From cc06c16791370c5d0474e3ba2f71113ef7bc7301 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Tue, 10 Jul 2018 22:28:35 +0200 Subject: [PATCH 001/125] Add cleaning cluster nodes --- .../installation/removing-rancher/_index.md | 12 ++ .../cleaning-cluster-nodes/_index.md | 186 ++++++++++++++++++ 2 files changed, 198 insertions(+) create mode 100644 content/rancher/v2.x/en/installation/removing-rancher/_index.md create mode 100644 content/rancher/v2.x/en/installation/removing-rancher/cleaning-cluster-nodes/_index.md diff --git a/content/rancher/v2.x/en/installation/removing-rancher/_index.md b/content/rancher/v2.x/en/installation/removing-rancher/_index.md new file mode 100644 index 00000000000..3a9f7d56271 --- /dev/null +++ b/content/rancher/v2.x/en/installation/removing-rancher/_index.md @@ -0,0 +1,12 @@ +--- +title: Removing Rancher +weight: 375 +--- + +This section contains instructions on how to remove Rancher or nodes added to clusters. + +Choose from the following options: + +- [Cleaning cluster nodes]({{< baseurl >}}/rancher/v2.x/en/installation/removing-rancher/cleaning-cluster-nodes) + + In this section, you can find steps to clean nodes that have been added to clusters created in Rancher. diff --git a/content/rancher/v2.x/en/installation/removing-rancher/cleaning-cluster-nodes/_index.md b/content/rancher/v2.x/en/installation/removing-rancher/cleaning-cluster-nodes/_index.md new file mode 100644 index 00000000000..29fda3d5053 --- /dev/null +++ b/content/rancher/v2.x/en/installation/removing-rancher/cleaning-cluster-nodes/_index.md @@ -0,0 +1,186 @@ +--- +title: Cleaning cluster nodes +weight: 375 +--- +When adding a node to a cluster, resources (containers/(virtual) network interfaces) and configuration items (certificates/configuration files) are created. When removing a node from a cluster (if it is in `Active` state), those resources will be automatically cleaned and the only action needed is to restart the node. When a node has become unreachable and the automatic cleanup process cannot be used, we describe the steps that need to be executed before the node can be added to a cluster again. + +## Removing a node from a cluster via Rancher UI + +When the node is in `Active` state, removing the node from a cluster will trigger a process to clean up the node. Please restart the node after the automatic cleanup process is done to make sure any non-persistent data is properly removed. + +* How to restart a node + +``` +# using reboot +reboot + +# using shutdown +shutdown -r now +``` + +## Cleaning a node manually + +When a node is unreachable and removed from the cluster, the automatic cleaning process can't be triggered because the node is unreachable. Please follow the steps below to manually clean the node. + +>**Warning:** The commands listed below will remove data from the node. Make sure you have created a backup of files you want to keep before executing any of the commands as data will be lost. + +### Docker containers, images and volumes + +Based on what role you assigned to the node, Kubernetes components in containers, containers belonging to overlay networking, DNS, ingress controller and Rancher agent. (and pods you created that have been scheduled to this node) + +* How to clean all Docker containers, images and volumes: + +``` +docker rm -f $(docker ps -qa) +docker rmi -f $(docker images -q) +docker volume rm $(docker volume ls -q) +``` + +### Mounts + +Kubernetes components and secrets leave behind mounts on the system that need to be unmounted. + +Mounts | +--------| +`/var/lib/kubelet/pods/XXX` (miscellaneous mounts) | +`/var/lib/kubelet` | +`/var/lib/rancher` | + +* How to unmount all mounts: + +``` +for mount in $(mount | grep tmpfs | grep '/var/lib/kubelet' | awk '{ print $3 }') /var/lib/kubelet /var/lib/rancher; do umount $mount; done +``` + +### Directories and files + +The following directories are used when adding a node to a cluster, and should be removed. You can remove a directory using `rm -rf /directory_name`. + +>**Note:** Depending on the role you assigned to the node, some of the directories will or won't be present on the node. + +Directories | +--------| +`/etc/ceph` | +`/etc/cni` | +`/etc/kubernetes` | +`/opt/cni` | +`/opt/rke` | +`/run/secrets/kubernetes.io` | +`/run/calico` | +`/run/flannel` | +`/var/lib/calico` | +`/var/lib/etcd` | +`/var/lib/cni` | +`/var/lib/kubelet` | +`/var/lib/rancher` | +`/var/log/containers` | +`/var/log/pods` | +`/var/run/calico` | + +* How to clean the directories: + +``` +rm -rf /etc/ceph \ + /etc/cni \ + /etc/kubernetes \ + /opt/cni \ + /opt/rke \ + /run/secrets/kubernetes.io \ + /run/calico \ + /run/flannel \ + /var/lib/calico \ + /var/lib/etcd \ + /var/lib/cni \ + /var/lib/kubelet \ + /var/lib/rancher \ + /var/log/containers \ + /var/log/pods \ + /var/run/calico +``` + +### Network interfaces and iptables + +The remaining two components that are changed/configured are (virtual) network interfaces and iptables rules. Both are non-persistent to the node, meaning that they will be cleared after a restart of the node. + +This is the recommended method. + +* How to restart a node + +``` +# using reboot +reboot + +# using shutdown +shutdown -r now +``` + +If you want to know more on (virtual) network interfaces or iptables rules, please see the specific subjects below. + +### Network interfaces + +>**Note:** Depending on the network provider configured for the cluster the node was part of, some of the interfaces will or won't be present on the node. + +Interfaces | +--------| +`flannel.1` | +`cni0` | +`tunl0` | +`caliXXXXXXXXXXX` (random interface names) | +`vethXXXXXXXX` (random interface names) | + +* How to list all interfaces: + +``` +# Using ip +ip address show + +# Using ifconfig +ifconfig -a +``` + +* How to remove an interface: + +``` +ip link delete interface_name +``` + +### Iptables + +>**Note:** Depending on the network provider configured for the cluster the node was part of, some of the chains will or won't be present on the node. + +Iptables rules are used to route traffic from and to containers. The created rules are not persistent, so restarting the node will restore iptables to it's original state. + +Chains | +--------| +`cali-failsafe-in` | +`cali-failsafe-out` | +`cali-fip-dnat` | +`cali-fip-snat` | +`cali-from-hep-forward` | +`cali-from-host-endpoint` | +`cali-from-wl-dispatch` | +`cali-fw-caliXXXXXXXXXXX` (random chain names) | +`cali-nat-outgoing` | +`cali-pri-kns.NAMESPACE` (chain per namespace) | +`cali-pro-kns.NAMESPACE` (chain per namespace) | +`cali-to-hep-forward` | +`cali-to-host-endpoint` | +`cali-to-wl-dispatch` | +`cali-tw-caliXXXXXXXXXXX` (random chain names) | +`cali-wl-to-host` | +`KUBE-EXTERNAL-SERVICES` | +`KUBE-FIREWALL` | +`KUBE-MARK-DROP` | +`KUBE-MARK-MASQ` | +`KUBE-NODEPORTS` | +`KUBE-SEP-XXXXXXXXXXXXXXXX` (random chain names) | +`KUBE-SERVICES` | +`KUBE-SVC-XXXXXXXXXXXXXXXX` (random chain names) | + +* How to list all iptables rules + +``` +iptables -L -t nat +iptables -L -t mangle +iptables -L +``` From 2f666cf1c96f17edb79ca8f8fadd99b69af75400 Mon Sep 17 00:00:00 2001 From: lvuch Date: Thu, 12 Jul 2018 15:05:21 -0700 Subject: [PATCH 002/125] index for sub pages --- .../backups/single-node-backups/_index.md | 2 +- .../authentication/active-directory/_index.md | 1 + layouts/_default/list.html | 68 +++---------------- layouts/partials/docs-side-nav.html | 1 + layouts/partials/page-nav.html | 14 ++-- src/sass/app.scss | 32 +++++++++ 6 files changed, 54 insertions(+), 64 deletions(-) diff --git a/content/rancher/v2.x/en/backups/backups/single-node-backups/_index.md b/content/rancher/v2.x/en/backups/backups/single-node-backups/_index.md index b5de34092ee..b74d492b3cd 100644 --- a/content/rancher/v2.x/en/backups/backups/single-node-backups/_index.md +++ b/content/rancher/v2.x/en/backups/backups/single-node-backups/_index.md @@ -34,4 +34,4 @@ docker create --volumes-from \ docker start ``` -**Result:** A backup of your Rancher Server is created. If you ever need to restore your backup, see [Restoring Backups: Single Node Installs]({{< baseurl >}}/rancher/v2.x/en/upgrades/restorations/single-node-restoration). \ No newline at end of file +**Result:** A backup of your Rancher Server is created. If you ever need to restore your backup, see [Restoring Backups: Single Node Installs]({{< baseurl >}}/rancher/v2.x/en/upgrades/restorations/single-node-restoration). diff --git a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md index c79513802ca..6f0449cc95a 100644 --- a/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md +++ b/content/rancher/v2.x/en/tasks/global-configuration/authentication/active-directory/_index.md @@ -1,5 +1,6 @@ --- title: Configuring Active Directory (AD) +description: Enterprises can use Active Directory (AD) for authentication, allowing users to sign in using their corporate credentials. weight: 51 --- diff --git a/layouts/_default/list.html b/layouts/_default/list.html index 817bfdccd56..7a948592078 100644 --- a/layouts/_default/list.html +++ b/layouts/_default/list.html @@ -18,68 +18,20 @@ {{ with .Params.Title }}

{{ . }}

-
{{end}} - + {{ with .Params.Description }} +

{{ . }}

+ {{end}} +
- - - + {{ .Content }} +
- {{ .Content }} + + {{ partial "page-nav.html" . }} + - {{ range (.Paginator 5).Pages }} -
-
-

{{.Title}}

- - {{ if .Params.Image }} -
{{ .Params.Title }}
- {{end}} - -

{{ .Summary | safeHTML }}

- {{ if .Truncated }} - - {{ end }} -
-
-
- - {{ with .Params.Author }} -
person_outline By: {{ . }}
- {{end}} - - {{ if eq .Section "events" }} - {{ with .Params.EventDate }} -
event {{ . }}
- {{end}} - - {{ else }} - - {{ with .Params.Date }} -
event {{ .Format "January 2, 2006" }}
- {{end}} - {{end}} - - {{ if eq .Section "blog" }} -
timer Read Time: {{.ReadingTime}} minutes
- {{end}} - - {{ with .Params.Location }} -
location_on {{ . }}
- {{end}} - -
-
-
- {{ end }} - - {{ template "_internal/pagination.html" . }} - - -
{{ partial "page-edit.html" . }}
+
{{ partial "page-edit.html" . }}
+ {{ template "_internal/pagination.html" . }} + + +
{{ partial "page-edit.html" . }}
{{ define "page-nav" }} {{ range .Sections}} -
  • - {{ .Title }} - {{ with .Params.Description }} -

    {{ . }}

    - {{end}} +
  • {{ .Title }} {{if gt (len .Sections) 0}} -
      +
        {{ range .Pages }}
      • {{ .Title }}
        • {{ end }} {{ template "page-nav" . }} -
    + {{end}}
    • {{ end }} diff --git a/src/sass/app.scss b/src/sass/app.scss index 79a7ade2061..f55845b9e5e 100644 --- a/src/sass/app.scss +++ b/src/sass/app.scss @@ -125,39 +125,3 @@ transform: rotateX(180deg); } } - -.page-nav { - > ol { - column-count: 4; - column-gap: $spacer-xs; - } - ol { - padding: 0; - list-style: none; - counter-reset: item; - font-size: 1rem; - } - ol li { - display: block; - padding-left: $spacer-xs; - } - ol li:before { - display: inline-block; - margin-left: -$spacer-xs; - margin-right: .5em; - text-align: center; - content: counters(item, ".") "."; - counter-increment: item; - } - ol ol { - width: auto; - margin: 0; - padding: .5em 0; - } - ol li li:before { - content: counters(item, ".") " "; - } - ol ol ol { - padding: .5em 0 0; - } -} From 4b8c3b593611ba73f12f9111007bf1cc3a14b0c5 Mon Sep 17 00:00:00 2001 From: Ahmad E Date: Mon, 23 Jul 2018 22:47:10 -0700 Subject: [PATCH 039/125] fixing busted link fixed broken link for rke --- .../rancher/v2.x/en/cluster-provisioning/rke-clusters/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/_index.md index 8c8e39b8772..5a4ed12c0eb 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/_index.md @@ -3,7 +3,7 @@ title: Rancher Launched Kubernetes weight: 2200 --- -If you don't want to use a hosted Kubernetes provider, you can have Rancher launch a Kubernetes cluster using any nodes you want. When Rancher deploys Kubernetes onto these nodes, it uses Rancher Kubernetes Engine]({{< baseurl >}}/rke/v0.1.x/en/) (RKE), which is Rancher's own lightweight Kubernetes installer. It can launch Kubernetes on any computers, including: +If you don't want to use a hosted Kubernetes provider, you can have Rancher launch a Kubernetes cluster using any nodes you want. When Rancher deploys Kubernetes onto these nodes, it uses [Rancher Kubernetes Engine]({{< baseurl >}}/rke/v0.1.x/en/) (RKE), which is Rancher's own lightweight Kubernetes installer. It can launch Kubernetes on any computers, including: - Bare-metal servers - On-premise virtual machines From 178b369d3164445924a26d1bc0ff3dca5f5133d0 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Tue, 24 Jul 2018 17:18:58 +0200 Subject: [PATCH 040/125] More clarification on proxy usage --- .../proxy-configuration/_index.md | 34 ++++++++----------- 1 file changed, 15 insertions(+), 19 deletions(-) diff --git a/content/rancher/v2.x/en/installation/proxy-configuration/_index.md b/content/rancher/v2.x/en/installation/proxy-configuration/_index.md index 4656ad38022..0da3fd4aaf8 100644 --- a/content/rancher/v2.x/en/installation/proxy-configuration/_index.md +++ b/content/rancher/v2.x/en/installation/proxy-configuration/_index.md @@ -2,29 +2,25 @@ title: Rancher HTTP Proxy Configuration weight: 360 --- -If you operate Rancher behind a proxy and you need to reach the Internet to perform tasks (such as using Helm catalogs), you must provide Rancher information about your proxy. +If you operate Rancher behind a proxy and you need to reach the Internet to perform tasks (such as using Helm catalogs), you must provide Rancher information about your proxy. As Rancher is written in Go, it uses the common proxy environment variables as shown below. -### Setting the `http_proxy` Environment Variable +* Make sure `NO_PROXY` contains the network ranges that should be accessed without the proxy configuration. This should include `localhost`, `127.0.0.1`, `0.0.0.0`, all your local network ranges that are accessible without a proxy. -#### Ubuntu +Environment variable | Example value +---------------------|---------------- +HTTP_PROXY | `http://10.0.0.1:3128` +HTTPS_PROXY | `http://10.0.0.1:3128` +NO_PROXY | `localhost,127.0.0.1,0.0.0.0,` -1. Check if `http_proxy` is still defined: +## Start Rancher Container with Proxy Information - ``` -echo $http_proxy - ``` - - If it is empty, set the variable and store it in your account's environment using the following command: - - ``` -echo "export http_proxy=http://:@:/" >> .profile - ``` -2. Logout and then log back in to activate your changes. - -### Start Rancher Container with Proxy Information - -Ensure that your `http_proxy` environment variable is visible inside of Rancher's Docker container: +Passing environment variables to the Rancher container can be done using `-e KEY=VALUE` or `--env KEY=VALUE`. The example below is based on a local network range of `10.0.0.0/8`. ``` -sudo docker run -d --restart=unless-stopped --volumes-from rancher-data -p 80:80 -p 443:443 -e HTTP_PROXY=$http_proxy -e HTTPS_PROXY=$http_proxy -e http_proxy=$http_proxy -e https_proxy=$http_proxy -e NO_PROXY="localhost,127.0.0.1" -e no_proxy="localhost,127.0.0.1" rancher/rancher +docker run -d --restart=unless-stopped \ + -p 80:80 -p 443:443 \ + -e HTTP_PROXY="http://10.0.0.1:3128" \ + -e HTTPS_PROXY="http://10.0.0.1:3128" \ + -e NO_PROXY="localhost,127.0.0.1,0.0.0.0,10.0.0.0/8" \ + rancher/rancher:latest ``` From be82ae9c6713e519eceb68a00eb2a4d99af25c6b Mon Sep 17 00:00:00 2001 From: niusmallnan Date: Tue, 24 Jul 2018 23:23:17 +0800 Subject: [PATCH 041/125] Update docker-sys bridge IP address --- .../v1.x/en/installation/configuration/docker/_index.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/content/os/v1.x/en/installation/configuration/docker/_index.md b/content/os/v1.x/en/installation/configuration/docker/_index.md index 050560b15f6..33eddaefdba 100644 --- a/content/os/v1.x/en/installation/configuration/docker/_index.md +++ b/content/os/v1.x/en/installation/configuration/docker/_index.md @@ -93,6 +93,14 @@ Key | Value | Default | Description `extra_args` | List of Strings | `[]` | Arbitrary daemon arguments, appended to the generated command `environment` | List of Strings (optional) | `[]` | +_Available as of v1.4_ + +The docker-sys bridge can be configured with system-docker args, it will take effect after reboot. + +``` +$ ros config set rancher.system_docker.bip 172.18.43.1/16 +``` + ### Using a pull through registry mirror There are 3 Docker engines that can be configured to use the pull-through Docker Hub registry mirror cache: From 32d20b6f7d8c13266edbfe871b18448dc0714230 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Tue, 24 Jul 2018 12:46:11 -0700 Subject: [PATCH 042/125] fixed most broken links --- .../ha-server-install-external-lb/_index.md | 8 ++++---- .../v2.x/en/installation/ha-server-install/_index.md | 10 +++++----- .../en/installation/ha-server-install2/_index.md | 12 ++++++------ .../single-node-install-external-lb/_index.md | 4 ++-- .../en/installation/single-node-install/_index.md | 2 +- .../v2.x/en/upgrades/single-node-upgrade/_index.md | 2 +- 6 files changed, 19 insertions(+), 19 deletions(-) diff --git a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md index 2c44d75a711..3b97214f35b 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install-external-lb/_index.md @@ -29,7 +29,7 @@ Installation of Rancher in a high-availability configuration involves multiple p [RKE](https://github.com/rancher/rke/releases) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. -5. [Download RKE Config File Template](#5-download-config-file-template) +5. [Download RKE Config File Template](#5-download-rke-config-file-template) RKE uses a YAML config file to install and configure your Kubernetes cluster. Download one of our RKE config file templates to get started. @@ -145,7 +145,7 @@ RKE is a fast, versatile Kubernetes installer that you can use to install Kubern 2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run one of the commands below. >**Using Windows?** - >The file is already an executable. Skip to [Download Config File Template](#5-download-config-file-template). + >The file is already an executable. Skip to [Download RKE Config File Template](#5-download-rke-config-file-template). ``` # MacOS @@ -185,7 +185,7 @@ Once you have the `rancher-cluster.yml` config file template, edit the nodes sec 1. Open `rancher-cluster.yml` in your favorite text editor. -2. Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts). +2. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts). For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`. @@ -258,7 +258,7 @@ If you are using a Certificate Signed By A Recognized Certificate Authority, you ## 8. Configure FQDN -There is one reference to `` in the RKE config file. Replace this reference with the FQDN you chose in in [3. Configure DNS](#part-3-configure-dns). +There is one reference to `` in the RKE config file. Replace this reference with the FQDN you chose in in [3. Configure DNS](#3-configure-dns). 1. Open `rancher-cluster.yml`. diff --git a/content/rancher/v2.x/en/installation/ha-server-install/_index.md b/content/rancher/v2.x/en/installation/ha-server-install/_index.md index d4eecdcdc1d..dfb67c355d3 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install/_index.md @@ -29,7 +29,7 @@ Installation of Rancher in a high-availability configuration involves multiple p [RKE](https://github.com/rancher/rke/releases) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. -5. [Download RKE Config File Template](#5-download-config-file-template) +5. [Download RKE Config File Template](#5-download-rke-config-file-template) RKE uses a YAML config file to install and configure your Kubernetes cluster. Download one of our RKE config file templates to get started. @@ -236,7 +236,7 @@ Once you have the `rancher-cluster.yml` config file template, edit the nodes sec 1. Open `rancher-cluster.yml` in your favorite text editor. -2. Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts). +2. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts). For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. The specified user should be able to access the Docket socket, you can test this by logging in with the specified user and run `docker ps`. @@ -327,9 +327,9 @@ Choose from the following options: ### Option Bā€”Bring Your Own Certificate: Signed by Recognized CA >**Note:** -> If you are using Self Signed Certificate, [click here](#option-a-self-signed-certificate) to proceed. +> If you are using Self Signed Certificate, [click here](#option-a-bring-your-own-certificate-self-signed) to proceed. -If you are using a Certificate Signed By A Recognized Certificate Authority, you will need to generate a base64 encoded string for the Certificate file and the Certificate Key file. Make sure that your certificate file includes all the [intermediate certificates](#ssl-faq-troubleshooting) in the chain, the order of certificates in this case is first your own certificate, followed by the intermediates. Please refer to the documentation of your CSP (Certificate Service Provider) to see what intermediate certificate(s) need to be included. +If you are using a Certificate Signed By A Recognized Certificate Authority, you will need to generate a base64 encoded string for the Certificate file and the Certificate Key file. Make sure that your certificate file includes all the [intermediate certificates](#cert-order) in the chain, the order of certificates in this case is first your own certificate, followed by the intermediates. Please refer to the documentation of your CSP (Certificate Service Provider) to see what intermediate certificate(s) need to be included. In the `kind: Secret` with `name: cattle-keys-ingress`: @@ -432,7 +432,7 @@ During installation, RKE automatically generates a config file named `kube_confi You have a couple of options: - Create a backup of your Rancher Server in case of a disaster scenario: [High Availablility Back Up and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration). -- Create a Kubernetes cluster: [Creating a Cluster]({{< baseurl >}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/). +- Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/).
    diff --git a/content/rancher/v2.x/en/installation/ha-server-install2/_index.md b/content/rancher/v2.x/en/installation/ha-server-install2/_index.md index 39b2eb1c572..c936195f38a 100644 --- a/content/rancher/v2.x/en/installation/ha-server-install2/_index.md +++ b/content/rancher/v2.x/en/installation/ha-server-install2/_index.md @@ -30,7 +30,7 @@ Installation of Rancher in a high-availability configuration involves multiple p [RKE](https://github.com/rancher/rke/releases) is a fast, versatile Kubernetes installer that you can use to install Kubernetes on your Linux hosts. -5. [Download RKE Config File Template](#5-download-config-file-template) +5. [Download RKE Config File Template](#5-download-rke-config-file-template) RKE uses a YAML config file to install and configure your Kubernetes cluster. Download one of our RKE config file templates to get started. @@ -201,7 +201,7 @@ RKE is a fast, versatile Kubernetes installer that you can use to install Kubern 2. Make the RKE binary that you just downloaded executable. Open Terminal, change directory to the location of the RKE binary, and then run one of the commands below. >**Using Windows?** - >The file is already an executable. Skip to [Download Config File Template](#5-download-config-file-template). + >The file is already an executable. Skip to [Download RKE Config File Template](#5-download-rke-config-file-template). ``` # MacOS @@ -241,7 +241,7 @@ Once you have the `rancher-cluster.yml` config file template, edit the nodes sec 1. Open `rancher-cluster.yml` in your favorite text editor. -2. Update the `nodes` section with the information of your [Linux hosts](#provision-linux-hosts). +2. Update the `nodes` section with the information of your [Linux hosts](#1-provision-linux-hosts). For each node in your cluster, update the following placeholders: `IP_ADDRESS_X` and `USER`. @@ -328,9 +328,9 @@ Choose from the following options: ### Option Bā€”Bring Your Own Certificate: Signed by Recognized CA >**Note:** -> If you are using Self Signed Certificate, [click here](#option-a-self-signed-certificate) to proceed. +> If you are using Self Signed Certificate, [click here](#option-a-bring-your-own-certificate-self-signed) to proceed. -If you are using a Certificate Signed By A Recognized Certificate Authority, you will need to generate a base64 encoded string for the Certificate file and the Certificate Key file. Make sure that your certificate file includes all the [intermediate certificates](#ssl-faq-troubleshooting) in the chain, the order of certificates in this case is first your own certificate, followed by the intermediates. Please refer to the documentation of your CSP (Certificate Service Provider) to see what intermediate certificate(s) need to be included. +If you are using a Certificate Signed By A Recognized Certificate Authority, you will need to generate a base64 encoded string for the Certificate file and the Certificate Key file. Make sure that your certificate file includes all the [intermediate certificates](#cert-order) in the chain, the order of certificates in this case is first your own certificate, followed by the intermediates. Please refer to the documentation of your CSP (Certificate Service Provider) to see what intermediate certificate(s) need to be included. In the `kind: Secret` with `name: cattle-keys-ingress`: @@ -449,7 +449,7 @@ By default, Rancher automatically generates self-signed certificates for itself You have a couple of options: - Create a backup of your Rancher Server in case of a disaster scenario: [High Availablility Back Up and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/ha-backup-and-restoration). -- Create a Kubernetes cluster: [Creating a Cluster]({{ }}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/). +- Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/).
    diff --git a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md index 2c3414f7395..24e05fcf619 100644 --- a/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install-external-lb/_index.md @@ -75,7 +75,7 @@ If you elect to use a self-signed certificate to encrypt communication, you must >**Prerequisites:** >Create a self-signed certificate. > ->- The certificate files must be in [PEM format](#ssl-faq-troubleshooting). +>- The certificate files must be in [PEM format](#pem). **To Install Rancher Using a Self-Signed Cert:** @@ -176,7 +176,7 @@ server { You have a couple of options: - Create a backup of your Rancher Server in case of a disaster scenario: [Single Node Backup and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/single-node-backup-and-restoration/). -- Create a Kubernetes cluster: [Creating a Cluster]({{< baseurl >}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/). +- Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/).
    diff --git a/content/rancher/v2.x/en/installation/single-node-install/_index.md b/content/rancher/v2.x/en/installation/single-node-install/_index.md index 05a6f2e5cd5..c9d505d1254 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install/_index.md @@ -172,7 +172,7 @@ Run the following commands from your Linux host. You have a couple of options: - Create a backup of your Rancher Server in case of a disaster scenario: [Single Node Backup and Restoration]({{< baseurl >}}/rancher/v2.x/en/installation/backups-and-restoration/single-node-backup-and-restoration/). -- Create a Kubernetes cluster: [Creating a Cluster]({{< baseurl >}}/rancher/v2.x/en/tasks/clusters/creating-a-cluster/). +- Create a Kubernetes cluster: [Provisioning Kubernetes Clusters]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/).
    diff --git a/content/rancher/v2.x/en/upgrades/single-node-upgrade/_index.md b/content/rancher/v2.x/en/upgrades/single-node-upgrade/_index.md index 853dd5d4f1e..ed4a2bf8c8d 100644 --- a/content/rancher/v2.x/en/upgrades/single-node-upgrade/_index.md +++ b/content/rancher/v2.x/en/upgrades/single-node-upgrade/_index.md @@ -67,4 +67,4 @@ docker run -d --volumes-from rancher-data --restart=unless-stopped \ **Result:** Rancher Server is upgraded to the latest version. ->**Note:** If your upgrade does not complete successfully, you can roll Rancher Server and its data back to its last healthy state. For more information, see [Restoring Backupsā€”Single Node Installs]({{< baseurl >}}/rancher/v2.x/en/upgrades/restorations/single-node-restoration/). +>**Note:** If your upgrade does not complete successfully, you can roll Rancher Server and its data back to its last healthy state. For more information, see [Restoring Backupsā€”Single Node Installs]({{< baseurl >}}/rancher/v2.x/en/backups/restorations/single-node-restoration/). From c6a369a88e7dce60e0946c509d9027e7e0a6245e Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Tue, 24 Jul 2018 12:53:13 -0700 Subject: [PATCH 043/125] link fix --- content/rancher/v2.x/en/upgrades/single-node-upgrade/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/upgrades/single-node-upgrade/_index.md b/content/rancher/v2.x/en/upgrades/single-node-upgrade/_index.md index ed4a2bf8c8d..9889727cd61 100644 --- a/content/rancher/v2.x/en/upgrades/single-node-upgrade/_index.md +++ b/content/rancher/v2.x/en/upgrades/single-node-upgrade/_index.md @@ -43,7 +43,7 @@ docker pull rancher/rancher:latest ``` >**Attention Air Gap Users:** - > If you are visiting this page to complete [Air Gap Upgrade]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrade-scenarios/air-gap-upgrade/), prepend your private registry URL to the image when running the `docker run` command. + > If you are visiting this page to complete [Air Gap Upgrade]({{< baseurl >}}/rancher/v2.x/en/upgrades/air-gap-upgrade), prepend your private registry URL to the image when running the `docker run` command. > > Example: `/rancher/rancher:latest` > From 8348264a1b90341d39b6cb2c853630eb2ae21538 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Tue, 24 Jul 2018 12:56:37 -0700 Subject: [PATCH 044/125] fixed broken links in shortcodes --- layouts/shortcodes/note_server-tags.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/layouts/shortcodes/note_server-tags.html b/layouts/shortcodes/note_server-tags.html index 24d5b5aba51..82aa0aaabcf 100644 --- a/layouts/shortcodes/note_server-tags.html +++ b/layouts/shortcodes/note_server-tags.html @@ -1,8 +1,8 @@

    Note:

    -

    The rancher/rancher container is hosted on DockerHub. If you don't have access to DockerHub, or you are installing Rancher without an Internet connection, refer to Air Gap Installation.

    +

    The rancher/rancher container is hosted on DockerHub. If you don't have access to DockerHub, or you are installing Rancher without an Internet connection, refer to Air Gap Installation.

    Note:

    -

    For a list of other Rancher Server tags available, refer to Rancher Server Tags.

    +

    For a list of other Rancher Server tags available, refer to Rancher Server Tags.

    From ff90103dd1491a0de023c838ca31f4368f79d5a2 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Tue, 24 Jul 2018 13:34:52 -0700 Subject: [PATCH 045/125] correct url, but the autolink should be removed. inserted tag to cancel autolink --- .../v2.x/en/admin-settings/authentication/azure-ad/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/admin-settings/authentication/azure-ad/_index.md b/content/rancher/v2.x/en/admin-settings/authentication/azure-ad/_index.md index 5fefc106cac..3329ee951a5 100644 --- a/content/rancher/v2.x/en/admin-settings/authentication/azure-ad/_index.md +++ b/content/rancher/v2.x/en/admin-settings/authentication/azure-ad/_index.md @@ -171,9 +171,9 @@ Enter the values that you copied to your [text file](#tip). >**Important:** When entering your Graph Endpoint, remove the tenant ID from the URL, like below. > - >https://graph.windows.net/abb5adde-bee8-4821-8b03-e63efdc7701c + >https://graph.windows.net/abb5adde-bee8-4821-8b03-e63efdc7701c - The following table maps the values you copied in the Azure portal to the fields in Rancher. ~~~~ + The following table maps the values you copied in the Azure portal to the fields in Rancher. Rancher Field | Azure Value ---------|---------- From 2a630724ba445276d2ec96e22d3d972834591328 Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Tue, 24 Jul 2018 13:35:33 -0700 Subject: [PATCH 046/125] first instance of the link is a redundant mistake. Removing --- .../v2.x/en/admin-settings/pod-security-policies/_index.md | 1 - 1 file changed, 1 deletion(-) diff --git a/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index.md b/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index.md index 6e6032881ea..103dfd9db32 100644 --- a/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index.md +++ b/content/rancher/v2.x/en/admin-settings/pod-security-policies/_index.md @@ -44,7 +44,6 @@ Using Rancher, you can create a Pod Security Policy using our GUI rather than cr - [Volume Policy][1] - [Allowed Host Paths Policy][1] - [FS Group Policy][1] - - [Run As User Policy][1] - [Host Ports Policy][2] - [Run As User Policy][3] - [SELinux Policy](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#selinux) From e713ffaf76b1d7b47206c3d971cf3d375525b3de Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Mon, 23 Jul 2018 17:09:41 -0700 Subject: [PATCH 047/125] cleaned up formatting --- .../volumes-and-storage/_index.md | 43 +++++++++---------- 1 file changed, 21 insertions(+), 22 deletions(-) diff --git a/content/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/_index.md b/content/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/_index.md index d390e2dd108..9e4a90d8fa1 100644 --- a/content/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/_index.md +++ b/content/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/_index.md @@ -5,29 +5,28 @@ aliases: - /rancher/v2.x/en/concepts/volumes-and-storage/ - /rancher/v2.x/en/tasks/clusters/adding-storage/ --- -There are two ways to create volumes on Kubernetes: Persistent Volumes (PVs) and Storage Classes. +When deploying an application that needs to retain data, you'll need to create persistent storage. Persistent storage allows you to store application data external from the pod running your application. This storage practice allows you to maintain application data, even if the application's pod fails. + +There are two ways to create persistent storage in Kubernetes: Persistent Volumes (PVs) and Storage Classes. ## Persistent Volumes -_Persistent Volumes_ are pre-provisioned storage volumes that you can bind to specific pods later. For example, in Amazon EC2, you might want to create a number of Elastic Block Store (EBS) volumes before you start running your application. Each pre-provisioned EBS volume corresponds to a Kubernetes persistent volume. When the application starts, it creates Persistent Volume Claims (PVCs) that bind to persistent volumes. A PVC corresponds to a Docker volume. Each PVC binds to one PV that includes the minimum resources that the PVC requires. The following figure illustrates the relationship between pods, PVCs, PVs, and the underlying cloud storage. +_Persistent Volumes_ are pre-provisioned storage volumes that you can bind to pods later. For example, in Amazon EC2, you might want to create a number of Elastic Block Store (EBS) volumes before you start running your application. Each pre-provisioned EBS volume corresponds to a Kubernetes persistent volume. When the application starts, it creates Persistent Volume Claims (PVCs) that bind to persistent volumes. A PVC corresponds to a Docker volume. Each PVC binds to one PV that includes the minimum resources that the PVC requires. The following figure illustrates the relationship between pods, PVCs, PVs, and the underlying cloud storage. ![Persistent Volumes]({{< baseurl >}}/img/rancher/persistent-volume.png) -Rancher allows you to create PVs at cluster level and bind them to PVCs later. Volumes are managed on a per-project basis. +Rancher allows you to create PVs at the cluster level and bind them to PVCs later. Volumes are managed on a per-project basis. ### Adding a Persistent Volume ->**Prerequisites:** -> ->- Working with storage requires the `Manage Volumes` [role]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-role-reference). ->- You must have a storage medium provisioned. For more information, see [Provisioning Storage]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/examples/). - Your containers can store data on themselves, but if a container fails, that data is lost. To solve this issue, Kubernetes offers _persistent volumes_, which are external storage disks or file systems that your containers can access. If a container crashes, its replacement container can access the data in a persistent volume without any data loss. Persistent volumes can either be a disk or file system that you host on premise, or they can be hosted by a vendor, such as Amazon EBS or Azure Disk. ->**Prerequisite:** +>**Prerequisites:** > +>- Working with storage requires the `Manage Volumes` [role]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#project-role-reference). +>- You must have a storage medium provisioned. For more information, see [Provisioning Storage]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/volumes-and-storage/examples/). >- Create a storage volume either on premise or in the cloud, using one of the vendor services listed in [Types of Persistent Volumes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#types-of-persistent-volumes). >- Gather metadata about your storage volume after you create it. You'll need to enter this information into Rancher. @@ -41,10 +40,10 @@ Persistent volumes can either be a disk or file system that you host on premise, 1. Select the **Volume Plugin** for the disk type or service that you're using. - >**Note:** If the cluster you are adding storage for is a cloud service that also offers cloud storage, you must enable the `cloud provider` option for the cluster, and you must use the service's plug-in to use cloud storage. For example, if you have a Amazon EC2 cluster and you want to use cloud storage for it: - - 1. You must enable the `cloud provider` option for the EC2 cluster. - 2. You must use the `Amazon EBS Disk` volume plugin. + >**Note:** If the cluster you are adding storage for is a cloud service that also offers cloud storage, you must enable the `cloud provider` option for the cluster, and you must use the service's plug-in to use cloud storage. For example, if you have a Amazon EC2 cluster and you want to use cloud storage for it: + > + > - You must enable the `cloud provider` option for the EC2 cluster. + > - You must use the `Amazon EBS Disk` volume plugin. 1. Enter the **Capacity** of your volume in gigabytes. @@ -80,8 +79,9 @@ Storage Classes allow you to create PVCs dynamically without having to create PV Each storage class contains the fields `provisioner`, `parameters`, and `reclaimPolicy`, which are used when a persistent volume that belongs to the class needs to be dynamically provisioned. -The `provisioner` determines which volume plugin is used to provision the persistent volumes. You can define storage classes for the following provisioners: +The `provisioner` determines which volume plugin is used to provision the persistent volumes. +{{% accordion id="provisioners" label="Supported Storage Class Provisioners" %}} - Amazon EBS Disk - AzureFile - AzureDisk @@ -95,6 +95,8 @@ The `provisioner` determines which volume plugin is used to provision the persis - ScaleIO Volume - StorageOS - Vmware vSphere Volume +{{% /accordion %}} +
    In addition to customizing each provisioner's options for the storage class, you can also define the volume `reclaimPolicy`. There are two options available: @@ -117,11 +119,10 @@ _Storage Classes_ allow you to dynamically provision persistent volumes on deman 1. From the `Provisioner` drop-down, select the service that you want to use to dynamically provision storage volumes. - >**Note:** If the cluster you are adding a storage class for is a cloud service that also offers cloud storage, you must enable the `cloud provider` option for the cluster, and you must use the service's plug-in to use cloud storage. For example, if you have a Amazon EC2 cluster and you want to use cloud storage for it: - - 1. You must enable the `cloud provider` option for the EC2 cluster. - 2. You must use the `Amazon EBS Disk` provisioner. - + >**Note:** If the cluster you are adding a storage class for is a cloud service that also offers cloud storage, you must enable the `cloud provider` option for the cluster, and you must use the service's plug-in to use cloud storage. For example, if you have a Amazon EC2 cluster and you want to use cloud storage for it: + > + > - You must enable the `cloud provider` option for the EC2 cluster. + > - You must use the `Amazon EBS Disk` provisioner. 1. From the `Parameters` section, fill out the information required for the service to dynamically provision storage volumes. Each provisioner requires different information to dynamically provision storage volumes. Consult the service's documentation for help on how to obtain this information. @@ -138,6 +139,4 @@ You can mount Persistent Volumes in one of two contexts: ## Related Links -### External Docs - -- [Storage](https://kubernetes.io/docs/concepts/storage/) +- [Kubernetes Documentation: Storage](https://kubernetes.io/docs/concepts/storage/) From a99e37cb0892419867846c5e111ae79fe7ebb041 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Tue, 24 Jul 2018 23:49:17 +0200 Subject: [PATCH 048/125] Add --no-cacerts to single install without external LB --- .../en/installation/single-node-install/_index.md | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/content/rancher/v2.x/en/installation/single-node-install/_index.md b/content/rancher/v2.x/en/installation/single-node-install/_index.md index c9d505d1254..6e16cafbc2f 100644 --- a/content/rancher/v2.x/en/installation/single-node-install/_index.md +++ b/content/rancher/v2.x/en/installation/single-node-install/_index.md @@ -118,6 +118,7 @@ If you're publishing your app publicly, you should ideally be using a certificat > >- The certificate files must be in [PEM format](#pem). >- Make sure that the container includes your certificate file and the key file. Because your certificate is signed by a recognized CA, mounting an additional CA certificate file is unnecessary. +>- Add `--no-cacerts` as argument to the container to disable the default CA certificate generated by Rancher. **To Install Rancher Using a Certificate Signed by a Recognized CA:** @@ -128,17 +129,9 @@ If you're publishing your app publicly, you should ideally be using a certificat -p 80:80 -p 443:443 \ -v /etc/your_certificate_directory/fullchain.pem:/etc/rancher/ssl/cert.pem \ -v /etc/your_certificate_directory/privkey.pem:/etc/rancher/ssl/key.pem \ - rancher/rancher:latest + rancher/rancher:latest --no-cacerts ``` -By default, Rancher automatically generates self-signed certificates for itself after installation. However, since you've provided your own certificates, you must disable the certificates that Rancher generated for itself. - -**To Remove the Default Certificates:** - -1. Log into Rancher. -2. Select **Settings** > **cacerts**. -3. Choose `Edit` and remove the contents. Then click `Save`. - ### Option Dā€”Let's Encrypt Certificate Rancher supports Let's Encrypt certificates. Let's Encrypt uses an `http-01 challenge` to verify that you have control over your domain. You can confirm that you control the domain by pointing the hostname that you want to use for Rancher access (for example, `rancher.mydomain.com`) to the IP of the machine it is running on. You can bind the hostname to the IP address by creating an A record in DNS. From 89d5485c7d8e032966913c1afcfd88260141b1bd Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Tue, 24 Jul 2018 15:38:04 -0700 Subject: [PATCH 049/125] moving files --- .../img/rancher}/globalpermissionfinal.png | Bin .../img/rancher}/globalpermissionrole.png | Bin .../img/rancher}/globalpermissionuser.png | Bin .../vsphere => src/img/rancher}/rancherroles1.png | Bin .../vsphere => src/img/rancher}/rancherroles2.png | Bin .../vsphere => src/img/rancher}/rancheruser.png | Bin 6 files changed, 0 insertions(+), 0 deletions(-) rename {content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere => src/img/rancher}/globalpermissionfinal.png (100%) rename {content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere => src/img/rancher}/globalpermissionrole.png (100%) rename {content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere => src/img/rancher}/globalpermissionuser.png (100%) rename {content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere => src/img/rancher}/rancherroles1.png (100%) rename {content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere => src/img/rancher}/rancherroles2.png (100%) rename {content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere => src/img/rancher}/rancheruser.png (100%) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/globalpermissionfinal.png b/src/img/rancher/globalpermissionfinal.png similarity index 100% rename from content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/globalpermissionfinal.png rename to src/img/rancher/globalpermissionfinal.png diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/globalpermissionrole.png b/src/img/rancher/globalpermissionrole.png similarity index 100% rename from content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/globalpermissionrole.png rename to src/img/rancher/globalpermissionrole.png diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/globalpermissionuser.png b/src/img/rancher/globalpermissionuser.png similarity index 100% rename from content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/globalpermissionuser.png rename to src/img/rancher/globalpermissionuser.png diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/rancherroles1.png b/src/img/rancher/rancherroles1.png similarity index 100% rename from content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/rancherroles1.png rename to src/img/rancher/rancherroles1.png diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/rancherroles2.png b/src/img/rancher/rancherroles2.png similarity index 100% rename from content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/rancherroles2.png rename to src/img/rancher/rancherroles2.png diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/rancheruser.png b/src/img/rancher/rancheruser.png similarity index 100% rename from content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/rancheruser.png rename to src/img/rancher/rancheruser.png From cfa8e37e3f6e25ca292164e551bbe99e8131391a Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Tue, 24 Jul 2018 15:49:25 -0700 Subject: [PATCH 050/125] updating image links and fixing formatting. --- .../rke-clusters/node-pools/vsphere/_index.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/_index.md index 8576632ad4b..627685e3f30 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/_index.md @@ -17,24 +17,24 @@ Before setting up a cluster in vSphere, you must ensure that you have a user in 3. Create a new *Role*. Give it a name and select the **Datastore**, **Network**, **Resource**, and **Virtual machine** *privileges*. -![image](./rancherroles1.png) -![image](./rancherroles2.png) + ![image]({{< baseurl >}}/img/rancher/rancherroles1.png) + ![image]({{< baseurl >}}/img/rancher/rancherroles2.png) 4. Go to the **Users and Groups** tab. 5. Create a new *User*. Fill out the form and then click **ok**. Make sure to note the username and password as you will need it when creating a cluster in Rancher. -![image](./rancheruser.png) + ![image]({{< baseurl >}}/img/rancher/rancheruser.png) 6. Go to the **Global Permissions** tab. 7. Create a new *Global Permission*. Add the *User* you created earlier and assign it the Role you created earlier. Click **ok**. -![image](./globalpermissionuser.png) -![image](./globalpermissionrole.png) -![image](./globalpermissionfinal.png) + ![image]({{< baseurl >}}/img/rancher/globalpermissionuser.png) + ![image]({{< baseurl >}}/img/rancher/globalpermissionrole.png) + ![image]({{< baseurl >}}/img/rancher/globalpermissionfinal.png) -Now you have a user that is able to successfully create and manager Rancher clusters in vSphere. +**Result:** Now you have a user that is able to successfully create and manager Rancher clusters in vSphere. ### Creating vSphere Clusters From a275c1a73ea5ae8a3569e365f79ab4c2843fa0cc Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Tue, 24 Jul 2018 16:39:55 -0700 Subject: [PATCH 051/125] Cleaned up formatting for API Key content --- .../v2.x/en/user-settings/api-keys/_index.md | 29 ++++++++++++------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/content/rancher/v2.x/en/user-settings/api-keys/_index.md b/content/rancher/v2.x/en/user-settings/api-keys/_index.md index 26e80c52374..a870182e71e 100644 --- a/content/rancher/v2.x/en/user-settings/api-keys/_index.md +++ b/content/rancher/v2.x/en/user-settings/api-keys/_index.md @@ -6,18 +6,22 @@ aliases: - /rancher/v2.x/en/tasks/user-settings/api-keys/ --- -Some users may want to access their Rancher clusters and projects through the Rancher API. Before you can access Rancher through the API, you must generate API keys so that you can authenticate with Rancher externally. +## API Keys and User Authentication -Before you can use the Rancher CLI or write a program that calls the Rancher API, you must obtain API keys using the Rancher UI. +If you want to access your Rancher clusters, projects, or other objects using external applications, you can do so using the Rancher API. However, before your application can access the API, you must provide the app with a key used to authenticate with Rancher. You can obtain a key using the Rancher UI. -### API Keys and User Authentication +An API key is also required for using Rancher CLI. -After logging into Rancher, you can generate API keys for accessing Rancher externally using your user settings. If you need to revoke access to the Rancher API, you can delete the API key. +API Keys are composed of four components: -### Creating an API Key -Create a Rancher API key so that other applications can make requests to the Rancher API. You can create API keys using the Rancher UI. +- **Endpoint:** This is the IP address and path that other applications use to send requests to the Rancher API. +- **Access Key:** The token's username. +- **Secret Key:** The token's password. For applications that prompt you for two different strings for API authentication, you usually enter the two keys together. +- **Bearer Token:** The token username and password concatenated together. Use this string for applications that prompt you for one authentication string. -1. From any Rancher view, select **User Avatar** > **API & Keys** from the menu on the upper-right. +## Creating an API Key + +1. Select **User Avatar** > **API & Keys** from the **User Settings** menu in the upper-right. 2. Click **Add Key**. @@ -27,15 +31,20 @@ Create a Rancher API key so that other applications can make requests to the Ran 4. Click **Create**. - **Step Result:** Your API Key is created. Your API **Endpoint**, **Access Key**, **Secret Key**, and **Bearer Token** are displayed. The **Bearer Token** is your **Access Key** and **Secret Key** concatenated together. + **Step Result:** Your API Key is created. Your API **Endpoint**, **Access Key**, **Secret Key**, and **Bearer Token** are displayed. Use the **Bearer Token** to authenticate with Rancher CLI. 5. Copy the information displayed to a secure location. This information is only displayed once, so if you lose your key, you'll have to make a new one. -### Deleting API Keys +## What's Next? -You should delete API keys: +- Enter your API key information into the application that will send requests to the Rancher API. +- Learn more about the Rancher endpoints and parameters by selecting **View in API** for an object in the Rancher UI. + +## Deleting API Keys + +If you need to revoke an API key, delete it. You should delete API keys: - That may have been compromised. - That have expired. From aadb49118bf55698f380f5647e136b051984acef Mon Sep 17 00:00:00 2001 From: Mark Bishop Date: Tue, 24 Jul 2018 17:01:16 -0700 Subject: [PATCH 052/125] added link to CLI doc and called out that keys are used for api calls as well --- content/rancher/v2.x/en/user-settings/api-keys/_index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/rancher/v2.x/en/user-settings/api-keys/_index.md b/content/rancher/v2.x/en/user-settings/api-keys/_index.md index a870182e71e..6dbee301376 100644 --- a/content/rancher/v2.x/en/user-settings/api-keys/_index.md +++ b/content/rancher/v2.x/en/user-settings/api-keys/_index.md @@ -41,6 +41,7 @@ API Keys are composed of four components: - Enter your API key information into the application that will send requests to the Rancher API. - Learn more about the Rancher endpoints and parameters by selecting **View in API** for an object in the Rancher UI. +- API keys are used for API calls and [Rancher CLI]({{< baseurl >}}/rancher/v2.x/en/cli). ## Deleting API Keys From 9e976a00855caced8733c3e161cf8719d6233887 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Wed, 25 Jul 2018 16:04:23 +0200 Subject: [PATCH 053/125] Add info on rancher-nodes security group when using EC2 node driver --- .../rke-clusters/node-pools/ec2/_index.md | 2 +- .../v2.x/en/installation/references/_index.md | 1 + .../ports_aws_securitygroup_nodedriver.html | 103 ++++++++++++++++++ 3 files changed, 105 insertions(+), 1 deletion(-) create mode 100644 layouts/shortcodes/ports_aws_securitygroup_nodedriver.html diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md index 132b4fb2110..e27d2fdf17a 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md @@ -24,7 +24,7 @@ Use {{< product >}} to create a Kubernetes cluster in Amazon EC2. See [Example Node IAM policy](#example-node-iam-policy) for an example policy that can be applied to these credentials. - **Zone and Network** configures the availability zone and network settings for your cluster. - - **Security Groups** creates or configures the security groups applied to your nodes. + - **Security Groups** creates or configures the Security Groups applied to your nodes. Please refer to [Amazon EC2 security group when using Node Driver]({{< baseurl >}}/rancher/v2.x/en/installation/references/#amazonec2-securitygroup-nodedriver) to see what rules are created in the `rancher-nodes` Security Group. - **Instance** configures the instances that will be created. Make sure you configure the correct **SSH User** for the configured AMI. If you need to pass an **IAM Instance Profile Name** (not ARN), for example, when you want to use a [Kubernetes Cloud Provider]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers), you will need an additional permission in your policy. See [Example Node IAM policy with PassRole](#example-node-iam-policy-with-passrole) for an example policy. diff --git a/content/rancher/v2.x/en/installation/references/_index.md b/content/rancher/v2.x/en/installation/references/_index.md index d57a9eab855..840bd550840 100644 --- a/content/rancher/v2.x/en/installation/references/_index.md +++ b/content/rancher/v2.x/en/installation/references/_index.md @@ -13,3 +13,4 @@ The following diagram displays the basic port requirements for Rancher. If you n {{< requirements_ports_rancher >}} {{< requirements_ports_rke >}} +{{< ports_aws_securitygroup_nodedriver >}} diff --git a/layouts/shortcodes/ports_aws_securitygroup_nodedriver.html b/layouts/shortcodes/ports_aws_securitygroup_nodedriver.html new file mode 100644 index 00000000000..9f45ef205ae --- /dev/null +++ b/layouts/shortcodes/ports_aws_securitygroup_nodedriver.html @@ -0,0 +1,103 @@ +

    Amazon EC2 security group when using Node Driver

    +

    If you are Creating an Amazon EC2 Cluster, you can choose to let Rancher create a Security Group called rancher-nodes. The following rules are automatically added to this Security Group. +

    +
    +

    Security group: rancher-nodes

    +

    Inbound rules

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    TypeProtocolPort RangeSource
    SSHTCP220.0.0.0/0
    HTTPTCP800.0.0.0/0
    Custom TCP RuleTCP4430.0.0.0/0
    Custom TCP RuleTCP23760.0.0.0/0
    Custom TCP RuleTCP2379-2380sg-xxx (rancher-nodes)
    Custom UDP RuleUDP4789sg-xxx (rancher-nodes)
    Custom TCP RuleTCP64430.0.0.0/0
    Custom UDP RuleUDP8472sg-xxx (rancher-nodes)
    Custom TCP RuleTCP10250-10252sg-xxx (rancher-nodes)
    Custom TCP RuleTCP10256sg-xxx (rancher-nodes)
    Custom TCP RuleTCP30000-327670.0.0.0/0
    Custom UDP RuleUDP30000-327670.0.0.0/0
    +

    Outbound rules

    + + + + + + + + + + + + + +
    TypeProtocolPort RangeDestination
    All trafficAllAll0.0.0.0/0
    +
    +
    From f8dbcf057915196f9d24b309137657532180753b Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Wed, 25 Jul 2018 22:31:37 +0200 Subject: [PATCH 054/125] Rename to HTTP Proxy configuration --- content/rancher/v2.x/en/installation/_index.md | 2 +- .../rancher/v2.x/en/installation/proxy-configuration/_index.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.x/en/installation/_index.md b/content/rancher/v2.x/en/installation/_index.md index b3f63e9abbc..d50710ea34d 100644 --- a/content/rancher/v2.x/en/installation/_index.md +++ b/content/rancher/v2.x/en/installation/_index.md @@ -36,6 +36,6 @@ This section also includes help content for Rancher configuration and maintenanc This page lists the ports you must open to operate Rancher. -- [Rancher HTTP Proxy Configuration]({{< baseurl >}}/rancher/v2.x/en/installation/proxy-configuration/) +- [HTTP Proxy Configuration]({{< baseurl >}}/rancher/v2.x/en/installation/proxy-configuration/) If your Rancher installation runs behind a proxy, this page provides information on how to configure Rancher for your proxy. diff --git a/content/rancher/v2.x/en/installation/proxy-configuration/_index.md b/content/rancher/v2.x/en/installation/proxy-configuration/_index.md index 0da3fd4aaf8..e5c155eeba2 100644 --- a/content/rancher/v2.x/en/installation/proxy-configuration/_index.md +++ b/content/rancher/v2.x/en/installation/proxy-configuration/_index.md @@ -1,5 +1,5 @@ --- -title: Rancher HTTP Proxy Configuration +title: HTTP Proxy Configuration weight: 360 --- If you operate Rancher behind a proxy and you need to reach the Internet to perform tasks (such as using Helm catalogs), you must provide Rancher information about your proxy. As Rancher is written in Go, it uses the common proxy environment variables as shown below. From 86a7516d200fdc7b6864107db77b0e1b4fba9db4 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Steenis Date: Wed, 25 Jul 2018 20:58:04 +0200 Subject: [PATCH 055/125] Update ports in Rancher diagram --- src/img/rancher/port-communications.png | Bin 57601 -> 84701 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/src/img/rancher/port-communications.png b/src/img/rancher/port-communications.png index ca1d335685410af13a2be941a8a54943f9b0982f..f356f6b49b04ddae26804dcb816a414596ee76d9 100644 GIT binary patch literal 84701 zcmYhiWmFtZv;`U*LV_i@ySpb4d|+^Q2=49#3+^_!gu$KQ1cJM}OK^7&&g*>l-uK=Q z7HjqD?&_*Jbmg;T^v(+ont81uB(IA6cEL~-#{7sWVo8x}a1S?y03)K9P7y{y@lc|Q0F%U` z7q{w#8MivD-tf!2opbS5kZa0la@F8&Ona)0hyCsCWj{e5DJN z?@FO2#vG6+VP)l-noh0C&`1$edR`nd8_`T4mkq41{_PM_~uxv zrY?GHUs4?1N(*jabG##RWVl9K6aT@+(P@O21<5=sQ z_#xKKBP)jhROpW%$}x@sMP)G5&#ex}-;hOfH)r`Ut5L!tWI8$6!HXbLpA|g}{1k(9 zMIL$Cp(iW9%h65WtVR-?_q44f-vmG2miU&<3t$fQHTLu*j>-00$Ti#D{mQ8QVDy1c z0UQ=1qYQ_8P1BY|N4y_A<-ba|yXRkn(BjC>r)(%m#EQ7qeRGbt5)-E8Hm&h+c50+J zA7&{`Y(NERX_y&S)kS^uShvzl{Jm>Yt)%Dvr0}=HtKhB2mb6sI14?sy{RwrWAwTCuR=H+k&6Ipj?0#B{+zQrj3kWejzq}8a3Gq zyoy_GF+o7LCbBk5z;tlrVJ>gnr*NYRx&Tv6@~lp^nvMEw)k81wr8X`K`6-&Yp^R6i z5{H)*Tb{CB;YFF78=FD3P#0mPujqtG@*^Mq=YuiekKtf`Y_u-+iHC3$puh%v|3lt^ z&{u%+Lvdnw^wb775ZGS-Gd&$~;k_yM2KFp%1j~T$WCrfYjh_x2kFGQ}j#z5mHfIR1 zYyQtNbkJZ{Y>!wP9T@%G0+Y>md214l zF7Mw*|99U#9?XyV@1A`F9_0P^9x=W3-cjEZ(4;cSxA{mFsvBwky$X0T40FO0J=4C$ zJPYYBCLvij@Vqb&rh&9TAc^Dj+JG67)4wnI?_M(Gd21H$8|o*)*}&e;h)1vNxL;moe@Z-!I;)1sl^Thx4pX@4_W2_tl2En-gZo<6_cqck z{qTvi8LvBGw@$pO7f*%dKf=TNw}@pYw$rl6?l+6{YW1%~zp-+Wt3YAk zm}fyprl?Il@6S=2!=?9QHCogDn&64qxP2?!; zy=g3)ad0YZ=DelOZj6Jy9S+Srq!DznI9p4UnHc*@t!fH~s;Mlf9IoT>y)+Ytx6gdq z?|D%+@0I!aInJ70h%xottd6;-m@yWk6 zKWwjxZN8juabk7kR;%S!^Y@Ak)67p{hKVHmrwYU%X3+TlEFwQ4`!VBzS!06G z+8$gCum;D!mzWvB+KVf<+>Rcn(k-X5 zmZzHbl7m&)9M~_q9l0X$V5QeGJs|fih@FgTDP$oa(G~c3b*1PN?-H+RX_Bg>$jZAX zYn}nGLOJ9e6CtBW6|rR*ukQ>YO-U`!J=GOBca4i})>cd8gPqKyFR9U;D;LDiB`r}0o&g8cThtf$T=1=8lPR@jOVx%K zJ7;3?bXh`j3I4tr$fAvVtVNQ6lc6?RTCTU$wph;VlG0d5c(*hz8b$an8v@HJ>% zY96JGvta1pP+@T>&L49kH5<=b;*3!*Al>jV8RFSWi=qqc+XxwTa#2{omRu1bbJ&N? z#J{SU^7!Ae&WBf>HJvw0|9@k-&TeWxuh!0yN`Zi+>@OfjX0aejM7$_(sqtSHzQMS& z+`~Wqqe}qm&`7cFhkt;rRODqW1MK5)-$^p|X5ABF* zSJ;>tWh3vO3)K9E179B7@qJhAT&*AR{~IZLL{jE_{`;P)G{b*IMG(Gi!Gnmm%Q%Qg z2i@pE3!~}_tnuo< zbUsF|W&W}&1D^{2dUfl{zJ5@8KPBWS4Lm4|tV;arW8|7uNU6j#0u~UqRTQwK6#~U? ztC9H|C6Hw|*@0MEoxA^_YEj-q!A-~G~4}0M*7qIa4F$UI< zWwqVk`DU?9U_Tl7$0yn4|Eohjs&Zl1gTc9Hr%oEdPzz#qN0*&-g<^ty=>TGq7 zNnpo(_Q<|zyYpovg*B{NOx2RDHzIqty`(aLe~JN!qd!;A z_A70V6Y#JH9qb1C1s%T=dsmU$hkT&;b_^ls7dl-Lv5n(lLoIeT^1c3zfe4$YGv7mN zYo(QEeV_s?n9Uo1KYPjbCj6s|Gg@Ms4gz+Oe-j^Bbj9(5wxa08Z=gnx9MJsxwU5#L zUq%^>wTnV-%^NlUl|>w2Df9yU)*|)9mI1g$LCDO5qap&?!NxY|LYue5AWb|6MnwN(M$MtZgvnv=?DGwB_doVpEA4B{(WV1K2 zdu{DlfIO_|Lba*<79sIb9OwNjZHRjfAiu;?Bop&a8I3l<*7)_nR}RDOd55n-KtbN~L78 zIq;of#12ENC$3$H<>zP7ZDebEx|EUl((HZ~lO^btt5K<+D&WbH%%l}S>i2|c-+F`d zQ@=H$vhCq*Zv=MtdS~EdsT!mA>+@eawbI0ZIe~AVT@O{SkLJd?KujAar%K0M?a^+xP3ROe9yygshII$ZB7jX;IIN@(Nr3p#GXXa4vx>qs>Y#GdlD zV}A@WpYIbNkIh1M*xBxAhEkP*NS*DnI_46&SP0!cBK3Pt^D$NU7Qfe*h(@=QB{eV! z0hdK~nCrn*!DNmYl0*+U&U&^qxG3wJbnC8WnMP&b%k!g}pSCeq>f~mqL@<8{4*v_V zN{-JDuJ4FHsk&Yav$hwvTQZ)|h_EQT)#4tl|}((F7e$=N8);N_qtl zbv)(Cea&FQiH2z2gvXH8e%p%63ZK!UuT)ZtjWIp#TUgH!;qRf00YxsOwHKxa|56bP ztdNaRbZg3Ksq#h4!W6_9t63(6g`PvUOA2ey+?gK^eC<3gSTw+vSDllSQ><7M^ZA;FY9@EiAZ|$bs9m4*bv1O$=}oFGo$H3 zxrw8j!!@bW_Q%uD)RAO4vpmC=LD%OS-3(UN@>cjsrs8So#-R8j1?bE7`b0KGQIY%J z9I;RmJjROM)N~_=%@@u~>(yjtosi3&;qKYl8~=f7e*VJBC?d|wM_~S?blf_Rw84;qr*6i$}tD7rMU9C2>5pkzd$zKS3Qxw zdS4)9d0&DNC{6LAI5?eFstmi|4YKDACv{$fY(!s^#PdDovaEE+?6 z@)pDI3IP_V$rSC!h`i=vZRe7i{{RsZW|*8*(Apy^#$&zlD)|r#f8lPbNou^BS+4x8*_?qB+FVh#BYf9^?pC z<;TfeqBx;<9fu9r??7zzPJ z6KtfJXDOLvZ7HukZG@7RBES_;q%963b4~YIVmifSDEU!s#mt?8`f@L6{e4C^QXar;9e$X|1PvIHk_~_?(%ju?oW+}p|FIDz zMvGi(g{uU{wMpCLwg~F0yq&bY(4v<w^Mel$HZ*M21H=!n|H@xm;O@O%^oO31tXR zDvVyoU?xRe=W{H98OV!1k_^Q>4=okb)cGL942k+(UF@WFg(Kx3-Zk&M8d(dhSije2 z4T+*O(?F^W{#bmyIUaJ3ZxxH3zK#5qo>#lltMO^ASy@@=cY}@`hvOS8Ja2L)FX(u` zp}27Ov2v5N;v9zIg^dGp1?BpVRY!dMiDHBB+=ss9)~n6$Wb0(eGtfG$H5a?EhXT@> z(obQJT5bvW#|yYez>%Y1DFVkk{grdIM0LNHp(bO!#X- z^l-7}>d~QU1IFK)&d(k0?(XOYLp<|{burGpo!6M^c`KsvZ&K1&?@!jcjW?C7wvG0s zqjgPMK4LLT2wyJ0ixfih{~nvc`9g9nV3j=Zgt|!n29p-S-#hG0B$i953IQ=O*Sw>8 z(e+G;iuBKH+m+$Nd#9Ey3P4v2qv*yJ#XWyv?Tg#z>z5Gy2kh`*zPg*2AOC?>NM^O^ z*AF`Yfay6Ke8^K9Zm^FaTfPK0%n&SmF@l*oVxige0oC$%gt$R+dSvl_+T8UCgo&ox zAI4EK(l`eH;0zk(xvO(uK$hI(Z*7#%b^5Y6KxvY}NUc432k3`}*QoVO{JJs!Foq2U zMoMZF&zjwL7KefHzV+fe8#l_Lf0Btl#rocE)T>to`=>d_k*ONb@YX11WB~^F5Y}aM zA$Qz&_G(*7@9DRYVbQ`n0M4#T-2CxBZ7iJd^ENk`{2m-U9{)>|q)J^0OZ=8M+mFov zvN#slKW4Add!;y%zaDnr$^VrC3fR4~)$ZD_m4Wi}UdfXdz5e;u|E`n3&Jfw}&%eDf z!EL?~21tp&04V!j!PEyZZd%U5UW(@zPcEU5}&4x)NE{^9pm6W&`P`qA#`4V64x+ zA5(|%0)&53l3`yu5i1`kVpQ?N3m}ek{~6TV*q}&av$b>T$@UKJNdKV0?lTPD&s@u} zm6gIVlxR!WbL=z3aNyp@e7qq<+p6SaK;|QW&6#whdz`dKe%|Dkbk=*qh9}{NjYQM! znCec+c0S?lADF?O`uA(SU>NW(WHFNtHLsiB;!e1i#mr6W2JmuYbayA0M8W~ny(%>Y#?9S>6 zTz;}Vb!a^JCg6J><@rwGhej*{gdg)A_k9D6@RI#vPeABl`QrdWO$f~RV!??~9RTl4 zV%|_{HM6et#r{b*@vR~v2j0jpYH$nAku)z@A;EaJU=kFeK(?|Kw$ zyTR#qn$kl{J1aXg`~QRCy9NhQ+S=|Zdo?U9iYWrVeEGtLN5u(O8Nb*(W^}ZeQG+~o zfCL)Dg=Z38&r3qu0A%f-BLlsCsO0fDnG~V_#64#6_44_RvY7W1MV6*I9K(gS;nC3& zfr#$`pf!nfe7smo3m}C^0E6w6KAVqc_3GHS1~cn42v^SUX|MS`T_EXu?j+5;09Zcw ztnCr4Kqh6Zp1o#ilC}LQ!0ylQ0lBX|FHLo=I7@KISS~I#udZZ0uAhkc@hy-T?&_wzh;CVsFN~m#~_;2$R+_D zcevKZ+gGuu@;DU2PP#?%#1cUO(uoWTg74|=HC(7N3=0bzaK(~wS^-cU(HC#Nd8yUj zNL-~tS$vz-7X0^wJgRQ(uP=`a&F-x7nSAl)m>O6s>+1&CgT8;|bFpNQkDq|=oDYd*$oAzez&swg~B5+w_ZjR>joJ>{f{FWPR89qrH@dH%g zA6*C!4?ny!hx({Lw^~e6NNm?P*er5L?2d+?k7n@B-UHOAsb&r0+w6Ao*52OU`@9pW z)OzWB)$42nK!l-XWo3tFwc}s90W2Ilm_W<8@{hFGw?E@>Tg`NQhk-jE7kZ`J%xHK% z^Lth4uM(=TL=CRn*3_wzg?=Gc5PEhwya1rM_#lM(q6?Lk@7k0QnhIYjB1Gx?dz;gJ zA5|pNj|$oQ*9mD=P~Dhyhk&t(0Pi;VpG@Q>mTf;h1ZWdEt!Y2ZZ>_|m;LpNovlQcv z+jt!}#dX_#i4zfRmg>Nm>%^bk=$Ki-+y6)uz+JFi+r0j=;IQgPsT9f6Lu3P_uyk`o z5hP0KmpxAE=O;>3Xm5%&t0_LY9f!qJN*ax2^7A>Ye~(Z+TWkMHEE5jDgArBAF*Q`p zhc?KILb3A!0ToBKS2mJpzDxrh4hc=XLc3nE&D)dj^XDRni_8PFQZ76lExBbu-``(r zzA8K&ksPR)({2l<^jqYbzmqh??i=b-1+l+K@bi5z;ZhO969%7Lh zU{@dkf)}7^`R6A2shT(}x_sk5Kj;wh{f{z*He${4zamqnp83V!#f*u2v@H8~vGJ;Q zbAj6b#HLW;SXu^yxg*HtpmGrB6w#IU>QIra|28KT6@0z*ygK139)j6+a!*oz($Xp| z)LR+z2mo62PQw;-l)t^@Y}sFF2JMy`Dn6z7Ai~2Jn`3EUSz&c$XOmH1805(YecK`|} z^Eabv)~YpQ(3bNH?*z7D8L|_IxokUiDmfSxx3u^M;23JZGEt4BzY?|1{=XpRj1@ve z{6U{pcS2eDx;W!@aYHY+E*cscby{p7pOob1OELW-|NO|5*u3_#nvBST(r@^+Yn#FCpx*KS4=Z8fApg zPqRc}m)&ybc>(dxm7_^cYjM z#(qdO*Bd z&sorS#63k~4tfu!i?A`N*>`^A0*S3-d|ZKl;4`V#;`il3Il>#Cj%JZX%b6<`v)(f< zOMWqf-pS#AI_ADN;wUeuXGvq*V=oT(Tzv5r#9aKr^6CUp_kH9T{wFhYuVw;=ty+!h z-5xcUCr9U>*N@(_Mw*k4TKlfTYhT@scN_eaA9rH5i%1y*fJ&@n+*PBCKc4)#M2`Za zTW7Z8dX%>MWTgU0)-->+l`9P|3S@8)FXOTE`qH&($eJr{C^Ylp!aueWQ)S9qVWyK| zMO{^+5b5$rYnhwe;Nw-2T?AtyZ!zlHLe)iO7`1wPFfEA*I%dL1aj+&7$?weNpc;mzL`>nEQi8V+P@@ z*Qe`gg;XBf^xkI)AxAB|K|k=j&#(2T=_mU?g+XyuiNwYg1Pfyx0oQi z@qE6S|2q4E)PT=vR@@B6QffGUyXJ8CiN>A}@rTzde_ty6<5HZYvMSJqYFl&DR^u?V zRxBhtOk(&>jl`O(!V<4}TNZEpljir>%QA-xCx66b8-id)C%6)hHh1UR^)O0Q-;Ph{ zC#8Vidp=jrcWQksqe&MwO$oHa2!=42sR z6e#TGjM%+fy>N=oT~3)T_-4a)+M^9cj5wWz{;w5r{j9gHM{^~tL(Y3+CD9sF=fZXK znM7Bi$wD!Sq7Ib$@e~pt@AF@hr{F*#U?Wb7{zL@DotFMs?PV6Pu}+L%Wcgvul_6mX5r=y8gU2P5O6 z=&H6{PsyM&!5SGE33GJ$#m2;_FF+QUG^>Oq+V0m^1WWr6-lL!o;`6d&5gv|v(gsZW zfUb+b((>o1KLfInDj|)afWS-k}>M)B6U4VWpCD(>LSG^Lly5o;9Fb^ z=izatN+cr*pU;7BR^o=n5h@8;TuNq(>caCq2ja-3v3d|VaBH84;uTd0L_9$$EP5Z6 zcDxnmdVFAXsm$g^gr=Wl9gOWj>3(hF)v(|j`&tq&of zW;xx<3ER0i$|-(6cv~=jxL8cF^5aK`sw>s6C?0tW9l}?y8myne5_uqYKQ^pEjEB$d z$HHYpy=-M(AL>Q-9y7*QgqzQJHivq~8Zk+L4sF)C1AFoB<#D;MmB?ECO9dBld$fuJ z%kQgEz;~{%p4X}EdeK+vc@b8b+SITYtCh{lls&Afj4?Z{+H^Iz1jMlfTPX}etA2$9 zH0`j!_FqzKW=U)2ysp|u;^IL9SeYbKP}imu}jUo3RHVEnom zC&}!*)Q9{Tg&hTkm)t7)gGCi8GGv~}*z?ZO5M8#5TJf6v*70BzUIt~~ zZckeLA~}Ft)MyI_hlU!TEY(Xh%3Y3FhiP8=fG#X>!v!gWRxrR=BgjoDDJkh*`k(6( zsG?DI+x{+vjZgS&@1@dg^W8jzI=YNGXN3VAr=OO&2!+&qSr#j zd0Pe1b!{ATq)5S4p3yZ5Jge_1EZwimS<^=IZqGt1Lktf4wkC4^GO6s(#t=~Ub4Ma& zFCVvKqZl9Q{(840sQWb!$?MwtYeoi?vx|@2wI~sX!S_XGQD`pEg!Ha{Pqs=__bXtGtr)1lmO_}0+$%p4ON zT0CI7_sMkqIA5d9hTmB%{>j=#@CH98t+R|oD zDinzU=TdEpW9|!*2|4bf9tAc~fO^t=*`?jL4^9t)MTl2)lZind5idI~|Ly zW|Cf3A3uyPKvpp^aFMEpRK2xg+xY3|qO+F!pVc7PahZS`o8Q;B?_2rNJcG=YT;>;B z4PHGjnJ8TwUMQk3S_8TT3`7w0aA!QeJZ%$|dlAXUxWsGCH?~g&rUw(+pTr|OaxMdG zR+S2ZzS>61zg|DS4CSwg0dWO6z^=u zwiZP1efXg7o|wkQF)*JP9M|H+g73QRI)EfZOVw-BlhA+JX&vX>brc^-bK;|qbbO@L zK-vK9Ta|IY=(dg~-KpXc#2I8iW2th4dGLGv>vzaGjDU(8vDBqZS*iOJuj|C#XPq7` zo*YS^HI6`BiOa*nA{k9^Ga*+*z-Kwg{s>mM8W%>uZC^1-zx|x%ZqZmp!#+Opa(yds zekJPE;`8VxQ8oJf>i}FQvXxq5G*T*dD-#2ro8sBE-eqf73RLkSfGbCrXXS&1WZ z_`|0yGx2vkKiYnd?J𝔔rMFb0Ac^I#?e!yWocYgfH_WY_k!fsSvvTUP9H+`0ZE6 zSttwrX4~E-vCD%YCyT;yz7!dXv$&1Gr`Ja6VP7^;xkV92KLwY2OVr&9Dyeh@7|Jt=5S5%L8%ffH+wK{}qKD3*EhfyU7PgBkxupcBYYr)7rT7RGSG1!aYPOt+3ZAUz+QAJD^ z|D&m#&69q%O{kI@=$zYW&@YcA<+U%21y?MpY+4-nlM8Izr z^iWOqRh1Rz4M?)6MfWS_og?d|h+hKly0b04rux4(l3Qk}L_oH?gld@6R8!#3o#@A2841B7sP zg9{RDa^9~*BY%9Dvk!DyN( zX_=(o#~lG&A-f{Gc8<4QI=`YOYA#UIfAg=(n_Wlts8DuBWyaNAqGt44x~?3;A3EPe2ds79mSTt)u4WlIPEA_7wg6oMzX zV=J~asI%-{X)&1_>q}uGF47T!{7$n5$rP@Y4RD&M6ZN+JHoJzpOXBSmaD`p6Tb*(< zvkr2!<2J_4l^R{9d3HBt7tTS&A%u$e!~9Yf|c6**XhPG%uR6FG0O_S2B8yb60;@IL1y z2D#&fYsj}}oE%9Hrq^!^$e`(0DL9qKQ&`E>Ga-z;5gB~LYyT%AOk~Y0srqmMTUOHx zULlD!YJ6$dhmK$0=jrW|Dr=72e5{VMxNXcb$DJq8sU)`N{h69x(UnPL|HTK+p4V3v zbJ@=>n3979=8VVlUGvzQ(!=)1z(wUF>-zbufvlB=f`pr(-VdeIJZfoa5vP{ho_eOo z90~E8Z^WPqzV8P*@*9UeV^)BBTjI#7R}DV(xAxV5W3T9!V&xtM%Mw(Nrmo>xt%CRI zH5+_@2?qVEd&>7)!TKGcQg1*P0p-qe-#h>668AU&MR_N;7v|4Z^ ze}N9!B&wsVwjta02I5h#ujNmV0COeKuY1kOF*LxQ*SfU(iKO%(3Y=KK`H3JbijA`y zuE3%tp}=yrM1;nZMKSyP5}P!?ILLBt#5qM}IU{}-`ppw!e}aY+&cQtvg_A(XX^haH zUq?atI1MqjwTGo#U0Ovn>XeHB`t0gt_D zMMT?@j7%&MCtOe0uXOtGH}!pIT%PY#c!@ROomVpy$N^Jeo(8eFA?aTi%Knxcg?kAH zRU&P7 z-)|=H)F;xUW}KM0`zcEVH7QF=%Y#yWn|9Kjc(tGQ+>+ZWwidT9^+st>1nwW)oRsu(Tn8Io}JG+)=Zc?C|*||X+*vH z`kXr03n&#=T?ne*Zk2H$83%7F?wfKqziediuIJASvAt^_xi1*k2_EUD|Idnq>yI-% zSDKiTSOTtn2eW!_G(81pmEi~$_AHA0{q?F9#yd6*v@pW`L{*U}ZNiP@2r$G|&pc+T z;@wAhsZ!4rS!>IaUn574l8)V^1(xY<&`vBnrX4*Hc|U$07>scCa^#IT#tB*gC(1g9 z5?&S$&u+tbLkTuGp)QJ(%k$>;YCTa}7z;ovwrj0h%{EiVdp&?cc_q%2rOW^nblCfp zL?p7j?S5Vpew{8U%{_V%9cGbaWh+sM<5AuBOk6Qiuj{;dsoDh6PD4Clk9Fc4`fY7N z2!y=iK?1!HAKlYP$8EkTo=Y)o(VSfyGqvu56&S(Jo&c zcAo_ZPELj@Sk64^5jl4E>tPLVh2)%VWBLrhCUIT@0>3wRN zTtu&+X@YdM3j*h!rW)-Mh0)>K!%;-m^Dwx0E4@Ev@6B*xuaBQED?eyGlMK~v;q$k# z{WK0SHElu(CgjRrM1;jx+n=rxG3k}I!YMg0+osP0rJ?dZu$A_NB?3Ys?R3A=bcJcw z`iX9#3T4jvi8*L9e@76uW%;jjY|#t}s^y~CcL)=f1eSpeZ~Nud&}T>4GmA6N0DOKk zN8%ygeAB2mf5U=7{URw)#_bz>b&0_bILDu3&9L8g|LLWlj#igFn=2Q^%xuH{sSMSc zTHxi~B5o#$nC-9Bc9Kqx8H^#VoM8&ag2{@&;Cw5MB4PN|-K9bUjkJQV*c+&ayZP7A zAv+sq8@W7)PR53A+U;gZvz9G_h9v_2{E@s*&Vrx23$hZ3Gd-N#jz{BjnmjmEE>1|6 zKwzW%#V@eh*N1trUzF1wK+eVd+aZ#LshhiGGKAsmD(dXG&Y<46#e!7qyCCALmNBZ) z71_aS7wroDTjF(1@KZil>d z&!D*&J*?@9?{DCOTed2$2%l=%nP^tuibTUd?DU?H)xaf5_)epu{@Die zy-r46`O?rQ#KM!CHu`xthX$+jWMJ*Xvy0=$1Fx$x+P1~FkV6a5t6F^uBs zr)r(yVbO2VOsY3cXW%)E(8}Hf%y!CzjQvsgfs~Rl#nH(#7|JmsdQE^p0SW)-i%DYC zP*?g2D$w$YTrz=}?N*vq!$C|B<3=MX9AtO(W+TXL{`}_V{#t&Lmm$O~;KfKp`jan= z`Yg4S$L!YyfdLQURiE{GS!J6tDz|>d?jnXqrrTeC{>ikPke%2P9l7Pk!Dub=DIT0W zwv-(M)2pSzimOI#+%&RExr?HqCr}VAQu_ z7WYh;o%RJVa!nHlTuD87jB0v)Fjy)lU%W~4Y6sZ21+-+P=BO@{7I~W&{`ymKq6?*V znjKW8))u~w)Q9GPb`tPi^dvW>fvvO}gVLoSIy@&HFUS|e&|qb{%Iu(kdo?ZW$R@c_ zYHX_caym&tcE7mP*Ysz0?U67p-dFZehCELJXuPTPrxCxFM(3=1qqGb)Ms0)Tf!(i1 zKSMw{8{29O)aLR8xPl{N9Rj~vj5|S|=)+km+G63+fHdmboBK)EKxwHPnN7t%-UMi2 zJ{qt%;Vgq?d{cQ-@4eFaLwkcgDz3g6#gnWuZ|FtTnXF_IX;f%)|7oV+?<6bRyW|8x z@6&SY!l6n->HD~~npMS;c04Q*o=E*IT;6uK&}E;C&*8m!jTj1*7oUuCa9A=^g_hEp ze+{ss_8@%wEvjMEQ`yI8$Ub6iAlF=A|E~*<1>3Ey-fezzs8!;Az{86bt0*?73S?eCJm-a^eZHhWnHV~) z;e&PVw<5fC`havW>;&KF+;%M4PJSJkImjRt1GcIU#$_hM%$xB?CDS+0^nw_T35K&@ zZK08V(Pdt*vra)}#F`J~mYWk(wk6@G(K4DHGwcp2$^FPr-A`2!W#`P^KhU6Foj~wy z_gm3VU!Zw;$by3FAEl`h(}MtWmR|)+%UN3`1^NcBzmhu=5@tw!|Rq2LkrX?le$@Y(c>#?mr#dVLwjdvSH2D>9^rC8*IXH4S5ZB#2L)Mv08JS?VVZJf_%Dn@Tz(q-;1;>#^@q2UZ## z;aa$}+-jkM20y;qL@CGy%x6O}g`T5{n#7$(rjA!S2I<(s4}t#RtY{P}>uwKqxRFUp znzRS5Si)ZigA*3S@xA)tFAE;FaZ(vYpSJ1;EiSslq|IvH%24!=6pC_4E+P#NJNrut zHN9CE{f>Pu1sFQPJWV-CksvH*UpGzqSV9HMqT418BrVGR$G>L^(L}WdQh@gldxNsc zOf|8fG#vHpP_als06fM?5Q_Tlw%YT`3^^ z96j=HwDP%Z4qHQC!5g`pA9*hqFv3u#n|VdBsfQ$|j){YleBc{VcXh|s4&?C2!`ZU3 zGbt8OqhA1X(e}bm#_gSbLQ#1f_)AP!7Wr>#&yEwE%Ib3@g=&w6?6DK+%cIK;PliO? zR*By-gmj-owqoCezp+=dHc1j{qv9;zl#u%h^3>#{><4^a>c4tQEbXQXqaQX*jH%*< zZkcFVnC&syu73nBSpG3|_*S)`pk8kDF)4_~mU59I99$NzOaXObXQqYSF6cuu3<&M3P^ouA-BTd2rk8F;ii&Yd-YH7P zK`BCsO-a9!o-ab9C(A=6@~+UQZa2cu)}fA`qD3>XGK`uY433)sZEG{hE{|oeB^RvKi#-*1XE;S8HgkwUDoSds z&LxnlKPpSvPCOj8f9mv`VnfG19c9g~womjxLLJ8^>45$Q<9;-W(=e2sH|e`~Ky*gv zLVB=hoju{lr*Tl9hzfYoP`L6Ad(;xxEbkn|NN|hN%cZYE7j2~irg@}U7H}!I4H!MO<6&eqHA)g$)lj4P{2szFI&bxhfMRBXY)PX2Q=GMObs(n(SHyvrb~a2?Urg1 zAKeS);|X{FMioEBQ0Qe+NC45r@--`=*Z7$k;bsnssc#k|ikx(2!N3#Y6*@C~BuB-9S{HutWBSrQ)NEl1FgnFipwZbXG#*vxx^I*@74MN3n2ub!P2$FR|oQ3fOVx5 z_D~nqL^SqLIk1;r;q$HGVWz~Lpl4>%0lqTN&^M9apSaIGXISu4-9i6%u8_g^>9hKc zoqvQ#+ad|App%U+<0spOw`e_bnm!NL;6GLUbPQnHvd>oO#w3zI=<`N)~_A+ak{i+|PajXz-NHl90@Q*{hD z<^g?9o9qy98j)fF)8%!~bQC7>$5nBBfXPb$%+hK~^VgR|oMK{2b!Jf=9A*BVZtv`P zwyLAYk~1Op}FyuLTw-s2@DE;1LO(RF-C=^UOY50tsC?(y45Oa6_aT0ONXTD`KLOLtq9C zHrroG%7%2IsP&r0*g4iSSO?<@&*{vF3(f!Y0_3yJyt9s;u@f) zpq~7}W+-Z9NcP^(ENY!1;)`{3##Lk3)K7Y8UXCS&iz?5N0sAGHuJJHlLQX4(KuX+q zyJ-?NSDqzb>`D@2$Iu*{V#o{_k@*f>!=7pgS28*03YH=&j6(m}9?|`2zLxiyv(8E+ zT#76nk)e<0x@9S;f=Fw1$YayhLDtidt&x?@1*%&rnUNl&ioShTPH~5KpqY{bH)rQz z7rr63u*iajYWq=AnTPoSb`+Yw9~5Ic>m1OnlTY2HD$zGP*!jot7gK(`0BNK@Uzd`z zo#V&5S~x(^k<{uHFc#0Wh^d9mBw|EfcndqCj+xT^QK4Zoa^ar=^MG=~d_&%)SdBnI zgW=EtBi=@-dx*;x-_*pBPm#$b^}Z0?LT@^F+SSvQb2)2BnL-*gmiMY_>=LleKc>OS zIL7x57C}JI(cDQR^g@FO8=eT$KLlFYr9pg@XP71$v)^`?DF;s%xnU+`_cUA)#k0uO z`%~WQaqnb;zn!-~HIAud<=ASsM^l6h!T&9A=yrEY10Ed+yMcaWRgy=f7mqzlRhG?^ z*w&Bp@G#55>wc(iqM@s`(aN8ecxc4SG2m+=gcF=Z7H)ly%Cl(tQ2~!8F}b2kPvwG8 zIdjB==R*9fQ7M@L6!}`KF>>1@nZ5-2A7=XuAMxn94)oF8%zyoNAUm0Io!{Y$ox&lk zf`<99!qA>1hYZ{f>_|@>kBpd`Zo9`t?vPrhK0{UA;>Vilb~m&Fw2`A>CbX3(bFlGT z#G2p#L)KYGW!bcAU+|{8q`SMMq`SKtNkJN=Fg$|8(z+1{X*Pb3b!=6C zcUbDhfXL4PD-VS_@9<&Bb1%B9LB>4=>zO{;wur`&q^5BVgy_Jq(c^Sf_Yc}*k&!vN z^m7(_Szw_RGY#w(ckRVx;yj-GY6M0hEZ018It@Q(Bal2%*veq^!ifRR_lW>(M{-r^ z6_gy&V>!Ow_wqpd%eK5PWD9R&M&>@PrwYsB+IEeRMmh`w$6#c zek#j708f01T@xfbk}s@nVyWY1p<=oD$m6uRQL0avc>QIEcz~PRllxv_gxtF5yQL8J zDUiT@LG~{{;`2VSO#hn$C&v%(_8KR3o}u`4CHW9#+hHhri#6fL8eRM@NAdP5EHkEh z!Gbnqa!>qTc!_54j*L(8Zpm2Nw=Mxjy?(nZzZT4sku%=V9e>_isr_T33HS2qsR{B| zk-epms;vBbZ@;au&slpCrQ~EIi&5vUrxHrZz5o6!k2YDZR1;_feT5}A^eIfLhQ~I4 zQDwHX0Ytc(>D|`J7_(A>5opB4h+NRqY;GGZLaPiTIv8shv=par6mowmjE@&Qmp)nz zWMIfK1JQ0Va{4HS&iA(<{?%(d04lbahUzznv7ZXJFg9qj<9j98X}ZcI_^tYJ%Z(Z} zu&ibWj3)7zb+k~PC3M3w(TpcdN3briCtJwoc^wNpQaqUy#(+toxIHvI`6MxNHJW01 z8WFhMudkM~I4y7)i^_xR zM%l0jfE$p(RlXDYh7(Hvc|HzNGor&y-!+@2Ae>XrIyZUa$qh$Qw%kZlPxGB-(LRo2 z!tn+7SYMS+g1|RX!+OUdccBz}?B#(>_Rmt$*k3LAkocqhixkqev?XTcL-zXie{CRy zkqDl^QMAs9!nQgNPxCJeOtNaXKfK4n04nxnQAE%ee@!ItAv zGS}HbNG1U&s0JgB%&anepa zvSm!&drO4JPY8^M(Dqpz-Qz7FoNv;UjFht3o33K&gxc`Rco4oT$_q|jTkB0+3&%HU z$2ax+_+TyQvKp2m`X+g8f3BXn5sq()Q=(s_)X+Lii@F(~%}DK)*#mJj9d)BU@VPKG zDLGWh6!KKRGVek}C3?xg^Ql}qkWhH@3O*EujEtfS2eJ~tI~*u*RG$7katUUfAJoNn{~dUN+jrC9=gHcEDO_OU`Yfsab9+ESj@f&wW3 z#O#_-5^jNV(>5|@opQBtxLqqotPi*$W7A`wWtpMfKy6(0B&iOP$7Jj_YXeKE`$-97 ziMnI^H0pkBz#wI3lpwF{a=JOBU6}2Pd?6d6xX%{-63M61q$N!m2)ngMHXX(bS8?1+Nc5Wm)^Jl!$G@MqDJq;cpsA#b8Iua5JKVKRO2*r^N6ya`bxigE9P!x z5ueFPF$RBd%zA0jOJEzYnQfy*X3cAt>A62!^s*O-be{8c(u_@_zm1a}GP%4#U;!^-n$ezlEfT+MP#h*!6;{xC`eWue8{;lU1+aUHtl z5@n+fWFch-eu^m*nb{)YD6xeR9l7f_jSN74F4GRW3c&x&3Cu>m9+LL>z#oK)`Q*hW zX?YQnUCE0b_q5QlDAe4qDzOCuAp8TEAwg4^&fMFawUW=z0=}k9^&}-cxdsn0vo8K1 zW~Q>)Z#YS)ZP!YnmKME{ebC6RD+as zReIyRg@aMVBB)(`HlK$^aNhi-J^Y`@gABGT!MNjcPDOI-H>e8pa?bcr%L7jug&7Y- zkJ3rIz-Fw_FX?~Z`O0iZ1Q*bR5LnB$-eYl9Kl#+|mM$jD&h)kf%N z--SP;?qy*%ER!;Oa8+ssMl6`{_OM!6%=P_S^Iw+m^rVY`AzvP&;4p)drJz=!8_}JhPXS~eyTMscPy!6e509%045p(9_qmFAN{t#2n77nP zOl1uG?!m_@mgTj*sSn_nv?C*e_v^l{B3<4;Fb`iWdO{=hy@lMc&c?@xi)c`ZRMJcI zcp^ex90(=?HJ8}G@^q?Rbk3bs%LmE!sSmyJBTel~)c0J4*CQ6ka+uC6kQ=tya0T&z z?YZ)53jwx8;1>=Ov#Ub}J%sqnRVkfh1UCvvWLN>2c0lTSj47w;@KCNRT zv)7;abn@U7l#9@OnLk-uk5Nqs4azKoi4^ri+CaYHPncN!La{7{*nIhyO^b0g@-jzZ zeLA?<*l36vq7fUk?K8rqfRrSZ14pQX*+&Vx2#z*^bvP~N-GX2F>+Vl^l{Dn$t_fu- z=ISFLco^o9RWTM&I&bPgO!6AVsd}&NO}a@DB!i^Ic+Z@|eTqLb5q>pgH_S9mo&7V9`gtR|8 z*WD)JJPo!7)^@EKyASo7_tOh4)wmS*UzA^bLZ8UB9 zQC)yprkY;?5AkWD9G%b>Mpf~N^^cBnNOMG#r=Gh|r-f$zwP$~*8#WOsLNQa(LifFpdgl^O_w~_f zP$Jw+wquy=nuZ(=Te#GUhBFOYgcOreN=iHfmf5bVZyM@RNU+TFs5nI_0IK-NENEAC z?B`tA{Q(;Mv_u6Fj}+g563p0F1J@(b<-1%KZ=3jro+Dlj= zBTOQk$|z)cmICUbeEq4+K>TBu-WkD5+~1owYSc>R>iaDqv-*BGzMzGzbRuoOwRP|* z>Pw}Mhxim#z_jl%TScU78G=9K?q5f$fdINrqrs8qR|ku9cLL#S$TGvk-HG_8_X-&;N@0zzuSN43$ZnotZQkJ!7bCH5 z?-wg%{$bcmMCnMjI|f!#FeueScTS5d)BY=UUpadJhJ@u{?AKn*|L}YL&iLB9q5aQL z_u1aTr%lOR9BVVCy|o1HdTM7L76s!<-D|{H9fA~^w_%Mk>VYJ!MCMeTF_^NSK4cOr zzO$C^J`FnnIpJE=3OY z#}+JOSG4*{Ij;RQ-^!#+V#kG8I6e|z zCRhhG8Ux=8cg}ldbH&bXYqB4_-4=&!vaq(V7Nt79@@XG9cYTG0dZaRbDTQ4d=>1^q zFAaT~v^b#@O#Bm%5hlyTJumZIg$&IXVtM2;y+hF)TLqpl_Klp?$|>bo)+Vxfy3%2I zlo$OPg?X)uaZ&QLgWZ0@AACJ#iPjcib53d$6k|&93dy~O5nF=N>@LV8T9-QHSUBKwh3$Cf>_kp z^QGx4dKDztYf>0?{O7GZ0{gT_0Xr(nk7fB!NJg0$ErfU@*(mZ1xj-mcbBm@OeXUtSx{B-t#bGW>oj3xKzn z#)WMf`Ay1`VBjLQ(VzOncDo3F=4s3xP$poYz{Gc(!(XNI^jctMt+7V^8+RI9uBz{u zbl?ATaZ;9rrU{|}*Vodjm#t3_sf<urj86X@Xgd)M}$d4`jMSlG*ueCPKTC)_nPiCliG|SMkqWe|__)u{SK=EYTC(V=fjeedL$V&6`xV$$O~+!u=Oqt`wpSqMU_v zLrt!GtEMO4rDcWbp?shCzHz<#@ed^3Z6U zx663$W(Cln4=**AY_{Lkq-9y=;D0-AYI@Mm94yv-F#dPxJZ%gtQerlfdY{7S3x(ro zHZEES!0dOY|9rju@cZYL{i>H1qp3`?-MJj)H2lNK)@u}WG|B5~tE$(hFSNdBNW=Zo zY#4psr8GuOZN{Ouv$0rv<488a zS(%da-CcTi=JTHFqa9Xqbt$Lm@|(lts|kEIGC7XxybB)%1qF#PwGWc0NPgD6 z1}voQ`9^M#{D$kA`t$U*N=ZvoGB6+}CnxJ4yamSTED`@#4|k^{ECtN;|M_+QuIZ$* z^#qM zFN;;)zvA~gqIhyq1Gnz_bU0`Td=w9bZ}2&{%eZXzt4e8bjzIFhar z?SD)Izr7&*`0=BH!7+IE51`N~uzNP&=tjWrOrcX@l>Iqi-SU4o-S6ZO*LadY<@z|X z2_*98&GM;q)1bVmOaaOY%9CHUQT%=zL}SxBU!Pdzeoq`522JE&Gcz-EdsTeYK=2TE zu|Ky4C|zHQZ*Om@X=rFvjjuOzoknYHRK2{s*1wQ)HT>_y=_QC&B&`8|-aph6JEahO ze0&6Qa&o0yUNm6gFW&gAx6_A3EmJCI4ggz5#>VOXG%Rs1fuwU%;j_UaEB*`MQ0fMQ z>v%2iYRLqPL$A^W%5r2${c5kc&Dx*w9C}af{;5m^zQqqFEk52>A#qPksQ(P9z7$38 zI+!LxFofOl#C&Q$-l*fXlo{4n#8CPA_^jTX|J8rV=!sF{53IvF>QX6bV3JmP$pgDU zLFVJ1zo+veK8nUn+&aLpPv!aEGilK)GeloBhu0wn7>^Bse%0U8%}w)kzmH)%!hQ%>Aig zvXFMP)a&E^aQeoqxZQUxp6>_<`pe!XctQ>qTgqODRyLm?TaV<&KT#A0UiDLDNr&mv zS5HKs5{6Jo$1LApE{zQDfR4@oth99)SOL1;O7v;0ph~Wl)Zu|3YX{w11?Fu6S z!>s}N|NYF5wz2xOUGKJsMsA{5WRib1(d(0I4SQK4O3BLpT39f~BZb;p_y{Yw5@cum z2Ri%odB7 ze}Bv1{-3a@SB63t%E{NXKT{)XE9y|oX+?w-%UUbqe^aXE*y4LxM_aQu{=!-|o8xte zGRsR~Lr(;rXtTv;Z;$9Af~Oq*pBLb#f^Aet(9h3Kw)k?9QLDHE%4oW9ngDN=QH!&& z{Yaq(L{BURKjf^`ptf_3ZY8sQ&^Wvq+d)^C?NQ3_?oY*gi!fIWk(^NOP!wA3!A+{CKhpplF1KzUZp~_U4I5?lb zQdrj?$r_aCby@VMF`6~HJOx(&`F4^XpJvtXVox6e4^Krw(N33aky9B0hw@eK11pcC zx#i9q!+rz@#jEKuR`BV<9csOFoS!x^#{3DghkwT;Qu1kzxZz$pEzVn?c2*ZU15fIA z+X=edoNe%&D_zkzF%60Xgs_z@7dc=1`!qHi$Mgd7b{?x!`L0_o7d45WXU9wZpV)31 z;c2$QQ7xUu2|3X*Fmzp?0V6vFAM^THN}i?J&P+|oSD)$6vWa;Dv^M{VjKM^=Q$Ib( z@#sfMEL_|$K!6kCLfG^F0QP(#K=tFrAF7izBHY;M5pWC{`1XXqu%D|#10(?HjGyaU z!MU2ihFGxSwgLIysRnRHFx8qC(7BPpnYXbHpy+D$F@;t!V>-pzfMW*K6-^F4Q zsD%YX?#H+lu*o)BLxKOhBh7J!vNx??Ep!BX@(E}2pU+Cs4Ymh^uX(lz~GzUl6}wHL!HcS!@peeWIQ{wmhLKDxFHF%pxkEaEAeFbhkGPmR`SG z+0-{f{4^a)`kT2*Q&AycDBT8Q@0d+}|Fm46Q;9+KJjUg7B-4}9;)qwqo{Yky+x+vf ziqDo5<+zH4=&40Gk&vL5j~A|-?aPI-lumrOXRh479+4)M1I~0QDXA{ECieZ*bm#BP zUAeGR;{o<5qVi{~&sAZoiucIS#z+4WK8D`dXjKV!iBCHMBFDjhKuj-WgbJYN;cby9 zpd_(!VE%nKJuNG(e9xJ48<2GRkMA}js<1eZ5u+0%f!hGk;nV#6NJ$IAO0OVN-LzjX zKSi1Dx?#s$doKeL{T0aRM;4@C_t}VI{7KuoJ@joNSl-x01+CfV3a`gp8eY7J2Za#u zBmHK!TfWkM-q@;zWE344{TH!?6!Olj8 z^9M#c2-%1vy|}rLqI4KZPKFjQc zbicsg%kA2A#s@mYo>Uk{6u}{prkQ%B#Bd$>^97nEv}ZrX%yn1sxFjl@#w$>?P~G9$ zYJlyvNlL?()7`>@qv&O20UOG1NA9&+sVvT1Bnh9Gm*v_*2NnjCd|rk0^a|hBb2OM~ zq4v)^?$@}-l+1Yd`_mote_9z{IM!ekB+agltUlJ;X&Dx?E>SG2>FHU@xymS{OsZ_u zZ03*9toZqz4$w)4Q2sLV#5}tHTcjB4Q>zdlTKYO-CgQK-uVGO-eWO5+6K%e4#f>H} z%IB;(;6n?;!cs;GyNFWsfUI`i<(_r%yRqxZ2`yinn(GPjVB<>7`sE$0?L>L&l|lm8 z*qJ~CR5b5*I%H*Rn0|5z=s-)jkyn7!X~Nix@ov;}$^Va~zM8(YdkGxIA&6!-KyyB! zf^uYWZ2iMiB#eX}W>&@s8xur@i3E$87kYcI`&(#c$jgtC?qVWIxH&lDY=cN6)TZv5 z3>!82tpUAq&Xjy=1mTxt5|MS0T<%AT!6c*R_TOa)$1yz~8=La#>Mkh0A~AtWr&dr; zY4bjg^{>qtxw>X@)tMYy>nr<1%r%V7!Cv72MXhyR~LbDsMtGOdb znuQClQ%u#&Dr6BkEeWW|zPLPOeP8*qHH+~4=tsddoV13TmgU2+Kv}Yyq{d}VAx+LB zeqg4V2!em>sHrQ-&a!#!5(;}W1?VVZ3dPxJW5AH*-O*hA7?fx{CKL8Sbfx5x7Q<45 zFg*{pBCa2}mK063x@Rwo`}LO-FW4@!eXU^dG?T<>u1>j6FL-!dn%cJ=@G-+X(b=+n z2#jA5Kb(hiZ2)4d>&;Hd?Vr-RLPQ4GDdb>%X1;#X$9o;?1>e`TMD^%8SfwlwGD5yT zrmlNT*FT=I8`cft&QX*_C`QQU-Zg{CtXEu!`PrJJ{|PXZxEy9*n%<}s32We3TUts@ zk}>0YRcpJEVEHwrQhh*->brs~vzngl=6Z12>O#fHFQU))`gC`-mgq}*8bR!sBunnE zW$@$8%3D(}zRTUIfj+K#gX^*=-U04695jYw<@z;+K*_K%^RCiiMH`a4HhF4}WABH{ z|8q5lc^zaE87S< z*-7?b{&a7jTmib|iU1-@Wk>x&aN%-=BoNAJJ1=r~BI{|AnO->IL2t) zDb7_oE(CzEfn-@S+Y8D_e;}#Z0IajjUNYao!rm?v=!KB!wdmb*DsprInSQUsmdl&~ zQh=2!=9osJ&!cF&JBfuhoDXu35J>FbKc+EiT0Y!eTl+n+Vk=H|%PMn_zXI|b_o0(e zJ)p~Fbc7=0n!i!vaP|?tJNjkayw($+io({=?(PC8yZ|*U67*beWxk`-*Lg(vlHl+V zWX0j_M`rmJbhvpab@U<;LZA>q?Mr||Xt*%-@c1c~jqCo?V;;9XKuFV`w5i=o(8-O5 zgCw*ctOXkm(+20)YC;XXGI0d2hi3wA_vxR~;hjGqop55pEpQ)~FAfC9@`8=v(d$5s z>e+SlxWu;umC>5|eB;K4{(sp8;5nE^IelHG68KjUU(;=-uo*Cax%RAe{^ce)i=g(B z_0-wAN5po#Fe)co*tgERqszyGOx@-kJ=hJLv4bN;Zd5eh(m^G+?isD`Yx38CUjbV1 zcxSUFu=(?e=JmV6_-%61tM_ILP|vt6$9*hzYVJj8G9JX;<=c>5ejfJ_ zqh*%_PBI4VNmO`yav)W5wHFe-p;PhU7g;+<5KFD0zTphMt13OTQS$6flEirq8 zT_9oRJ#lw%R*N%?oB1Se@HnQJ4h-jJM@2E%GGoN7D4hTPB7t#T zr-AB3e3tDA^UA)D*u-2Y2lwdJ=^!_p(@V0mZ-(_moe0szrrY5iC?rRni9|g8eR5fl zWpCOy#MmeaUYW-)*El063^h=qAthq2gJGRS=#<}!gnyEE&G&GLCtQo-g}BU$@nY~V zKU*sbj~dr?MxSDLHox=wDgfX0ihxWh>!=4u@!fBIo9tHSgHrK!h39_|5~#=XT;D_H z5>8`mh*YoCWl62Rcl)XYTD+cjYuyys?37UK930cOsOyckDBg&1sdBO4c&k}Pga{Oo zk`p4MWj&?txKF45TS$f1JxXKqy|`<46+-Xc=x?{de!_eUp)5hqgO^=jZ6}IPX5Us4 zjxd;rA-?C4!&vVnjS~FV?ADf^fIR`$K+_PGO_qV=Fc?;>1W*Y zD6&nUbe0n=A2Z=_MP>Y@iLBq__Lnv{$wKI_m*epTd_P%v-R0lPHeNCZcJ!pc=8E8+ zI%iy=ts~q)GJ0Hro*MKo;rt>XYot@5BM>NlOmZHk+=_Iwde^4JdzAoH`5sWk>Wb3y z_VzWjj&`Z804SjN{wSGo&@VdCB+8My2o)6-!J*w)3ew?vonLny$%vkfO3Hk~LixF~ zzw?k{;ZEDIy&q)G8FfPTyagqPlI@Ky>JaV#D=043F&oFs1$<`-XGO4+PslX)EFx8IN&=P(`}CP`Un~*b%lsWdc4dL|vLaMh2fM;!m;-O}^}p zx}szY8UioJZxhcXkdHeRQ5jEt>{$g4CQ1@14gIPQL2)V0rcp8yz2~_BU{wn{WuCHn zVVV?@VyY*^mSl<;y6(~LoS~gWX7b<)$ONK#*O-{Owqdr$BkH;L;V;BXUS2;6sY$JylEU<2<4lj7iUtL7EUw1?$oyWr3}xQa7EZ^d#h zA7TCrUvNN%O7UYf*sV~v4~eNgS46TKqiol}z)&Px9V1E=%D~hgXR18LCV1su$`Pyc z@8PZi@oDB6N~1h*8K+F|OrU4oRMuI~hCh`L)F^qeKOD0<+ByPP>O5z3jw!R;-#7V!*)(Om`0$zlmi~oS} zN($&f9_IJn=2qdJixkrj$LE$~xUmX>Cq%J)VT+)L(-$QK;~1fm9pFMXn)JCc;*QHU zXgYEi|K_z^(@+jpzZ>d`Y#p+=^*JsNjF0<|5v3pkcA~vHhq;_8xH-qmgN2Bf-~=y` z3Fv@84t>k}j?BI5BH0N6s;(8e#LnH`T^@G!@l+ZaP z4xSO7q)7A;j95ouDLz`7w~wx3d%@3~Zwk~^Ba3KiXvEpPV2oTq_$1@=a*oYXXmt8d z8MHRg<{j~Su5}a(RIg4bZg74!%ZoEmVMcQ8(WC6>!`{ns=^BN{dEVT_n-E$ zuU$T*zDlm9N10AmUEqnz~-eN7>zVh zSa}WM5ZAmcBEALZ@R+>%O21u_rhtKj@{$dtx#EOIv~j)-_6Ut3V_|i(<8IkYBc#6C-=G2JleqB;rYkY^T>RhZ#a z-kTxC%s7^xaP=^&%sPR+i-Gk2q#(r2B;Qv{z$yDc<-8h{cu(7lI1gBX%#zH#H z{)aVn0yVT%LPYhfe?;Wg{>Q@TJsyno2O?@UH9ZFCBcB9v#8=$!M5ges&IqWSr>PHb z6%!c!#JcD^-F4$ds34az{yH9}@_!{NBr|WcX0oJw{7!6E_xG3D0t=PX_GBm7Y@O}X z+`Wn7=+KP36F$!|f#70F_5;-aus;#QghhEbEfBA4_w#3JEy$hpauCA98oNNTFK$h{ zFaAJZ=SjN+w%vHG+UEs0YV%Bu)PN)b{2t92{~(f7{`q3$m}1c}+*(Rgy0KA!Ka43x zX{rQkmH~GB0a|rpeW_V=4}*q>_H=ldL5MC%H$(+0mPKS2ganA7;&M%RJklRtLgd6$ zB;L77er1GRp$HO+L2@c}*R;A9&a>F&J&u1?%|7mljlZI7qdi;dNGz<`MB?_r{nb}# zKMWJ!O2jT0*sWInnLq%-bdJ$)$ng%Q8D~kaf3wmf2`>Pr4flnwQs*6}UW-qyJf`Zi zQiCbkpz%t`4R%_bI^xr9EwnQV3b#L58^n?!PMpt~94YrdJ`2`$?Y>YtVN^fh`D(9T zT_+^dst;Qlibp|(&q$My&YPdBgq;YY=!rYf5Q?uT*poU7Z$1v#C}356TzhATETzV< zGOozZ0Uvem8daXl*&R=ZoyV&jwghxK3t zGG`eb@zEFA+@;N*UkJmd9njb|k%zy@YB&m2`rKUSx}l)C(wkCra!@(fivgQ4FF{t> zu!^jy6cjz?P`_Y(@K)zbL$BhkVDMnDl`~_o3McVbC%6=gS!x_)Mv6um?@bNw7zNX` zL9{;FUTGykJ7}5&_8=Q=g5ZTJ+h|LC|S*All0!{J(S0;8zSa?c4 zi1~0X--x{=ktkh8K;;`tYwH{)NiW1}fsHiHK{W>NCckS}&GcvmHB5mxZPX~N4VfKH zke4Y&INlB~u_Br0B}w*lT_TV;2hHSTSA)`UE+O~zh(q=yC<#bBRf&hOw6l&X%-?h~ z5-Rj$yn45rmM4lxZL#djq;Kp#CQZA4in7E_SlwGhzD%U}T=uJ@L|87*TWfT*7lF5P zO9~1@85f?-)kzk^(SO{8JofYmg}j{ATn8^eBk#dPU<10O^2M~j@u?&*Ui(&;Tj1wP z1TkvI#tiCM#Bz%I_EYTVUo7>P)N`KFQm=|8PhN0}^w`nWm|pfz#FE<6X#rIZ9qTLsA(~_UBN+Z6uE9yEfBHx zJzAcn{GJn_uX+t?GD8<Auzp6Wk{`}woP7X0l$gWn{*7SK^OLM8W9z1iA9-%H0yN-gv zDW+~L8H`CCBveM@MBr%K>)@&iQqkOEG0qLB-;ytnE!T|Kn%24ztUM71 zK>Gr9=5q*jSQF?VM?k(e4>jo7*$^Wl6^8hnV-i(Ru1jPOc&tJr;U!6y@~#h{cV^v;N!~|F zroET*wt~|i-c1ggsw!gJ8X2Vqmuyju;a$yX3A>D(U?%HK=K*GwxS4=`D?J@qs6I(U z2ZiEMNer>;hvJ6S{en+EWj=kLa|k2-Kp30=907c)HbFEGX(a5ecX7!m-k(fox95O8ln&(Da)U&%?z{-;+o; z49*>MU*Gr63)RA@)N~9NcTf0y>v1^Fty>JyyU`!Nc%bL)0Ghko%m z@cysqrf;9XEeByCsp4w(*-QYJxJ5{?i}9Rq)bXqh;@o%Pt-Oa&YX3TG#TVSR$Hf=+ zlb&fT0qYvJY3fFcdQWFJ6M8T*Wv|zsSCC8U&o{t5#4!*KXq=v(eBWFiJzI%Z2j5N~ zF1wcKkJe^6N(-+ua|cYcz86xcAzcI6nY=er4;ZgQ^TcB)<1q>Q5SC7#bCy@YH-_b{ z82`vO61)zg5w9pmAR>gNfk&l$BZtaC$6iMo#gPIR2Sr-PkdPGoW9<3Zbpy3mYf zuAORT)}#PBfuvb*!&eRxJUn17uuzUDsd0SGpVcOu6WsUK)nRuWwhBq%JI zKeJU;zAYkI8I}nt_rT3rDpZo9N_saa5})yTzFt)BP(@I0c7SAFw$v;%)P#10@>wx| za)SrOTsa3Ix3g^zH+sWqY#r3oUWTtmXXStcUW*0x-J#FiV^A|tQe