From bbe73308a73c08bf4fa789e44a825541fff08149 Mon Sep 17 00:00:00 2001 From: Sunil Singh Date: Wed, 3 Apr 2024 17:03:20 -0700 Subject: [PATCH] Adding the CAPI integrations dropdown and overview page to Rancher latest, v2.8, and v2.7. Adjusting the sidebars for the respective versions as well. Signed-off-by: Sunil Singh --- .../cluster-api/capi.md | 14 ++ .../cluster-api/overview.md | 210 ++++++++++++++++++ sidebars.js | 11 + static/img/30000ft_view.png | Bin 0 -> 103225 bytes .../cluster-api/capi.md | 14 ++ .../cluster-api/overview.md | 210 ++++++++++++++++++ .../cluster-api/capi.md | 14 ++ .../cluster-api/overview.md | 210 ++++++++++++++++++ versioned_sidebars/version-2.7-sidebars.json | 11 + versioned_sidebars/version-2.8-sidebars.json | 11 + 10 files changed, 705 insertions(+) create mode 100644 docs/integrations-in-rancher/cluster-api/capi.md create mode 100644 docs/integrations-in-rancher/cluster-api/overview.md create mode 100644 static/img/30000ft_view.png create mode 100644 versioned_docs/version-2.7/integrations-in-rancher/cluster-api/capi.md create mode 100644 versioned_docs/version-2.7/integrations-in-rancher/cluster-api/overview.md create mode 100644 versioned_docs/version-2.8/integrations-in-rancher/cluster-api/capi.md create mode 100644 versioned_docs/version-2.8/integrations-in-rancher/cluster-api/overview.md diff --git a/docs/integrations-in-rancher/cluster-api/capi.md b/docs/integrations-in-rancher/cluster-api/capi.md new file mode 100644 index 00000000000..53ec6f4a66f --- /dev/null +++ b/docs/integrations-in-rancher/cluster-api/capi.md @@ -0,0 +1,14 @@ +--- +title: Cluster API with Rancher Turtles +--- + + + + + +Rancher Turtles is a [Rancher extension](../rancher-extensions.md) that provides integration between your Cluster API (CAPI) and Rancher to manage the lifecycle of provisioned Kubernetes clusters. The main functionality is outlined below: + +- Importing CAPI clusters into Rancher: Installing the Rancher Cluster Agent in CAPI provisioned clusters. +- Configuration support for the CAPI Operator. + +The [Overview](./overview.md) section outlines installation options, the main architecture, and a brief demo. For more detailed information, please view the [Rancher Turtles documentation](https://docs.rancher-turtles.com/docs/intro). diff --git a/docs/integrations-in-rancher/cluster-api/overview.md b/docs/integrations-in-rancher/cluster-api/overview.md new file mode 100644 index 00000000000..4320dc87774 --- /dev/null +++ b/docs/integrations-in-rancher/cluster-api/overview.md @@ -0,0 +1,210 @@ +--- +title: Overview +--- + + + + + +## Demo + + + +## Installing the Rancher Turtles Operator + +### Via Rancher Dashboard + +This is the recommended option for installing Rancher Turtles. + +Using the Rancher UI, and by adding the Turtles repository, we can let Rancher process the installation and configuration of the Cluster API Extension. + +:::caution +If you already have the Cluster API Operator installed in your cluster, you need to use the [manual helm installation method](./overview.md#via-helm-install) instead. +::: + +:::info prerequisite +Before installing Rancher Turtles in your Rancher environment, Rancher's `embedded-cluster-api` functionality must be disabled. This includes also cleaning up Rancher-specific webhooks that otherwise would conflict with CAPI ones. + +To simplify setting up Rancher for installing Rancher Turtles, the official Rancher Turtles Helm chart includes a `pre-install` hook that applies these changes which are outlined below if manually removing: +- Disable the `embedded-cluster-api` feature in Rancher. +- Delete the `mutating-webhook-configuration` and `validating-webhook-configuration` webhooks that are no longer needed. +::: + +#### Installation + +- From your browser, access Rancher Manager and explore the **local** cluster. +- Using the left navigation panel, go to `Apps` -> `Repositories`. +- Click `Create` to add a new repository. +- Enter the following: + - **Name**: `turtles`. + - **Index URL**: https://rancher.github.io/turtles. +- Wait for the `turtles` repository to have a status of `Active`. +- Go to `Apps` -> `Charts`. +- Filter for `turtles`. +- Click `Rancher Turtles - the Cluster API Extension` +- Click `Install` -> `Next` -> `Install`. + +This will use the default values for the Helm chart, which are good for most installations. If your configuration requires overriding some of these defaults, you can either specify the values during installation from the Rancher UI or, alternatively, you can opt for the [manual installation via Helm](./overview.md#via-helm-install). If you are interested in learning more about the available values, you can check the Rancher Turtles [Helm chart reference guide](https://docs.rancher-turtles.com/docs/reference-guides/rancher-turtles-chart/values). + +The installation may take a few minutes and once completed you will see the following new deployments in the cluster: +- `rancher-turtles-system/rancher-turtles-controller-manager` +- `rancher-turtles-system/rancher-turtles-cluster-api-operator` +- `capi-system/capi-controller-manager` + +### Via Helm Install + +This section walks through different Helm installation options for Rancher Turtles depending on CAPI operator use: +- [Install Rancher Turtles with Cluster API Operator as a dependency](#install-rancher-turtles-with-cluster-api-operator-as-a-helm-dependency). +- [Install Rancher Turtles without Cluster API Operator](#install-rancher-turtles-without-cluster-api-operator-as-a-helm-dependency). + +The Cluster API Operator is required for installing Rancher Turtles and you can choose whether you want to take care of this dependency yourself or let the Rancher Turtles Helm chart manage it for you. We recommend [installing as a dependency](#install-rancher-turtles-with-cluster-api-operator-as-a-helm-dependency) for the sake of simplicity, but the best option may depend on your specific configuration. + +CAPI Operator allows for handling the lifecycle of Cluster API providers using a declarative approach, extending the capabilities of `clusterctl`. If you want to learn more about it, you can refer to [Cluster API Operator book](https://cluster-api-operator.sigs.k8s.io/). + +:::info prerequisite +Before installing Rancher Turtles in your Rancher environment, Rancher's `embedded-cluster-api` functionality must be disabled. This includes also cleaning up Rancher-specific webhooks that otherwise would conflict with CAPI ones. + +To simplify setting up Rancher for installing Rancher Turtles, the official Rancher Turtles Helm chart includes a `pre-install` hook that applies these changes which are outlined below: +- Disable the `embedded-cluster-api` feature in Rancher. +- Delete the `mutating-webhook-configuration` and `validating-webhook-configuration` webhooks that are no longer needed. +::: + +#### Install Rancher Turtles with `Cluster API Operator` as a Helm dependency + +The `rancher-turtles` chart is available in https://rancher.github.io/turtles and this Helm repository must be added before proceeding with the installation: + +```bash +helm repo add turtles https://rancher.github.io/turtles +helm repo update +``` + +As mentioned before, installing Rancher Turtles requires the [Cluster API Operator](https://github.com/kubernetes-sigs/cluster-api-operator) and the Helm chart can handle its installation automatically with a minimum set of flags: + +```bash +helm install rancher-turtles turtles/rancher-turtles --version v0.5.0 \ + -n rancher-turtles-system \ + --dependency-update \ + --create-namespace --wait \ + --timeout 180s +``` + +This operation could take a few minutes and once completed you can review the installed controllers listed below: +- `rancher-turtles-controller` +- `capi-operator` + +:::note +- If `cert-manager` is already available in the cluster, you can disable its installation as a Rancher Turtles dependency to avoid conflicts: +`--set cluster-api-operator.cert-manager.enabled=false` +- For a list of Rancher Turtles versions, refer to [Releases page](https://github.com/rancher/turtles/releases). +::: + +This is the basic, recommended configuration, which manages the creation of a secret containing the required CAPI feature flags (`CLUSTER_TOPOLOGY`, `EXP_CLUSTER_RESOURCE_SET` and `EXP_MACHINE_POOL` enabled) in the core provider namespace. These feature flags are required to enable additional Cluster API functionality. + +If you need to override the default behavior and use an existing secret (or add custom environment variables), you can pass the secret name helm flag. In this case, as a user, you are in charge of managing the secret creation and its content, including the minimum required features: `CLUSTER_TOPOLOGY`, `EXP_CLUSTER_RESOURCE_SET` and `EXP_MACHINE_POOL` enabled. + +```bash +helm install ... + # Passing secret name and namespace for additional environment variables + --set cluster-api-operator.cluster-api.configSecret.name= +``` + +The following is an example of a user-managed secret `cluster-api-operator.cluster-api.configSecret.name=variables` with `CLUSTER_TOPOLOGY`, `EXP_CLUSTER_RESOURCE_SET` and `EXP_MACHINE_POOL` feature flags set and an extra custom variable: + +```yaml title="secret.yaml" +apiVersion: v1 +kind: Secret +metadata: + name: variables + namespace: rancher-turtles-system +type: Opaque +stringData: + CLUSTER_TOPOLOGY: "true" + EXP_CLUSTER_RESOURCE_SET: "true" + EXP_MACHINE_POOL: "true" + CUSTOM_ENV_VAR: "false" +``` + +:::info +For detailed information on the values supported by the chart and their usage, refer to [Helm chart options](https://docs.rancher-turtles.com/docs/reference-guides/rancher-turtles-chart/values) +::: + +#### Install Rancher Turtles without `Cluster API Operator` as a Helm dependency + +:::note +Remember that if you opt for this installation option, you will need to manage the Cluster API Operator installation yourself. You can follow the [CAPI Operator guide](https://docs.rancher-turtles.com/docs/next/tasks/capi-operator/intro) in the Rancher Turtles documentation for assistance. +::: + +The `rancher-turtles` chart is available in https://rancher.github.io/turtles and this Helm repository must be added before proceeding with the installation: + +```bash +helm repo add turtles https://rancher.github.io/turtles +helm repo update +``` + +and then it can be installed into the `rancher-turtles-system` namespace with: + +```bash +helm install rancher-turtles turtles/rancher-turtles --version v0.5.0 + -n rancher-turtles-system + --set cluster-api-operator.enabled=false + --set cluster-api-operator.cluster-api.enabled=false + --create-namespace --wait + --dependency-update +``` + +As you can see, we are telling Helm to ignore installing `cluster-api-operator` as a dependency. + +This operation could take a few minutes and once completed you can review the installed controller listed below: +- `rancher-turtles-controller` + +## Uninstalling Rancher Turtles + +This section gives an overview of the Rancher Turtles uninstallation process. + +:::caution +When installing Rancher Turtles in your Rancher environment, by default, Rancher Turtles enables the Cluster API Operator cleanup. This includes cleaning up Cluster API Operator specific webhooks and deployments that otherwise cause issues with Rancher provisioning. + +To simplify uninstalling Rancher Turtles (via Rancher Manager or helm command), the official Rancher Turtles Helm chart includes a `post-delete` hook that applies these changes that are outlined below: +- Deletes the `mutating-webhook-configuration` and `validating-webhook-configuration` webhooks that are no longer needed. +- Deletes the CAPI `deployments` that are no longer needed. +::: + +To uninstall the Rancher Turtles Extension use the following helm command: + +```bash +helm uninstall -n rancher-turtles-system rancher-turtles --cascade foreground --wait +``` + +This may take a few minutes to complete. + +:::note +Remember that, if you use a different name for the installation or a different namespace, you may need to customize the command for your specific configuration. +::: + +Once uninstalled, Rancher's `embedded-cluster-api` feature must be re-enabled: + +1. Create a `feature.yaml` file, with `embedded-cluster-api` set to true: +```yaml title="feature.yaml" +apiVersion: management.cattle.io/v3 +kind: Feature +metadata: + name: embedded-cluster-api +spec: + value: true +``` +2. Use `kubectl` to apply the `feature.yaml` file to the cluster: +```bash +kubectl apply -f feature.yaml +``` + +## Architecture Diagram + +Below is a visual representation of the key components of Rancher Turtles and their relationship to Rancher Manager and the Rancher Cluster Agent. Understanding these components is essential for gaining insights into how Rancher leverages the Cluster API (CAPI) for cluster management. + +![overview](/img/30000ft_view.png) + +## Security + +[SLSA](https://slsa.dev/spec/v1.0/about) is a set of incrementally adoptable guidelines for supply chain security, established by industry consensus. The specification set by SLSA is useful for both software producers and consumers: producers can follow SLSA’s guidelines to make their software supply chain more secure, and consumers can use SLSA to make decisions about whether to trust a software package. + +Rancher Turtles meets [SLSA Level 3](https://slsa.dev/spec/v1.0/levels#build-l3) requirements for appropriate build platform, consistent build process, and provenance distribution. For more information, please visit the [Rancher Turtles Security](https://docs.rancher-turtles.com/docs/security/slsa) document. diff --git a/sidebars.js b/sidebars.js index 1ee600f77d4..ab01993973a 100644 --- a/sidebars.js +++ b/sidebars.js @@ -1215,6 +1215,17 @@ const sidebars = { 'integrations-in-rancher/cloud-marketplace/supportconfig' ] }, + { + "type": "category", + "label": "Cluster API with Rancher Turtles", + "link": { + "type": "doc", + "id": "integrations-in-rancher/cluster-api/capi" + }, + "items": [ + "integrations-in-rancher/cluster-api/overview" + ] + }, { type: 'category', label: 'CIS Scans', diff --git a/static/img/30000ft_view.png b/static/img/30000ft_view.png new file mode 100644 index 0000000000000000000000000000000000000000..7441fa1b9cf270ddc549c5b1f1c5e11c7008fb45 GIT binary patch literal 103225 zcmeFZXIN8Pw>FGjaiiOUD2S+l2nZ;>V*?BbNbjK12^~TS&5labAfR-mw?ujg0W5%k zfYd-BfFd;%DIwCovE0wOp7UJi*ZcnX&X4b7m%v;rYtA|5827lx7;~;?w=`8*nAw?` zn3z~lH?He2G3_X4V%k}}cQ>@CnWf?3^UZ;dyklyR-x(M1QQeHA`{cp zZ6+q!*Gx=oZV8pz@^E4IU3Jy#Ok2o5DWuFOXxZm>!`PFF>3BTy-!>HH;VWp|_c zSIDZ?vMPA^DsUa-@{FMc5ZdSpKYx!A%`{8kXFH6BDdml4sn0g#Hzx62+l7(O+B1K< z{b@OH|K5J2!ENtOGvxE$wbR3YzI1Z?Ha4VT`0u?SGWZF(T)PYTl-~LOy+=IACGBUr zC-}Ic(qv_&LC?SdAGYI-Mh+ga-{&p>TSA0+)Abeh_fq*Re0Q^0dk1z}N$d z4G>+YWb&q+J&hqW=I+K<< zTZ4Wyd(vI-4roWpvqNs%q!WI2QPqBv$*bQ(!gHKhQ@Dkxn6D+FUt5#B^P5XD%$!^H zbiKtA2DFY%)N}0N-}Ld}mo3aB5&!y^8cOf<#FX^pZ(VUEt-V!y9{OseN4=&}+5Fe5 z5%m_**dsh%O?xfJ+;L_kH#7Nlis|m5FDm*l4>nNU6yu@;rFAxZ(StcP%;wibR+dIG zewg{|Y>r)coIG%ri(s(R9F#f~boZMRZ{}=|Sf?%fhvnC3w#Mu?gM-9U6&PJuiX3`O zJVST~6H@};cHw)rnN?L+#Rh+e1pU5~dcgOuTQ0e$TBLfD@TDpr_!wF0b+%OBk<%K% zv;2~&U@Ow9u+A+_Qzb*_o&>+9Z2SDb+R6pJ!)NL|2r_T+qt6`YwBOmCQ^+w58FZS% z!N~Ex$TuEEvFeNpVmb(d}Z0)q1>8ElzD_q$9T&r-pKK(=<5R%|w?s6u)QDZid{yVB| z;)TDZ4bc)k=YijQCb}j|cT|$3l!moe0~*}79H3aY|?Q+u~t-52Q>*$v47DtqL2 z|LxNDVITQ6=da@_NXv;mqBG_PU>?*<4?tG8L00X-zBe7l&_`R67V0vSSow-a2J9O{(*su?us6 z=`_!l)YPP2n+@dU+hne^PDsFfArUOr*5sD)J3$=^zgxyK2@7`4pG78Ak&i_N6WgB? z0@LMzR{vPACpTm8O=brE9n0B;`u6}vmWAuSze!Zk2h@W`5D6@DGe~NHKR`=LtH5Aoq4iu3|SO&RjYd3W& zy5e^qG3;38*E%h^ec&Zic7gLOck1X6)BkbUdQQ|N;c)Ef^mIGQpE0RNAVWs=C*~Xx zo|!gR3HAJ#p4j1?`R}Xn@c(qg=8xTVb%VUcz5!rlwe5hy z$XEZvm&a;=XDP{6bVP zbmP|d`TFt;!;(f2tF%S;xw`Ai?|n|dS7T3ZW2?0}!rFJuP=CA^W zaJKTlYr_Ju$&gbHqw}j#0a2M<$pfhoiL#Az0+#;k?zdBthGv(=k-k&w?TLBDRBq0N+JpGxcw>rDBlw>Q{i)3CkevQ zrpN0@M;*~!=^mlb;5w%U4-pnb4E?xwv&I75!{#XCusvGww55n43vu+^zlH)r>wOF| zvA_mBuZ$+ddd{HyV@EC~ptW*LSFog|^`oEiy*Un?9fOVqb~M|l6-b(`%EC0rKX z?k2vX9BooK|8$Jds^?))Kx(e|vCD8q=f;7h{j89>cAlIc zi`*1WDtM?;zZ-2dcY4=qWk2yG5S8nD%P${k7Rk|DO2afMSUAk-#6>5i3-X|dq&a|& zmctu9cODQt3>Oki_f~*y?FE3>c%a$ zluuHxJo`v*^POgN|EnJuKJGH)-aF4l?+NyRpGfzmX2TUPjXv4z()vN(J}u{PJin=G z`7V&@4nQP93f$%FypdAnc=Nds>IGV(Ii7jeL>J$S+v(T+y10b?@R2FZOa(#Ld4N^Q zWMJfTGfJ*yqn)F_D0Pt6T+&%91Nl?H!-0@E$Z!)p4fl)PW)Z$O_My>ujpXuj(wgtF z{(4$U4yox^m~Of!hrgjWs+^o~i@b0hI_bR$)OGkIIN%gxnH~YNn&M58rmSC%YvWze zFOR&EiV_KCJSDxFHx$#+s0)`Bz90LqZ}eq@&)l#mJ5L_ar8biV(maTw3V8A*vM^3p zY=dO(91eDPKJNz~>Ml2UqU7`EnnBGRbFyH6vUl-|ChwDfICh|6H-0 zw%%f_^4@v*3Lt201i0!rDLy+y@>Y2Bu$2CMZ<5CVcG9pc3+Ni&zh$4fdGxzweWKpz zPt<#mtNnHWgNP4@y-XkH0u=#u>n^h{P)ppvbO~KWTxsB*yMRa~5?r^4IpTigqXI)E zg1RpOjN|^^#&++M%y;%Y(3_?#lJ*roMz*~@CgNo$`I|PVmYFN+R4ol@T z%7#nRu?uFcu*e5blj!EahhmdY?*r1zldVD5F2T1(5mpRgU~0GpbD}`=hAb=5LL&>N zR{jX2Ve$yritJ!cR7BZS+D4`FtOVarV`m*&oE38pCD)~!<{Z)HGlSKf*&Qe5l*HxZ zK)6fJjUEk3Y%*WR_e#`)f<`oQ46vXtB&7I zO!-lwauxkmL7z!wIf*9O9gXoU@8G-BVGw&B(`?Q0%HePq@|-X8k$_fdt-lZ}VPg89 z5oj$t1XOA%k?~auQ=3!GiUz`-8elfS87?0Iqms7U!M)DP{7~w0P{%Dt8M+aP zVV;HKK;{b`Yn-?j-4HsqZY%e?K9 zehjIJKG3~ks>Qkf%K(MxbXV$kGZM5Y{~)bM)_ZHXRbn`Ym$&cKGbXhfIq5l`$nI&F9?b^La1B3ly>Mv`FNnlYQOCg<_^8dkPOc zuE=0cO+r?WruDMk-=U8$tYItQLWad_SI5*nn2R50-hFmbxG0B0`;46+A97_~R$X!? zPhjL_3UiZcYD^!F{~oux6uZO@l8-wK6l&MLgUbdWuX#R!F4cXycb!#^lue7Fa`qd> zkUce6pC=V-UWy|3Ke|M#bv(p5mRr#*c676seV0OUhqMLG<+&4DK4{~hLh#zx?9xoW z=}Q)C^DWX9vU1&MCHk!bSuLY{14d9jd@GEsdT{EteCYw-&LhiNBcF1;J{3KyNB5Lu zj>k~C6cz47?uHdW?Z?GeZGj3d^_1U8)#AeX$Ai{NIIY^Ym?yo3^Cvw(L*0m; zw}8nO)OY^K_)=<8F=J2iwiTx4b~HIg8yL`{<_?_bOy;V}PBn0m697}>mgloO#?PB; zgj-tZAgv0^SgJA$cD)Y1(0s8cxz()FP%C0uAX~Ut)8xh7&QhMh)r~t=fxlo0tUi|) zP%PI1hIolKxQYw|bt%sFC~l%aZ`-w@n>AN-6*ar>4|HI4qjm%iIH|P7@^R{eS|^^D zLeI3yr)v3oIaw_wE90}TiilACQFwsylx!eY;@LmHo@EJi*Cn+)RatV*%v8ZheC(RU zFSzK>m6+*1){u+mC|8J}-Db8R}SxnGOt+hw9r7Nh4%ntkJ#Oq5S; z{OHWl_GBw3Xmv!7da}=;{Z2KaraxuMZse>T*jx@KhWj5j-4Z?1+m_l+d&*4DW^)_b z%J@!)6e5%1S%9YfqOfR+8=LQWvLDuj6dcm_dhJRTt~a{mmu>?@!wT^xZe68hp40*iSFy%-JdR*)0XTvVHoLe4^_?MXOp)4mOV-bN_tRlm6btEKjxHDlW`>b-(=he6iB`g>sN~dds4E z!Nd3Tqf-+XEqAS!cXMb|=Wcb^ThYSv(kfq$-|3WU?(Rb=$dCxSia?%IGe#PpQeds*GEi0%fe0|>iO!#a^fUsuG z9_Npp1puut^~wxn?x;CE++aKQGyQk@-@G@oDXGl zX~7s#ls0591cF6;Gebxa>J=#Xcb_s2MxHr14z%}A{+e<%5byES=Lm!zp8+8s=Pr-o z{~F&`=u-N2(WESyF}YVmt2cFRcd-;DDd~OY2Z_@0ACp=-;S|a0Lz!TXQ{CC&E%gS0 znE}DtfsEQ|o{^I=CB;2~Rs{gp1#k30yo2m)*#N365stYCLORN z9LU+|>2hiHiw7qlmcwK{HyZ{CF_-K23g0_d1V$Tgy22xG&X!d@u#ns09^=NL;E>od z69ClT@|z!6SaQp1?}>Q@r|lDyonCFK;6yaStwydox%i1M)oHMi-snNo=E8T)c(Uff zve3gt7zWxjY#d}>KlA(oW4DDb#eQyatE}I*%4_6Myy+QZhBnyUyeqGHA!jleo-kV` zg<`U)yhHr{*VOc>^$B+WSa%dl*e}D0?8)-@PG*`0A$rOMC6>o zVF@%fM@96Y*UYNzRQ1-nsmsDJSu>vP!r!i&T&>-8@&qK^?~O(BH^FlJU!~mt$yBS? zd02MtvE}23X@mR!Gg+WIzJ2KDk^9>}@)zKEGKn>XK5Wpt^idT^;ua(H=*%V4BdT8Q zUwUt&bbQ~JA?hX}w%cqO3+|xX@1vu?4}_%muHD_qb~&^_p5Jiavp!tf9B#2>K3p1% z7}0HDU=r9{dsvSePHwm!WGB!kf8_FVMA}2d$jf6(t81sS4v%CAt=(M3HWPpe82}GD zRg+(I_9|tfh$W;1>!0*hqD1ZW;oNbh{`?S^*(@e5sTKhJl{)?9S)^oy+J#Uj!fo& znJj(6Z>K7bs6q=XfCyaIFnMtng>}%5+gvdUv#_W%#EApZL4HAf4y07;Tmpf-HsUj#_$~K`Cf-qi$n@c)f`u>IQp9BkGHhOXGilms|j|cj31`2 z6m57}5txu}>C?R`z+gsBf*U=`Ifj-mOK@d;KeAjMfJhVaJ>Tv+_1TGD%`a(jfRe%Q zJ`^quNG9hOA^j8r(LF4;C~DPbu`}YKGIOv~cr~`Vrut3L!`UF`P~eC^r>1$phwQ%o z8{M9bsfH((R~bEoQJX?~VYh0D{>N8FGXehZ>ksbF_Xz{13<{>by64jpg$wIwfAd99 zuYL*;0bqYU-y@%(TYsMyN;sU$FgW#|!3)Y+d?RdlyZxa-Q@_hFdiDSjP%*>EH3LvH zOxpV&W!i)9)D+wt^$c;RfVE(~oDh1ftYwm^keR{R(59&a77IKyHB(7bB12pWI2vR= zFyqqsLNHQs1xT)h^b}cfjI!xF>Y98vj#Suq4Wk(;y{bb!@1kZD*HuWK1wonr?Tf>Lla`N-@ zOMDL9B>`2AvcaTjX2r0T{u~e1Poi=yOTCfG(ST zPH5Y|%HLfhlTCy4$M@y7Va?$Gbb5^Cj5!n?Yn35HYqeneuz zqFw6Mz^U-{q|JcqL*DGizq`tpg&i|(b(Yz5y5HJQRfYjUs|dseBXltKdNlWHDf&Gp zZP6$+a=*4-R%H8=(cVLW{U_#(TO}@jv`pRO{q0Nd@NNRo>&*62p>c&+S~%d|x7Vi? zygXIot=Ok%oyLrr+P%Ty6aB3jgdZbUk4}u(>PC$kHT#DLM)m}9PSEh%3 zYiM})YqFEn=sj(}PXMiT4ieJ@mSXbib^c@ByU_{8Y1O*bv zxjppIV6DUsl;P5VXGZe~QGKriITI+1iqtvCiUx~0^*S-_(dTLGxWBuXPs`IegrFmg z;6VTtvlVYz!k>Q&u`vjGcu;=I(FnhUJDw*e@?^V+d%**sgZfK5k~H)jY)X!4KGO%s z`yuF5T+(}0)8#jRaBy3y}KC(#$5H$78mGxd=Btpu-4sl6?n)DgjROL}Mrq9_BFc zLX%xGu!yG-s3FJD)6N}5QAgQ-rX%8f@jCx9R~eQpF;Q_H!9YYgA^H|wY&y!tb~j;b zX+-7VR7yN|zW|JLMOmNyq&}nkE!qp?En1xlky5dnTHcs&+qbk`{0kmFmy%2=rqaAU z(rut4z#Ch$?vUReS>9{|0}$V_(=6qU8^*h1q|B$MGdWESXR$%H(AY3%6zv`uOblcN zA@tO2MFRPtfAR0vFZ`)VpXgPwbY0Pp9AM9YrPhy(a1Oi7Ix&*5{zD-ARPU98HAM5a zp&^ZHRu7H>)zT?^E&;Kr`6xB#!y+v4og=%+UyrA>Ka{oCHF?X^*L8Q_rKn>(>Nv0@ zhi{(GD1~ilo7DAUaKqH2eLd%lN-G)Ye|ekq_z3$CaTn69S!tx`J;*Hz3xnPy;zG*c zo4-?~wn&!X#ewJ+$RLEwlvjPW*g=kv)vL5AYE}7XZ+$#lNWi2@4fIv{f(au%QD$t@E|hODyq32OrM3uX}uV_11JYh zPf9J`P%j%)KNg(9{vK<7zg8ij=$%S2HuiPVbK=f?Q5U9b!0K>jIll9m1> zn&TJKk+TvI{eYV!PeeZBu0(o(49R5UOLK&s*o;N<3v@MPao3bLWh6ol!~|lXw%}4z z7?Meef)*0lv~3N!jPzdS^5H&dx|J7ps_VnvUpiC~O~ByRC;Uy9#oW=!r$OnD(|BT? z!?_%O2K%Ipi3gVVR=wOTKTI`$P3 zX3Je>Od+>k`5uy3>9E@8#lNV7=VmEmzB3o>c?;x%LgEaB3_wJMy?fn`BrbUs=akWB zG5{lhTjLdtUcGkiTwd>fQ$LcPxwXZEYu$H_^FaE=btQ06Hyyb=^z^CFRX}i-XSamL6{7brXh?Ssd*7BJaoYk+FW8IjTvoYl|8Yp`eC+>bdRxGIX z@bSF#Qvxx;XenfYA>{-nhB4gArJH+H$MB6h`X--ddHPH0qdiClNqtQ2^I!V;1>dyh zb^RfS^onoKfsF#6|6!Y z1(5;7OY~3p2P$jBam)G9*sR}Sfx7nkiy6gNF-h-DAc(S82{;&ip<*#XGS4xKu=reH zbcmAQ-e$yz#?;D@GEQ6i%qX!w$p;HogP;eYiI6CI0SJ%emCi|74u)G~mb*h$pR*o`4W~aC|e;Mrkb$kL!19#2os3 znM(>7&(vtTKVmn$cE=|3-CxpMOGa)}v5iRb5RHUAFT3sMjB-=#`{eC`E>heCQi4dM zhQQ*HH~~Ug30aR-N_K7VS{N4szaMb|61EUava?&sar(IFnF?t&ITzO~h6+eHTzUSE zFJBiNP1~TqM(RwN4C}O1ChKu@SbC+yC^$tGOR3M5P>bqhi}w^ieYV!urO(=NF?-V( zC_6|@AB1-cpZ)PTr_x5{fuAt~LEbobb4bC}kG-C@8pWj@*sR(0Rna`aS!J-T8y!56 zT?MpoX;~5mo10QTm7qifFY@srDSZ5`lQ=N0)@|F^?0284tVjiCsCMJ40qD;B_(NAQ z-i^{e?Q1>LUvxoT4rhFJy#1&KKGar)!i2#SBQdTD8Zr>#lER<&CIUioq`v01qV>GN zYsnbQnZa7CwO;6eqzD-t2T8h;2nL?gCV8?{rd6kT{TYe3Tf?U0W<{b>L8P{w6?Yv@ z@0J-75GZ(?zP30?r5d4SgYV8&wuFm@A|45dNf^3h_95Jn-}jPyyB~O$0kCKAY475( zyUs&q3t%VP$85R41EQhg)%0!b?PZCVM&<6P<-NNaxHS2*8rOBZxA^^1Hvkax^5VtS z?_NW^<7g+dr_dj1mOTmIf4o^#-?v#Y3STl*x`H2_gwbNT?s_2bAAz{n=p9|{iIrgj# z^*G-~7$+v$M^M36SCty%EEl+L9)o0w1kksyyMCCuz$v1TP2T#ZTT;>?wiT6w$^7^$ zP^#F_(V)O$>u$2*sybKTntIY~!b+5;0r_!3O>l*!bKtXUV3PnH(4s##Ykw zk%f7ubR2V$!Q2$luYop5>wsDVGw z6`MZPGt|SJStqRg?Kh`xZcHZ5sAx!(bPzI_^%L{jr)^Hi205w`M(w^^#(O&9X_e@8 zCw%j20K!y=2a>Uc*-8b!>IY){)9!KE1pYclWq)m4~Z)3fH+ z8~FRtfT;`(9L;1)@EmzDc}5!~w4G8;TkEo-EBcfq6Ay3+l6y89=;|sjmrwDxgD)?^ zswQo&qH-uJl~TS*84De+pQ?92pimx=;D|<}MXFCQy-`)~UTK$D79M$SdqSaf;8+%K zQJ9*EH|ohocMztGqz)>^_Uym1CAEQ2*_33NneNwd))eg85oV3l&-jtu8e?X&y!|>x zlFZO@xf6=2@Wub!1ewyeZ~uZ0L}r2)zBG>&@IYjs390#T&iEN^U0o!#^G_uE%df;a zQW3uWUJ4#;E3{@*fq0#1T}Egi#G#N30uI@@ES!(>+PB;TAr6&JIX1#B5(|;bBWp+u z=Kbw<|JYebHr}~n0gr8eT0MgV(b+DKE<)pdMHk72kX?TKio$7w{%{Kt`D6<-A;Uq^ zR%`fHO<-%<0cJNyj0;{4%j&d34b}4qFTRO9f!p@rh@+{5y`xcwmg*ujupJ( z2~0zBr9vB|kI>-mp@ARr@MA8$m!FIF6DE`W3^f1$4V4bu0%>zH4RTM(o{RSJUD+W_x&i+&K|28wO$ zW(nUXiob*XcnUJiuB5rm`+cZ-d`ryS#WR=s?YSWoTzD>kL>V;!<+}X`k2-*}MRmYK zkPO?iLy7d(N5@e*9=0!$kdUSxAC1$`L+CQx2GsUE1gJpyC6)GrS~#tq0z#p4dncRy zoxA4tDdI><`Gh-r|f(7S#kez$54$0DQ% z#l_FvD67_E1hQa-wSgoe!8UyT#CS{^67M7Hkw3d(a?NtUIw12HMAa&mP+=g$(Cgc- zB8)HTmA^#^aJU2!NclbpSfHMXA4lL8q4pgRJ+M68`+^6S5smO`m=iDzepv7AfdkHp z#PMJIP@*ckggUK|6g;!KrhuaGXQLVi2cM^L(BqL0P1yX z%O!{{fCL4a91a-;iN`*W&*sVYv9qMhvwlJ9jyNd1<^0x7O+dmiP;meh4+w9ebT*Z) z>;S(ao*pL}p^nJtsFEBCQJ-;zWOM~&+ch|0>>KZMhoNE&(S^z{sH7U6(t}d2ScGr# zZ0FoTbsWU=?;i0NP-1m;=CEm%4lN*=1=pDjB%p=FFtQ#K_c_C?aAKih$sv#&Zj#WS zNZfbHM9k{myeCHS-x6buNpSi_2e``j{l0sp%q1Oeu77nG9rFTPS+;pJyR2SW4F^#H zrHXBO{ElbqyN;n#mJmi;m;%>#Jo2E;@CAW*iMQW_bnvTY2h^j)EL0)Q2OTf1UExIR z7)TI=)7E+S6#`;fl3K@2E;N{swT*OaZt5$>ufNOjl*M0y7>5~apPs=t-HxCN1S?u$ z6J~Sel1X&KVq{SjHc&b90gy6~++c^oEn*cI-7KwL_K+)5eOQ%9-&qng7UAfAj~E zTz$Mc0reKj$=C#A>(03z?nY1-f!w^FW_89CtTuY{^B~slYS=v0)JSEzM!l7sp)27} zBxWsGYdkE0eBYO5sxp!w)2fzBTRF0ZpfptYtFz`{Tj%giWFKnkf^|471Cqk8SFni^ z3k9>w`tVW#9m5ix#NJ&pdrVA=9OylrO}!6M!~}%@^dA$mNH`2h7@v_Me&ae&Ap6$e z_9M&U;o;|!az)D4a{$v3LJl@j3~4L~4<8*m2hU!jFK!^o7T&fBWmpk`Exi|8P?`X$ z{0%XH4cFlP{)>ioj^LN-8Xix?PfFR}*^!C^F+(5czfT%LQHl)QI@}_3w6{d$VAsEh zKVaMh@#i{-?@5;xZb~v65~{uinc=f|9Iww5 z0Jy~Ik3+qGso^9uS?#B@v&Uxh6H3lsGDQL&`%DOtSG_!jcB6?_lq?2LUYu7W*pN5}&+$ zEXOWWlKG%ZKI{gde<*u1HPC7r5*aNhM7*BlBE0&eApz^0$;sconQ)k8?g)?TK|{zR z9S~ZRF`NmY+Tii+pvI0f5%S>^9C<86=A~fTL7LXJYjjG@a!y{M30Hvst^Z`vfyK+W zNN9)AA89X`w1oOsb2a18VGTA=mL*4n^V~A`xp4{7rK>|5#lkDEk*w##%${e$Mv3Vo z>3sCT)JrCnlTVQ>RN?-qtE-JuCM;9m2|$tuS7kp*Gk|KAc&jE^Y+cjx^DlQCgN+0~ z8Z4b13(Z0^<3k4%|4uc@Zb!dNJ6NrdWyP1X)P5w;>muQ1WL4QGqj4HUAfA};(pe>o zIZwV^G@T*B$TeN-K{PUsJ{qJTqht&Nt)#S>gNV>Th$(@NOPC%mZirS6(jGtdKYDmL zTO{afJB4#42aoT5DCN^dBA1aHhHNHRw)*o6n;bWA+G%J!o=ENRXCsNo{R40^_#;4jDKIa*~`|P&&Hmh5moi>LJ zP~|uNZ0=+m`s?1m3#Q5($G;Q4ofZLd!Kd4Z;@q?^2j&n?jUn&=mlQDe$ZVN;Fx=}{ zQ`!G#(_`poWG7Qgb;9AmO(&%hi)_H@%B`0CW#QaYw6zX=^-~Qz=$4xw?20gxgo+%p zQ-y3kl1UBG$}0XCpzI=D3}rz`_oM(WhtD2kLG}$CL^cgaTbg0&v{sxa6yL)W$`=Yk z|0e~93;((O8EN>RyTD-EA9CUU^>aw}XYW_f{wdhP=>cTZ>-;io_uL2d9Ivd%KcR>Q zoYD|~%QrW1ckVEg**&P>m%(+Wlzl+?&xr>aWx-u;+h!+&Oa9yKS%6E6H;PHkOm3%a z!@_Ury(Yl#OiUX0lpkI`;{T&dd=x3+S2PI1@rHXUJ1s}?kx3J&hYCLY*~Tt@2rA_i z6MwdC(mCtz)P(wcuj76WRYsGVKPdaU)?4Ayo^>k0K3x0lkTMLTz+sGgu=CID!0thh z5FUrlO4dJ5VG4&`o`_Wc|AS%wN1BC{+spOTa@FXlDZ9Aj^%}L-A&h3SjPx1fJJoOP z6ofaG4x+Uw;~ECEk8)#z)#DRIr()mxXP+{fzY(>pJ0qrSr*N+5yn3Qim`lfE653L( zWx@H+FIua!H4=jzNY>c! zAy+JykTz#=6SNFBVMy_M-@G!1fk#njTTym@t;buO{54=4nMx2Dg!?0w=D1cX-PhN~ zzrNeyKlyTEtHX-K6_e|^_%z~Qo5bH`J2!2j7$R#AA5?9pJJmF@e|x(n6DXXf5#qV} zW1%@Bd&$}%s+(h?Z#iL8+ss5iXMMp+gJL+oz*SvQpErF(HEyYDoI-x1Y^;H`@TZsf z2)gdVmM9Sb@=Rx7bhoG&e4sO-hRCy8$={nxn4xbqE@4JY zOf2O(w)i^9;UhyzcBS$orY%~VmZQ<5X!=~Wj^1s;xfz1`hwt0*qh*K1c5iC5S#FVS z7vpy`8J6BJ8#sfa6uUhB=ZuTfR|#9va_5jlU?;69{cF5!x9BgpKNU#)F3syNXm9g6D2*zMtf4@pX>j znOuAniNUzZ`Nu*D8McMVhcK7h-Q5>vxA2RL>s#`v=Vd zt8nC!g9tu@mMK?tsZWfOgN+$jtIkwi9mYga-Il1z8#2B>C3AD(^`V`;c+3w;kXF4$+sbV>}_)u=tpUliD5$D zdxqMyxT+a3k{jjvTfXBvcsB~KWsE4pK^1aF{s}@$#|9&;W6jgfVQPu2XD`Y>ayi32 zZ_@W=yX|xdiHQ>P$82g`3DHiq=IA`ia2^inlwc0!~q95?%(dK;X9$cD@V70`9 z$u?AfxSQNkO#ITVb$bQzpm(ANtf%H&YwV8T(<^_`=EgHY8PdLA+tW{6`(9hUv1~dr zuOUU{(bCcy@$>VmkaX(3EnhQJ+CObRYwT=N_O7x2Yh$Cfhex4~uI?y}miyu19>EJ2 zZsPGQTis67%xfVB@_iEMYd!B$Q@g7J*RbQ!ajM7xs)XEQC*1Z7dZ<1mtgWp~E}MoN zZ&T9x4JD;$0s#)9id(xS91;!Iq~MV=k&7#^c(m*qc>xsGzvm`0@RkB4K4+_A6}(RZ%EXB(1@38@m>Ea);7VY*&@vc^cC8~Nzlsr4haca zziF}6NLDn@HOMdY3mmNSQ`s`wqk~e@(kh$m93H++pQZMX9j7t0*iN0oGlqgKgMxz8 zG&Ln7oE-w8FnrQ9^e?CtVw*Lvvy*(`7bhks-#%|rvkII6l~G%@X*khe?mkSfw+h}` zExSCI<7Cb=XzqGZ@IcYRoi%MV<`kV|bEG$Uxeeua< zF;P*TJ>EQtx~5u+D`}-JRMDeY-(xg-db=F=&3I56!Su)1V}66I7H zOe1S+8#~CC-jq|^h^*7koO(to^&uTHAJ$<$c#zzaZ>n!$A)GB-hXo*BnPEb<0P z{iJO@8s2uJ1Nl%?poU8gX7#%eHOi>o@nfxt zxj`GND4gQfx~Kn^G+?)_)7@lM@sw-9uaO?w>38lI<=NyXBZ}= z<+a61i<;bkaQ+tZ^0OYe-F&WXlE`n_efigJ;dKAm3RPUObH8N#R!No19m#kJ_aE0` z`2|m(z8tBzn#Ih_EROEU!(I{Q=Dy}L6j*l2F)k^|Wv3Dx8?Dz5xIg2HU`r4%~| zoIii7CTJtfvn5VKUCw*j{=L!#v}Jl_Nn;P#bBSZO0BLn9S2DFOJ3AYf22!Sa_dC~% z?70x=C;9mCV5=IS~+z^H8<9X_-s6U2>qUScxQ9Whk47 zfv<15q{~27V-z2n){`&#=H|k$U*EX4eygG|sSRKa&|*^J7=8Hg;U#j-X7@R3lZ@>? z)4lDs=I@vKpN>D+wZDt#;|izM!{a2KfWOJjc7FJJfg0R)9)%$u8WLNr zX{DI~XJGGqqO_X)xYD8bycM@Vu#%F(Qtez@t^$hP_nOkk{IwCjsf;_RVYU9z1d;E@ zyb;KSm9|ow$qj5*$BFC3eQHZ*tI)2ZOuySyqoxZ+G zO2PxKvapNa06Uk8H~|<_4bT`J9i4~~!l%a+72KSRNsHi=6X4@(_&s`$-sOr0uhCKL z&?)Xr5g#eqSfzJ}g zty?K|p={{+A9eLvbCYMexp`5$cI{$uF)OiZIPmz%6ZY|aLX)FA5Mv+rS{EK9b9| zs?2x(F6gC0SC+2WSsbp|y792p^Iuv@8$5=FhN1>Pg+}D)dd%cE9rM4-4m^)JqzAm` z&CPS%X$%@!YioU6iAE1?v=+@^jyxfza)eJ)JVRjo=g;GTqMlR18;D?&7g@sF)i5iB3_i;!_|1>tB z5?t_STN4i*9b7@gl9yfF)Y_o`9CUaBww7A$%LQrv@k4)|xI6H$hXOvX7{ma4MMFz| z{t?)CF?iu!J9kdx5~>R;lIOm@5o0}h(kWnhi6!mA`uh6PL~5iXvgr16sga6~c~UV` zDq$f9I30D@;8thvq|#~W#H6I49@FE<&f23wL2$5By{)@j->N?BF%556 z9BYY6PEL*yGR**!V?BEGxExz@xQ(tLs{YFur~;UuOYxCo$1>iC*$IG800eLP`n9Xy zwZ@!~|NFOZJT*#a+Y*T}7?qisIZK>V962W6nW0hC_htnk2whz7K2ksV297FJSkTQ=3OUh08@%Rc7a+P(Zi9m|yidNzT$8 zPXt~N5h0g4_jjeMv&EBdo{IwCF#7%bov>b$!7`Ty58q!^U_Exsz*PvXsTpzLq;v`ncUW0fHF?oKr_oyH%9ZCBa7Iz$I;#Q}RYI zW4RHEG0enl1vzVZ62>#xnaRO%(|9K=BKQI)H-;6s`j|gS0&DX3=W{X;YKk|#m3*Vt zOVVo=GvJ4?f7+b+p5W`;++2%5x_&r^RBP|&Yz(cZa&whd5e<>iWwH92pG?I@Jsc9S ztSKv2Y&Ov6e}9n=vQN3#wPwQr*GgMffNS2)m(! z0#3bDJyr1&69yIp`mCm=R_GH8Jzj=GtSv8ijdsJ#wSrfpRKnSLQHcCAG~zS-7RMZZ z4S!&neNhEaGCDR!xoO<`Pu#&X31mtvq9jN`Uf%4^ojV>Fj6N)sL7vfD1hO%mDf#_k z@hxf^8u};{ie!4wIC-eEQAsg%U zY}IQw)`qt50EYbmk}xcU&)}k>BwPpOM}XUAoS11zRvH>3f$b>JyL45EF^dO*=YW5} z@d%lgf~Gd^o$473T62y^18!U%fnxdPqCzxTc*LDxL7F0Mec_IrfO!+MUbZD9oa7#8 zO_0&uf9%4o%a`wgI@0UdEGIJJT{;jeKUw3{Crb6|)Idn?#~A<(aX>4uS$iN-&{iPR z01mT@V5t-iO9B>zog*=LP>6qm6_c?2dK}dOm}w&!KSP~?g=*Ojulb0J1}hkuPmimn zO-?$n^Fnv?CgwANHB91%PAYg zHcQ8jnuv;u>gnjb3*ibf3f`bu&h)e)&p(7bUnr{43q_%WX93U<%63V^bY*EH8Z8mL z84w*CE45l7QnRjuLl7^VT|zBYC0qx57Z1OLME6)PQ02azlR%0DLHY=40>4Dq`z5P- zdl;Pe^c~RDvBz*~qeacjt9ag*j5nwEWC|M>UazaGtK8aLYm@#M9~bAC7pf5O+l|E7 z!@{11_%@KrD&Q5kf0vs|E>0n1y}d@jdvh&og6iWe_R}s3W)EUb!36~_H1Z+Z8}$48 zo_v!MH9$aQ5J9VxeDUpI(@f%Fe|leAo(ZSE913KZ2d>SOiN?3Uzeosy&|gIBn`4An zf(8#`qi{HD$#{r#@N?B`tz*Zd8q*Ma1*OIQe5s1K0fZ^zrZ@!~kEfGBPP`}}y1>JA zpa;xw?KVznx8X1{JOgpY&b{xiY^*WJ;3ph!`ov5{ZURE3-1%!ClfAcXYeF{22?_ha zzH_BaWI+P){ToIcvR+w800XR?>fXSKn<9+1G&PA*{(>m%#hGhi{?yI+$lzBz^tquS z=^*f}SeQ|FnX4rVbD!~H57(=jni_Y)Ac!&9{rbwMgG%BNflKYG;iox)tbO@%!{0{+ zF}YeeykpA;>jv)rl8V02DxH=IZUiA3;X#t3q8+w-eliCAwZ!aNi)Au=<_6;+uqwFn zir)GqW_Wsh+-|V~bQ7T_5FB8kgJ|Gt`KDz8@JJAu_d~|d5;qK{8=1RVTb18pSavHs z%Nh&ihFTeqf1StB;Jw4p5o$9^ei-3 zl$6AFRL9)hTtqr0DM;=NC`1AWy!HYaPSo83K7vKx+&z`tyPpreQZpuD+bSAJ<^ZRoF>^VOv(Njxla{^$~LNimCPh zG$HveCKF*eI)k+QFTY35(EpE+prFJ%u=0|mE-m<9)et7b%Kyy&Ugm!N4qgoeMD73n zRd;qJ{A+wR$86xWIbt4J_u`FTrEByl^&zkKf#*ukIVTfZR7;`Gid-eGd^tuc3#|UL zQcO&}_pj~x^NPL8&C35v6)a?w|9+p}F!E|HK>= z5;Cp(7S8_T1>RTusJ9_&U0=}-X!l@28h1d)<%knZkAQ2_xFq+7Z}=|%}by1N?z zk@Qe^F7)}mH{Nmoxc7|lj7N|A?6c3_Yt1$5`&mmWUls04S8dp=1s6sX{`ZS;4F5Oa zAvodx1|mpq0B(ui87?Us{gsjR6QfGlKfUa&rM9?oBGL?wA?OAQ{fDQ)WYL5{kX=<& z-!k9#CdMf?r|tbFJ(>g-Iky@UWfB`1xO4!;#A>PjiK3gm>L8;&|NO5TLy)#7q(*6b znB4!;CY54ppM*wv4B_Z|Zb~K<5-lyh2bbr6{>*^Cw2x@R4XApDo{Juxt#6qM8ylN% zg_@L9e5t^Q$qF<0Q!m~CqvHIjvr8$lRRz8kR0Ms&^9|^p5yJ#voxr-}60JiE73QZq z9OqkPJ=gqy{`(x{u?ui;HdIZ?F2?dQNo>+X#C!;VsUlf_@5P%XTTFa^7c5Y_cyocY@w^-%?Cgyy1yXOjy;WM@^XfD%Wl~93pA@7GKs=5aFR#R z0So`6bA8J$5s4!Hl|NA}by}zxDy~(>L;rDk%xcNnKE*t8<~*E%|6|Ref+i@ooA&Z* z?_eoG-h-J1()<$BFgTCd%l}o}o_b!I^!m?Rx+adU5$)JFpj!e+58MDZLf`*7NdG^V zmd#{W_L;@OmVQ1=H{o!=5Uf3zRd)=52L(b--8KKrMmpZVM*pwrjGg{lJNW-q;YPe6 zj2Sz$;QZc9*;%B6ZdB-w+@y!9Ge+*p5&E$)(4w$j`C8e&Eq5MbEjGFEs8+nOB zZv_Q-iXc3GNjL?~jqKE(@O2BL&ElZy`bhJ{;}0Du_eO4JfymCmc2h?0LkMcgcQKbK zFZlMVj7A8C&oq%7iSdp@A?G52-VaixAG)n?v=^*3H{=&CtXp#=>2a_&8r&Cvjx{mhBH>fBq2K7ppRz1kP)CF0Z6TA%B&7~C5lFfNZOVL;DW%i*gmm{P z??`2bm~dZ%jw#gh+R@WFQzyB5yr;T9MQMWy3V^;5Riv z%e<)m8ziY?nQ(j>0OHqf5S9fj9BG~5m_!=fwPIjO@ND}TvsW*GMCVxmbncWuQ|M%I zEp%B5loCRJhQksr&ju)2ba{H>e3KzTJjITbN!gjhVacUxgBtjusC5>40W>X@AJ>m` z9~fwou7V^Ebr=!%E?RBL=`MZC=UPKei=eT9t}vD(s?hUgzN{?uq@0rmwHQ~=Pr}2T zoA;CQjdgTD8g*Z`2480?XgmfjOwoyKzWq#^h${;qd`(_C!{KrQfdxE9hqIvLgLpK4 zgFz7P%z97EwMA#sWGdY~%d0}}(ZZ}QVHQ|(c*LSFVP-+=ah+WmUviBdx2pzKgc;Ie z0OMh#E{Wyjj{RIc$KoRq5O>(^K_l1Y%L|&^e$Z#!5Wwa80XQyNmOr6En$*a3L-;6Y zs?<9-LCgXYod!Ef=s||Q;TQPJcb0H{Pj}2nZA2|29n06qVrk zb7QVU%-MDGFQ*F|!k*Nz@c@|xG|h&;oJ@Vakq$Lt(R6NS8~bOU9cK`Wg;p#ROC!)( z_y8>v+KCUl-?rql-*$e@+^{W#*54ECpHut!sJ!oIS3on$JvER7{$HRj4DXjsSV)Vs zCh;Jr-Syi6q%SbhdUEC?P)ln<$#ZR<;HKz>BqBic6_C6MSw9@)JY@@V zDCm>raM%MABv1r2i@Eo5hke8Bqfay+vO_m1G+IhR>nnRDF$@SjI-qzeen9L9fdw%R zQ1dZav(cva>AcILB_NU)HKw>YK03zP4FYh+Bn;m{zX|nCB|ic`%I(1=%R7d09Eq3d z96C6G*&-a!NGc!yXP@JwuVuxdn(;YNQih;vrXUefMgwzCHvON9~;VM(Ondw^kUR2PBx1s6w7yZGn4uKBPa=gUr z^a$q9Ku&s9=sOA!2+HXuI~aP+(zm`)geasa0i5W!SgQ`V3wyv^Y`eo|<=PL8mCgH7 zTJh@XOk5ZC*|pg!Q#$O(=ae|U5))2o`;aP%n+93+3=%kpM4GM*eLf+ZMyA3V6q#qw z2lC1D1uV?$MXG%uJ>pz3bHr|JuFNF2NyUFFPI@Q6k%oGC*S2gsL9S|I=A1R{AeKG5 zBRx3Z0vL^jH_uZ|2(~u(){U$hH)KXKY5JGf%d}$}Wl6 z3M&J0#;sf{Xw1vKKa8DD>rOw%v4v6#DX~R4EVxAG0)1$oV>B@8aLBBSe|Cab!78 zK;RtocXl~u=FZpXN`VzWwgio;DZ2F~{tM8_+Bc_*Km_enpnKGe%Cdg3zG;?8WG0UL z=}odqwzTUSoiNq8_XdM{p%oWZw}uM zMT!773P=E4P8N|Fw8?TLWy0dA%aX=}p5WXT*Fw?*+78 z*Aa}v1TWu6emYqWO4i9$+|mUBuJU0Oqn;LQp^0^mC2L+7ES5pd^i@5j%ZQ5gANoe+ zRXM|4$(;xQvMs;7-7Pxk3{A7p*2-G)u;&fPQyb<4z3Y;clzNUS$zvzz(?yHu-&)&= zHQrOT6{9LV;mV}G_v3B*Q7+;=X3*KY#}BYOL`e?oebN4cOaf}JMN)dx4PcB_P1l^F zZ~Jjs7H= zIa)h8HqS6V>Wi!S`6a8~xQTjYi7`tb+Hn8r#+w7jz)FSZQLTBWqlKc&v|pk4D)i;D zZ`FxLTYCT1NEohR{Y>lT-|FJGy8P~JQi)bKNC7M&T38<#KYCs+wp=B&ip-E=MVaqy-ThylGfL~>591IbTvXK%6EfwBr(~f zu#0$cqc}Lqqj$MUYFpFLNTB;9tA%(!i$c!zA2Y?YLjvN8x@#&*Nmo4h3hHJ`Pi?L} z2VqBZrfUW;M2uLTp)bMHfKPWC#;mZ67#jJaNFi}dT1iRCakUxqzqk{Kdq;9r-%?TC zeNh69mZbWue*a`ppaVH9)s=%!l)U}PKM;Dh7v)Zv(AaJ3E`>D}^=A;5}y^umYk0G_4lq`J|^sgLG3c5i|fQT(Nsm$`voU9Ph4o&rO$JAL$z%{!zQthsiOLYr%VLebsqdAITB(i>2PFZ^;xND| zdJ2oPmvSl&(LH?OlnvA2XT5o*#zQCj;CmuQeOQu|Px9pb4)AeM6M_T_hSfEr`nVfm z2K1nVucI%*M9GumK5{S<+Z;Y{www=k1*n>?1J72k8XRrpvT2GM!@>#w3L?pp#eATb z;zP8X!&S*9;p%lkXsKL--ydXA1aGBK+=<@&h;*`EdljJO%25 zI*tie05KpJM(C_0LK@gmaDD=X(9;0uzh~8T3Pero&?!G@2^u>DLbyK}zYb0OXsrSk z7m}yWi2nqn1IOeZC`V9lzoypq7Fd7Kt)Py31ndH#-o3g@8E7oQM}Zk+7%7Ln`+$!r z?n`+oIODPXKzKGIh6d#uLhOYlLJf347^DFb!fjv#A&E6KDWf6A>sp{TOrV1+2a0xy zkz{H#ei62(&sZHna%twNelTm%-A@G~khP^2(lvL3-CAE)84pOn!NWOo{}1g1uUiLPBNXhN3vVToMh1M43zG`Eeq%ID8Z$73tpmIkyR{Z zfwn)7jSC&%7e2ekc7A)$^n$@ttJp)_+ac!x6iXPGES{&@kZ2?T7PG4moS4L{#y=Wx zNP{2&!U%u^X?D8Es)o_b_k^(D1|dI(U;zrD-u-Asx*Gp2o2O|JlCaG5rAz`6qUhib zm^OTnfVq8p3bdrQ&{&5>tky``B+NnS4+IEc zyC5wfQsV%#YrUiI)Z{kIWF(a8u^F^0p@T=YBH}3lt}mdElHi}ttXrqs8a>Y5E32eu zj&gf7Y5`%#v2q8ZZc?DK<^sSD!b&vlkF>Ln1X=F(2 z7)vP#&%2^9Lg{-TQv}lhu^IrNgg_H80`Cf8)#YB+)or8{-tR(p#(0WIP9JcAh){{f zG+>zKs$GrHa{Kq&KOKHMM1SwX%2dG(T}F8pbA|HJ{b-WrfKZP_xdYKBp5xD`IPARK+JLFr&HSo%1ox zfHNi0&(FxtCzrErGF?(Aw8YwzrZr%@Hd1XdFGD8+KW|h_Xcw zyagcVImWH6L(x;YznAaQ@1OD5!|!Rp^*#Gn$%XAPpkY=u!WFAff98zQ z2sLB_6~iB77i`jxXMn@)P->5mOAlDKoF}eliVr0;^O?vf*cTr%@@K143knK)K%_4B zD$jX7Eh9tPq3&UrNd0tYk}pl_cFk$y(XeZ#D=Y^`Xy-$s28I?)WH<|Rw-O=pW7FXo zzWpS%w9{&Wzu`C=UdJc*&wk{&TS1r{YEx5FmEOX_6X)l$)gPM#1MVAOwFv30=%Z%o zN5^mw>H;m09iN#gI3r=C=`R*I)YqvFDlIQB2P7;Qd~tFbND(YF(KT{iYvo!OQxr#J z|>hikqSpB1}b`qP;NlZCnQ z>>1iT;^u+;%bD^u+c$4)@@$13ct5Oq@+G8zL1oaTKXq8&G2htnvsfhTonkP`DJlQ1 z=+|$}qFX*CkI{dvGIEB^11tGUAr!jjN-<;OGf5#yyzwUw){9&QN<@3N77bSd+z4N~ zdF!a}v=Gpm>`IWi4#h#0Ghe?`z+y12X5}^QZn}a zl*TkV$B>g_XFBg^d@Qj&+q=IG=%6v?t78-Ig5YKd^Bzd@ne-<8b)^;GSOF)w$%9c-)qz9VK3PLCRY-*d8@=6(>8lOpOsdlTVdsgpQgozd> zN@2TM&OFBpykn^c_ zwSp-A`|(15M%scbUr05g%sD*)4pE5Ar}?7&&9Aqg4M!!xMTOtrGbMHEyy6&QT}wq34ZY-D z4p^wb75e9vN;s-vk2?Z1xbb#c*U3?x#`2&qplmi?34qplLYhMc+!*FmQPCZ`G?1Xx z$J|n%CxST`A@23jxNPEP=h$;REByo)>w}9hECh6DjL+4OhItM6S05YY*n#|nW z#qPk1C`6C~6hh0W(fjj%C7_Lsw>!acJjAAPO3Hs?hrYH|E4Godpr>{NvX$6vX&u#m zlGcz9p~hX6z+P;&zq|Cb13>!-d2R0uYSZ{E1kGxzFIV;Lxf7q;V+`RU(rh9g5=i3U zxPyL(Q;jP8AZODCj^Cjm8>bh%YhdBg0l`QC7N9)}@JoR|gJ5AuYzlq=s5Au}|D}CF zuY7(p44@;3Clc53aU&};x8gk@+u%wTdMffE*zPi90lE~5BY{+jm?Rg~Y=ICU2f1sw zJ6+YIj{#7I=x-GxnWTFr??a-E7^iT#H_8&?Jbbf1I(ZV;(PY$MhzIU;7Z1zz;kLb3mlIH2s@G2f}C4Ow*56l#EEjsRfu`gF2%|oxKR2&^9;- zq{?m}JJc;gt~i5e`%dM(oHCR7&eur){;L;2oAJQ!0bc{a2E!)ni1!$PJbVOvnBl5$ zuJdDGQc7}C!gl_4MhVD7d+oZ`2Jk^qrgZwU3@Hmi2A`q*P`VUZJnnx`H>hr)+&es& zuE({=@q?@{z>`o(4b4C+Gy@wAzpOh?=nOm0E@6MvoHnBD=I2GQ^Fj&)=M&rCp$EJg zO8s@CYeevY-GilInnYJd5!cdeCHFaEJv^H0{ku&>L6^d65%u` zX9egjmLs9oDeup0FdgZJ8A`3SwLD~JCh~*#6Yw_$2DjEL6=75&b`1Ifom9z4GLemh?bMTx~tMM!h!5w6$oNk*Cu!9FnD6fgAr0!HBX^@4SBsv2l8fAvTtquxyezbL7FB_0`2nivp zb%P4!i$THv4FI=3`xNBevJ_ORv=D(kUwwr zc76!P;sUpNKIBgbfMbuCf#BSaP-Y#1JXRphzdj~P(H*ZDVYwd$222X50|*-hy7zw^ zIqI?KtWUh5c~_nwj0l|0zn3Mcer-vI)T?AkfQxZkC`2D0@^Q#+2P>l(u;l?bk4Q!I&o$jM~r&9!|2qd%H z;Q6B@`>7W&Y<=7N9kFVN{PxJbjKG2JB4FlQ?lEJ5@8(-zOU3(%%<=eB1pBuxTTei! zLCAynSm*SJ#S9FD3YwfpWGf%u&&sV~uL|>lO3k@Fp2?n#=v^ozp#g(p2pVP598vxbeW%raYJAU)}G&(G(455$CZj*zMDi=2h9kaPt|2-1*upwWi_5%2{@SnRrG z1xWpURi%I`!s=?R6TdPW?h?^cHfyHx3sR#ptx^wrIy_+Xvbi)|ga=@$9`?#8^$S4l zAmQyxS!vbje_|&V5hz~X1- zc$ziuV|Jn7-l!akh@tR=p!#biy{WUc(=!e+xyNoS=7+qYm8r9u=sdpNMHK{nf6~T$ zZFY9Kvd?#w27_-k?q@3L19%FI%_4^0PxHAqZXCFfU5KHpFk06YvJletLp%) z&kfrov!f$d{qCs-;~vd@LGg77$P6OxV7@Y0inwUZZIfjv4jIjKSB}cH5o_%1-t`De1@t5SlzF4o<2#)}cT0{r#`MnOz;-r}?-aepvY1oH$FAVGx!ilwQWwu;Nozid z8awC3i--n59C{W!lxmtZ+BTN^f8`_)M@T`D77_dYpIC$wgZ<_?CJCFJ4bEuIMxdqq z6kmG)DE&+BpbU_#ajVpH11T(W>i}2wwfP4?MclG#8yNG5!4pl~UhJXoOn*if})XX*^I$ zAtfPm>cNxz0m)ymwU7)0{&i%2b|%6)HTxU4?hM?my!Z#|gb1^SuqKE->N;@hCy4lA z36z1`fpTtu7wfcRfMPri37=f>&Pa6j(#dzIe7Qahwea#-8}N)ZuZ>N_p?G-m)91`Wd3<0nR+KyXAtU`#=)A1!c0yav(ahcbW^|PQSd~_6+@q+15=dfUZKuplht9 znb5Yf;K}2-qZ{8d)e&3=?Z5!WeA(499o=m3Qc!LLEiA}u0E86yavNEDknre)bCrLem zZlao+vF>zGcj*k|AL%kvBI-tL8@C+RMt3%V<&bC9iH9&!0CSFDM~qMeS^?%*cVbk? z3GN8JJoT(p#3;^RY&*TTmP?FsFNo4ocRzDySHw97xIU;c0@7cQsxz4Lj-crlr2_X5 z0iDZ#J&}W>e#_kLrbh#~RZmgcPRJ1Cp{d1bD-Z#1}52dET zDFqIT$d|nfz;87KbS_$Qup1u-eRhti85JFO6Q(UQ)KzibC|>D=ybuGQ}=Wi@jyqZ7)dRp}~PRL1E7_c;AZ? zJ8d_UdIK7bP@=(n1hP4XzgarF?v{D)GZ`k8|9HqEsi@#Q!nGYYuVB+}k_8vKOOB(* zjJoj)j3c05d>vXxVV_V_X%IZ2_EKo|94O_+%zC+buUW(;Nc-{p@flDX7CQ)Klggr} zCmOv8DL-u;=zO(VQbgj;nGKnASrR{8XmtJb*rTyK$d&nM^KnBn^A_ad)kw9b8oO2Q z-?t@1J5RAHsX48_5iL4@>QvjW@o$$e{u*rAg~r%UA~h%V6-k`PlSk-V`fq19ORDZO zHAn7qum^s%7Y@DTSiQxYKLchQvg`Jxy$8pCKr$O_kLh|5aNf{eCe38vrJo8=(FBt) zY%>o8D+HHAn_5)5SSYz~oj>6gT%*OT-;<#bu<&XL`k*r}-s5hRAZ_h+Hyw|$Gk9Eo-s?hF zhp6DsVKy7h{wMdrrYc5T1vZC)LP4p(h>3F4^Go{pH3)7Q~psX=e*3>-{(egvG@Q}5)m}9@Y*#dOoRy$r;$EdOFPKzgm@2;9(J+q!0mHUE(;=x`x=F=qE z?btGicQ*zo+6z_OSD>XsA9&|z5tU96chC0$6nRShZ|r=2vesoo*j>eWZ#QUfP!4E% zpj9*ChB$MPlv`)6?Ni-kS67$AN^1m%xH!*7Ao``hew7@wDwWyg!tkIK8Z0no`MLz- zIsZlV5l{@JfJP&`?Dwuu-{7R$$zYA>%!Q@uagC;Nhg9mW$(S&EvgBFSVHH@5N#HlIQkhD^wMd=qAT5KTGgPtd!i!zkh$Osv3O)Bnx0Ka!wPzcymB%CP3x98}>~2$Hs5(R@f4gl^WnYXe~skg9+Um zB-w%Fq4;99 zge?N*p;wKx9^$BH|GLH&VG9;oS+M_Y5XADhx^f_R9(4PlZ8u=5SOJE0@(c7C`WPxl z2O28J*Xoj8FoXg*s`E9tjwY&?y9WY07&)+~G7p1%2k-$AR1sJ^h>8R>DnJKmuMea0 z_J9f?pUk7dHDj;Fu3J|_{~fH$TlCuD%x;9=Ipqln2w3ms_cDtXF$GH~2`zLadav5S z9en5G!;M_0#NrPQWh#5Xu$b7_#w50pX%Eam-Ri(;I9dx0z|5p+eGX%;XO zSk=ECdmdzuXY$xL*Z2P5P=ul^bvxB0Ekl~)@^Q(IUSW@-7iShj2%_B-D(u1~W9PQd7Udg9(r}y=wp)Cg$e3V$t0C+=V||oUkzg0Rd}SrOrE> z>{4-wCD!F&S9?L{uCZcrJPUg2Sr;}GOmBbIeQiR;TQibag@d}Z($0q9@NU>nyBx-T z&!ty3pim{W@eL*Wpt0!Y-JRE@%auaIhn$h@34y5$!4az#ve)yf^WdXUTwJQTg^SI6rXV_f%(n{?KW=byfJ=?FdPI(TF# zo7}5rUp+J?>GrI9zHQLW9&=lEbGKK^qNfBwwW?;H7lyU{{Nu0=5BM5fE6X(+UTt zfR6^VGOz!`8H}M>yW6`oI^=lz?tGK~v!epL&$fvuB+V|v#xctd#y?2>hX0EeH%1zd zhTn_xhOtAus4Tt(e?_Hrn+hIz1Q10V)qp*wyZ_~TsEgrJ672d@%F-IjX{6vD&PXeZ z+FMX;M%1EAZ2CwmkMAMLNec{IRS!61xRcG+?yXaQc=mMKV?DL8QQ1z{=bmyiKYFssCHmrG)2?B^o|=Ogb|t`NnJGlrPX{% zBh#-?L~eQXpm2C0({zctJ2N6bTE~h0>({S7%~?o8=Et|+rxW!{N}Q*bR2ejutYh(h zd>`RO>GUG6T=*eNFnH{cWkB>_aN6_kH`{!94~25PbN@m@9v3BD6fhzLC#<5R=L#i< zolW9zWOniZ0v17!Szs!?=uR4Z~$+qkr2E zzty`ziyO&(HTt5|FQb(BD-&15+}!$3tx!#tM7G{nZmpzBw-L=-fQdta58}6AmM^-8iD%ziBKl)S!v5VPU+f}E%jo$A~O|PFNem%=j<_2NO>dVRe&!4}7 zAz8QD!e#pO0e%6KCBfC(|VVfe{|6OzZ)P`z#{9zasReNnTyr=^c+g1}{)*X&C^;DZ9w(5TG*!T9 zEy_s7iI<txX%J^m!*S7r+_H%y3uY-Gfa4R2QGmwUBHQO#DT;qtsU-S3! z^z>{xjjw#k<njQcbfim z<$eLhH;;1~vs%~Sg}=MECrVGk&+qG@&|IB}9sF2Eb^m^`o%)nn@#CxLh-+y?*Ncu} zo^sic)3v_;wXpue@H5`wi;Ymk>~!JE(8GxqE&dAbXUoswa^SV#YiV|xYhvB7@B(R{ z+TV96Z$*in^c9dwHoko3$w$5G*1Oy0yW5j~7&jnnJpAuKLL?FDyxPc0mr8-f^m$tEaXo<@< z=Y~C>!||;Ta8uDM&f_cIkd7Fg_%eQn)W7Sv4^J;4G0`h#a$+Q8$mV`$9vQ(p{FSx_KPicVjrETVevi%6$H8(&I*wM4GUA`e6 z&04$!QfEA3;+xUlUS1FN^>1PJ^h~w15}uj>`eb}+>NUU%e2AGI842=lF;yGab%;kE z!EpCh`u%+pY$R-K=8dhbf*KmvAn0-fb?~Ya&>R|;3XKQf9zRR?V!k7BqBvgA?}(d( zBsm$GH+t{S@9BwR%h{F&=Ubkn6u~z+GzB}}S2s6b7BA(dwY|v?FP(>pl3vI9a$d`) zcgyzMw8cKm`P^~9Ig+WwvAPR!E{6ClkKT?zfQ8mWx<Uz!I#C)Ke#82#`i zZt)E?xYlUcJ_7fF;0H#ABV<#8nDK?1U50Er&RodZci!HQm6ao(x_Hg;j+`(^5{u^a z26?U7{$2EaY(Ryp(OdGwqmGqKMML1mjT=+5vt&URIcQFvgl*JIOH1wOnVByEhv2D* z2!ZgK+M1g0&R!{D^TYI~D1OHHbNP^lb)Pahxue@ws?zptC57ak^CtO`k{z&Shrj6Z z#fvZUXrAlnTpt1Pb#8`VpdK%stgNi3uWxOF&_~Q1zT$jn2WbhvUuR&Y=p#=h@#1eO z{{Jjz+vHZ|mjmCbWf$VTj;Fy`qYdO?0Zn*p)RAN#}Uuld`qqabOb?SJN# zURPA{@B24{p0#wtEIw_*a{2cVW0Sq%+KGo9wy_(+%4Lk zsey6x5Ip&xbuwTSF^l-*9nyutWQ#=>K12hGf5sh7WwjbW8WlFgeoyx#S@Gj5=$RSx zgpRR4b{%g2l=<=Fka{RZX|U1UgD&YmHaQ_&$It;7bT*dR*2k+fu3?S@BP2Z%%NIRU zC{=$hVSjNUgV+yKnhI$HT5G z75mP|H+883&_kAaRm!(>5#D(-q|WLv+oJomREeng8>5ocTk9G))A(4BhjW$f^vSHG35)T|=&>qT*A^?=9fx-`8b_};P&|v*H5`;&zSuMns7}G8 zEiX8AIZ$1*Q3i7Ii#I3@&%JS-Ig0riqxG1{poCsGn*U^wt@}!EvOABUF|0RD9~5Yd zq)X$JYArn4GVXEpy?7_$o7}VO+JJFO@z4J5Oyarl#QFZ&Ttk=IN>!?Bhf}CmS(>fk&>h5(zTAg*(94m+zMcfU7Qyo(s%o4)V{%vks-xO37GJvJ5| z5B%Chmtu+ntS`%b4kdry8DufWhbFHg(jfoMnm z&|;ClD?aAeVsNH~$72`~qQ~%ubY^BmGl#CWX`;7pGB60*+u#3q)F7as{zi3&BQ~BDcdK_rFL%6tF&C=W4Rxjq_-9A44*!UkyljI5Zo0j zehi}`?z$TcxyhlP)8e;~DW?2HvC38Zov3QcEj+rBLmv`Tcp+6Qj4(aB-@_G$35ngm zB2a;Gw)hZf@nAW}bD^oLY}I?=$KMN3WU8iRrhZcR&iwa!KV54Kw{x)J6{(N8e?WH= ztx0!#JVQST`_DBU9hZbkH@{O*N@SWC91tv8lWBx8|Ibktzs$nnsD!dI z@{_p94d^Jk)~g&f%-V42Y3I?2%y(KSe)5GXE-mihCQX3nVc{Vp9iOKOCF%qm`6Lmz zhxsrOwXWN&^!HvFyx5R9C(9)1x2w9e2-$1!4wRP}VR)qA9Uc_0)je{nm>wNQzg8pV zx7+eoAI>0s_j(b(&KR8i>4`oh_PyslmTOGdTgiQ@CZ-B8E zWeB)#FH9+Jp9_#Os0>3-viW1s5YEN+Z;t9UjAe`(q3xDeTjyOzDh(rs#__t-67#Kt zRu*6Y*xg!)!EE!u3LIC09w*GfPZ=2^FfGw5#mmdZ#dqjxS7XMdp_Ht6yl(3}m}4e{ zRbiH{-zkp6tpii-K1n{LlO*`SmVoHX(OZY_g;BvzIDBalg1>V3p1;D2SA!z+%OgRD zMg+d`MD4M{F#TC9D`u=~{)>gjqr*>h#e(@^F^(di2GCYG!K9*>guBM8 z!E@Hj317P-4Z$27eoXZH{?EtHiIju?nuK)vBA>l}kEsjs?S_j}$9C9_rw*5Xm^B}! z>t)BQy1!X?NKk)yW`?WG;{)$BPzc1!$;!U{p`h^JDZ65u=&BP-PVYwWS!5gj_xY5E z$hH|}WVXk>2^vyI?iU^&+f8J|@OxyR@|i#TclSI=31B*<#Cvc7myj0Lg~QkRcQ6GK ztW3^g?m6=Q^S3-bNzcKdbNV64n7Pth_=l$qJ8MH~kff{}crU=_oD1*p)P>p%aH;fI zNwu`JVu9{6*ON&`aHf{}zAShto6EyzG2q`*85tYJ%5Ls2H|V*+O5xK2}p-PtCz0_t(q(E&?|)sl;mG*zI&e3lDWd3kwT= z3oiW*8gfpnQ~1|KssQ}43aphQ7=km$#iB|oSwD&;KYsS?%!tF{-Pax-ngFG|dH3#d zOigX=C)3dijlrs_2k__aTfzNbbg3B`FOqSX)WGk(NJ;q~Qds1CF60>SCA@z9GHZ(F z8N4}u;oLd?7cZ{B7o)e~5O|vm>Lmg@40rE7fo}qY8Tf*pkcqg;(pjVsmY0oU95@Kv z%Twph)xQ1B2W(D z0m2&25Y6od;O=?1>jgbK4tTR-K6dn2nIDtGkHMag0@ z+Bc>>Xo9e^%fZ|lHJ)^XNr{P9uU^G*ULSfry=rMGqi>LC}MP0a9&kMdH@6lP8b1-DrcL;+n+C z_4xj`e1{X0#{k`@fxLpF80E5rV6MRH;&g+}O--!fy_`^SYl`8c`gmQGd4Tu!?es=o z0FL2NQjUx@D5AB0>HAG_> zy3aAdVFe%ddMl&3$kV4)Fk~BdagTqJB~kK`S4D z|NNec?|n@TKgKOPn*sBp$_)pzuH7R!B@5Q>DGRr1=1cp<(Z*^yB+Tn!Ne$pvKbQQDc*(1 z&L1Y~eaji*a!Q!g5EkQLz~Uh*q0t`qL|_mmuR3tTFmBO2j_<@8VMfdi7Op&QZSK}% z1?Eqtc?4i8Noc3&f}YhRNT$Ldd<}&%I&<;Jd$~Q63~Ck1KOF(3b)LC5G>r%@2{PFv z*4ZxOZ-^M}evK)b3a|!3?29Zg#I*vJ<%^HgyEOna^i)`wWr2|wsEO-8`=y#FLMkEv z4~y&E)QE1*(2%l=E&MK0ChvDZO)PfTyV;)1p}zRWj-RhmVEK9Y>vjC(Up-w1wIen1 z^7&)oMdz>5(jG4~8U6~$bk}^Y;Sfmrynca7Grv5m3Wwcf?EK7?dq;~_E?1W0Rz`94ogYNi}?88TIxk3 z1Er5(YgS;Bz*mnxJ%I6cT|C-nch?Cm0gz)C;NXWLV7~oJJ)R67mao&NPn(&UJ&>1| z4@!VJJ^>l!dzLfj9M

Kx`qepx_m8vqNtILOdUnP*_nTx$Q3rz9+|9?WW=8CWq25 zSYOCn@4ti+Gv)!r?)ToV4`)V>g_q1z``$UaWts;cO6fNEIZ{sMRw1MaGeq6c&>Mz@ z(O`jSQ(_FCYeoD1Ia5-Z3bD5wq0p}Yi%b6%>H+>PE5>SChq9(L{{EJMEQwK3JtOkV z;z!zSC3Rj2W76(yJQnq1Eg>c#pb=oharXK>kZ%a#?bR8X14sgS`uPz}|8nDHI_3ri z!*?zHm|p;SdjZD&+Eo!Dp=#iY)+|c?E(B`}&nBLE6H0#%GG)Jwj#8PMo6D%4h3rb? zeM^z+&M-$brZ)GsMmf^xz!p4!E{gUNYr{Ol-j=D24=v`9d%1SC`TO^aOiyQ7Y?qZK zTJF{+N~WS5B@BFGws#RMy6^i&fA)Xz9pQlNP(0o=45oynq-y}!GTOS?m<&Vxsh?<4 zc<~3->YoWBr*Lrv0aM$~{IF{s?wx;1xS|J?(=LNOmw9HJNJa(*6CQ0e#qTwHi(n!>0_xe-VWv+iZ3p%GWa^x1Yr6(Zp~DkaiCU15|W!(hc3_4E#8XL21j z3@{IzoXUuCGDS%BkNc423Bm0->gsyn@r)SqSNy+=t>z`cvw4?r(DvyuxJxnZ7HTk0 z(Vs%8apwe6XIo=%AHv*c}l;m-j`1p9} z%Q%;zQra{32MmIDeaHDDsgd_#)P8$={wT(uIEK^uj5BtfiL(WgWq;&ncwxn2)7=dz z2m>ehHO1*tWg+Eh+8hIF+Sd=d z@n#^~^^rsI9R81vjt;?qDLR5P8LH)^P}LJOFi5+X4J(F7GFcl2$C(~GEL35-n2Lr+7%P3c?r*C}M_8$NGMVPZFod)yxCsdK1y@~+C z4ppBQ6E$7}mI^#PJiY}VFZIDn=H)N+O%sL<(~;Z8EU?1H-!DzFn(uhR9Xx~WsWYR& z&b7zO2s{D9bKch0_8jn|>#`c&QddJZFXMMfWhEb2EwlAG3HTZ!ph0_jdA)RZcW+nL zdHnL_OPEz?Xckev?QQr_SZEu?CkVb!8edDb@ywww)DpGxc=`Dp9ypqa?G}oww_u&x z6xj4_eZCV11Lxa@v_0T~sb^-O3`zoT$QN5^`|jAml7YbhYS2AB{dV9pS|AZ9N|vXXcM)iZQ- zr{PA-6?*y$iHV7DA+>eBWO!6melWwOcU<(fAn6eWZ@-aEe*%-FogG{jPspyBn9!>_ ztv+#DYvzC%NYoqqIWUj_Qw5~Hn)|ndp20LyF0;cUAtC9eM{y^=AEBUGL@|5jQX5!< zNN(%ks6Z-zc+`{iRIbNjseIG8(+U7`38oKI^@E|($YQA<8xU;ZAN&SqU1%vqBEE)U z?0m7Ro|xDLc)0!if&xI}jI%Tq5fKU6FpGk<#BOzhbn7Z@oMdqpTr13Qw7}S}>BNf- zg41y{mg;y5q)rVC=yY16eF1)W_2$h}=#GK|3tbP4hCO$fIJx!OuB>um+G866ArI_r zZFZiEQ5f7?pgQ;da;T}Pxx&IC<+S4d>Qx#|Y=;YcEhBtF!h##l=uhE&;DG zOX3=x^{?SFd&|rvov>uRHdsAO)z>#?SAqIEHf%e3JT~T| zfws0bYqD&(a4Fbcuz3U!W5NA^1qvMHiiQ(XL6fQ6vmB5H6%L`lEL3o7WMt%;Eco;^ z*RNlrqf2Yt5206~yQHQsI*cX~nb?^(k7&ll#KgddV}oau3yX#M2n-iwp~0gx{e2P7 zU!n1K@yiJ=NL@)#|Bt&;Yx_HO>HnXhgor|_{L}&XY(~x zko|V<@J%c!%jWG}e7Gsj-~8kM=5i2j3@#Ecle~xA#q@K4!6P>I z3I=kVdbZfFh>VNZYO=~)HK54v9XA6VNXVAZbK z2hHdX3=V377vEQCN(FD5Ef4MC?bEB2#EQr8+Chy|LQ#=UKp$2HhyhNEi?@=_N*$(_ zc<5l_VjgfXFeo$0-w2>Qudm<_e!KeC@-W5?9A4@E7H~Fz{ksi(bFg>%UCPP7neXs8 zZW8zpeF4JXEm~T*v}>2{ zfy0I=v=N`I8mETb#b$!`6PLXWIsexVP*l-=O#?1hoR%GUANTBkYXwcK(tt02$&aew zPG6VgUCD1zz(Camlx$zIXn1?3 zb7ppynwk0YGs|!Y?%Np+;N;-FT@=pfnt3Q-LMz#Eey$hm1OA-6Jh79rGafnlIap5G zeg8oB*b|uCFeYvUd!}+TY=e~%5Wb4n-3uAOQ}!mrkD|%0|4TuGgNk`jn57Ep&Dnh@ z5q^P^G2iOFJ9jb~7ZGCIZWlS7-Dxs$TEv)O2DOpc(+PoAN2?-CE4%O*h)Std zoqwLDg@;B#LQ9?dNnFBKA>V{^3JMD99SK4hH}Dq7xopmX%NFMZ8IOwU*@~7h7D3h& z#XLPch=)Icn+lDhm@1&U@?R>`YrmE&3dK7;9q=`;7BsZBX7}o$j4$L7a#G;+fy?vl zC1(fx-fHJl2MT!vh3|xO#wKymY(lfy?bKCNx~+RqFhZ8+-{8K<wEo1${@=N^WmjCXTL?+5% zznvY<{6EP03#cmBu6rEb7+}yCG}4`tBH^I~K}rPaP>~MlR+NyG77!4mrMp2&KF)TiThDpF=QqAH#(AD`6!yO3x>n3N*SxNGyNO_rjaB@Ivp=DxD}9nwi*iSa4tLG` zKYvP{d5abIfX|&&*!szT56HOTQl#-*Pu6w8zxcFbQZxKPA9b!^`{#}ZkQL1S;iTYx z)#3J@!tJ3@zzak8`tvFhjXCR*@BOAAep`UV70mzr!=*l=bg7`fL^GiKMR3obFP;3t z0V*$X@oCFr4zS)Q3x;{X0R`HzVcSIZrT z^8elu^26j04-ytE*Iej;KmzXd&uvgq%Ub?^<6x^)*VlJhaN550-?#S>kFIp5_H2H^ zv&XRGzuOa%{C^j);Gl@-`0CqP?E016YinECUd*!&#WNXmw+)KR_OA2Mqw zVkIAq4oUaAUk~DOPkF}iB7JU4VulLFN;2joV3H_j>#MvaCW^fN!uQL5)w#O=Fw6ej zos9SoTT**MUo^ro~ z>)8yyuE>M6M-O%^Sy(8B_8sc0GY50mnKa`HA2j7JM9o41{&cl~Nin6lxub*`s4C!J zBvbQfO2nV=mANmS$Fo*v{av*PYn-nA9li!O4ylX~lRZO#%(N9&s74|k9emZdF-M6% z%t;y=M_sa$5$vSTg6X*y=MT!njGh#y%pvqoUwy`1WW)8K zv=H2p-abB{LDM zjpS;+BKQAZywE>wL0RA5WCl2=E5HM0zpY*OCX-aoCDsZ3a_#syx%2*NBp_nM?;QlF zoFwlg8eXDmXj5FXG@doJz+!%My{sM~;*G7p&0>2*S9b>Mel?73x=!r{VL^y$t@UYX zp|xeeh)db-g{Sn|O}>)D0mYvAH=Df5(K^`|3eQ*M%Ea(jOx1NqYYjU`+N2wQnvj{imknwB*jR zvL5QnRQt5la4}phfPF}lYk!WHn9dd|1z5O#-9P%9y_YkU!O-i6u>%@_V%{)xHhJ#G zcST2T=dO%7nyzUYNwMqTb)vR7&w{F=mVJ$9>XW}H$t64F$cI6qwqa{uJE*|-)#cU) z6BFvmo;vNdM+kYjQyVqeEk=URc?Fg0yf0iP_NDobn3jiX#8;wIX_*0^f%=m$*}$bA zL*vBANBbovJD7`E^Ln{j<67j%N_mxo%}nAe-^EXF==SkOr76ebGpn#f;|WKG3e$EE zyyB-KHQ0R?v~I9+x+!3kvE#ry@49H<%Oz9@0p7jNk zIIDDhr$;J>>pS}ICt*<}uIS5q&p)vQ6%`o0`9!U6T$LsjUUR1Du~saxROF6#PQ^v!i@AC)>R8k~FAVB(9rkU$I}q1^b9cwr zQe?e&&~3*lAU=6Yz*MH}L-y*(ouBeoMMbDYwvR(Q!&SK(2E1UCEat&J!}{KlN^({) zCG|7<-m^7@hjfB>x5VF$OjKk!jQ3V{b(eElF6&UxOt6c1KxJ(VUA0vZa)u8p1-}ErLcN{G1pi zk=iqL!e7Ul;R)5}4*4|>v0>S7wu)90zYYzIp}}UO+ZSNZxXw#sII|l5J8|b03K6l~ zU+b>Ma*M*da$Dljtg(f`AU#H2o$iyZ$?poGV?Gl^Ym72k$y~aqD2_p``*y0uTr%d# z-Fo$|Q6GeU${TSrX}D+@Zk;f7qzi?rJh!f>{4NMDqr8QtEWR$_((h>ZikXno;=W%a zS?xbRGR+v=4ioA;M#_)bCOl1J+`td?U$$0!>ZJk`4HY~_r#h**Yg1Vh4GB9ivPMab z5ShvmUQ>}^j_ztZGjK7vAawkBa7M!wA%uZ)$Z~fEjcOTF^C4(mIsYl=oMYl%_PT%? zC!MA&=99Ir!*P*7+AtLJ3dV!c=bSVO}wQs!XhdjwX)f!T) zra;m{ziWMfYkK5(y*IL8a{Nmb@@7IZs{+R8&3)prLdQPFlk-Lw7`-rh(|Ep<%@tI{ z_E?o^NDe~UJM2z+2d@@$x#fnZb_bRHiwm&h=^__D5|Wo}@hU#*_K#~*xZTTmtA6|X zw(|G(l*WqzQGuMV*ly0Ja;s-PolbmpH6DAE zGps|>t9B#1I&h-z5L=s`iia;?5-dR+o)X0(`-JtmT93(a2Tb)fi4{AbL6z8!nRNW+YNZkXj{4rh~pY6e+_UKRP_ zYD|WvX&RrUw3#)kPZJ#~9b)1&g^PH#ytbs57`p(W zjmmf$>SoU+f^Gs-FzB5?J!XKE0!iLUZODil~B8cI^Uo_YloLU~jN`$nu;26k)j;Ik)Bp4>mNcoiTH3iSUUBKXow>igrL z=cZTp=$gJ~NNgV_tGiYal853$;n!siuXL|p2P@=8s}&~W1DD>{Dp@S7ll}dBUl#Ve zJ@5AUM*A%4$whM!e0~xaC9uj0>BZ^Q|4H8Osjn$yG(rHkbah&83nK^xDcUt2D#!Qs z;BLo19_sDV$g>dW<*p^Hbo+qw3Sq9R^>r77^8=mwAW&4$w&`8;mV z9ns6Iv*)L)%BPV#LBy(wUUhhyPG6BW+x^uQ?9{VBN>7YdGHf0$s3~AS2N~;# zSnk2O;3QB??x*)XA1{P!xT!a_}Y?xsSNi*i}5D1GEW{r%!toDubSjd8xn*0nX= zr6tVSo8xFGOe}|MIeRATt?&3~3=K@wvlUs|_xja%$8V!@U5+JU;Q$Rj>iZk>xH!l> zO3rzlh#lr%)WpsO0s>%xdB(dQ-i7urT=e8*m2DS?3;w&TVY$!UB5|VJT=N2Tk z9}2f8q1a7&onzsT+}$pZ?Sk|Fg6H9r&%`beOyPRnlp(oVdSnEE{6e*&D>4Gu~afB>#m|6$_z}l1}G(!Wub8AQ!gdR`)^-c z*Bx@8*d%X(Hozat*0Z${`+VF68>KtYEwj=#R7Wg>K?0#0j2&;V=B?Ii!!_1g44dc0 zLoKWFNrz=skWtH%avS@@^MZ1LQi!7dj*43TdsEA6C>?tY_{6)>k(%*@FyXOz&+&-m zah$N~fG?d4SqN6~M^y(Yk?8yFBp$*;f$Fj7t64ST-6Zp= z4J3GL2TsSy#vKD%L#+&DpZ|6cQ$4B`9}LbosBwLpdGxuD9_Z5~Hsu@?W1HA(*JWJd z;bOauEM1TB{WB9zwx#nVtW(&a){8f zWsz#GE_>Br{yaIOIdU#}4_8?oz36?_bF9(CQ$+Yqt9xHG{_M?B`T56&H+|pPZgmDu zAL_-EHbBBgLqP-93@H+H=DQZ`l2%xUkH_9abqhB_J9{(2SKJZchpv_(g+jLru;x&x zb;A|3MXC6t(1J$I=@pV>9_=7`omD27x#QBJsYeQ*z{8jCq^gj+WCe`lUt9tTL3Ep1 zx3{B|3Kxd~kKkRYxE4uo7M!;tKvx!kTfxv{z)7Pyq07W+1es8QAelL*_J=%2U@)FcY?0F7x18(p!STv)!|%Ll)hE1xoVb#*IB<%q*C0%TFUQ7eA;9a4!y(8dlorRuPD7}vA0^fSEIwEk$p1QiHa{) zi5qd9_Uh{Bv$a2ihvtvzroN&P?S9-R?%KRKzD`TR6P+O|GmJL5^lPM#yoUoXo2{vw z?o_;&pN4z@@`ka#^*KxZ@Ml$y7i!Jk6GS|O074C7`VqcUF&UWA0b$=&o?DKW?K6Jb zXZgxw95Z1h_RC#Q>waH)Px^N>)9csENdc>;HTTFgMD%usgB>xTgMRa-y4@kKB=e!V z>lhiw>#wcPjq+$zoi)M)NXRduoSX$dG^b|wvYS&GSN;!9!$UAC=|$TLU%ohi0XXnr zXeG=!rCrU>FBJXWT-De?vi6IS4En||X!3nV6ke}i#}_(ZFqZQ@2vt>}BOho=^{jFj z9cgP}kSr-K9(3QMJFEIl3LU0o{C;TTvIX{LnpKTgQm$7s%70)FI!@=eCI@FzZ`g30 z4}BN$y2n_Xyyu90))U4?aX%&oqS+;`4`a|F}spIV{rk z@8+6=Gy5Vp&5v_$$F8n-(2n;ZP6EFNY3~r9ZFdDS;(39!o`c6&U-896ZXKKOixcM zsH^W+q=It?qPK8yxsO67V@^))9H+B@&;e9>KYnGMzw*1GAt~7;rWM(`FsKl>Jb?iR z7_um*+$$(Bq6|?(`KY_NSFb{tkx0)kY-d5;h#YHN)|rr}3+?7fY@33$io{mVqw9+# zqQ3%!J<}SEitO%X2WD4ZK%juKF2mq2ylWnnlmaBK<2hw@Vb429FFL%Cj#hN>aC2LO z-lw168-bA1%1rjCOS`(dKr8Y9v~$3ezX*5%JSI$(SyxGU#Jo+_ihB!r1Djmw9fx||9Nxq5wNOu>*H8O>R38DI&fyJXtL55kRdqluOXBlN*BboAdkU-0md&q zzb&_BrAY;>FBumRi+N!_5ET`zBG9dOsQ><5_eFBeiV`NO6WBh@Y8N7SQ!svav$@;2 zh~IYU2Dqkx8WsbSkORdOp3&ai{_|(U{I3{1I2AW}r3}6gbVH56^UGFiJ8CfYgK!R! zaKo|eh}fjFz)&7kca-$>7|0|2@ZoJ{rb*H9wQGxk6LvJYF)T~<~We}qgj{#9dmp9sMVatm0nlOSyohxG`a zH#ji87#0yh1!4-&07_cHF~k)`?KyqMMT4bQ)PFc(SPq;{@lz(<%b>%Ua68Uw!F!(d zl(~KC{A~Rk_-w}PU!W?~1(l)AH_$Vv#&F<}a9!z&achd3Jtb}YOGTjf(9BQvi!*Ts z`ukr(g=v=4&eyqZHr_^gAgbMoYF9*Y20SJ**$Y}AD%MrEX9lLG-(C^Y(w1}|gP06> zPAlZN$;LDV263ed=Y8|dlbo8fYbb}`$&s?v7QidRT%>nsD8bVl?EnzTTtrpFfu`y~ zpQ58beEY_NXk-`|ek?k89sBtEi^HTM$Z!xk{@uHG>ib!J#sPa3`i<8Ry%eapy+T9X zTEf15{c1e1KK?}r8A!0+QOjzE!WsU_$b{8N9I*&2ECxK3Q2L4W*33R*G!)qOTtJOk&wBaHQ;&aGCdMX$(mnbrTahv5(*i0*)7ls8Ilc{H5~Hcv|r1!0yJkxm#1d z{xFZ0_DH}4mYJBkIx(>F5{KX58Qx;kRGV?>X`QRU(rfU+Q~Q@_?lW$Dm@bo?QJfz3 zIJF)Oiu`55mYEnB9)>A{wraCdPamr`O_roH=w!*JoOpjM&p;~aoR~ZbGzKUIlb`J8 zt~9*o#TT2qOjhI!9~P=- zJ*6o@7Ct;yP=XnT-RSqu%3?({An<}=%tDdv{)^Ty7y|&qCk94FyyU^6 zbT%V4(2Du_`5g%G@)keHKJ;vtvs>>Z2TB(D$;hk!vXnk_&k{9n1M3Y^24t!Lv^#XN zQFrEZL5Gl(miFV-@myPE5`^(E+>4^1Zt$19pWMB06e8nPbAINW*WuxT3LOFERM(UM zOk%)0jN!AmmGda6cXw)am6hCtn;2I2G>oVtat~0)E%iOj6n4Vc7ah*qX|`th^EkNN zU&c%p8}*y7?Cu>ufti> z{gW?-iiiYUuH+ZIPN2;umwDYqp`RUbyU1rOX;aJ8oaMU-`H~h{oe7 zY#F0Zu&>YsK2|Z5K@lWkJV!YYa~{fKVUcp}GUqQXf?vSCz`tEz&0tIw~RV9Go4mBXcKz$G#I_&48tkD9kfVO;79FxYRost1}Pu z_uoR4WoiWWaQ}22%1o4Tpvzsv7XppsyZ7&>ASB>ZccnbclRnO1tA>xFWMPqIk%N=j z11ZJ45K)cfak>#jim-RJQcS}!b;(1+RZ-eqce^&7H-tBC67)TWlkVEEX#nQt6otstI zE?V@<`Dn*NMlz5UA{geKQmu^{B<+h+L+x}2o-iT#;@dP@qul($+Q70Z1bA*M(P=o0 z)$oZU@`3imC3Wq)Z`*qm3aBQOsP+^Y>gekrEdJhTeEt!Qq^~P%04IG1qD1-}yAF^@ z;;YTvKxQD+i5+VekbgG-Rm!UgalUHF9CPajbLB<*7tBd!sM_|F%dupp{voPHf-&?g z0L9#fwjhs(wPgINK%Y+Iydn%){fF@q8+t2MAx3j1 zBhWfx03kH_c`EKl-?&#w0w%SH5N1)zB|!F?Mi=ioy!OF}Bfm|*PfG*a$+-Kc9X1;e z*4U}bn13=ztYHUl{AV?j1-9Bd%N*-EW;=PWF^5%E8&OZTkI< zN|CqHZs8^-PGya0Ka_XK{Q`mYuE4eLl$76@Ak^Eg0agi+eMVcmz&^cnbH@iXEq6-$ zlNIn=@JyO&v{&BQ_U!zchuLJN@e-cZ^3ljZC@+4n zhUt0>2|W0BKv;I24C81oz0<+bssE*6KRMSgX_{l5S3k6J{K$)_Ju>TOYxe~N@b18{ z#x0s91*mrDl}?DV>W7RK`ejK*z$`ZFj(V(h{)DmuU~WRR&O32Ir;k1|6AHLkbm??{ z1)w5#eos(BWD)a;q|WbuX8@$xjqs&hp4EHk2Ziqeq=8^F)i|C#`01nSj4&VwoIokw z$cp#qu0sbN4tILa=eBc&zK6UfiNqSi)_^Mk>{b0*kfZ`GAAz$#*Am2EuwjW)RT zfa7d;qKDt5dVcq7vi02K?5rt4+uOqA%kS67$U2X!p05a7T{JicsluvG)x`whU&vW5yacI*0AhrB-=g{&K zM#%O5+hY25)TNHJeBdy$^aXG^$naK^op{js)4hUw1>`VH(BJ!(5OwEs-@AAp837Tq zR4vZf3;HZ~y-e(z3T)YFd4m^FSPPS_aB@$k6XzHy^G8axY*eT^9$|k9N}JG@0_^vX zkjR+pCaA!QwSA;^wqerq{gU3Khw$JnkXJ}y0ab7OPcdn=*F{4M5E6L?M=Q*YX(UDZ zq|w3V`@mC@xeY+kV3_sI<6pDuEzOOvEP%)`*lYWoDJz8VR3OR#bS6EYOU^SnL zWP2+Gur)sbjql>wiYeCUH&Ipv5|e}Lz(}({Y~!5Zt{&WcuZ`{Y)^{KwO4CnaQZ(%< zBOrJ41H87~jz3PX6X1OcLg@Fo0tNBDkSjf|Pa|#(a+cf%u*NVy=k33+%`b{eZDdSu z1sOM>c{{oD`ex6;12TWNJzIMZASb?Y_Nl-|Ina|#XenAvH`0ImD4;1J_v}?q3YOiv z+#m5yBHar>=chP1ADsN&cFR}uBSDQH9~bmh4-AbTy=nWjyd77bUtpw|imxgda|=uR z11oI_1i;NvAhHi0k6ng1#R-5sY({j{yF*6K7irDZW#}Qpt*%n4#x`nW0z$3%deAUe z-W?_IaGQO)rGCCwR6PKp1GpRVMYUal+x9Oqjf3vGzFVL!W22!!)FvsvG9<3=EcXxq znEVWxyWT+o8bzd%pT zK^0G;A^L||aPn?3N#ssU|Ecy#8Odtgv*pqoVF)e<`T44d2=Z zAj)*u{U#XMh(WGP>X4xNby`GNG&H*#R$0YG23;kMTi`WY0_s|zW142akTvEdyY|tP zhW>M3`=E`2kZ*$sp7|yq!-y?W=z88?@c~FbE<=KGI9)aX-uYg3Rse2%=2YIYGuxQp zJ;Lx$9nd{n%&<}BYy@@{qd0hbu?)n%_RYAw2xVgVu*H7jPE0X}&=s9d} z=$c!Axwxb1Jo5ZgR@e#}?g)G{9^jaOkkKtrVdL1Ob1m#cs#;th>wi@}2il0-mooNA zGe_luwZQ!$c#H>;v-kzGH0ul0jRsNAu>tlT5nfT5s{*L-;UUWn2rIrc)#ck+zEi|= z(!YsAeKR3a!2^Dqr`CkEAxWF$)w0U`s5`;Mtb$<~xd9AzTdp$q zWKXQ4%6Na_b$XKU^1bbT`^XX~jKFBBaT}x_uqV*~Z@t}-6;G~fJpmsy2*5Ldl>>uO zmJSJi4wZ8oMaCs<%$3^@Lq?!#{TNmSi^i?Tt{y;i%;VWRDA(?FSh~h?(&1eyeu^=T zuj9|;RX1HgLIdl`YrR)%x(x7Z*$BJiazR9c14RqRk$s_j z^i9WK+E{Cvn`j*Z$vgkZPQLn}# zX*R!@MKpPZjfaUfE2~R{`w|9r@^tu*+kcmpbed+i`p{d7^`L%Q@&O;6mF;V-3Q(Ux zrVkFweh?L}MDs00##cwf390R3OErB!Kf<|h{TFEl8unJpD#RkikP)asTsD;GpU>Zd z!QRYpf`*dnN4Jw)EnFi5f#F0$0ml-wDwR_Yg}b6aQJ4={Pc^-(Thk94e6j-D#a2cW zGtzh@+OFz>NRo)(d4_Gwccsq`_mAh=^|@U^E@8`bJK|ydbyO1GHd5W?1Yo)iKTo#< zp-Ltzb&hQLA!@NL6wP&8>UYHs;BA1gf9*09x;N|AEvR?Mxp{i`^@}{f33xfy-|`pr-v{SOMDwqMcK^edQ~{@}RE!;+l!E&Fp!Ny^-ZW;4@e-t3*-y+=@p5eo4^sAG(OPh}$K zkfr54Hay(Fc~3ya(Ol(i`Q!D=J1rSgE@QA%tc>P#5vrW~_C^1S8zV)P?pTktIpdhM z^!2N^>ti3yk#Km4*qcqHv@b}@;YeAgcNrO(1w823l^S0E{g*ET;?a1gf3*caDIi8E z`@`A~Bu7wxA4|L1F>N(Iy@_blyac_-OqWf7@MB<9DI-+X6ByALDB}!GZ)mbyGgT^2 zdHgGaMgl##hKE!3t)zEhW-(FMJkHyxQ-7gbCl2jt%QkYD6>1mLx^vq)6Us0Uknyx~ z1o%KDmpBNiz|3hCX(gaNA+pULy;@F(W38+&3+_`Fc9K@18i74Fu-GIq7sCw5B$g8! zk7M_mulG0xk2a7Rl8pR|7J%qel&tqw$s$6row-^l7;lQW^K{8`zu{uRyX?WP&mQGc zU5!al3L>J0S4q8B_W>eL)Zb2X%F@zsId%(C7ZA9%Y5lGuUnOAqbAMw>SY{$+1T0>V zM1Du$|1qeg05fMPztrJY_WJX_8GkvMzJ3@{Cwtp01TL|QasPn)$5h0LOj$L)_Gb~j z+*)(+l;fiX6p9SXocrOih0m@hR!0>W_em~ufTEEjg9b^8sH63isl~!6+ca~bVXu3U zOW83EmS;RXW=L)$?$nu(a|8pMKMLdC*%c9I0usyt&ClsN>vtg~Dtb?|Qe5&2c_Efb zckFi9fW~E%1bS#h@&{#&BnWgZVWEanr`XPcxN;P? zMPZplFP(>0(*0`;J&Hpwx5A-vz4x?i2wCzVM1^bNF!q13s2KNX4~SY4VuY@+5%Y|u z10e!~^jH{9>KWS~y}Mj@Zy(Vgt%~Blj6T-FGf3i--b6>U0|xqU4_=7;l=p?sLw(dmU7y5^U%#a#4et|bMLGX7EF7B$ zHrBk=e#$e`yZEvcQ&%BZy9ozV&u{EGu|K0J#%P~UIw*eZA5Bb-(`o-JT)V_tj%z>GHyek(|Ka^? zP8oia3Sl1K$L*3Jnr_-L@`k@%-1Dzy?1KJtV|mJiKUC!j?Z@mjO|PGVND6eh-+vwW z^KUW=1|S36*tf(DsQ7w-F!H;<^*Hy7YwR@`$V_uV3fDlb1PN4W1RDaEm80+G7i91nece(?TFSe_AmHSc`f? ze|sJ+ATbCr1G%fd#3~ZG)sv5}uRF`nC8a%~H>VQd-hyYW_Af04 z15cdb0RMlq8Mx~GAd6!;SjXU@ht4q9#OOW17?VFJ)UA{ev9-S_)VRva`APxOuaEYr zVR(Xb^e(BQmQ)*=Oc9cQo`SE|#{RA(1Z*S>^gh3gj!p$YCZM5M)$2ch{=^u!06GpC zg!}k~J)RZDgMmkY|D3CSBECcTlW2?xL1Cbbd{AJ{;DvtwJ(Pt0^R(+fe}oFk8h;0| zR#Jb3A#MfZ1XNQOVB6x1?c#P$&}LtiQGg~ZW^kb1#ZJjH$lHiz zE4SRm0Xe0!alf6sZRw zqka7Rgy8oAQ&R{B08AAMMwlP3Bnd%cdY)XC_?yzDVTUmf9)@F zep1kNmTb`6&;Zn1i|bY2G&Cd~0r?jxi0LHyzr!9(ifg*(nA)qn;KP*mCV=o(U=^cx zLdEf<$vh9Omr3*7&Cv(ib!15kG^?Z<`XG#XVoLr#NYeh+T&$9#AqWCXi+L{q&)loN zBmnAgkl<4G<8!+RyZ%NYKe>~9k>f?0x5F>UnebBy`r8cf$Fvcj(^wkX@W7Ig68;ZB zf-9TW;?tGmROUw9U0Opjru&d&5D_BaodNA_8;5p*teHX-2!%Zu8L*GHJVZoJ56J0M8oK;zFZL%WB1XwI8rhltB2wIImA&pcjnVKeR!+ z!^(Y7f0X7z zoP{&M1SFvICg@Or(46v*2!;FFMCFt>2&53~Y+l0l0RS&3537subvOVtFU(?9p6znF zK!+M*qPF1%qZ1c|;>C0JL#&o$@RWqFzX$vsndtx(D{4_HT$MHr(OG{C&WgF^0ot4{ znBxE<-jm|xC1Tpz+SA8AP=Pc9o8Oh}O44;d5egtcgWcZPF_vBOh#$ZHz1{ylpfm6D z0CMM3aJRRde|QrF;BTPSGytW;!SAXB;||8s&1o1$e=AT33mnQO&xIX#6poUqH})%np+KQ9fEkR{Xp!+U2U$t*hVJrCr!x6ZaO5RfxcgM?I*@B?75i0QK|g_V2N4}{ubP@f**pXnNbSHpQ^TH`o# zM#=)a;W>*l_G#6~2b18fXKAH+c?Q{M_YtYQVSyh96c3?sF)WcrJt<(*s@LRC^k-BR zW-cee_!w7ueSg9|2)rM}B_xozQ3n)$##lU9Q-G@mVvhwgvIC1nz+Vn9(m|`2^sXYi z8OAp+{A8)4-JXTG2a`~iODoS{66yv5#Uf&u$C_;7O68J2bv|(nk|CW@Zy$Xws4@^N z3-Gt3+3b9Gi+dP=<0`8zS9~fjDw2RwnL%eH5Kxwc{;UGv7VQ6};yB}Tz z8EpfkZBKYdNjw|n#TK5(LIEBjk#zU{WNIGhCOqfK5s66Ga@BLxk&<@HTZ#_f?cv~9 z*8ZgBkzdl4#lThk)O5}t-X>aH_Qz@&0$GG46iqH06Fn+{)Q#kyV*})lb3V-U&K>=N ziG*T`Dr`_lAQcN>V)dZyuo7N~IADP)<;PD}^aP6VfpAr1W@x(9Snety)m5$4soCvm zN*Rcv3mAgDoM|rCn_{5KLsS;?BEkTBSVyKdi z3&p(3YhSs_{1)6@4SY0Rpam$~bkXGFqp}FVRSW543s==j#S5&6Pj`%B6u=TBcm_kE|XtRGftdYr2o-c=5r8pobC zqdCCmrG-j5Mw9_fXtn*^J=>N5;*>frvv0nZ^Xse;XsCZhY0pT>eLqld#k<3Vb5Fa> zOe;HnN`LD^zx-r>(}H52;|&npeuoDT$_b5Yy+l{{VwI}Jcy|7JYm1JY9ZX-4-wt2$ z*A5k~fJq^&U}0&iM_rS9Km=WZ&o`bam5eKC zc5!iWJk{A?xemS~h?foGJp?pA@cntuTSAN{UW4g&(qTT3t(mH(Fab^%^egaJZ}3+} z=I+9)zCa5_S#PGv5iNDy>7(y<%nf<(BbSoqyEs;W5#e&kx<|7v1td>dy^#&Fh5-$R zrgVAKKW*ghz7$XL#|DDP>xlRt;`B7k6Cq?8geu>6Pnc9zhpXj^l004~btG8u(TjIr zHUQ<-$nYFW0+=Ps%&!XLR;34cb#Vck$F%0S0qg$qaCxhvRyMcyvkzKx`rcn{=-@ZDsS9a?r;aPOl1$0 z#ypjHR-5H#ck>Z!dUHR%>MGEOK)Nt~`_xSaoB#xj^pg?%%WcSWA+#v=6t}w9*tMqb?V$UHpL}K_lryc!X1Eq7s0M)YqV^EeZT-6 zZ`LOIJY3Oq%0m5t?y1qY=#?Ps)~6@V!O>u0trWUZ*ru%DXeU0L2XoQguUso;@SCt) z(4n|UMC+7F5>(YlTv=Yb6Vg^U7LM}pD{FMP`;Q2IF$_|{gKyAmh2{&H7Xg^+%6j&V zfTXYJVj;H9`M5=DI^)N6k3OSN0Qu;Dt2;^oSO8?)QZy1gL!kQPX9osF-#nX9qsO`n zhU@qPZL|TLJ8yKdiMN|3t{NPkIIjqX;~>!!{r+W`#j`hqS(?%c$Nlhad?L=ND9qX!;~-Vx zDP(#OfJl6c$Y*o7htCG;2SB6U&}>kJ+yz~SEwrf)>+2mKmbvbCN>tL(Hh2YOe@)SY z*)9FA$fTHq(U>{`TJF4QAAn#{&l;RjTS9DQ;gRmGWk)T7=Gn6C`)M2Uxlp3jyeOMW_E`khP zLFrM*etdifHB1vBzm5bl;b2b=k>nP$5-5N`>MGd`vy=D!NFH=6zVRICl=57Dk+@Qv zvaDLhqMpV00FZp7xJK^bP&AN#0)dKNyDLLI30dAH_pGq=B|al#rW{mf2#XKZ<%SGv z(iOOGB3HZfqje+xkrAH`^V4w_$Pc$6o=1}s!N3~QKOQ)IyA3%3;T-(XVL`yYY6K#y zvFPc&LBd9RNTFQ4myc-dJ;AR(lYrg8=Aq!`&>AP<94kCBM2rc80wLWzkXez@x_>Dy zenB;ADBm`p&B4`#)@fRn%gbOflI7W3&?Q|&4VPF1;ZaK_xMWTA_l+5&3Fx zABmp(`-Wc_83=x1T>o&6e=d2UcG}%(28b?rGGuVv$zWq|Fa1?*tbaG z4SB%I%#`<-y#V%!?_V3IyO?g269$$SF%tXN?=bKDE z3%>=d4xot<>5c#N&Tm~DXAS108JU6NlqPwvfttRmiv4hd&_Lx8L;8T9PldIizeGBU zo|$P`bLGRkTrSn04IYsS=VWa~+hAetZzsfO?Kt%ZD8;rgaovOIx|^Uq2k`YfQ%;|E z`dp~b64hw~Bmdw?eU;d;Q&kP+`DsGA-!LdANk)=r^<heH9aL(CBn6c5q>GN|bI{zX*z(IqC{pzqM(d_aHS zT}`Y%X5++hvY%u%1;iH-;zH0U;akOsLHy$FNU$tzN;#Z(EbW`V%9InMF>)qH>j))k zz`dhekz*28$*zd$%K_85CSdflB9%p-BeN^NGsKn0>d5&u-;Ny1vI`7JUp8DCg(5^{ zPp?!Crv8~0^fE>VdW*7*Vp@}{!woW53o?HXODAEa6sNDb^0-dOYI$OunljgD4;T;# zJzi*kp+CgO+|}QL*Ri|q_p#o)S8#~d5%dX9G{`QYrpCfSJvG5Mwc*GLwh}(*zDf&+ zFmg;NR}ze1n@eVn}7p8C1X1NA39edSDoy(JLKTctg#JO)naErl%jr90dL#+vQ1yFX z1|FzT-xH`94r~;EVh?`qD3shdR)e`;ec11HgW0wmy|t6`+s+~TZDiysVgR246H5)b z3UGfPKyjLq!#%&){%A|_PlJJrRsxnhHzTj-+&>8Xgr$PVkbH@eG15aJb3_ovk+BaX zJ;CMfC=0c&CGJK|!05*{;LicTh+HhuEzLf8A?HgtI< zA0F(dyrz;CvgD-zVFg2V*4^Qto%^V?@rO4!)8T)VRbZkX0P^hYRHSFfa66Ib)NeGZ<*LDg#qiFndCGu*^sOX4~w9(bH1-%(u@T3 z)8n1*cQe>TB?NT!p1!x03+ZM4{-nkS8hichESj87hk$*Et{=`YK@38?s~vog>mu$k z-^!eBDMh_mrl0TUP+!@ZiLbr0{-nbH=O7d&N#D?xC)1*AK$k`Fsx(_iObcWGWiFku zSge7V&hgPJ%n6OQYk_aMZ#wcV@veVNV}k+HPZAiT5Hw^X_z8HVka|LjNqIcq76T49 zVX)^9kO3$IrC{c*D+a_BezIy%=oCJ87Jxbq3D@z1Oo+L$jkM~HewJjJ6Mb$%M2w&> zB0i;p;f*@b+hsPK{B`ZP4A2fAF;;MdY=$Y&=`7AA&n{PM-;Vjh*mZy>@vseSR5 zyktqzIEHFZ;ZAvu)j6}|6Xbvse#?U^1fw#Tp;5yR{dxzA#pT3~;ruG9!*80yeT0Nf z1B0NvL>4*!qmpLO z)+~3#(GSOm|M+agw7g56p_k9g%4cAtZ0!;Hf`wb7TL(zzg4l=SgFw zZGoH(hO`L+IvONz;EQ;fPIqDVyqIxq*u-qJqL{55_uudU2;+$b4HY00zz11EErkpn zPONb}*7X!*MEaWCpgp9cetvZWK|vx`5WWRCWAN~JmYV+pZiuFRIRMt8B@`JE0OQ7o z@0`LeWzY8AAq&o~NniNA`RL(86pCL!01XAke6!eBb=*&RfWSa(_UsvU^^MZc`(%EP z-lF!Bm|SKTu8*J?&>N3Ehl96(-+&21y7Y>89Iyr4m|@qL#ZFcvfl)4qS_oG6Sc~yH zs8nFGZ|&>3IY4i9pKl-n9?-6S`HMtiAeIxI9bJ`>bhoaxbpoIS<{;Uv_v4Xy$@M3~ z2>b%i8l-7=xG%rh_*{NngyKgXd?+Fu0nZcE;v>D}W_&2hkPn6gt597`2C?fwtKpZ$ z?&^TS`AlCo6bjh31PHp|M$s2{41;9sqXz35Ox_OKffnSvg0U1)Q;Vc z6ag@l88GcUGcp6gR&w3hS1-tLms%Re0|Aes1aZVPbVnTJ@`4DX0(Uf({5~BKRAH=< zbwJVqlMU~)akEBSdAKf+9%jZyLa7Z*+s5xqExEWJzbdVdVcJEp8pbYE0pk~H5i}Kc zF%0@X05~rUO|=<51jzgz`?+soWd}fUY`8U%Bl50)!PHCk-8xC2-+-nEYX-x%_J?!J zJ~R<^0Q)2GH+-w}<8e_yj`0=`X%+%n76)|PFQa7Rg~?E0sBOTNci-)VAMqC^BJzb! z930;%f!8W9?6@@o^Dp{f#EMLXASRE~(+NFe@gw&Egt`Rm*I)nHC>Za8;|KG=2^LIw z0ph#^zYP|mC=V#N30G?vUoFr2L~1*bi+nr9t}#D3-x&W{GPD^FR={xTiQH2KQG3#R z;48*KTmXe2q0~jDkb&hzd4S}wQH|hNCBkn34+Et@J%~QgQ1Bs{J@zKOsor0lsPPam7i9CG z(ej}=n$N01p};-iDtz?v-Xb&W=DE$8PA68aK$Qx4j$u&?LnCd9H2U3XaX{L`{6W%we7Vx|o$VMr za-=^;{so0Z&b>zBaV=lK!opAY_R8ZY$%S)n1|`$9-hdbQv4Oj%A&o|6RGbIa1}!hq?oN6mkmLhY#Q(B_%~-78w=APz;CB z)gh*-@fM>k2eZ<|VMIa>n;V^9Y*=f@%+Z#)7Q zbx-gO|Ka*+si7m4Bvc*FQhW=TWy=z{@xh5}x+8(&vTjMgvwa5%5h3^AW<@-FK=#+i z9b5afkX{*>5kO?=NQ^{QJqXo-k;>xn0@W8GS$F%QfFXv-il9mj?St4=vyA(yE*jnt zpt@E+@xn%_c+4q1P%F`e4}BDZU$~9MZs=R6o-Eg-LW0NzCQFXj+B(H(Setv#n1grKIglBv=02)G}z#?L)_m?6R_F z%FN!Qlo1h;k`c19lf5%rimdFJ?PKrpoY$xO_xzs!@jS=zIPUNFzVY!M*L9uyb-vEc zN>hlCDSc$U-Aj7z-68u5JvB(<$jlxhhk-DVTD*T6G){{HY_bj&CHT9G^; z_drCbzd2?bwKd^XfI{7{NMf`Z*dl?FUmdU$Jp^JLME20tFLC`EYiFb(XjEiwfjn%q zmp&TdKJ|^>eDTUvst5rP{4?$eR7wOy%lF{v#~{QDUn8#XJj~U}N42ciD5{6(OXe5| z^z*L~jP-B_>Ew%$iK(!+6-a_q45E6FZ33+R*=>LC_@Vz;tPtoWt*OBX;4`TH!#y$@ zJzsqzrl1@$y|P4N){eVyM$R_+w+@zn-j*jc2dS zz0`DVn&f)N$>szzE}))-SXfcT5!v5&3}Ks4UQFdc3U<>RiVve+pV|((Go>m2Y^3ozMxR|YxaDeK4*X& zsjr#2o_UaQCde@k^J3E6ER);jtjf-8yYvmBB9VA?0P^&(=0dT;@S)3vk2aBD^21xJ zrrq_Of~uGHSgUVroncM5W0u-dzBB{ACx3#2d~Bwp-Ytk@qZETJsy*6@tgW)av?qSS zy*M+ieXqYg>eZ`ftvxC7(Mix5H^KvRuYkOo;FpVy)@d$IhYwFfL{iH-fm;vYdq z(WVauvZWJM0-xNrkmP~674X*3jA{bYb-;a)?GH^^mywk{@QW`1hJ2swk4zD$a!ORW zw16M@1uf2~jk}bS8cr=2fb3Z~^UB4%`#;hH%_i_^yzd)+9R~qEiVFagPzQwy)GJsg zDxhUz4_$|vFw=w!`XEu?IAo30^1 zGhvj)Y1BEdp+WV3Pm7uI>2Tc~k8TAUP*T!o>-~3TCKy_(>FD>tFM8tVSG8O`Tm;=s zPCyPDQz3dzq%~EMZg$}9V|?e(nSw}IPUWy*l+?1o{OO-7qLCYBwP>0S3^am&P)8`t zW#Bqoyfm2w;sK@IX-{2fMo)ID!VJyK)aOJ2U26fITQS1G)AB1?Gih5&?9diabNqNzAZ8gLU3>`lKT=xc>#;muw=YCZe`nlcAHD{ zAA0uw5>K6_X0KB$cl+q0>bI!C!`&`5FE6h68gMu56^HhIkin49f1JTDLJ(sZ0Nzjr z7tX~Iz-Iy(X>fJ@3DuXMtSUJ1L^q5WBCaG|kLXXmRR3-9QN%j{#N=6SK9mWBoHebf zSeU$`+!$nwX?KWj95!P^ltP=@asWA2{3av!r(ZkQ#FjJd@ScscN|7Y|SHQEumQ(?33 zf=NbhZV9s<6wXCyy{dyk$-^mcVVEx_CoQ1{@E;V$JdB;53Vc94)k1_&22gfP%zvY{VQIJu%7Hke$S*R2!#E(MsO*1*8JMP-y<=+wK z;J@TvRZ!nxtMBN*5lP*Gb1g^-mTrLq<#`mEcz_*y!(!~Z(xG%n{d=(r& zCii=1(ZR{Rp?-~Z6B3B%IxXADt#L*G(6g0wMdei4Uhge2y?pSdlb65l*qq?5rh5WF zyPyP~8GqX6OsEkH0C_|3f+IAymkL38?uDwIZeZ2h#`n!2j97TBGF`(*_zmjyfyeWt zLUdeUlRm@-Uxw3w!ZVayfd{75O91Q^oYs1C*0^BD0UPVgoa9}2G!zvf{$TjaW99+V znQ0b+MZ=qN6K2!haD@>e1CWf=W2?RZkwVo-EYP|?D!YFDrXcmywgB`_F2+Sx`9aF1 zVd8B6v9we_VvaXaL+`4M_G|0d@7Oc~S=SBVZ$g>A)(g9+H4O?BP+h|9ZA~dpBzjs4 zq5L;6NOn6c5dlJvtEVXhr;Nb;C`R|)V-y4dLG5&%E>kF30PIvqx!loa6@hj@y0u)vNNIi5uy4-`QCH0hdyhxPvFV{m~ zCN}Bg#z@~r3TQ5=8Lnyq-;MF=j~vi_4S4{B@PfM7Rlcob_o}mUjq{->hk%1aO%4Dm zIt_pV+FcReRAr&$QOGsDSg^BA-VJckOxm4Uyf5;X58~Z-2`)O|k0${lQXDET7rbDssN3IJT6$DaT z{rxQ(=r2DEML?7Q+hZWrD!xbp*?@ZX5^yg5b{=G?i@E0BR(#U8z*{lxwHhjcG?~0yQ_3f&noG?4fCt zL&kUT2Epw{NE+7>oDRY&Y}B4zBw7BgDS8*!&s$Pbr$ix(h@K8*&|m>yywPD_TYT4) zLjrIBW5zjyFvM94@fO;6*YN?Td{|A0Nm9cWq>Iga-a)z&tse>nF6^)H_6!2r9@_MT zK;fN*y8MQH=3c=I8_}-91CPgm5&!#F-#sq^?DAn!AnX2O3N24yDH@ zjxF~@FTx6dX&eTi6qn%G9w+tTmVtv9^ap5}Rk!tz;A^MI!L#|{pF0OZIiKw=0@^}N z8a4c?_OM@Q_piPr+>-NC+SFU)LOLQW03Qz_Ld-q9ewQO$Y3i;fQn4_8I+50hrffj6NTp$ zJ$c(Vc%Hvmm3BHGb(v9VmtKkp#9+YOHe9+O3Ixm{HaGoUG@ot$h^TlhG}4XmA4t(6UIj>d zq51+%|MhH7`jllJg-`FvCs2>i9M9E|{;O4oQMMU&M?F3|LRspzg8#(rH!IqDuWB;q zyHnf8y9=RtodmM+3%S%n!;qRs0l)s;2#pK*uWX(G7TBh}!UA3lcnz-hB%Hhh>1#xD zFmO6&pShnsE%g!Ta(c1B9Mt&ey6=;gl)@u4!D|j_Ta;XdkeY_z+8Xw2FdVpR4?#Hc zv|J*(xu=XBYT+`FEkSwm?>J>9XpD}OwN}g&wd;t|L<^}u*QMXL=)?S(9txX?jccq* zTH5q4N(r~D@j7jd@AyRvN=z9N!lSBlS24E=={! zriY$L$YOkUna(*ZN;dTxY=m&zvp7iZsHgS=BF1DeW5>b-c@+@y0Q3=uJSFZgOy~yghyT^5o4*L|-rn-E8|noEOn zbXWMQzuZN21k_2E{JXsb;?D0%-4441So!)a%x$nZh*IAuQ9?e9fVya1AWbI?1+)#Q z0UFyVji6F|>WNH9L zfgc0awv)%xptIoWAIIja;m6=x2XTX$L4CDk)IbBFfqLgH_G8B!^vqn`1R^*hjsg+qEhr!$C{cqqng;=e!k78S!S6zS z8&J4Jyw(-dLLY2w*320nmkoVH13_RU!~a1#`z2k`QV7_7WxqZ`4v#Dll72>J^nyZC zXXNBt*}n1_F{f4HEF~B;%f3s<#-Kly69ep`{=1K4LH z``BCr!P7x4fXp_g5P?vN6i!+;3M$mQ_1O)$wF_bs6?z^z)4x$d# z*BVI91E-BI+)VRwFu={&TIK*-1$Jf#_=9DGW+{^7`Rnl&kHEi096#_c)WY=PC|DH}7!@I_`1`#VEE%vQ&_V9?Ea-NyCI>K5 zj$=Gq-Z38mzTdiXiyM}0VrZaXr<)ZfK?Rgc9WIs1c!da*c7q4$-c0^}o3|<{oRnaI z!pZ_hWA8>jw(6#q5(7q^H};Fx^x8LUqPE+E(&I}=xxUE!qpxP%v;z^DUXd>|I{i_a z^&E_4L5vcJS_a;yqs7f?l3N#Yd6%{`D|!Upwl$|3JwAVBj>(BSM}9;@Zx-t4pP|SY zw0AsgNtgDkpC{?@%{Ou>Uz|j$%g&UiTEEBL)2r%*hzyurlUgRG!K;8|VPU-d|7UmI zy$3f-yvLkx^d;{&y&&c!O^7D4>`;#9lJ|Ffn2R6<%ocj9Rs`q2R1ML zeSM2Q$AK#69qPyC#c{|AgGz_?zjC%1)F4*VTcB2ypsrg+mN`0pqL{N@D~x0&4%sU zY>?wxN)V|ogLi<_RTvq?=NHXd?2?Vn&6SHbvy9U;P_iv!m2 z+*!<3F+(Ikf6L%)F1^xRBK*M5+QEG!nMTe|gISni ze8KmD-yF&ka;G$Ao zIDW#un(f86tlH0mBK#=jO>az1eM5P;KTCTCi}nV_b|a< z{h9pDM)TiXs?(QPtDcfXbNn0P^oAIEFRcCp3-No10yj_KWPDBaCNrNVGoByalm+l? z1;ap>2$R3b6H4Ua6X_KA;alRci}!qqIe6GA{XB;7(*q@>*Du9EX<8{xlnviqtrl!X zNNxPy;x%5$Q}l&@Fw)|EmZOU4V}s+!gG=RJ7e;_zvU<)2aSntnRTo zg+Q!jQD3&bSp&nVbc*I-rXN#T6a4qZQYyss$AbZNdC)Y|rFTLRrMf3nlZU5A9#_x- z?UEl{@;gSUYvH`*zanXq<8Ss=`nmMb;7;OhfeM~=zWEryK<=f%yf_$===YCMO#0wE zrx}fAemCv^$44?WA7Vhh4P!Rp*U14wP=t8+Kb-NZln^$>q{Wn{!y&hOE?q&R=fXWvUm4lZ(A`X=Jre+iW#+>okq5Y!ee@7N^2jVUwast=R z--HjU8KDJ}=`LUZqJ$1IB?%(B_W$OZ!aE1!PBP~{kyljdKj^%Ebmc59C94Ujyc3_SLJTg5;95kPQz>HJtFoKnxU6`8IwQ$!0PJ6G`(zg z1#4};VM{~E73CRvA|A@GSI0SvY`S2Y6qT*G!gW?Qwo*^(LamItx)st#fjKpk_g@a2 zdqJ3s_IM_=d$0LN?|ayVEBY6IA3s9MYc%+XsZ#1(Tf?rOU|sv3U?pm-zFJsKN~|j3 z9w0#q$2gek)ageiO+U`0DvS|qt%cUiR~}x0rJ;T_mm}3W-v6Lh@Ft?zb9h-BSRTtTd|?p&LU zVfoAp3hKv^B_}HOrNumbaIKqi&2%hhyGuSJ~CfK|s5AUzJ z2S~LW7cQ;JxOQ=LYb>0i)MW~s{%XWWvkGTD{qFFEBNmJEwBZ=mU6w75Qwh|rc&{4N zT^WX-{5Sa(&N@|YR4%7~A9-+Y)j%@H-<5%1B@#f^NWno3VlAx+Qw+&{B?z~Zhca_j z-STgti+m#8o3pblerUBZb`2H-O33#D(Z>>{hzK!WpS_fU#1nCm#lkRJT+ z7F|dQFwa-Ta`>Bg;25qvQ?xeCzYOZ$o(vZHIXv4DT+gBMb%tN)u;%*tc!X535wH#X z{O?IXWl{*xh*}+~+HoOZuij0?uW#fH25C9D%N};X!q9vL-ug^m6#p?S@4<4kdw^v7 zh|_{?*g2PD^+LF8{B=MKEE3d?&Gs4Ku3C(%6VKPQ>~a+8mh`eV9Ij+6O(q`!oYEgeXfJ#RR(76?J%&Ha>wUzW@59~ zOY>ga=)Pz7SYFDqj3hAb2G6Kbf_asP*U}BF6d}^7>P81(r99xG@?-XIS{u`E;U(ct z49|!;!bzAZN9~3`A0oZOvUDQb(`#{(nQW-wxz2*rR2Up>^f5SC;UsYid}k{xsjd2} zq+l~9UDnS(mxL4FywRKa-__t_s#lD+R%3bp>8~64T5Dma_}%-mV068-^m`bcDQ$Cv zBLK38w~tp;%gW@jTfmbkib1roB$x>PC86*{t`L^Pu)gf5;>+FK%ngDJ9s6)l?vtSh968gP`Rhu8LY^BlSukTTcq{IpKe-dTW_dNd+t5C>eoC|#3E#sU^eUjo^-i_-%1)#}P>8W;iFZ7)_ z8CWg4O~J+n=UXoYKAMz1dv(Mnq(dkYNtfjckFm|HRmitZ#z;NEG#CD{lo8w+$dpgW zoMck&`r1YPEt*5p$%!XbA+F&(P_j=RjnWeguoKw#yHK}Bnw+bOdx)f)0~5YBba`dE zn=l;L-x9BDakAAb$xzfTqAoHh<`HbNtJkn+>=mJ=f7dwaSxpHa4ArOi7-~%qSS3wU zieUftaX{kw_27=j#p~6<4|Mh(H`l~Zo?bXyoUpx>r+LEFt4Xj}ep9oqs^rf0d#1HU z0w){IgxI&rAB_V) zzu5c9{+#tMmTC9mux~}q*+oTF6!S$+Qu`tV^My_(6^-*%E`{wyRk}73Q!)0sy#t3+ zw}r&HZ)$q#R`zJ;?o*0?+pfH)Q~vkL{za^)kj;HJVQ3;Dvx~;st7M1nWE6d4gpp5E zvMO0!)6nmC)*Up$VxQRrF8h%&;Dip5t;Rgb9;6-`QywJ11V1h1E|+#~ZpMr~b z^b4}}mS62tu0EhHTJ0E~VC;&K(ovpv6N59cx?%K1TmO%re0#U(x539Dn)(gZo!PSg z47Rk*7XL+R5^B!6g^hErdvC7e#XgDXuam>WpcqNX9Xy|^fmMGFs0cMOr0cc}66za& z7#Pp*9QvmgkB1O*w4Pch{YzVaoYptC&l7Z9l6#ru##NS5kY@d_Y!gEiJWtb`k9aQq zVTsM%2tvo_O}RfAA!fQWr;ZIhGy`$utYy$mV!Q4*X^0t%a**?g&3*w!_a#vfxf~TX z1A}9w%v6U-LA`;4E$MQc(cfjzo8G{y^00&c>%-q{tEcD@oxk28&>foR%4}^PACypVpXA!H-~2dm4#hvGAog-R_0KKY*+fPU{+j*zLEGwl z~y!9Fhq$h}er52Kd&>g^p1x1eE2z&eA2O;m;s$O=bjO^B}TZ?!@BPo6S9q8F!>R1BF)#!I)zd(wNBk+l=l-=8iV-Cr{T9D3ym@3r5HYX>F|? zt(1ZVW#ZeIq{qVfkiT~$l;Jm6A`8PQA1{jCtuSwhCX``E%HiQLOqzV+Q_E6Mld&^`6akc7Fd39)4Pu!Bh)p6D%$me>K0&WAFlNY zgq&U%V;7Z?mL5w4Z-d7-?;jnn#~M9Strq8DwKj%!6`u4vGBbEP5{b5a=@3HH$@a*~ zJX)Ed4Dt)8LKf3P8Vqp$&JUTJr^Tqy>FnDi;WtJ1_seTOsY*E2x~s8MO}3W-=Dhu2 zs;J;;5s$uSzXzj-y7O(pkfq@_mmHIOWp)>LHn5@=w6C%5SJR5^wVBC*E4rZ6o4={6 zsTmG`ev0{~#k(H`zMZoAhtuts(ToB>VtadgyYrEdlNUZblcdltF8Ibq9E_32nmq$Y zc=4C--=%?>hk}xFZax8kx=G2&7+Mwkc|;szWtT9y6YEqf7NCQip* z>tX`z>$h)n6s7&;E}6xJ#PdK^Pk?c8aV;!nc<}y$nGi4H<3p2@{ucCg!#5a0Vj|uk z6_pqGC9osqP?ef?cc7uN(Mm;&Rbx}RsBr4?)GAs&yG}oz>=_82@bxso9*WMWZ6Xu zSgq;hGk4jkvUE!+&Ye4_6hQL!$Gt3rYKBVpRY_0J3cV5Qd@VF`VYa7`q@kgKM%eZ0 z);bPn-|e8U&j7t(7zR6ViIr7SS2wmyd0cC*r?9TXZgh6-&h6WeA#d|qfdzq$?iG}F zF2h27AZvkhD2^nQu}P`^W7mF5(lu#)76F0N_X1LSM)1rVBmtJoE$N5{dGSt?x%=T0&gX5F_=r|oOc;vPT8`}egmekk~OwN!(@8Y=$4>;`r{7`w& zECBn+eD*8`nn4nHvoJ$oT7uzN%YQQ*Jg#wb!=PUq7%^f3%X*2OT^dOGVa?mE<6TFB zXqWXgv$P&*>buGGySTXtz^Va+17>o-!6OGUdzS&X!>~Y@FFY`2%#j<>r}T#V5F*&O zx95hT4=;d%bw`Jat9rRb=*W>HzJIJ5<3&7X*HpE%jzH%T z3tU6!%%Y~YzMc$$NAXLkNniBr_kw4==K zJ&}=->AjX7e1$>pil{Zq6&)Qv2@3x)&QEX1jePb^8}idMT*e217b%U@M8n;=uC6XT zJbZYquN!W#T2wToR_;89b#olMzdGHKxu|~?GLzv*4d+SZLxlRj(R~tPRr7wW{OCbXrOy8hi^MoNc zJo)PGp8eTcv!kQQ^X6Y8FVpZ?MD~x~TD%DRi=-Y##?_-OCst7`&jHu(sT}mUxK%Cvm)wQ8{S7ARMR=Z zDlB}aqoc#(F%3Qab7-M}8|e4{ZA+1N-uA&&uB+U>eSndXF@%nf6kGUXo{(5pMhoCw z>D#v{kg#5G?@OFbD=DD?5~_veyx`n;INY*Yel{iItinZrS)%4MXBEpAYzk= z{#0BjX8?Okbd1Iqsq6I%7cV9!B^_|-ccR9^Rah=uNK8tSj9Y#ShM?B(aAuG_VB?dL zlKMjLmM5qt%Yxn{K*U%cxXJ){&5iAC6A)rJe6o^~2ljR*#7t@*AHt+tGq+YgroMll zJ|Xy^?ffwYVJ&(l5zmc>A_ju6PfXQ`6x;fBv93JNck?3hfEs)_4#$(WWru5O>yXz5U+u<_kg+&VF0v0h1a4Sh zIx+HA&KJw9*XEDj!#jQd(%ywfkfD{s1;%5(aY8Q0M??voVEoR?tUv$UYBGp2g#Y`) z2I+N~VHAl=;P1qQ?j#M4R3ltiO+O1IN0uni{H4%PS$%!|WYM(zA8)QTjT*xV|N9f= z-YV{{+YI0DExJ-fJzEb>6N-u}#9=xRR%6P|GwlG+8-oJh=UG0E250yZz}b^NZah%o zrnm&rYSQ08smLJOKUaqJ@^&+GQEn*bHkeLuJ&@S~uYwuS>hJ)~-@iX;Fjg(T<4i89@ts1m0*vNbb-jG zD!h3N@?Sn@{v+lo%sqNnQE>)3(7`%h%(L$0-Pqi$wc=$K5V+f~DI;@;!EKBjQLp^@ zXomR$>q;_^U|=e$s*hkc5PVJU-liZAr#2>o6HEe04CJgk4Ktvqh-hiH;3t!i5FM^! znG}P&RLJIN)zH@5S47c2$XVE=>!MsRA|hpTV> z%m@o3gH}hZJHp^Xka|Q9Z~|s*(_J<6{jJ5|y=~{G`b_8E2QLSK9S$69 zIdf!0#TC5^<+8wU0UL$|n*RBtVq)f#Te0*kX6&B1`6zJC)j&ty>|Y|w%S|N2#Hu)w zqety&b4N||%AM710b4FK7o@15pvJ~$*()QLN{}AJ4cbKtLe2JrHo^0LaS&6CodW-= zgGr?)UMb~p`{}uzo@?eU>BUhD+GeDgVPRqJ+rgYwDjqjr2GP8>2~>0>y}d;tQT3jb zhl7)|34HT7o7^)}y;7dgC78C@DJzt!4O* zpMI66z`w`MxfB%>HQmxw<7SB3m)l7MTIbOUV`it6hicrE%hReI&&-6Xd$L; zxA+Yw0z9mIy3km#Ht;;``V}R_27tr2kkgWRlTQ3;X|*A{|8u@Mj=&MuXyhjS<4uG( z7|V=x*qYKal3A`xUoM72l=JzsWZ~gcCx}y=`5n~MA_eh!b)2;|V`rzA9jj_G6${{ zE`A&T_Mg=pi^Binl7np+{Weu4v->m*i|%;&#q@S`6-ojBgbHyw@o~s{B>CMy3P4I# zRh1){7i?p=Ir80D9Ob(>_}zDOAkhJzXIg^JhoBghNyT&B1-UnISK$G{)2Bd>*e;gJ z2(HKfWI7n$gEGHx;X-E<~kz9~@vWZmd zLPY{=VwkVBBB}^~A`9is^q^J99o*R$$VMTqWR^}bDZ~Q&9&1^UGKCtfAedFf*}uQu zF8tu4iea({icD;F%E-x)m6HqVFS@0iRWQ&EC(~-Ms()$?W`uHKLt|fF^7xB`D4Xo> z?eeUpoiX@R1r`O&2T!~?@7uZgi;zI3iza5WFh=gh*ZuWJkoi`nWQAY?97-@?xdYK) z7Eur}wFbf>193iPxIW*H`9d!^)8)&=7>ZIrks;Ape*iB`3|Ds!6IraMys4mo1lf@H zZNB~ZEuMH7_J(vj4Dwu9TvQFq&DuszBxw8)8m&zD-!(MZn9R;qYRhxUT2WzlT zg*vvChp>k$C8&CpPK;6x7cQI=6Jvz*!A&J4BFxm>+yv4UnuR!M%Q}Feu5;H#W4vBv z@R;QS2b7taS*qU|9Q+bcLl_43^j{#20kNivzJ4f#gkW<2*Z>l36a5C&3{M(yJ=|7%|(kZe!jh#Jz{$QH2 z!LIHOm|+YPbe!~s;L*6_gF0*{JIvr40__i-@aZD8U@{~hKD>(TjOlegK59`>(feIF z^x)U#gDr)X`8-b(OwHMdOjHfWIb2`qHRPHP*MZ#tXJggI0u~BRhI>iM%#RIaLeG*5 zOh1b)yErg$&|~g{yX%9vP6xsR2Q0jHvWo{K!3ziQMEHvrnD|P2C>>vm*=M(n1*6q9 zUjo8ehHpQAHX+?RKl7&`&D{fN*t5uNdF+r@E z!NF26#1BmI@WjN#k}fR0imq-51T!Y!3w4(|r1gB8<@W*K`zG0J?S-~S-0RN!dww)0 ze&blzWu@cUA(Ddx734dbR;GU2?d`ZZk&bb{YBMbOrr7_Xn@|KSb&M|UVz%Kd{!1N#!w>{(fo#PWYkT{T-`@ZF`BOPtMHdb? zhhEuPKE5s+ItXejmcFuK?^yC~nVHW08b$L2Vco=)l$DzzFW*6u0EFnsje$pcE#zX8 zJ%OG-!yzb|(;!EbPe9;J-Aiynm~Vb$|K@&JqMf2LZj(VN;c{&Sb$lyIjWU7ggBDcD zJi~?-RZs6YZH`#qi^bKAGRUCJsevC9bQ&O2- zAa}TuO_jh&xC{Gr$lSsq5(gzeC4Kq2(`P#pS1vpCO+bIzTRh z>I>dbwAB*07t>=jzD-?;QVho^INy@SQI(oeFa)3cju<> z)xyE}stpvV`>ucd_V9IxME920qk+WsukauV-kZcCgnRG6t5|JIRkS=w4`2}*X=z0k zlX;-IcdlPP?bE~=%{c=e6M5-_`_1$lQ_%@4q{$lkQA6?jDM|XhnwtBMr>6~cMfW@# z2N&UgZ#-3!%V5jZG&Dv$8*6rFNy~EpRbgIE5jpk#NU%MG)sqHFnC3D(r&@<%$H-8k z?NxqfY-dNC=dQ;odcns{sc9Kvxj(dxT=s5RjoxMv^74kuAUq38pGz)nvGevsf*h&> zDmsh)P={0n=KFgvLE^tMVf%TgfYgi}I_3wtFIq7pw1>cl0FpYJJ=qFgW(WR)is>%&NWgD(2CCY%18G8MjMK)_V7y3LFyu%As9p}`>~0u1 zS4NSE@snE?Xc$^|9{nD>b_pBulsUAwH7n1tZnQbax1+Mf?0spsm4n>bsd^-!jWOS3 zf$N>0`Hl$!aV48Nj)?v?NA7;#j}8+6+k#0^{V%T{m71ps ztiGcCIfGVO+Ob1h;cRb=^b|4*5K z(4oQ$-^j%**cn_+SlLQj!kx9ZdbTN}!gsLOJK{(83T;l^Q+nHWcG)m9(?Tn!@Q}|R=T-sKg^5WI1(1C!)kC_QZtPy$ zdMMgSx|bz$zQoL|C^2C@zhL_y}^2_Gwqe*OIYL6~umN!U=dfj5$wjhQ<| zrmMNiicN4G3@h?nw8fat8N4k#kjojH#_|OYr_h|4hW`oM7ClW%t5agTS)^`NK7HWJ zzgK0(+WRRp=|e?EGtAo$ik3m)Ij1yLuBVf(-_zj|w(cKIN$!>mrBDU84WGPw{Y10u zeaQ&t(ymY#cyPTf#bVXDm)DxsG=b%gN_N^dpfM}%RawZ19GY4 z5ngC-zl;iHa}O7O@pYGM%0KC&$r9b03wp^D@33D|-ulH+Do*4Vu-yJipks2!T9ui$MA@(P8l7AY1`m|^u>(;%Px~4-`;5( zO&_0?Im)1m3<(GJ*XDA{6m`mU%Abz@8n(T9HZ=hSZ&QEAL(J{gy~qrmx8z;taGZL( zh}KBv0XcCF?`97iln?vW0eCniRR6u#0oU@d zG7NMW7!m(VX)82gSz>~mN{Q@;4hHJW&n@(TFf>v=fF{?EG!K4O_!@Zcc1($Wk{chk z4b3QyJ9Td>apeZsn#Z7kYikIKjsAYRto61~(#x}dOW8vB#@kC|fQ9hA$s6^x;n5>{ z>wI08{!@kF&H@R=16uDmwhMSI4^e&hk?>;Yv%T|t!Xoq1wNh)>V#m41`>}sdm@y>* zrif{6ZEwSeafcGz4m>`~o7&au294Kq0Fz}>wfd1@E*GEI?`LnFm|$bggR_G)d!c>OuuhQ2NHy#Wc%yZ}1cbyli=}cb3stg;(p<3L~yzA(bB2 zv3FiVz4=re`p@LPtQ$R?#Q-UiF1r8dMym1cB`>X|P9Y22Oi$LS)toge(AoHy~vj<;cx$PJ4Dvxd0|9Qp!NsqgnhR8DjY$@$`aF#*MI{ajq>A( z<|?AckFi|XE0>>pH7;QHQA<%tXk**t@249xu^w9h>-$jbg6j{Xycj&^E_#Ygp~66< z6PY3__n4Tx#=+BREYaTH*$X?@9!xv`XSPB>1zmOMNd{e=JCJ+6nB;G@ig`GzdFXxj zxWb9V6ty>^b{}7V(V#59P(cz(&j;XP^6(q?$7h01`zXmkPOabrqyS45Bh2o03I(RF z0n~%vb&^guJxdy7|3vEynG$8=^S9LpeQCqMWk}*6bkuQV+$gr4u-6&a3aA$FkM}82 z?;rS+uaJ87pz|?tL&F>82h@=6-zdKLYwlG}Ns1+Pd3DhuWcNG6 zVyB7JfXWKdD__r;Xsgl_TGdrdJsZ93A6NK1)A_;#=^5b=v7Z|xOZJ`b6fJ);Y)MGB ztECEyl1#KDG?isV;bVXw;=$nA3x|&v51xpA@x&~5pZ>p8QTUAwIIhUbL@t_et+sx_ z?*l_l!!cEsCC6L2yI*k6kR#b_g3Kg*W>Ic{g(?=J4?)PuE}bPb-WslszJg?GOqC&C zm{=q8l#fn{79=eKo9pl&0qOh9*A(_|Q6IpfiYcB6-AFkO zS?}giR8?XTd+}Lcmx+n~NB7co-q#MR{~S7-s}sfmK?4tR@)^{KZb#cg2<3r5GDC)x zudWy*B2?yBA|S{wSj^{?&kJJW|Dhbm!sjY)UB zS>d+I^&Rqv^F|%h0O^FV4UabsfT1TaEVw@x|5h0Q4QlKcp|$MtIe^DJf#c~$192Dw z%STPJPh3TKlNjc-@3js99g4R_o*DS3GJ^QcjV8I3tb84?IAAryI-ua1jJs9yKgiyt zt7r+oGnP611~flY7@xiLfm`xFjRzn3{d*VyUxx>js@x577$3)PRx2Qpo`6k{?Gr|U z9TOR}do(2nj~6K;#FV@>v(V2Na$QWx0Eqk2as;qn z7+QuVkbDHqPyZ8G?GUI%>4FC`!$+YfBs_pSVM7Ub0+w3;ZKrHs&y_RV!6mv7%%aV> zi4G!IV-(3+Q28G(CDei8i)gKuFtjwkc)B)*1Pu)S{odF%Oakhqq4q&M5YmRh#See@ z@Zo<>scOLqD%!_zEQ+Y}s9}y8MZN zi6+C#cma}oqO$0@(z%rptCC`~IeTVEaJ&%3o*KhZz zE9)*WEgb=PAJJJ3A_l>o<9n9*hTkUkWdnTI7Rp=5Ade#3I?Q}zwwrvWYbRk~n1WoD za-mfSV>(c^okNpgy;ae;d-xe?@2;@D^y7g<3UarQ;%kFa5SA>gR#HWC?rT==2Qd14 z>a`h~(=~$gkpih}CbFxSIxFpGygY79(zB9>H=#3$%|_^$+f31>x}<}TCXG&=FBr@b zcd=^0V(68~`*(GKFFMRrI*2QLLf@-WLTzR2+%&CZSLO{D@JKs^6hMd~uDc&RM%2Y< zp0mCz1uY@&0dms7MA}z=22vgE|Df?tziwlAJH^D6FkzJ z*TSS4nH}S!tzI58=qFu}WjFzelNk5VRS321uTtLtq_)i{ak{NFiQ zGM71-9Rg?SRWnrg(~Z=3S(CGF;Vz}0d-7ym5|VQ&p86nltcMR@w>7k2Hu1C_3MZgo z5?riPlmEPKF0ykfm>MEhu?!pZw;X4ZW)B^$dT9ql4z5f~rYTW1biI$7pK>3q8V#6# z^%(b4Iz9~kZ{R7h%{5JD)y8*xoA(sjV~@Gtk^LjH*Y7S=B}T~u-90Q8d#{Ih9T?}k zgbpy3QP|G?5;|aEg?=8tv8T{p!BuPhm-ozwx@;0mlBVD3U3LCHe%HueZKqGI>Y%Qj z;c~G3HTo0J#oagQZYGa=L%jA22FO8$T!TM>lF4Bxnc%;Y1S>^nPwC=D(_Cl@LHD>Q zY+O43q#vba@n8BEAr0mppmGtc_46uOyl0BXUV!EqIs?`jeF6K#Lj<@5Pk{{(8UKEm z`ycuPQYZ)DSmM9_e?B-Jxs)3a?qvG>Kb@Jy3}eW015mOE|K&IYV0e`C1VE^+sQY1Y zwdkup@0yN_dx#nSwtJWLb$8A_(HT9N0CwhX_F z+xc@w+vTZ6v)G=zpZB8K5=FinX5IJ#xwb*McvG)L5;AEq$i&a(}rjKDT$wVTiuIJC39zAsyyp1KUyw#bLx%*qbQN# z{E@{>JvHN*yI!W^{lwGh3T!qld0y6{HXeH&=fC6*Ua4*GblxFb`%3dkI`;RcFsq4! znEX6X_wiiP>(7QejrK{TA(tYl<4~3Z0|Uj4;c$RRC+t5SM|$1Cs2U4gZ22gk7++ogGzGfhv5m<3P8A8GeEVrNA&>z>R^ ztu?o{c#mLVO_N(xzVJdI9gF;A<;~b==Oa#I2iSO(@-KXoxxl?wk@NTA&{d!Oux7*U z_j}K+KkCul571WDHEWRKDheiPW6y7Gp0D}8x_is0s@kw!6h%=KDd|*7q(LcZq!Ezr z?(QxTq(izvKm?>?EjpBxMtUtm=~^JQXxPv4eZTK~-xz0)z4saC&pGptjun%+=6vG5 zulu^Ldyo%kgfim>yzEP(mE!WHqTe-ifTuHKIVJ3D7=r0h%^WFb7Onjh4r%rXEVtBk z-Z$5c?!W#!Kq)|JO|ZX8*RCGoY5<93e)nm;?4yM?r>Xx?W2LI8J?2E%MbI=91|4H) z-(@VtcV=w5HyM~#L(TI03Um16>L?p2%ksoW#Z~pu))j2wa850FJjcLN%7fT7pE6N*m7-0aw_zuq zXQb^Q?>Fl1Pt<_98OPNS#hU&@WUI+3vGi-Vl%cMpwQ@vs4U^HfEPR=rZi-!7ZWF!P zyEd1iq&Y3A;5rYw-VW(JKIEmWznN7(;A0w({FrL?M$dfU8p1hDZQZP|MnmfoMB-4M zHmd2;wAW{Z3GVe5f4b23=%Q0}7Y6W;sa>Ns-KOY)jzyEm{Wp5_Y@%j}$FDONTNeZR zytikUwqxv}$Qh2=Y*8yLZJ8T+FVFkgO4%)AQ{Q@wA!|+Zn0x6aC}CzUC)S|fI|D*$ zG2^5a(#gZZXG{I(D7yxxN^V5}w@sW6lDAubg`j0lnPV2tqXV}%uWjFPz@zt#7F*{A zGwtYoznj_(>+5q7XfHK6MadF3F^>FoS4STNfr_~RHl-K-CbR_KwFJjtEbi!ZscMB-#vMCDaudHF&X7BSW z`uGFn)QXmX56G(a~0P&JBC!|@}H5})%psH9x57%>zqQr4{|G(arN!>I#UOZ zb@ryxH*kwFztVbEcsQO-U9Wc*ikek5`0L)U8hd(6bFJdlgFUT7;lf_{SXxfU1{Hp2 zXh9FI>AoxCN6|qZF>W`c?kgL-eJ!XbgW4wfA)y4T_9x}&Vkf`23;}V!8>7l-(rx{A zX~{IZh_EHt%hK^KFB?0Ae9Zx!x_KcJ)_MlmTj{J#F`9;h#D@ zxgBDdrtkRJs_cx6&qZA`2vh?Atw6A!*uqHM(Ajr}wZivSbQ|~MJkf%yxkL$fUQ;C`jnSXxZX)m~I6sP2foO*Qx!7#Kt5V6c;?(lG&rB5kW)<8jLeNqyRQ{$rEE zqdTMx-zVc;KqWu>=k>Bkznjdh>G7|H1PQLmbkp6vPf~(i-Ieihi79;3-}Qaa40NvM zJR`BY@vSf;i%KajePRrg)@afGbdnyi`HVvBwZzaP)RWt#3l_%E{he3u(U;aPi8azJ z(%)(-fgykY<*S>Hq$VkcKTl0W)Zx_dN!-n@U8JjJHYtfk?x{_b0fMn2J>;H{rTay2 z-dWbwNRZS8m3`s4Yg*tH{+w!tm+vcWixMbKg9K~#*tBpXYwHuHJV!p3>jm039i^rc z`6Q$)ztfFt=3kaR>VMzQay=mG77A)*~nJT(fetzaO0o% z0)Zyp^Co{S24PpPG`V~ercz=+>QT|knE6Wdd*)r27}vK8H=UQZIhA9Yb^;u4x}4W6 z;rzDnH@{EYhi8|EVM_9(9<2p4t$3QTh#fnxRu3vy=MSuGmg}W@Bn$3jRQ`A&;Tc4z zn@Nrh4=t0zke_*Z*W>j>bX$IS!hx})6ET`@SJ*rLeJGAR*a^AU{s`mR>r$Uo2Nmx> zt*W*Yy!NdwTCDuDm&WirdBhwd=a$wUt{~uv9NEqa-0)+R`ksNFAJ)@rlxxLA%~sdD zMPzkRR5=(ASKhe{{#4))1cih7=jW<1H-*jbVeW>b%YL@c1;2{LY+G*np2Kq!E#nv~ zU&KGWC#YqkJG`?axqdOK5of5)xZD@FbY&rKh*@%zG_SY<_KRjNMCwa&YIVh^l8c@GQwkGxNkS#Dcdy8WAiR4P9P&(0ex)vDP>*PSB7}%9YUc* zVT@m6@Vu#Kqb~Kt>K8f1{_U=sljhFxqU45PH{l3${x<1Mwd1+Tz25NU$XWPOJKdl_ zZBH|2yKMdjm+tF4`qGWeo@C7ce*=gT{2Yyx6Rv99E50P1l5{~~H?EOl@?{>xvUQv` za0z}x&4FLZ1|K_-4|4|Ct5Hgbf-0S!-|VOBU=|Qj?IzRA zMsa-G&D|-I?hfNbOzR5R^?KVGjUSWglp!%~!R1XRV)0#-@fGd;d}Ooqi184ZtueP{ zh6uf&|9o^yQN-5pw^p9e6w(?)FcnQO^@;GyvK+Gx&rJ-yK>K;;J@)E(9!T;Z?XMwa z5h^h_%G!_VN&FEHofI~hO`;z?rq+PCIu6x#n~u=W2*0_t)Jcao>#Fx^D7}X1)3{#z zN4{pKqH?PCO};9NcEsM8vyFs4i^hz?vXf^C2WxMX<*?5Ji^iuDn)uQ7h94<&J)seW z19h_PHGb(OjG5w5X2Earv-ZT;xk*S8sUMf{Y?6$|bycSa;(|8%$qB`~Zz} zS|@YPM*6vZu0^qPwQ9AU-OypS$j_9ywrYi*LvM}a@24;kSSyYa}=ABjMU#07U zfh(K0tT+05z+MOk7C2Z@@g!A!_PQhkCdYP@$AhuD)q?CyEU_Otvm9C1-tV|qA);j` z%vOq7gADFYBsXg|wN72cb6vFy+$!LjCx@1)wTu zQm^*why!>jJSc5HjRmNE8zNmwgVC>0)N2M$Lj`u4h|CrY7&(;+~@JHQnOXKElRLTKL2{oLqpbIlT|*qF~6Mh7vD)c zPpo{bbr?>&HX2K#<{X$-PNvNn#{_cheI6rY!^eVZObfjZcF)>ui~1Q~f6!Mpp!K{V zW~^bjHV|raAJVx4TT!w-be?q}M6<_nRgOTkPMF+XShO##VMVfsGBK}z(dSVTc(4`R z3c=BxMs|P@bBgC~_flglHyM7@tV1RL6BzFxwU=d)eR>0?KYdYm*}@FNwAQg`L?Bo% zrAPX`0_#uP*Z7n&!*$pg8dj?Nze;>x`MOk{(yUG;BJ{v-YxLoP#jObws$C{Vsn+%E zTT8FQ5V^<6S1&wHW=xu4ajMg8U)cm4Ux?~aI8AkOn6@5XX_r-;tZv8|Jf?B{oUOXJ z9C|*Y8hEa#TeE-24*k3f=hD541g;k@71m}|pV=h8sQZYuEp7F{w)TcoSX>Khzn~>} zxJ4j^>6P7}gIT7I)gHTcV2~~rP6uv9^2iEn8?>)CF-@I-%}ophWpREVS^-|*RdS-|de1%ZAp(r1R7nk#~f z*c*2!9mO7T|I8A!7G2v|^}yT>@9hnh2jZiJxolI@*IUd5<^-@6Wxcv$I9Sw$n)~;X zxC9%I-rMnp%%`IjAUx%o<=zQU1mkzP-5Im{})&tq0yiPxCe9bw3VI zOdaEH9^*t9*MTTdMxPc=|8Y39&c+uzn?5tS9d_gQ=N=sKx^Oq{&dLvf8PvdX`7)1rU&p$rb+dbS<6w?!$Q-SV|h zZ6^l(4*-GzEI9GWgJ9s)s8Vmeg%Rkf$>TaJXm*3N^B**-NId^ehc8AihWQfa;|!4u zexFk-o?(8&%`~1OWEED-!_(WpC8;Fq#r6%lVDm|tC8mImrS%OBzw4X#kPo*hqcECY zxHZ-N^w1rYCam|zGMS}Zm2X@mH5aa~eLAin1}_lEt284n_1LxDynE55u1kM5$q8Ld zJn@{~OABtEdEi6p-z{h_4SR_By6L-vuf0Gs?RPrpPzGbHt_FR=`~)}jkaV#*o;*8T zFbCB2@V#k=rRi-NSu~91Zhp)NE6_d7k8A>)w_Udf0SJX451N;MS`Xv5l|QquUytQ5 zx+dBt#1W{dB;B@mk%j3QvwCpUPb@FfOgqg&VqAEG zE9YC;y5#i?OZl{V?H({(D}JfiyFW=|JFGYt_g*EY4`O)Ay>}JTK);gGIXQLF9i;KUOf;!y8mI)yk2E{KK?UIr8=hTyl(~O_sHfyNn)f z6xp@wj31f-bTrl2IyN0J%iy`r)9i~)+l;P%yNf?bJ)*G&(i#Ap9-M63e&r!Yy-()n zBGD7tNwcYm-1M@eM(1eBOsj_r$+$EM<{&+%)yY4cMcp=xnD5?;26f}fdyBad8SD%V zLnMH=z7|9Msf8Hz3NH#VHN4!W|5`M|q5O-+HsAh!TAbJsWAu(et&6#-m!L+MGbHKI zD*PX8Y!gLj7y57>wL~=H$K+#a()sR&jl*b}0Fyl~!3ime&ZAJRo>Ep>76IIEZ5J&T zNq-HFXa=%@57Smb?C+DI05)Y;fMstyNYW>8^}iisf<4uxt`X8gS8zf@3c`@FfjgH^ zW$a2>KK$`2vv0&)6$XH!-usQSW6p3hZ!5k(qIEM;+7(O3&Ghc%-~sGY6jaVA*`?W& zn+Jk`^n{6dz@RHM!j-YP*wYqNc>v^(1t5RTJl#*HZENrB#m>w8O>UhB7t&O>oYvg> zO&Nqe9RQP|`ib!oIjxIl)s?mEWE?fk4S~mW=u;we#xtxw^`PhguHhM|kVpXj z=U+A*1ls}p*Xhf_y{-j5;2l-`;r=nPyhekLzyTC@{}jYcBe$eTo%Ms1V#9M6VNaYlO~?ao*or@?b_;^`}wHtO#$vY5a5|@w!Mko%?PjZ$nyzXN&xH8F5e+{ z%I*Lt655DiU!%R**!F2dd=9{m&4JK=Hq1@ntjO?Mjc{e>jO`njM zwvI}oR$V}x17~ywg^VV-S{F0BTnkYEzOgHzjo*`JWQyNMYQAfy{+MaA-3=C#??a@J zXAJ;MYs+9WK6N1lVLImvMRB+AXewT`{dpUPzQ^aVP#$Iw`7C8~E8FFQe0oO@Tb_Yt zkBFSXh5!voe7e+xhPdh~&U769zFLW#i5KsaS9bvB3oxktTVKl_SP8)+IfW$SOQveex3XXnrFOYh9t7w`OkH8soXloe zSm;cFgs;<7&--SSv055rrR1ndi|=N8_rY4Us9C!cTWJ;U13L2tsw z{scOWt;w*LkeXVw5E~U0oSU0_UJIn=KvS(RtT-|ETt4Ud4|_Y3iH9F8*(0Muz_#AN ztlE}O$7`D(Vkw-gtoPd|6Xygy_1gD%J)uTN?=u!a!GSMDF+ECJg~p=sYrMb-_FBhX zo9-KAUQ_SZF?u4B$EZDfIe=nsJm7wfR`*COb#xXYxJBB>r^!bEC?rl61KZCJf$n{W zYUIZca2^AB?H+~nwOeS_##|{e$rILK)R<`Vpq-vRnbH|FT&}gaq(AoQB=LtE z2$QZiMz&APlVv_plizp4!KXD}xRz_#TcD=*ak}+M$x>O($s#MHQt5|Hw|@cqpHce` z)*$?a+2>z((V=&I+;Dyk-EP(W7+&ms@RdeYLgDws-j5broK091)~ zC$-R%6dOyx&S`!9snkt3{IqSq0nzr}1SF=ME4%=$Om%p7MqwoU%;uRyn#2KrUZqw5 z>*#%!#_4y`j>JN>?~26@l^>ZYB>b5Xjh|zJqjhv}jBS%`;S5Hk{+V>!7jE`RuqUkt ztHj4wqI9j2))=3U@J^IAn2kHlFxS~P=RxIc2$UM~eV7=DUiVV0xAI8$dpn(GdU9nB z6&F|Ow*tLd;y40jwUM5VV)cXeZm4!RGj0CO=U)G4Wr0%F?&J{YiIi1T@*OOzwRVt) z>moO^4k9p9Noi@6h89rn|IzV6;i*7sP@f5eu=A#9{~?nbagRQ;@&EH%nk4f8m#78F z(00k&{4=8f8318lP8n4Y%z-GS+uWXeZ0zf&_J#0ysd-Daf?B)g7Y~Xv<)iNl$i`m#Tj3$qK<%KQ0s#`fe>650K$H3e$a|Co_e1nu%63q{eT!oqcwL|* za9hjFniXm%kAd782Rl@OnpSAgV}VH;e_s zBcQCK1!^TAsaLD_MoICqvtz)^Kqgem$=utdGktcR4_w~b_|I7vw2;_K(lOmx#B0ka z=QJQPYig}n5!M`N0D<1gbzXwL(0ectH>k|yUnUz58RohKa2}4qB`f#P$Ds7Ey5UQf z1kKgk`85hMzWe^yGVAgk&)o@tw*qhn1Ox$b&}|p(T^W$Qb`Tr--9iJR^?G;((EFo( zOiK$#8C9U1gSkf6YS(o|lzk05I}R|(z(6A) zCZ3*g1p2jG;SUBQfyxjlx=Jq^z4mDi4i21vj|19U-}lLPc!3o9+qZ9M65m^lzTIy2 zCnO@ejRvGak-&E4xEcts)zs9U0OigUiSI;WQ+}&| zrnof8yCD9y7Y!?dJftf`V60Ww%e1{t4F|x5%d5)xMD(}9}mlDYWpBZt&EL->w(ATqtO%6h9O90n_JxDSz8`l0SZ?avoBP? zH_?!q($c@tVXbWv0tRYe&6HRv?1>={TOCL>oo{mA`eRC+o8fo?)L$B57gEyF(@jc& zfz{YiwGuAiZItS>Dfe)F1TGYCUboTolj`+s?ssRcI`K_)psfvSZxls^0^O$ zu>VNg?xD2+I};!>w@E;jS6l;K9a4{981^v=WwS6cf`j>bPqc_l2#p{6V}*5sRv*9e zyn$2*X86XP&lT0I`=*U{x{8m`s7^%(%Uh2Orw1Ae%Mt*hqmk-NKC9m|m6*?U-FvUx z3f|vpK8K$Yl_m~DKdhfw!*nI(rO7V^#R$Mvn7%rvHQDp~tQ^M)6kTA_>LH%0hqBrN z*(s3nq2sz*0l70uiw_>J4g7{2E~2P+U>bQ*GM&r@sB_5x5ICr@bOhzcxyw>@_Wch74_N z;9`74q@c61oyQxC?hce_;KnLd7sM*=I=`MJwsDbCELHGyxMUuM-_HS6>YslS0C zIxn+voEd2HVL+#b7mpoqjF{Qzy^m8*%?7VDY$t<*u5Qw;{$OMRxoydzu2L4??;7dJ zcrFU38}&%%*S!rK$y@ zT~1CsAll{g*dakVAGsl5grY-KzrXyXXCY8h48*$8sV8G^KVrehm##U{xCbJLnkXlo zmXgMF5f!Y!H7*AUiQ`Txz#MBcY%buA(=sshY*sCS)woos60Ev+ z{#8)69Q~9Bi>p?H(^Cu_D!p}Q$d6jCH)q+N3*W|-L}I|L20~0@AO%H9Hc_iAu!TY` zQ;E-%pqVJ*~@Y9I_>ooXa$%(X-)OYYufcn!5_?-Yz=zbq9vh|m0kz#j?_czV? zSlcOwj_rYKdR@T;NfCTd&r723uYRr>q%$1HyK=4_(cd{Dz5TINa z?B*Kq&^SDHw1C}*(Q1FP$A^3%J>>*`Bq)tF_%hI>*~Q%91*--aN~n7QoCtt`a6l>=|rtoG7I12xd-%>~|EvBd#1i@XZ+Qh?yf-?nCE zwl($IDk;j!DFTiJKoy@+_DN06j6Ir)pW<~GmK3w$V(B8v2afvzNO^z|2W7Mjgr~*H zagamD?DDYEB13k=(9O^%a{?AGcjYKhbgF->+vfhVOfo`%y8+5#0T?>j!=bluTid`M z6(d~N(6&p?i*b|a@>j}&rz`|QZ$L`oHt7l{>&z5-6!sKYH%`8UC^5aN-vsQSzZ4jw z_3QgUJcgp&p$_kCz}?$G;WyxsnO3dq)hRY(lO=zS0`EtYsZ z_eb-N7i$H9`OnoEpWV*+<(KAg)CrXjLA*_-CrACOg9X#l@a3;ff$kIZS~@|hQYFD^ zW2-9Ddt~GehATPKdnpr9bOMnr)BJFOwAU!YE!ioA}WN9?^gzpZLYAH7LGO9{*qeHP{HV&h2t zgL*N<=Tqa>DxZB{Ij5jF0olKy@bT&P!$?K;iZ)rn8H7~H&!$pe!2DUUoHL_pL zant0x)_K{zofjiZUe9Ad9c-02!*Kx?m7vXF`Z*$+UG~!3v8l5rPJ%_u{`#nlr%%93 zJ^uO6MIk&?y2Ja>?nGT5V}S)tL$_Fg<=p0wZeub6H9}xAJ#Tmj$pi2PFBe8VxELSN_&9 z>V(&O8IKPbIWn8*EOH>l&!6dCTLu)JS>z)$kTxO9!yjPuNXgx|VMTI-vpNKI)Ko7C zqw)FTk<^MyIZF;fBRFn>;5W$t_X5y!aF4PG&DAU5;~Njl0%ZWd##vFUJjgrKyyc4U zkABlFP*()0stixNJnu|*%b7CfcBENL!;gSmIe1PhV}P)pjqhOZ6PU%h(HJ&B$Ohqd zzCxy*?;wE*6Q_$a45k{f{&8R9Zq2+<6*sF2=jYP;4(d91A5-2?8_VnRG`>C}hKc9ZsJMB$e|0Am9r$z#?P(S3I{-fS@E$=}B zV&%s5djPTr^$8e#{kxfI=G=j;w*Ig0i18&8s16dMK^4T$Tb!q3_)^|~Gjkf@>1UCXTXU!46;j`s+_K04{>$lSs zxQjT~3sEFvvRKc#!4Nf|H#JIYs62WPxJ`DLa>@~`ze}311pfp@1I%QFrJ}SU&`4{D zzb zh9{q3i4}k{b-SD{RBkTt{%s9JJm<=ZtHKVOF{mN`e8~0vQqu7SnxE@bK%g*2{3#Qs zranfSAV`t?lFBW?IgF&MWjGukRzv2)F6`H7hwz2Ub?(UrO$7GyT_vW)&Hwgsz5#W7 z_~3BzWX^P%KL{F^_~ewi3fCb#j);%(uR2mjdp#3D0kw?bM0y0=r4WZDZgp7J-@ym6 zMjH1hY+TnU4Q0?@#pts zqxTqm8X@*&S-lnGH1RLanSK;+lu(giU^Pn~5!u3ttLW2VX^;z?myuMah4c49Bl2Kq zxIYc-RF(C82SMSx_a$a2gWUbS`*%nHG2y3TKj%oB6`)Pfag%!VUNm=~-6IPEH5wWj zv1)|-*!4941?>x38vuVE1S*ODmBqOB%YsrnSV?h(_HR`{F6tPjK?>$5c;x;rtERZ! z@1@LPmU@7Q^^<5(;d{S0Gc<=lM5OUsYtBUce0SAS=8H1Mig!AF{ppn5OTM4*Y;cw~ zs7$PE{Q;%(bfJ+FsEpA&CGuDKDyKG>*D9D?m2Vj-<2yCPnu5ut$I%CSR_e^WuB<^H z%gwBKce$hoaWz9T)+eb%{vh-s9 zL(Xtzg8uu-{+92q=#j+RWV(PLv=)wyM~vY~(7D-y1pAX`%O>B>!b8Apl6zn9D9nC6 z&#s`gvf4}`2{3m^wJ$O%9#O(Ko88bqYikt64Mbt3HS~Yg^^1947?;LIH&g?g2OVGU z?|du7D5NX8(KqUF#ayC3b;a!1w4`tDB|Mat^N`;I$vd?TAnUcfl2T#bzy8w_vW{;f zg503WPd%FCT++hn4$u2;uAV=t27qbfGB78P?#PzE5qznK#p*E~(gxK6`_S?S2|P=? zG`=rfJFxhY@{n)(UCznt01uhe8REMsj?ViHwdvZ#%>S5jkaqw`qieAo#jRxmk%76d zDOe`0Y(j&!=!G4(iKQ;n4A@_ZhDMG_lSaYuoW^=7|MbYT(?Lo5( zmbVW&5Aml*3N4sN85drILW&IK6DbV^k~(k?^{Z7Cgd&w+iuEW_7b&B>9Ajx4ONzV2ele>|Z_k7LEX4wlio?`;%_%TL$XYyL{9%v$0 zn>;afF?RB8Q1ld8n@Xgy)^(}81;UZJR+XME_57;Q(}jG^*$EB5U$@`E7jb|5nk9au z#iKE(Kkr51pzSJ3*XJrt;$$koIqe3QB{ft?twJi{L$j0i2aC89SHBLtHHBRkhp;Y2 zQYnhEn6C8qEO(SqD7(p)ye#X&LDOv`TomD_*;R#A7E5@{Uc@&^0p7Lp7=KGaaeoC+ldvnTV>Sb z+IbY{q_h)vZrDsZyY6!K(szMd8)XJ7Y))GJZqwX{5xzc5Y1~m4C$Zm{G?_262=30i zEaVwL9$yZFSMgqfZl)^J;jS{;tdYC7-aZ^?9H;6(<6~p~B1F6jU6$nb9G>2=wPiOy z<3|LTblMHTtxpK8>L&4u5nlb>-P?XPv04$2T!kL|=zU`1JeP|f=HjQB^sr}`jfkn8 z7lu@WiCyTe?$2;k<9`Q*BbY|NCt^GQGL|1|tY6n&8@tcAUYaGH)^0D`km6(<0{ZU$ zsM+DpJ=cNZt}Y#NIpnO*vgdl-uSuyY`Pm0>&>zxrX#&-?zVTuofmaz(3azmgx=cz9`p*S`1{ZI7p;VuH}8 zI}*)=1~Uyf-4(LzwtosOoJpeZ3uX5dW~BqraNcjxqDJl!X@PlkT%lF~O&s|u^lVyo z-<2>AFLz<iQ~g;u}>%U&{NPYNkB21(kvzc?t2C zfK6jCf$4AWItP5rFhO9rnVrqNHr@_--81evweW(RoB?_BC#*&{uoP@ux2N{F$D*)i zMz&+HQa;wm9bw1y6BLLi8Vq{U`x9dxy$>6I3z6 z19kO2j3qGuq1vO>iO7y&If8$&kK!sa3p0|?U#)_u~4%ZS|mT@*A+m^FJ8>N zoA0#9oC~icZeM#>Tw$p9^y>j&s36N(Nb4C(kUVkQG;KIKCb~QhyZ0}iZX2fA6JAE; z;9qQ?WJLc-?cQrGQJ8NBvYvU+vz$#)T{N3lPC^25F{yH~4Duc3hxW4hDsR~b4OCiuIj#z|SDq9u7a-|4pxKA`XKXxo z-^un^4Z@LNS@wn7@LD}wB}|@)ynH?h1B}dvcl%9;eZnZ8%NBPtr6j7Rn4@>yu$vn? z>m!OjFfu;?0nwWaPyspTtcLVv+ zV^5*}x@9I!QhSn1>%ACq9__r%icx#8={L{mitWZ1aM)UF$B}{l=SI~J-W{}nkk+gn zYTT809x=^zbn>)+F(u;4{b8Mbfx?xoi9*TT4qD6Q)?*TxL| zwCO4r3!~yl;`jtT0p!nXsRaUibu8ub-kbN9p|hb|ujHF>rfD0Wx4yk_PWC{TVE@9U zHao@|q!P27qF-0;iprx+(Yp~7w}yQ?oA1eb$WK_aTk-iSXb|t9Sfj$*f?QnjbGX7vokKl;t@AtKkvvEKA6ASHacEeqS2n9VT%xF2I z_y|$*v*%;+Y0pw11Q^dyjux0tVy&k&VyveHgVinkoygU)nTdF6Nvz}SXQamXuRlqf z>rAH2ucld%`r9&i#@5~alyp3k{X>LldgF?U47&_Qi$9BV5@p&Q8o}dZD?Q{7D)P|n z_(`G_Ri8}H+=?@w=dA^qam|WTl*_7-df+VA3yj1fSyu}aVJhzJN|tc{>_CyCy+Dtv zmcd2ecgcrp!;|W9&7kMnao{H+At0VHwV+^Ldkg{Hi2$KOaArr3bo^eFaavq&7dHL*8j&#nQB&F$JKQ_F+L&gRb0h^&I1jr-NiB4fEJUXyFaetY z+#W3uGk{9q>A8prY1Pk%`9`YF9}x1SL_gw9n$Qmr^(?G-2R%Csijmpy{AA{L3otgrYb&ZKK8ims&$q_`zz!@yM}i12Df@> zqyVTcs3KeK${4?^!}V;N@{3jKbzZ&|Y`Tc=RdjLT zAxbxiPpx$x7Wthv*0q)Z5VWAUoHy3e)!WQ4+U6+xEOm@YqzuKSn4i%^z>Esi*{`C= zMLi<1FB8OMzjTT9(uU+5TDqj{ssfM-rxxnHkEB)3s z{?9Ajr8fX80xM>kd`2b{K0KndOv_c2#j}8gcBL33wZl1Ws^8NHHB-G92SNctppqK$ z@a648>F*Uqqm!nt0A|Xf$@WxV*mG0#4zPrd|KSMYZ zE#T|UHV(&?vW!9P%0fg7LQd<=353)ywz-*mTagnzshKuFA7|DAot#qj`6_<7aKsg1 zzMK?=@9u41ns6RthK7dsOIAWm?egN%V*N+^fk2~OnM~LAdA1ttsY?)H9M;FTNepa1 zQBm8spBV$>>iR^<<(4>)2fhI=GN@ZjuId~~Ot?6uf3hg!XL&r40I~`|@6+2e_5|eU z_J>_z`Sl(X6wq~3G+}u{`L}5K&z=BU4K`>xbG0Ac_I7%}UC-jRESd-ap{lqiuKcSs zrM5)634MhUBnsEN)lCdD*K&TjkUrS!K3QKIm~@evsQGi1-p9}OSYjxrrsejNHrsXO zyJXqyB-B6(6(0NHP2I>e+nv3Jm}Qg02h_pkH3eh!YuD&8#hh=3dX1tuN3Cus3fQx- zeN~9Qct$@RwW4nKFzi<$uKzG$Ao^N6+Q65k@L(gw(f+P*9k^u8DKN)D$gL#~1QyC_ zriTT{!vm@&1uXhGKfNBn2R8-bVM;I%9-*o@VAOB@#M-@oSb5g`YuDE32ofkbdcWl( zBVc)$kellwJQ2>>tp*U~*rNHkWzM9-w*k|(zE`M>y{{G+lTF&ZQ5s|B0SXzAa8R{_ zXn%}el;yy|hIws*QJn+KvF?@R4>P>f#6Jk0RD`z!L?@11f?E!ezbA~rSu`-awEJ$O zM0IN9;ya5EKY9#}_KWk#Gc`H97*J=eb?vTs%nNrA@xPTn#_t z5}GspCi@#+%kW>kZ=gbZJCenfmCUj2kN*OEEXzZ;bp`wPW&ti`_sT(6X>4MO$k4QG zNM0hRe5;0J_IrCEV6#LBHLRo@roK~jl}z}U$rND!YKYLa3Phl-;c_F>b#Z0)y=A3< zh;6BPw$huojo0Z!t{P+Uo^N*x3)<=Hk6H`HYG2g#aRYYm2RGg60aT#D{&)c8$?z57 zKZCA%vgW}fkL3t3MM7KeJf_uh{Yd)a-O`EqQxe?HV7 zZ`*9`yTiUhPYNCezn=0pcOFboq_1Jx571lOWB}VO zDTusulfL7Eg8!n(9DCayBhjLx-LncGk$;dk37(2lFBY*xGawQ3P`^y1&A;~u_X9nk z@hu-I<<~gSs=c3)7pvQBp200X$eu^TXiQnpe+k7t@3FMyS+$~rP+Ggy+nOn`bN|FuLjv1a%cb7xj58#+jE z%y#Qqq5XRwklbFj_a+YSNnAA5)OA2BK_XkIwAx|-X9{r4Dqk&;*=Y+_Yh4 z9RO-B(3%mSH#ipn-n{MsP`m@eAxxkPrlIi%GrqCgxj3aXWaA1Gh`*v9#I34x``#T| z&k`BwMcYYZNT_y~ z!7BOp=iZ1D8~5 z0+AP@0^rNPFX`dirlN_Is)0SvUk z#oJl!bUrJ|g@PDtzi}o1QpG|+15y(6a?!#AGrP33#m!jD&CTE!ozo# zJ+mY6>T7Apml4M8wM$)B{aNbWp+E4c!b4xBk~Y-XbfZ<-#M$x2@r^S2tOEcTxQPkC zpz1#J^*JpyJgR^c=>cF&U2I9~-aXsKjz3e_qyY5v=*%G;4tU0*!KrtSs5BFN@up`E z4`VPg5dn)qt;K@WVT`K5+s?r<4$0r;ak^(T&)pe17)uVh0P0y~DmvJ%hM#^$OAkmt zd9;YpU+TUntw9d)8hhw3aFf?{n^Z~b8^p0>6_q{$i6Z6&&WJo4arLx{&-q$h8Nb_< z2_fb$0C0w!Mez~S%W7$^Ea21FBBRWMum=-9{*)g4z&%2AHz~0O@GYYN5LMc&|v5ma9kAi-6%&<&(h3cZ}3@7pW|h>v{=D(!A?h@ilS) zv&t9$0~3jm>y3go5vz(-Ggc)vs?zxY+?Ilg@NSa99NijrCQQyN&~s?LVvfFTTHUUn z5)1%9945T**h6LhQegha-Pni>YP~e&>=Z*U@-MXW66!i8X4}4F+ zTpe+7y;jDkg*?i}9|j;Zz`|Oyjt4dMiPk5_>Ao_v1LoFHuX!22)3Lo23SU-`PcWag z)yN-tRfCb6)h9hgy$Bl4F(~^P^b8#e?yVkjewtcPcpZxLC!kb z9!UldX4(~By)=WrToEQa6eMF7E+lRO)*U0Z)<<^(ATRYV`v0OZ-dh(h@EXH_Yr#;e z=Fm5VO-?Fc{kcsk73InOBdB&=r>p~g%p@WMEbC;Yg~VAWRorSSFs<$nWHin{1scnl zLwh3ke znW)EDfB*CU#7!Xo6{>|Eu&(^qt>yo67($IEnuAv_pn@@v*7RCCi<33!8^{M6(?Hi* zl+VlGgVIYKm7bvvR#2|^=f(epYr%iFH^{86!cJItiaSQg1sMbW4R25$4Q>DF->?Mw zVxi0(mVt}NEp8qZk68)zi3ODNgQ-t->bqioxt-y5eaGGtOAsEQo&fpdIg8yf_^iC> z#9SH-%~}5__B|OniU&=N`hMUWr%e7_TROiKCg-;M$}jK&A3B|DWA<#%y#9sw`-f4{ zsQ{`AnZ6MC+~uG5A;BVjGd{Oxz*JpxJdTYFC-}l+qBwoZhTKPe*6E)n!F{HG@^xK0Dh-gNP-ra#pG4iVt-a!+8G;NLzZ zczBx~rTG6244cNkhCKf-UflooulPUspx+TTs@*6!1Q)kE4Za-<2cRa$Ki)uOa=^@2 zuSSjbug%Bb`W0AV2LH=X1h(}5eEYwTbCB7Cx*Y`lv%uSRvEjW~GHG%&b)o^Cy zWC54)5%(6QBC6N*-FMOjR8p0(LbzuOh|{ALDXlWlQu?1uv+-cjcvu6P%C7j-)IR>bXmzeMD5pwc&wvJ~ax2nqZe}g`q>k9T)-^L&uq`_5IeJvL8bGP5c zE!=vUl0>!4*>=%-`sI=YJB8BY!W-3>6EeS15%Gx3ah)f7ZlU6793@y6>fwcXBeVM8 zZ{~hlc%(xgYmdk<_^(Yk*`V&7JL8m(=BGew&|;q#_+J5WEC(+$2gfT84&97(_5bz-dq*>C w3-AB=7nphtH^CPe|MM@nS=*btx*6L${m;MS|1*FGd + + + +Rancher Turtles is a [Rancher extension](../rancher-extensions.md) that provides integration between your Cluster API (CAPI) and Rancher to manage the lifecycle of provisioned Kubernetes clusters. The main functionality is outlined below: + +- Importing CAPI clusters into Rancher: Installing the Rancher Cluster Agent in CAPI provisioned clusters. +- Configuration support for the CAPI Operator. + +The [Overview](./overview.md) section outlines installation options, the main architecture, and a brief demo. For more detailed information, please view the [Rancher Turtles documentation](https://docs.rancher-turtles.com/docs/intro). diff --git a/versioned_docs/version-2.7/integrations-in-rancher/cluster-api/overview.md b/versioned_docs/version-2.7/integrations-in-rancher/cluster-api/overview.md new file mode 100644 index 00000000000..4320dc87774 --- /dev/null +++ b/versioned_docs/version-2.7/integrations-in-rancher/cluster-api/overview.md @@ -0,0 +1,210 @@ +--- +title: Overview +--- + + + + + +## Demo + + + +## Installing the Rancher Turtles Operator + +### Via Rancher Dashboard + +This is the recommended option for installing Rancher Turtles. + +Using the Rancher UI, and by adding the Turtles repository, we can let Rancher process the installation and configuration of the Cluster API Extension. + +:::caution +If you already have the Cluster API Operator installed in your cluster, you need to use the [manual helm installation method](./overview.md#via-helm-install) instead. +::: + +:::info prerequisite +Before installing Rancher Turtles in your Rancher environment, Rancher's `embedded-cluster-api` functionality must be disabled. This includes also cleaning up Rancher-specific webhooks that otherwise would conflict with CAPI ones. + +To simplify setting up Rancher for installing Rancher Turtles, the official Rancher Turtles Helm chart includes a `pre-install` hook that applies these changes which are outlined below if manually removing: +- Disable the `embedded-cluster-api` feature in Rancher. +- Delete the `mutating-webhook-configuration` and `validating-webhook-configuration` webhooks that are no longer needed. +::: + +#### Installation + +- From your browser, access Rancher Manager and explore the **local** cluster. +- Using the left navigation panel, go to `Apps` -> `Repositories`. +- Click `Create` to add a new repository. +- Enter the following: + - **Name**: `turtles`. + - **Index URL**: https://rancher.github.io/turtles. +- Wait for the `turtles` repository to have a status of `Active`. +- Go to `Apps` -> `Charts`. +- Filter for `turtles`. +- Click `Rancher Turtles - the Cluster API Extension` +- Click `Install` -> `Next` -> `Install`. + +This will use the default values for the Helm chart, which are good for most installations. If your configuration requires overriding some of these defaults, you can either specify the values during installation from the Rancher UI or, alternatively, you can opt for the [manual installation via Helm](./overview.md#via-helm-install). If you are interested in learning more about the available values, you can check the Rancher Turtles [Helm chart reference guide](https://docs.rancher-turtles.com/docs/reference-guides/rancher-turtles-chart/values). + +The installation may take a few minutes and once completed you will see the following new deployments in the cluster: +- `rancher-turtles-system/rancher-turtles-controller-manager` +- `rancher-turtles-system/rancher-turtles-cluster-api-operator` +- `capi-system/capi-controller-manager` + +### Via Helm Install + +This section walks through different Helm installation options for Rancher Turtles depending on CAPI operator use: +- [Install Rancher Turtles with Cluster API Operator as a dependency](#install-rancher-turtles-with-cluster-api-operator-as-a-helm-dependency). +- [Install Rancher Turtles without Cluster API Operator](#install-rancher-turtles-without-cluster-api-operator-as-a-helm-dependency). + +The Cluster API Operator is required for installing Rancher Turtles and you can choose whether you want to take care of this dependency yourself or let the Rancher Turtles Helm chart manage it for you. We recommend [installing as a dependency](#install-rancher-turtles-with-cluster-api-operator-as-a-helm-dependency) for the sake of simplicity, but the best option may depend on your specific configuration. + +CAPI Operator allows for handling the lifecycle of Cluster API providers using a declarative approach, extending the capabilities of `clusterctl`. If you want to learn more about it, you can refer to [Cluster API Operator book](https://cluster-api-operator.sigs.k8s.io/). + +:::info prerequisite +Before installing Rancher Turtles in your Rancher environment, Rancher's `embedded-cluster-api` functionality must be disabled. This includes also cleaning up Rancher-specific webhooks that otherwise would conflict with CAPI ones. + +To simplify setting up Rancher for installing Rancher Turtles, the official Rancher Turtles Helm chart includes a `pre-install` hook that applies these changes which are outlined below: +- Disable the `embedded-cluster-api` feature in Rancher. +- Delete the `mutating-webhook-configuration` and `validating-webhook-configuration` webhooks that are no longer needed. +::: + +#### Install Rancher Turtles with `Cluster API Operator` as a Helm dependency + +The `rancher-turtles` chart is available in https://rancher.github.io/turtles and this Helm repository must be added before proceeding with the installation: + +```bash +helm repo add turtles https://rancher.github.io/turtles +helm repo update +``` + +As mentioned before, installing Rancher Turtles requires the [Cluster API Operator](https://github.com/kubernetes-sigs/cluster-api-operator) and the Helm chart can handle its installation automatically with a minimum set of flags: + +```bash +helm install rancher-turtles turtles/rancher-turtles --version v0.5.0 \ + -n rancher-turtles-system \ + --dependency-update \ + --create-namespace --wait \ + --timeout 180s +``` + +This operation could take a few minutes and once completed you can review the installed controllers listed below: +- `rancher-turtles-controller` +- `capi-operator` + +:::note +- If `cert-manager` is already available in the cluster, you can disable its installation as a Rancher Turtles dependency to avoid conflicts: +`--set cluster-api-operator.cert-manager.enabled=false` +- For a list of Rancher Turtles versions, refer to [Releases page](https://github.com/rancher/turtles/releases). +::: + +This is the basic, recommended configuration, which manages the creation of a secret containing the required CAPI feature flags (`CLUSTER_TOPOLOGY`, `EXP_CLUSTER_RESOURCE_SET` and `EXP_MACHINE_POOL` enabled) in the core provider namespace. These feature flags are required to enable additional Cluster API functionality. + +If you need to override the default behavior and use an existing secret (or add custom environment variables), you can pass the secret name helm flag. In this case, as a user, you are in charge of managing the secret creation and its content, including the minimum required features: `CLUSTER_TOPOLOGY`, `EXP_CLUSTER_RESOURCE_SET` and `EXP_MACHINE_POOL` enabled. + +```bash +helm install ... + # Passing secret name and namespace for additional environment variables + --set cluster-api-operator.cluster-api.configSecret.name= +``` + +The following is an example of a user-managed secret `cluster-api-operator.cluster-api.configSecret.name=variables` with `CLUSTER_TOPOLOGY`, `EXP_CLUSTER_RESOURCE_SET` and `EXP_MACHINE_POOL` feature flags set and an extra custom variable: + +```yaml title="secret.yaml" +apiVersion: v1 +kind: Secret +metadata: + name: variables + namespace: rancher-turtles-system +type: Opaque +stringData: + CLUSTER_TOPOLOGY: "true" + EXP_CLUSTER_RESOURCE_SET: "true" + EXP_MACHINE_POOL: "true" + CUSTOM_ENV_VAR: "false" +``` + +:::info +For detailed information on the values supported by the chart and their usage, refer to [Helm chart options](https://docs.rancher-turtles.com/docs/reference-guides/rancher-turtles-chart/values) +::: + +#### Install Rancher Turtles without `Cluster API Operator` as a Helm dependency + +:::note +Remember that if you opt for this installation option, you will need to manage the Cluster API Operator installation yourself. You can follow the [CAPI Operator guide](https://docs.rancher-turtles.com/docs/next/tasks/capi-operator/intro) in the Rancher Turtles documentation for assistance. +::: + +The `rancher-turtles` chart is available in https://rancher.github.io/turtles and this Helm repository must be added before proceeding with the installation: + +```bash +helm repo add turtles https://rancher.github.io/turtles +helm repo update +``` + +and then it can be installed into the `rancher-turtles-system` namespace with: + +```bash +helm install rancher-turtles turtles/rancher-turtles --version v0.5.0 + -n rancher-turtles-system + --set cluster-api-operator.enabled=false + --set cluster-api-operator.cluster-api.enabled=false + --create-namespace --wait + --dependency-update +``` + +As you can see, we are telling Helm to ignore installing `cluster-api-operator` as a dependency. + +This operation could take a few minutes and once completed you can review the installed controller listed below: +- `rancher-turtles-controller` + +## Uninstalling Rancher Turtles + +This section gives an overview of the Rancher Turtles uninstallation process. + +:::caution +When installing Rancher Turtles in your Rancher environment, by default, Rancher Turtles enables the Cluster API Operator cleanup. This includes cleaning up Cluster API Operator specific webhooks and deployments that otherwise cause issues with Rancher provisioning. + +To simplify uninstalling Rancher Turtles (via Rancher Manager or helm command), the official Rancher Turtles Helm chart includes a `post-delete` hook that applies these changes that are outlined below: +- Deletes the `mutating-webhook-configuration` and `validating-webhook-configuration` webhooks that are no longer needed. +- Deletes the CAPI `deployments` that are no longer needed. +::: + +To uninstall the Rancher Turtles Extension use the following helm command: + +```bash +helm uninstall -n rancher-turtles-system rancher-turtles --cascade foreground --wait +``` + +This may take a few minutes to complete. + +:::note +Remember that, if you use a different name for the installation or a different namespace, you may need to customize the command for your specific configuration. +::: + +Once uninstalled, Rancher's `embedded-cluster-api` feature must be re-enabled: + +1. Create a `feature.yaml` file, with `embedded-cluster-api` set to true: +```yaml title="feature.yaml" +apiVersion: management.cattle.io/v3 +kind: Feature +metadata: + name: embedded-cluster-api +spec: + value: true +``` +2. Use `kubectl` to apply the `feature.yaml` file to the cluster: +```bash +kubectl apply -f feature.yaml +``` + +## Architecture Diagram + +Below is a visual representation of the key components of Rancher Turtles and their relationship to Rancher Manager and the Rancher Cluster Agent. Understanding these components is essential for gaining insights into how Rancher leverages the Cluster API (CAPI) for cluster management. + +![overview](/img/30000ft_view.png) + +## Security + +[SLSA](https://slsa.dev/spec/v1.0/about) is a set of incrementally adoptable guidelines for supply chain security, established by industry consensus. The specification set by SLSA is useful for both software producers and consumers: producers can follow SLSA’s guidelines to make their software supply chain more secure, and consumers can use SLSA to make decisions about whether to trust a software package. + +Rancher Turtles meets [SLSA Level 3](https://slsa.dev/spec/v1.0/levels#build-l3) requirements for appropriate build platform, consistent build process, and provenance distribution. For more information, please visit the [Rancher Turtles Security](https://docs.rancher-turtles.com/docs/security/slsa) document. diff --git a/versioned_docs/version-2.8/integrations-in-rancher/cluster-api/capi.md b/versioned_docs/version-2.8/integrations-in-rancher/cluster-api/capi.md new file mode 100644 index 00000000000..53ec6f4a66f --- /dev/null +++ b/versioned_docs/version-2.8/integrations-in-rancher/cluster-api/capi.md @@ -0,0 +1,14 @@ +--- +title: Cluster API with Rancher Turtles +--- + + + + + +Rancher Turtles is a [Rancher extension](../rancher-extensions.md) that provides integration between your Cluster API (CAPI) and Rancher to manage the lifecycle of provisioned Kubernetes clusters. The main functionality is outlined below: + +- Importing CAPI clusters into Rancher: Installing the Rancher Cluster Agent in CAPI provisioned clusters. +- Configuration support for the CAPI Operator. + +The [Overview](./overview.md) section outlines installation options, the main architecture, and a brief demo. For more detailed information, please view the [Rancher Turtles documentation](https://docs.rancher-turtles.com/docs/intro). diff --git a/versioned_docs/version-2.8/integrations-in-rancher/cluster-api/overview.md b/versioned_docs/version-2.8/integrations-in-rancher/cluster-api/overview.md new file mode 100644 index 00000000000..4320dc87774 --- /dev/null +++ b/versioned_docs/version-2.8/integrations-in-rancher/cluster-api/overview.md @@ -0,0 +1,210 @@ +--- +title: Overview +--- + + + + + +## Demo + + + +## Installing the Rancher Turtles Operator + +### Via Rancher Dashboard + +This is the recommended option for installing Rancher Turtles. + +Using the Rancher UI, and by adding the Turtles repository, we can let Rancher process the installation and configuration of the Cluster API Extension. + +:::caution +If you already have the Cluster API Operator installed in your cluster, you need to use the [manual helm installation method](./overview.md#via-helm-install) instead. +::: + +:::info prerequisite +Before installing Rancher Turtles in your Rancher environment, Rancher's `embedded-cluster-api` functionality must be disabled. This includes also cleaning up Rancher-specific webhooks that otherwise would conflict with CAPI ones. + +To simplify setting up Rancher for installing Rancher Turtles, the official Rancher Turtles Helm chart includes a `pre-install` hook that applies these changes which are outlined below if manually removing: +- Disable the `embedded-cluster-api` feature in Rancher. +- Delete the `mutating-webhook-configuration` and `validating-webhook-configuration` webhooks that are no longer needed. +::: + +#### Installation + +- From your browser, access Rancher Manager and explore the **local** cluster. +- Using the left navigation panel, go to `Apps` -> `Repositories`. +- Click `Create` to add a new repository. +- Enter the following: + - **Name**: `turtles`. + - **Index URL**: https://rancher.github.io/turtles. +- Wait for the `turtles` repository to have a status of `Active`. +- Go to `Apps` -> `Charts`. +- Filter for `turtles`. +- Click `Rancher Turtles - the Cluster API Extension` +- Click `Install` -> `Next` -> `Install`. + +This will use the default values for the Helm chart, which are good for most installations. If your configuration requires overriding some of these defaults, you can either specify the values during installation from the Rancher UI or, alternatively, you can opt for the [manual installation via Helm](./overview.md#via-helm-install). If you are interested in learning more about the available values, you can check the Rancher Turtles [Helm chart reference guide](https://docs.rancher-turtles.com/docs/reference-guides/rancher-turtles-chart/values). + +The installation may take a few minutes and once completed you will see the following new deployments in the cluster: +- `rancher-turtles-system/rancher-turtles-controller-manager` +- `rancher-turtles-system/rancher-turtles-cluster-api-operator` +- `capi-system/capi-controller-manager` + +### Via Helm Install + +This section walks through different Helm installation options for Rancher Turtles depending on CAPI operator use: +- [Install Rancher Turtles with Cluster API Operator as a dependency](#install-rancher-turtles-with-cluster-api-operator-as-a-helm-dependency). +- [Install Rancher Turtles without Cluster API Operator](#install-rancher-turtles-without-cluster-api-operator-as-a-helm-dependency). + +The Cluster API Operator is required for installing Rancher Turtles and you can choose whether you want to take care of this dependency yourself or let the Rancher Turtles Helm chart manage it for you. We recommend [installing as a dependency](#install-rancher-turtles-with-cluster-api-operator-as-a-helm-dependency) for the sake of simplicity, but the best option may depend on your specific configuration. + +CAPI Operator allows for handling the lifecycle of Cluster API providers using a declarative approach, extending the capabilities of `clusterctl`. If you want to learn more about it, you can refer to [Cluster API Operator book](https://cluster-api-operator.sigs.k8s.io/). + +:::info prerequisite +Before installing Rancher Turtles in your Rancher environment, Rancher's `embedded-cluster-api` functionality must be disabled. This includes also cleaning up Rancher-specific webhooks that otherwise would conflict with CAPI ones. + +To simplify setting up Rancher for installing Rancher Turtles, the official Rancher Turtles Helm chart includes a `pre-install` hook that applies these changes which are outlined below: +- Disable the `embedded-cluster-api` feature in Rancher. +- Delete the `mutating-webhook-configuration` and `validating-webhook-configuration` webhooks that are no longer needed. +::: + +#### Install Rancher Turtles with `Cluster API Operator` as a Helm dependency + +The `rancher-turtles` chart is available in https://rancher.github.io/turtles and this Helm repository must be added before proceeding with the installation: + +```bash +helm repo add turtles https://rancher.github.io/turtles +helm repo update +``` + +As mentioned before, installing Rancher Turtles requires the [Cluster API Operator](https://github.com/kubernetes-sigs/cluster-api-operator) and the Helm chart can handle its installation automatically with a minimum set of flags: + +```bash +helm install rancher-turtles turtles/rancher-turtles --version v0.5.0 \ + -n rancher-turtles-system \ + --dependency-update \ + --create-namespace --wait \ + --timeout 180s +``` + +This operation could take a few minutes and once completed you can review the installed controllers listed below: +- `rancher-turtles-controller` +- `capi-operator` + +:::note +- If `cert-manager` is already available in the cluster, you can disable its installation as a Rancher Turtles dependency to avoid conflicts: +`--set cluster-api-operator.cert-manager.enabled=false` +- For a list of Rancher Turtles versions, refer to [Releases page](https://github.com/rancher/turtles/releases). +::: + +This is the basic, recommended configuration, which manages the creation of a secret containing the required CAPI feature flags (`CLUSTER_TOPOLOGY`, `EXP_CLUSTER_RESOURCE_SET` and `EXP_MACHINE_POOL` enabled) in the core provider namespace. These feature flags are required to enable additional Cluster API functionality. + +If you need to override the default behavior and use an existing secret (or add custom environment variables), you can pass the secret name helm flag. In this case, as a user, you are in charge of managing the secret creation and its content, including the minimum required features: `CLUSTER_TOPOLOGY`, `EXP_CLUSTER_RESOURCE_SET` and `EXP_MACHINE_POOL` enabled. + +```bash +helm install ... + # Passing secret name and namespace for additional environment variables + --set cluster-api-operator.cluster-api.configSecret.name= +``` + +The following is an example of a user-managed secret `cluster-api-operator.cluster-api.configSecret.name=variables` with `CLUSTER_TOPOLOGY`, `EXP_CLUSTER_RESOURCE_SET` and `EXP_MACHINE_POOL` feature flags set and an extra custom variable: + +```yaml title="secret.yaml" +apiVersion: v1 +kind: Secret +metadata: + name: variables + namespace: rancher-turtles-system +type: Opaque +stringData: + CLUSTER_TOPOLOGY: "true" + EXP_CLUSTER_RESOURCE_SET: "true" + EXP_MACHINE_POOL: "true" + CUSTOM_ENV_VAR: "false" +``` + +:::info +For detailed information on the values supported by the chart and their usage, refer to [Helm chart options](https://docs.rancher-turtles.com/docs/reference-guides/rancher-turtles-chart/values) +::: + +#### Install Rancher Turtles without `Cluster API Operator` as a Helm dependency + +:::note +Remember that if you opt for this installation option, you will need to manage the Cluster API Operator installation yourself. You can follow the [CAPI Operator guide](https://docs.rancher-turtles.com/docs/next/tasks/capi-operator/intro) in the Rancher Turtles documentation for assistance. +::: + +The `rancher-turtles` chart is available in https://rancher.github.io/turtles and this Helm repository must be added before proceeding with the installation: + +```bash +helm repo add turtles https://rancher.github.io/turtles +helm repo update +``` + +and then it can be installed into the `rancher-turtles-system` namespace with: + +```bash +helm install rancher-turtles turtles/rancher-turtles --version v0.5.0 + -n rancher-turtles-system + --set cluster-api-operator.enabled=false + --set cluster-api-operator.cluster-api.enabled=false + --create-namespace --wait + --dependency-update +``` + +As you can see, we are telling Helm to ignore installing `cluster-api-operator` as a dependency. + +This operation could take a few minutes and once completed you can review the installed controller listed below: +- `rancher-turtles-controller` + +## Uninstalling Rancher Turtles + +This section gives an overview of the Rancher Turtles uninstallation process. + +:::caution +When installing Rancher Turtles in your Rancher environment, by default, Rancher Turtles enables the Cluster API Operator cleanup. This includes cleaning up Cluster API Operator specific webhooks and deployments that otherwise cause issues with Rancher provisioning. + +To simplify uninstalling Rancher Turtles (via Rancher Manager or helm command), the official Rancher Turtles Helm chart includes a `post-delete` hook that applies these changes that are outlined below: +- Deletes the `mutating-webhook-configuration` and `validating-webhook-configuration` webhooks that are no longer needed. +- Deletes the CAPI `deployments` that are no longer needed. +::: + +To uninstall the Rancher Turtles Extension use the following helm command: + +```bash +helm uninstall -n rancher-turtles-system rancher-turtles --cascade foreground --wait +``` + +This may take a few minutes to complete. + +:::note +Remember that, if you use a different name for the installation or a different namespace, you may need to customize the command for your specific configuration. +::: + +Once uninstalled, Rancher's `embedded-cluster-api` feature must be re-enabled: + +1. Create a `feature.yaml` file, with `embedded-cluster-api` set to true: +```yaml title="feature.yaml" +apiVersion: management.cattle.io/v3 +kind: Feature +metadata: + name: embedded-cluster-api +spec: + value: true +``` +2. Use `kubectl` to apply the `feature.yaml` file to the cluster: +```bash +kubectl apply -f feature.yaml +``` + +## Architecture Diagram + +Below is a visual representation of the key components of Rancher Turtles and their relationship to Rancher Manager and the Rancher Cluster Agent. Understanding these components is essential for gaining insights into how Rancher leverages the Cluster API (CAPI) for cluster management. + +![overview](/img/30000ft_view.png) + +## Security + +[SLSA](https://slsa.dev/spec/v1.0/about) is a set of incrementally adoptable guidelines for supply chain security, established by industry consensus. The specification set by SLSA is useful for both software producers and consumers: producers can follow SLSA’s guidelines to make their software supply chain more secure, and consumers can use SLSA to make decisions about whether to trust a software package. + +Rancher Turtles meets [SLSA Level 3](https://slsa.dev/spec/v1.0/levels#build-l3) requirements for appropriate build platform, consistent build process, and provenance distribution. For more information, please visit the [Rancher Turtles Security](https://docs.rancher-turtles.com/docs/security/slsa) document. diff --git a/versioned_sidebars/version-2.7-sidebars.json b/versioned_sidebars/version-2.7-sidebars.json index 7d677be558d..edb87c80c6f 100644 --- a/versioned_sidebars/version-2.7-sidebars.json +++ b/versioned_sidebars/version-2.7-sidebars.json @@ -1215,6 +1215,17 @@ ] }, "integrations-in-rancher/longhorn", + { + "type": "category", + "label": "Cluster API with Rancher Turtles", + "link": { + "type": "doc", + "id": "integrations-in-rancher/cluster-api/capi" + }, + "items": [ + "integrations-in-rancher/cluster-api/overview" + ] + }, { "type": "category", "label": "Logging", diff --git a/versioned_sidebars/version-2.8-sidebars.json b/versioned_sidebars/version-2.8-sidebars.json index 3e770dd537d..2dc5f196a5e 100644 --- a/versioned_sidebars/version-2.8-sidebars.json +++ b/versioned_sidebars/version-2.8-sidebars.json @@ -1175,6 +1175,17 @@ "integrations-in-rancher/cloud-marketplace/supportconfig" ] }, + { + "type": "category", + "label": "Cluster API with Rancher Turtles", + "link": { + "type": "doc", + "id": "integrations-in-rancher/cluster-api/capi" + }, + "items": [ + "integrations-in-rancher/cluster-api/overview" + ] + }, { "type": "category", "label": "CIS Scans",