From 99ca9c0397b108f623e089d2ff41a35a08016231 Mon Sep 17 00:00:00 2001 From: Fabio Alessandro Locati Date: Thu, 16 Jan 2020 14:24:22 +0100 Subject: [PATCH 01/30] Use Control Plane instead of Master (#18438) * Use Control Plane instead of Master * improve image. The SVG was not matching the PNG, so I basically had to re-create it from scratch. I kept the visual similarities as mush as possible * remove tautological phrase * fix glossary references as well * improve cluster glossary to move from Master to Control Plane * improve english form --- .../en/docs/concepts/overview/components.md | 11 +- content/en/docs/reference/glossary/cluster.md | 6 +- .../glossary/kube-controller-manager.md | 4 +- .../docs/reference/glossary/kube-scheduler.md | 6 +- .../images/docs/components-of-kubernetes.png | Bin 275571 -> 155521 bytes .../images/docs/components-of-kubernetes.svg | 2097 ++++++----------- 6 files changed, 786 insertions(+), 1338 deletions(-) diff --git a/content/en/docs/concepts/overview/components.md b/content/en/docs/concepts/overview/components.md index bf83ed3762..c6a00b3a43 100644 --- a/content/en/docs/concepts/overview/components.md +++ b/content/en/docs/concepts/overview/components.md @@ -11,7 +11,7 @@ card: {{% capture overview %}} When you deploy Kubernetes, you get a cluster. -{{< glossary_definition term_id="cluster" length="all" prepend="A cluster is">}} +{{< glossary_definition term_id="cluster" length="all" prepend="A Kubernetes cluster consists of">}} This document outlines the various components you need to have a complete and working Kubernetes cluster. @@ -23,13 +23,12 @@ Here's the diagram of a Kubernetes cluster with all the components tied together {{% /capture %}} {{% capture body %}} -## Master Components +## Control Plane Components -Master components provide the cluster's control plane. Master components make global decisions about the -cluster (for example, scheduling), and they detect and respond to cluster events (for example, starting up a new {{< glossary_tooltip text="pod" term_id="pod">}} when a deployment's `replicas` field is unsatisfied). +The Control Plane's components make global decisions about the cluster (for example, scheduling), as well as detecting and responding to cluster events (for example, starting up a new {{< glossary_tooltip text="pod" term_id="pod">}} when a deployment's `replicas` field is unsatisfied). -Master components can be run on any machine in the cluster. However, -for simplicity, set up scripts typically start all master components on +Control Plane components can be run on any machine in the cluster. However, +for simplicity, set up scripts typically start all Control Plane components on the same machine, and do not run user containers on this machine. See [Building High-Availability Clusters](/docs/admin/high-availability/) for an example multi-master-VM setup. diff --git a/content/en/docs/reference/glossary/cluster.md b/content/en/docs/reference/glossary/cluster.md index 1442d4b9dc..2e8aecb23e 100755 --- a/content/en/docs/reference/glossary/cluster.md +++ b/content/en/docs/reference/glossary/cluster.md @@ -4,14 +4,14 @@ id: cluster date: 2019-06-15 full_link: short_description: > - A set of machines, called nodes, that run containerized applications managed by Kubernetes. A cluster has at least one worker node and at least one master node. + A set of worker machines, called nodes, that run containerized applications. Every cluster has at least one worker node. aka: tags: - fundamental - operation --- -A set of machines, called nodes, that run containerized applications managed by Kubernetes. A cluster has at least one worker node and at least one master node. +A set of worker machines, called nodes, that run containerized applications. Every cluster has at least one worker node. -The worker node(s) host the pods that are the components of the application. The master node(s) manages the worker nodes and the pods in the cluster. Multiple master nodes are used to provide a cluster with failover and high availability. +The worker node(s) host the pods that are the components of the application. The Control Plane manages the worker nodes and the pods in the cluster. In production environments, the Control Plane usually runs across multiple computers and a cluster usually runs multiple nodes, providing fault-tolerance and high availability. diff --git a/content/en/docs/reference/glossary/kube-controller-manager.md b/content/en/docs/reference/glossary/kube-controller-manager.md index 62758c5235..fa4205292c 100755 --- a/content/en/docs/reference/glossary/kube-controller-manager.md +++ b/content/en/docs/reference/glossary/kube-controller-manager.md @@ -4,14 +4,14 @@ id: kube-controller-manager date: 2018-04-12 full_link: /docs/reference/command-line-tools-reference/kube-controller-manager/ short_description: > - Component on the master that runs controllers. + Control Plane component that runs controller processes. aka: tags: - architecture - fundamental --- - Component on the master that runs {{< glossary_tooltip text="controllers" term_id="controller" >}}. + Control Plane component that runs {{< glossary_tooltip text="controller" term_id="controller" >}} processes. diff --git a/content/en/docs/reference/glossary/kube-scheduler.md b/content/en/docs/reference/glossary/kube-scheduler.md index b9672b6e03..7094a6982a 100755 --- a/content/en/docs/reference/glossary/kube-scheduler.md +++ b/content/en/docs/reference/glossary/kube-scheduler.md @@ -4,15 +4,15 @@ id: kube-scheduler date: 2018-04-12 full_link: /docs/reference/generated/kube-scheduler/ short_description: > - Component on the master that watches newly created pods that have no node assigned, and selects a node for them to run on. + Control Plane component that watches for newly created pods with no assigned node, and selects a node for them to run on. aka: tags: - architecture --- - Component on the master that watches newly created pods that have no node assigned, and selects a node for them to run on. + Control Plane component that watches for newly created pods with no assigned node, and selects a node for them to run on. -Factors taken into account for scheduling decisions include individual and collective resource requirements, hardware/software/policy constraints, affinity and anti-affinity specifications, data locality, inter-workload interference and deadlines. +Factors taken into account for scheduling decisions include individual and collective resource requirements, hardware/software/policy constraints, affinity and anti-affinity specifications, data locality, inter-workload interference and deadlines. diff --git a/static/images/docs/components-of-kubernetes.png b/static/images/docs/components-of-kubernetes.png index e56dc79c7a624a2d958c5220c0f8d25f599335d2..0fc30d936741089fbc7091008500bb04914d43c9 100644 GIT binary patch literal 155521 zcmYg%1z1(f_x7d{lnzB2L^`A!k(O2v>5}g5E@=b_Nhy);?iNYuMq0W%zB%4|fB$bk zkKj4%J$u&7ig&$h%|}If$wz2JXb=QFl9m!vh9IOl2!by{MF!sp?i5CXUx@ai(r;10 z<$-D#0zN;mk$P_rK?t+3e{dalqH5sFCl2Cj4sWcD9Gvy+K0waS&djD(=Jp19HXoR+ z?TnN61c)Gr9Fi7$`PL<6XWmuw?b;p6!H~Vt6t<$K%`34t*j2^fS!-9DRdOA7)xY>X zh|6KBp1Z0taj(&s---7_*HsU)R5w-4C1BP4o)d4hN9RXbj)B3tae4c)|AUY3%cLi* zL)WMIg!Y5y0vkVB*?YmSYt$+7<-O1IZ;OmVeI8?eB!@$k$|z#$fse+zP$naEwby!C zzZoz@-iZgb2eHX1hm8NRwbw613XoTDIz43fK=J*`wf-K%H{rxKW=I|VvD1G21kIcG zXg^J05e8}glr&ojL(}F=VCm#FANbNvow+4ITw5zt z-^Q^i9oVGP5fUFh^)^N&7h)2!1M`ZBd9ar-*XcxoZPnodDbgUOy$%cWXj5;EzW#K> z`QZhU2-(vf4w;ba(UpzDN-*KrDTG$12M%D_DCyYPJ;hgP%;D!4o-z-9U7$KKfC{so%!tk_5Aj?G7KsjOlwxP=BU^769qVol`SN)LIr$aIBx9Lyg z^a=u8?BtW$xFgr8JN}g(<;RkHkx`s#1MD=1OmK53B5!`~*+J9L3%JYV=w?oW3%n!V7sC#`4*7=TB}?6=cfD^sZar z;BFwF-jXf_^2z<&@Y8}WC%wvN#rRmjn0dj(yo>~@Or5D#r_Fg-Mi5=UUwNOkZ&6V- zg#lUJ`ppPuCD>I~`9wJpZyj}`JgFv_g=;nM^l6C4_kM3gS*ymI7B63FE0>vltT(-d}!Yfd~ifPIB-UIh+rA_wl1IIslLolCr z|6nwSa~7;IT^(U3v}8(wT3hc096EX?o2ib0Cb|l^D$8qsEb4MX4Pm>FXgOS2HGFRl zr!1p8c580U#Kb+V?12b%jf>Z5spN!}9%1}wHnC|qO(%Q~rxxVic@T%T*CD(m&?v_l| z2tGp*dV-7cI?U%lGRM^B{qB9tS(s#J&JmbesnxP~dQ3}Y&Mgf>YYD=ZjNpNtvjeSH ziwatFLuz4(=SS;$EvY=#uosK!c(}|-Vn28>sorXNfBvJkf;W(>Wr2cq=Qw9Y=uaAB z5dnFR;K5zo^6L-P%?p8C zr;c8G7=!s-hq3XkMj1)oh4Z_O(ECnZI@X>|dM|j^S~y-TY}loQYgDDi#zA8mhjz)7 z-!J9hJWiRH#d6~*IGp<#1+S}GT~f{DdH7B8cs(hkyRq;_>VDiz>xUmDq6EfHP#cBg zaXSHyJRD894YPLyg|v8url8q4pd zA{5=)w??Chcg>`==K9{Xb!r8?P!g~Bh0UxrEmH*__MGU3Q<2Tag(B@l{vZ^Y(i{>Y zOe|6NeS%Nx(WHZ^zlP*lG5dM~)yBatG%YWxb6GmO^Sw)yRF=~-_gy6d}uN~ zI;l^wj&XQx@!obc|5=Jyw{;R%#5YvmkxA!{Q_rot)H1p?Ok#l;gV98yh*ml5$qWT< z?*cYuc%Yj2-^$S~h(^T=bgwqC94xJGXN=yvcI}5ByH?*09@vcPuU~i_oL6~SR$M4Q zfl2A7KkIGWpEgCd;CM6G%S78&4|a_;ewM>%w#Cc1cH)qKrTgaj22IqZpzV4+J2A|M7=PXx!+nPN@2!Mb zj`YhpZD)3!qw=ERX)o- zx@Dn{Lw-&0cH(C0#u6!th=DlI`3igngShX^Q3Jud*JcoTAdy9HE z8~%3=dDBWMsn9>Kg8fu_-Rj5x|9zy=ZG-K^zgHf1>5@Eb0K`idRYnsQeA|(KUy2R+rj%s;As(-GL_Wa|K3D@<#61iff;@+i)uSK zUH6Yl##rK^HqO;)72G5TojEu$|MTSEp9Ap_M7JgZy-7(yht2N&7pefYl^yDT=GDu! zL-ntmu)D`l|C!3a+hK;tSd06AB5}eORp6S?VUP)h7Zx&xS>D~-nq6Gcx0um_(25(JTXd(s5mOKn%WiP*pUhE9)BNrbls zJiuMr+S&@(`GQPHNa(OTgP)X?#F`|_MfPs-x;+1Eca};(fOw@RDmXbg*)_SOgyrb? zn1#WbGIQPH#}-+1s)m4)QYQ}N%+F8u&sOB8J54ohtAE?Ou8r zp{3!kuUu|VC!abLR-J!v+!##l$dyZu2J0&xM)1{fd*U&-6>)dO)8I)RZ<1gPlKQ!m zk0D=j0M^0Rkuq&r&;t7P?(6WMAH_wp1deQ<%^O6O8l*o$aK9f>2$Cyp?`u(fh(U{c z;41*9gzPJd|3cEB-4&OESDjE!wXZyhkmR-r3tMS4i!-TDnbdQmp&9)fW_Ng*XKL!u zhvSoz&R;pN4@VV*Dd^~aG~Y~TXk8Nz-?;P7Ej_C z-!FHD`vM(2KAs^qn$vLC!Fcil(Q>8|4vLG9Uk2;WW4ny#6FMREGoGmfS3y9}OZd=J z{I4NC!mrjXilSxM$E3SPSJ7lZypkq=%<90Aga`K(9w+a@{1v=oKkg^djH42q%gK90 z#J5OTih3`;4|h>(Bie|;OXBw~s`z@Ui{GV`TQD210go$Q30=XreynhnmtX6vYiO9H zO+i6KOq_iKCPT@_Hlk_a?C2aH`Ks^6WvSISBr-BcwV-Os zspAoMqDCf1R~YhuZ$pE7#QD_0?~ajg3S`FybkBrt4qjQzRzDKyBEf07J$pJSLjG4J zlmDiXyE-pK^6Y8@9wYa@WQ}(&nPPyHj0Ky@Dv?>$Apd8G0f@3Ra9XnZ&4_2HA$W9O zS#T46Ira3EThm}Gp^xjk)y^)jLWX)raCW}DxnHE?-5TFYnj{14y6gQedxo3 zS_f14%iPbc!fvS~BRgAt5sK1|$G*S0I2l#2-5R4a;UGHMna1UwcZeOQyl?YIDf7H` zN)d3yk;uaK^77gQcHbREW}Sxp@GT?Fd(W7O;bFyqz(BqEdPg3&6WSmQ5;RQAD54@B ziSWn1Ubk1jf3mc60-M%leLP&O#UD<@iN=>&Jki+q^Jkg;hWyS<6*@03FP3PAR)f=H z0T)*Am>%=njg1Y1@q86pI=V6*Fv#h_!9go97;FLpqlMypdgV87V$#wgcXllD@(9O5f*>OPGp)S*MWK3C-!d^#1Ts1yb0?vWhi_aQ9$53nlV7jbZ-HmLIGeRD^S<}e zY;?g6&HTG6941&`Rp1B-6Wr2&c9RFRR+^5Mf?YYz?3RoqE~{J8R#OWB-kq4o2AZCp zre$IZ1U}I1WYc#fOESxRvUq(e-RtVXqW67M*I|?Uc{gxuu;;ULb1AvG34!pBUl^j& z$RNHeXgitYD(vId;0Ep<#$JL$Nc=f z*$vR@nAB9u7!+t{stke5?PFnW=ssH&>E%`0@ZN#y|o3`9>rQRJ}P z`G8TY9xpI3kl^sM@Z^5WJt+uW8REYe)8^*pme$rj4EE@C!~DsydCk_b++Uad&ghq4j+JY|jf6}Whj`4g(f7XMfy&Elc->O0$BY?5 zANmE72uWiv0;894UEDo#ypPX5xk-{!X3}i;siIjThf7c~Yd4yV$mG8HCZEV_Zxo^C z?d=^-!cUNvmR1$%xLY+zDIhSnZf|UCoK;x((AU?Opva2enDQMH(e|lZn0^B=3qODV z0rv1m$O!Q)I#$f|K|w+KCz~S&$H(ks$J-?>>Ublwm8Sl{-w+|KrSdydGBBXOeEHI3 zvN%! z_38Gc2A&WCJUrIp$0mD|sQ|)_oHvw~Vm)~9V11(qCdi8qXf*OECSG1Sah%K#-#UXu z3)^Vk68D*rP36NcD=VvAiRAB}h3QS>{oVDtenW6DiW^WxrIf+m-d5vuPh{xe@UU%w zd(om>?!Saspcjd~MQXXz##)xQ9ohTv!(l3?#=mj(&S??ojps*O5(n z`zTy!gJP^C0PpzOaMfK_@*`ome!uASjHzf`?ATH-6N~oMn6Mfh&RF1K)ISm2|Gr(k zznfex3kyTn*Vi|*R9W8Ljqtu%A%g{}NHSq<1MmHXCTwEj@RJjV#;N(q+y?Mnqf! zI~H71!~IsJYiqn9CME`K^pv36iAkl^Jkgt6*_R+hGHS2fz;O4=CWN>(?1JjVzXTq zySTdg5;mpddHVU%b=a)RY}3PxOi#JBz)0NZ^1747T94|79e4rCXHwror5G;J z5l)UQQXlhLjgjnU3M?-#KiH`l5>-(F=m2aaHn3v}U0rf`1Oz2@^-wae3pkN3`-3Ha z%*=Ns+7SKBU}slXQjeg^LB^%0rka|`$i4S)#!DEW%cOBPGEj7Q0&I60lfdjvb-M%a>*Jkw4r{cqq#}OQpvJ3VO-C~ACU@7 z5pQp77>`smZkaF3^r!L@0;6xscvfn=t$cUsxyNA4I89{3g%Fvz@q zO_9?H^C7@UGZoT>00YofRI^|vozY&DPfodA@$&sZux zo-Y3CxIFi2ITaStg$riXw@&uvXB%5>ULDn_I5}01d-A1XR2U7EyB2CUxg~|IeRlSH zJGfBdR`cqW#tOg;$t;6v?h0U60RRnK$-kT1a%=hPc$ETUj$@lxK0nPAr`ZdRZo^3I zPs3coLzEZoGDVGfj(C(UmKJT+jK``XEF$w8O}tt;<3i?vFx?VM_6{2PLCJk%0oiCC zVi3H39^3KiVaR5-_iO7Y#51?&lxAPlJ=$)YulHW13wa*QJ1_qB#}tATN6eP9qJ;9R zq8gg2%*Oj}9M>|VySlmv*!Z1xO5Hq8yF_=3%&c5pT?vXf^3A2JRC+icKjezo-rf## z->XA0pD28(txYORgL}5W7AN2{zWGj4niu43%p%p>WGO)2;H;atUOG$$PwJOS((0 zzuIfR!UXK3r0F5jxlEQsL^}YN1MEG{dvhP*5Rfyx@9!`Mvdmik^kv$NPtS>Th0kxz z(yM3{j$!Ao|NisGbcFI-eSVlCm!T#%H+NV(&A19v(E0u%8B6m8<*(7vGV4X5u;#su zp>#-w7jn{Vw@G}*357=HNB1{fOWIon`Yidh+ntg`OH z%Y5`9)hOrct;;d4*oB45p=9oo5x3-$_Z8jx@vc3QB-mJ3AfNC@K*1O@p>W8_Ul7lv zl}QcTE}XHDJMmsHIkJ_y8ct>^LbInf8hyAq|6|64mRLZ#iW%Zg2Bv`m)MB zrPf5_Ki}P*w{W|}mo$O!HX~p@)zOjFO_}=cg_Q~b%(_jxHhq14{Y-ogd?c_87li(s zyX$=^d3gyVBXL1};HeWiOh1jszbq~;h8Z(U%ME;ne$4O#TpG2L$r5^y7Xn3wY3Clm zbwq>&gXzN7Y*dYnjl_h^nykWBvlFDaoXqJ!6T6Ut0mvK=`Cec2HLQ4toG`w4>vDFV z^3O^q3JJcq?=EpEE}J_@f#A1&bKEb^3a zeEkcg`(Z+hAfIyCZ#p;YRAFj0HZoE_@v`c*m9n5CY6eKZb>sIDx!~QP) z$Y-=LxyR1+ReDi)l%(%eEm#QPw-Ie((=~isyu`=GDrA!j;F(5-!^7NNo{TB=)??sA-KOo=YfyRJLHoIq(nLo4e;n7h}Oj-=DHiaT=9jCv8 zm|~8%1PERLn=F{4BLU+A<_`k|a1h8~ySNuU`~e;y#YcIg0ER0KfC~%&V-iikNgN;aU}EuOngc^2?=EIMmED< zEEBL?wKj0DcXWjj9=4;isNsb&5C$XCqfG)gQ!)~D15#oFLbTA(P(@A6hb$~CQgr45 z#-9&ClKq&=;xWjSE%r1>2nmCMwUG1hJO*hnAT*@p0-gyxIZ@Aq;i`E&&NDH69`rIG?kB%%+dX=dkGm_!?qCH#|Bzy7e%c z&s|oar^_VApfH$=x}bfO&9Wpo&%- zr0pQ@%LJ(d=brp@qboaLc6>53DPd#)$gw#03*3A&OG}5B>zJ9CIHMlCZA8iM2G~CX zWTi#wRid!G2;?sSX+u!+#WFfbZL)M)ycAXN0a4f6+v^h*g-Pmh(B{@641>X$@r)J= zGt8mNcU;tk=eLFFXu1V)YR0wM9@YCz({kot3mGz^qWBP(T%nS8vuy0`Unz~;(%HD=>zfq_*eS}%a2ib+Z)lYvsg%36Ysgp-p~>Z0+7$m{d{9zc4VN7SvwYuJp+ zal_@AlpKvnl8uL8i!OoWx)UsaDbObaz_f{l34o zxG1&92M(cBw+$X@g^}LfPp!uiNpwDgR8-sZRHYKk1aOof9DVE>QbX0VC4__KoMtT( zd2BPs*%+kh%0LcXz#dm%Hk$j0)MW|IUcoABBqTw{t8P%7Pf$SMU^6Q!6R>&^y_Zv! zX9)~*1OE1~6#;YX>WW0rjROQ045$?_Ooub(B_MowXbBv&B2+b70UF}q=6FcMLIVJC zr@c8-PHzfCqrsGqPpxXNY%(&P?Ym$yug4S= z6g+^6)^=UPFW9%vSiaV1bYZ)$#U1(le+4umi$ncq%ND}|bcaMx`cL9#3h?G{RW65$ zKUYLek}bS|QRJ7SC5CZWA#kfj5OdA5mqOVts*9Hwvli^H#8!D6xd*I_%ow&*7Pa4v z)RwbutgQHhO4ej13%8<@NV>4M5FkbMMqQ2j6ZJ-xGnLiU5?v>po&i5}bDVxJ20n_r zC&?@B z^^iF0-rZbo0*6t=*4*3-d->s<{m^?n`T4oIgDHckm)}Omua37yvQS_ngPf}Lj=f;t zSjo}7M7xRAcDa*iqtHX!@=4aO{v>wWS<9O7nTBSdsQ?tP5zcNC&CZw?Hm_`5rET+9 z+ofmHCW4g!?oGE$K?zSbP2dSg-K(dx!DZY`6Z?JP78-8$bQd`6#03DRh_e`YlG@v| zS!}G~9qWH;=w_v*uF?n&NiY8>Q(`2%vsh%wPTAd1#fl~+yKEhQ3)+1iJ+so z67m|{&5x$=2}jU%_ny5!42-`2*!ytid&6~8T14t|Z0zyku6~;YWyVJyB$m^70r00s_NT z=I<)47n>zCot(JjQ~3e`=L0LJf&{v%TLn}&IzHk)S5#9&1;qi7FJ^(rc*@+Uo&ZqY zZ?IFe^z?oS34}Mdx3Iy@UpD1~QW!D6)5CvD54yU#5%8?g>gwuPVg%;f{($qNqw*_Q zF(j{y)>vLX^70Z;Ag_SJfw|a#nxlHy7*RxSw|>cIfKhE$d$D0f1X0w2p`5BReDSg? zqP%_2_p|1O`Cy)54bu5XXJ=eGjKHx!S4b06RVAoYX9B$9BQmmdqJ3Q8A6;BslL!}! z20_U=KVQAlEWdAZax&9fSn;qig~t{iq-X~xCt`rff>i#K|2C`joz>RW+Yr=a=FE6#xgEOcn>u19NLhP(^+3cn)ZsO}kM zc?rRrf2#Msu+n*^k>2KReJA#hJ;<^mK~d!7Ds(Nc8sx#LiG)X zT(r8ebj*H^<&oj6r&;gJg@ok6gYq=ETs`8q8_%SO~2-%@=0!uaVe)B}nGZP;i3Y3etZ^89ozyj@@FrU%WC+nDt_L z{cauBPtkiRF{p6H%#DAhn3EfZcaVT{hqhEA^Bo`SQhDi9^fD&JYTF>8pn}Dejr%-0 zvlbg&yTOD26##P`6CpndTaTNqknZP?&P21C${UC__q zwRgxV%{2dM9N>J(EgT`%vw;?4J6C0aXb*iySD}Xi%3!V>E6Z4}vgvgb@J+0Max6k9z0D7}`8q2?CBTCEHq+2`x+1FqW1x z?GV$`hw>F2`C*Kg_^QL-;{O>p2Ory8G+r&yIkb!x68RYPC3lK7qu7R@!B4D*=xbA6 z2K8%M)eJwYUH2XF-Lnj206OliF6i&KAFx%p7_zDoR@YW1MXjanCG@qMz*s zs+f3+&0-x!vps|fw3z$u)=st^quD{BA#%hN&pttjoJ*zb`Sdi#g(($7@}{5=%!vp2 zLeZ%|7u{hR1g=Qd7cbfb1-SHHrj2Zb#2pEu5Q64Tba-b5WzdTkTgyhtr)T4d5+M0J z0$TAA~#km6nmnfhFY@isZMg?A$dp!|F!4zrV+5Hwj1D(;e^(s;B=&> z$_r{zcgE5(Pe0{iIlMZU$__>{6o4Wg^=QW_&t*qNxi#xA3vePmv9@@Zre z;5+<4(YeA!oarkj>LU9|Dk?qJ@Ej3T5wHm6{%x_@(N){YH<$Zx^ah$|Svk-_T9s5* z;@U!py!Y!08xO)@HEmO_xxv~0s;rdzKsN|+hRX(Z)(jbkf39z}lH{Y3>!X1fV(H!! z{0n0j*=1?C#)zwZbw$KgdMyWKU#~7=4dWi5#Hat;CNo3qW7Q}w={5GL=3ZJT4(`ZP zyz6M}v(le;UpnGz2#Mf4P?j3D4VFor@U6UqJ8_{aoj+4XIAj-fgkqNO%Z8^+3_fY) z^hh$JN6GOpWnVz2i*R3kqxU8IH9QSw`sx;WDTP6IOr+p{5)vtiIV@WOp*qg=8_>wL z6Z=X=dL+fUB+8oV=MT$1T-Ekso*dd2`zFk_p!nZfNQ2UOs`63t19WR{9JWc|Yb8jcXH zp;L%BBeQf27Tkj*nh0B|;u&y7fl%W;TP_P}ZK^ZMUr$J3AAn_^l8Oi*jrC?zfm;Dh z1gXfjoBuN>>4+Q2tD`(zCxw2A-{;gA`1ClC<{RUT&I%yt5HAgbUED$9I091KF66QG zh`_EuqbDQT2^7q&?)yVRzL1HdvYC&yT0J+4#B}^$H`>5psrzJAJk0>jl%fS8{6{3$ zw2owD&^HYWUiF{*D6lTt-Qrx*y3XS11iki1r9Pnfygo&K&GuV){m0~PIzG12F*PJ2 zQ-|G(_xzvkxOkq9)R4R{E^l-S12#{@hCIRrocFVugw>Mz@1d&Ofma@gPrf-`U5(k z8MO;@yCeruI?dNDaej`fiU}=u7WTgU^-j#nuXP^U@=ld$d@5uu7jjzxlt}x3W>Npp zf1_lNo_w*8MIKck6=2OwDmybqa10{~&IK38{3KOjZgQ0cPcdtxN4yw2y1EkM2q*N5 zho@}HxA|BYEcyS2Qja|%fcERN3^mm?SJ5$~^J4z2Y%p$p+TbM&BP zb4_8*45`#JRk?!(!U5EO-~ez&kFvwG+2L?Tw;q0)QVRWrgdy_-BVexdw^M9I1-UU+ zIbH%K+|GAlJZF&e=FSKLrpCzcKP8PNX<1qC;S$IR(V~YQ?r#;=hCk;X_!hdL>p!wnn;nAZ>sP7g`I3$Eo zTBCdWPoA_A#QIYCq2;f=!8if4Uk)P$ROGDLk7W@n5wDSF&%gcKpgC44{dG=b!)s|5V1lg3zTjT$zowwv#R!R? z1~?raz1^-u2nfmhV1NlTdf4?;lMHu*&gZ*hz~dbCvoEmsWoR)NlO>1>y|>QjGf}4%ia)|D3wT66L%V{F0?*3!c7Qci*N3O0L+d;vW))W`kGePn;ttw|6h)#m1D& z{x+I|ZndkJ?b1D0^hKC(ABB=5W4e_=C^^!M??HbO>L)h&*GEW#*- z9X*xIJ<^h_790Fyd^YP-6O1k10-7Qexinc8xHyFR*tSs0|Uh;y!%7@`%8G z2mq&FaQ-Lj76nB~k%6;mo&MZLsbR<$$g>C6Jg{{SsK1z+MLSQAAsCwDzn0oShhr27 zRs3dk^=(K9DnxxXUUojbcQN%McujN+4_Gf69cdAZEF1wZB?)C_uIP41Eb&l(NBl`v zBo98eitRin3D!tUSjDJ`9hZf0$T8ugL3#hpeEai($+iLUl^u>R5#Ec!$g}5Z9(L`~ zq$Pa(gp`!<&`EjoYhoKsA~88hvzwIN`l(Jba<)0MXuK7wz4xOmmX{XI3L%^M8Avv8 zJ}prR$@B7d^bL@C&5`}*-Vxb+!?q@ZduS=z?|R@>N!wK0Jc%uRX2CCTj;G9_BWh4S z>-{h-yfx$Mm7v&J<<96lkHaTURG6KDR7$>)Kr}q2^|8VFkKdv2)>0xfHkDYEJ$rOG zoO;Sj;uK}yBeA%}M zUM^MfWfnhZd43plvNrWQ5A@`x`2KZ-z;4Y(kcV{URo>9-u^XkOpl767M(A67qn}xp zAc@X<@}e#jQ7*{?!zXy0TxISNOg)*Nx-0zCqpcK{-SFHrgqeo!y+$!HuBZS;MylXo z7AY?^79I`^!D4po}yDSL*<#M5N!Uj9-=ZnNd$*j|`rf*Jey72Dj&H}q+1ZsB+zye;+BphRkcO7+&;(Nhj)~fW?r-BdqG$OE*2C^{F8IVp zx)l}26qIHdf0G)eu}MT525K=X%ycG-a>P|r5kmwXl)O4D%6FrEf(0={;$w_C#o@9e zUDT=YSSFlOp{CG+vzoG)7)I`R7mciD`Bv~S(kRN;h^SL84d6xquSN5IL`O~Lt1YbY zUT(psVZz1LJuxj#kqmjsE3iWvLV>&V$GdnhGvI3%x3fq>mb{4i9jD4hR3_=5O@}F^ zFhKXy-d97++vJ)A9#%F=%HR>vP|TV=zV*?W9um;^>*OQ^dl9&}M#W2#ps(GpQMcL6 zwiD2MhXNIweXth4F{OJJkKj<(_ep(kWC^I$wn1qO_-ZKN6Y1y0iiLdnE%yKl zEC)3?Sq(w;kwp#|_v1(G=4AyZDT2+EyknZ{<)cyr{K24RFO<(yCBRIa1be{AoI`KM z+R4(5^9mPJxi7FkD{ITjR9*85xgDyy)K-;Wy8=4kefF?;$$M0lX5`i!yv~Zq43}%%kesT=S^C95p=T#Nv4zRCF8%Q5}igP-XzP*bIgT_(*ZVDEki^bI`P5?aEK>GoQ%v7wbj}&08y-y8i}7C90iaxjX`pLH2VNc3AY{So)*UO^WddI z7Rq|QKLE77Ub2U@xdM{O4=obH(mL3e*C$k#s3=izlr0L_MV9$cazw>eS((b02A}MS zjm6PEQsegv$x~Kal!wRz-?rGoka}cpnEV&ykaM`Ha>WT#3Rd+N%A-0MH#*JFOxo~l&-=L6XgXWhV0baW>W48@e==jO{G!R) zgIeApMe7G_SI*lyuk(;|Qku~|a(Y>0(DD|AhY`e56eTDH*$14=lb6pqEcHad=6pu< z$QTUW@c<67`h0C`3>@5eLKMq^CTayODSKDS9yu~RZs1Sra>~q=Y4LEP@ewV6OZg4_ zZM6O;{r>hp{^$K^V~f*u97K<1xnaxIU{V0rcyhl`h} z4}E6>w8hXUP1i|z8``@;97Bk$#Y?fpSR1BHsJQ~LO9*j>xIB_EfK6X;s_S6jubdeK z^@3{RbhvU2!LRuNA<}@Q2zrG>l_^1?LR@U#f;KX*1e`ptXqYC)=Po9*&}_s|8JW~n zi7ch@(9hO=eJXfFJNKTh?zNe9@^~BKB4(lCA86v@lTyGfv~2N7EzIVcTYeQ0}k3?60H)8}l@>_h=SHSU54s7I1#%g1FWWbqgnLK~uJzka+MI+ju}8+q1^8@pqZ4&>QhYQ&5s;md z!7z1%?6Ry@1ODG|`TDp}dmK){>dk+>0I#yjbiSp`-Qa)&k2<=^AoFl%TGdo7J~|G` z3v766wEWhM(yT0KzJYJbu)X|>>Vu}b$C!S@b1^X|J)A95arOITsd88#mJMU9ovm{3 z(5cwK7hk$sfO8VS#=iBUCq(L!F#cxSMO_j!z_GySa)KoOZm% zX?j6<8ifx`{e!8k{RH0$n6wj@r(5}Y_>XAB43$)09DW(`Kkz+<;$mlt%s&Tf+lz{$ z$^Y6L7O*#~lId)S{N7ApJ%4YTzLKcX_5b6iZ!q014Kev>P(t|bSW_h-m$*% zuI$wwRO~8RY_^Yrh^5(StWzww8no(qA)3Kay(BE`=_JZ$3-k6o z1*5^UUiMDR5#4FtpC{_dxv-U(0#eoc4vt|4_J!&}BT{Qq@ng7~bg#>lCJdR6Av-K3 z#i>N&S^il#6qM!MNZz-vzE$@B1?%dx4O&QsU9jZ)3!#?7FAj)%0=Jr}X!IjDNem`7 zZxAB$M3qiKj3#wdhRA4c&oB|Ujh2FlvMs8 z^t3n|DN8FzNlB5PXlFk^i9~|K9}`E!_HVkKsA8xuuHUXF(9A(a>_iSNcF3twMEHs; z3T~!qQh33>ao$56`{Yv+b++Hev4DW#dW!pg-8s#h1^Yqw^-^8muS!JEq?NN2@yabD z2ysMjuy6=Sb6R=*u{Ht}pPuHlfiWCyUL(&vrLRSL;pz6quYgpCpT=WLjO%Qn_^T`8a5jB z{KLw6zvm)lRkWFkcx&IQ%#C}yx~TuCQi~}Gda`W=W+Y$*y?fQ(uHdH@q20o$Ki$}W zHB|>h@l@n=L?9CNN3K~7QI`Jn^#v$JS1-ysm({gEo z7j|L8@tcfk=4-otG8kn|A3kiD(=jraxfJI}qVI5Y-*Nb3WgD()#PLs=9ymFhRdU@; z|7a2VE81QEPT(!$S1iMKHWSrL(W-T z;>|x;KTpV*rg7PA$cN+#m%%h*zqq~4*oWeXxiq@b&8_}42bmJ3_Vq8OfwA|+?ZcH! zG1SueRN}71U(gnJb@;AjS2!fhFhtjbTe4bHbDsxHx#|9(D&f|PEhNGrxQmeas&Q%H zuSh_m`Qmyz*J5-)n$9BJ-zPCrUHF5P+6AR}iMwR(ml*2rbaP+e&XM2FQwI9GS4w>2 zw&A6FYH7OijcjLeJU!(`Uq7~-?$=iSqDcLpQO7v>fyoHP~U5xv{1iqSlMudigb&Tj9)yb z8jG<)3B(vOstzAKt3TAxWDgZ#Ab)&-tjK!7Z5d{ze45bFM6-kMLQu8t8-4kkMVv9M zBEJlSQTh{NjY+GPX* zh@@UQrCzu<*f0ytkJ-LcdpqMJS)dbnX7>MR`pU4Xx~^RW1*Abbr5i+~8wC`RF6r*> z?vR%55TvEqba!`mcXx9p&-K!RP*Ich3LWOt*bVt^MGanWv%)vIP(++m3OhRQ; zMRn)9*CU6Bnn3xcsq7ZfV)grb*Y~Hh60F)gv3TnD3qxj7cYKl(Ffvy3jzS$>iIkv5abp|QZl#KA-l6;^#S z2QS2tQLI_+j{XlRk%V8Jd_vnben7l<{Ry0FlP@rRZ_w1|ZfZH~RV@&N!%^b;DE@Aq zE#x-CoOq(5Y%R&CC)bF`R!j=Idm-PtTy#GF=y?A+!o4QQ)_ND&Athj>YdG~7TY|Er z)GvtHZFyqQ7+c)lCHQ-&_da&GL!SJPahAs^@^&aE+g*z)lCVPgC9a+jlBHBpaZ z1}fbFa8Gd5KWT@gVv!P;Du}^vu6LP4$Uol&x^HJOG0xIvQ2%CJfk7&`H2G|tDXDLz zSa=wSNUEWPX&sm<2@$wBRe%9^A!m`BE2*DRhs?0-JG%aSjrE4TEbN1c7%J)uEP$Pm z$!ADF@mlVz_|)6&M4&pGZGMJ}A6jzwd=GB7f;VBAvZ4*wGd-H3i&N~C`2=#B8}|@! z8!qN!zOjGz#$ex9w8&(S>J!2Kb@$2fF$#3)1EhXuZmRy* zyb^(e4hoaI6VIomBqiC$@?1UIE-lwg>7Z3O96k&~#T2*)yL;C3lHsYkR2($35j-ES z%7QD(Z(9zGxJ5AGagX;6-4|?EM``}+Z~7kJ=RjFN7P8Ybe-)9Qw=ajBM7RdNLEOOS zilSh{9rPAK%?*1JUr=ku$>wH(mnlP2B{!Q^?#_$2V(a3Xx^fCzq_W+F$=kQN$uaY^ z9hEj@re65^5+Ej0Xz8p=28Zc=ECnOejVxq86RUEebjSgm8#>ZPWR(gn7`Q!H3B?OkgHZ#^2EeDeVzu7^l&!-9sDXp4&WT?2K z>7i_Cl#**L8c#%li20)I1h1%LV(zllGv5vnJ&?6Pk~KuH>qXm!EjTI~81>nBTd4v=ID|OvZFNK4hD- z?fb|lA$QX6UVDTqHmvlQ*mQSwKp>q^_q;|GMMGyW+*YkF$-niz(fan#Vml9uyB$Yz z{+r^zTcvL8-^e7Xqm-0=qJ0A_%-s{X%Mo?&;imh|d~RY06)pJ&S1Z2#-Nww6#dKRp z#Tyw+Hzuzi;hX8+t3uCxcWb=uEU8{6>JeGyzBmuj>noKEB^nvZbkFAIJAa1E>fGnI z^RPNA8%`aEY~`wN2YnxE)k3SZJZzmR_uQ$l+-qxnnF-O^S=;^L!YxHO)7wCfO%y`C(;yQ`o3vY9MI>QD7Jw`?7i2 zAx;3LJBhe(k}mGy5Jgf=VlyN?0>hosx7fV#=Urba@|?wgftDiwc8A41tP#z>iXRFA z(p6eFicc}gBZ4j!`&hHyvc~0VridL7MiWe65~-T3>o=gu^0w>@QQDqH6HyQfY#4{a ziGbVtW|s?LXZ0}2Ta^f%yVUUecBS^?K%oCy7fv(S$GGO^wmE&?Aj}BG^+qMcCOi0-gNcE+NNPhHMsl~> z&A1G^TD8~y=7t%+s;yrSBCXrW%?_RKQ9aqZv+JyexIGr)6qd357tvfaywop zD*OBW1_S@19IxgMqlt7ol{32fn(ZUI8Q#bQM4d-}0G zP6z%(-R(58_H+*9Cs}E!wP~j5+QhPUuFZnjZbkw)r9z!rRGaig?>f!LL zcLK=;PvQGwgPOmQgipFx`wuv=#nvFa;9}=hBitP= zrd)@ERLqts6uReb{^7tqv38{Tt7MuJw&PQgl`8W113jM8K3|8*diaX5mbEfVBvqdv z^Xo9vC%&VRx#)XQrAEoN-tWc_mFK+i7!@Djg?KzsbHWcKO0JqX+$5(cayC!*mk__G zOHk5Fg@7XpMS>&j0{hY0$~A@XUvm*LPx`=?Z~QOGp1-Bafw{@#kKEO3X_4wD=j9Is zwNXj!*Pba5r=zE`MdSIt)S^J9vP~@p+QeI<2|AZ5%ic%b`f;X~tT7hPSzGTN`os=O z!{jto$Svj(6ACBK-06Tj4AeT?0--jS^g&tuJ-7rE&3Jo95qt9#5a^d{?(4!OV3Nsn zW^C6Gdhu@IUwNc4;x2Lg>ix{4pn?f$!t>MG|Dz0+fRd7&1R^f-JDorm?lr4}pjGxP zTVZwD)*gg+d|gme37pt(dUgoQ7JNU1RhX(#cU#CEuWFy9!Ts#XF64#qt9g{D#t9o0 zny#5kfwShgu(pi7FWbQE?t*Ra3xXI7AWh`eAAe;>Fu=u4Z{dF4DoF^Hp3)9gB~(Cb zM)b!HmOetKAxCz(T>356{FbpF8Rb_jjS*U3N5NGteET*{!MFE0N(%gTN99nB($6S2 z(6{hYS-(l81F}vSweCZzCw8WaQ~$tu5JI%Jhbh0EN+CGG&6n_CVFna@?_6p8{)4_m8oJ7tVzU#1~fQb5cr?gxQcWhDTr+5cp;wypX zhPVBG#MtvG;f-CYn#V%99B3Q+UEf&)M?f-BIDMx45+lghXG@>S_~vh|u1|(I>=-lO zeRMXw)v$AcIfUVLa<~(8sk98zuzXKP6~;VGM9xncXkX9tp~lrT;QH-H^ZUc&+#ju1 zGLLf~uZQ?6Eq29C3|=iiSrD2xtt%5Q9Z7<-{T}MzaN4hyRw8Oy zo{t@UoLkw@61$&byB{ED3r&G$^nBFeG1Mvf$(x=K*S$Mq`cU)8unt?bKKb(xJ4}~C zFXPDBn5U!i>ycL=$YOv?Gh%-DbW~1vXDo-z@aA*}b37Cc$~?bGw#9wBj8i9?&Zpx~ zBXl8BP06fB`0zAwtJV|&etJ}U@%rfi?tGErwruM1mFW2?Y9IqQ{3|B)K^;qZ=zjK; zm9W`%+y(NMOf^e1x0}INA-1qz#fR4=4%nuSIJ-?z13y}5@yPvjaX^2bCoq?3wxkwl zy4%Ec&B91c)w>yWDK{hd)QEn(y1t1?5$`5gAoqIN zBP@eA8WVNdg(9VVY=vGp0?S?c75DN@CGFc$$`y}<&(02nMXGb+i>~Wu2;Xn!<9UA7 z8Qnha*x0bUN~&qEKjHE_=~Q+eUo7Rl4q2WAXI{m*_T;LZFK0+5R(vZWp5hxc_bURg zVef0Nhq)uc)(>NfwSu!&x<8_meD%^Fs&*8Ppx`f0@0OnPxafJs{mRw6M7>K;Uv~^L z57+YDBu-l9SJtHp3QW|Mc*{Vce<%LQ!)c~aj_^75)%DB8K*DReD;nEZ+~-w4lDFK7 zYc>pvj!||IdA_L+0`&5mQv<&A9C@ieSvYs%yPEvE zf<;aSt5>=bVqNw5>L14^F%?D9!m1RVyM*Ey<4|&Re=pQ#E-eID&)YEyxj-*fM7Sqn z_NZA;&Ef3Apa14;f_vM!mq%!>!LDE-ZtqPS)=cnHnq`3kM>W%yfH|j8hmb)#t%;Jg z`d7(xI@C(lkVgX!``D*omYL<$X+zZPuZ6nZpqs~>b2v!Gl0`jCCg`{;uR8viO=MTe zcgK4+E|O&s@9YPI=rQbh2hQWJrN+^kSwu)hW9I<0BMuz28y#FM;lTv9x2TABr)Pa? zxVJ{^o&^_Xe{Z?q$olx*OOcsV{-pkRyVm)3KA@Q5b7f| zU#)ms^Em;;GN=43vK|EC=#5Y}4*^Wm(b2WdEj@Jk{l(V!h%{o|yVSc1(>}r@SW>6W zexj71#sHP<54sW@q8H}AS-t^&6Kaa)TtC1`pAT2-8t;t6AqGttB>Q)e+c3?PVh>$6 z%+1Tj^L_P>qcO(!}T?p`{IMqgki-0c`Wb3bl)2zc^ES1e(JH;dgL%I{$s+ zGhW{oEmQ1H%X7xM8X?mwsA| zF&pQr=;fccTY73KCRZK`a@>vH&#ECvR&sAB4}1C2y5SE@TJ%^TkG=eBke9PV+-%N&xX+w`qWH0NuqK5 zoW=FDGa8cFG!nFkRaDvAwv=qSQ|990!_;TO2wF&6F6xd*A95&ZP}h>+7ODwDv;R&c zROwIs)lgvS;o1(@@H+K~g-a|LtItXo`Ovt~Qv50><6(2-Kzx(K#ICtY0d~HX(*?U_ zayHGFoNgH3%5=45BC_jJYfa9E)4I&VurYQR*UDz(gQd-~_-6ZkW$XN+Q#wl8w*q;K zqevdtel1tlGOjfY8J4c_lO0RxjPw z>`Z?}64uIX+W%?9_jT*FN~I`cOTOCs0ZR z1~CrCGQ7ay6>osTGRa6&u=Ac1Cw^$SK6H7S3dLghJ|aR#x*Dpk@^mZwHwwe;JQ0Ae zbU(m9-J1Iu$3R4jGHrk3kl$Ca92REO#88$j2+hRI!|%=}MOH&rV*`b2EJLj~JVh-c zJMW008o6&i0z5EvkoyTF35F7&Q2F^8#lfWR%{|D0I(OV4nJ0s)(YM#*y3UuY(!`C0 zWP^PLgVaAt9uc=t43{>VE&#wte5iW1qwapw{U8HHVYpFY<~|Xo=|=Cd;1M^j&&r;b z%>T>qh(K^z(!=ixVI%hEpB%h*1Xr3Aw2eB_Io0*=eCyyws$x&;mGXxKzYb6Rb3Z0t zO5;hX-bTrl`nl4`TA?RuI>}nBJ2(N%$o_CZN=x(P6uJq z3DMXN_mJ(hhSRNYKYlQOaG&AG^IK9}Bp}ryghEg)K=2V|NWJ9wjgTQ5bZXD10feQf zD+n2)&$^rV!D!NI)9YWu$aQ+jO(#u03#@#F#D=-#fA6d#9-p2#ra=ekY^6o7m+R-c zNG%Up7vk-8RwwgQK>WdgSm$=qu_KE3wO~?Vd294>KFNdMwN^)3SkEqace`~uo0+fyxfW}l~ZFP8UhGz(Vi+Mh<4qN>No+pL>|+qXzZ8l&NP<>sk` zpRk9M_i=ahO?2f$FIy@h^Z7I@>)M22rsj5sVWkek-^DLeLO7OuM>M<@eM5Ec6c$)j zw-r=fd_NqPD7h}vjR(^pypB_sJ9pK<3PY;m2u`|qek`A#iCo*=GuqQ*%~hnmIMyLl zC}PZCbj&^zERP6e9T&CBmtTSuagg^xcY*Ag(WZP_LDq#oS2wKn3Ekb7j*;pgjXam{ zjwm6odu$An?ubKI!jZz0JJOyadfrr=q8-{(!#=MtE)QMdUeB48y`IC*Tq7M7Vz^;7 z$Xqyx;G;v$HZD0qzH`YQO$omhd|3+;6W_Uxb(NfDyl)gb*(cV8)9w~z7ENqqibXuc z`U=X$SIW)LWOHM8_ry%Eb7m1iZmf`lpTyN#V-VN+e#VpTk8Eu%I4(lEo9^ZLM9llj zSU#&i7BIn*xnX)0tJjwUCtONu>MK#`ZZGCnmIU)_My1E7Gs+!evoOJGzGqZanC>DL za=v*kUt|_v!_dH5*Y4?vK$UIT?+a62mL5R0QFfwa*mT~!3hH^u?Ti4YbTc<`7%FQH+=3EaN%)%MOZ%K|y4ben zG<@IOLS4SJkFfhVr3M4RH!ucg{<2lfxIENCp#QmDFfat!lwm!Z@%*S^}t3 zV%jyNEW;p|&VyR651ZP2b5o}Rrek^D->*__Tqg&jKDQM)D-h8TLSn`*EKWvf%c|oF$+}}y-r(kQrktGcYZt#@n$puzY-MA@Tn5iA2W@@~sej}sDXYfwl&wsYV9+C=uJ@zAVO#jBr_ z2ROFiIM9W`Gdn)dSmdCT_aI`~5Ae_p-a128E@wZF?jmEeI)tZkIA~oNEsvQnouj+Y zCyaFw@}x@`l@#!h9u_SKoZl-hlFdOz+j@)pwskRBducxm1tf6J+&!jzs)5PXEs;@H z>$|PFa3SC#j!zkcln*6?jju2i1E9PB(IR0`{>AILVk^4m*1rJiA~aCp;o%LyH8zmU z5uv2%9y?j6ROpW;1%;}mmU7bUb#xczud-`ys^=w*1V@lFE3122K3pGFWKR#BA}_rA z>dVwQX$q8|Ptk6dzCPV{9q~X$o*L#lvw3SVv*CoxAauSncZGxKTSV*uK(40b2trt4 z{k4XE-_lDFsqx+mgpC4j%0e9`}Wp7h6Jnrc*G1s_Nz$cj*Wg-Vb0 z$cR)p+{G2eT#=b1uQqUErH!x!8H+b*l+H8K({ov+md2a=T(+{-2IV>?*k@$^v03a- zwOu(JF?A94`Ev+a)$|;=By4*$rA7O~y7I75X1fIMoi^;*3}^4L=_S#tj+G-w(2A=# ztD@#qBc6OHvXz$mHcf|Zk7Bf|14(oKeQVNlRj#=75`J7jMyiMitMg(=hcciK(aozaAF?4ZYopoJbA!c$AZztf|zJ`WX?|IUMPHk z9rwr3D)JG0D~$&4XB?a^zJo;5b*&2#%0I1CjTN?@RU+JefuXel$Y>gGDr3@w&G3QH zZ#%%xKbN*kB*R?R??&sS;bhTX9Y-+guK)+K7F<_LOHrn_uPOxb6CHxtAruR+ii#j@jbHDU4H%GAfkjaCduRAl22s zsvOL4$;BolWKE5WVgBCw?`}U_Z6Yd~$(&}80T zUs;jPecZXcd!YOt_vsqPEyT;U7Bry6z{BeWEufrtv*W*h|Gp1x2FtDm{PDGB>%{C= z>aq;Md!F8?`J=QxBEs4!f{FO}*h{M|QCy00WqC3Ni2jMNsmh2G?^lXbUb8@D@7coy z45@FK2*!jtNJ}c1g)!=?(5^&EY7CU&xoHZ~(CtM9TB@1I0%5GxxR%~1O_>qDT@3&aBAwoi(O zFQBIT2lBt_t{Gz^eUxI0PKXN${NC>(P}Mx^oU6AnO_wU8^<8PG+wgasg4fb}Y1N-j zrzS3G`5w00hev(@?gX`p9zm8@^nmPh471%&5`gsls35`^GZAQ0EH4Uztx^5=MtZq~ zGTgvzLOVs??Bl;IEvuyucX|N(dCuABT$#_E>AYkxol3eG{;Sk%s${Nyu)N_ zmYgb^0D|zyP!lVNfph0&Ph!QY9VZGijpz&@`bfp{hhz)VQnkJZz7xew$?2SDlvxrHQ}^ z`a!Q|ZT-V-rhkZ}6BBtWQ}M=;o_z%ea|@c3G@_(|QD^jEeXG-jXOd841e&Jovwoki zif}KbE8&HgO7<^)+-af@GWnkr!WsIQ<%vvJ^?KmckPsrEnUmsC)2b&>jri#czjJJ? zL~%XCBO^M#JE=A)a2VS|5O|$t5$XWA>-}2FZGH|tt3syqYZx~*XU8RYc{=|EXvPwz zIpau`PPP8>H$1GiAtS22q#EPszPE~^u}54oWxv&`tN3%$2Vtb)Bq^tMa3PbqStYd6 zO{^c6Od8>q?)(8WI$VB9O$U)uE!h4Y`v#U-t@p#GMaeh8qWpXX1o!?iMnbN1GnS9D z3rFi%`S1458{~uA%u~a<1>U(18le5CbH1tJNrWEXGG(0zR5WmIm;3n75hGhqF-AR| ze5rK^7rrsFQfiAfyI6m6S?8aE@lSS`+?p?j6}GD`4)_q`i^d{09I#t+Ott7QrEF!^ zT`d)-`ubhw{>*($M_0&Wq-^P)+-fFBeP!Lag#qt`S3~oV4bi9>nxIP;+IF5ISA+&c4CF3;#oz%Bplg0nQY5E(f1B4$hIO(-bX)5G7+g>|v< z$f?b1C?Yh^P||)kI>%8zbKW?HGbU>OBCC3pK~sW~*4)4&_)-UaCPqwu+jn+W=i*Jf zInZlK%!DSbab?$|OTTpmv?_3D0KiJ4i(RB@DKcxWRy1fg3zIg(%SR7;fgRp{>^s9J2oEj_2tg&;2 zTY&Q9L>_FOA%4F(LS1Lzg5zN$zf%lFJ0L#z9O2Lf^#Fj+By7=!r9Z6SCM7qkyZQ%v z?FLdKPdjquH6|?NIw%1^3g}1S?v`NmlXbYN_9BMi+e}Sz`Zu|ku&r$nu~)h+`$yUe zxuJRVs1@>fKb@<_=O;Scv+AL{T+bmt;Xc>Cpx*WCgiwtuuHLs~*U&WecVex` zfV(G*?eel#8Cs#USRAA?05!>;P{T7UDT~Rx!HSNc(X*$kQ9#+@`0$g-xU0B3fRFUW z^X+-LvzM+^iCp2}#IeM{uY=S@quFwO$TMg)V&&k_wCV}_33o$`4Tz7VfAF{4?N5b) zR&c8;(s2Q@zovHMQDjtNOwHfnSvC6;K7o$EJCo#IaxH?LEls~mWAT6@0te`t#xI54 zp*!qW%3n=(_=XS%!N4byJV}04c8bgV#RDZ>!%V@z%SvI^Ne{)KtTkeMfeMA=Z4umO zMMYtzuLk~Gun-Lai-Wj%8T01l{`}vrlaIeq?d0E1CW3@R&6O}1(|;0rb6F6mtbYvx z;zdoiDb;GE;cW`kfpm=i73T)XAGY86u41kr;x_9cEFru_lp;P;z6rf+&XjGJ^ZOjM zDuWhSke?@-?Z)PQmxN#P=KZ%Q`J<_WMDv!FxIC&rS5S!Iy!#l$hA3+};~9xk#J7vN z;V)XG0}6K!0k_124hcXpb@mSiu{_R=vCVXU+H-ANxpHfKdJV`vPtCH3nZj8+gfp^g z!TzV{paXt%DSAsB*^g(v%naJor%rbc7Zvc(zSbKTfZ61|YZc82-w91OM2z|v>OKFr zJcb_i$DaSbz4MT!2Te>j|H9Wu#qM_`=Gs$#(=PT_LeRQCv4WB@2tb4Ce^Q+;S4Rly z;$EN(^6e;q`?&iYt>i+LidI$lw*-09{IC!u)qV9(RRJ{Bwn2X3YZ23wgS~X)cx%wz4EZw^P z0Q8Pg>!mmo7FjVJ4x%^uZf|G4?k@MYr{?D*MTVQ9k=P4U4e(D)u9SB1TE06zP@QyE^wphH1l{KE;`PTPw7VQSx~cr4iikgZ-`WqM_Pd7t`n3t(JMHJrZzmvllB6@bw(~CwJhAO~!!!O%m&>a6l$|Ox_?wV$c zZ%P#%BqAlcb)I$xstXKz7RZ=S-uBwqto;I~t8rU~!{r@!h9d0(TP3-G8BhP|j{KD< z<%b5T&3#2s20{*m$4%AL?GMJHjXGymZ&pf=cv%});dp;It-9*ck+({rf8Um{?9pum zeI6x2mk4`tg{(=F)Vx4D4im`SH+Y%c$2|E0?&Ef?4-@^jG{Lglj}zVeerWbhRF|XS zcXJVFnf!CImfLdErm9lr*03f`H&Mu&=`00^HJ~ANEa;jYSz$OFCt%-KeV-Rg6fk&O zed$gvX1SpAA~3{*Xc-C|PSyls#lZOqGrz~Jq0*ubR+gg^S0qyXxcrGx1|A{i45|ub z30v)v%-d8*srCPwTO}WrUSE3~MX*fD`emXmagRIC&Oul&rjK=&*Tk}5hgG@cvvHS1 zWJI+d?zzL;JW-g^9^HF%SNUX&-ezE6Ar=#>+(;j-7%E1{2Y=U;!_?d_ff2h13a6!W%yhm32@(Q@%(H zsVcQ*i6y%=SoyG_mo)WL-d->Ia z;qF9p%(VPHQqhoQ?WfFpGjRc6l2NW7$NlYMKFYKOgn7=<_bQdS_TM=SBoA7f6~$hp zQ;H_X9j%9nwqnQP!;VN78`0Zc=XY!BdYf41%jxvYBZpeK>|tq*=tT|cHyg9o4QG>* zFT{%5VWhY{!1K#jMpv4>T1^+KBR7GA@RJ%3M{zxpWOTxDCYB)4@17y=|=X zRgSKEULZ7ZsU(mDto%9uj8Rz$-~nEM$veA?&BAz#61yhLA-n(pN8#ZOlZY{$cSrVP zZvyheiP?;TNJYtwO1X(N*uI`wc|x^}B^Zk!%gJyFKHw6iz-~!NHf;NFe|MmSM6tt4 zBM~cDJiGK%5D7iE1jD+{rZ4TNmEULrEA;_zWov--X54eD*u-2mK4Dh zsW8rCYDo%RZZg!v@tAjw?C+gzXx@Xu;}StSe&+|yT4MjS^25G0zybgvl<4ltJnk?j z%V*s?o3n8IB87|?&M>EU9N*cx@3uEQZ~fkpyK$m%;~`stfHz*k=zxz!tvhz}keh{R zZ2xlgS%_|~Y=HB7^JvB3;=7XlY+?8WVCEBRO7h&_%cz?-Vh7)nV(CW;lTB2#*5Yt)G|4`*?JrA;!{5VPEVe+C;3-aEq6ZA z2y@fj_XtL}V)?w-n!@8cUKPs&p6a2BIVs%%7jFLt?nD~9heeJ#9Kf#uJ8%#hx_vJ& zlrc__z}{u`ZRqa2#5x1HBrU|IPoz*Ks*NM zZ|q$eN$NtpdgQ6z2KH$+v*XDG-{adutY4WlguJ$~&j5w=6W7%EUz__1S?$TWSvH))f?i&41Z85(AS#bdlDYSP z+fTU0&E3Ds_>DP@NBWX3LFDyi~vg%FoeDz#Vy!5mgvGvL_{;{y^v*s}W zTZy6q2A$oMX5~c-z)7{x>pvG?|C|-r#kSh$uYLO`!e4+2)1zELN+zb-RYLQ85eWYD z;6fcQaHkyv2ZRZ)!iRFn7bjXy;z-d0JZ2{b|(Rbw6 z)i$~h8CMG72n^HJ(Iloz^?}Iu%r+Np9|1j=r$DFT!Z}`_#ata|*HRx|YwcQT*^BC# z-qrQU0%|ZlZqa%u)Gk!B?%%{kMN7l3qW0QW5l~ad%{}?wjW;$-t?jFFRZCGF{p|kg zW^B4k7h>ihm2fwP-tI`5+83xe9iQeu0+_O^Dl5LXhqi6H;teUED$L53nWeqv6gDpe zZ1srSEKVDy#AVcOjQFU}GS;+=e5t$3o$26#l#;?m>a$8Fd7r%*)kpJ89hRWLfh-v& z?ptiVlpwco!+A7dR^OS>>z9@~2wgo%(HFCEXj-PtYUz3)Ay z$lgBfjR?Hm=x)chS4%l?c0IBR`NSxvprq2Hs+@gF9i&g%5({eOONyoB!EG4jpK4fBqr+haUyt4f_ z>oJt6mQBNJEhRAS{E9F_ax*`oT6tpL;ZwM|*gCGgs_K%b8zzv*ozDcurMdtLUir0IycWO>-CsCTxl2MVZs5Pgi<3*OYb zVh+H@u`AYtsDHZ{1&jp>KUyCD1o0Ivb}rPLGzq!}PNg-RNyj4Qv;K2LYj;s1`arT+ z!kBdrVdFcRn@UzPnB>3wjwr@+L^7Xx-|bLxSq0$&t@jrbSgKSnV@trjSx8ImVgJbl zi&?ccZWGhrWM575d1xeDA$;xX)T(&0X#n|PYq-UNO%>C=E#pc8cVfu^yyP-V2~N`` zakHpOU*dU1Jpaqz{ZG==T0i7s;BIOFE9rQCUVMHK9J(#8!Ze4$SJa^Lq0;d^YUsWU zZR&TxHDVeUY7TsA>GlVThe0Wxu={YS-aqn|8L>);u-8U|U>)fX=NI}bgmk$C^Wrg^WrBfv|A^?yqZ7_MmJb<`au2=Ki(1Ub{E0PQL*P#PYB=Mmx2J zwesDwx?@bpTdb_A{qn09t`&Ezf=%FSZhcuE@>me4;!&S>Q8ioNGc&wo%lJGyKxQZwHp!jp!@xtR z5Zq?SEU^-j9&U4?_R)V%*2is8!ug_cG48&&Za=x5%pr%QmO24(EkCSjcMpgaekD)rF@(UC}SoqrB-uOw_l`-r?j<3-!DOi zKLW=5B2cstBqED>2Yc1GYH3~WO}@N8 z=5Kc5+UC61_Nx#=3+UK-o%Qe0Dx47O!S1&ndyWRf3Yye$8z`e0|+qm4Pt?Y z7EluHat|KQ>+?zDGrZWJ#s+(Ph1x&AbDheQLtAO57M*rl4!?rTS98T?ez5;ym=m7o z64ycQICqpGPuqn@IA!otEuFQo*v0V#qWlGt13(0Uc0HucqV&a=K~1$GDi-R^4!%rIO#I2KHTPNPN%Z2349 zRF?%!A5YpIeN7sUw^o4M{A_S)Tp|8hPrP=2eUjkVWn%%SNE&#?fp(o+(2nKw94mJ2RNT4B_BtDNpk zE`4DB1ChyITB(t&4!9HE_4e95#REf{CRE}0(IxDpT#pwx+iZV@t#Cuf8!WMq6Wi5a z)c!BOcCm9`-gD){B6V*lNWJpi?Dc$@-=L5>evt+fFU>dE3LAsNP>fD3r#VF;5%lN) z|00udWpnVkt(>+_=ZWCy<2jG&*xeiOWwPfK-PQlO)+Pky^`9+a?z9Ic(-hjx56!UR z@=_J5`oN9sE$e=Tnw%lylJ`vwc9I?6(} z9Ogx58}-*fEYHRqiva243ez`P+iZBPq9TMOS$#KMh$wLT#Us^BM@g&#Z03Kns24^$ zteBrk(-by|0Y0qqZjCy*Gx%d&SrQreZjjvk@4JCn(83(RFs9Y%hfu=CFER#-$&|jW zwE_g#=Pr{VFoots%6C0)rPqpL=|AMK%#;6bXr|v`YySI5Ca;;97P_cS!yB;9X8Jgi z>lncZ*s^75-&XZu#bS&o|K}tk6+Wnv!T-QurjRUZ3ib>KC7x9YB`Nt4aEIX7{Hmu| z9Ai>vL&i9qj5&Pqxgh%%Q%o7W5tPGt1W zGsZx8{=X0ZZ_;+RK%b8K-!ERuB)0CBj1aFWm0Iy%;bAj`U>$_%1d+8q^pr)hkupaE zJEZ>r4f)IGWGnt!jf&=r^{msYa;T_+IWaMw_8H}V-=$J39dq@69|rai^ImwMq8#*7 zlN0{mdVc$rRTYBlOHfD){>;&1()|bOy36br_&v$XP7E&*W`{2VqhVfPt_ zT8z1`F9yCkA+kx8An4+-S+KYk{4ZM~$}SqC9PaA(1DQ-r!ijcO^I@lf*`B#3@ z#j`XH#+3nIqwM5BKvnrT!P1h=IGM!=d771j@1bX?{j(mkhqQqeCtXm{^qfR9wnxJ> zx;Rn=a3zq(O}Owh3jNkpzCY}X-MiSB)OPiXl6^!@ub%keH=Fr3c+3ykIOk;v@FP0s z%iRE2{jJ=1I-d2+`+TYoOQ^YZ_@9Gm2e4sMOoog1mdntI0XL~$bWT2jRYg8i%jHG4 zD(ysE5;5xWyAE*6o&t^Yt@*MDfB|2$iMjz)q7} znzoN$qqNK~_U@eyb!DFeN*g3#RJCTybRvJ;O{IWUu%i-PT{@o*8V1O@8_M*mJNdVM z9QAt@KmD7*?Yw(r(c8j)H8Qm93#v?@9ZUU3EYO_i_XCcp?A(dhkU2Nm=h1?Z5dILW zCxyplyleQ*a5p-BO!=&NJ>{2V=lj>;SNK5s*#7SNf}Dvqu=6>jV{q16DxE}g^9m>+ zx9SCktoZq1pa2VAZGWW;BxL|x?8`h_wf)9$M>)1u3zi!e`o&KH94;b4+S@p+pc*c! z`e}k6jAW(oV&0S`kMgtvGYTQYEK@}nN2Tw)qBGz9qGhgI1tv5<2NTBSpXVF%(O*9z zDR!wSV2&UPgE&WjL*3-0iCPvry|)GKQ`bl1cAEj1e{zj=57u^PYASh~|Gr(v&kc#1#q{sX0 z;ll7(S6Lu$XsE|)$+Q^OYKCbGh5%{|8<6Lc-&L);xxoVQW$f_i`)30p&Qzeeg}I(l^1kgRg^rT&MxC1Sp^2a1Hza&AY#3Ki>u!S~`30qjJ~& zzZM`(Xb~pC*3hzH@t-3Uwz2(#HD{c!VN{JBTL_Su15w&s^_A8`%asKF!cry-npSIh zBerKW(2CcR|Ai47qO36J{>en8mpP3%cURBqY(!0kWMXM+bvj#P_r&Rzn3o_wW*a=R zdvW7bnW2dzU=X@1=@oG~oBpOV+pYfc6A*#}GfKx|XQcPyLm~+L_>eYFj}JLn?#5ea z3#y#*bNpbskDoZ(S1Wn}Ftxh6_VwC%$`&NJ8D=0cEL2i z?v=&SdliM^+6>j`EeZH1TYvgE~lVPf-F!Bhj@f_H2T8~q2Mp2 zu!g1`szxQMc9dVr9B>m$0h!urvg8@?uFw&gYEEE5z3BQp`^@c7&RzgsU=?#~+JX-p z#)BCaIOHA%CRvyl3q{rNv+x+i&7h$c#mllPr45`h$E~mo&3MI~OP}>oTDPjL4*;zI z(&J80fR6Uff0VYTy21z9?u@ZK?}uVI#{dTkpuokoKeg-a;!s*-nOKOSMt5cZy)0;{Uz;arz zic_UOI3)mosoUMUHc0idbu*};+FjtvbXO(FBsDiTnH`}{CYd9hYPoHIvjKp6>j&?j zDU#luH*?@E7YMVJhyi^nDEP~FtpVxLu#j@ImYaobTnK=~Uv&xM!X`|p;m55Zh}G!! zWtq_*fO`r^tFA=VwNLvUSGIpT3w8tj(-VZ-C#8Id-gdeik;{%M=m(t64JfQR6CYC# z!Gs6>OkxysWi$TyhT-wBrt@*Qhmj13UUPNEZ}xpZ(-D#LX!ZkvHRamHBwar^?LV83 z$&LpIT7mdVq3Sd!f;~D$V^ljyE@M;N1f`iITpuVbfz1l81&B`-@yE*n++pe27)WL= zVrZbD{T7tW4<4Lx)H#>ipkVu<52}Lkr@l7;p#{JtA(xW%aKWBcOp>Ua-Scd`Jrq41 z-Lv*ffU~6(KScqAl{ek;0H!~WDC122EJUkvVD}~EBggzxeo7?o!5&S~ONFQYFFVO? z6_jaRy{#xvfYU_OOcC^oVCjs{r5|W4Lx#MP)LE05h`ERSLK;2c#v_UOyC5QWkjs#O2`%C%)w zqTNgHI5O5gd$9m8VIUoQslS2ltSLHZfuqhew!67Vjy^46YWQLXNPt~M9Z11a>F-Mc z;Y3ewg8ZFhk{d?iEwj}C&R`DPC-4i`q-?J3vn@`dlED{-~{y6vV4GVXeY1@NUWO7Q@BaCC#*a(X&qBKYAFgHEr^;}P^g}2 z50nbsvavzYED;z2cj8}ttdq?;T~NOfe7=AEM-~$$wYHB#RSKwb+c;7;%+$DZb;g{m z+)x9qP`;>U8a_6Kyqrz|gr+|_`CXHcDC{aXABIrn3WhYMCc$;t8v=o^iVJsi($AK? zqFgRF_Mn~}%on!`GyjK~%Ec0rg>Haqy#TzxYxX6jNnBEh0SGs><(sQGXYy;UD5C+s z+|x&I04#l>1S8>1sSga{B(7}zm}Vpsj9#?l-0wE_Vc|jW-U0^=gec`wGiK8#eq`o~ z$UEVd{Se1QpF`a{INR$J$x5rz^|n|EMGO93z#}U+4gn?J>0GAz&IPQBbNvapTa31k zg#ar4f=&as&C4)TeH(Bm_`s{hJf6;4-PI(Awg58Jt%de));hcmDDYiiF*de?B@IC; zF}r7--8G4cr=Ql4D*)!xnwyLKS|H5R4rJ1GTtE$?4H8f$Em?(4Xt&@J4Lnpci-~}j z)W*wa&6pe-1mGx&*}ttf2$?;%qip0Rw_)?k-JO_b92`K)?J;ji_=m4l)$2u%o~6hF z@PT~?^%Vf2g1ahKl$)Q`{XGa!z>bn%>1im&1B8!MYZnSp1F{S9`pU=eL$q9L0Z^Ch z0ic6?d42$PG4uGNE%Y_^JzfFUQeR(yT5~$!EHV{LOgy#!fxojLNv&48vKvBy2J6iy@wTRDKd85}Jx#~`dLR35LFVU=40n2ru&Z_BDcb%@!IW5h8dH));DG>9?skH3y$ltafNT!q06qq7CDnugJ6vP zjm%_{-539L8HPijZTBgZqV^Y0`wzxel%h_q~X!o~<2J_mMSp+T1la<5o ztbbjlNl(vw?5H6;Kia|~PK2B?2t01DG@t?+35rn`csz$a-A!01QlHwsz&f`~_7azv z@&B4)N4`pBYDqmWk$8V3#rQ>30}E^eX105u#^5d zsgb=)4JTdc>1}e@y@lUxy^cw!z|qrVe4erVs;|0nR|^r88z157{wjRXdqGt60(Ru5 zr+tDCkns(QS*ljy>xG3BH1FhhWJ{Q@SM83of_|Aro-n>oLRxqwNVcQo?ahNeOHr2F z6ppkIlqZG(<@#C(Ew}p&*+Ua)0)Zo4k`ZsjvD<6KfuMk_#?;>K z`F>=M4@MA|=x&|_#E*O_v0c*tvWr|p%6r~B{!4fl7G&U4GGtCZ$1^D{Gw+ksPf)>> zfH6mjyB{*qU&NF`xN&lABP?g?T8(<#FHoNZs}PTksuV3wVGw~n+w`RQJ8l5}_zI%R z^X5cSoa<=UPHbQ@VtiLb4`)ZZVVd~+Bd}(kkR*Y^pTR}BR z@yRe2iFn54OS;?QGRoQszuiu9tQXm973uVp`Kj@ten%=9mv2f2a#@oi&70$1$Gj)o z6DX2+=7Oqt#>FB1m+*W-#eo;>fivu}Yk<+nGmCfbkM7WaWZ|viZJeMOQ)SAB#M)TRai3plqwoh5-FO@@vNU zzRN?C>f9$zhvL^i{UKe0Vy`lqYVQpSpz6%%_P4b?U_RRxFqM2Xw=nM>TlSdSzfpwb ze7}+U{58JWQEklw;++I_VJ9Q3P3^Ce_1W%Mpmk57MlA5-<VG56(_>k~MdCpKk zqou24I6>`|rDWkl943XV%;L@) z){h*?z2b${aUC5^1bi|lJ~Fa8DjymP^f#?$ zs(A2ga`Z|bSHp+%$6KzlWaa3YP-a2wj`C=i|BtD!0IO>G-ad4vbbClq>FziP3ewUI zA_CIgNFAg_N;)K@6{NdFl#uQQ>F)aGT<`z;-Tn9o&tadvXV$D)>s{|!Gn4d42bTy> z+CX_+W>pLpZl!8PwxOZ0vjgE|M zgvR7z9>X3mH1F08C$1!Y^_cbftD@=UZ433~_0k*6O;I8C9o6xXP&FjGiOa)7o05!B zsxr2n{zN^4KXOF$d%dka^RJQ(0`0IS<*LuO3VLD_H73`4T=2oRSJoKA?7fadow5{u8k0RjTOJ2v=W53lhJ9YC> zi(S$GLIQxd(K~v)c_0*CtmXcqy1wvFI#XlK45pC=E9&0En9ZH${rt=7k}TWX2RiCY@#(cyQjgOkEtOC zFP+U{YCiacEf7@d%W*uSC`~t!jmQi#!EmV4V;y`je7G}Ly;{g+Im)TGDO0FwBzV-J z_=$-EQI5;Q=aqr8?QW1lJFcb}g~H5-X&;>Uil-{~G?D0Vb zRogfo%24LVVAY=52gA$sU%TFGmaxK{W_@zGFgyQ<`y?wgA3@L0u%Dw z<*J!dgEgZ=Q%XclygGi0CUU9r{3mfGC5fe+x}OqO5Yp@H;*Uk?s9%9#ST_)Tzi?fj;5Cy z#C(a^j4ZDf1$u}x9avVXjb4ln!6b0lBm0K3#=4(Jj1(um3kl#Q@5@$C-Bp>dBk+FZ zIONwoP+FIXj;F$p$9{d|-&4ThdpNuMbqWTP{hm!g|CkibR52z9^| z9~NA+gfni&W0J}4L8_lb9M3$X>1EsaO;DFrg2W%iZZ4W4pZFa1yI0W)cmW%If@MuD z;r#A%+46D3Z+=3i&CDN*bCFf%MN$0cTnH~-p6J|ca?CWbk!Aapsn%>cR92uj#H?jk z)nmEwU?u*FL^b(So|dQ)KCG+lSJuP%p?&y8cx7(m!usoPa@4xvZ#sLw^*uRs`@U1w zC@3)cY}3M$^7d>QEn;La$6ByNAju#l>-C#qlUWRmpAv41AGj>YMzXTyq6W?kTZ06n z_M95Ol#v?K^UdPFT03Vr_Y%s<`G%I-{Ji7(>3s+1-DXM`FFR&48L@`z5-Tg9Kwn3$ z=k4#}g12*~Snt;sB8l0gd?hBr!%u;ok*6zvp<0^{ihg`x<%`+Mf|Do*8|kX*5xkI& zcp#4Z^qb~m7@tcoL~6Dyo^1se=`t@VU`y~$Ve`vUJ!p|&4dt$YNTVNV|El(4%^r)Z z=g*CZRiM%|VBgZE(dwhhmuI@>oGbX5Ea^Q3PuC9$_?;a)s?^}PPCY1!-OIV+uhiyC zy5+t5se0JA^E?jPQovaDus&TMDjPE0p>8->ZaB+r%%@bjxw+yPNY_;j(iWia1U|Cy zZbn^mta?G)e@ld=pqA{eW|h!PM*Lt=u?7OksQ0Gg!Ldfzc-f6Ep$|s3G?JcG^chW@ zbZ57YtPqo{W*nf0%ayB+5D2FrM&m^%RP1g}1)y2;fgyu!VXsekQ^(v$gIjW6A3jOy zmY2!}$FhQbP=LSlzdH7);lAI@K|#7;d3`i=^y$2#`vZqLe&*xu#jjnpzPnap-u{if z&T(%RE>Cy8runL?p9fuk3FUClrV-VCTWCUXZk%EAxy)Y9NLPG>Dt&PPuT-J0Ov)om zG>vv;a6^tnTfl7+&R1MP#+_Y_dEy+DuJjgY4?|6Sj$v*`X!(Ft?y%{H7V6E9Qw|KJ zn7yyC>$e}M4HwE})$pPs71~?N0yF=S!&s17e?%xjHxw@AZtgHUnDfNWk(TP?C?vr0 zg{ZO--LjwO&pbBc6_W9sl6=aR`Q*2s4v1ngkvYgl7q(C)t!!V&LNNy;pda-{RBc>T z4e(p`k_D-ZxBFmnhB#w;VnOff$sVQApx337kmJ}?x~hnP1}WV}ej-L1n9U4$b(<3W z`BJOI*IbZJpBsz&e#T&g7l{@hbfc4*Dg9?pZjH;VeJ)U3FrB*H1V4=eV^J)V+>*UR zHc4hQc*v@Dywu4G#>1zv~9|Eb5Zq%rM<$@5Y)MMfyk zmtm~FF1mVY1=Px`ZdDjeJC2#jZm#lA(Hp^*dN+x+?hu^@y43M$>RoTLZmOV%8rNcJ z`vBRp#K@siO;P=%poYA{7&h%=^VeQpZ>ja=$?pW&^W_V+GV8bLns1X;Rb~VPsgR8N zLEtm_QdSDM6K&Rz$s_lYeK)7rRN7_VI%95=35tVd$+Fh|8(q+uC+5Xeess|~Ld>{F zEFn@*Or0iMD4$-(fVo+oO49mAij5$ZI~VF^k>seabqQA1Z^B|4P}Y=iyO&<)?oYep z-n*CH64swM5Z(UMF>u295y30xhicO!=LyFR#P-51i|_?133&FrfxuBu2^tB;}T8alarBKgS5B z6F`m7pQWN)Rn@t{RnM6;+yO~{^}^oUKVOvZy*XNv`FX0f2i_V$;O~wjG389g%K0Jt zb2Dj1*|W|Vyv`=U$dDQk-KEopwD(af$KW6QIXnk*!B)QpdHU3H;rv2JzIUa8XD+I;;;KVMA6Uy~>~lMemiCif-qrV^g*ukc3@z7#sR1FPsWuR0 zoUT*-`4y%8hIsuB96dE1en$7;oxkmH!&?Ti`Hl*HEU<;(>i2GWeEkwGC=@b0ZcEFI zeJQslkLm4px2$d5_X6OU1YBBfGVS-L;ib0fLNhPPMkuCDB57A&u3E!wHSCjeL5*+f&u@v@cJ z0huZHi80@o9?{=D;<#vPNPVnJO%!Fz6Mj3CG1Uu4ZmzHp2ktbbDK_@CPltHL?dgUi zP+^#Pgz0;oa`HIf-X!fMFx60*-UdvsMSpWjuy|}pUh5owHR>V!CDJVlzks7=4eQ8# zxw`cyZYRfs!|ba$>`M6`0jpC(&});N%J}X2+%=OtG=$z=|s%A4^&`v9J*zOdI>^mCR8CVj|cv$Tiky|c@5$29SnohNEe?cg=rL0oX> zbMI(dou=7q3h?LqVPZr9F?Gw(eaFMK(Klp|!r`G@=({(aJ~j(%E9#F@h@yd$w$iH3 z)pdQT(Fx&X74x#8N$lpGq3RW>aael$d)GslO314T?p~7#dy|X(ECd(W;n=6lY;5*Y z`VHCsK1zkGS{(3dCvY4ItRslwT{tury|pq-jlTc-Vhks2-k+_*EQDwX&I`nX!XP%? zL8u0ev#rvRhViX%JM6Kd@1n4__EGx#Sm3*O5dj3sR%-oLixt{BjnyW>F~$+|ea%rN zJaD+gy5|oe0ga?Fc7k5S%zKe#?r>OZ)NseabmsF{qA5g?oPwakt{xp7bq6+r;*9Y2 z7H^6*rp=RirKi_>RT|X0#ou%sVSG6gZMV8od<~8XY+(Brhou+fo`20h|$@(uO^oAf zl#p>o=vKuD@)JGb_Q0k*JiiSVxp(?Klb_@jQ;XIoG zvo29m6vUdelNFbH2R1d4M6iR(jBc!)eGi$}h311l2IyXTQ$p*>G>FGVA@!V)+EcC) zW%g&rUo@Y?_!_@6n8oM*-fctEkXcO>s|2vg&u`kIq>djyY=F#sJevl@ccIFhG9-Z@ z*2`PhTH3o4jRt&!4wo>=S60-H-nN{VZao1J-_0U9YozgOncoHo-wWb?WybZx=HtQ6 zB8`tX6FCT9ApzZF{BGL=?a?>7nEOuM?GLgMkKoQW(!!e;MpCe#72sKa0^{4Z>iovK zq8f~%GjgP0`l3?4xbH*f2|?Oa#kWyt7ts*ceQYPkK7R%i8I@dAHJ{DaZj8Q1FGz{- zIKMDb(;G3q%MlD%)p{Vs-Ucwu&nO(}=Rw$jAZRO-6=wTvi)vye>-d;iaF4EuAHUc>1s+fSqhd={KwUi|Ylwoak+^SF*~ot z(ko2VG1pY^yC&4;VihPli14(bufP!>=(9z5HvB-&oJq2k)U7jg7!kFz_@`m7SnUk` z96Dq}5{qKtq4npTkL{6bYm!XoY36D#85Kvstc?FTh32xh@wpQOrHF8jQM>?IGNV5D z18+#-XTe8$gH|U(@73NiQZj?E;z^hn)X$b-sR!NUC!2l5$oHCQSmH2u%gZPVeJEzK z1Pf%i2Q>=-O?nkWnZpg_G&D_(vHzxhyorn$FwgW`3(OpL@DyHtCP+6`Z8lfC`mhHWf*P3J%4awNt*LrtwRwN zAUn;6YhJ6eTd3Ngw}jB6a6lEmM2)8cjjtJ?jhbGMej*z|1txBsPd$W{w=a_Vvp`j0 zoC}m5aBxTvXrBz-w^ zay%Wblv3x`ca+0+`zgtkO6_eXt><0#vj`G7SV!V>^xgEQs7T9zr(d;?ss-x5l3N_pRYTAmfyYp$Opeydqfb_Q zd>bGEK!2(@gn0 z(EAl|rDRyERrPJgaw;%%*^6jmf>*0qnX(1zC-Cp;BF52=__5BHTF&lYD7D?_`CdIt z6lNrfd-KewM#|ge<}(cLfhA>phs5_H;8sCqDRF?9?uN~YYl{&&O?)?zA9fu7PZhcWJ(1fZJq0jz=xq;%-SmQZY*749&u>t$o6tZ|&y! z9R#xH>xr%Jp4kQPPpz*JA975f@BEPoZ& ziC)_+7O~3VvW;(5alAxB3eL7SoAmkO%@36GNhOdgYGVk#qQtV1c7mwr&E*qLg?W*0 zi`hXzIxIxGgV#Nh&ep@9Gsv?1@dIRy=@^meF~%Rz&o%p!o_R6kAhF&HoFohcEQ73s zLyLW{kk4g@FpwNF1TeO-iH1mk1Dg?fh~2jiYa5?EsPAtJh$xfO)1#7+mCe3KQmdmG zw4EbDqRpQTI{XQAxWtAs7Ei|2YlyOim(E(b?p{Nn*(~DnhMFIv%dgy!kHa}>Pu@ZfR3Mj^ebUI%I`;$pRU=}lk0ha9g*x3>8KCsEP6`sg&9mo}{v?AA78TbDKj0`Q z;TJ12C-v_6ahgBo22$CDBUB)-0e<28RwY|JoL%-5FKX<1#n(K7YNIYeVW4!|ZFlH? z1_k|M&;ijL1^F(DAZu6koylc(ZpiRS@b59=?d7-Q^v3Yto0i)Oz3qZwUxp@fLXAiq zj}5S*Gad#45Cy{gs80ur<5ipK_X0+=0dCes}H$mkLg-lj=cunHf&(W4%Z2#^pJS{AMqP8EW$}y_O$_aX=m*K@=b_N%uLF zO~TJ&d6NL6SO5w&Nk-d+FvLHraCk;Rri>-4>_`hZlEtfKPpj9%Qsv~1f6>*#T3##Q z-YP7-gt|k$&o=5@acc@OK;|Uv2Ybgx1gTK`i|Cvm52e-O4Y^=yG5J3X_+G5#oF9+J z{vdI{f=fG$Fhzz(^dwiB6E3XcN~*AeLbdi;U8M28?8F&m5eEJ-!RqXMwU8h6S|b9V zRdvVTPIU_a-;7U9@>3HpS3= z>)(j**m0etM3*j%K6>4B{WhXooP~W$@1RYv=-fe@odtGo(i@5S=pz;SD-6%fjMQ-^ z9{B=t$3=C1xXDBTtZ`%g}H$O2aMqAw{$k6pU|og!c$vN zf|(SKAIQ%e`@SZ8#*$;hb+oSU3sdud2s@CbJ$8m1*W8)Zv9%c@?y%z8WQ1?O2w98J+Oc)5FH5%XA}<;Ss} z7V_`?Ph)=^mSi48r#)^fDsciDnM}L2M2#;RLQGYS{nhf9jIuI5J3G6oc5-NaJ73;i zEv28IpH7t(kzMT~dgo)K$kx_drIE9!)UV<*X*)zjR+qjC`VC}gt9Z4VV*!dUPk@wQ zMz3k#u~QEThwbTjUe3lDKmx)dh=Cr{dsM<^z>Mt~wUy^!iVe+w2VFvwZj>I`VnvFDj34fCnR<(E(@CD(`i`O)vJ%BT=n!$( z%hLQ_;p0XEm`fR8d733+qv(~_axa`>w%Xr4vAq@{rEXD{bE&`}Q^M+a+nbGf;JR@r z_StRDQ0O;*RUx8W2|tf)apHpbYhYr$x}B{j*Zp=3^CzCmyT3UrZN@ns88_1)HV!*H zJdFMDAviCOX?wPTe06no;@cbQZ*Qg%c~yd*rLKrdj{~zAhYmakXJ_i;y#XUTD|%j$ z&aZvrse03n94*-Eho58Pj6<9~M-7q7rvP(J*T-8XL<`0MM7qh;v52%Vh&l!PN129)uVQ5{3{!>i_&m7>O1yOC-rb_^!D9OzWie zcrrixDM{eZx7L6q?7Xdlt|X16(y(GmC1<9Zp121SbjzQ+T-{g}`^?fVZtcQ>GmSJJ zj(}qSphC1O(x8LCD66E+!#x@lU>RgAdR1>s^RbcgC{gajOx}CT#mcerQ4qe{*q)9! zcHMTk@=i<($z-&oN1!G9-aac*Ey{RezbhtjAcK?+J`&+^0K-tugkkY>FxKpl5a^(1 zJh3=KvT?|8h|YM8qf8LnCWcQ!2!p~D8q#Bwn?}Cxu%-y3&eoY*F-%k>J1*zFuaKb^ z!JVD32Z&e}xuHm+D13ZwvgQd%Fl%&~@kxt~A38M0hJlI6jtt4< zVwP_ z+^un$v_M1TzC8|!PYcMP`~~e6^moxxuev87O7Bi(lUr(qV%Pf}L5IGlVMZiss&fG#GcJ_y zB6@jUQSFtbER2Ah*-{0!yRnuKP+?)|C3_K3c7ALAAT1XJ>_xNpRtBiDWg*q#Gy5mg zm>72Wam}tL0h(bmOSS53s1npV z5j!zi{f+~lYX=_s^`l~?{tR|f9+078 ztm&*E3=F*5&sVppl&mK7j$TFBs`$3&7O@xz9-uoJq69zQ;aBMY`4eVq`)GS-M@?TJ z=ac$tH(Os{algwAR-fyG9>iigNXNS~->cL6OiU}6&2`dQb7xwxvBH&qD=gjMXRN?5n)QadALb*ks zWy5ycCdW3B{~v^zUo{A2XI-KapikZUiiVIE?>Z-tIaGAWB6U7ATo zEm>H)L%f&sDT#FW9+!-}iDd5ebs9^GqeISj1}qoK(6~{I&PFM~0it-3lQxpch4((i zpw!X_2z5ek1&Ml__JF9-s{T5q*SyGA4t03zh&QB4U0 z!%h{X1wb$E^lOjbTXKNt3>EKj0^+RDZ=jHdn8`N%18S78b}IKO9&mGWV`5{=I689U z(~1NGbxx(-T3ZX<7%o`8SkJ^TnKl(Q(c!1Mw;2wSIAT6WsC+fwmO=Fae){7l&#bd6 zeKi1{1hpNeJ-3elxCZ@OtbHKSzCDLUoB9^JBP-0?7z-KXZ^+|wd=Iv7u!Ni|X?hEA zV&Ch*KcXi%8aTd;CoN`DECgtnfc3EQ%8JhEolOI+JE-~C?KF9mMjZOO66vPi+oIOl zQPX5-gbRUF)KHxitpN;upx#fiU~ro-mJS9K-Go(zDflA^d#0N@ru$vuK+^^d}0fnOPY9Bbd zxBft@1el%dk?#oGmSxf%T~num%(p4^K{A{r#`doqSL$$L;ULhTznk&w7^s)Ttw^41S(r z%6GOR>voKW-}{R-uakME=pU}Z% zr2AgG^1fGIVcb|@UWSD}DeeiZg3>5Fd<#rXA~VeFB8?68%3#BF-ccO+QBB;}h#;C@ zr8|Vo$gi#e^VeGGFE)s2g2G^zR_A8ZhXV;e;?`3LIL+G2a_j&FOs`}6cXTo;EH3&4nv2pFcsR*x_(WYVXGortRJiFuXn zzwAqkgInbhc6MwzqP7x22Ks$$HPYA=b|Iaq5GCY!)_aqmwWK@mHwDm&q|`1WN;pdm z2?4s{p%93#i02vHOvr7b4T`>B2BHCbe9+RM$ytGX&55T7g-T?B0h0GFs|vSvF_fAC z6S+T4IB0Xz+QZWmY~wC$OMs70cW8PwO5&!z%%t`8Gp%>@8e+l%aDc+KU9f*JhiiK! zfs!jL78OHX^l-)-N`zV~d@|$w(KeM0nUzPel93q)WB6VDjyK`j-aAm@>^L0h;87>6 zQ}ko;F$my6YCBBcKB}Yc+Io8?GbHccg{pA|t{5mK(MWme;QTGD>H68JS&@KtrK!>R zRk{7leN1G*D-dzR!UW5d(PFU|2=39%Z2rj`>?dSye}tKgrUu7YuwEq&fAU!dNr6<3 zCKkTbCh+vCNP~L(P{0`a#ghlqUf`}T>Y^`nh2=Fq$-U@x+ZkIG!sVTvsaZ& zlO!4gvPWBKkDizxRB;JCSPjw(D=+8lj-n0&doP*IH~Z?;9sZ#6NbhiCWo0eVsYIru zqYKiD;TL|eT5BVXyQ@bSG_s8iqF1G2%xEhgE`$b zVNMlCQd%`e*Vv*D?2_rCNu6`J-999xyvl0ha{EBu9evnduBF^j6XuMVn(j7Yh35Auv>uQ1FMhPKw(GMimK zr~wl0DYk?+>FRCvdYONF|{Z3)6etbOWzlCu%lm&V6|| zi<=IA5;<=CRwo;B-VaqaE;pI+`*fqbX@r>Q=-0W>cv{e05-iIr`#50VZ>}5)p zd_dyCh1}dlw!@eLQ61LK2Cycir6lc56G zijocx%tOcSog*`czMl$0qPV->_M0hRgJ>l6#n8_lQ3Va_zMQDMgPs<+rI)O3MZm3? zh&nr{V{sVBTi3_RLjPEUY{c|~Ps-yplM@h)jgKdY6!#xrCZeHzCP)C=JLAAW@679y zVRKL=X;vdR$J>LpI5w%4EGz+E%u0AkKDyNR;gOHO*g&oHD-2@-`56IsKD%^MECTYa zN3rL-4SN-~lRUv8A@?OETNEdDS64&iBFNe%FMi07fKP~s>fQ6nDBk$Ek;0sVi zd%mJlqucN(HD1FYB591(U7vYpc{f1cQf@IZC2qf=Kgw_867VyK!lvjCB^>T=AffZL zU%N3DqdmEk1uPw=bcR|BU#ps~2S%K4w#sRa*DS@v{A_zqNj7b4pTK~r|Jar1pA&DP z^%A%<<%k53F>NiJ_JJ-~uHY(+NU}WUWpwN-VMFyIxSaKN(bcdKZI;XkGYoTzec|z< zkQp+`UD-M@wNbU08?IDmSFE^?i&+e${1K^J*T!kW>S=({VhT;dw}0^DBHU_&Z_laKuEW9wxoJyyCZOQ*aV9;^GVDa%jN^<(U}2u@8C) z)*U!n>ZcC?>Od@TVCHRau>JM~MHb-MRQ(WfdFRSA9lEKhhB8Zc^&jAvW(oubQoFU& z`uw}<;%J?bnHdc`1lhWpYH@LKqQ;(HMn;C=9TbFW-Gk|urJyP=^Tq|K0sp0YLqiA1 zJOl6KuzpPeL$A{>YF{h`NhRL`oP9YbvVYLX-g&x%h7T%<+ss|iWh7X~fw+bU+gp7D z05<4Z2N_LL)wB z8~=g4EINw&KiZOWKRECTQe0xwrH#R{v=v0IHk`HTHUmVEvK+)^uZ{^|w$rLNJz`Gu zXe7nDK<6z2{_Ly;q%JX5*jl2>_`H#fl<+!cBPJ$R3f-Zls2@K09RWo!BS{ZZfbLf* zHl*N#dfI&%5y|W1$PP+o1(CRz-1TSKLvFK>7a)@-&`sY*3nu+nQ)R5pGi4&bf2VOA@ZOPGy8o%3%Sx1=o8aGg! z$(dvdqO+e7IBg&t0t<%pv(=~bhBh77%!Kjt$rk~I{KL9FY#Uf-M6ulOUX>FSO|9Z$ zLUgnalVXI%@a`*(t+=V;X`;Kj$s3MJF{&c|PZbEOszb zYl&O$cp(nMhQkZp+qaEvo&A@|om<|~lkGX9xCi2KRx&)j{m zok*4@yEkpmU^=>&PiGh2tJpIF0hn%$%pH49-m9!_Tk3 zcZX@~HPHRFN1N%fv9-b|trG>i8KK@}QI&4u9T_0kZ|&B#3TdVQG$2b4$U`m$?siuI zmY)CsL>z5Vk7F+)z=whQ@Ai!nC%~V|SBLv;LjbeG9*!@R+ux!ArPV4+3*|-M{l^}`WMe=-bWsCVzvk|@ z2l18~4#4A$_3Uj^oj6)PPltNbq9S3QI!c4k6dE)GIK6Ys{Vz9o1g>60T?tW$#cUyO ztqp25qkg^xMEvaZwhN*lpyWV0ng2c}h=xpA%?T_*cljnXtsg5Juyti0o6$(SM=C3xgyq)9^ zQ+!U8;dA)(XNEZS*^D#6hiAZWpx{cBoK{sv@31**=_#Ii>?L+gAW zmYOsj9Mef2mPL(Vl2<7#nJf;-!*2kM6u28v+T%4olx+2af~ZBEP5iVDD~EFGooKCJ4`<1Z zMu%GR|FHh3HXdX12@u7IB@B2ch_w%ZAqiB!FKcK>o0FTXW@s4Ye|wbau@ue}qP z2MhCH5E#K}ri*6jk-S)mKVO%;3+FcPW_bJrn2C|*%JBD(oZhw+ z+ym*>h4n?a2|YPTF1C#VZui*Q2GLHyg?tzn$jzD=Z2pv$L-fM6w9rO9`1lT#XG>&3rXN+y)$Cq{)9SP4xqqw$ z_%HBE0n`t*PX9sz{Nfl#2s(wVJJma|>7wptdvi^(eXAZfC*!}Oy$^d? zD@{AlEndD{OwcxJOSNx)-NqjN_i^9J9AEPc5snkp8#g(c%m0}h95ng#10I@jdg>+y zOco>n(Fkxfhh@*y`;Q-A6r%o`WSB(*P*yw?+}UvSZsWU4ZHrg0 zI>yJz!OmGS<;zKr^+P`?CglJsc0lYX5{*4Cu5)_S;nhdBtdSp|2>;P>HF|CbRw@>X z`g?|%@7`fIo=(|70>+K~X*oDJe7$BG_L_0(45AGi+)U4QXM=R1QC#+7m4u2*j1pBz z!q@#%)&D+b9uq4(bsEC9n?@g0u$OKMy!#)K@ErJ?>2IzZ8~6~A|JmM99tj#P);2#{ z`!#+-1DG}i6_v2`*;d=RXQ(C!2w!T5`cI>XPNHBWoyIXS`(+^PjI6e~pMx}5`P=vQ z`ogfeKVcWPmM-LotY2f~pP!PF67GMqWsIWw_nTnW${|DGIp?IH9;_?`jvmYQ?tIVx zE@EY6g~NFLnS0KzCOhfW)YMNp|DEb_RU;$2>!afGW^8$R`FQh}Je1&6BaFr;RF$>u z|2hfGINb&al!^xEUh~y13PSgKp1Fta!nD~Eo`HW~dvIBl{PBBJS)nSy1Lf=5k^E`!zrV_<$wRPcXqd zV6uvbDabQtJ?Sw$<&#u4J9>YWr_dgZdlUm0cX()Yjihj>;wm05YWR5$kkvm=$!U&L zGXCm10p z!M~jcFSA;B3gIS!uv_bw7~&A=68^8c|_c+bBV9~Z)y z{^t&)R^WUg|LJSJ5$Nmp!kWRR=H@w(kpCM+B0MC-vhauunX{UCztrr%F$VZ+93|p& zYJ_b5y>5EIBbCg+ODzmRv2myh>iwSjgn#wY7^pY&D^PDD-GONpj&4~+*2YpyOvFCW z|EIYM5I&TECK=0Bb@+EOZZHa8@C8}XKs{vM@ro->)fmvCf3C|X$Z&%GOcJk+Tk0O& z1~TXuHH7^Cy}Ve3znGr%Yx_$`&QAYo1CNix`;Q<-cuyTzb0q%ri3J^sJ9Lx$KOM;j zZO!rf&n+Xg;Ffxp|GcH%3`B?Hkw6?n3l}`hIDMJZw^u1PHB367J^x&r)Ihyl3=uuX zizaA(D(5O|^P!MDv&!x9UwMrPzNfSiP`NmZ)>tfkLxmV`SrRZpIe`U38=?}`UoC0> zz0sXG9JN7mDxTYJE8{Cd453{AYc1dJrw|VmDPN7$1jYL~+0p+Sp(u;(MP(SuyZ?Nm z3C7H-6(QTdS56!}P?QJ{`@fIl0-cxc_@ClEAqE}cD@1hU?=_^*1_m0P_J7($g$1-L zPVRr&l(QHOo~w(C=uUG4-U*)%6kbrGkM;KfC!|1}U)T^Y^*vg<7g4brC(MZ`pymAU z7-x||Kq5qoBLx2BpY}DyPd{~Bjs#mr_=d?jmc4!V!!w}yQL3}5`IG0#eE8CGoPRwre zUnBKh=zXi)7VG1?HIvMlb{-9&X?ch?h=`Q3Awytlu^($e4IJX)d5@a2e^i#M?b|%> zJ2nEQ=IDP+&=fHigc`#3Ksy!OpHokTJu7*=FZ&;PSXYFBc6f!#oJB_B{`Yf)P6+@6 z{JPYw>G9UL6u#})oHJEinMo2)e`>NTAIj1=87@;!NxyY~Se9W8Kf zU}0gQks$Z)jc;%fH#&nGHJshtx~J`1qCj2=1rka?k8fjRlWW{!KQ94xm=!x;2%-?Q zGjL7-6+Hi3r8J0d#v{Jzy_WK7|CiwW!uI4>kf3Vsq4&2P+4^QT`wkArWFx_Dyt}>n zWx)JzN2@Ij_!8h#k2vz4J%7p)zX&$2MuLv=4OkW6az;QYp9#?S~%w3K|4rF}^s;BxO0TB^6(|v=q zbxy0;m&Y4H0Cxbv-_yufDsne?@&w(-*H=wP2OdQ&xK!CgXS4XMsOg>@gK+M`YfkNk z^5_3w`{a=q&>=$8y2%K&Xy{4V9ntjh@!8-0I)Dr@@>oRE)YKdi-37o)+SK$uGBPrk z_vv=xqc{;vX^5EUbYgNn{=eFn0fUaBOY-`D@9kkZ;dKRu(jQ0G-I`r7i6f-A_#yGV zdk0UX#G2*3Ui4dQY2k(Ao(e^WY8RzA(EY!0BE2} z2N-bJ=d%}8>o>SPCgU)`1S4)x?}7!OBD$)lPZSkDHUL7&ysz*DY$r^nWQv+n88O?R zXpl?)Re|oflzIp>Ctpi^m{zKEu*oam+dRAB*{Ajr-LDmZhXyAE)z|gC;i(IG2^Y(V zbbhJ}mYU{s6#Tj;NAGg59a3e3rBm_3yaQKoC`dl2+C=|in5)oS;GTFsEc z_+B`?A=I3FID0repQFg|!4HMb$v1m4P$Gww??lI&qd4N;r!Y_hITQ9=emqd)xgnH4 zNN_!}^+VQfK1VLqtAE3+>ifiqNjYM$TUFrwtAZ8+Mn&)Qh^V?&c3Va*Q{&|eru@c6 z%DXuaOnJ^cZd-fwF^<{A6<%DCbo>FyJF(lFJ%2_JKCKD#JM0J!jjXEiK2_-FcE$QD z!I3AGpKyt)ZMwfD6;XamO-;>hY^3Rlrj_;cYgQAVPfgX!?TR~kjgTHnfx4<*nSkq4 z+R&^0l<$fX;j&@)i~EZm5J=48SBAJRE&krjIVT2<>NeH3cC!CGeCkt_179nYCTu; zU1svftMo+Ew|Hq{{BEXR>7fF3VL4o=4pP^ch11JeL8p2LI(8xC#FEdn7 zP>=!*kHFZ)>J>ge+9!q4HH4Nk<)Wg` zoT@uK{0Wrsj~DlL$xKX51JCCD>4%1f{*0Gr7WHN0%dl!ye_34bVBTu=Gp&xD^(dKxD5&5jw| zBhSt{19sCt=AqY%zGY~g`sjY|ufr#bGev+VT5wQB`_B~K$~V&jL8ji-gM+G_-Q8e5 zEZL*&qA`=gMdBhQ&C3~Xtyw-dz$naYidrYy=#ohmf^H?!87fl#4WEeAQV}p)BvKS> zI`D_YZeJ2-PlmX6*6;?{(I;|F+p!2693Csba$qCmbBbP7AFAPIgTov7XC80)Mx1bB z98Vof!|ktagywt;1+Ksq6Zi~X%b%^MJJZ>k?1=UShlUEAe+&qK=;-Ss_@`I>X>F~6 zDAY8@*<;XM88DvB?}7?608c|jQy#0x-8n!SkK)5+9U!{Gvy9^V@8hA?zCd}@8nk(V zBsn=b5w>x6clXca*Mhe3-c=`1F@!Ga{twu13T*h_RJ~!1SJTRVT|ri-^v<-&kb7?a zo;il6RMA4Y>HjtS^zBmuqH6Dhg9G5e9b8;spePY=fH8;^9b~XnUobd07*t20wzai6 zI64-cOvT0$BK%N;+fMs?W<>}@BprTUtUKX)j(rN|$P&+spev9HKR$8lUXh{?#yxra zsjks;j_qHcOO!%_@YZM7H#e1@N0xtFMAF1OiNPO%21$WaAkf*KHlOl zjEDkgLt)UsmKI6yzJtx;@|=(%s$N(j_e--5}E4-Jmqm-61K`{olv?`@Zk< zxp^*^^X!^Ev(}oKQd!^-SD(q?c=8d0BS-~~i&)j=*-kyv+XmMFnUhm&aq?k$7KbMf zL2x3){IcW=k1wHC@!tavVR`=|@9`vDu_OB83Yo?AotW52S)oeE9_uXBP+?}Z!Ia6{ zIJDM<5KEk&gq}W9ARite76rfl|NP8p1viW7&6Ld!f*LtpWE@53q7T+M&O1Dhd>;`c z#|nhYEIl5Comq(kZ<`F2{5eCfj!~Ore~BbOw+r-9)b0l^{1j8slonar=g=RUKj-{d zh)wZR5eL$K<`eDjMw~uo67l|klSc64|KI;KkztrCCUz7mPfPu1MF5Up;HSnHU%!@+ zk}=02|2df_j)(pD)+?L$&B!*R%Ip8W2)M+O&?`f3GMsv&!i4JYHM>~vOR9>()~?fM z!b1A?=FkZOMsZF%t>FVSJNVx-wE_)QISvk|-@MWFhHyGZkU~Y3_RQwNn5QCtuobu# z=(P)h{H>*6GMvl%<>cu9AK5_nQ`$uz^8g9@VoS?BjmalMkx;Lk$aqyWH3_lvtG0G4 zO3cjmN6pUMi;eZ^Gqu#_|07bY{<*_7PN+lse4ykFY969X4}XBb-tS|Jz~WDzQu}`n z5rf4wHv*pLg z+_!&=D5JCvHLRJKV;@Y+mLEMDQr;QYuq{j38V_@nnR4g*m47VHt#TZ3Y`sdUnjc<~ zvb7xMFlEw>$W4r%WaF?qT)NmH$xl%%S(a?kVd|_ljrJ|Pz|ywO`Kt9gYGG$Kc88eN z?r<`#j4fAdWv-FMw(8j9Iv3Wsex7Wg#c$3^JAX?0*BsYoth>RM@+v9&X1=Vpjw9bk zMaw+6B*yrt;XOlZ@P($u)rA;mgQTRhWV=!IPOa`+&Y@KUEwZ0W^4e1^Jq#;JQtv%Z zI>CSY%c&$OU|t*25tn+G?nwKD*nkV$!vT;bTNA9-OO5emo1jlWUYNCBFxZ(a^Qen` zyhMI8Ov-PMgEL)yBF3_!L!STi*j2?}wY3hJ#8)xx-k?;}DTWohf7W7ljIKO8sRbWe zc7lX_2SenotsFx4i50UVv!Q3)AIEStW>R!7~g416kwz=#4NQ zXO5LqBu=$UAlJr^ea|HDIlA@}?DLQC*%OeQLG~0a&cn6a8_iHe_z+tUeR#chPTmj) ziJWI)oaX^ApWF1jf=RYLCqSTLal1%2=z$ZXdVaXr2K#pOnk7W8YTcQF^ZanG>0pFm zIG6@nn}rSpHU;h6b&baMZ;MXMAu5xVm4|Xiioa#T~?ujod?53 z+9X#;ha5|;$G>YX3KvM=LrNF1VF!^w_zaPLiT%Alcx>L>La4JFV-g-F4TcC`8uA18 z#g~aNHGbb2gABA;W;}#-Ye+OAvZ|dBHF~Tr`)+6sOaL0^n-G6f2nhyu@r(Ct3x*gW zxB-R->M-5ZG!00QDmzbtJQC0yme6(%21hx1CD(t|NPWy_e0=iJuw>gTmzo4Nl(Bz>1;?t2+Ao+HGIs7Z=ktQ8+DhIc4p6#C*`dC2iwh&oL}5stXy`a1g=2N4PO z^;SbrHZBc#)xQwBB;*Z2Bek(Rutw{VGhxzVhNO_ZZbwK+AYCY#7Ay1UxW9i0DFr@! zY1rv*6nc>gA>PBqeaU|-Aq6ks4?Zm!w+ij|t$9AX#z9#A^d2vmFnWmsl3uBdhsch% zj~G(+Bo+Mj0JHu^-R62J95G9`UiMk?F);#8Uet0na;YGhfO~t+?n957cCxS|o)D!m z=j#ZMt3RntPb_Q(*MaOzO5uF+@Xf?ca%Im^$H=u5|!8XhHBGdu$ZH`8O+*jq%2conJ1%Zziy%W z6JCe;d2j>bLE6Mm{=A)lRN$loy2C0bWauaQU>)8$rCAAM?@(&-@A8VmNxWI$5~JOx zhD@QK4#6x1f3n8zUFH#9S{bj>h>irMH^4<#vPoILpaxT;E{3ciicO7G=5;Rv$(w!f zHCtLZqCNQ*mTaW;`DC}ML@cOlVpluH^8wFsbPfcGrMoM<4x;BIr_DJqGP4wW#5hSV zwCVvFs~&87NtPwOvZ8R0H|ymvw9Mv2r0Ed<-7sdkYo9ruiM8SMu+_)a%B{41g(V#L z^QX%;q^rh?EbF%pS?3!Hd8jfZ8E*?{6OfIE2B*D8@T{hD@&_avKN6&opmL|K8~@vZ%BM!L3aHbZV!I@D0t3?f7C@w-+QBjj;$L^lMMa+->n-J=fK#PgIeY8)Hm{@#7q?<6c-0yE5w2bRkH3+vf##E zn63Qe?(yCpQhq$wXCO%z7C6)Iz)%=rvkK&f2>HLYIO^Cr{{8o+22lYOSMSpU=EBQnY_zm$HlvUqo!p2@gVpv zmuq0$AHy%*5pC7&?J)OuHvWPt!cI*Mt1#K3jM zsXrT!V^Wflm^(g%cGn2!EF*l}*pO+?E zVHR-!SZX+0CX)Mf-2t#=_YRgFm`>obfWJu~lsb_O{nCw@wL&+SJV1g|!pqz!gPv z<~EDDvi@UV+WiIfzM2_kyI7*d3<5bU8+qrGPPxU>qiJBK_xjO&Eq7wT+Z>63@9lTm zV8qFWo7tl-3Z0Zv7 zJlkF!{qksOE%|{~*@5Y&0f%UGt*;^`4YrxZM_sLPP}jP-+jt7w8W8s_ZmxyDF;P%4PE|E6oO+krqssk}dt zm&<%kgZ`~?D0+-_U&6G%wcOosd+PeBuxL z*WM`|F|ro3bMBt8Nt8`Q&X44OU5s8CjS~5d5^d~882ajxkU7%{;1@8N6Sa-JgIk^` zh;!}-mPM!C?vIxqBUq8}p4Rp0{B>*oCte2>%lZB+)??CbG(x1Fj3|(8={uj~uR{Z; z8=@287j+h-3rDUzNKZdT+-KUK!TKh_ESY-+OFCq|Bkpe`LnS*s41RwmtIgNscjbg8 zNih(nBI(o-Q-kAD|4r81d3U z_=8{r;y|zNd&wn)%`svc5XcF|hC1&T;{N3FV_Yme0$P^92mXn?G|`|Inb-KEPnk4hDWh?#s}rcAm?#zLyArWQvZ2yUNo3}de?34Jg<#Upjxt>A#wFz z8OLo2z2%M!;F>O8ER^0J3qi>oTLLK9fQr7P9cMc9LfDdmK@7PfZ~t<6G)7H>&srl7 z2LE4#r|3MsFP7fyg4;2m*QGC6E~4%_AyyFY%3JN`mcg4mrxXf}f3!lf*~XZ~)?PzC z553Ufvc)z-xD#e-iRTUekKas<0r~$ONeuViO&f9J0@t1=o-U5H^l6-~{#pOUT7{N6 ztsXc4@MUu)K9T_Lgr8d2k=x9UhyBEyguVOAe?gR$)bjG-=}tP1(Duf>-=|zIDeT}j z_JO6Juq4p1l6(d5A~*yDq3)|b4VqUpCHq74sBg==Oi4MMCOAO}K2(*c=RlB2}kSlxqTZDv|R{iYXH08EjSX~gZ zXlO-gUfo}30MKI~ts2xjxjgKyv%yO$vgYTQ8msHO^tgrdTFk-KLS@97+{Ff6uu)#)s-S471{1>n? z2xw{iMDEM^l2cNIvEk28Rw=Or@871UdvF>!b3J?XsHKbGgqceQlqU4aZK<+Z7XBGs zn#=qWTLQ}RDWW9{loPf#&rxv*;A`IGGqyi@OP>1!>l2fyAgaYtQT1$^;ec&v>vv^k z73}cv+VOD=0CKx#XJ@Ap>a26=q#+(@|401fwy0_-EvpJ0jsdu!5Fr@zLS*j)b8EvX zwp*``-RVOt#a;{mo=&%CHm@HmYQR_3o1K;#j$63yZJ5~ZD-|N>$aBH9q;=$3(`rN1 zDyyrzr;3!{*)4Ise-XOKB$cn!db?kOm}QTepP!!v(x29r&6cHT;DxVkfu4MfeUnKC z^2c83-$<=$(rp+4ydXsA+X!Io=8=CSNr0A+nb|9~QjLILzm!~#Owfu{BG%RnWHWg1 zrSq#NW{0+&wsv+n+*2@BpHiaeB1BU?319j6{W~3Een}a1o)<}&0N(*fh^W`o!YtaoV5i+cGbF%mhvL3_MkE~cnUS8tUeY)CFoOKs)cp$hv)<4@g@M) zlDOlPr=J$59oU-dq(Q&Ew{L{>vHAB94WXT9GvG944)OcAu#_-lJ-W7QOFmpP~ zJWoIcKj)*qc-YP8)e3uGCGj8ve^=QHs&2{oLEA(hH1mF&p)Y4Vd6FVby# zc0S#s=kXjqzFw>aL^pl-l}f2Oku~@)`dgd4>J>GL10~J1>9p2X_wr%|L{wDp)XFf! z>JnbYQ1C|pzHYq>iBe2R2ol`lfprx39C?KNf7ApibRM(VbtF85?yDg17Q{gyZf z3Bi4Ba1^6_JK*i&+)2nRU&?;DY;WwarV{b!tuD!6<8h!DbXWSpy2?q0tX^DS!mJWqN8pVx>!W?c37EeNC+J8=g@L@Rq#nyf14 zC*w{67;?g+W0P#4BHYsHdC;S4;O>C>p^(IJ8G>N}yz2l>j?bUpJ6vR339!*>NRZ0v zw>{@oZEx)dAwNtToO%!MmH2K)>$Mii_{YgXZ|u{Cm7%_`WFH?6P{>-6F*D?+1nmGL zkSu)c;bNo@?s(;0*IeYoPwl}Ne*K$fqh(jyCguT}UA`V%-xSKw$dbx;H|AsAXBYYp zVi9uEA~9Ap-Lb=qJR$xg3>0G05-{N3D@O$cJq7UE_%nbz^K{0m#DZ$gFW9P}{zm_8 z^Ng_~Z9Go<(TnnY!ad5G8YP1TI{o1^mTWbLOnsFYO&PzEi(A_7n7!bYG%iPA(&dNY z0S(Ou^Vp_yFf~ioA485d(T`?dc8#5xm>`(vdN5-M^m872Ibq{%E$f#eAfr5)-`lNb zy54QzHMA;uUxbJG`i}cZecs}pOEVG#e#)b8yW+z?i-l9CSe+fR>MO9FpCzgevShm2 zGvt6&UNLOTq#zh5K+W`u9^Xll<_nzHSE&ezZOht1Zv9(dNov1z;lX*SI;N>TMXo&g zs}9NG)(P=NAOvtCz}jZdSe!~8;_EbLMpo!&>YUhIU36siryeD&cZgxH*_a0$1}fow zRat9UHplUMiJQfo328b!W@)bDl{Z`-oxDBSW_g`{^!3MUI?)iV$RC@t4sWQ)^_f%P zE12AF9W%(^IMS40o8pr|I)BO#b2-o>SkCvojh8W`O3JI%iQZ7c=eT!7{K<({No^D5 z`>I~{RR}P4U>PpfKQ>7_tDod7Oq^MI+zh=hWY>ZuJbg!HB?b+c6h9~h98Dyh&Q83r z@vx>}(zUs$02uFM&1(YQ5`wt|(7Iq=>p4RQ-uzAewbOy)ix;~FH-YbNHUI9IDa~m! z#HFehVqGfejdmif4p4VAI@P)SE7;4hg_qd1(2WjWQdQ6xWhvb@TV<*F!^XZv$U%zu zZNd!W$hJd$P2t6()uZ+_9|6?eIvw*!mm2N`%~r?t=RQln+%vHc2OjQi)+yM%Ho%YO ztd2NebagKBhRJOT&j@`kRS>|p`Mi}J0i@n+24M;K1DfNzLKdc^f<8i?};xEMP{~&qf^QaFc?2r}%>HdBgi^LZ`jt zdaJB&D}9pn3Ey}d;T@KayvMr$Oqg;09`5;No_{XKw_=f|5>s^me)RosY{9ImC7=+4BP;x{; zAGz;s2NT3Uc#Eub4miLK14KJG}1%ENXdVb?);78auQ}$}pd< zY|*Dk7|CqEUZ1db?QJU(FAyXYLkZ^l)+@e2RT7ikq-oTpjzw2B%6bLNKV4rWVL|S} z2M_}!X~(YnAu$=AR9OS}=X=HKavy;pV+W;pK0WvX8i>I`JG_f)eSe@gQcg(?`;-vNglPiJq$!{!3W&PWp@A;Delz(gbbBvB& z)$l5=q_W}NK+R-W=j1fzHoaViK}X+vlMgL1qO$^tKlttlf!aHUoHvx!eAHm0H$0io zlV!_kQ=6&Ia3OV-%^d40TYOc1l|1R(c6gq2?(#88i_qua-S}yN8l~6{x7;%g@H};; z%)Z>A#wfob{vnfy)2NFjQt-kZjd@goAGjmuh``MdA^GZjqQTFxRuMXey<;;h$n|P~ z%q{T+1aP92;5P9eoF9Ag^h)=|w_|O>JNu44jWYr?P}R;;pK_hMa@+XaeACT zAKu$XQS4ztxO`8)`*QfzrJm?B#c$LQzS^^f_1B|_xxSvqe(+wYWoRGuHC2*|KR=e2 z9T9c&-6lt?5%D_cam!}$@b%sK(8#3$TgV?TP*F&B;8%fOeFqZM%bI8|sJ`Vlkumd= zWn=C7t$4Su+?H@JY8s4KU#$Uz{9UU;l2$+y=mj9Hs^NFNgn_3rVp3rVBnG*wrkb3V(Q_O`)Y5S})O=@p)FN{nPx0V8}}a<#TT zE`WTvh`)*Gy`=hd_1$FmF!awK2iYtEa#K^&4@D}_dIc*V&*T92omyL;_&ma>tW)>b z9CK!eFl{#>1h@=880f9bm;YlE>xh^F#l=jF{3zOUvE*qnulmz}K4_bC;D&k6ddh-; zca=^b0_tIl%YH0=Y|7i6{H%)qTo7-eWkukKN|YZ40*Lk7%yoCG_1b{z!w{5Y9el*q z(XqVhfkr^36=c`0yn`4RTOwY0X~lyXG*S}U_Eu=u{7`b`p$w`v&&nFaF#;?(3T}aIY0XyJWGjIj9Xb>o9%0Ny*DtJ%9Ovg7j$!7(y%Z!r$ztybGq_w9sNj|<`JiJ zE?-`hMYeQIw3f$hal>);lxqvhoc_NfZANB3-}xP{2q+<#o^ zY`5?mpvV!4(G>-2$~n0q*Q$@sMkV2H(*g zRLwTQU8`JVldVJ|%xO~Y#AY6CV+RFwGKKd8I> ziKDNxdjWdie-WX_*xREi9}OqSl0_(pD{1+bB{C2pXlcLMih2=c1iv-L&!?z|dCCAcg?zvFU z9CL*U)B-c9RmF1BxyNJ5cB0mMV=H_MsfhS z{ol81`cqz|i&8Svw!XFIy7l1xt)EwZ%RTh%Sx`;4wbIPw!mfN&krl79hEl+?WW`2! z5!?rrVv)mnQV9Lx=#qS1ldEA)L5p!-%~Tm9dPAM1H6l8ZKS-Tf+s*Qmkd=)p8nPtd z$&h!~UUUOu*MAR&L#?XOP4~npLwEln6h<+jK3GXc&7j+;tGJ}P9d^CP@ka2?l)oOB z(?ir(&T!=16`9q_`1GZEuusYQ(z2oc?WEtss(IkLjk)4(U8qLt(7UOz>B1`e(wOew zfPMA{!D#2Ofgo_c^RgbEjC(yFHp<*fvai)v&u+aYID5M!P>@LTCpJx$P`*e1?E|1C z9h2(%j~h176*%yR@vH;WYtpBC3&L*wHl+4tdS*V2*9?B60RF10P_Vp25F6Q2k|jHi zW{e}Oy!(MaoW%kGE_lw2g<(EhPh%H_tDdpyrpEQ&{2K4AXDuNp#RU}#%IZqge3s59 zQEa{7mB5Do-)u;1Akk4%<9hE-{^>f1Md~Uj@riF(Xo^$)_H--HM7D&Y2p=J> zN>|?O0i%LA-6hIb^|8z1ef6E#g1~^4%qM9KU{M6Cv#Lg5qMjf;f%gC z1zDzpZY;nmAGAGJJkxmp)8gu3n3qfuZ@%Y0Mt_g#6b=uZSIyTWf3gbtd%AT%oxCtk zb;;@dB)#~OJbeE_iUre)^S+sVF%#1H`1|hxdV4LH`qO^PV+HY#2kSn~d)i@QDi>FF zR_u2*NS8-iCq%|QzGd>k7Hbmzf<_g49mm?nT{GWRfCn8O>DSB8{GfBvFdz#D&O9nAbh%tLC1gSb&h_vTzr@hnd5i+yak zJJcQXs&8nY)_ypgF4Y<Wn~k7#c9M ztEy$uMKN^jTIBLNt(v*hCzZfETp)TpkM(K3p=;GW z!sZz!1#mR@1I&9|a%$K$LyE^m$$Q`$#Yn-d+}2ZciMCdPK+$9;!DyS=5f~bnRXa>N zx*{Q)dkhm$NIWTw=GhnL&+00n?28Ii9-nAiTjr*VC8?4CRSjR0_!w&7rvPqvYQ`2K z@7R~W&5fVVC`I>coizWxhm6vi(tvOYifMhO(z_+zDAEk!^4RAAEsz~IHspMUzVbo~ zhynPuF-18_|58`T$qVLV^8!^vA(d%Pd)8z^$OlFjN8^1VjknHr}!NJ=+IOx3=UhpJSkru0I76 z(cxlK7l~-7*Ln@3zAHkSTy^@JMe(E9R< zAwjy1N4E^k7Zg4H=XC#g&jM+I7fxoYO=1v~1;A{)y<57(y=~h(=Sf+*)JlanEs(LT zN0tqIPEIZGd;HTx%JuOWG4#SsoUmX}a}Mm5CtoKry+*nK&%4XmLzu0=JBNTe^#qRx6!k7zFz3(bHT*LIeiO6|%} zR|&Y{peSZ%;x8aN@Ds#1VRCaPYt#mI?|RD@N}vJE;P6wEj(JpM(94xf!D2N9m+b03 zp!JmN8V>GNU7}qLF(J9XQ19>Rvm7PtP@uR3 z2wI678=moGl&i@QE8?ZO;e=?3`8>S|xgRBX`|7{2JK6*YSH1&?&`nD_dD(d1=+mc# z65uRTH&i~hAIjG!M7oUv%xHyxs$Q+m-2Up)1sW-K>Pvq4{P_!9hCC7gN|M=@kYehk zUEC@Iy?3=?>=fK3A7+h_yaAQMo__S^Edam;+noieH@-MhE8=`(d~PG1#@|4cz}l@r89fU|Sh= zJJ>hQY3F8tgRL0FoQeg?WY$K|Tq0ck zj%G}ZiyAkts1lGp0CwPEqa@gy*%lC~>P~I}s!Q1pPmC4dN}Rg~>8SZ7&QC7mq$RF| z(d^o-_2#DmoG2(o7L^c5=KAU|>Ty}uYB_yp-@>%g*O)LggSCkgoSiPVE`}xC`KKipF$rf z^yNrI1(+CUmy3$($;#9qVygsf8!)|rh4HVsvc86pEW?JAyof_4+FB&uMD#T1e#@+( zS$VO$40R;Mj=EVXkNSW2qFcBo_{r_yC(xYVP_6-3OiretY8g8&?!~j8N5AE3F2EP( zN(03tsO|PFSN_GOk#r1n;>4KZjX>w2evC^Ypr1@md$;rZ2Y_Mj8+XY7fkj}7-)bP~ zE?Cs)ojOD?n>$GHWu0pz%RNHdA98*wvp^-kh zRusuRw^Cv*kLm=s&zMMM5#*1P%#k`ae3`}_HNIdqE)IJTV3FV47%_tla1lGNMgKOp zgR~hGApfa`q8)0if>kCTwgkR(Ct=OS2r-6sDOjRJR6-90ifa3j%XLSD0wwXe{r_)U-=!$-inEt zh%_*#(j$+|B5*t(IjF+@alKZAl zUiv2>P3jC#e*OOaXcs7J4GmaQn%S&g35uuBGS~9GEac5h=IQLkSM;U<)_OY*vNX)p zKY?b+g_jip^wY9LJGT43wAfLK3A;C@QJ`Torb5A_rJZ*ncY(GW0>}u7?EaOgLs;($ zy8J?k@uj;#Grp(a`qxLD;sECr({g*)6nz)2l#g(kYlEL zkDE9MuDaL}zcPQrT=umB|#uQZ5gLq4?%J|ICbi%O?be)dPAXEk3nBYu>Qmwu390>;i@^+ z3q&nn9uExZ1xnBNj$BssVjVYW`@6y!Ioi zS0W?N!4O*Oyaef|w2)!nGBk2>RCr(mSbD57NPIYRO5M+JckMSGcmuiD9gVQS`+`975ZyMH9j2&< zM@)!jTF@YCe{R_76PiXg<4F^@C5dOL56uON(G1dsBm>c2ouRt1%&s z$zOsh{CEvFiVMA7(L>$2$s8B@E!^5^mCyDqnrFCH zoKOd4HKY#u{}cM3+hHvs1YFT^<^$5>IZ*CEpqP1Z<<(2}_#{dce|t_ONN2?zGl=tg zd+}Xu=GjHUndH@8l?L;Wgc=_y>nS!pT6a1!@@v<03NRNX)`LEVSmmE zjX@Me#+iHA{=t{l$}NVyyXr8I;2}ORRq-OjDG)-3f1e@3C|UIRpo8gkhtF@?;(jd9 zdQ(iSY`mlfZen@l@wv+{e8#5LMeoMQ+#kfpaxZ|E4J;I4WjcQqv*2^(8q)E$`1XdA zmBtqqwapTG!Xx=SWXho9J+ahO?Hj9L<9zf1pzjGr_s8@Pc1MG1Tk0r;AC|zCZCmyn zIUM|MFRw;r+;DE?CW8zy?74;vt>G;QB^iHK=ocq;dHqp;KW261B`mH!l5(?$!i zxdazQ>l744o$3nDEiB>2$twWK0iO2!vT-Cu?E+;-R&k7TiAi@(Ab%W8^A=pZY((4b^Cf0MykJ%9CZ z+%L)%pR9OLMSDUT<@iW3(r$0XYZBJ8J4z@%fz!#ROeiWwt_-qFtE;QWJN*3q*pX6G zPkwp-BA0GvbOw|_d8J!#lk&ajN>%CA{P^T@^%L$DCVI^Q1m=7s9birE%VcsoD6TKu z)KEcm0kzhI@<(frb!LK0x?|IR%n{VkM8+=uv?uCe0P|Eis(&mSfW39;0_jI-KCAYn z3t~Y7+vW_vUHwpoKFcm&(aT|q;Nm5pP{h3WUM~9 zU2zvjYqPgn2K)HWd}3pJ09r@JV1JyLiBm3}(OPE!$Vda}=5Im!5S(YvU^zKCm6IgI zrq)54xFU5?+pvPXd<>pYJkqf_2fv<^7M?mRvh}`g0|#gT6q1h*v0^rmoO(uP%LrPN zL>&gQC?|=$Qc+WQ|81sTmaq!k;6*9og`UE*9qPLT^X``XC)y?JUWj6TvqQ0n2GE49 zdQe<4OWJb6Czg0CMo#9WuWPbM<6<$KVEKwP7RgZhgS$<%w9s(M0b?^51k^#rag*_cfWaC3~zLPoaDVkjmLP4haCNxJDux}q!R800+!awoAr^u?& zhWr>C+kFuYUBYa&)%k8`Fowd>6ri&n`G6m1=%zZLBkb4|&OoKCb=gbT`gG2Pes=I{ zL2rUOBo5q2GiHS+X?et>BbCPlQM?fy*-BXSG>Z$7V)#iY{yU7Xv za}=rp>w@j_Z z@5$H7+Iqg(l_6H(mQJ}qzR!ZK+I);+rb2(L)$0IMci<9cAf_<2DBUOOhF2_ikjN5sjsk2ueT_d z{PS9vuZY~vPW&ElIUBmh7H~v9J%Xy_110)o+Vy({_8+UxMzW?a+r^(g;N{Cmr6eX2 zG?^V{8)IyopSxswY@j5*(d^!zE^%~hayY0VOq@NNnSE_Bbwqrb^LV_}>U5t?_LLtj zS!g|_y-FHwMxnz=?oK!W!*Azih(YT1ZIR6k3+?Y#|27Jomkt#eJJ+J)i=_12@}x?~ zy!&KMswhSz`S{hGj=+uvG<7B-Yajc!sUALOQd8vR+7bxfRW|)iLqC%7Lzu73oLO1| z%`zykIB8$SVwj0zE!NKaawUOEkyD&?8(Z0?pu}F%Xbkm_*|v%TkSmgr8O^H@r>!Iz zx#FMH!ip02SenY;zq16mJb&|ob{KX_>4iwg#HE|X(^h>p_0dfX5!A%TNgPSz^1v93HBX37SGMyx$yRl~QdM@KTr+v=?9;@VwlUbxG*r-!$oleCa&(KlqUPd?hr5YC5`(#<=ISg*{hzLS zHa2n+`v!!W(LNKkYn$2EpuC@jCHuzuPVdqwP4Z$72P6V^^>A!m%#AymhkrDNgj%Fk zgOwRkp@DLiHm_K3V7GU%OJl`pe;KpQfS%#g+Z>3B_71{)2ttf_va<7dJx+Z6~SvN#&VUNA? zQexe|PkyszE~$2Mo8pE$mWc1Bd0OdepAzBOlBo1lAXudw+E!>_>=jdD*+WXhjypUdbYPg2HZeN8)*RfYGc^Fh>94FPk<5xBp(YKtpTT)ez8oozw& zNY4ZW1eV+uZ9&nKKR|s4OnWaV711}E!Q1qBdk`KGv2Usn#K1R~<{EwqI-PP_zecDAE@8w_DU>sw2=wU{eSkN zYknWkn~KY^DzvpFiT)PXedM=a$msK#l{J6t&4jz$t$uJ|Vz%d#Rx}M7`5V2OwK3Gj zUD{#W&YoRi&Hi`d(nah1s4c(vz@_zc8wJ9YM#u=`{;o8dlw8QoklnIL6>{ytg-iHb zQm0W60uG+aG>0>F3%WAr?28yJ_On+}FFI=D&RZk&V%@h?P~>>v0tD=$P%m?*4K`GK z@fp2ncw=|YIAffc{Q+S)whOtURi10V$KxS-0-G~XEiZVDWXOtA+z-L%i zb?v%7fg4c2+yI0@RF~E@P0-O@cdU z5wrr9^Mr$1x=#wz@C*6d)e7*SpuLtk)oK(Wg8{+IBqXGoB4rG% zpsu&iYpB&%t`rK=9?$y}PTHMNooUhazF)*nC$6s~_EC_M4pBb-L2^4@`U!Yic|AP} z1;Gb4KvWtXE!25<=@Er9KI$|Gf^wUvgwNCG8VZTP>Ubw*udC(4pfpA29dWy=wf3kh5DbBnV>;5}McIJ#q# z;{+g4k?7e~nhJxzkKy!JC`R9;@IXBz4-N%oM6BLbv+&jBYFJFo{ZPki0-m5 zQ&xHGpq*nf` zhHs$@{c1WH%?mta`yyPr=h; zdX`H}NNljYQ^y>m9duOlOyW=P5t@U0-Ph*DR@zAORY4);$V~T!7g_3^%O+|b>+wBc zlR1oAHJ(NMT&f&a8XPrXI~|yHt2xu4pmiR+@sQ*>81=mz3sZyqSre>RQk{*e$qVgR zPWluXk4M)uXQ7x}0imrKda=e7Oym$99Sy9+=gdrbD=T_cRn?g>aQlGL4Bv{2Ba8=P z-ns5iF)cDgbo*Q_4@5GzgVe28R$aF6y~E_g%Ge^Gs75T<=$F5WYB~&%yMJ}jvtUWF zYO$_fkWj>{$)$7Mz2)necJUE*{9WOD^{e6IpRELsW;cDr&aN&PB&0Bb%&yJ@G6y73 z$>@!4^Vbws^J-A1!R>IatKH|03zTpM)QNe2y0{xj84ia4tgbfR{=a92UR9e|!E=^AwJsj{@TcE&WHE201r>O1bhLQ$ z>p4dTr~)%I?#k-uS`Q!JzL3=8OiA%gv%q{ZQ+8%J@>Qc~QwX6TzYRt`b0$l~MZ-vs zuysoC#g01d%^2Z8Ve#zg%CSWgx-2$Q+%FZC zraws|96Z~!4LpJaC0dg%8paxYX(7Ypf?pD9@;uCCP@C0gRw=lQF&Z04WNr9OUR&a> z9SzcOj#eWs!Z4+gj+EmfyvU$i(=a0z-@b_2Gj{z9JeT-H>znda!PmniHb_H3!7UZ3 z-EqT8B&k~5U-gVI8Y6Q=DdLc+5WjXAJm=+2tF2}GH97fnY)sJHEJdsA)r%Lwt*v~Z zDESO<7YS_qK)orjSh7v$gcd>DF>1(ExA78rzmTxO%FE07Vs$lIBbp`C|cL;`+*0Y!@^=04`? zP>GpjT)OV)u2c#rL;q*Hoy<;~AIJZ1s+k+vPo(G6KjK$c_!eJPx(yAYfVNW`CT`r4 zEFhR7b#yz_{$bqXZn>4DmCDJKMq!Cj57*ej<+QjTp8n(YfWg};&L+@jL*i-gjL?Yg zZt)I@E7SBfVV%h!9ry~%&RA}i@tz&toRNIz-0Q6t<-K!6`E6CLq!XS@`y*}87%kYK zqkKehAoM2AB^S~*(VG+XO8{vpHiN#dU5_vSASkp_NP#-A^*y()yxnhZXXRdTS*VZi ztFEIn{4<_bN=61+$|b04{7%BWueVnN?ie`xg|42v26qP)9i!i6-6QBpyynutVLUTE zCbR8$Ut3#y-YgIN@`{7=B;Yrm0$u)>uU~sXQ;DMTV(N7IeO2GR)D0wCvfUmVH4CfX zx4ha2V22v9FtEAbE{)8?)HU;Ke79ydVw-&10&^N~Xq}7^(tRTiRp#>JodzF!pqzKj+cbRn?S`?? zherzv*XYEPTTK)iM|a2CdHMWm_yKvdB<1Do&G!;g6(j14>BIG3e=3%!E_1w0=XwPy z>$;;39{gY~IXUA-eYa%8?GV~Vi#8vxgsib&`?Rye-KK|x{_T^2y#&11XI%|BOIKX8 znn10xY5^0t!qUmp*jP;0`TFcuexj9Z>!Y)GXbf)xJ|dNc8mE|k+j3#-%jfl$n=YKp zvu2l`Po|Q1l*v?mnfQm@CBqUZRImm{DT4ieQNTS;+=)8s# z?e9JwFEz2Tv!DK?&4R2Isl@quAob(NPgpUR%AD4+Ch%RymL(#4BeiFaemvh&1-1Nl ze{#lGmS@x5pCvJTial>AzdPr>d(We3;B#_VxSdB^(L3FA_eBW!Cwvz(6fv3f;`X)h zW&B_eZ@JTv$}<8Mx$7B93wJ{lVjSq&dT+6X@zay<1z~e{UT2B2e^qA87A>>_~}d{Qrph%CIWKrE9PdK?IR5Y3c5gmX_}B?k=Sp z=?0~d?oD@Wy1P@lyS|%q-gA9F_@kT66LU|jwPt47UM^WpZP-eGZM<^&70*HKq)zmY zJ7naQ^*2A>z1y&se`~v>rmoK6d0SO2DXFEUl~L>H;6Or28FGE?vbMGcM)=git6bmS zendwX;pc}1wHgT-nG=r1(a=@TnXTPFPJhXuX0uV2@|#ep{Uzr_(n9O1E1S;GVmzW} zwX1zP^fMDS%Aaxsij|J`4VmDCW!*w4>tR^&HV`R$bh6giUwk(6V>6108hWqJWo~74 zSiX~!`2{psXa$V%xl!qYY_MCD0PK^DBKVr`8(uBoKBeiORwMK`r zcCr9Yw0Lu?O}3D~SZ+Mu+}dL5=BS;&P{f*EpZo4A{}8vS_Rn$c)d!n;$dr+(XJz`J zdqqKk_2!N?bq(}49J{7Q|IyPKPaSFeK`L%lA{y$OtoDLNv&YkxrhgaRR+S3wXRDXY zT95mf#cutAy<61fJJ3argGvn+Rb zO055_d--EVbcZ9gPR{-$-XTr=Yhy zA)H+4=Jqg+i?>T}>nx{BhLAvAa{(z)Wyn(O7w-6Ob4I#u<7~@*8+jF}<-Dr7gFr~j zZd94%HN)>iLp3~=kF{xaN z7oDFN`KQqBUvXsgyDfgdl z;fDGIue#JbF9+3f1u}|XALXuB?S@~w*Bw_%kXKl^k*NAldeonNnvdLw)>P<_z==G* z9^Qhr>8N-WFCA`RElzmkX}%*?X5@v~KV&p>=UR7pb1g8_5qACkQ&;q&DJxaugCgU& zp5T6Z)Eqi46Q*P$+Usg@!?PcBR|Jhv(Q!d zz-0hZxCKb#6Lvz)fqJ3r*}{Xw-GYpO#sY2?c8NN+HiVXeQ2ntxFi9jWJ-~=3d@%lL znypq%yY^vP$ywf-e$=e&m7L2j&Q#{X#ngoR)4?CgL56O)|mrZwvW3k%!X)urmYUsAH| zTsezwjgFUGw}H^0vl(TbPw)SER+>! z5R8nS#C+xXL!(9_W9uN9|3A8EItd*&jkl4FWxh>N|LkqW)BT1!Rqy$GtLdY}2P?++ z8vT(qD~VZIQ`p(|JHI^Ly6!Pkx^wx!G{N?+Sy*f}@J2Se0+rAEf#Vs%Z?;9hF?b~S__UC;2U_@@@2AB@_2u)H z-ucMd&Wv`2V7@*nac#61gPkV*!nan>AQP6vFQulL6-uJ2j>Kryg9=l-Uy7}=E2KqT zrBGQeXkOlS9tYakjUaFA1%Qt4pUqaUZXs(&o8rGpall#uP)o1v?GVY^!SRCylVJM# zvx%gpN=ivdfuQB=OwP(05BiG1(97eqJ=Z=3YcM=jwm^Xg6b-py@8ffYGc&&UC04>b zx7~ncfD_Zx>v^B#3$S&!%Y)lk7hW1JPS_+Yx2IKI#8n#^Bn^^~lAg>OXN->M6fod| z+y?LnMGv3V%;8FP_dbkH=&h6<9p+Ui1uA8287D~Xf3!HVRx1w4D8gJeyvc;Fc1E0% zUr4@Iy@^ZhD>br!7bZKWQ@Z&k72P*$_iw~c*-?+5jyUQ$ z{9>6|5&=086=Cf8g1A|V+H8tOZ;pNUx$BdFM(+eA*zm?4dY7>*qGd`m{~?W#wmow1 zV*{&;lcQ5Bh=111quDr#UIYM7U~!B$AkdDy{D?$|CoUIzX>UV4Go6+h^5*Yu@|R+> z*d+vk`)^i5NZcOllK3}QPJeeDJsO#O{YHOMCmPK6s^s{;9}aUEw?1gxS*hnHHpCyHV!**ev<>?Hrhp8VytFD}VNC5*f~J&;_BaJ% zZ_1MRoY*p$?EaoaM%fp0`Gv8{pC0z^gowL0G)RZel=6hwp`;@{BV&1+&JKV;-C0*Ozy%Ycak4hB869MuW1li1((7iCI|Up69!N zmm-wF80cve6MumSM;R9aFZ**KjecxN5SBWe7$@c8i<#nbR=`8+0=kqHIqa1^Xc7X3 zcLqigtL;^RziSU>`7?TXOzRx`=l>BKX1lY$esqD|agBokPe`+v-+o# zWOlM&6HI8BlJ6+;`mt~hLq`p^&S&cn+Ptj(slCVLQJgbWw{|w}Gfyta-@Cgw`BU`~ z5oDaV?sX0g+7gydp`jOZ>OuDK$F}PLhC01AZ!np_a=A+}_$YG6WaaRC&+UT~Yu zwlZ#f{IxPOW5XAbO8H0FdTsrP5#oGMWi`D=!|wEl6aud+V~gSiJ}UJ1ILhx(ETVP2 zL9gH8@pkw8E0vkw2e4>NVS?rCk`200XH;=fnU!SNSV@{A(<8wp-^O%wxW2k)ylPW( zDQ~JsOyE7eROO)L;m#OW8^{E}N`td>3p)vO*UQBwZl`|kl%qJ{A0NwC>HBjd^`H~7 z0E8$+kJt=dO!}nAdi*fzVbm3=v%@@p;EXqH+~JJH?LIt4`_s$Xxxb@(OX+3aX<;HY z)+q*Fu#(nqwR4e*cYmS1g+x51Aq&xJr{a4f)ku=)ZTDki=Bp)EDy;r8e=K8&kESRBHy8XfX`t1+JLZ#Kcy?(%0%~YFX z)Ya8pV-DGzU2H#ceA4^P?b;)tb+iA^_)h-pi9WGsa_>Ss&yGs4Bzquo^702K1w}Ae zXaT#jy4se^VxGw7?NvIcKu1De(a#aJsAcXcpzyh6_xoCxmIse!QE4F#^?2)EvRZ+8 zRU<96^~%zA%{e4e$#WS8XNskI`h3~#AENq)v>n?A^oQdHG7Q1xB3t4*T88v#wv6Ao zfBajTynlJ~RN*=&T*}d!#f9WYEyXIZ*yKXuhnt71>hPC6Gk*XI$>lUXnt;};(mS@Cm4Lg2c zkf5}u*ANVCepO@GF{Ui;XC*g`NmuR)*@==2L&~h1{1%h}_uA0$Q|$EFyt30rf}LTh z{vK81=%Q4#t_WgRaMBv@EZ-I6Q5~N-{Hfp<6_>|U8whX4}Jo;}O23TeCPC-yV zOB;LJm3YN<*TVu|=^#f(Zj5ZU;_YcTa0f;Q+riBJhrNM@xT`mMY##JXH zqM?CvZB?(J{BU*4z_Xb5j=5By$B7L?bWfhwShRRhO2j_2P3@{_Qb)j>l`FrlOQ!&# zbbNdyn@^pu8O^u+$?PFckxf=( zXuOzG2mL=rtv=Iudu4e!Iim{;R~FP@&MsJm6dW3=-|h$R;(oQjo!`Q9(uvB>anUrI zgv>VqXdq!nN0#R1W@_~s#4>~867|{$&|8)a00nevl~%BKcAx7z!+vM@>Glm=g0(_{ zf?-qXqIZ>={ z{^o-#t-$fno4vcco10{)OZ}V{7(dE>I#dhA9r!}VI1{?1L=5HFoJjTTW#!T(2_*}h zw|J%^q15?*Kw0vkHZLk(UHJSP!S_$%e^Z_jG|w3P$`>&NWv>?a=F^15rLoAlQm+8r zY^;!vVZIef%Geni1&goI!u<2e!z;FL&ghxk8DA54d+d}WX1pRPMuSzS2pHe@T#OK_ zf&=Q`I(+>cY_*uzgA&UOl${8gp;5+%s+60uUB9aNii7B`4CbjNcr~R@ckFyT7ZWk@ zIxjnnzkDgI^h&p7J!COn_-5Yf**BwOr4iLSuT7f8mdu_itEb7=I~@*Jn)dAdMf2F? zRJ3GtU3r-F1RGv0(52xC_a%u(+xI~!YNTeu;IGzeYX{1^8|DD5b+$2#ak5<-18x;s z&`1e@#@Qm&mG!;~tgPbsLm3*q{-5JD+iCLBcG4WgFL^LAuwYsZ?XyfLaa_*|4L}~V z&#S6a87^)p=Agnzn%SRmko=m#!+_OL{3WTzq{K!$@$X8&Q1?Z zRG(sGKta)LIfsjRHQ%L^Us7TO(ij*G=S4?$&Kfuuuv8+E)e<`p3GW$SUKtf7IG7$2 z6VS+)B#TkaDo>i?{Ka>@sZ-Fi$l!Y_Fde_jYuNV*#5IYpUw@>Do_7r5v-xOi^2NwB z_pdxynga6WdcGmPNJ-iFPAY&Ud9E~k{-f_g8lJ7w#7HI^125%>QJ<@GD&8IMW5k|T z6MIBgnvX}C*yUdc<^iv2>*0D0YzA?jIEUTe*xv8fnIgAkuGUCk<>1t?yd5QYvu*XA zE*h!SZRMNe#9~kinjPUW0M4DjIYl-}H z*16_MFvS<(Vv=-ZoC68Hm4@bC6?V99VuB-`vgMa2`kX~iEowli4^Us-!|RdD6=?#VN>ef4it3Xiz zNJR}^x;NgXm)RlEQU0lDx^2!QR%N;f{i*9Hz#u_)GS!mR!`RIxuiYCMImm(}jD#JN z7+%H)lstLRN7Xiq{mE~{4_A@`sdbj9i=(QtMq<_7qkaE+NT%c~+S)6f0LsctfE(-A zB|^Wfx+q}{((pCjRfNXG2kA)Q*-P-)OL(5?@YRN{8BNa0hE`_9!&oa5xvLE8Fw3h> zOX|8lv%(wksh$a=6}372IGC?}TKUnSRSLF2Z^KRMDi=%g+Ww1?J z!-)*~iQIMOD_hCtC97b_6_~U*hMFH4(+lWx^QrT2GRP(71m zR@T_>Er$f?;aEE_Th}O1G>vR9rE+Pnl0FotKtZXsFHQS9vj)o;?tPY^C&WmM8Z3AN zuXQdtUxzW}gm?a)nYwq~!U+xN;G)Xgz@b^RTvM}v5O}xnMP1eA$SF;RW%(xeA`@_HG<@iT zXZWPSN?t$h2#BGA;ky(Tt5=oXj-J0?ABO^zpkZNrFgTDiuD!u<(vO#*GF+rs?_iC6 ziuSN6aB%Z%_~_Q!uLaIod-UPj{o}^=5a9JVj}H7Ep7XWsr-L-!yCF8~80^EBohFR- z%$2c6kz18}LcEHO+ulr>vW3s;1Pea`hSg>uW+3C9IrE{4Wc-d>WhQXH0Dod{?3QZz zz^z#r)hH(c!<&~MAJ!;7cJ|lAVk$%5x@InS!{hdW0u<5fSua%RIeh$M+Tkw<5+ly> znC2(VSPGSj^}vcai^cjlFfaeglz^`W$sLSzdIm$gx}tvlq9@61MmP~P1llmLXk@~S zg>At`uy%G2=uoJ&n^T_&J+O3-OfvCvC0*yQ>9Mg)htz{VU;2I+LI`e#(*im|Dqvka zen&7MZw(~r9}%8&0mLVZZD{LpyEa-|tp|YpAe-7w&e62y=HYy`#QCP1Ygb|iqY?{% z&G(J8{dhdPn_KStgDD;vLaCUr<|9E5Ab zKl?*wG%HDJrX3HP>hFyHEQ+O~h^>Vk%ID)ZT8Y&5clb8Ctf zwtic6Sl@YlHs|aBq5I%>mwuI)DRO;$r@obT|6mnA`_0qo~p!zZQ|Q=+x5rl zah0cKP3B$1#tSJ%+o;Dd97}aZaw5n>@}_|jhq6Q8`K_G{I&>DT34hpt^=uBK=Vlxa z!NO-AZd{z*?eE5Zd1F%2NcsV*`~A1e9CTggq#GS|Z26uy&ILVcKvwe@n|apv6$fjh zE4I9CUxI>!r`G2g_6Z>J;Pv^>m(#B! z>neRh%1d|_Zi$g2SSANw3guLA!)9=@`W2M7NroWRf9Y$}=vAPU7;FX9YrIsgff~T< zfGP!-H`0zb>Gh-my22Tdk->jB-H29|eMT$3W)LV{HPOsGmU=%R#EExF&^2|YIWNI~ z1-p9y;09Jy#ITr8!Hmqzd;`mpo>AJ|TscL>$?-!=fW_eBL@(g5BU0*2Au40}Izfc1`psT}slXJ>o1IE1uDU`WEKnI$a>Tv2uyriM|afVA!V zz;Oxs3>toA&FQ{cxFLE{*0(?gp4;PJW^($4^=L4&UaQCch+riEZ9Nf{acy%Z!_e`qI5Xn%y;q=|@ghm+ zMt^Bf9@e=y`}4lyP4jGqRN<0cM}>pgD>bRR$dx#Rp3}uqjR?c|a=M&fqS|w96+2OW zuia$TCcm0lp#kw!CR<_>I)*?#SYuHsprl)!(=t3Oj-^=rAGOOwIpMXNnmF%5717Vw zR6A@3H=u}2jsE+_h%~HqR#pNiH+w4kW*iwaIN)`;9k&Hi?1Qm)!qvcbr7t9D)SsDK z@rnTtQ$`+>mBSs53{G9A4H4`WK|VO{gU04Q2}&%NrYYdP=61hP_u1F?Eq2`R1o)q# zP~go+ysiF=;FH9Gcc#Xa>>&LD^3Ckjl7Hp8mSAD<)6G3*sU_#oz%@!yI$MA%YP*Hi zz1x_48Qy0=^9&3~f^ASgMosQV9cQw#vUWa^pa?i*j_=G=nWDlJDwlS5WLRhB8hb*svWAeNxc8ZKO2(KuZ1fuzRgqEs0fXLWcl zQnT-=CL5%J@fT-d_mueF7w#YPL{EVf2nImEHV>z-9&b)`&)=Zpv%Crw$3L>`kd zcBUKz+K&Q7;boI2F7(UR)1ig|Q#!~X8W+>pf2no;oFL*%iKF+)&@xjGRLoL3=?%Ac zxvxHgQsx^CLj^8VsrM@^f7DXlx<7;3%gyI$7lbdrf(inZUSR}yy;PAUuXOAr z>76whk}&wV#69Jyj;y8DABs&iFE!_9eA-NE3h40Ab|u$=YW+AaF}bX*bjR^v^th0;udTyJx%0D%7M43s{Z zZ;7JfI~*d7HocyQji*uX23n=wt-+K#4Vfl=yh}jZYG`_^Y&9WwOy)|ZNGs!(x;hoBL|i;(zt@hIv@?SN8^-R90?bwnb zK6xpq<9fbzSG%Sb3!Z&Od_#Cvy|~r!`eAR6S0ZbNwh3^M>^@if{jE2G5qRK9WYZ;a z*5s(3CkX^J-s8!N-DATJX5g5_mm-r^3#F0#$*{LJ#_fq;K~6NJcH7NgSgsN1d=|66 zW#*pcvYDyUF4zdXDkVU33M{K8@|_*+bk4t7Z;|-fu7~*14&o|Ox@-i@-s^Yp%SkJP zvIQh+VS)rP%$+0KZccV}B?+@N0_U|6Z4Aor5$~~@(+^I3ciqxDQ#yYG)Vrn`={VkH zqV8L3(+2<|vXUB}Jl0fcRnCHPKwi&Bm7O&8HEKtL*p5*IRAS@fEA)GiU=ZKDJZidHay`l_21|&&uDB>>N#0CkEPczY`fE#? zpAKV%Q?$;>#YN@TH2BiwhM#~4n9%WPjPeC!2!LO<jRX4 z@VF>R+F6?+uAww>?!ZZAp}ckL;mA5k6cEdRS^#y+@#j)4V^p^Wu9Lz&V_jCNSOqpY z*>TCB7A{z=5>2!EVez+{9pt6^;~cP(csK(SnnYp8GcV!o1S7M8h*Z- z(W1fc=!vk&BIO6?DsCg8a+CHxf~6Xh1V<6^ZwOKwgEt*`_GpiIdQ$$I??2jL_~zzk zw%yjR`x59%GywU$%aH`lWl|cl*-^QM&2Ea?&2&bKwPV?*>Y`o|J?f z0^ln9VV=hGF^MUiJ5A@s$pZ$^G>`-;>AS0=y!`wikW{3mrh@H?WW2oT;DCX~7}9)l zAwFntug>WPbkQq!dXK~PH2b0{B?Sj$irWjyKq#@gy86H?LO92~JM^XrEyuk61jfw7 z!KlmkZo51@@NHZdKOZ8WvGpeqKbmu20P(kQD0;ccXr>h(*vwr44}p92%7KeXIOxyN^78V+ z$cUFc?=O}GWj9pJd$^mtN(ei?wPZCci9*Ur`Y% zOQ^o7hFrVWb1-;0zyQp97U0i!Q__2k9TGv0K*44A&!W|H3W9RVH2so>9%;qFHasm* z&)dy6_(M(337{lc9fvqm&~e(6Zy2Z(KLz+IF@bx%T-n{%Nn`W`ur|2InMU#kp0g2g z-G0%hOlCtIm|@;Ki_$hH0J3FxoQg3rF$IT*$5}XmEX+w!UOvmg(2|>EEPIV-@!~==g4s&vvEFls25v8~`vk-SN*v&QF0;z}tXnwS8c- z+YMM&I1HrmI|?7B&8CV}U0hti4(cJWZuHGPF32o{(!swt9KPeznGQ8lID`q&+eu=I zbu1FIVoW(;|Hy!gB^94hw`8^+`m@?b4iknVkBU87RuA0A>dHZB3_}V{%M^wrV&$2M zkheM$-y3UZ39Qy>R=lHf0bgW3B}ZU)%~G(`AEGeCTbo2X9z&=qe6nafBj~3_CGDaBdYT8K97W0(D{)OogM_#5OxP+?7UvPl=w}itN{9Zo8tDm zJc0XLFT@aX?Wf0>#O`wZS%&B0Qz!;q_w;lE;9O3?`Ho6W4a-!a^#Hl33dDvG1~C77 zJ7v#V)emz^%LCl^@de5ct>cSO?ENBB6Cm>Fw2@cLd)X?p%Qin*ZwSxMsS;hIHRtjv zrta)aittv3-<2ohVCa>OoC7jymhV0{(daTzP(w_+Tw2F)*65z*&9_m4|MY<_kdDIT z@evC#k|xg!5(@J1P+j#ea~4W2dwVfJ*Dq$?Eh-9JEfq%C=2qPLX1hXa3=mZVD=kXL z8H^yVYrI#5=~|6}8DX3Jt{f|_DT`e#T)@mSd2%tWeFlDBBIDvp>gf>y?1F@ZqztHv z!7RSMjt_hm!}1>m-ZBjM2Lw?1`}^ZzKqnpez85M0boCjc6t=8v3M39l>Z|0lm#cv` zzi8B~Gh0>RodM!|D^fZyH$QN^DzC~qktaa2NrSSJ9(^(l#D36#EAks+ta*HAIZ$B( z3zz{!5`VMRg6F0}wp{T)I+2*9r>jdXkT%1X0oo%pFRbF|H|=+nHZ4m!rU1j%CV*#? zFMV5cQBtkVkcmWC{b_DYuZI06gjcRmkpzI~qp@#!7hOYu-Q=MVywKZ1L1y~!-K2yz zvz+9;vnTJYY0noLnoUrYtb(8NLu0TT9_T<<_V+DXVo<;h7v<#UQUV)7Stf&W4 z>fV@;IitPzp~${}emAE7b(08i55(cuC4UA$0Ij~PWsAdlY6MdBi<(+BQjAblyLH)s{F88I-YAq_oXnkv6=V&!JR0Ehd z-=lMFHKLkO8Ai+9j)v=Rd!)UOsF+wQ<=Y8#2X%Tgi(e1eqx%P+Y76Fd+yUq|yi^(M z%?;7;Iaq@mHJi|AV2*e%quIqGvBoJ`F1xzR72WE$36XA2Q=jtg?51m81uJRw0nKf~ z9AA*bnHB*?-p?GpdaeoG;o;%a%yD~39r=>t=wJL;>w9A-vAfTW&7iR_WtCCR=)Ull zD?$hcXcten8_?I+vV~<=ZX%IR??vH8aU?JClQCb27h>0KTdU95kDVUz5{_lSm8Mv2 z%Le~M2ij}ifW61Es9`5Vq#Jw=JsoD&y_;n=sK!-bIBVM_P~Ly}VCVK* zuI*lIRZ;ZOUU0JvYQu&pb${c1cWvY?oiGd%N5Bm;PSb{q60-ye@qtjamM}fIQo*6` zayrOkfT1++;YD5O!$c~5e^YYjx?7N!Ur?Y6I=P-3#EOcj<7qX`@}dw3{V)$f^PhF| z!{s~|ZFFds7o&6gH?8~gw=e`plG}i2o^=({%V$bLWA*ZW_v5oR8vrn7T!mhIW}HYd z_A2*VZf=YL8m7paycmbf9}Ojm?d?z$c9TF&t<>u%GaU6B6L)No{O4Tkccjd`<$F90 zB?Vco6Mh;dBET~mFH^2~%KlFZ7$FH+xO&G%Jm{ist1V5HNqwhdWT8!?M z;R{AQF%p-g2Z4GvHnuCgzXxS)+v-R+m~cPkfdiQOOPh;K6|P7T2WA#lzXSqRXvfo% zG~naA;=;Kf=V%u+@shZ_NMwmU08!M{GmaI^{I+W(N?GecB3Yal9&|^==#%X`T z*Y0>~O6mlCWmB6WFP{DF7WzxRgu@dMlZM=GF(g2L<_TN#V$1~>7jE;qX3|2%RaUV6 z3sp|bPxBwP?YIlWw)wbw1^0}^b%f3ffi3rFJw^b!3Fffg?%hy?;O*2=<|a@;=c28v zFxWGzBc&Q`k8+QlQOc6AlHK+~`8xpPufojX(E&;id-ee391f5RU zNti=G>UVRt80zY}F1s`vt#>w?qMg>+CDt!Pi)EcR3c79~zrqmDS3n=j(fzt50`|Vm zb;KWh3X1Vzue%ry1B|I(Kpa5M#bjc}a6F$e5LG{zsU54xc2ekVx$a;~1M}Q~w3Eu< zgdg`$3RLuL#h5)(RNbR9MR|=iN#J=q6u)u*Af@r!gInYHs^(QsfEu^xIUNQ$O_o3- z0FMoU=$ygA1nqkBdKA`Mqk)~Zcgc5$?){(}zK0hTsbV;5Ke^EB)9JhTwL>D|NB@U> zMM^K*NdqI<@?00<7&m)pPO6*^vm_CLUrx_^+-$ezQ_esmtU-5oNbmyUp6Q=T5K zI_vGcv2zAO$w}GUFz~F9F(?impYG3dJVWf@ZR(of#t8;O+B3A42a}@JQa0uF1)saQ zvM+x@bTsO8s7s`gz=4UbPEXEktvtf}3~&>_QCKJZKj5(FT6`Dp+rJx@S@!-%0QQn- za$PI~@z+boM1(Prt!h0CQsO^OI}OE7L@RzDY#O%I)pJ0W$Q7dJp^eqyW21OU6PJculpbl(Zx69~^KF!@EZ^>u zxW^z^#*>C2{nBZGd@fGpNLFf!%3EGEE*>`ljmZ0PX^jupn=W-6v(7)jw*(aOQ&MEf zJvz0VKC~V@wWF^Ajy{VzdA^cwLBAc) zBUowk1Q%j-iCe>f%Ml3TuK@TcKz){4*99qGq^W)%1bwtss_5wdpv#Avlxw*f#2%M1T z?|Mt<^@Gs%r6GN?Yq1~)(hn@#KSk*n`gthuwvXVDyKZ!=vi1XWIlXwqeuu}? zn>u4}+S}`@Xnr{YXI~$zaHpUk{?B*$A@jBVdJFM(W=;TybkDt7t?T8qbOJ@(S|*dV z045WvfMvWVglADY3uJM+GTxrve6FO`l?rB?wZ5Jf!m`=fVb7NYzUv-lSJkfsm<>?QH6x!A<>Z< z{@>-S!F?|r*i9R5uJs0eL2~;%@dVj_rF)>Mb}5F_)L7?9(*oxy<*QymR8*mQxj4$r z6)y6>mt(Z_Xf{IHa=TKe+`_(e*Z1EGduxmG-S;ExceP2Aqw@RDcXID`*mpPp+YB;@ zyZ7IMyliGu8CZ|5QmL!Pzk#bjl=qdB6Unh{EN?D%oCS9IJ5zAn=D&~L52B)ZF7L;c zFbDeg2c(HnGM_+$+(*YivR8mq1_^mt#82?`L%X@7DCnG|pkK zQZunrt^m)q&-{__HWJ9}K)GZQzxio$&XoE2SO4(;|92xeC`@2O_qU419~FyeP_Aoa zr0&ETDy()X25wncZ0B6d=kR|wi3FcTBeoI}@}LI7ps4xSj^&bj9oMWWiNHA>P%oxj zrFl<*&fFka15_LB7Oy5Vuy#7l_xL}*zDA^@^a+5cU#Ls-0Fu4?29GR8V=lM^*c1G* z6X{4#IFy0krCuzxx>RX6oQ$>I`fm8?xXTd3v2{_0S)aaU*hQ(Jb@n8amz1yw6kHZd zY_-@2;0FDWJHGcsGXg$BJfHzQS|Z>kK=WHy-20EXs63|^4sFBzpnHjpOc-u`jf4SZ zlom7re5lPic{uU-yXSa`9|7qF9VI|0yakd`6;7IuaSJHtly2G9>HfxhHTNAlRICgmX zmCt7%|0VY$disMqeVs(xH?MF)hCMYkFwUl!4$`(Cc((76^ty%ViA)ZV(HUR-{Q4P_ z_59UUcee;b{l~Yje9pcJN|0yVCwB)txaJFGhOZ#*L{rUrR{1T8N(2!c3=&UEGyi)} zhIykfQGJ@=Tq`TLSfq)*anKuf0vq<>taEbo9XVH_ZrFDl2I4)X@8dK4vWBP)W8&Y2 zihiq?YzXP%T|I0&r$ZQ`y5u_oxCTPgQAi<$liwFd0`fu+YyydpQ&|jIXgctGzJ5l2 z8-SwC##Irr$4>;s2^inY5pZ>Ld)KB3{$~i))iC`2;=xjZt;RgT|E__aXDZ_#@&^rE zYJYaJe+e~1R%R)jy;SA~%4!Uv6@}mbPLLQY9p@>t9p9(PC!*lcFX+CbMXt+v54PH% zW2+m&ymI3>UO9y)2}eWw;L|p`w~Eiw7w0cVIKkq0d{Qbp<4^{ZBR=@#>HcFk!0AvG zmuumV)x1-53nqK3<=SvG%yVTip&^J$KuQ z%gxOl(+%PW*Du0t$}!1()5bbyX!n)4imy?Rs9YDn12<_!u5D-zmkvX{`*lO5g&TVg z3ynt^WgK|?zZ|Jt4r4UAojkcgut0Rq_c@c4SI3a?tP-TEp_6>KT987nYep1c>%-JD zIhwp}mC;@VpLKortgfm~yh6v%ZOOyI@wWMl*Wy&)nJ?1M9Hko4F{PqZFP4 z)IYqr6kJl+k zTW7m$cTrRdjTici%~qErLara2U3|{`)ZWv1)QA4PWreXy<_ds|?|E;p;1kuE&A{t% z-pP&cvi@O?v%&RX{-xh7C+Zqlv-L+aHt{d%uDY=hT%+sw0t0bow~4bGMWklNk6;Bv zxmO9a^O2w4JHLIla!6RzHxjpa#Cb!UF~>gR`esCvZs$W`2(8NeC_tVH>r?XA_&|{k#tizF4+dtF5!5%7l^_h1pg^v!8ZvX{egy@gg5V!aC zr}Re~I88g!qX)Z0XZ$p-1zpY9Zy&tudUlncJcR30vMy|T?4La9Isj7sXPHn$szbJ0RvK}v2n=Tx;m)@^e@+h!XWq66Um6bWkAkC6q{1CxJ z(`#7qK*m_@(x2{nIkK?Sof zc%HVVy1JXjByV0fPl2f$&dZ!mXeMX+qX`@^t~tXkBeG|oGTec0>`o=yM)5D9J6_r> zne!X8D7&r+p&FZ&9HWe?II+k2+sa?)pANjtuYt66(WPv7FIzjH0eM#G%+Jr9Q6ksB z{78l3je{UW*f_)NN5cCE!ul}$+o zo@=vUc4JAL=<-~cLXXVS@L>8hL9*l0Fb(_FLOFf%@`tT)8s*dRsTgpTxQD-J-__)P z8XcQ5q~NzZ3i`BA8L~GUFW0*toE58H*&=4wY%xaDVSL`EbAw#drLDzL*7xzDTC z&c{2SHE48YSH39|s+Wke7g?P%OD{?ei3NTu+erDe%X%k!dvb(S`Lwk3N?vQek0-Pz z)Gs^K&yqrT4q82r5z)~;(D}~^=W@H;EblROgYS{~!e{0+OHH54eG}+dG?KyW3bz*~ zd(7!=3f1SZDZ-5tAM86wy1&TnTtyPIL7Me0LL5;E1-W_s@q>)USo*@LdcA+UWQ}f`T*rLUJIqHS5UTG98%~;87RO-F`R?$7 zCav+Yw=&psr6bttef2IUWFrO*hD69spR;xIVvDM$ zY-`dSVz@MefR>Jq0Y_ES=t-Qx&7rLz5{4Y@)>)q1jda?N6Uc$xRwpo3{5!J*?JHNo z7=aRcE{TXM>fwN~az?kH2r#Vg*v|`)U zysO3wn;P8-`Ws7i^<)Ot89ewkavc(Seoqjh2Mb~s!AUcK<- zG_ZR-T~ZQvz)tu^a=dUL&n~ON6&CfMtA<2TxknF7?yl0;PoOU3$n6A)k3lf6^#tF* z80E_0tKb_uqyV2zP%0*TwOL!supQw)ib2wyQEMotx}57-q|_0TgmMj;)%WJF@WSu$fi!$+%UpF30~7Kr&k1zzZcC@IM^uH z*jOwfUcM{1-OYCs7XMN*{A7Iu`p!<`?k}-Lk)$dojfV9+L2bIwpM4yWdJa`vLywUk z+lw(;;-}De$@7LP>dB~h`$KWT{NH5cFEf%gyVB1;f&-eE{O!cHa=p**vxmm8Me5iD zrT)VbH_2G@nKb5sm|qKmIub^7ytaHj>WLK= zBF~u+uuUmXdGf568W67tua~<4N?16Tn{sN40>-r;xy+f`A2e0yDPC2|Q@dOm#mXrZ zEZ-~TD3x2dy{b_%GDw)PXCEJt=b>$nsn10UDO5w8k_tWPSnf#wThCgPi;h!tWnZiB zR@BmFXU`;Mu^56duDv1Gu0XkY1wx9w;EO97EWU-4RF+h?m0Orh0WHfn1=_et^(@vbOCG{w5JiVF+~HBao}8KYGbsq4lc}7Nz2a zW$aWHHuZ;Nht@@C^68usU5p$12gxzBNs781h|L<+2w`c zlq{B*o}1MJvwO~52`Mn`eq5r!%A#j(ENm2(HtfR{?nsZY`r2cC zLdcNt>GD8mW)n5f?Y>^s?X)6p$WD*Hv^vly=aLZcNHa-*&ZcU7HPpmmT7MDzcI2ut zo+>umKrvc#>_?IM&rn}9_$c0M_ZghjEXdy^;Om+Uf&CY=$}W$I@z?!%I!XM@_7`Wa z8tPXM3`NI`D5tnGWq?TV=frY{7G0L6`x1VeCT%CfPZXrIqLsbnNG$3MHj2ao1~1ST zn5#^RwsoZU8B#izB}Wcsvi$hkxjNa~t2&Yo3GKJSrDovN0aVvqoRDsj2M>oh zxJ^7RdAgaWl>qwMZCc?63s)t?b&0(sh2^}jt?$-}_m)M`dNv$PL@^V5<31)KyYuNs z$zn`LO)Qbt{kQ}5z#SQ<7hkN5xKYk!d0y!I=0m5(+d!`gxhdm4e2M(2eyd*+a{hzdr0ddZTjRz}t-bCi^4>%I` z(x0Ye)fPSYpR*;&(375liC1+3&_{hk0UH8X3n_}Vj>&>I{RAz9KR20(X2AE;u^E{p zXeS|eA~;J=&R@>TIPIFk*3x12@PvjhN9IpHS7Fyq@sjJ>FGI;c=f{8Z{YO^Kb`(bi8OWCad;-5&XKh zD(>`f#Dx0e<6i~2%G=KJlht%?FTod)jZOab_zsI(8q3t@H*tvrxr zmSXd_@ymc`Ep#^8v)nc?h6YTRzWhvD8I8fWtZ!3P`sBq@=wyV&jqyXuS}U?C{B>8{ z;G0s|R!}x?)T>6l>3{9>^X-MLo<XA4kW9y7ycTdOyLQek9?7bi8 z=IY?KEvx=q2+=C+xe%3BB`)BYWS>*}_;2$E7)w=K^%KMba8S>7r|+(}d6*C{-ETs9 zETm~)wT^eiBWsf&mKj-; zals~6RDrSIpJBv=_!ZKVwFn>akp@C=y2^db4un=`beu)tG_FM&5;%!#B5c&cz<7h` z&O+^@X{0y6H$4{;S9Ia)-F32g96n!dyg_yJT7|=?fb^ z?RZABY@=xWE9^}QqJeK@#4`3V`leRm7AjAZ3Ft;-+-{oOFcRrEn?4AK61f3j^wyVB zuS)H=hr}>c2=d+jkeFmeF}Gpk?>45WIJ<4&lG9tl?Dl=8|m)uK7e$0cXx+(@!xwN;E6bE?=@?TG3SiN+ZLIkiHJM6 zvy%t88;@Pf(x<(X?PPrPoNd*^(2?g##@vvgcsc%5Ydqq$uoA7$z}y`IqvdBwdpl?R zfPH`$Y--FZWIJip8+6CZ#xxgEm8?49P)t*3v$I~$c{zNkws~MCkh6PgW;x(oO+LVA zxh7Eu5nLBqCC$kyi&M~zguUmU7@Lsvut5PSr>hzXWMCwk9`m8fdiMjYzOD5LNXU~H zn`z3ew{0_yroxWD>q2}zbWx((o8y=oF~A9cpK5`A!8m)lwQW z*dYl)Ciu-!@qZMH?W?M%CMmj}Qj^&1v9wSvVZXRiTjqf!Gt-@6w3|-_=0{^UPiMDw z-z;h}W-$JC&j(?%iC14rRB~dzfE1zCO8v*T3YqY$okO8Wm~Z59cC%S{t)VH!RKX6@ zTVGZA>oq_A)JZV4mCdTnPRSiD$r0hSi#eHzwAmnUaeIiD)Fe!-Nws*no)-Ljs5$Rk z6APe|B%H|v_Q%6AD^Q?86WBlY3dwdC=XaU({Wj2j_8_%Rb7)(2@YAr*4$3Ka<6S%( z^)wlqnIE3W_s!Iy%Fk4R#GQZU_c8S2Wb<}(AhUgO3yHsBs>{czW~NoDV5c%yXSSN!E}X#ClzU# zBu64jIw5I~W4%1&3*D55QOvu?rQTt2Dthz!1UwK%bblFxILc756J%J`~ zqsxpLi8|+J%U~tV$u57}r_a_(2(KU{D4p&02C85qX6?%71V6GQg4aIrc05VcdFeJo zmc8Efd|-k7#bt4eOu(1V(vhUmg&dg8KAPD^d6DhrehRhy^%V253;sO^|IG*vKu}t4 zrQc2(JXKbWNsuAM2&*SzbqTdE4MJe<0T8lzY%$0eHS&SChd59%7rVZBTk3Un6M$(* zMmW9hdiVvTD?s|Y1;Phtu-R!IrhYA4p@3aPv(F^_E0f(EjKF8F9RQbm>;!jh|If3W zrbgn$4TU4()kH}K|470dGa8P-JzJX2TW#W!s|TM3Ud_un=kue(B&Tyw```2Bg;6qf z{!%DjpSHb;(OQ7&=*k(p)cr92=_DQ(^K;Tq z>r+3?lzww`==_d|RnLfL`Bev|!bFYp0|$Z7H4kETjRD_xW%BjTZA=~wWpUs*2B_%( zL};QdvFc9J%$dIN*JQ$>Xs$shVecE)4i)VAjQoJnmSqtZ4ki3y=<%PV)QF#F23k^N z(R$r*!LbvFrz> zEfF|kKE6w3ydF;Dzd6BKdEuG=WTj`{YnI;b_!r+3_w8$*Vn@>Op5!Ef9z|fd=1cdN z&OpfY=a|n+GxN*k#NXE@)~`>|qSf-y`_daZ_QS0-g1SJ!AkjcC-xW9oaOCqK`+s&? zrd(Q{RW+XXR^GgS1{PipBSJlH`LkhkG}uKcF07nN^Qf^pj@*ziURl*sm_cg1tJMY{7s_$6KD5<7c`KPf#({|!%AFfw7_Y@Rx=_6;WrX^6>njoqqY+qLm3z7x7X8!z|A0-&F zqkfg2ZN%t##1NYPOGdU|_U3EG0)Rci^C7|7?b!Ipgqgus7A={2l4VJDmGg*U_?^#} zf13gVG(*EV+8ne~-&()?rHItGg<$kau>DIh34lt;JCib>F#x#^i zj+c{hGLq-EsHQpx+WfsN1o>FYG-0YQZYXz4un&}C9u#pBQxbE`S!_$5NvtDL^6AORWXBZgbi}dImbnd9Utj~uf^U1FteB=8M->y#j}^Hucg?AB+*4#R zmh>8*mHt~jOw(3agq(wcZ!$UINatghGRLB2U&#(LIa#6> zQS_L#Q6WQHi{8}z7@w|(ObpVyFAdqIGjbB z=~c7y2E=?3YWgcHV20D^hZ~IbEBbtO`YWS1wQ)F$*y;52HsGf|2;UQ3o)(!e0W>$!Y}Nz$cm$jf?N)g`Rtu5Hrzf( z+}xH`OLy`Kk#f$d&C<83?zY|wikaZ=$;I`x}mGxUN=S#7k>j>w(Q8Wgre zcysQ&F`1A1YO>sRE!xd3vpWWVpPan-lA$jQI=e0qT0k$*cQ_+sZ=q*?>>HG5~1dgnHUc5#Vm6U>CG z{O1ODEMU-{7Ka}LxxbjJMdY5-ysFm2B`uNC*Ym)SuuewyEmRf`smB~F3t2m$4NB7S zUk9VW9kMD^ALmw=)74JWI{E0)9J#CgMwlWJZEOuYW6ktPnwg*p(@cWePX=~k^d_$& z?>nlvDHRd*Z284hLODZyqBAEIe%}%ZhnyeutB?B9W!F7 za_*OMas0m6l$NgbDf9c?4Q|6xef8ACrCi9_gh?VAE~q1b!P-&ghxvtx9bf2zl4KUj za99YmpgObFyXMB74fXMbr`ygVaG~*NjLiHc@_YYtV}`J zOnH7+(I>OWs@F)fTwJWjDX6SjJRRb7`*^N1ySBC<{EKt-<>1p zmfiI@%Enkv_{SFi5b0H<`@%vqKx{~&*UFOa;%|xis#cHx<0r1cOfG$<)EG);4jUqm z=#7xdg>(%CJjRD}6~vGCexcJh2tWhI@a1XIZuhc*Ez&L)d3SYyF}C^pkZT zI)G2LysTNxfbt6DDzz|n-vKg1;$g{#Deif`=X@T1fgz;q$0jmUx|Tq!;Z;edbILX| zIMnbdy@eLtlhA(s_3C!^hJwMIl1|E+Y;0^~4TockN_8zQsi1!^4H1*7!l3tUYT9Ud zT6duYB?g0xteN%cO#I7#>RRe#za@T2v2XV`;ZNl6d`?M{_)U-1kA2`%KfZmr%1Xm4 zx@3JETYdkP3>4=r_iIE9L)U>7O*?XcG^FlBV&{S=7Q!N8#L{8&7^A#80Z^GX+RI^y z^iF+|GOZV;_n75$JsYCt1Fvmtu`IXsXT;;Bx!LdY3giz_*{{XZ9)@)S`?)#W zD&y0+jS8-g6%&|?tIylaLbk(GZ9AZtbD~$NasE4>qAO)%4&&QyNVn;UK`$dK^QkmX zWS2-aJ})up%DZ%ESY}VP;Om~cMPi~9ONjNyB29<`U8TF4yIBqM2j-J3O7`-PxUfz{`SHk?dqZ^mbSv zCJ;iW;bHGuB}P6TVlHb98O0>t7y+*9{G|vhmX70w6Q{*t^a`39JqH6(jSBw!`n0d6 zj+N;~HCDO)>loV)JL9hVa))=}{C+LOm8a%Ui;QYj=U+*xH^kBThhn%?dE1*AiIXiu zN4^FFOn}H5p={!yRsklFAA+007p{gQ7tYO=al3-(m8&VMW$N0F&G|fW86YF`&>obM zD8aISKMW?fr2Q>CgkPvjn8$?CXyzge6c&|I{Qz?3xfF%GQljuEUcP^igK2|Ob_m0= zeISnX1bCc9jo$1HH^Bh%bE__4w%W;q+x25urz*P&HZn#nfeR7s#472o}1$j(=HdbYx-U<10?= zG%&Ru(X*A>%KdmVwm|mEc_YL}np%WIRyrXQ;c?{*o28^NC|+@%?q|t}+5#N0T)r|? z_eO!^)=soVRtB0iLXMbX=xgTknl>oyR)aY?d4V-Y7Hvz3ovqRa*EjCZkN%pK-cmKB zu8d)?al3Ut_o?QX5?os^(4rR8_kgiB@5>p_@^aZB^Ol~_{a=DI03H9dHO7GI5Jw)x z7;^WC=$K(HLjjVkGe5=Q>Tu@9vuexJ$*2|y{cT{1Ij;{EC+-jd>v}Gk+DdK|M!Akn74=Nc2LYn=J=tFbB}`h& z7jKkNubP-{jpW;1kbjjVPMb>Jb?WV00CL!?RnkzJ#ZvgaZ@YI`9lJJj6_9>J)aK$h zPlCDeQ!OvgpTU2A(y#S}syG}Fo5mh?PKzXm(W&H#h={k*`*|l}>*H>mG=3~2J91RL zyf}2NOjy`CK`)Fl@2y>*qF$UBIzFVq9;A(_6vE%)3t=wsK19QLRF{-8Jd}|kDhTp3 z2ON;dgl=oi1MZvOv3K-HI)(84{!wPMHEm{X%zDA@!kW%hHzfbt0zzwrq6Ru}l_ zyHh13K+W*3S_@{*{t?Yot_1b6Ry0zBiz+3MW_+U#aQ!S)FlFHa0uiuTWGXuk$&ibk z!W61?cl213SHfp);(ga@Zhh$ZZ+-68^fem`3*M*w7+myLu0)X8>aTYNKHY6brE=T* z>G?j#fs~=zXaIvsHrZ)qv%uVH*I%Wu#--o$Z?It_tHQsX{(%{cTj(kl=qCXpySmf% zRE-4sjsM*4Pxd7|PwM==QxPwnU+IW(rkLty33OK-;_TsuWsq&JTq!~sbn&}gx6#)e z+N2T&D!)A~lgTVB{psxK=)RZy!iXJC7AN)Q#vUR`{bFe301YldDZTGG%>peFz(uJUOp&Oz(+- zZ7(JlW!BdM^?I&^mMSryh4_Iqq&{c@=@f(n`JAG*G-B~Ez(>cHbDG#acG)}iW3^OY zFw2&*G7QNyxSqRFMO{v&&jKnUfMrFqv-MAv?>RYei7y75Dnm5B@9O+ zI^VC1R}W1_P~iZqaFD`RXnnBfnzE3GYK>E-BZNH+5CyNN;+=dQy0}+~#OlBLpJ*9) zZX1*xlRpX+%2H`c47DuC22BF0FGC=5R8&)jW3BA4{~7W-9DfNbN|qQd0+Z;H>wTnl z22#SKj2S#ilot3#tu8E>r?@QJOaWVU*JNG>*CdBEEf!7mkg2nj-<xD&ujoBuEF#4Hh%rrN<1$xvs7#d5epZzy6G*4)4rmE|P@0_khgQ6H0pu>{kDXpNKK6{hk4E_lmCJxe^Ic&}t0zgP z==mR1gd93cn%WECr>AC{JTAd22TrGwz?HAX2jR9xEKsN4Q++m6y^^>9cRC$E43Ma zdj!Q7g=IOIj4O}AR?!9kwDAUBiz-d|+8;bhCcSWY3@L;{VIfemB30n3MeeBLTTMzE z9bbN4d23&dt5KGKSpShoTv)#G z-$y>y`T5OF>+qG5ex*m)RB5^ccHN^B-YnZca=lUtar)KmND-WnNg3fA@rrs(DABm# ztKFHeUsp^UjTx$IDpeq>|C*72vaBG3&6b~=5U_or!oxiS`-!WLX`?`|RZ$f>WH4N7 zXw!1Hf;55(yxuF6XR8*`(5mk%czClzusl~6`uY${Ou`v*3@DI7xeEcRU;0V4CF32wcxz6rsV%MW@l6XVAzUdm^H|Xn4 zt2P>^pB@)sVhQ$<85+Dm;d^g?C{@q1YFueMbrCfWbM6_ofN zN_ml(lEf^;l4Hd^QmT3=ji^|7)k0}5aW&$&Z~o9Ecso8m{@U-$pjq<Hg6X(Hf0NcCl6`C~%)vT_1Vuv?=!FLT@%-wsG^!v&@CIw^?{M9DUsNCVQTM zAW+UFKH!d9L1DJ&R&8>wtoC<-^^CmD{USA=`^K|1yl=*nhlwcZW;Z|du#u>0<$2K; zs2HF0%}_sr zW=o>WGQMYjT*?@NG~1)6IaxAn0XOH-@HGVy4|kpAXolPm$sd4qfqZ!zCq@yPDE}Tj zeA_o-)Z|r-+)K~H$HEpmLshq*t<;p~OJoHJFsEkO+4~pKXG!cI>suTBFR%o)wj4GE z&j9yQSTM=|4|p-LdLH6dOd@RO(wuF)jG9O5cCkM-%xq+JyUCM3rE+&jGmi7>3SofD z)NS+RMO0XM+AlKuv^m-?P;1tKXCnWm2XKBsGwDgM^tG6ym8R_7ZK|K+_l#zN+mD1% zfq{qss~z=`27_P6zcs%n9o|wht@k^vCz{n#)1DqeC{}#LF1oHOwOQBGJI&SF^;`sy zyjpv{rDt;ZtU14x37xTKxY!#Ti%BWH^*zitirlea z_*NEFMN@6eUA8F0S2!;&PLT97!-0Cpk72 z3+zLIWQqiIsTzO3L^`=P66RZznphIs~Pf2&EeC{RkS5$ zkjeSvyc?#-?OA>DX_*?Xy1z7Zwp&0eTH&M#o9QFxaXzP^Rl%5>_*6wDdr=H4hclz7 znT>A}dEqd1qrJafCR#}}T)1PTKn$b`cC+nVtW^CdY)Z7(!>k}oDr(FIwdV^UVTe@J z@$*qz2PzIc7AtbwW&J1Q%4f7J6=|fVpjwQd5pd7r*nQM?xKQ5g$PGvaRfSTQ`94d< z^J}}cWc>AoxBrdZ<>+zIM@P+)WHx0+ctU%#j0HS|ru1UwQgr*d`*7@ft zNwk@Li~tP;uhz^|xX9@vOo3P(S8ILsr+jC>c@Y}6U|mDMOb)B%a=Wr^D~1LD9+DM6 zS&YF*_dtvAmOkYQ%nV$YaEZ%h*`gI+{&+@Km;GJCEGtvpC zs&|)~wj(9^nTGg=QB>tsEf`?I5ZWnx|Cp{{(0cGyW34P zP)07ONU;+;T~qaFhPYi@N;Fu$U5j9ner-9kGC#chZ>6JafDG1ycVc3t7m$Im%9aMH zgrr{*BaM{-MF3)AfB!7I%gJ8!WoMDHpEpqwA!!aZFVCF%8KCc;E(cpd#=rRrb-bsA zMIc0~l0KNP5JHQSiU_Voxnum{_567%L z^4<+;xszQ<9AsmAt=mtMokwGZ4vnmxV?k2ynIV}&4ytL<_i4aDOcaPsOsIgZR}0i8 zE=>sjtbe)?1DXQF8~cg3C!H&iON}(iQL{M{2Z#C?pV`u83lT`|9`wx5jh9jwM<$88vC0(Q)F?AbFc|UsBCICFdL7MPt z15Orm*L?iNL*T--}fmEYSkI(_#3hC(#QNEPe>=E_E?-9R2p>oN^c06;-u-0)D$348+I?FH4 zVo6B;r8d(M1arS|jl#$Zv{=1=Cx!~v+TODy+Hw)+1Gy_^VF0~Bulk0}e3I&rW5$tY zqSI)CrMU8>axFm-;o_)dHE2kny~OlSN_aQ460X>`;uMYvR|~&b>+DqRVaf@#JD3N% zL#d(Ji6n=<5U&6H*7Jdsz#BjJh+A<8TsRtdGo~$2q&inqXz&Uwtp%@H?Ux%Vy~0y| zml0pc71HFGaZ`OR^pEB$!$|~^BM7;we4afnE-zoV6EfG|h;*%`ARJ)u`~`BWWJsO} zoL8G*8t6z_(TW4Z!m8^S=9$OXc&C5u9UWB5?PC`V$;j4lW&TKy? zEG(1bs{nD6@vdofV{Xd8!q|c@w0N=HM8Hq~^Mfz|WzB>gLxD%i%&`!4H!e1HPm-gE zh)K~(TVj<}lNXpK9tI=^$}^UbaQpRic!5IL1kOdJpC}BmKm$?9k^4ps!7@+m@%-L) zU$YW#t>fGQ2$HE;{vy<;7oh_A-iuEkmhPPs8pzSEA0NDu1az$KXT90ncCv|UoLypc z6y;qc1wswIkO{5?Kt}}lqpty#V*VkXZk+7owZ*}I7s&IrkHvS+p7NV{+_F*uBD=tF zrn^K`3Lfjww^g?FqMWZ)QU~|$T6vvKfJH@4{^Zj}mNr!)XfFfm%Vm=YQOMOC6ila$ zj{$R)4cuv|OlD19@7gnvc5kfuwh50`-2w+vgYyl_n4`4i@>0Le!{+yny*2%5DSwHM zp7Q(OcKCt{1PZ6-PG#=TiG`;a8$0I{tZzA0|9-3AP_nj5??70GzX#*dD zg+;#VA8kib*w2D;R{X!DMP&&w5bqim?XS1KLSUPL_Fl^9Q%0|{tvo{Em#)~#Hi=wC zDlw1C1T!I@IS0S+7R}^EzREgg>YmZ0Lle=B9WyWO&2@u8&nTUN1pywSfx^7DLYQ2| zKp=wpEEqW?{f2WvWL>7BmSwjTun)(1n??yUKr#;o&ERLYjV!UdBBRzlv|n!eEuXot zteiF07i}w_=nxHVu?Sj8G5x7&iUSH!mzkY_JKjns&4$lHpA1ibS5Y?;11VUfXp9I7 zq)=Zl=-K=en{IXW%$~;jOIc44+6uY&64RdJ*%vsvTFw6$2o(JIKIxio@*Iya{_dDE z69QMm9?&a#b*7bE*;55?7Wt}g)(?~c&0SfekF||WC%xRUf+-2OzKH zO7fynIEo8fMN`8s_Szebt~qtoWuHzB>f+YQMqg<#Rbe>g@SEX}grDof*G;XBR!ijr z{DhcWVj9l$vd63|FZ;}=f}FT&!7s%hc4dfq0Yux6Eu~mZw@+M^oSe+;Xt4GxBWA6O z4NI%A!A|}}&!k02q}=!~P%%J)Jqb#LIPlHHte{r^bthdvI)IF-YiTH;|C1VyENbt} zLMq7TvfCO@yNqlnZ;2ai3#qjDsD}I-&p#jWY7T)oNuX&2@ZRWm+ucLw(9d#4^O`A_ zJKfbh(XXm$#nRapAcX}*V-mrp?}(LV+7aXZQBvTOeZhBtT7Z)`aI43#&jjzYK*P`W z_bLfXhOi5cPwNQ&Zy&8n*{_B_Nr$3)Z7(Sd<5BnXE&YGg2;kpc`>OwrRu zV83oY{pNlUFBv;s7p3c{11j&E#pc_ho+h+N-BPUGa=;haFojtNwi&1Sj1i9!Zx zNx7CD)eMcTxWiupGmC`EZ98-%sOLyY$gZ}$0 zszVQFoSZVFuo4MBUkM-|uR1}LM#a#CpNv4(83-J)R}F7m*5CBdn8)(H*%%>lLY_s944rnC&R+kr z#ZVMWSIe2y*{k276*L%)p8s?r_i_EVC3U)*zc0|2gSNb06vr&?nMn!9L#POL`h$f# z{XcjSBqXGrk+eY|@0VXpbS?n7?ByNGIsfxID$voEEcryUdWS%{cdCJ?%dFPjNaM=$mv2sP(-nC}bV8`x%M={)he; z8F#VY#D1b-rHus_!3Z=n*zVgAnklIbWU;gtsXo~nB2fU!2oNqsv7N}Un(p`U-9sVflp+gK}XKE~o zR%s8-Dwzh@)Xia8PTSP#1xoiGBEG8U_?~m%87=~r>aW~{-3J?I56OQVHO$-@@20sB(W!9gEK*C1G(Hz#4 z7dd$vlGj5^HRZow`2wDkP(F^ReM2KN`++}wEeaCpcn*T*^A%4DbJbMv6a zn28nM=xVX6s;6{_B~+6~*#x}_<1@6ot#Pz9gIJ(-%WyGfUXZ2h=T{+9P(DZk>NKwW z23=@@FjqS&V8W%L7PSJm!u)mT!Mm>m@bNZOM3+9X9mwBx1}y3Mzr=whB2?GGA-m2E;)?$ z=w0o>b}%C~kR*WZ1f)zZ@c=s6nib%2x}xj@gTp%(6deh3K!aVm*_MP{MzEu?H({`x zDl^mE@_UizrupAMnlnCKy7dnP?g{gCa3G*9-;5H0v)VUz!8tkYLaENK+3lw*+g%ij zbgcRsV=M%8Hq}lH-$ykW3n;E0Q}5wrP*D~q_fTS{$yAW2eL$8PvS zInI8rm^rIP{HG#oKb*A}F5x4{XKQ@U=uIL?6tgmIoZH^@iJ^iL-JXmj$3*2d9i_G* zItgLYkt$AcKk;oYG&h@-OQ$wfsd}<)XXfpQP&-XwX@O1`d2QJP@+UL4skCE;M)Q?1 zhi^`V9(o}MxzZ8n)D19Rw|(bGR1LQV<~DyppZgFV>1#W%gbVg-A7G4b(X~B$5D;yH zE~sedsxYtRDHZ$u8(+H8L-4|n!}gOahxYUlpnF=TN%QcqU{vLMjt_1I@`9i*V3 z!Z!NP7WY*HGLr4+xe<`EBX)jji#j&`!L<8@pYv#Rl4KIdvCYSQtR$IW*MR5;h}^bX z+qDaEqx>V_)}hOYcojx|6FmooLjC?>^K_3jsu~KL-oo<3RLd9?z}t2vAA;HFQEqB$ zS@SDe&QsrO?nHDikEBg#{V<(Cq_2R2g0_&%>_>prf(w@7mY z)MHoQuz(5x(NOXT!1>Snws=YS4E*N}+?D(JrNCC)^>y2W&n4mwDZSx1P@4}C351WQY3V+B zMd@N_e9wn@?Y!T|Yu!jxrqe%q-B zlPVM`t0$*m5N`mLg&|L}lB}wI23m8R=<3T(9@U-u+@_gfXFE`&HMdh%e{7XG#6Gk# zl@tcr4PDO8_w*zk!vjI}q-ouzhm+iPC8^QLIM(vCYT}j<*hc&1lJPIWc(yH^$|UMI zeeqlWp_-Z#Q2hr0BsO!cz;QWbP_ZNp(pfPO7#T(7xZV|Hs(}r>( zTlQ@rUd3privyRa%M`S#-??v|Fn~gJh9!j!rc|U(?awn~^nbLS2s_qgs(U(Y!xxeI zt3;y$DuMsZimr&6D2Ue`zIj+dfetUxLdDDZhwPU7v!iv?{pg<6$#lSr891dyO!qrv zsk48GMO;r;*GOien92B5-l;VJbtL(5I+9R+Hh;sR7c2B&7j$JGr&%$&nf3OpNA9M+ zin4nGJyDxO=;94!efvFQwlDA$gE(g!6RuM?IV1kB8#w-c{ZnSQv02>=76g@pX4wH62SSrQL zAjl3`7|Xf>7<+er=SWS(5e+to92C~pke`XnRJANV%kERys}12YCa^dW#S6%J^_a% zq7wK0lYIbsD199dDV*vtgHiephL?cl-B$g(iGW;gJkJIV!Z{61aF$4Hpbw&wor}NE zFXtN$CCU=RO+;`IRb(nd30%kcOms2){R@oKq1VpH^&t};zgjrj*5fcWs9Asr&mS~5 z5P&HHk}cX+_uJUrbnnJ8*ohGNeY*cuyRM#FPwkR+2<4j(F28gtr;JQKlC5XIJj!K1@d6^vN8wC*)zwSsESib_I2YRGTfG_0&U%4tb^b(B)a7 zenV+rhxTM;szl)m^7)C|;LHq27bph7DM7w<#57G4{!66qHmchd?Q28oe_>QFLQ$W#UyItIW=yV^*`D}w}jNTx{iA+di zR%9|KT35^yjS-ZNrId`}my9KW?~G%FrDM)7vw0ku8irpSo6)U#G2!t%@z@(>!a@sK z`bR=UV$26dK2N z6^Ow|hhtMVpA^3jT^va@0O*22qY73{+a8Xb+#}<|a!MJctFJM_v$>T47K945y^Md2 zKYw_CJkg1n5(6H8U|b|!l7nbH^Q}zET8hS{cW4B%^YQ37*w+};Ejr>5%SQd-rm5)9 zM@Hfi{3^1yNyQK$eDB81DRpLJWYqMs-gtlG1`l(bs>$FN_qQ&rg|M^-our;H8ncvb z>wC=VXES*xV#Ns`Nqn**-ppDj$acF159-(QoZV?Xp3R)jzRyj-whIWKQaUAdx(-mU z_hK#okQ69071+sj#P_oh69Zo0Fc|H(z7#`};7sM?SS>{xtW0-)*SKQjtm8x=QwME&_~@_P^-Wuf-C<(74A#@c0@+Bw z0J|zkRe;3PF{*+k5(=Rwp*Moo<{tK&+ns1z*d&rrtpd2!ALs*k7r5)mIc z5@u!50Ruh;1tX|4usVoSskU+$3MyMr;#14>(?t@uQywa6eD|r|a$vnrdr&k^&#roW zcgE_R|IUa5yHK+gL8%RTVNQeH)6PSq+kwCT7y*OZ+WqNyxo12D2N^efZpgn%hTvU6 zfpF{KG?Wd;zP`

HKq|IJ;1~^%3TgywB959F29)m)WGhli%?ijeipi4~^=t0Teo%nGUu8h z0}c`x0Q?rJ;izix9X3Z*Qf9!fjyi+hFmz%BRwY9yZZ*32G~4c;%F4F4jC)ps>Oqs+ z!!$)lWkUaMcK$P>6xSaH@QU6#w|f3yN`<{1{( z%CcP6EzxP!tc`#x#6&iAx=xSN0_pviR?7 z7Kq&La*1`*Dtuih|C_20DMsQX6YgY2o+;G|&QJGvi-1PbQ)N8JY@_`T@uzM3GY&xn z{Q3F0dRuDpJ9LaAG2XqpZ&GyW&s)r3ms{awtR3l(((zm?f|fcn&+4KoSUQd z9}x=%489~h)BR+mvFjNJ{g+s^DD+&u1YTinr+jz~iloV4+$$UTgc zP!@f+jS(cff0wJx7{eaf*tdesDF51A1NSU81L=(W<)RKRZw+`*t%<4F>j*Q)lQOw9 zGC4H=usO}Ba%pCAsB70pnDB8&`man0qn2O&5_iudiS62nkuwEhLIG>i%-K`EL*Z zML)$!_BaWUDO7qtxxe%MIQAV;5GDS zKlZ*lgjP5XGqdT<6Vtl2tQKT#R|QmuzCIJQopAC_OiK$tP1m_4?q+rky%-Yw$cOLS;EbN`W|~n9 zUngeU**a>|t>mf~q7f5)hhm2%i3fjRhCMajhVSk$W97QyQhq8IB$i#j=KAsZJ1}mN z#e@-=ZtvOQby_-Mzd?>!ZGTK^xj!u}L|{{37jPn;t*fRP-tZ~IL12hB*kx-Nn@t%I zGL1s-a6a{jFt(uIwafR@ezJ(xD;VpS4VW;0`cABOTbgS90zKA`TWKZSo7xfzihd_t zL>o(o21ztTIH-NqnN0WL0#9&W_f7ofS@*cqlU)r4_?UU&QR2ekZ!6I=e~s1R?gxt5 ziv5HHOeCwSQFJpQ<>zfw^2L9R*?R8;{+&7}8}UbPcdX{iVrXu{Jr{4>cdS^UmHG{j z2mA~f0+AkQDA6>SCs1|+Pl#jqrEVva-DR+qD@MIAqrOoHwuw=LxbjCG>JI;Llm~6JyfCjjJbE`1q0zYSDh1y`K44l;_s~ z<=w1!aEFV@vb772e5)^z4>C5~F7Uij344(L1Z#2_wR=|nkJzuX6rXV|)%~nqj{&Kv ziZ|fQdb&u3+indC5FHi9gE-oNxGc-4WcV2+^nwRf0rokBpiZRC%$|3bzRR5RwWZ9?sPT#@?}Vs@8xd6W{Q)K+GDB4;w_|S(o?2@ zDk7rSmqZ)Xo2o~=x`E!*quF_qNX5gizp`eeh=^gJoXF*l96v0TuesbK;-QG;Q|CeO z`UTbTtu9lSO@<5cID64|6dER0zG%MOij0X z#3<@x4)fymh>pA4I!g?ug8UhHp0`-w?M!I5A!`DE^v2l>7#&;JLNm=Ysgy$JI~Rg*E$zZgX(5gDU5ANuf?-J0Hqf zI#Ao%qyQqMEo4+xz8hq7`HCbxA0rdk*Fx)WGb@+ZD%148FMdpkT$~;HL!cgTW(Jlz zye_wYi-dH3znifMWMY2fW<6k`3^bIQuKS0sZcp2O@erZs?UCFD>+2dlS&0bmh*R~D ze@jgs1P59ub2a}M7Mx9%u16UgHvA+T9FJwb1k)q<{3q;DF|Xm(R{h4-RuB>F>CG9I zi|XDK%AW}QK?j^$0W&Yj>u}Z|!tj4kKZTViTfCi)JwJEb{5|b-09%v zs059QJ+sbrxI@M#5ZOl)n&^bb;AYs3=vCX?qcTw-?bLwr&vlTzs8BrQleX{kwHwF; z?T_YIVq;_1?!Y*r!)pmi$3h^DSlS?HNK_~bve#%w?|0+ouwCZQyblcecuz0! zff8XT-6<(@9i0w$4r++6@egDM4C(PcE z@A~A8$&?!R!_$YA5V$CQF{%HOmOD2VVT|3bQ@qTaR-DIoc5>FnGZ_8m5E{jPj$8Tr z=UzaJjL5U5`%?sP#Zmu-+^%?{F*1&9-zMl?W8w`>DHm|*XF6y$$%x5xNz}tEWozu) z>m#ysdY?EyChsSvCw<=);tQ*~w60hnnscp!f0Ua!BPKxn%7RX&?%OL=sS5C4z=X{cY{>OwGZZ{-<* zG)4{f#!NO%Ms%@LJ<-UWzq35}|LyC?&YHLQh%3np^j}D2{Dxr%b9>b%%H=ZO9PP>THL0aB+L=2%Nhdu1{FOcD(-gf=7I6N za(2S&p^Rd!7JPB!+gzcb9N(MGV(%CgoZpbntZjdcS}zv(@NL( z!vBo(AZvjLss^^7QC=?Z6{gtD1$v<#s=d*l2Wm`jqceQ_2AW0cXTvYy3|a zs7H){JSP5k1Hm^5z1IXD6#cAQ0iFpTCi@J0PVioR%BigYT*S)8xugGl5Lz2wL{vSl z!FY{wi4HsZrDNYG@=RDg=7N&b4#@u@>MMh??7DF2?v96&l5Rx08wsU51f-F8=6Ex zD<46s`}SSSm|%V%zGN694^Q$j4vKTtYlv%-#DC+WQD|VLT~V*1yfE?1L6+2`K{<$A zYjgcKdUfT8CtaWO2U6ZTQsEg*{xTn8P|J(HLb2E6BVW@S0p-u_2J6!7Z#P|8 zx)7Gqw|E&lx|A%`cl=H8a#4F#8#?svlode(>ABcy z**KD;%8;`9{Fq!j5DrAtgGbznXxe_l8pOjbK#(CE_U)(RNcU%5R9tS7!tCi8afLkN z3Hex8y29OJF_z@dWX91wGep1;yhXij_ z5yEVdFh~#XhgOZ1Y4-#2e0-_?Jdtx!TCH4H~5KN*c~8Y@3+xo2B>N5d`rcqUVC z;n(|x%H>-#A^BxCAirS2JJ-sDw=6vq_)t?rnM{jmNe;o9o-u_dxp7Wc1>Bc>A+1=S zR(~OidjFRMC7k>O33eAhs~828K2`0%)I5Ci$YW8_7?4Nrul1tm8;7CSLyew3eLQ9| znry`mlP}n~#*0Q+Oi5U?Gr|gaCe&u~yS_cVpY^H4041g3t{M{lOpblxTk9E#GZ~-N zdHy}m2J?h$S>jKUW1}T~iR)fq`d2Ki%tcGwW8>TY!smwBmiWDyrB;%0ri+7+!P>8F z2CxD`%sNI^^gQ}jT9*oSWI5vb5vac#dV3?u~K?-qZDk#-H3I z;hjDRi$gb5Oe?=?38i4}Z{pW=0r457c;>hbucadvqSAtyK#aTyHKx`0K}F372wK_KnkbK+u>u&J$_UT9W&p#e*ZCcccuqcSspI>qH!9F89_?eN51>3L1 zw3Uxh8K5=6fH0T!^!mP^^)Er<_dYK8P{?Qh^2dj+eeyTd28Hc^A|s!X6zKJ1l;SQ2 ziCIslzwxbs4J9s>cU8w(1fc0)uf?xbRXR-`FSLd!;!(u@SRN}lR-5hTx%l~0JlAgj zq(WBY_nz5E;Em`J%A=s7ZPij-ANsp@nGqiGc{B|Nc|WzlQ;D{c;R877@nqf;TmMk8 z;#M*IB6z)`Bdis#;ttKG>P8%K`EH_6UiI>jPNp;WFuYXw@^zO0vdbnnlVpmob`qAl zd|rZgYAETEokQ>d8uG&3_KI~~*OAGZlhgH}K62G=Mk$g{t6`t5baD}aP{CZBb}MT; zOPl^M^kvYCMzSNAN>fKBfckrmFY*At{VBctXfXEn`st z+0N>#!NY*9s;8`s?oWDp!~m&{#kbzk19qzKwqtq4)r5e>0-K`<^B$j3VZd!t#-2e+ zrJW@iLk#IP!bF%+XnbHajI5H!c0dmwv-jfB;}nz_n4(!En-mU#5Q)t7#>XF z)LXE;nU(EOJ$t&@6n=79kcM&Hyh2r;Z{ZzaJ@NVUHtg;7J_pe$1=?xiJWkaS52}_G5=c64Mp6iyG=9oH{JuRjvD>`GV(}GDxP1^6<2OUOZp|{?imcxxp_h zWySV8|JF}^*3E`bJAm*02?wLcE2SC-2B^i@a(tfLf5@VL*IZ$reG%yG*#45i9l1~6 zY_GOLbzNQ^9!4=PGS+)ofdL%IH_ZP_?|fj7vn(sE!~2mWT7M|QZyL;HA8NZKH+4jDl5rC-&sx#yS@CK%J;|I@&Mbo8QV`}}hR;JvB zVTf*-iB5amqqyRmC@m^4{Cm`BbI-h~@r*GpghLY6xO5wnvo#Wx%RZ{c#VW<+Z>Gce zHtd(}*JUS}=bO1@jv`$q#xu^l-VMkg)B-!|b6k-?KK#0soz zDwogj+Q?0w&58z~Y(bFMFrJLZ(<0HA*LMm7F~0*R*C zcH*n(Hf1LSgfN14oeM@Vj6>C?tBEgw54+ zIvylYE|hVt*{KM*B9->F2TWVLX=09Fz1?=JgkTL<#J1m(og^rb7T+8EGq2p#K$Vob zZOuv^{Hn(E9`FRiPfGM^a^Yrs2z-EhD%!eLay+}<}VDB4UPZ8+A>3{EmP zTVE#8VJ7U`9`VHs!ii7rPR@>Ff(bY{7x4Mlt=R;+bpy~#sTKaI&H5%|-d#{}*o%%` zM(_ujmz|q{Wjn6#cf$rOj2oNRW*Wb1s^kZmxtltPc#Js;))MksuYyG+zfKqcPkk~ z&Sn8#`K}NlPBO$lS&LCVz)sVVpEvb{Dw!D^7bxA#PxZ2|i{o%hD8|ScqNZ8V^DuJM zy>e_6GlkxVz2|&v&)(f8CW;mwyeELJ3og}vrHKIj+qV-6#nEaHy2VgWU+#BAigAbp zpJSQXDN&&`!%kGaFLUnNo0Y$KW|{PjVqE$Crw_DOlxM_RiQbOY9(K>k3g0Zl-k(}U zBl2Z7C`AcEnD&$n>NxQO&Q!e0>nK7~*j|>~$T(}FgT!dpXGDvdnqtSP0>20a+$;Lt z;e}x_1CQcG7E^oP1(W0EVs2f#a&@+v+ACd&$0VEr$v0v1DJCNWYTj%qL?uyzn2*P8 zLL#yV_-5~P_*p1&HAJ8ml@}s;#+FTos-rPt%L^SmyT4Sxz+Z*(K3CvkX%f(WSf4B=dDM z!fWbfrxzbb;?Lc)d{(#c1@vE?k9Ybc$p`!q$fR~jhR;YRi)|{;IjV}yGgoZ;kJK+s zvs{~OVDNz!FV@-v)(VG`xesjj`1j=c?8($ZB3N^~&gJ%?8=H!yD7M)t*FVadTV6~1 z8glnnNcz%wBJ*8IP|$QMSgUcCbu_v{fI<>!LSgacna3$0gF?P z@m{PJ?=N!rONij8ZkaP74nhPjZUNqfP=N0jls%1F%C zj^|5B6@2ZGAh^DoJnCSxb~+-5}8YIjiT%$Dm62#MEH<0t5_@RzeO*=wyg| zzs$HZxzn&++wsk@2w5w4%-Ms`Ybg~}Xdqc8$u1W)I8x`a+UCf^r?zO;3|g6cMuC3% z1FOYq{KG)ZJJ!z(S^p@9$+n8Z&eMrv2R2ql7Mn0m$L{&RGUk+!{nR;I)h_pc+oJhc zpQem&c@v%|*6Yhz{7WLF8VUaomg%_|32Ss6<@@&(KH*%f7+oIpi%Vm6@0^{fFo={C z7~>^`VJR8IqiXd{c%+z^M+tzmoZw#(Cn>L+^p=~uAW#qbq{EbhB?v{aPpn_Eu++! zaB-(~X^jeei-WNj-CHYCTg&fAzj&2OPS%968$!;)-R>r$*Uqpp z3?6AlEBR>;zO^gYU4`zkMW@}Zv(PXshQIAvI!nj9?o%kO!!18LeX-VRyqmtRg0#vS z5cwT7(Wh_y?bw>4Fmy$6@$LYcts;}{zNMYlsu^E&)QSUyAz@ho!A>Faf;go}%IOW= z)Zjdq*W7*1qnV9Le_j%Tu|7(MFE=%E`3(qbFuj#dE8?*|DH5KkTn9bA(4yjg6U2Em zQb`nC{$ajOD%Rkm04oEc8POMCC40gQa8)ktzMps8>uqUY3*H{&5)5hH%^M`GJJ+XRJdgipDs91*#r$`N2JM5~Y zSTsbJt9vH%aeT8LG2DEm5z-^c%m%)!3~LdNpCK927!D#(7W&1Iwetp|4*EWu%nPYT z|B-*vfsZ%8$mZMU;Y*kA)yB4s4Hm8HU)7SI-o$A<2A$%DOU<^hBSmjODt9xlvAV>B zZzV^$5S{#pu(L`c4W0VPtE#0O@0*>s_6>MeByN-dlV;@QMEH2J#|~jDhuY6%mU-O& zXnF4RRu(z2O=$u(RpSs+H|Q}v)(?HH?Ou7)t8S)EBij9PFl~v1h#EI%dmvnoRvaCuC>_R+W3>~Xcci12fF>ZR{ORM+vmkUm5 zWLc;EY_GMZzQ||>*B##>!5}a2tWnl)50-TyWpZ(5l3__p4shY(Yk$XUpSy2SqNaLV z*2v&gCeY?6!eAY7%qGA}^`sU-EGASr7Hr}UjKS3(b zxdD$`;1+1)D=o7f+emv_3_`bhznYW#$DN;s-XbK9U}~d56{{fs4t|@Pk&!h1(T;1q zKvP&+RyIiSHy~(8nJPAaw&NXjMfR>~YDns|O*qYB{D950JI0)HVtgDwI~zgRxvB0d z3+>|m`B5-X(Jol@>q6&uCNTUNFyUQYRF6&AO>r|AyIdmL!w8VX%b*=}3XNt&mClyI zP#_$!@xZFKHc=s~&NSA!Kq>)|gq0;2PpAtx6@O#MjbvB{`sH*9mQ_aoER!ZytVizxz4u8!o6GZc za6Fxgyh+9MlTjS`NB5^P?C`qBnUz&Aaa#9i-QD2ZVtRf31#zeWgM>wT{;|-RI6L{g zC)S`dY;JokY0nCJ{`M?$A7%w>o(`g6Ck4#<3#ro)W8;|kHjeJnl}+zS4qpAkXAPlM z!~+XzoE;v0#=V0ng;c0w+X+Cw$;M-iiSDsuc%-@c>Fl8rCp&#(nq0ED1kWNWO+o1U z*92O%(x(*2r(n2+-e^7-DELb1nhOb38zw#Kwzbik3)HQoUqmv$33ltg<;STvW`4P) z0lwQXL6n`Ht$D`L+4G@Q9ibJ|>lC?$t@f4oU$MJB_#8P(#THv>7K!WgbqU&4l68w% zt0EBr_}TvY>~9f^3zz?I65x6_g}B%jqrqVQ@Veiy{Z}!*ZHHorTYZnR$zYuzj z<|1*R;ph3-@&!i+R`HPEZ3+>fyV2pY$}%=KulIY}V+Rz`Lub&%@keCirVBB^NBR_5 zF$f+wY$?DsptAN=RqpoaYUOVm z$pJT!L5MC7*NQWAt*vt0Bzj3KIUpm0FoY^`oG z>>h8Se$YYVR^9u)g;bOES)JC6wV|vmi{`T(z5lOux%_=ERZ2PH>qT;G_d3#+<4^Cr z41V6Xur!JAjergMi)&Xo+{^5;T^FY1^FIiS&?N(lqQ0Ah+R%DlRuTm`pJ_@OIwyp| zo|8NMk(dUXUFnc;w9>CZVv(FHSWWsaHR7UHRlAw(fDmyUQ@8PC)@{Z=;#C&tJ@?TOq(Wiwd239CF^+w_S{j`?K6sz z2q%b1)$6dOgLmx7t6_u<^{$TyK9z^Ot;=uG0FmcR6+0XQ^vm|lOteaq-z3i@JCNNq z8b}ju?OvIj1#gK`04Ad*{V*na@^fL1x>mW`t^PJy{gBy^jCNMGX!``KAy?8fc1} ze>FJC$2$wa`S-HhzUr`?#PI2Z*{VIy#5-zsewsku+b$IAgh-$CR=MlA1v_Gq?+7p3 zy29X)I;VZYU8k0G49X)8K^CmoNy7+$J2_&dEdGgvzAh(lCM@^@p{>=D-=W2otaVm1 zMiojRQNZK982D)fK7se%mm&m&+lGtzGPu2584Jm-6Alc*G4-c;ZSO7K(SwKf# zV}1DKk@MD|&RRHWBjl~$(P+jk4dY^u6PxK2{|QBq@x>o)H3d>i&p)zT95JmiybLst zZ(6GMKEtpJWFo&cQ*I7P&muCCZY5@Ip}y@>S0TmDXOT6U8s%CCItkbd#q>om_fu7S zf&OtiR>xy)$K$b70cu|O!kdjQ`=Z2b%5Zecuco_yc%PY01&GDDjvW?+y{xNzLvz-D zPxvR2Qtnj>CkByu6K+7a{bHajObE=h@J3kXobefkgtnmALEuq3~rCSKCv z9>IO}WIgM)v39#&egQk*+$-F5jzDg513L&2{DCFgifIgU{I~DIy%Ik0_yF(8qdsY) z4IAMY!QV(+-eEt>E$by(e}>;&?z)5lCGpwS<0e6LnN|FJ6V6{Nmp3{)A1=|OPX&gB_zX&lQ z$Y6r&?N-A;|Mk8$FYWCA^8(~Yv}OX%$>Ur<3@YtGhs@4sMN{Ahtv zmpdG^-|4HaJ^Uz2Ai)pw1g2MaEj-Kj^fdh3lN?-0fxt>Q{+S=NY<*+v&vZ$<<*`5M zPatdoS*%R=Q)JIX?`?~vzk(Z!UTp`o{h7!Q3WRoM=L+1@kNQ!8M&6{ySgW%sOvsP~ zU7~54wSF^wOt_k?TQaxSk*6-m1>q`+==M4~`tDKK^&91kSYu?Hi4S#xVh*A{N5mt- zu+dqrEyr&Oz|e#xTaiD}HHLUg=;8xDMLy=#k>XGHEazgCrJw`wMaB`$Y%Bn60$TlT zWNs|>5Xo*93hkahXGnH!v+B$RK#$h<{*3o=3HbVhfBN zT0`XVgG83MW$(sJeEjQuCXJ#oVxJU$UvGN?9yuWo&#U@R+5uQwL=-EgCqZvSt~VZk zt=yW^*FEYCXulN2l@ESZ)`jNHS#BM;?WVkXz{O1x_~{EJ5p4V>vI_@F1>xrx{^VG) zfVMQcIV=nZJe8pCtggNrukwzlcYz~jEZ_T&dO zU=6Yoil$EF?1$h74{S{K52(>HiePPMm{C)N{*5vF%BKT79Z~ruL#m+W^I@F& zS;vC+M49lJ*g51EGxXry^zZC=nzGgvBSkkUrO0_1WMYH!wN$KvxjC?( zqBi_#D^!Mym35TxG!#-S(NhQdKH#t?`LXR&lfW{Y4?*~!^faD8KzvkWjl5k$A+xh% zRT*|N=ueDuz9o%9BMk}hGF?ob8igC?s&1?f?Dl>^mhFx6gk#gW?#(yhG&`)HFy3V%^%(AWQsd~D~T?Zd>3Q@x_?yc}ps<`uP4J(YV!c?Xa2gZ5;E+7xC0UI<~|8W{1;#mjR zBB7USLn{>$IuTjNPQvo^7$5t-CknlZ)o0H}YYOgZn0E)NN`C!sT_TW6q`-1NIiAJ} zMx;POSG2vQ5!b9*R~t}nS;(LjX<>W@xDO=4*XY^P-QFH$5R zMw--Caq4F?vbrPh+Ys$HA7-^UR?p_~=so*Xd35r4z`uHn4*Fwxpqst2502b%qOYFF zzBs9w*homGM80^*FHBK>jFqwxUXTLJD;|=@Z$c7s92#7i!QVYvj4r!vA)U zB^J;-DW;r`b1~X+VO**wrhNLi%?yc|4QujB$!o9oh3-x^IoJsnkteg2nI-<`9D`AY zTV-W(sr!ZrRO6T5ZDfELITfo%g8Wiuf~sX8L`+o#?MGP1+tMfz?H{HCl`G88~!(8R7Qem zz#Ce_ix*#4`W>c`w!S==j5_xuW0;l{Ixa!iz8$z;$oL@hXwU#Sqa#XM;V7^+UnkT? z#^LXY(bmWi-`5}ZhAGYL_qB)et~y@P_oW@pzGlEOsvIJXwKk-DWExM(PdL)55oKdS z12>1Fj_~**w$~lr?`|BsoDd##h2OfXb$4ege|_rf@3+p6Hjrfm)T$~h|`5hBW-)TnIJuitnpT2IR!Ni|x z8dg8y3RGlGNwrELhx6G3R?s?gTdv(g8TzqAy|bC_RcZ7L+Z3d436;87D9oy`N0OOv_*Kl99mt{~1E8AKWfQanX?{=NToE1WW{9I4 z@|Z?tLxq(0D4GT68BuxdpBU1`La`C!{n|q)8<2r~N7#KF=v+(QiD1PlBZh>h|2|W5 z)u}Wk`~k-OZik3G36g)SFY2^d3n^HIGnY?(z7W8~08?a#x$7fsnnGfJoOqNV+{9hO zGc!JH61Z#;I=xf&W7$oAMb~j@ey)AW654L(23*QRN5d`CLR|v;-OxxirY~rTv>Jud z^@?#o3QA-S)o<~j-{fAKWTCJJ;``#&BL6!+52Mj#w<*>?BNS4oSJYB7&0rY|&r%{k zyn3v}1N3E1{;7NZPt;dpt?y^!iGPPyA(xk`+noF>uT=~YkHD0bQ+(N$C^I7sujH^8 zKXk5*OFYuMb>B0Vh8s>7uoCGdff0lC3&?ve+-%4(gn)u@O5N}{Y9+kx5v%*6J7K85 zJEVd*y2DogblZ@ih;S0Q1xk>ClZr*KI)J*^58KF-zr5Jl8;;f?&n{S1^~4Sw3%o$U z@SM_c`OVD5{4hDRZ0%Z2xf*x$Tc_?+Rg5`Dp$?IX=&}ju$_JaK1a7+njh`fa(0#m@ zghzq7;*+#civSZl1X!%#oD=gX7XYw|34g4i@G3|t>X)w+0yzQjGUiz3T7kK3(fbgR zlmFtrfWr~Ek%&Z+?Oi+8jUl$dQ==f+6ePvte?xoz?R#K+sLVn;6embF*PpvY*5k{@ z9p?ug4UUNAb4Y*DMiis^u+uR&`)jfa(Ppye41gQkQo%y_@Z?%*n?rZ5gMJK9Iz3|& z5b#0$Zpu_$KXg>}Vxw=f)a9qtc}0vTxIrW;cKG7f;YG-~MfGgemdTtzfH_Q99G=A_ z#=fg``{3MK&iRqjX@ z8e?xR8R4G0yWEw<{ZmSWED_{sW3IOZn7*Lryq*r`aOjJyiH&E|d7||`;S=tF3U@=B zE$h+Qq=xPcxL2w&-759Z;a9j&BCIN+2A}E(HwF!@0L>LV2B{z5nsx{r8XX3YbrXDv z^zz+356zvHR;D%4rTOr=+X`CtwC#c(-o6q5It;6lNYdW|asD~>F|}eC1@LmT2xE!i zf^KTpvlCIxl!CI!9CaM8z#}Fp0=EyA{4!-7$i?k;7sAe({e{?mXhcWV3vm!7n zG9K%Nsn!v%w;6ADSssgiXDYYp`Jrmp4Wa?SBpSH_cs^tK`hyPIHh@rSyBdto<2jiG6f`WsD0&; z#L)x>OA(@-L9pauZOUV-bOSIH4Cp%U^*M zOUqv5WuY*P;P%Rd>| z&5r}^Pze1Gvg5N1nzfstLCb@HF3Z2KP+<4w!o%=*@AJf39IKwCF09rr9N{Z-82a9R zYqXzNnKhpL(+M6~a0Q8IGp2JWk^XK%aF9Rt;&;7IaWSLlCE7=VI!A@V06b(+Wr4^3d$3(U6YZp@+-#Pjtj`zVij(ezyJz!nz4I1I!_e|ea_x$XZzu)^jr^D@g@KR3he#m%mb2lH@ql3a{@7zy3 zJGNL^I=pgc{i5}Bt1knir%P0Ip*V{n5s-bQC%6n zLe^%>4td2-WYSlqSdrNH`xfi|aOvT>E&w(fGR>Y70Zb%0FBl4XEUL`G?>w8g5#Rfc zd{&H5U+YbI>$HWan=lws!<&UdWq6J!DSz@ss?}ehjA3?2ueFO>dX&=3`Bfc7$@#4N z;NHOXVXTY6Q!0Y|c!=Aq3E$6u6td!I35Lr3#rZ}!v{HS9)a=Xzs`oy--`mQK>wq=7 z<(XwNK5B-68oox)y;q9>^hJv$_r8i2P@WNt51AwYbkySL@BSQ`5fO*7#$>aO4P3R? zmX1uVVj8f(q`Li}0Zgh#z_jbxLHBZVTsNvH=BzY{6TP8AT&)9#mE0D>aqd%Ate)@=%?PvO`PpOYS2JvosX)N0_cJrFjE-RphCt_K#1`mLnz^(K~j?SBwx zI;CrXz4nL>|qzSw8wFk!>o1g%z7o`!H9I;lz@KjcY@Mq6ic{iSVf&pSO#dks>(~iGhzJ*V} zh)e@s#j{+a&z=#bg8aME`APTPSMs(|O}6z4T5 zM(UQD+H}YgV@c(qe+| zypcw|qCwGSs&u%qDAN}uwfdb|bt+C;ccpIA-SJUC&mg{_=i+*%Pt5FJy$5SQMKCax zZpOWpVko>__OY4z>{M1yDHly%d2E5nD|i+VKcF1jGcS{&142hXj8M!T@6d3sGjM4v zCLjKl=z^$hB##?gnE$iWfi3Tq3g*v!`qJ`5uRILd_y;oUJKeI7$K@@TzjnrUw?s~5 z*~gr4nJ4Znq_9^T4ei)WL0whgvg>z*^ZmI6YJ>w9QnMHV%aAA}N_k}{)HkJkHrZfV z*#cP-z9+j|JDBgM+Lg?}P)+Hz+AI!fBN(BFwRXX*DOYoXR?| zxSha|D%O~GlZXMkoA;YZ6Ky}je@f)5Cf;J++`0$Xr^;-8!f(-GA~4>Xd0E1J~F009Y>yj9nFjcQ4t~bHWO1#yM>@@P5crQ{LAi zI204>Ly+xewfCyn__+xHp>|>V?&0oIob({>C^;G2Hu2W`nE8ElO}`HX+E35gB2Kx+ z2|;2JRh*Wj<6gPii!_BQuMULV*50Fg8|(8WmT;1=4&W!fJ?D$iar#!Sujsi-?+u^W zVbKMA%q?|KYgT7CusC&*aK=Z_6RXn`8=m#=}Xx2TkhiH*pVrt`x$dIAXYWbKaH zyQ!#kz+?g^>(|B~Gu&bi3hHv8bnvofW`r%Cp8i}9h-u8rA#z?lIY&kosZ$wICYcJk zJIkdAT%OIYr$~bU?+zF|nz{zEO_U3k%E|=Foe#0GjNn~}Py;}I?%Da!@}meart7!A z-btcD$Az?pn~Sj2ja<8;7Wsft$R`}1fB=mN9OGeB%b4P-%DM9zg>~}mMP@5%S@3T~ zj5N+G8>f?(Pt+%y=?VYIU=!_7I(WPt(`<}noc;VJ{B`FzAcDC~q6b~4cGz_-WTG*! z*6%Mha0jft=n@codr?)6&xTvrZa;dQ#3YMWAJHf5Y70R4ZZ8b$9iQu$k~4R=0wT-((UsOUW<<+3%F;$! z+?LyP=04zfpnL{1x=-%7jWxc+dxqA|@|gl?2gyp1o*1ghR9cHeLgWfB%ncpCdPNVoT-v$m#X)t6lH|X$V%Et1U~P z^AoZO=1NrzGi94{(njaWfHC~j$k6XI)7YPCv%Ka!J60|lB{@%lv$DN)pv0#rmp1r>mS~C=63z_1 z0cnq7INXw>r%p|@kkFSnC9bV(78*z;!`%FMVG=sU(ANmz!J%X8S-ShrV*c;~q))=J z8vK#8suZ^Z|NfM8{3*F`ilF|nZrvbD3%4*VCw zovpk`AvLXo1D1C1wnc%#MiJUoX7b7j9V0-OSb%BY)nhSN%?CRMm$K< ziUTE&$_E~XLgrQu6$%>>{gGeLwW7sfCLc<_8eOWdu3jXO>3)5&$LnSFQQvNp8x_

cfwwOPFZxZdCpDr+9LqJEcc(}S^ z>?)zY9{UT*Lv_-zCJ(G>m8qsx^9K@G>_wf zIN+~9K%-Jf=P`%^QQcJWE4>U2Efbo#knOA$ogBy=!!o6W(R|fLs=;L4_x(*s^delk zv)!V~8zKa*R+1pc7~Ly*%A8Z2AqB%mytJ_jo-bAqIMkFOSV#d? z5#)1y8U;hQ1VB?VI=aVNh(}T04d!F0VdNh?SC_fZ{H{A}U^imn|n)9tR*=bi@pi8vVTw!>pDf{haSG@te4>N zxVO=@#bESRl;dPpJ&NzBrhFvnv-e zzVG9@e&A2Xo0t^y!%EW6*XZIF%}A=x;k`x4i-KTq)>^!n+E%?neu4LoV!=Gs* zC6$(kaK3)U=q__dFoHaYZ02&GBL@Jd%nj!i^2d8VJ)uS`7z1v9xJTE8by4G*e4}8- zm8Ezd!ll~5_Zq0vtiQWO#4;wVs+TRQHl`foHugmdD;w#(HNkixkU|7$v)c&dnK}yg zzEb1uf>zDrDns^Ua1b)@vpm^*F)rQ!oap|o0%6&GET%P3#tc#<&?WR9+I|BkSx)*H zXKn-l*x3#6)fXN;!-b7}${(t(-=M6*6*)?mh1Gkt5oFZEbZ5o8Pu?e+Q${oGuJ7)Uzwqf$gQ)V!dTdve zoIItEsSvFo(jQlnnfy{SMlr_y?T0CwbCG%zZO(b^ zlUa$yav-ZWwoVKwY!Bi?r*k9m*aSbk`giuZrArHBTx3xa(6{)z- zR~<*bk;hr32Z3RXt&78cHrw7V$A>WT8M?J)w(r5Mk4-DNePie;I6{#)gqwk3bq@00 zpR9Ki*1p@zog5=;o4fl23~ao!VSBtBmdN_^0~W@kQIMuzF6dvQyX(cv(+kHmHNAzf znWyIY&EwmF>k#oc!sC{Ta30Iv+q|#eD6(75-uMY=$5F)-N=$gmhQ~MYY=?*H z=hq#tCJ?Q;V}{ITwXn#BcMTv=4@!@`f4kR^|SU9EBwk3`zO(Iw^vvVRtfV#2E&UHsFcAAKK6rR1(d&dNV(JMY-t=8Al9H>J^4Z3jdqqK zsY4iDvHH-0vbv=M?l$Ahkd+FRPOy4|&}C><16uBT6gJOWuda+mkY|2ydmOik#2SXX z9Y0j-n(8EyVZlV8Uvw^D8;9-nvKyS8v%|Ds$)R&G(!k7ALdf^zRQ( zv$yfmugg}p@A4>Dlzuk~QTw}e><8jZO_?1wpSn2Y`w>h&k&~~vWN}z`?;B@#g-V_s z;^qf0Igg~0>WIwT+A~UBD$bW~Wskl@=0KwfnH`48MO9vO;g4D)8PiVjDx6+j#c!N6 zFgN==X$VBfYAu?@*Ocm{hE@;W2O^jWx&F=KqJ%dn9II@OiJrQQ3&oNA#;VV#@3qN% zf7pgRHdPQ(ARmx+WXSawc~M$Y)adSv*|(ZvRMSGtdxqN=`=r8eh|f#ePX_%mmmLwN zOf`CpaRJt_G!3~t1Kyv53&v!7?H;$st?H+`f8}Zz-^BTVJB$+ns?(Kb&H3p-3b1iy zaTIsmbb7(Gv+ZldBpt%wQ2h;M8{B|_K}&H~Jq@I6dyT2h7CCW6U`4VDWx?Zo#Z~#L zm*Ko$Q#Ss)ed_u`uqRAFC{sth%Y^d78;uI9+E8n4?YqT)RkWK1 z4D{xeU@*!NeMpYXP#XC9l$&WaFe z!0Je})Pu)$_-st>{MOR+f#s_CU$pvu!NBm(!WiH6%1EOr(|+NvZeRlEx4H;oa@ZfV7SiO`FnY9^Is#@JAT)_ z<9(%ixOU9aq6}fJm#h29#bavg)x&(!-utZ zj#nxsG8Zh_72o7yQ zhW)+2FvfmJ_0pYHe)=kJD9o&q~uL+!2jDanYuE`y{KZHVIScN_~Eg!ns%y^hk6yC21U>&_=pO4^tn7=z{e#F&=YnmtZQpL25(GIqNe22KS3 zH_Uf^*?@U{YphLezHs5O^;me~eC#OaNmoPGghd?7e;_gUZ{zz^@t3`Cx;Pg1W25gR zQPyDeH*xg@-_K?nMchXbJ%|qq@ee~jQg3@?B$Gr?@wk$|m(l!jySKNEoDwHeJ^vGZC?sMUaVeGIcR~{)j+}QdX@&o#H zt(+JOX0*2L538NDO>=HamEPs<#%Vf@_iv@FYwI-37Jq6JLMIn{!0U`Y+espwJkY1Q#3~nIZp)LKnApA^yjrr?#*ds_H+`!3L3UY>K?oukFWl zC%E&9Y7{_AB;mSmm+rdcBqx$J-^DoVYQ;>04=AR__PL)V6!0jAd+z_v3-x}w4V<1u z;@$h?BP0eMUGHO_afy8M53V|%R1C~UaF(~9ZUF&NQlz^N-6dTL(j{He z{r0){U4J=-!MAJex#pU4?OVz=i9ql9GVEltmfR|c*8O1tzt>(HIz-gNnTv5x0Ozmc z5;}prF#WTxlLfgkD)P@gv;%cQPVO&*_MSP?6vyx+sjJ%_ixnAFDK;pALZ+kfr+UjhXl zl5oUOkmtU~(~qoRJT<$%-jw4$@^fa3F4a4IJW}Y5@G)Ml6Rl0)C<~ggDnCwec->Rt zL64mKSkpTX7xaQvNv!pBmAEuZ?SSUvoUGaDKf&;>lKC}lZUIupdVHNe3^3QEzMRo2 zx(o5h%X~oz*^5CZ5Z;F~cv1NXe_bNz+pDJqgFvJDzFE`okht5DLFwzzLS@}2Oo-G!D`0`8r%meJGhbGr|uVf2ofSeDYZ zJa>nN`Xwr=dZ>C_H$=IiB=p+17sp`lH^`QBw0qC54qXcGPf?xz+qS&0Jk)2jt$w@a zfEtWwIdgw+_jS}TE%urDBK=DX1aY;6md*D?w|IXhyHZCzqtVW0=oir#SxBrLpjox& z$@HtIIS?|pZO%Ux?6e-ZYr(dE@rAq&Tk$SmFHnbKoAjpoZ;?tqYdtC4a&mVLN;N;d z!b-sW%H!j$?;WJ`0?^vxHt7}1nO|W3VLMx8CAUM7Vb$2f z4?^DN442j7O9au+KFN;1%GM-$`6H&hJ>Pf2gKo*?<=EydK#-Y}ua_IJiFR@mN(+YW z?=0gJT55%L4D9s6i**A-S`Gd3C)mC}`wxmH} zL-<1i;%9w~jk~X*v3ZGpg-DoMjWqmpFHW#u&WKD1cXZcmexZ~XtN+oRiOuODHKkf` zY&YFifhA@CK9(!#fkOUwV4Xp_*UkvP={YLUKx0<9vl! zu#J__5T}1UStMV)Ss%Z}=L!Eyi?j=ZozNDX(PP~!NOS0eqvh}@crO+$#cOrt?zFSx zDo_0FKN}a<+eaQq)yAi-KoU!7N)s``i&OV>S&Q1T-S|7vu6A6AsA~keYWl7#gF5jH zx4fc5<4pHwY=36ci)FlSje?g)sUjXLLoR;pY|4R|1Ex+(dwhQ9GrE2cl}sn6(`jp$ zaYIrs4=vA#PmU|c5(JlVL|n|&g~}&N>|2y*3yL~t1JIw&Qv;r6;T!r!?5EMMpoze! zWEei4SJy4kiSClFpqNz=fBTFCGRWvae91wK5tET*@!-C~k>TFgxW-J($-~ek{N~o2 z2F$1t%c6Bn|6-`t5QxRS#) zUcSF|Hi5A1=C*bN9s*&kM=~Ubnz?0zyZl$e)Z_$@+f)F9yhSK++f`csY8yqY@fKDZ zo{|!kfA@^Af85{~qTLDgRK&;HjgODbAQ9kws(Gfo{FcHM_dbzuEo{b1M9}My+3%{G zt~d0&a=LvnJK^8kGh|KsE=_Sfo$}`;M{Az9LxXcJP}*t?`G^9fyXd&(j)SDN4tj8~ zqD$|5-{^fMt-TzP_Z@Aaq~<-cWKHBSKljkRzSue?98o;~ZTMtjNdDqyt{(K>scg}|tCZK($LgZ3o+>X|n~nN44M>!0Q8zPYNR4vG>0l&2e6{zFRW$GqrR zX(o}k4DTLTBAQjy=kv+Ml}kY~p~uOBn&&<`7qZQ+TWQjcZT;SN^t~8X1L;I}iu^iA z?4>M>;W4u-J8!xl%^z#en3Jgdocg-0LT~nQCzV$kP(0h}2+A`#1<(88m}M}<>>>$X zFmnI25pb%=!2~}6Ah(32nH3WEjdj8UeuGeegzsHy5OgFlzPv14$Z3B+6ZEx!)vM`k zZoV3f0aES=gx&d2W5uKZzTJN_PIgbPNi^az=N{GYm9}T87$?Y7)1MdmK3PoX`6p^D zM)o(53tkO5+v&atu}&1e-ZDc4tjX#O?UIXbYG3j(nUq?}Y3L`MzR(5`RXi?Mq>)2r!E23-?V$y1rS@7lKjo*|>!VWiv0(|++`=LAqbITCLg)$t|@FD#Yh1%>y8UfldDjF#-%0l%<{fmxlR^x~6K}xLeeoZ12 zLjN91E)iv^W#V;C_>Bqm|BX$R_==(MerTh@2dNbtgjm=2WKd7~M{7!`o@03kcM}MZI*6BBXfn3g!N8xzXK47x0gj90qJQ#w z+34k+?oGI18$Dk)#M2{_OP7wig%~lVTnhCH+fYjoB2R3GASJ`2m?49eolu-Kz zx4doK6K}7>M-8vN2WmdU_X*AT#lm#t30>v;s;hJ!og^z6!Mb^U;6ghk2~vzPU3=yB z3<9H{c9&mXF9;y3%uhruPSI^%W)-gjaBT^sf8yJWpEMRxnpES2h$KM_=&F;U@bhI@ z*|9@RMa0ak?94rTsm;ZvD)Nb^;HoX~ae8Br$&viN%`m;Fqa50dk^Sg0xwE1-KN0*h z9CPr6%`onfRLD1I%R_Q1X>8r*Di&e*>l#ny-Ug|+Z@8&jGy~^B{6H&ivBJAbErE+h zqdcprFF9_3lgXUv@pKLKe&rBtgl-8dv$A^u$+CAu_GF+=hOKm?_S_Y)g*h`*LE@}j zBR3OQfi=|uR*VqlbfVa>*TJ`kF+JO*Ra>VNPRD?B`htsMNl*FHR^W8h5%GHOx1awv z6-#M2gJ$L5?QUhDY4JT9Ry=hbUaJ@`7Kd@DzZU| z2!OAVMQvICBt4a>gU zjTp;{-mvdTV4vsI>cMFdApelKqvD_XZMLxvXsjv=hs~TPB?#2Unsh1&yooG@0437L z`j@zR7{MlPtiiIy<(jqtz{FaZD zw7-yk6m{eP?80qVnLo`Krqu7A`=yiJC;RTG44W64yGZ3>cP+-JvG2hSJ#lg8y!8a= z&cyrr)_W&4-4UMaq%9WnvJ*L>yz#nCIsTmJy!QC;ui2$Xw?6s=>JDZFAOA$bj?GZ(h2g)$IQvPO;P{uwxSXYVhrHYFQX--`$oQb7`sv#U3Igcl$hslDnR`14jBwj z7QOwZ9^$>#yt0`Y5&g+&d(}%c)mS2~lnY8PxlcrvQ2# zUv3*Lvd?s{o|>4E?O6ry5{IzirL122HZJ$ql+g#pU1EmA$Vn!qMNrd9#%AB-^dsjw z;0&i3qbk$GHot5K(W$l(UQ`U)IOz`73viJQ*Y0=h=Rh+yYM<&HB~YE`KvXNlGef(T zKw`1HX3V}~JVjzm^uDkwSh**+2v88aBA*K0TTlFtT7Ci}~xZbf3C71*${;9I>B!84)7=gd5^W{FI>e)ao_?f8Nt? zW9<_AN5m;>O+a>tV`>1D7$}75@dN$$8O8|Cvr!9YYu=;t*-8R3Q2vUgi;78ah_Ifk z7J#UpFZB3~8I#t#pV!JA$LUyFZSUUh!N>qo(FYq;N;Q?sLS9eH>Vt2Pqbg744eQnR zf_xFUEQbeV+MoMxS$q^U#GhQy;gf&qq*ehWM(apNYV-Oh#;>d`!ae$~0cHL0j#h8N zu#^XQl{s<;bl;q%krR?qzT=K`DG z;2O1m?*JAzCrJJRDv?O|3hz%|9M-Dy99x&qSRUk4_2=U(wo=~u$lb_wxx_nnc@JE) zRL_=}D`I)gRKf&k7w8c3+{w$I4*D7Rc|OK<0^-2$G~wdf&yZaBi54r)UP$W7SBBJS zYl?8O`ZW=*GsVe2e)`d6@j7K8|V&4DvEd%8cXpuFLZ7}2J5^m121~} z$@BU16eN(clv8ANwj@-9hYa2;ouncEbLOdhIzJg5Hj%pQ#)ow`-57p1I6zS$(`~<> z{9biBKKfP(R6w4!^+lqc5ndhti0GZ9IaP+nFfP&)jHs*%*<&U4f*7p;xF}EXrM=^dO`PHOYOxloT%Ry`U<_5BHyo>=Xnc4?|M54-#8au zWIqsM@sU2bN+P$Al*8K%*NjJ{y&EoF-}8`*cYd#tryl4{V<~`hL_9h%<7~O6tX$>z zlu<;6j0UjS8X=;D9p!|jnX4Ebm+mm=G)v&**An?@$n3k{64;O@j|u6eYR7(#S55Yw z?&wb_oGP(&liuLs;&ZOXzj;{>2|7c>nEQ8)B@=b|P7F#90GQL;MoiW8$IqHx(6{Sx z5vf?Zs3LZ)_-2cUesar72;q*j^)odTc{b|tPmDUZ{2U7L{wF<>ekVPB9MO?;VnK~D zZQ`%YWaKRoH#%Bsa<*>a5S~Gd;co_C+e_)C zkrIz0%tulngYEhWS;GD5o1rMpW|xXt2Bru0KgH)<;DStEeo&$k4uy9>JM--OzWYv7 zLWCPd_1I5Ydx6IN$G<=^lxm6!EnXZ>9p|R*+Isndmd@_+_QX#dmRrg}g{9QO3(c60 z0j}hR6bwOP`5Zdo#zDgb66=X1mOTSYLnF25IAbUQN!RLY!fWq4H13EFCuUB~c8@o~ zkMi1Wr=4?$q9CT&gGYK3?2Yiy6O3PZkheO%?O_+kgr@MJDJEG~u=Wps^Ti~Gk3?R? zC)o?OPBcgjSE36-omK6Bj;8jknw|E2pniqAc=422?v!Y*y57BD=F-n<6y@W~?Mv}L zdA@N3$NI6>ILn&$1hVFgR`tzS<<;fLR~{F^C{ zak{x@@P#!kR-2;v!%7u;w}Uo7l(zCz(4(m5x#DuAQ4G+K-LX@D91G?-xSX%|<6NB< zZfQvQ)PiIBn)leEYEhhX$+d;pNOJ>{*0KkmrPh5;oDmycffBAHOS{TI$;x9ufy0 zeX)HFn(!T1)m-UK-*i9#Zh;243sxA~*E&h{4v#i7`j`Z&uQ`Z(pwKSmkcmH)N*uxy zK&A9p{}r6sz#2ArG4~#;bo?3T4^>-f5?o52{H;}oeBJ3Mp>#XTUiV=QsV8Bv+X+ql zwNU>;xyhMjQ@4dU+a$igAF0@S=@Na4p-$xfOVAL+R>GYmfhEqZ7jjS%$5p3?b4U4x z0dzb~_t7P7ukAEbLL8#kJ#wZc-#3ty=myY}22(WylwV{nMXwQ1nSJCCj4b@S`tDWz zyJL6OO10)K#yZc}IjXi3)LP;N@5S?f?foVZa;X0JSN7_m(~KA?^y4W1fVdWzbTnu3EuREpme+3xZ*AD;PpJMp+)M%LzGKNE&0PY9lq zox2Ofkq{$q{g8=$z?ANm(qVQV8TzoImLJBF(Vx8L6CZ`} zMo%lO=-j=h3BDh+pi(P)rWf0ID$&gunQBpMkcO$?yYy?se)CwsdM%RSYHroZGq~_>*6t${@J2M`FQ81 zhY+#it{z8nDc2Ue>o9t3>jYfo`zyi#Z-1_OUn)&51*qQJA6|k)6ule2j#V{P@Z@ai zv})QCFb zh!*f6$I~y?>$1`h=$@w``jLY;8w}o3zxI9`V(ezQDdRIvx^_kcB|NvJC~ohHq6Uf* z8Q<_MYfznu8LXV3efYV@z%Ny1>4jbC=m3}IM&ySKzViT@*z1ZpWc^n zgLklzwZ`B_unz>0{qArQ)dib&McH{NlGSWdk-k}@wnNF{d? zh;cbzVwBO*gvOFpXy7FmTdrD6b*3_17EBTka7`{G0lYc*q8XpZC7&1rNgS_~Bp);e zCl#ZlQ2PF8uL75iY&nqIsF=ct@q_c_*M+-mWk$8!=4yEnZ0DSI@;x(~4Il23wF%P- z+C|^Zhr^al^>uls3;1Cu{GaD|1eqi`6`1Nz zE#|t5i`$Ty1)6k~-fHt9e4QgV=c6yi4`)G@HqN zc-Umk+xls~%~?2>+?`Z#M%Dr{)Xc`!LVi^^M}*nO-?6Xa+Su^#i# z!CIV7xKDV7q*QTFTTC^YelagRrMEZ15}@Cd2pRHYI!PnW_(}Wfea|G=9w$9Ipt2( zq;{)@FKCzhl&JUwo@4J&_rFA=cD{LLL(B1!kBD@{+HOPhqx5i%)o#YCA&!s`%jB@g zBvUhlXRQ|@#JRt$syB}+S6Q7AAbio+*r+#v)aV_{69IHQ2;s>gXZ}Bg_ix<$%kDI zP8XjwUW`WaMwCt~FQ*2vepDZXzgpWiSPTlbV2W_^qZ)nhW`tOis#vgVI)Q&4lDk#uSFEYn$Jbf7U)<+^Wn z_V&G{@MP`_^vt|lQ52xl$^^|7(%8=bvxKq*jq!hNKbUl23P6LEA?Sx)poK zt=X3f`)DMW{C+T9AHJ%X(YoiUbKhv!y2>pmMjH?GAr;78dX^i63}|W!A!kI$>aW0u$nFx& z(3_TBN0OZ_Hl^=i%AW~ijW4yK$Eb>(U)6&uPQu|XU$RyNkf2RcYrR|4d#M6yMh!~@ z5Xhr}Nvp>bqra+Q!TXI-$8jT1pS3R!_Jf;m=qa)LX6-*QxwpN%%4F&FK&c!j7Xa7B{Pc^PTRWO4O2|LQiI?O&`6AJkk}XvZJz07jN2s8Flwj_0rH`qW{hDT6Jp??1a+8wlQA@%`ISkl1=n{(bCIgNtD`*J?X(wP;VF zvkYSjU_~j|y`B_?I@>>MpUWPYU!f7s?n-VP+5XU-Ic|B;VFMzZ}bC)9(M3Zx0L#fCoJiq(-P006#J8Bdpu>n6&uuLaf88=&^z1br58WI ze&XgDnpR4kl;?-NPG7xuF(5CILn7?wg29T}kv_B|4zJcpo@q z9GrXQpycmUmDxNr_|B{qz89>;KR8)t)=X3;wW3LuV-dy2F=rD@+*=rS2x3+8 zJLf0sJZohJBl6xY5ch1(mGOy;(FI!e->&!2|N353GP<1mWow=0jll2-b`N`V@0VI^ z6M9Mj;#V2IZxRw^iUP*Em}N4uH_S(sn~$g-s6xT}QK$T9M{|$Jx_Qb}lC$qrzQ-j-MZ*hM;gGAHeU;$zFbIo%P|%SOpDXwB+C?l1Y8 zQu{ORM{peOzo>-z)5}jzmJ4u~<<^sA9}ag}-np=|Od+R@#`ONvF+OqI>deuoNae*5 z8zg+&c*r`dllp+v`FT%Gq$#8Qe;t-XZui zS?-Gg(?jXH%J|Z&!w02(J7br}%UZE@;-YOBzQbYG2ss*>Qo>D0F;*l*W6`6xN!1p9g5?%H>N+MiV5`U(-l_VpZn16 zRky(?_Rb^)axpk%!;9sKKXKXd1RH5;w6|pLEW=bSKXB%0?R)Y&GC6aJ$Q0VC4GBi4M8}<2MXUDocwghPXKY^ zEX1UD-8&#nJp3Wy>w0vo2>Ud#GSKoxR$_f|rP2}1Plch7{fI$clQ>dpz2NDQ+56(@ zU)KIiBw}`508$4+P2N5_^|`&!s9&D|^}4Y#Q9yq}^#2JJ)}aFN=UjsT-Vv_!h$0GU z+Pl)vj`U{tRZ=gHE@MIz?5_-j-~)XHmX?jtWf@l2jvLvkJPGL>R=&ix(fDG@H6u@l;N8@$`X_CMdJV z+UW~?`^;eI)go}EB!~ZwQSJNpTvr7X>Rw_F$}E6-do#aTd~aw%8>lI9KKTGZG0$GI z^P#@Wfr!4%iYO{2k0sxml;NApvURD}tA`s~{Kbck6{S{R`M9F94Nq7(UHHNT-;AQpmgpGq|gTv zLGlP)(+=uig5kk)^S765WAS1r*Ubj!08jD>pswyQcTee1Mq=d!+k>S*p~NEtU>^rC zJ=3OsiJ%%uot^^q9JYhTC>G9Og{`!lR!)9hnbZR(G~v<=4svPsVnbPLlvC%gm@zz% zksv^-4juPb50B766&0vE;?1=vYjem!Z4~TLLZNu`VBl;oU8n8E2SqQah50j3;|&4< zgtX~>Fdl&|s7dA=-w6LI%15U(%K=)&ymrZEa^{9-*Lkq1X!O%W0V+)nUqh_~ml;cu z)0>eWhsflBKO1kXXoTTp*s6V5WodD5xhs~hC%?or`*AIp^;lyOTN+IFap9LT&=iM% z7C!4z0YZknI}IC*_S*~G<-5n$`GGrcCOk4;6xPj!)f{qkLb`R}FEq7sz^g1Fw%XUir)FG@H!QDYvNWPvE~F-0YL`4}t^I zRh0<56|&udAF9*MXFr=~K zTRhAg;AX&5;cY_z$BUrZ_kpBP`hFJcu?xA-+cR*$qFXE74?VkT= zHo?Lxyh`cu-MDr`@qnf~dd3OpxTzY;ycG=P1(Z_GL$OWKxt$wJy{`iQ`pj+!P_)_W zbMjo0e*wHRY;iwD#Uj5#g~-`19FYDTgf^ekQ|jPb*<^p{NtRlVkK;PI9<_E#;{#b| z=i_w#^^q0aRBg$`WVxtBkU&<4ZD+r7X5(HE+KP)xY)E!uK(UCHdfP>=5 zkZs`L8UjiUV}F0I-Q|T14pxK%<^hz)Td#KB(nx;2y!ZQi*{7Y2j}Z{DVB%(|pAk~XOg5SSd zqD7JD%PZWlAlK}KTQadp97E$=AnOTX9sJloI%HbAJ8qgN9#{dR~S zjn`Q&cahD3goiWrpL`c6U-T!!wYa%YT@gZ2p?-qi!(xjK0dG0c_JM30<^{5#N9Y7u zD$q3v`>a3D8$h^~LGo@GDu))#?)ZEWaeq-oU^(!pv8DKQ4F@37I`A@_vwX1w{W#28 zfiwa_|;D^$@I9c1wxnl(hXxBCe_KCNX^NVir zbrdWuX|E=J^K-CePb|wr(QZ>Tv8b-+7|HWYY%8i$BmUPx#=Ac%W*KHd4 zHC-?syiH2TPDm4FR1?cHcc!VumF8r^IbiBaiP@-PW%21fLjuHXS-!cBIemZe)tG+qonkLzSWQ(zl(neQ=pe%?RQeru3XKdl&wLsOgabe41u%{$O?lB*kul z`((Y#_V0RyVr>=3;XTO5q;>2;D}A7Cf13BkKRz6j&~?FP&87%Llx$R(vO;mXBTEGUgIt3t`i)j24llzOo@9`?JIIXFy!XM7^K z1fmf@G6Er#$&dtS{CqIwJp(uFMofL3J7on+H4EP7fp`UUUtodr>gD4L8XSNRY?NHa z1}t8A4*53P-bEunKML6XA>h^qunaaECfn5{FUmQt+ZDIo?f*B_V2jyp+|Et|ie$)Z zb19aI-me=7I;%V!Xn=;NumiB>Y%1NE3fkNM_JJv8rDJJcC6bm)?2r(LV-v{W|K>Z- zwZ6dwaBv^tL=(4Qd+ z^xytGTb~CyYQ4N5v$Eo<2uOQ9!^cw6qD#}HY#CJ!L=uQ;VB~G>+=&LZX zf)@QqVktcDi<5oO7Afk8 z3MeDvn=XW1i~lX8hMvZ0eLkEzb#_@8?c_Z6LsX?gfx^*SVD;4H)q2 zpU4iRB*Hcr1k#kaJ#8?t5YTYJL4dezGnJdN5#U;L#X%PPaP@*aOhC7?rtog4dUL^O ze+O1fP_l~!n~sB*13R8-pT`pYseeWlC`bjAi)}H0 z+&N@Cb#L~K)*0UzXs<`I@ey)Fh5|Snk?37*fCT3|g$Ky1I>*7J0%rw)vtLA5P)fI@ zjEr5_CA!!2wh0?PuepS^G=9Sam z2HP<&;3)J=-3Df#kuV%Z-O=T^H-;x;|5^kn2NQK!G;`(}s?1hogY zz?IvX&I#(B7TZ=sULdN#w5WGVDeLMEak8`m3C5pDw?fQoyMbYY5U6WBqCb-W0#P`Hukp|6df8sW_1L5GTSzc5YS}tS~dv%B{)83p)CITG&X| zb(c^sozplsHi^Rt)oSN6pOHg?khdEzhdL0wyKRagt8!LB=V6ToBybdPLJmT;<3>LE z)Sc5|3~lz-h+3!!U1l+K0g)fbBw~+_e0E!kE1O_4=faB zX>ZnnBMuld#IpU;E*Yu?+OUC(6$dzLn-M4Hsu=n=k8QNq#t6BC?zO zWz*VB|F=vgL~uQvfwHmZj~&3Z`VelIu|Nty2TW7^@XvrjqZuyLUf)IVx<8=x?)UK8 z?w;8;3Mxmvy(eA32m@!c{l>aB^EV=k!pK2wT!EM>4+9zyJP{zDf4jdbg~AQ6X;KT7 z{seQOx4WleavX*0=UE2~f#QvyNhhE$^@Qu9V!#IMenq@z%A*lAtxuq0mM z0qU(|K^G#r9v%8#7kU?)lM}s;XAp-DleZ2l>^);RiHT74<=Er+7psl6Tc4O_rLMeX zNULEZW{H$?tBS~^%2=EsW>GRMfrVSJK~-1UixU93#KRo>&e~o8Gm8lsBIx%ZXs3hk z7-7ZYf!4#GJtq)Z-NT91e!A~}WiRW`#TeO6@ZU)IDXJLI?0O;!j!dP;UhY%pPP}e? z-Gl&?uh;tX-!1^4?F>lu)i`9Wo|TwC!`OEwI;)xb+b1`VqR z3Kb#*T-6&P6l{b-;R9>rM{4jr?T?n1pW5PYcjd4w&dbzcovkjRqXbYEw5e#$={huS=l*J+y0@JT$0K0*cMq z6PLVN_JZc~GDaXTF%3|~_98uE6Piu=?Y;`C+;hG)y;iFn5RlQEPJbt~(F+J!7 zaJcb9R_r%c`R=F~Zdh)i^mj&d_$y{9tV{fVBCb@Ak>(etDLNqP^E&UpF@hZM$TY(W z6DziNCuz3ZCSWJuA<7i|06Fjd3bOPkL*oyK``c?DdC7I-UQtA4Qc-_U)t-%(emoZKEJZ%yYy%NVTcM0drKjuSoLAQ#dy*M*swSp0V& zmg@d)fBMtw*t@q80Nkx$y)VrxR?0I^OwI5jcTF2#K5kBJgxy8)P7(>V=k;GFEOnd zl3ODLI&183gJLe@L;g33dtu568xf|GkOI-}wsEZ8Ft4p)weYP6h@1F97Sx*(jB(*L zC+EDZ?`N-@m}EYuf|1R3aIn1|kG7l&_smUlfYILY=_`0;U0wmn@zyu0T9}1ci#awt zJ0b=gAY!xU+%S=IRxFj-OWrT)wbIDGCTCN8Wtjx1^bxYY-E%(*Rc$F>IGx#r<`FQS zE?=e75AXeP5U4(E@bewu()^FV5H_djI|XK-V=XWztfga3Pfl5X$Q)z`(C-v#JFNgB zzDIPtf)pT()V*z$O2$3i zR=}KOCaG?Sd2q&*)V)swDKJrf zBYg$$HhZA;L(+7#RmMhKsy|LFe^TE_=WD@#=|I3iA=IvpB@9DCSDLKp9Q4ynj=lOv zL9l}rTfHIY zDN(zFow%AZ%Of&L!QGbp78ex$J52_nt{fjS+ct>MtUUwQ_y02Ax((Mrxf>n77z1U< zf3G_;iCD%(xKMcZZ+2fsV42Sk8H#(;JC4m%9-<{Jm6c%F;RaiHd+1IUSN%skw7?9V*eh1`J{XGe4xcfeU0xpq2#zg=K_Dj8h4@ zIyQjdO+evAA{lzsqL3@4WQ_;Ri?9g*&6IM<_-q*m=!t z_{){rCa#wnvaJo6N`7KeT)>4BHG%Syw|cN9QTg}tzvY}g@j@?wF35ea@1(Kl@8-SQ#tT`xH1cREQHIDEXqWy@u_iPe~-mfO~?6w0(2LZzbuGU1Y z$yng012{kLN5QC_Ejgc1=;qOIXhlz_F8%;P7TfjoLJ?_Gn2HCH4_KJD9FB|QC z>2Fj(*TVKVCt2#!T}IyKQy_~+eW(9Y>P&Sg0k%WL2@)-+ySqi!my z?1_%`@10j9+cQ7?nN1( z)NDpKqhC8MxuIQ4(L%M`W@GK|cf45ABLRXa zRFn{obK^4ojS<^e>Fc@O7SYDKr;eQwrS3F4+wOg>n#;mq`q3AJWu-^N5nM((ig?d|1E zet9}5)GS@w+xsI+{hflU%^)El<})!CQ|=fUm#!nHi=?)>I0-QqDY65@2E zb3H$^#O!X2U^N|xDz$fr*HKl8x$sS{4shi36C&eqs1oVNIu!>m;n5ifzLG25b6Qtr zHNmTK=4k7*n{|{=LO{nl@5*@HMM%E+fGsWS7C5i1W3+Rqv8q^N>pnQh(o_F!Yml`_ z!o!%h=8Q>2SECSW=pTY}i=_YU$zYl3H*3R*N3ArLqvf?Pck1Zw?jgD(FEZWlC@`v{ zuHEUv(^1})FJ!K+u04iNx4)H$aUQU@HaF|M$NbJGrJbDDK1xvC?izRNQ#P_TT=&)H zYO}kt$Ls&>sz@e+elal8&7EHy{cdCT_R~kOkynrGBC11LOc#v;(J^WI-pC$Xb#j{;jFN%tPcNt+9&F)Pav43x9e@NL+nz;_RY|yM~ ztPTw+r#-MQGjg;=^`sZ@YFPjcKH!9p;;SrV3BiuM#kt+dOZfAF3>{M0@%XmceLsA* zREwI6t9JCu%Kcwn1)E2N ^F$;!gk?tZuDyM#hMb@SEbdX4MdVQBW3c;w{q^x1y@ zf@2dSBZ)cImfvZn+9(h&<0Xe*NvL?UU}m($9}Y|>YE60AA16iY+Qlgj{F-x{)7E+Q zqY)YD^0K#6SfAsEqt-9~z`>uT`-x8Vo$AjSDmRa4In^15)Jp>wu>*^ml2QY{lOB|< z8d-*AWeQ<`&qguClKwEn8Wvv=!-qwS*e)Zh zGbk<|okC|29DJ4cnFS3k?UJjA2)<9-vR&WPU?TNoqvMJa=_DCaNbacXs>ss~77`XY zIx;fyG)J5iwQqYJGo_oz`Oy*yh5tEDJSqQ2|GUejtH-Fw0IM%fPi$Vzb8B0#yS%KY zAQ{TT1Butn88Rd9!lV`~{MstIKJOqBCu@m6Yc|o&;SE2(5M!gTOqGO=|18=2l%W%Q zeeTz5__{OhzCjE0u~(HPTr6bj$GGU}H5OW1w>k@wmXnY$J34k$=xvNpdm?Y+easvq zN5jDp;sXJ6aAc(S@^C?M012HisH%$H%a=E`GK1R|zoxcUMNbb6@`(m@x*;9{QSseR>17P!H3vD<`%TM zt^z968BwW`uZ=b#6!)5;l>D`Xg-OJ=!7I#3hVROYXV)Z5Se0o0K7%mNFrJ^fzmsuP zM!0REoEXP=TvjTBt9%av>TicsYN3`FS}t;lS^6b>U6_zmd>eGklU`HGrPJOMa;JTh zJBYNrgv5-nr8J3z5Z+g)*DrQ|%Y?AVNb-!%PEoL2EgIean}dl3+e1S`1!e*eg>O6< zwHBj3MH@fH%&o1XjC;bnz<`)R#!9c8)w?s9H(9F11_???zyhPfrl4??gZg@V8{c1_ zV)@R2Ab+%55-wS(Nt5yYCV*MQurIjU|8Nds<^;)mj$%Q8Ae>6>VapK{|B5E=} z{DtDkPUuVvMp1LTsI+5b8y4{Bu(Q4WyrV+tFU3iRIcEzZ7^gGbPsZ$kJ zJx_1^3Hvv^F{MsvxCiA>kLo^f?GXwT33QA389SQZ7$GT2NJxObD$h`zJgUN(=$oS= z|9nnK2@~?Y{E~%?fUvq-n9UR_j4QL4i)n_x@5S z44cpMh;(Xd>Q$)d)zK1%%?v|r4ecoRn>Vj0DdDs#4Z@`Ig7fmIeXfq;CMMo%YcJ|7 zYJK<+dwuOy``cr83UO_14eE7Dg^P!`c61cKx@z>Ju&|N;uU@0W+DJMVIEZ1TrA*-% zB;n*jK7#?N(b3N{gnaRDZf>lstb)KFAz_k63j5!F=_7mVhT`t-ZZW`W*dBX(>*IF# z=cRZ!I)`m(MMeM3*>>W$Z)j}>SoHMt2*}986|V@yUI_`2SzB8d6%_^PmWS8Ya`{{y zMCIhXsy!~w3&p1xu-69YopB211~2b`+iO`=6r2VA zF$w8|`}2LSTElc6r`rE(?W_Ny`o6C(ASECrA>9ZFNFzv>h=53UcdK*@2uP?XAzhNv z-3Zd%okMqbJZJR%`ThmZ{KAWwdr#c6&)#dTz2{6g!CnO&jg@TSxbey6=u?t#2$GSJ zd7@Q@#ypx>-xPo|QDPc8xivF0^9ucJ8=NTwx?U_ncS#=%Ug?gh%-v{k+0&~#8PncB zI^q&cN>2U^-cHZX?$|ybOqVJ4x^ligjA@jtw3~fZ%-X)RxQGxg?cW>Ehh(8MYj0^e z$!s@}BKDY#t<7cL%luLpT4?e^a^3hDGo@4Swe$zw^Qf0^VB>whu$+a(Rzysv^zQcCreC=%53Vms%mOTK;%aU!FGB(FC*h#ve)UOXg1yZ9v&Y2&z_}vob7gWcXQdE zYAGohswuRCCXE#TIfX>2|Ai$kvB>f%ByUkx^v zuMMnfz=E6KVWCNgekMyXIU-Te1<~S_R?x?fU2`D=Iua5{!Z*jt%K*_$+HsROt`AV7 zQSUcnu*XIui}+B?``mfuxq|gq&Qj=XNX9|b_dGxbPGs6<+^Sro-knEBS6AMJ(!|`H zRzP6tSXYprzp1?)6%Id`nEY@Mb8>QCC@RWmXiVseaN!R6zh7_0Qn4!Ig$TJ8=R#%@ zY&c9!*k3)G)G*K28}|*H;RGnAb>$Zx_#QI_pGkbX;PlpZ&$VdNt zf|?0FhDC&?wl2hI!p-T=qnYhvYE~Mv-a5J-=258{}%Sa+eEO zoP2!X6%ny%WFIc-!v_q48hmdS@n&{$!^q`~2=6Zk6B2(w@jMu8g*bYNEcy743kwTs z#gTM|ossktRgSa~RN5!!n8<5t zK2k^&Fx8T80DDWhWOir>udv}VH;1gJD~cs`c;mH_l3%*a=cP`@A$mCUO@7 zVoTjY8)@dAVPC>CGnTbL95BIjCWLJezsB`Euy%KMgTupHD{R40woFV+9UUE_qM{Hp zGjq=_VQ^TOq^m2xZyS2(XOUZC5XMUIkzBamufNu5^d<*a+uEftuMMP1n5~U(PnL4n z&G3(mjxJ8yH?{_1fVyg#2r@Bn|Mm4XRlw7DGDimoQ5BVk*Ecs`!5(nh8cWU1&Fwu4 z{rs6vu0kOnFCuu|+e$55qBr1*_7AWW>UtsEp(_Qfk~nvvp?5F8f(Wwx;idBI zVKb+E&{kBX6j}<1O}T)+zP!D2m%6sX9^hKI|Y5M*s_4Nw*pJw5Wt$qA15!ubKr^ZPy$U! zfMZWBsza$kt&6)Bi_B>2eI=BzvjCuiy-QFVma+YKu8YfRuG3$I;nGsG)|qwAZH-*H z_W-pOJb4?Kylf;68JUfid{TV8^`-q$%~VB2g_)^x9OI8YwZ69bMwoV&rj}Oo;2{IZ%by?A@_0z&>+6NMNwA<;2E6YUbL<1>kK)g)tv$?<_A~ou%B|Hk zw6){g&fu{Dz-17m#rui@~IpcC1yK;FNZH=teO?O%1o*>E@!*=K?lohj%6Z zKLa;+6M?h53APpSCa^xGV|!F?;dS{#^*fQ|;ZhBT$V zDUqoBY~npn<=)gd0rI#m?9s6;!z!m5T0Le-^ayuA_2q`9LwI)-;WIdJ&2m95SgGerauan zRcZ8<|45lEGX$QfOm&!y@{b=fKj#6D2b1;9ee$S94;Q5RsqqqTk*aQ&{Qlja;w zn85)%@3s~cBco^e~=UeL?FNmy?ff7ja9hSGR7yN5$W z6!eWzaq0483t(g%aVkDOqU!2ue&=ms@1ywnvZ+_G!P#7z0jzp_CMyx4LTd`-Xxi4R z^WbZ4Hl*qa9<@%VFMxkUgN{E=HzwRaFtA3&!5yTPi=^v`=fn27hEb-DT2TjxzIufT zheoKVL2AYFyDrVuH8oSm6H`;*d$c4G5v$-_k3_+7m6rNa9?E#F{I(!UZwp?_fdsAm zhAeM{g`2Z^nHVofWGny$Ba>tgVAz)Z#g@fY=e@@7*pE2x z{r>$s6H6sN#>%o_C02Wv2;#Q;GR@iG)=5TvkDEk3Z!d$DmzTGws7MsJYY^9hPrKG9 zCMIGj@>H0gpH3LNZWp(|R#x^eE8~U}H_$gC^pJqS5Of5BVcix#VA_NPVMg;cd*39+ z_M#dSgZ_pIZ_;7|uYSh4nW~NcEk%+2LuWvpRREHNuaA5`0QtqE#^u7sP-e`}p|40Sbti6*=sH(ER%K>+Z6& z@q8)NMb~ZaryP;1t7~i$BLhQR`PPZMPJ`#wUqOuxPvzthzsb@%4pYC z^j~y!Q#lfOVD6;V(lndJ`TBL{#`Yo(u22aa%^dGcj~_n=Au~%Mku!8-EI)pu__sk5 zfFG~b)q?0;CL`HOnJ^H7 zCn{`70g8aLp2$eNgy(K}0GfwbnjW=q0!URFH6G7vD-N9Idjayztu4T+LjeIW=#FMJ zD=aN3;fyDHAuliG{nl3zi}STs{Q5bR|J5&S=0**05T}q<8$8D7>0qt{n98# zL`Fu&5l;b+0$_;qc9C1S{VM|~PW~x0RO$6=U*LR)9n%LboX4e(IDl^<^dIDwWyvU# z;y{FwNXUKX>+$B?(*Fj?Z=H>oByn2gRQt(Q>%o(WLP@C9&za4>;%J~lEO+)K;_e>K zr(b}9*8n9HcDT}QM*2nz1jq4lBESFxf`U+ilJGH{ly3>JjZ9*oEZEJ~7G@m2^73-qhR<60yx=D_mj*eNJy6NrL8rVQoQQ~U|;--Bv63E4q)x^^}K?DwY|&N6UD~8YQrF{Q{D<-O0QZ3fR#&tv3^WW zPTpPvi2^R$xt!sRFF$@v=FZ4VNd-=Jt>)%3FR!jvOxbX;vtz5Osy=36u`V~7x8SB> zWNa_9^6dCRtx@G*Si52aLeIF>$<45$$ZYPMho0l_$-v zXb0q~@p80q0PtYmX?oe_0CfEQrBL=b@?;?5Hn(WAkCl~`*{I6YgK(s>D-}uiM6a%D z_D>Z6tCNW&u(t4)FVqsRLau>j0XPhxYh_VU)4P75b`wEdAv|X8%uS99oka!k*pAUI zWq*9mJ7hj&8zT_ZSkyw(=x*df8|siEQFQeIxu^m;AL%?r!R0d;lHC!>DXdz?v& ziu!K285&YAEiD0+5lvfLJ0Kvy00;pceSK~4dFWkD7=Qi^j05oMj^18m=pG768UO(N zUYFdQoSakvaK*N{rA0pEC^`V=g@S^#mKF(6Bn%A=5dgdZZk9+)Oe|CKEpQcZHfu%+ z@F=lB*@3|8zk235FYF^WWdty9I!4CINnx9br&YDJ@k!$&BUHk|6q=fvaO@r)js;hR z0ff$#nSUcDh5&@BptLlaY!&A7^K*lt3|TYMRI73=xJU?=Gdm~8ue_Y6uC8vN(dUkr zk?Po82uP)lH(l9F{r7j%}6tOJG;9j-oE8LJURmS#L(Cn z34p(Vj~|;SCpDeJBqgzjKkX2~6LR^p%LfZv*|t)eFb4X&>uud97yu|dMTo*sTkG`bIM=8=MoN{Ur7o zF%T$AI9dtHHEJ1gRe1!Yyqu35{^Th>_z?9|iCCA(j^fh|^$^&Ycq zWVmd-(g)UJ^^{@K-Kk_c1f(lhqf?mJPFtc}cgtB87szGKl`BTQ6nAytdqqB4J6qL4 zRN`>`<^g6~ZE^yk6#)a*UPwF2Wd&&^?2qan{m!5dY=)Mp&0NM;hOa3VCyA+j3m;@s zvF07`lBXSb-d*6|47QI;@n-%u_!Bo9(!uoW%}5qVj;<<@qEWh_PR35T3#skZ1T-IN zNqN=qPc4ixqW+#7l;+L+mHPnjzO*#0yzKshf>U_9*Cv1ZT9*WJ$g3jRI%7!B)GN&H zr(Mti!vsJi;0gQd5^34%0MHnIf8aN@KiD*x+NFBQLyyHPxAV3CNi@+STpl)9V`Nui=B6SQ_p(fwNk0EFmI0--Y$ZOogD) zT0AA4R4~Y?R+Pd%GE7E~3oA+x=Hb>yKw>%$Pv_SOyu-2iwOsh9T1s`Ih#k57e&Hh_ zuLRs@UQ{YOI$Q-NF-AvUxh)71_8^>@ZY1_s+w*okt;dMl0#T{waU5?&`M|~=wwoyq zAR`Ouf8*KfYNUY;YEQ=PW_Fby@w+@zJm4{2U57Atwnpt{#)H^sPuz<)+??_W=?R>w zG<8M~ub#eaB4MGt8#js(p4+5+dQtko{cpnl`S-EHq=EBVIS zVfa#s{Vn%ak&cIrXT@4BIXX;WXsvfCS6jbMNWNm?+9yKqV7`dmO;YCaSMI3ZmBHZo zz3S7^T6`ovO4+Re+nh)``n&$4mcowmJ6P?JM8qHS@;lNu7z(FjYkG0dsk94jTEZO{ zV>s{EGVScW@Fcu`UP~7L^jFZfUG-j}(1E0aVN~9bFt&b2vu_f`)#aH(%#H1B{W?rh zZOp=!;LJ@}E&%z;&gE^99T&@p0nU&|-e(bO?)$A*Cgh4egOnF*2|I6ho&~B_P}+rg zys`9w95%EJM=L}`D)kF)wpX+ZlI=r$(rCTR=9t-aN|!rfZ+8S0&EAJz2s72udJ(FR zn0g(y;jgVsjql0r9-X9iO9%{QsoB5K=Hz=WRd92ZPb6{Lri-!tBAIt=GZe%8LFaet zyXkRrnFRUzQE$TPzyh{YM)QaV9WmDW6}uxm1UzVrtpKcU~mB z(T`Sl-??->sy?-Upu1b_=+m_yah#Jgta}6dP#p4hXHXFTLq%IAs!N7qIURiihsU{U z^{HZ`5a03n&xBKR3T+3+qGv}(AvdOS%QvQ8Gsa-&d44~2p%cac`Er?dtW%b+p%=q( z-|+1T)jRv~Djd$m3B@m6y(t&A-p~>q*&QGJh!aS>4%6EbZe17ip5Fe&I@R-G%#w6O zPCYr6KET3!vuP$LLuco=PhFXE!Odm<+uBAiC$o=3w-D8VmQrgpc9PKJac@qh_MK2$ zaDqoh|F7$=>-Bkg5vK8mn{(B9Cy#F}0z>9*sUZuHRJFJ^P4_PTIWC$j zaq(i)cG*1Gs_a@(k1lfnv-P{RLq$P-pZ`77?W`L%+?~6*9d+u)FO1Q0b+x_!zQXz) zuL9b_?7DIPCYJQYWF=t){W5U`n~z)G%(9lDTmFeYZ-RF&?Kr&VqPGt_d7foF$$@A7 zLO;G=u||$h8uAF2w(Oi_U!(6tb_|4rkHPdU#`@-ZRv7Krltq3K_LsJ$)BX|{B~(8b zSQ_mu1JTo^6DK>Xdj5N&8|+r2kvN6P5fL*~L{BfvdFnAyM!lhz-zIn#E-hN666)pQTxDQ@_c z{j9tY)h$^i^PyL@Z~JPYGk5N25S7?Q!0T|jMIXh&Fb#SloC;T6KH^qt_?!rQgTu55 zm;@(r8eF}Ko|2qF7Cvs%fiAT5dVXq&3T^z!RX4%kUBno_5r45n3%!ga7k|NTon8_D@M>?(G)5*!s`VNd zu@O1NfCH_b-ur znO|s-RdOy_PdYZ#q+*YJyn&|l@x0>ieJ2h)Uiz`_7PM?6&8j8x=7S@t@2NdP6^ub; zNZFBPwNv3*n6TU#{1Oo<^f(TR^39WuihXM)WfHy3PgD^8g>FM1T8?3lugzA|R(O8V zN;Ww?)SNzcqlR`s0YY#XBEOoh9UqU=(NT%qSqovS=lumDFis2Krc<~;v4b2a)#{1i zXP&wrM~!aTy0PwN--V1Bdy}Y26f?Dl@ccpGI3~iz4OiakjV7Cc=N~Qe#Patq&;pp( zu_11prTnV(4xYCN=|uTwT%u%9z>taavjA>BHupKZN#S%gY|i^9YzU9#&4{wYjK*@< zX-yfMn~8q?pi;@Thg=_TAAJ;iq1-Rk|1GhMgrIzPEfOaW>X<(?Vv~B4lf++dRIr^E zurI}7e}91;TDEtqmVn+QJUIEbq%PGt_W-BCVh0s*s1QVJL*IaU$2m8Vhg5M{@#DD!&nE9|E6)j zmk$7~ti9JsWl?syvY^M4f1hVy{?|eZtIY6g<-)Ts_h z_x|5&5Sz&QFB$pojak%x+~oh`zd|1}`Y51(4LTA3Zh!FLk7)Wnt`ERFRs{vTq+1nQT z-w5R6GgqB9AH#dgX1#v&U)m8hgK5#bTve*2>f%Me^=tNlk2|UJ4?5YDoyYIjZRXM+<0*N;0j`RKlZl` zG>zgN8s1$+zn76T2%aPV<8U-9aWA_>BQqwB6H30J_UX#_|DO0^4DaVs_GLHo@5-QI z2$H5gPJB-Guk+0mGnSdavIX|7t4CpojQH;k+L2*YvWa|8!RKkokwaYq*Sn$V1AN3J z*k~K|edPbGxYPH|J_%Xkuq8r>tmaGLS;O;>?&N1m^x!V{0lQ`Oh4RK7DMu;W;ne=6 zv^CqU9*%!EDz)47-wt>hi>@ELAvALq+ z5{prE_=QaBI!dAVA=ML}bXb$fQJFAAjV&YHlc_nM`kb9Vi~rgh6tXIP>9L*`r4U`D zM~xt2Pho6qir~Y}czw7#LGwB0_EVTTf&D|$g{@EK?Pu0}3{0hHsC{}tzaKw5 zc?POTUr`L^&Bj)JkLUjyi;bJI z&(7LLfYUCTX>(XSzj@gBGVOC=s7;s>nx_*LLFK1Bf)h*AoVNbtb!<38B+j4n#kz_F zs6orv6fQs zxw`Bz`FX?BkXht$^3VHB@qbpLBZ}U@>Lb3PpVHv z3PprAjoih~B91pUjC?!~gOf@$SAOOxKKG_=Y_6yELV5pgmU3n~{bj)ocAimIjOyq# z%Z~k82qrGcfKyQDH`{owDHQ6AyUL~YU*HQ9-n?mn^^QL-;cLe>uJ<~(_;z>-Uy&&R z2?2iA<|L)uOGc-DLLW0(7!&Q#zQ=zOvx55c;$M-UqJ*>aF zZm;6;`#a0+XOgE_R8txh774^Tu$Zk*2ICQzxi5h>|k zgx(KFrkH+remw!wqz|s5r{yQ>F5D(fV+}*cY!UxpJe^)wi^fHqZC z;5Kqya5JE(nQIU?ei>1kRfCc)CoBkn*5~T7P20nHG!HtEpH~>{5U0PKLJ;+?Zm2dw zfQ0S~7;-KRoZeb^K*k=vv^zz6E2u*o_5?ZG&dcr2Kr1%zrR!@H|b1W3UN_R*OA)jus zcbJ7%4P5SRE6<)TM!*973^5PKiG9Z)V3eiPWURCmgl;$ke|L=&4c1e&evt)MCT&b1 z@Jj0fiM@VqQdN0ZU(7LS+z;U;K z95K7UTbK&rC1U_d08Vm3NW^ubPE!XTuk+Wkk1)J|p-xirfMXxW!J}L1|1m^I=p`e| z79I5}Aj8+v75!4y63_+&u?Kpoy_ANPW;G`GfQ4NqC9QoS(1O?$tE!zhmt1CO7v9_e g&oY2|8r-ux1a>E!xlro8Pzbzar4%F!#0@_DKMV*9LjV8( literal 275571 zcmeEuhgXxy_dc$>>I&FEdRcWXNE7K@WdW5Y(u7cyNN*z2s|Ao6l`373-lTU>AqmoZ zhe#qIHH4PXlHa_+{kZzwf8ck{&N;h~VCJ2jrNG>7UB9RTm>Mf7`uAN!ncD_^52=-`+IFMhSSs&hZxtVJVF=7wZF6d^7EVE_3QuM{y$Rr zPbU9IB>(Bj{}su9GWky?KT6;~$MK^)pjZFNxpJ zuVKA{JkU^f#~1pGuT2pd`U_>CXJo#?N~?*>p^Ti5gx)ap{VpQEYjd$n`@X;a-)}4D zED!zf1@sGJT{`bTQ>{fbGEaFPJFQQP6|9gw5o6-&Yxr=gEmmaFgiyszK7;bLQ1V(x zZ9pp5``CHiT@iKMXqt5#h$##fZXjh!EK-bEGkwTMg|=!j=o`soyIQNUlZDk&(+?4e zTmJH>S<1FAA)J=Xfv;cAal`9nh|B0LNji1zehQ&*B~!ZPO;-ddobo#juN{%02eEU$ zvTPM?#>e^*{K4mKVvwu6gBg1C)OFj%r=0p>16?`RF$KY%(*t79_GRvv=^9>IkCvE$ z4I*pmAL)dW7x3&)o@VZLMiIz2^w3qzCfp`DzB|$lb-X@4>kA~D+EL`X&MLOxpbfSj zog8*B+3*BHrc5L$%UzDCj~@|-`r%7ezvG+ zI$ys{bi?QsgjaY^BIpY@BUgPe#}s!+6&513)5*rp4u*)YnM|gqzxUpRvirEwY~V?( zu!Eya$$hgtgAzGeg<1V74{rrV0{MJWSp59ptoUGO5VxVbYl8gLG^u&8FicCH5-35? zY6vSiuZ~#taf2IbH;^HBy557=eEQ)a2S)xKe~xD{5EV(+dk zOHwslEmX$M=yiq{l2QZ#uW8@7OE5%I@Q$Wv{RwTFI5; z$3%XmF6r<8U51r;c(-|!3Xt*1N70H6^=IU^+8dCck~i&Yw?F2xT?>fWEvr6dOIj=8 z{gveMK6S?U`6%9mMX$~64}sdX0SQm+8dVHMm`bsFALOFrl-f~rp7I>q#zE>c7~{U{ zV`<8m>!S*1>QXNJCYU#V%vF9(b!Wwah@A0#q?NEiDG2SJ*_G?4BW;n$-1u-C^6niO z5#Jkm`V~UE2l%aa1DN4UPtpk$(p(7YX>8Zcvu~iK1xQY+m1_f}-gYN;F6wjrq6h9d z)s@oyy-$&naV3+;Xg1;+{Y>Ur=v_bTi|v8Qoe?vknNLW<=UOD;%C6nj#g(Bi^Uu#_ zdJc9teooqt?Yg%g_oB|#t`a|(3-e&4PUn*Fk1hRiRRMZ4WhmdUPL9jt;f*m$Qwia7 zLg z_q-V6(;3~opc*c(b4zh0mvXo~&gm8yCv!cHah~ttIU;}eLGA2|H;!xf6yROzbv#|fZ=k%NQNY_Q~HadmA)L#mhQE) zU2hzRJ?WQ{&8fc0G8b}ECMkPI@5l6IRRUVWUC(@@1|j=u3!gDJVuT~HvGc9| z1y0YSv)mROH743zl6)S-uW{d|Q2Ey>{>a_tf-w$G5ZrcFCpL@B$5A4*>A5yB>W(|l zWwC4Ujj)&7G3oly(`ZJ1`PWS}qp@bWI0si5uEFt5H$E>HvpE0qOs_#X$C2)B)M)s` z`2%Zl&9ZlBsO(L4MR(6={5GaOjhGSQ8#;s7E#z3)O~xY4 zd7jxDNhuNw64PLV>g%ml+cD9-J2qT+V_!^_7JBGbL$a8yn`7%PN{xP--?iZ$E`+{y zejYzKC|_^g9&o3~+9>Z%oxngI!ys?zglr9p6}`Z0k?3}pZY}Tei|2 zF+)`jh&2W~WdX~|KYu&oRMcolSF}{6Ls&~aNzmTSHz%~LMcfCjLKfSA@riwR3Yzr_ zFXV*(;Go!em#%yV>eG!>>3KZ6T?}BU+uaE)ql6*jQMsx=2OQjlWJi3yd<=+EJ`$o)i(7_NMTA-( zy5jWj+ExmIL&LRsXCX#}!;`N$xHG*WfUWKB2xD1g| zvGuP5k{6F$#GDWs^S!kILaxWNjr&t`>zeC#)pq9VGt=hYSePPd=X=iBjSB2~qAG=z znzEG_891fh-k{2^97+rR@A)I~TRHB8h}@;Hv#q+BugfzvItv^ZmdA0Va3vN1cMu!W|0QZxwx_xAVhfvr)6e?2AaI_cvK z7S>QD%;ohEXc`OzljG>Hu@gcZMJD=>=7vtm{xZ6;u$qg@@JtGYoSYLgpIV7suaLtK zzufAQre?iO@;86L^sm8(G5MrmUI>rx>yy5_M0inlm^aeCtD_Fv)JP1)DKBsZF34Vz zvScZK$|P5F**-zC@RYqogNu8d9qeIIr!ZnvUe0Cf`PbeOn?2|E2lu}}1)&x%hSsT& zI}u|nEDgaaa}`Y2V{a^f+D14$5YM!Ym;0mr+N!75q!R(*IgJi;m1iwe(MumLPje`= zCwy|{;>zT#bBLpcx)h!tA2PBVY3IvD>|6il_ODe^f-G?CdSk~m_zjZGZ< z#tqI$^OOhEZ7>cfT8}*-MnGT_sLGd)Y+5-|2BeOA;(9*-0Uz+3@1s;dcOVbJP1&3v z%{Op|l`q>>-mQmj)o7MDYL`Mw9fWa!M#4` z2ciNmV!GZ@Py7lFLL@+!zmJi(zHMHYeI87;x!EJ*M6}{O9?f%PYAx-$FF;*ybh~rTU zTok_4;kN4I_;J!xsX`#Jhc7ZfAJK<2aq#6UD2$6Szd4$%OdsNe5xod`O>^oZn;{d2 zrvBfsWPlJuLk;0WEXc=-Ty{|+FazqU!HN^y$H+z7DfL!NHwRn#=W$T_tv9}PUBR|A za(%v^U(R_TE1;4ZK4@T&u>Ub`tw8$jwW?Qv1|&lI>z>OGGLr}<=Q$ZOIZGVYmb!tY zM~kdhrz=+<$B|a~oq#FFU6^vH2p=ott6!T;gD?9{SRH_7OxgXGAN)Oi%Kd!fno}7d zso$9zP-c5#l|Jn!d!Wfvnft`~(6KX8&I>Qh-`IJYe`=}BAt%&rY@p$gkFd3x?ap@! zm0w+Un;{(h>tLn;G+|fx_e_NPfLpJYUc=ZUd^hoTifx_acsL>WRJ+}@9|w}6Ub<3^ z!3px6o$0NExNODNUR5jBDieJ}iH%s6Qmw*0&FiZFSs1sC$4VuAHe&P%HS9Bg@pvl~ z0I2UcBD9UF(U7?iu+Ssj{!7&=X<+U*$4$%5g&Rz(|~@furULrEe`bRR@pDdX8?Yg})XT!AlnygQd+MBoq&QDX&vZY{o0!}T;=ha zOjc+zzjEcDr!9fBa>s#)E^QcRju$&g9Q^!@?#+WG&z<4QFD*4tCJv^mb67hiL~eW8 zT?7yOcI+-cAG>yvw~w=-+iX4*5{<3?xxx>pHjH+)_0uvXlFsN1PfrU zRYoOeIX;E7C5c9MczeG6w!W)BuTN-oawH&jGMITF{WZ3?MtP7lG~0;FV>qfRe8r|} za><>rnrnd;R?!827EN(LkWgp@LLrb|b?>;-HGY~&FkcFzdf zI<#65Ew3XJHZhf-pDLq`6}B>2Q-%Nt7RWFJjFu-FPXDscbYr^FC8ThNSk#>co7t1+ zt+*dt6^);m-TDYUp)d7h(E~z@TL!t@biMjcjXgXMz-ax7Qv-S9Ec0Tvq0Do>_RhNx z?d=!0#&%Hwm`-FywaXHtQO%=Z0eT{5#hB|7%Xp1*P;sIs68K)F%>r-JukYo6r}Ozm zhqcYk1$ z_|B^RDAo(^RV;vJnbItAQ-qRAncaopt*NN>R)C9hoM$r+XZqspi$+s?gzm>oKwj4I zJ=cD0N}WrXPhE9-@*gufFzz5cd8t6;qCl19)V2~g2e;e&n_r@CJrT2;;20!t7sal` z=ojtye{4AVh1b=46MGO59)TDV-t!faOh1Gsnv^dPl{Q8srDg#RvT+yE59Q#|ltd3C z*^|!l5XZFr!KEsdnoy2{(PdNBq>aK#_kkxOT80x|L-vH%u83ej!rTzPl5GGOLe)e$ z-VDr!rNWnYcc!q}+}y&KL1M^2wa&8;{qc`+!2=*$Ziuq=oEhlH3?hql0A5RX_^d9A z`wX@#&L#4v5~oCEyYgC+kBg$0V@tab{xz@$w*|3x4qoJi-~jJ^rThrFT|+Ni@F@FI zh>k#p)NC4B3FLr#;Oh$EC-n>N0M>z&UwX|Ag-eCzOXBu|2NwHy!=*}Pl$P|E(vGm5 z*!6H$K}6O=SqC7|%J0joW?nUN>M>L}*Jz1?@qIY#@B7T#K87 z@*EMEVL%j~5wqKOgC4)ft5Eate{TA)&468KyaoUB_$BwtO9@&L=ED|WI~>1!P)J?L zx>q##nQT?QwzC;sVV~Zl78{!dXLRTM+`iqN7Zq5 zG#BPI6LB8(rtv_=o@2nC{gJXS&4IQ8AtHz&F7jy%v5H1<)D8*|%EcGiArt~-G$ly9 zvTyZyh##=h=71<4iu1}$YgQe$6ux2eoP#Nsp4}w$MlYF@ zQtRpi#QgN&TKFe!>4K~Z&RZ;2@3qtCxO#N07E_jaZDD<%96F*syqO5)mA9<~_N(fhQ z-V`v>R?*V~xt=j@gTEha@=bhnYYpEk+g=`Cot}$zlHXEpE96glFa=o{6mUV{O=tDf z^Yob-A_NO4ikA(=)VjDbf%O!2t05~MK?f8u# zVz}I&RNTPS0oRacPOkcbg1Ch^D{qJ`^4iMN>@M+)5!wIFd2naGoAe<{I7Hy1G>DL~ zEB-AkQtveOkfx>gkBH(*N%i)m1r{O~h7kfcg-Zj%fwTXlyl@gYpHozBVzk&?&XAq5 z-RsMw_G=z+VuY!q+zb#i8@I2y6Sx(mo~a`mJ!6VtqPuJ4xeX_TnT)?w%6IreHWS)RL!+pn z(a)BOTkCz)0b?*XM8bk>aSOt&7;;mPBWd5$Z;oLeLcISNF4xMetq{8jf_qlX2h<2j= zV;`mRHqw2PNw@pb}MNv03f_vJXHJ0Hfo~ zFP!Agkr9zw9#BZLAPQKSZ|`mdND?CCG4V?IHURn()*aF4eV%mJg=yO1jVNZ^JV=Jb z$7BWD83R}4mop@GW4(K+Mv=1o-5gVXTNK+$E$yq!bdZqehj4ymc$lDlu>8c@Eknog z{YBR8TOumi!ytzzeFdN)6uuD>&RKz{)B<426$&z=BoS*P2=E#%e@IIMAl2$X%BGR? z{29kjQLgBKu=pO;d3N9F=78(`kW{bOd@rp0&Ayk4igy|uliyseBecDWvI@9ep{(B^ zftPg%73Y%pv;E5q(B+U;vO%I!ekLGl3H~L#*hOW0yg7}*KpIeG$|^42lu+Dnm9bt2 z00y?#BJAcF=wW^zzaQrR9(FP$$@f&f)FMV`zPnmP0p>Jaw2iiykj*)DY$!6>L{?g$ zVTmkaEepsUZp;pe07ZGQr%SrE?*!^eCGqf$G~i$7b7dahF(kc&_w0%E(mzGImmk=D zfa-x*j2<#abiS9)PDg-_ROS>O<{hwl9j{LG7|MAp4?QSjPb8O22p)ArCUUXAJCgzvl# zM0={sU1+ae@bt|JmLHc94>M5C1PpU4x7<1P>>=rPn$iO4nZ71SJ#*(V;vpYk2o5IZ z0h9Bh)RfQf8gy8I;v0D}XN5Dpsl(RC%Pq`vPCGh%uW-@DwnvXe=FFj)kWD6IOd&D( z>cXYs4lWyV;_9rY1Z}~C*1Y49RV29-K(3@huFyo#v-`vwE z4NmsP-mEX$8X=DE(X{NCB%1t84+AHZp6eHni7`C?l#qGPvj?A`XrCgq$5Pz*k;B$2#G&ukWe)^!dFK!RU>ycX#K^o4y3~!aa3Ox{h5C zYiAe9Ye+>Tv%xE7p49Ij96;?U=sV|c%R(kPS({=7?L(jv!t3&T%>s4suLa&|d1Rk1 zby@gl^*YnRt?jGp#HuN-ajDGYHVi;yWCkg(H$I+I*Iod|<+w&aKf*sm4>k6iO0Px_ zM~B>I3aL*&t>;jR2t>Q#cw@!~jy2iYSu{+2CiT^X|GjDml7PYnb=AMppBmmOyIYgy z!f5Dpkbd6PM|C_r(L@~nP}O!oTQzzjSQFZyFa0dql`=gxt^@#VzSlM4Pl%JC7Sf9ptu>F zug^+n77WxbN|TNzZv{xqgdX2RE?r)GP45>TI%|$5>`IOV_?N9KE9p85d1gG#mXPfH zn;AK52f5rQ$>S&FU}Ob$nuQ$4k@%q2dQv%*8^Ze@KZS`J#}*oP%`xC5WHOAF zH!3F&TA=mhT@0aW-`A0Jt*zf5Zd{mWZrJIu67s@a1wQf-$d=1aS;FWZ4*++~*-+)9 z&PElG$WdyDyLoMV;q{xV==uJpwmikgIepD2CLVzfC$KJP_VInFRMtz)%VPN}u&t;k}^?!!I59R&s zu^bGU7N3qqp<{0_q!#nhuj+F4qSQVyrd@=*-+hV#@{PTcYLbL^%`X~f>n4^jIt#&9 znubQsW|;2uu}I6%U*PZWH64rOY@^i;MP#!c@q^r_GUfj6Z(`@vvgq`NroZfIvcR4u zBc~y*SVhYr3{=xV+FuG~cXOKCO^`p{?>hI|e6*f>lNFMS*}9iFm|UK4xAk1N(lNpF=(n{uD_oW|0x$pT76?^Wu%GI_OeIt<;NQ<=I}Us&P_c0hy<6<;-<%^SCFj zM`jg&kY=;W57ysgqMtWMw<)E$PiZFMTQ6{*Jkv)P|N6UW922N|Xuk7RgZNg{k+oPQ znY1%}(s8|_!@5!)zjkdT z%7B_2VMaZOYurE(TW#MM0-Bz7&mY;UO zD<^ZxeWF)sikU61rNr`%xTm?ugfPd+w99|FTN!_sb99-zQu3aVVHxOOWZgW{0J%b8kW%b?dsKIGjgawnmt232vVj#CtzcUF>1$bg# zmwM<}1E0^zW`z;}-94(4`GBnH*qxv+0=2O{Lghsw1ijNCZSN2^zawXUTa{B>$cFolT~2`112i8*n_Jxkj5Ky3;%IPgJ)r~gzuh2BTDxx5f@GB^gg5pc zO4132+uDsw z9=l?^2%(5`O&j((gK`+L3Qva7oD{V8)s0ab;tijX2^Y(2T7#%yf>7Brf#;+38B-mt zFNJs!xYSQJL%J2C(M}EI&#i(5gA3ag0_LhoENaFBw2nr6%|%l(ohI|O8juTb@1%Bt zT(Q~gaKHyQjBQ+JD=QF4ltv!pJsNg2;oAyBVjECS&%}f#_r?d-5T%bX1&+&R3Y+kl_ zp+8rY^<0az`B1H6)s86HwSuzAhF}yuhiM=@9OH${<&VyT| zDzT)tz>cG{5bkSqCXp>z1f|sMr>)QzPao^u$$`fYXhX%-&ABa3)aVd&>T|SodAk6dn zh~gfD?59eihk3&DKHYG-YuuakF&UeyUihOrMUOT?LB|j{=doigY*oIrJK_i$yZ1dO zZLnh@g^1srK`CHT2ehm}(f1qLD5Z8t1glJZNHZL=*oFrzUKQvP6|fP>HTO{E5EsbM z$s`>4q*ya&(zv0N`Y

udvajK548da(kOnHO0KxVpnl4?d5u*O>Q9%Gs}|S>SIfnWw5LZAVci$P7hi-#+jTm=)Dku0MQiuxnada(Of0`VX=TM; zUZvhIWW$?zZ}aoD`k=RPYh~cPXDj1m(gf6OxzW1n(%#8`S8qm2c^y0|FPH|@tl?Qf z#`HU(P9vGm{LUXxX@xAY+2%&PaS#Nxmm#diJJ}IPx_#yMu3)$zOd|^QceOK4gw`ZI z$53!@M5uFGQaj-kGfx#nYV73y&!rc}gp5t~caH`e=2@f9*h;f3diV#p=_UzUwqgn> zn{DiORkSZ*OmeHum3AF!zog&N-{rSq$vtIR=B-&2ql1k6ROlr;nkh9%u_4mcA2gedyKVb@!Dh>kM=g=a5`_H6{*L zWE(gpT2yr;48@nn|E5iU_&H1eqwWW}^V%S`;9hpGXlg!By4Q-_Ki|)-7a?q%#R;3p zgf<6;U%3@1S_lz}ebY7PA@WDH=JTTCk~HEulmO@(G}hNFax^48@bFqm3>5$MH<(Jr zR)aSI0FHaxbgIHMBIyv#Q$ooO-JL6(%D>k;-A--Yw200Fe}x7N%2%#*H;aD{E0*q} zLf+WY=2zw|im5BKW)S|;g3tBEIN*4D6h@0V2?aaaiaN9h>JMjF>t^h(zv>xxXwS7Q zR~Qc^xvTuP{3`BsN!lYR3p1h9h}3(yd2Qwr3wtxz5zes{$FVspcl3TnZ6h4DSTKn@ZYhx#1=3DWvsh!Up{Hf8i#?w_a3YTQiYz z3a&SW{Ud03d}hWXu*>@o0ED&DpJ_1&BEN>!p}z6}kVg$tYLIHw_A+WQirOql6MRj8 zFH)oJQl|M|f^KM?|7*(TrfDNuJuKV3FO}oq=W2F2SmsZPS*d=Bd7rB%ENmXr<*qH}W@#`Ipfs2*U|mrx z#H&>P=nvq|4I>7x_8;r;v@5L0dw9(ltsOo8$Wy-D5D)Da48L;A@c?FANzB+Wh=vvR z?+0<0G;m%$RIrxV{BWv+xdtEsvW9(2VB0A_@p; zt4iXAXjr3GNHjXe*GI*6BHm({v5*ZxOs661Xn;}xH-d~bRXxBf^j}cDb6ke6eQ};EJz{{@~;I~9O=W89N z;H~Zxhl5wWzcp0RSQm)f++ze$!o`CPu}Cpd6wu?C(625C`f4!+S1&*#kl@rK#1iLXtLZ%V%|j%nWE1 zp9CbcwGaQnmn$P%cuYsd)BBLM7iv)FArr{$I{AiHmp-bTy2t>q^<#G zndLRwYI(#tXTsn^q1W=jQ|I<{9}_WeLtuGY70%jG$j@FAF-!vk4JBf461o5B9==wH zw*`Sd&g*F(b0plZ8*U&g&@YU(-m>2Opcxp6o&t^!B!@BPae4ygZjfKd+7BFmT&tgt zEH-c^EZk^|s0w7U=}bi1^=s_WN$+zZUZTr7Cqp%Kc2nEGJj42Csdn!>es`Yx5*yB< zX_G=?h(G#y``Z%g*6-+!hgO~|lrVD-WqYZ7EzkC^Q0tX4kXR0fHKZ1|{9YKo&)jgZ zHWCr!bkU?rpvrEmr9t1f_1LK~Z2F7Ip}~V$0f?|Rjlsy%qYn8QL*)u`$7|zeg^E6f z+|}1skF8$B0Us0Dlm5s}PO(uhU(4CH%tFHYuhxU~tp~(8>v*|Oj>_e=m@apfR;G=t z7EOKEk*7J_Fh;F{xF{w6^_LZ#Oc=@Kj_ZW{DQeiBM+uC_$J^=f;obSgNz3VYVmf^K>n0QVY28+Ly>e~d*( zXg*!-wjMieFE)3IHGfpo{V)7Qb%zO?8zq)c(a}_N1ettFzCLJzfciIwO5L5}coKr( z7!Gdfy0_%kGi*?WA%OJx;Dm=|+^{3F@7xzR++&5FLw?ickTrdBPfOF=6|LyYl#rw+khS^cm%7TWSplxD+Zc((RPFS*49z)-uS~qe6QVc0EnwTiolf$FgVCMy7eB&t z$CG9XdvD^kfT*rqB~e?(E$yLt;f&XOHRw-#C8EUw3XLIn@2xKq4?2x{=+Fj?Jy=CMq_#7s0_i@Yxb1`J>SvHbcxJ{tJMz_6fSW}PEx$qj6-AK=w;QQi%vZ(Dg zLGxvR;HTfVRt~=w%iQp=t(t&VkFJSt3zaxF_!?1;*PVM4h+J!X%o&L z_X#;J#P?pP0o>aG;4y!ZdNlMN>Os&*`&eyZZ)YfkBkv(Yh>lKa{(@C!K!t}nq3-AL z>!`Uq8wRPiD2292pVsfa9+hps(KdARa_DLE20P7!(Ni$XM>aVbwn3d??Be_*J!gw; zfytKAiweVCjEws1&1Q5%`5t*YxP>N4iDuMe%lm2Wj)%r3e0(f8o}rzNcDb`HvllJ> z1~&TEXB<`!fPK6`8XX;I!aI0f3Ofu3od81Xl*Ew-8lzFPCwwTq4ng)tQt7XE5&#*n zMk-?&Tb5AevvyH!`>p1r?MSU;z07*_opNiVJrag`*?=ba3glZJf~eJq z4(~j3XZ6=ebAz73=gsPMMuwb?ya1rOINje!34T6C1ULk5uiMj z)qx>UkP=bwy!5c4m^2C82IOBe9HAm{h`jT|N3#hgJIDN@3CN?hJW31V7s3u(%m#}J zO@h{+)#-1x0RvxjqS8upMY?SCYe>&+TvGkyPU){|t%`By)H_em=R7B9p;0yl0fM4`%379xxN{Ti_x*5pFQ4Oo4lqq4CHY~;vm2>mf!go!T2 zlq}ke=oW;H63EN1@{QP6Cpt!}#)})2%}Y58b6LXqXEs#~X8#v%F0fK6EqoM2vTgwl zO7;d0g|kw%2WNvle=9 zUw_;r#l9qbXi?ZpK`apv>7Bya`WtP9^HZjX5KhsP%j|MuD808+GX1K_EWJ6seyJtz z$_4l}Z-OH>u#u+YmKM!W=j3J;3{=YnPUd{)^H*av)WphMiz`iuvHI7T5LCF$aO|YZ zL)*Hf{~hkF(1E;BmY5yF5;$DbfG-@CGXf9;uH3m~)YHb4DD52T;JflC@Cv72(YBL6 zmpBB;$<}0mC2#hZ;NEPi>`~vA2qDDM)h?SJUwt+|Yysfjz)rfO_udBywcaLUOH!uLZA`&5O0w(@RwHrjSQ7tRwRmy#Z}K&gy7{0V7E*A(4JFY1;&boOLMN=Mo_spQeGU)w7fuItv z#GecGF@LhaoY?gYVO=Q(Rk=_HpB+-b6fybX^-v$&1br(FW3s}=1hosUH|qh^pr%^8 zP`>AoN7$*zq;a|EWu2A8*>f?*Z*rac`jylSY+JgNo&;!$Nl=z`+Se-W55gk)d(Xw( z^~ygq49?-bOBOHc>qOhJP69UuZ3R|a31B%h| z&LOA3>d&O87y#1U4OO#qf@T>qkw-Q%EETrx?kyfk_=>FNgi3CXI8(!2yPHdl`B0p- z!&L+z#!n>YHmJ3D6y@oaoEd#rM#s%MeB1M+W^>X#0M=GRkkJr8Wv{6$e{n*#eB_He z^$rj$98Vm< zzjF^ncNs%Ppj+2kQdbg$Uh=2+y}J4)t~oPbTh{L8mv~xR`%T5SIcF$IlUXd?mQJ~R zO80pbMNf8Gt19@}n5t4VIP)%MgffJT2yKiqDVB5QWQsnUMyc8U8K5V67BxkvXuWv; zEzLM7^h3jKVHqWJ{SUx$tzW(c;$7!#Zl(3pR4Ia|Lu(X%tk0 ziuM51IK2m6{K`K=WzDB9O8_Smuo>-8a1tG(erhogqMh4w3O1aB-cIZ2vd)BliWadw zbl5EH#FW)!`IE;y9HQxE)&Y__C2@2-{q2<*KD1L7uDXKJ_ ztyfoDEJu7gAzwby_rC*q5y)*UDGa<-tP;P)olSK@6)|#vGI4^&(f|W`Rv;2{yv7A2 zctW68eh2$^f>(Nwn&8FRp=c`J`Tw#5pqX`-+#fT2PnDPf?aL#Gv^TO%(%-j zbj&Ch`&V{Z!8YY(6QG2IUGoZoO$k{yiQT?C$`GFi)M~y$2e+Lel`&NgkI-z+iG8K_ zAm=33bbSugWztXUtZnmatQXE!dj;RC>av9URzUleD9avvMVmjxd4o5kr8l082x~pa zEU->A7!98kbF|}QPq27f5M*;_iR~qRc0^m^Qkq@h7F7B6!d0r(AtFgd{TUsrsM3z@ zy?dQBG`A9L!%uW0M4 znPfw-YlA4dC}}lkX1Jx3vEQZHUlUwI-Z_$(ff)4aAO;h(()5pP=dDPJS5$XCT#*$l z_YOCc8;BcQ((f4bD1@Oy8z|grhAP3!L)H~Dn>J-F-(`?jFR~s@?Rm781i8#xiMbbV zKvrL>qeZ^V>$6Kd*pqds#dVRPA<<2VN{>TMhsG`nQtnYJPX(3H0k^I~GqP^Sz-g7& zxSRZDydP3OHq?8Wdfte>qbq!&S#Hc+bulWAH*&p&q_fIN84V3S`N_vKG1|>&bR=1^ zl(RTchh17@Ro3Tn0!})s>Pb=In2UQNzOXu}ylJ~-KFztktU!8teY^Z?c)p8AQpG<` z@Gx|O;7+ziTC@`?o)|*$rf5Q|H;Wf@2wxSb5&}(I@#cp?oA8m))rnQqH;11?rKsKf zfu*I&@JECQnH@@u0;vJvq*Yh(N;tN=)O6gz?2M`QDGk)=kt2=D=H8qD7LHZ25OZKY z-SsO%nM{A058ZA#AinGSypTnoB-&Pglr{}opjXo0PD8|eZf)2qdul;0%fxG=p~;^n zrS9v{8wD@#F@mO8ifbHCC{*pNbhW>CCK!_Hl}QLjUxBw=#I0c$Zk;p)-5SGi)kZX` zk10$MViHelwijF=!t}M7w(j#qFJAJx&v?I`7lnS-QY>;oQ_Vg%*wR1g-tN4VD2frz zS@Gj~YEjS^8}OGfztwEr1cjk62;m>6>EZ(S63WP!ec>u;A2&y)D$w9c(l-zl0wI#S zya5PKjO~ZaU_v|5@VBxvZ%U$r6~8fk*~GzMU7@9ltwE9OE}hEMp(BmBzG!3o*t``3 zvTRc5A*?3X>p^M9*)+b3=S6zg8^|6q&el$KF^rQ%{q~*zE1T=ZgPRyYSkxPvphT&D zh9*T;(yh=48-bUR0U1j7s$dh5d@D+cDk&KC&NEC@2DM}_1`tn{3!O1B zcv6V91bVb^D zSuifBzmu&j)M%R+>eRvVQi)jK=#i~ONLbm5%Z1#~UX$&>`9WO5?+k27PBkMA?LOhmLB$_nRRdAztmFB$ z1?$_6A6+uyKNMc}gsq=X(`Mb^h<{PfYPZCWAcdxjZ!{kqe0qnU1eN}~q4-wD5 zh376@CuEs&5Be>tNLLS#0}uiRBpe#;2KYzIs|T zwa0P&SuY$>3_9na2`p)U`tHb-_X7nO7H}`d4IDi&OzsZo>~c#))GpG4tMU7Lv!?94 z9JRn*AlJ8hNwV&bJ+4=HH@A&e*-``e&7exs8!gNWpxc7;kcU`Iz)|EqiTg}kjh2q? ze6sF2XID+M=P|?EDZU6h{7~`u`o#-Jw40D87;hDMa9()+$DwAXUx(B3Zr_g_?zw6; zo0{&47n{d4;df1nYGlt#-k8AGcg)Kq&%Cwsh)cq3o|R4h%j$;a$bAefVg~t6FXJth zqZ9eF4_8iRq*6Hu#I3L18C7Hrr zU;9B#vMdC{yyc?{4PtIjdlR0?_Wnxq&e^*4g?zOy20VMwiWd8l8KbuM?7W|!?YYvQ zZPik1&)I@q_V&mGpI!HH+xpO5;C$oeuxq<_A$qPX>f3`~{`6qw`HMN&D)G$BNcUuE zb7FI6tIF>*cjwD^_`^dQ*4{)GI}pJ4&CKKA-=u!#N2%XJ7;_PQ^76B8@|0MsJePAB zdLNl`uRmJ5PS*SCO&SrVz=er3;Uf(WU?J!ToN0G)|F?yNeP2j(YFu2q2{;PB>6y)L z;hsqM^IVtzFkl1)Xmm!arC_JFwh~tyk?I<=Qc68Gwve4i^xsv6hUWfoEYE7O zu6ZTqvwaKQC)P&e*SGb|@7PQh_d5^LhzL;DUw#m()Ci0$&aKWkM}E+0^KJJ*-**qq zmvx@PA$vycH8JSuV&pl?JDqisvKuU2lIhPCTL<3$?uYtQP!PM*$^Gi~MxBJYd99?Q z{Y~g|SKx1cyazJ(shLpH6RD3>{EaYK=b8B{eP(L$#dEb47g`L;uE#&mnVSQYlpQ#k zbJE16W0_o4D&S;*VW}}d^L5?%(w`S&PLuL_&bh5i#BMC~9`oMy02-Ph-FoW1?w!Ju zpvPJWQzx9>CS^^jcihwu1kah7m}E#bA(r#(CaX{7r|QLs@$Bo0%`?zC4%+6qiyjQm zm3}H1nGq@Lw1b}HhdL#1^fz>Y-k{N6n|n44)c8yk`Ne)F0VB@bLEVhCt06IkHyCKb z)N)^?l9sFvW<+`ql5y)C%iDj*Ty7XYut5RiUX@Vy6bd%p@yD2uvND} z1)OC6O!%;@RGD4WZI|&aQf!uP>Tg{s=AB8L?(Xi;cHam5^xfVkV$UCZ7(1UlCZ4|F;jmQfwy{3Tv+ourfS#Qx#@NFOI*WIZ zc)yE}=8uqz7jv<@o2^-Nb#1KIpn4C^vZpQT~T#U1532F&CI zSm|2xR}nC)d0Xu9K_ge7L;p5wMu%}+M%&!T8@?8m5FkuZkDjrw6GeRKb|v8GLHk&2 zqSM?ytCj+ulISKCxJAaVSG>1YVj8HG-~S^<#on3wnOzTvS4PFUDd2c^NrKG zj-_Nv%rkgq^3INdALJ5)iF1p{aNVdf(EZM+D6hH0!6Owx|5Ku@Xp7H zS|dKW1G*W&$1OpJs5T7pHhscUo8mXszxI>rcdtav_e4r2j+6%%NAur)vL$5mVWqiK z<=(-31Fe_mXxM75){US~)ex`q)Q~sUMy;qp{-OVm4!1cq%I30(jn>{2kN?jUxx8Q{%*2g7sr-a_{!q!Wu{Le5Zi&2{2~+kD=u4iPi*s9C z9PZA@ldy9clLEG-)}bd?qj!Dr;pNcR3e!5Srz@ zl6nwO?N_(W^K!K<4|Vm?0ay~S(9fH`pkHe1EVH^*y5|o9GJf<2tdKV6e`-DTsGGW&?4~Q9v=X zNn=GdK&zH~JiOwdmHPdkNA&bW+2BB=hobm%2a5e24(}ySXYkccX9LR20?N_@%BBL! z&IXp51rGO==l!Yn!U$2jX1_2}2*3GSM^iuX98FxX?7>H%B5poYNx-B2A7Aeo)>OKM z4dXcKu^&Z5y2=qm1f(M^coZ4IfPjc}6)6z{BE2(uM5#fgNLMf*U0UeG0t7*N4^0TY zMOtWqylaDVM$Y@a-~N-q>zciv{gk!tb+3D^jW+rxv&H$JxbBbb+wKl?6&flO6(tpg zi#Cd6h7;T=%hX<$QIq-W^u=t^+13AaWj{bGyVb7h7~hKFtB#AD4_B!jOb8Xr%29oL zN=bX+sj0Juwo~uQP~lb<s8V&Ix(=%)YKx|^kC zx!dMuM_vOirB}BMqG-*Xk)jLjtd#%o(1oBvoqy0)1BY9I0@(sf!*-pU_`Nxl7ZH4< zI5|gk0r%82tLER8v|AG1pH#o-F&dg<@pVpemOjR|Wfcxy`g;lPYZ~{Bh#-%lmCDbo z7t)iwtL*wq1k1hKT4uka_}jwzB%CJCv9P~XsMXB~7>0I+p+>Mrq6pf!o-_XYav549 zB;&X(_05}8|8D?y*jtds#(K71(G(_JgG)mbR!41@eX;0py1nk$+yx;Kvq@)vR`9k0_X zJZDBFL+UIIAp>QMx23+8^c7@)7n+Zapewdd^J7bFT$I~)z{jM^ifO5O) zfH8^EqO~DAX3h!Bh0|n*D1ORy0q+d)2wbhw|Fa|6bB~|LrEP5JdkmJAP)O2&&!zh! znd`Edg+xRShMWSiqBz_`0KfVop1PCm%|)4E-X|@g3Y27__wI3<*r=6Q%HChK54ro# z%ZKxpo(@+-xu^p72~p9$*E0Or=z?S~Z@0X20;+qRdW3K|zuvVD+qZXJF?I*WnuO0V zMdeV4&bsG~ilp#U%Y(D-6&>n*(r1wSy(u3`w)*SN$ZxfPT6mTpQC{Mlx-27Z`RhU6 zP_~U||I`VIPr>fXPp>T+o8L}5*{qwu`@2y|I%&)rBM)rq+x=sy$ zZOU@*4xP{ipX6hnsJ7ND^RNSufX1}lW_KnoMacut*k) z&b6*2OMIfaJ69!)^<+xmS0l2(9_g)Q;SQ*4(++sgm)+KVdu(&3PQ2P~C)g|I6D=yd z84I5Zr>aIx$y0btZTszn#*hOpcc<2xGSSym7e!DSU_R~V-YU2&ClfNXYJwqlzgO{o zY0LCXJlTHBi8k<{m3l-EiF)Elq>J;&V4j)5H~m6+^asy4_xUoY>`4w~zv@*EZ#*(m z_+-yJ0rxmpQ@1S_v-)P67xQrwwW~^ySz6MllHM52J|S)9Mb1%3YA}xC>vUoX(-F1b z$O&avx6`}?&R$rZJqKB6yr}r!;GH0_&AXmV8xb;QK^5J-;xTS<7}|kY;Drnl^WL2$ z=L`D@Ppc(5M@Wf&uqf%ww3X_s1qz~4HYVOFLg51@eOt!$Uytf8?Qv0NcSyKkB`E9yz0a$$7 zU5nIuexz@P?7P;7s{Z>-k+|x&Hy8DCJkT*eo)E#v;m;_~R!|i=R#sdwo8jI4fbHun zX8w8M>1?!|NwA$Z>pOHyczgt_XK^^`P2aTXXdl;vaK1g(@6b?GL9$TbE;U_cOsy|t z+1fy#bKN~pZ7(eSnyvzuNKkB~mJ^*8lQ{Uj*KLbU`rijRb=F9-*tIESRb3Xj?w>?| z5Jt#QyGQ-g=pJrIY`cjp2@qPMvgV~?mPg$XA^G*LI;*DKb;RhhLv*5!JP9%J8a5|h zXgPV@tA11Xeg4`1<4M)byvY?jGp>@yMND2vp;h8DhqF6A)&rt(&m_*Y6`_lFu}4_+ zzdk-}c1A$5w9lv}5s4s~EN#H?RnGPk1#e|#T#x=HC?XWB;%%=#G>qTuco4#}eXTl$ zb6GQ=3);Af8pmId!$$dDUK(Rlnd(lSDK?ty5%763tz&R}5qw@10@u-BI2y~0LL*p` ze^;_!$c<*O;mRd0f{COo;Q~B&JN^WuySE#4>sJse7Eb$R+s*TC2D4--V{ka8)y8Fj zXBYi?@)?54GMfR4PdOnUoOa_0F|Q71}hj`+>0-LgT_W{ST-6 zVr2M>9nY&p`*x%jp547P9&(hau1lq%NCBBQfq94~Sq{_ZetJLa8{6XUkGG1Pm;X~Z zLCvZx_D{{j7?MMelU}SX`XwG3V|Ayto|&7UYZhvB0D!mLS){QR`si|m6TT@?dlD9? z-pir)hYKxeT)>PZ6yYJioAxckbTby0_@D5mGkq9n5i@B;9+BY4NU0!|fP}}(V_u$= zF?gR(C5wL;SaSEdIU55~V^daM!Mx(w?O@9~Y*q<0NsNN%Bh}vdZ`P}{lsy#|II`rX z_d40~Xi`w~r(M|m845)lEMmtK1;wYxZ__hNN8Xxv$_ihkT&_8QaeDCJbk+5^2zvn0 zss_jLu!(1oHKWr@!3^Ys)!&Lid`qJiw|dI_b#uqmRI9;;!=-EmC{d|Yj<2;Eb91K; zk@HnNCZ2z?`!S<%n&`Bnu2nk=9YDjXYSnNF862w;_LNKdo#{w_(WBd?QI*Y~fNc<+ zs%c3)SzGCc+_=$jxUZn&SCaM3r8=Whv3mB^KYAeazp828nfmUmy28DPjtVN(OVaD%VoNr}@p*OVJu_qluk{RERlhLm3<6NkVl-dd>@cr4 z;6~7$K*3N3qbVs*<_yzvME$gW<#$Cct(rqy2Q5Tl`=O31DuNwH1Dw#yHBi#g233f2z~T+ zTaWF^wvRs~FdXNUq1OC66OY9Gtf}Mdx8VJwnMYx%;ky5Fn>qI}p9m*aRk(J@bAb(0 zi|zsDoR!4gikc~=zp~pHJ?sask2mlMN&$Y{Py9GO)P1gaq(XF;}z{Dai}Axi}rskjJ3*Q z|EzOeUBqPDQ<1UH*TBdU#eJX9bpIQKPHk*7fR-v z`J4~Tw4AD6>pA7v@v+??=N>lD#oldU3X&s_H2O1#o66B(!tY#ez{MRwqDj@R*=1Xe z04Y42Xyj>;A@P~Nl1`R`Bf|P@5VT2*)*Mh%^B>%k%)=>d=#n6Ix${s%xuQ^V?Sc9E zxlolIAC!ShQSjflA21WdV?ckx6(aCI+vZR3pA~E<@3Tn_dQnnE0|1FC6i|#Tnc*L? zld26qSaC<%OUwQw*f1$ry=%vgy9jVFMe7=v7c#zQf;lS`*bi$A*M0x2-+mpagdOrq z7L3)|+wjt43B+GfisyrIJn^${Ee&qP5Iz#zTmj}4=PARzJzZ^Bg?|f?JJg-48{`Rmxwxmh{C8r#D>VCDmeK=mg+3~DxBp*{}jyl#rIjbJ4 zRa2VJq9Z!I{@3Dd$CGdTQqog{0~mC}9$H0b9_BW9L<-5m<8055W7HCZFGG-xRXmNn)WOOB zT;5#~8{sV$Ea##`W|DgV!LO!{POR3GWH^63u^aFi;uO@(`ibZPsS_ z2R|B>Bp(bB$Y)fQIGshqls|}Aqw+Ep4gWdHUpcV0kQtq;XDQ>@{<3(q9=WrU`F2Lj za_GT+z4G<$yP_-Wm6(m+4OJ#sW@ykaulCeVnl{(aeXAl=hm~N@X$qU*pdMx-w>Mjo;L8XL$C|=x}9M z@)YZ3qTQ9yeCrnkB`Nv!)x5Fp40(J{TZX4z6x^M!?)I@ZNy(-RiZ2Og9Gk0axlD8T z>6reeLR z)6Z;K9jBih)XydGxtaipw@nbYINgQOW*`)(&1w@V!RlE~-i{m$1S3r)R!;k4#on5B z-)bt>2>_cu-+t?68w)#kjtVZX>xNyxXf%NP1dCBA$i{w<1a!Pft&M#2!sMFu=H9lvZB?@tutjcJi)@dB zE?QQVn%VX7#0S@;PUNMa+z*X$dKZmV09B#`?=b#UR6MaXT?XINnsHe#&!!C$Mx8m& zj9(vn;+Bu=^cC&_&^^`+w92<=S@&yOrgM6G?(HP$yk53cec9aC+eJyIu@enmPf9Ao zM!At78nd%C865l-$W6lvOJ(>2$ukwEwxe+Y2_PD9UbgG@b(xslMImv-?ILC_V)#O8(Sq@*cd(#;!!k7Q>~)Seifye|uD>Rn#P{4Zy!p?v z;yefn3H3pTalx0JsFBTtujX$D^12W(2-p8LMMF6p3^rh;ucvHq=D6dQr!T4~Yu>#C z(=)x&L{%no1Ikv|>;2{D04lN)Hh3E+dN= zfwp+wrAZFr>WE6>hmUILH*b-oGEli{0!u>~#D%dQK62i<4Tv)c&G}2jBRsvJHt5cT z>0)88H_AH=kShwF-80oYwlqjqf{VbF;X)cdg_*nkij&g^;f) z!<4o!+UaINaK=`+erK{&@valH*7^~IKccZ6MMh~7X2y^&DXkRTibx30w!`DygnMnp zGK?sTgw$d_>;&oA(hL`BwfU~Vj)TMND}o6C%v6h#X`YkhatYW#vTc*`-F@rdx@TW_ zuDz?H37r3ibIQndj)^JwW6O0-{bTz!Jvarq&j5r*zll23Ri<)az3K>}UXg-#Fr%+E z<-EIq@6poNI#yP)xwd_%tEJ2(w8_`a!Q(x`?v=&%tb&_Nmk-x=DZ!f^y^7Y>rD9&U zR2NODvBec4X6jnM0c(!uq!R*BnO+0 zbKtsc?beS6Ad{}7O%c5I(2K{!Nd7>)lY5_leL4DlsGJNHnQbMkd$X3%CA*#QSsPeK_plF*Y)u#`t^lVnWb|z%PsL6@L?i#w1L>L zg}3Kh1GBwhP4R{2e(i1@UA-Qn*ZY?t%UZc^x*rQtN2j1 z*zSB)?U6cz(sMtL{STc@EBW(5cXF==v9nx$b|@&?rdR;7>#>BX=PJe?(#YH3r>yi0 zPY~rs$Hp3y%*ad!r{fbXu8;^ti?%t0Zy&sI1kIacW)@7=@vNk8ftkQ=7AjvN-@lsd zga>`b>UlP#D#9nJS~vW!*Fyfzn47B=A>kv8*`0eGb#ru<>^fOyzVQlf(q_IPrhP6J>h+;)BS07=s}+e|W^(GB zgN*7_=!%}8czPS~BgiqDt=U4b-P;lDhu&Km`YeoP5^69ZK-hmY&RrPW^;#4}c6GS& zFfAGv!J=Wg-FrIzXvqF^X{n|o^kD(X^v861@x97J!$K{)nF#&yJTBsg`b%_ynU1Rb z_ZP&JY=N9x+dz&F7vbT+XP7#POlZ~Uq)wZmA-(HJiYE8JgS;R+$Gz3b(zgLMgD4tf;KbCYbWdCs?11{H#jbi%7 zKoyr11W8S1?KsJ7<2IBbv+Cmosgbnv$JvGT5IqZA9|_ytAxRgE>K?^5*>zlROln5aYB>d02SycsdaS%5avnZ>RSvWRv^LN;JO~@lhYz(gy zPp$5jO{GE|3SY;)QZ`f7_)r?*KABQ^u!7ZAg?s{sSFZ-~ef) z&CsX&+*ZW@!`6*UTmsD@ZQ8jDR`z5^nWUY1%yLGwHo1{o&M`=Zv5XJ(VGPm#!SrVQ zp%;QJtOL4ji3(Q(fovb)@?2=L>#-v#>*?u{B^2zBXFhM(7}~gPpcy9B)dH+b;qXgb zhtbZWVUQ@O+`R;#JK47G7GyWDr^PHlkAN`$mHfU_p;BGa76UcQU3HA>0=aI^ z0=N=k)Wt1CX|O#z=;Jm&^h%@ZDXZ~`!zlX0o40NyVO!<`3{27^#J=dm9(V``_6gvr zdmAsq1ln+aZGf5HOOdCT^z2){BvO#TEyXJ|{1{$fK0L$l)h6+D$6z~jWv?i9oE&`n zj5}3O%42mrxrKl^u~D_)0wD^hc`Ou*t)|4^tEnmpvxz>q>M(gDT#J@(Wpor#X&I3t zt{Ma9@tcx4Ix749j7&>Xx>ta`nt^#%L&>`6F@pE@Ue?zwR+`3lhno2YY*Rujkc zrX8yh=*LT&e5JMi6%2a9=c!VOV(=M+*3CAPole_rM$850nV!PoaDzdA!OZ6!Cf*8I zj`(OEHm?29^HRY5L9LACAA~$A*^$%r^QsnTN!Gxj7%L64CH?EdeO_zRd00+!q1)UA zhdCm&oIDrbdEQgP`3k<;A%$)JRtX4CPc>5abvzFU+*%cO1HO>jx4-oI0iUU~_v!ve z68i!a_Bg3S=nL}!JN^EDclu}D)W04Izdl@I_p3uX9XpJ)Yd{yzR}rRb%;vq?5`S-^ zH3bvhomn_si6|BY+>ukJj&fTH^)VFpBGVEZcyn-ekX? zWpwj(nHWD)=WEvh-O3nc!9d0PDX%^*dMYe z_&ihpeRGLwCCy{q`H*t4HqnKc=HT#%iV7rdXi%$qtf1OBg(`##@@p`nDS6PJIg{R+ ztXXlc$I1^N;){yBbSCt%mBIam_RUFTvF+w{v z69lVk0}f&JuQsS>n1W<4fwVeFn}n`D?~o`C^h9R`gs(^YY8!?^IL^p>gjVjgr`u_d zkPr!IG&dVpMDMakjBDi=yNUvv0EFa3;=;m_@(#*)M^fe5e6F`5GTBT;KLdfyKY$iy z;aRCx8Du3cE5~@uebv;`dP#@`N5X|upxrjg9@qpO2S-H?;~=MhjAev`H`#cos+1W? zbkWJP(TQnpuQl)%fV^YobS=naV-qww<`6Z&+}s1(9X`G~+RU>B$t2QUcN&boE#duu z8VjR?ekN@Yk%xgX2vW=R7FI7?E|(eUk)s$8T~BYgP$y@5qN$YtW10;%v46||xS}ZX zzcXQAioS=q*hyT@hGg^lRGqXz9>%hYp+l4MEPTQfk6kZb8!s^Z^il_ATra+p-_6M; z7G~Vo)BV;l7Hn^AKC(wHM~641VADGBwxkn{iAE08+qZNL_c0X>yd-g-B~-YpLceo zE}AufRV4U~T6je>UTrc{H~sdJG~KM=e5($x@4q#29%K{ymm-*|n$w~266V#W(*4~$)ekS2>wcg!MR%=mJOQWdVg-nyuv_X;5!aeEKp|wWC$LPL+s_r>Hu+*jX%lA1cnBKh6uQuNtIH6~;o++`Zy$ z$xfpsjAmgq`}i17Ii^D!q7o^kDyyF-#eK(s9KRv*KK3=1zH@r1bfx945C79B>R z$9}W!A{=Ai$kNL-Z)4#I=Da9|6|?&2v%`))OM(}edLh+i*UfB7iCQz(5OB9C8lr$a zVhzmR{FoXQp?nfMaoJsvqx)^;@6$TVOp-ejy^}lhO-P+q$->!7t7_9k z6Ek1Xmm_hH@+8i#=%#t+u?#S4NF;>>Lh40hRJ-;@l|e);R$7_Xyg7cQnO}2`O1Zf% zvx6?n1J5S+fea_Qzd~C>fhE_XLA~I&8}YjjocO0jyr)x)ef>pI%f>f(burndq^d0M z^~u5wkl$7XvSFgxyg@dG5cBvcNKKwFk;BBp+_yqS$W$Ludts)TPyd*J@b7Ohkm(n- z`}XI$R)S({>y<#@;4+Ix+hkTAyAKKyUH)amBPBH=qG^M$hDtWu2Pq1Mv2Y?aZSe7a z;pfk|-Oe5tHiRUo4>lJxPctr$3{|`4@yxV9kX--)<1@t}iLnWd2)lx8-^PDdX&C&| zyL4%Bd1#k6j=DaOf^a>WdOEQ-yWm+qJ-@m+A3j?^FS8xQ4M|}leeQ&ulQsFbko|lb zahx57_GtRRVejXD%=}5%k*V^vnb{{i^po|nlj&n^X}aW@!ZnprX2DxP7s&yc%mQ&& z2ZZJ)*Fa*}j_Qa#v1h7T2y1Bxr19!3pPK2{9arsjX+~P3O9aXCA(K<24sdt;h? zR~>BFSYykzRl8^Y!>s-XvjiG3kWq(5RT?kE=Pse#nc@_r4x#8j^1jBkczJjuB1hFOyJ=SvDQ>6i=G!fi){JpRYfgcXDbD+< zfGd}|$n81a8@lX_=#V1RJGDh+k;z^Z{xzeh^y(qCY^e$@-J92I=DV`8(o|sEFEjBz zad6Uv;YOzw5QAz(i1La{MGXkGq^le1`2Ej4RbUE_?A&uGFiyd}JkAxTp!t6$fU z98OMFaWS87nV2MvoMPu;^A564XzPrpwYNx&o{dK_G|Czxd~ZIEj6+Q2*K}kMd8{ds z(r#dj#?%JO&s8sXHFzCY;qi0`4Go1?k(*c|GCb+y8s7c_+DY%wBU5EdeRiLAfd;@L z=7>>=6S{jf-+GwrGSQX-$619o&b-r|pn(jDI%Cln?73U=oBh-@l1Anuw7J_yRIPN# zGb0*ugvlZx$hPt=nEiMch2NIzCS!2f?c>erM5lW0RfUY#Z^ny=yswv zLxvJ4p78$tSu9hvGM1d@rvYK69T-v4-Dh0kgd$4$0QH@K97L0%G|on#IUaRon-E2j z?Vl#Xb8)_5+@krI{2cv1K^qFTGg@o*Cs}(Jhn8im8;k`cxx?D_9n2j7bueihkn!QN z3j$bVM0X~K+giP#iNhPcwDsRsM!q4GdKBwY?MT^$2X2P0-TUDv4iUoAIx1gZv)3Zu zxTfg^5JL=)?I`zrCLw9WSfBMAq&%a(JX#ktpIB!Pl#c{oJO`9$UnV|iuG6^w1CQ)T5e1`q>8Ge%A<=x4@7u{Ws zZlOR8*rb0xM|3ogtDtf81-Uah18;hZNtGt6HykW;*G=S*2=|REV$oc7wDA?1NKrox z*pj5PTuz<=M^+rrAbYypY2uPVQ;!UaEI+COJy-(%daF`6s1+jKD^M#aj6$KjmcQ^^ zWo)ds?DoNiP5=8#B2KY5v-(4N`gst20bk4F?e)D5%1*SqZ_VP~#`^;klDFfI0p$CR z@b*U?;U#^0evK*=m_iltS60)l^lzI?$jOn_&$m8eHYpNIj;MOm$7PzV$TiqlwptPQ zq_~nMzi>{%y6+f!^Rb(^bV!@wfV{&UvV^en0S?v{bCDn^yikH;8d=S**yaf2e-jGd zpY%64wlOJNC)94jdVGikipkr$dMqsCZbr(E#T&ZDAbv1yBw zzpnuZ$<2es;XIL&T&1bP6?T-Vn-@wFc~%>r4K7n~xL_{1B(%+1D^xA$?Z5Rd)U|(Q zVaIGFZYJs|lR+Yl#jc@D>dcHAJ>vwe8HDobss+|%KrUDAy}X;m#!qG4>F)SPw~)4F zXQ_b1JAuOK+3ZQ4od#D&X?RSFOKZ3fwM;t#%AA3zb*%Jd7(A5mtj~EZVXApOs_1>@ z@7WiZs}(&5=^~s*5w*-_{*a?aqXRh?TUW?Dd}*biQtXQ-txE+$i$i2^q?Ew`kzf&z zf&D>A-yR}dzL2=Jj@B`LZT?b;DZECq&dz@gohz<818o$Z#Xw3KJi=K*tz< zIF{NpxK0$%=`Esjv|LjFhwTXyX~*WB4YXA&H`uEAPr*$R(2b8&|llN?pPn>fPz9V_j=9QMuvy%#>Tuh zQbTXRLeFC1!oeelGEljVyUwv`3M_32Jbax4(4K=K7A8%KwO;h*3wfx_)NHgSwP=VBYj z;M-9?aN0VcrK~$#%1!cE7nvRTj~=GPHA5|c;?wI^#gFTOI7FRH5cYerG{t2iiy?M8 zN6cXM7g;q2Dr??;&9iG)&=S6K<>E%BGjQEVWbZ|5`$E|OTfrf+dOHScOVJ76KMh z^`nQR_oyYQLH}s-#`oa#aQ@#U{zF8`oq}>|y9nEM#d>MJCu*(ISLRl+_;0(x^M1DpT9#N2!#BQYzCwlAizSxJXNOF zfK(fZ&A`N9r^| z)|#p~OA1i;FPK?Zmv`-rplGnhbD}m@RVaH*IJKNpVzWwyUWwAHvZ}0{y#$37C!dcs zzdgUck3+vCQ>@&za((t=E~RDn8#|;215yAI%AQqv^_Jyw{2_9NJF+5nYk2<3wtkdU z`NJM=(f3Q?wNCbRFNduLk;raiwexizvOaH$YSX%!3sQD5MV0=Nx88KJ3NrNRWhlji z4Cdvf3Fc9+jSmpORy!6b(yPpgX&%$wgB#?OJ@_m36uRa7CJ!Z4kE`B2s>2k*rWStQ zZ@vMA!UxGsrsv*ctS@Qo_2F_{n=T+dKfz#CqQBT_ot25l-6_Qu7N} z>sh7sUf*7mQ5a0hy4oN-jLEf|XUz!o)F?TJKg`~k>uL1jG`jmK(Ocfe{r*i=9*6&W z>zkNpunG{I{%dI83*wS9+bu|{K%l*si2mY|iC7?U3 z(&pc~mZ^)&@%7JpcUzastGzw7@8DOn0(sgkNSE@F2{!bGERu8`^JF%`nWYUKw;AXlrVB{QKES0dd3I|vC0SyZecT)> zj;K_Kc+CdLtPH)1HjKQRal}>~%2{I`6>9PN)Lo=Hv=kLa6$4XU`Hhql>NaRl73tUH_w{Y7vqZXr}uuf06J14XChgh!+B7 zSw}fn;$~+3M|>RnijBPdy_N=s2z^dvaGrlAR?9q3#Fp)eoAdR(Z^jEfJ3E)F%geMM z&>uXAa(X*J>;_H_S(rgWyvJ#;hpV5Ev+1B_6IJ43=CQ(xtKeWBeRmKUQr)&z9FNF= zGodqFn*cTj3eBd-NGb#2xBi>TKx>1Z6Do@Y%=(V3EkYiOfiY6nF?_W6N&q{ye0Z9( ze|g~(6hqgqgT;khWy=19bhCiaDBn_gse~jCRyBYU`o%ezLs(w4d_847(coE*gW8N< z{)YTS3DNr;lB?NTSK(hRc1TN-MtodSkf4xIkb0~v{&yw5Y2ZohAkMFnE}sn=>&P-8 zOJRAhmPI5@$xQf+*r9&2#>sJWL9$#JJ^qB8k73h|vA0%@lrGG&-}eUN`Xip%lzPcX z>jC?|=(}$R7!NdW{}Z^eg5rB$#5H=-GRH2k>fF3l`PAD@D(=L^Gh1Uiw0%r{?zZ!l zT0n1HXJ(4bs}(M(SSnvCE1n!lNa7ppl9n=gSHkNw(|f8oPY}J=$6HrVkITE*{k|&4 zY9FiOF|KZcs=&O{Ez5sMoWhkZLw$FFsVZ6pXyK@+ERYKf3dVQJ*%W@SSYA+Z_Iu2E z-ZkCW`<~+px`716ZShjb>Pc*C|51%GI48k*;f_)iQ}sK~rCw=t9cejb-n6SGAC?Ph zevsuF{~EzxnZ8o1wfZIwgzd1IUTHZUnCWnVB9Q&A{0)Z3G|D9eY`nfNE>ny|NIK4? zC!~9p9?1WgT6VD-jJd6=8P*q7rw4s70$n^G^sF{UGm3er9w{@5o^C@!uXFFXx(QZe z5&j+OR1%>N3Z}*3Siud;Wg-Nc?TFsi z8R!u?=AwObp56M|k_I!=)N9?oxG-4X5l{~Lpo`Z0L^0$>HvVbWr%$^)1q?ets8*W( zFMN-#!Lda;N6Vlb(c>&_Wr1gq*J9&hJ^gFhCg^%AeF$gLD}P$Jgf_n1F2WtiOmwuL zTK(Ezi5cx>b5@j+g=9&DR~UA_B7iv&1U3Z|V&5wm*HBiI*r|@L9(+!!?D{uom4G$t zp;f;xUc>Y^&`&8k5A+Wvq{S_Fth=<>J1&h!2p91ml3B;uwdyjCcJ!~+IQ2if!83D0 zN*F2yEL72IqXax=(0dw+A`NN7he-|PZZ1<`-N+-s96a1y(x}y2o60E(onPbOYD~a! zA=Q>D$C;jsXr>RQ#_=Ckj`ngP$%V0I^&R^^R-Fes>`Rn7gFl=qBt~Dzc879r6&|q* zPSgD>J0o5WCOBBlycZIaABdK&9B1ueSyE6C2KyFf)0LM$d5-c_vxQRHuWda3}O-)U_47GmC8VKynl%p;$lfSNAoxCN~EG11}`BQq*UkU*Lmc`qS zR_?7#L$uPkiJmC936 zg@n_~4wrk3mx)?!dN+ z29Y5vuAetkfx3(crZCYQndM9Qn?mAEYB*&Z1z4|N?0|`q%2WOHV8`A+d6X8C^7g!5IiKSE7r8;2iVD6im_ypt#$zzXU~ssg zPc3?cqN0mB($Oa_hM#us=1m-QXUsoTZTxT*9mN5?!jf7SZej;GjDL6|*>u$E;9b!L z4wWm68Egw-V4arvV)pwy^QKnwjlj=AS~or3wf|o8yKCK^uo9N%5CqjqtPEgH#!yt% z)IeS)H!rOW232emb|EinJMMnsVB`z1M73N2iR{eEYvoBI?@qFhhsg2d^bX?g$y35+1)XE_huM;ADbBl$h zV;H;Dz3wW}IWHI5IZ}nL)8{m1f-de4Pp+#vIMsV96HxQ)s!@OHTE4gU1}X9Vhm*a< z6t9hG)4@+Dy7P6H?`yNI@kCDI`hcG%IY+rzQk)MAFN!$O6)H7-d2J!6wn0&LW+T3Z z@^!MD6KA-NFPxpzsB~6zzI|XS|L(QfxiG7i-w#s$9PRf*BpNB02YN4ib6S#8Ap((c#N)84C&KiR!7(KtmEsGi0J`#)2;{s-prPB#MX zS=NSD&)mEQ>6*%vzOL-;_8ets8TH)QsJkk}a}Bg=3YnQcKPpZ=X=xxgeumFicVFg7 z6^tUY=M!lHJiXAyNStxBlKi+TcFoCO8`sCH4=N(8Ien_w0wH?v2irEv^M{{0Z_MS% zP=?kAL(1Gp-@Rh*HC!^Hj6K;?b+}ySUvcZTdb7y^8o@MB_cc8B)iF?&h3c6myl2Zs z(&1rzw6M8Zt-8#8C1f)VzF%L%qrV`fdGndBd`RW!mQ&rP;;GgP3k!qbzqvVS{hlY& z1Zk4`t#9JDWUP)s1?2Vbw3yeKgeM(bobD4w*R?zbX@Eb6Z*tyS&)v>Am8^@rPCT7w zuu>V|m@> zJt`acQN*ZjYtt8!i{!@g>@xISMdg^}Y0rKyZTYSd_?~cZHxCyaV&U~F&88wxJyin{0QeE`)lzaOw)BMc%x4z6r4OP4l3cm0 z=W#Dg`_wR(QL8maCQ*I*NqLJ8sH8Lz`W2`cOyN67iG$?9PUq=3t(JW7_)*oN&_XIr zP%^#D=8xKT)M5CFcU-FA<~If3%+BdOVmb+hes})PwOF2QYion;^Y}3oF@2;V(;lV2dkC-zndXii-D^7q@w}%h>(E6g&SRwir;=RR#R!g+;7=+i%HWd*K8;G*d&iZU z96LVMsU~CqEem0A`)%u<|EbW8Z_Q&FqJDqE9o>3wJ)4#w!hPIiW7!zQRab+fS#*2n z^|vt3wj2PHkGU1Sbr)>b-Zf|PeZ6B)du5U@TvaM3a)vz-FW6r3es3$NjnWn+4LcDABA$)3K6O4NTvB@isN7pBaEBXmDB6~pJVIzRY2QWL7eAjzsn z9wH1Lj~4dI00vfjer|PnDG^E@@P}pZXZ1m)s0^OVe(G+t@Kq1To^KM8Ud-)0lY(if z(3S6!r!2w~2wbAvFfd$$=3+?u5VC|P)<8NQWp#PA^X*PbNB^p2sMMW5hoHWmxWOsp zj-N-)_xc7)}1I$)Z~(4y*rG4#-n zNIEzz`oSv7sb|D1!|v5+Qp#+1PrMnU7wOA~BPvKLLS1-PXw);PUrzF~M$XwRiHDPw ztCq3ok#LGWR%~Hfnd-Qy`))k(w?9FK6@^FU8&d^6q->$XS7bBd@i}x|ZJu60OWs?fJ@;oi#XdMcLuy`|_moLnTx+FM_h|Dj0m1}~4`rn- zzXyE*LGo!7N(4XhmUhwI6?09s_1UFK9u8YN)U&}}$7mCgE+rAY3m#j$X!ozk8Fo<$ z;h%g4s}4fAxn^{P!;br8DC@q0Q_s-$2c97ql9b7zCB;s3;?fGL&LB?=h8MG|7KS$y zE2b-~b325`NY0tzf+pP9~@-gOWhQX~jpaaYHI9^L}y`7sWhHgy` z9u}h1*J=dEvcF$md|F^$rO;3syQ$wVQvWsa$<%lr9UBI+IN05)%u4I83tV)fHX7FE zrHuk31f_HvrLpaU5|Sddx|!$}UwwPmTnzWVD#Z`gwdFO09+^GkmW zH&OzYvhqGN^BVJ_5D1tz+@PWmS%xGpBTuT;=DHxORBiS@vx8ARzW?B!#Ru_xK2z>9 zbxR4_B?kk#{P#U#44ak}hpPY=5~^rf^G#W^<$!y7duH187T+2vZKXm5Dcz7lH>`3L zdjX2|HP*5D@CR25Ry)fNvNTj5yoKsLx_ zHr-XVj$*)HADlo&D52H`g}05lMo~;TR^w0td?O^Hc~6F(ZshzKrF>9I>x(a-o1A(! zU1nb(fwde0imKHk?`)3)W&p~8Fg1bX=4!Nnjppm5s*HpjSu{tD!=-=S{{r;qy-zRO zG|AWZ%d9yHYA_$nAhdo!eBwkyf4ryMRU%k6WCk8>Z&&-KOAlP+$a%vTTIP-qy3Zj! zP4}L3PpUIMYD6wj#ZcOHZb5A~SGhL>qKT9j)TES^vjSZXFTT&|Sha+*3EsjMH-32M zcZ}U8^LOEvT`xioI-};DIHArnG%A8jdfyx#r#tEo#kh9EMJg(K3XE6~MHxC#=CcW> zm*QJC7e&`qauPnU<>TG*x9mlGe&PF%0!p;5d`PpeqSvypT^&wcHN|zct&VrFEn6G{ zj%sX+g-CGMy!3kSvRqifbEk{~Mu{9~NKT>A9r+P4oLn{1jNksOs#$3o0eVslQi)2Y zgLF%hXZv&ZY@qW3!Ama4u8v)OQP)oYyCE?K=BBwa9jB9wVu@Ke(8w z@+{Op>BrqV6U~TO{{G5~Lr~ZDwtpwIapObHeF-J>kMt2!aIv~evt?&YmYaG->1_f6 zo{bc5SzafO#xoGo4N!S--P~+p&3oFs`sjd`wI5@}!IrwX_M~@ac$4xl#^L8pI8^6WVJQ8S7Af@2Yn#u#DOhDurFr&J4s0D!RnCfvWTE#r4_! z6PeCe`1T!a*jU*)i6Zo=k3X3?;ii9}s{pDTp~F_!qv77H3aBfL)tb-EOpt}Vp1bPM z%K?xT2V`Vr>wX^emE|GR})zpMA3G00yv1BQhe1OWLcZ2hRU!d2Dl@ zD+q2|7A{FnGK$;N)BZ@g3#c?Q>0p^S)+_4dlKkRC>xtI1%c^zS9fvZSuVk)NmwO_u zFk-aUS5{0+0-@S=vvRI_d+#G3a|@)zuclPdsJ7+z5H4s@!4^xl@%*ZN>Cy}_(7M{o z(^RQ}279S>iIwE35rh_y0baV%ltVc=Z z-5V~JkW4pPbyjcj71R6Y-bg8%iN|B)w-We~?11*QNEs87=7tT}c>9}i;c0YaN22MZ#E$!YpleBlA{A8wi^|lV zv*Fz_kllw=*PUVr7myjJ1t~b5}pSOdrY5erTO1oQ^adq$yj(?3??{(~NfrAN;&ssrIv(LBx zL)v>rHI+tf!%b z!q9sa0))VK2b_6l=JEN~yViStxMpSal>6*^?`vQC+WRno@sj7uIUichscC37`lsip zwCHm%7TU~rVVuA%y8Zcfb0#qnOkL+!r~W`yIuXJwX(G;q zpnnXxkB?6Od#+JO?z|;c&!lr+BlX#&Esv?%0ILDlxa(Bkgouk>l5MxG_CSiX8x>kF zkT0*uC7_Y3!>|tsp5AuOmnw9^D}r4CDt4pg<+fGt9pnt?Nd^*ItJPd~mQI8{xR?V0 z39{D(d^Zq#fVQ`9z`QTQ>5yF^;tLhET_wpJhKTb(eDcr=N16v!G%|JW&nV#9vSW#> zx}83mSDv!`z)U*Sb>&Op`{i z`xa;=v%ExBNl7e!%79Y3kyYr;9EtIOYfK<_S&-)nrhnTe7ZRMHK1Q;TSOLeuT+Zt) zN>;d1&Ks|Xi1syC`1;g9#e)Omr5o&P;X2^`81x`t@?3oOY_`)2G-Jm}**x-IUnLp? zd6CuHozT6R;2(C(^orZt+;ebLcreUIVBQA`LJ z_mHQmTjMrbz6;v#^5x^sZcpE#7@bT+BD%1mn`?bviEF|J({7!bQq-V`RCYnH*Z0h} z0JMgMT@mlyJl@mT7WCOak0_$7>+Ui#wW~#NE4@{k2)YT*?$v%z#G_Ys`$jqXB!Eys z->bQKpQNap)b}9dkVnC%_ju=lzIo<>Zc@jkp`B^nl_|<$c`hP)ZH8i0fO$x0A8^r= z2g3R(JpNJWaYDSzRxW^1M9)+9ve$Ide#w~4I-&v~~_rJUf0Iiz> z!7v-zi+fv@k^FMW$KIbNmqehj_Sa-;${f^=hpz6A^T(OD>C-1}w(-Q>NXl_(fw=_% zQ5C;fDW5`Io+i+a#=vW6;WcyVT9uyq1HO;#w1;2Eq3LU@$`s<>wQ7L<+TB(yU~oxD zl1%u!?tCXG1xJJqR*khq#s-b%wl3mKm5mni34m^-CV7^~#pOBGpZ+qY(%->x0C3Tsv88C_nw9#!p9>VWM+sc7c+bq%1kqPri;SxYYJzJ>fXiQq~(^XN| zr@?H^y{?#Ti|I1&K2Kj%%H-wY2-<64L}Bp_E&O>hg&i`OZ!aq-jK|Doxm(Q>xy&>H z>pzM%^u8|3(7Z<08Tw^d6ESRm%TmEF(kvyG{Rl8r0CZzn9d3%hI6SZddJnU;N#FL)F&lrL^|<%`=J8((J? z+3(#ke6{6^P-eT9(=kZuMkX;%unQdZ7vRQ;|2J0tzc`%z@)Z~{3mi^s0LQ_Yyn?Yw z9vwQsFuhAjd3UkFE(pt``&F@4SpN_3k;fWw4z&A$K^ zz|^5aFr?^)RuO+jEv5qX&0*#(Ps{)|dW|$YI5yT}vhgr(&uLD^zCq4jA(X0{_G?dU zP)d>YT+l4oUG<7SVhwFR;`Pn2d3u?Rg}A5vHNc&#X>MrN2E-i3?pAp%_6Suua|T7v z!SgFmYJUCMA2e34ywn@T_q2^n!R|V*Y$WQEcD60X2D~0*lvtGpyeUnT;ROs+4mLMP zbPnIBFceA_D}hgk1TieZdF+JMbiFI_C`n_Cz9+f#fg%>$x5d$z*Ei!UU4jT^c>|%D z;G+jHFit?ZaF>)*3+1RSH%gs&SqevG%|RQ4(+jRZx7Tf%#q;-w%#l*ZLL_Y;pC6w} zFHfqh27@UJZJ_N}_cY1le}9Ddt2;IVUV#xq#BqZiwy?6hn24k%Pe<4n^3LKy;1^DU zjrG@&bWR(nZV~+CFS7t#)?l;rt@$BPMet}=OdutXxxS->@8MmJI_UD-cfNH81>K5W zwB}eJKme$UC+<6oSU5K752?L|5@4D0*g}^<(Vr#nfcCCxAxvZpXuQ6r&73UD`c{Ai z`R}dmg#Kp)8v8sr6t95e5#N5FU_4#fcz>9-YH2uD7`o`;D6i+!C$|C>34N{0QfCbnr5lIqS`^7mf$KIx>A6B4*#X>-{L0srFAHBpT0Bh>w)8pU>na(P18?&$oiJaPXMjkn~IU6k626g#Z zv;C=lbZIJ8fYD?SCBjs7@7TIkt$UGB>amUYF?*h2n_Jrt)!g5=A*KR@IGPqT6VkGr zg89FcGwsIyoTIa;u9b#){~S`J>xJH-$(7K6^;P+9a6Wp?zjV7HtUWpd*K&uPn1a+m z^50nX;AxoBD+Uqa=b?u7RA+vInqxwD$CVDdFyAh zjp^z~12LNrE)&nz8Vghu3@#$~S%$&|yA>~F_TGDCkk54fy=lVC?Xf9A-(ij=iOg=Z zKd3v^jzILq$_F^Y$eOs6>>`&N7Tgc`yhaJYQ1I zKdZms>9m?|uMBqXGh0b>7h=@sn)J>o>iHl2w0;Bc_}KGnpf$hJvsj^Yl)l;cC#JH` z)uG4=SzalhiX%sza~}#{mw4#wI{8q0d53TOyJ$@FvhSO1x~b@BY93}O->4dQ{84@s zMSWnQ^3_!wH+ySQ-_uAr^NFL|VU0&bt-O_ZN&`z}thy}U^%7%8rsv&P=!F%SD=TvD1cGnIc8?!$m zCu}O4|Mhsn^Q*iqRgIEW!~GG&*70*$h+HB2{-@16oCmX{AbzOv-j0Wj;Mq6d^w2pu z_Y{3Q>NeXX;8SE-J-E}+h(L&23>e|!1SR@i2pGPT(djnUi|ItZ_puSjEI~fwSIhw4 z5(rPwOv$Q@+9Q>+)(6-)^5uqJHu32Z!vc{xWU)S?55`zubpqno77K-=y>|*p___p- z$yi4q-~@?ilAW(B9##a+d>G-eoqn&`hJehWf{3ANiXLb@6=yw{42@2Yt>=VX9^`%y zF_#1Oo4PK)*;WHZkqsOwUY{1F+$p|D!L$lUQqF$vZbZouE&AXIY>smt ztg8dxdHR9I?bqwdHd^F7zT)DE)3{KV3lKy$;ict>M%v#qM(_W5jVF! z>=#0`UYC0F=6IJW>b*3S?nk!|z`vg^(AAgjZFxt?Uqa*x+&mwx){xHNgkgGx3>DH3xIF zI_md5S-6-<$d|MKyk+u#`>mJFi(iv8mJ!mPdiW$3+^hb=+Ju*>7XG%v=ACC&QD0wD zTKS8E4=qd6L0KO~xU^iiF&!=%`g<|{kC&wJu3pv!R_^->NhMH-K^-;u9j)w>}RPR*P_1)UiC!qtu(DVmXSHq9$X53`>>O@HvOj6{8_|4Fp} z`t@*X@F|Fx^-T1O@Jlq=%{oy+rDBI6&KJhCp7oZ=bg`7#Am{WIsB!fy@wWxF+u}cD zG>d7&WKHX_Hxv#|Q9%Fi>0AfDvM06uAq|U))O54rvbNK&CEw;maeB4cU=kBzS#=^x zC_MUdI@RK0xGLpblg^S)wLW=^gX4cWpQU9|*B{c2H*nsMKl_t}v_mtwA=5e!p4lyS z@~;rqI_Y-Q6nO4eBTbFkFIE05xrzYFUz_Oh3(+mm&*aPz(L(uKeV=n1AMG|BQ@_DWi$c#!Q#h7VfI<0LfC_|SM8<((}YF`#AulpS2ll4iB#i&D) zso+-Y&D5#s=kuwM<1tgg;o}uIseTfA>DB<^XdYnf|7BxF|K=DW9lUFV_0IjzCqhuo zjW{{jq_rg&s47hyACH;&IH#_mYJD7{L3}Eck(PeX>aN^jid^pE7fv~OIWgKa-KJg3 zrU``&nR0G(zosl|{IiSs*MmUZ&qJZijIlW=a%Z9)VQ8Cznwc>-Yc5J%4g5Q!qp7)e zt>`b*H0RO;EFa10RfLRK4R4uO2hS&7iGZce1`E;V;rTA8m;Ut-NB>pFI=G4-Y-O!* z()lf7K#cK_pGg2))ab%kdX`tDIu?K>qX4CtjMg_Y;X=u5V4=DMz-J_sN=)GBdx1v> z8h}IMPjkz)vkjOg1jC;X5aa=SCLw%;6RJZ3_`+Bh;a$uw^B}F> zO3Zvd=^oYDGaaVrB@uHK=>yMX1ccTH7dtrl{-5M!Dh10_<#~c1Qu4GF$s#suAYpOH zPpC`aB&)>NDq~?cWjzg^FWbUAr7tXgcw8|&OyMm=ntpjz(%BT94c4bn2z=CR|M>Rc zw_es4EhWaU>B2K%1i7qREub4d_C?Soe|!5Fc=m5Uzavh~^s?NgnO|97={hITj5D;4 zpn1h+V{JWnW$wi3(?Qq;u(bbw=ifzR;}w;GkQ_p3Z9T_|`FK~A0KV=8`9@gSrr@t| z%Vqzes@Zpiq?#gFrwV+4och?xd&w-SKf7?B`8(L+_+1V_Hl+AJux$YTD6!fr8Am8Xf8s8KF8=?@a)Mu_B79 ztqo`9lUdfHgcse!H>UpbKC!>^K1^&)cum;k_555Ae+1PZ>s@_LD@kxx(`O{V>#sI4#`){A_F>0GEwAub;O!B`qCTiOGd={q*(P|*v zA#^Gi-XGZ{S~{L_Szjl6ISpUs05vt`r$e-CX1)9=hBfT&Zzpt%SZ}ebMfjXcK1ALT z>}z?$f4yVB3%`Acdd}v8yFM~6BBM2J4*QvGFkO#)IsJ!1TPg~D2L_pAe5t($d^5IQ2+aQ~2RJ6kIPJe@IUoG!9=ZI74KNJAev5%C zxSEd7G*t=;KAxn2nE$BaQv$0aR2K%!>ycbY*AXS7NVJ9N#kYxuI3+7)t0&1%Toe*) z2NM7k+&|2J>!2c=I;0t6LxFpOmRjSkJ_`D$~n$@_kKl-S{snd><= z=|A4cDKgOS9fCNw_1W;7-qWdJFJTuOtTKLfJ280v+REB`XOGkuq7I>AplIs#K_Gw_ z(f)Qnu+WdNp9B27BCNnKDj9o5F43U7PDDrLE|?aa~+PJQ$2|FSwq zW}CdX?q2|_(~O<}Mhi9MfVu=dkbz7W4Epn1eeCno5E4XBrm^X&DpF3BJhce>$N9(Hm~4c6E3- zVUI=2SpMU^z+=|@ePzKCe{Jnk=jneTzk_SjiY-qhocZfww}jQe#oG9Q2T>{k!HBit zrKRK3L%UL7hnGYt>s6b3m3@7n($S}pKGDnXDecc*Q7v-OHjM0WXKU`%8atb!B((!n z4Dp+O6cMS3eRzNDRnGAZ0(j7*Jlfm=?o>*4 z>%+^cx*JSkO$E{llb3#UgMR}8vZ#C7y^~pJ*}vw)s@wauJIkmlP#<_SfyzoNkWuoV_t(O!(MXV$LB>Fn0@SDjRT%6x0h9Pc~gw$ZYqz)yN9h4^OC`waVczrQ>=%lq%Ke4DB>87z67sn;1MU|epR zhWIO9#d`UtGV4;Npb!U`jjOp_{=Jq{IBub<@-PRBevfn&ef`X4`Zt|dLG;IlQU9{w zq~hNiR3iYJo?l-AV_&=hJepFWw_G&qS1r{d6SnPBhm!1qM+X#UUa?8AN?UZ$2C%7j z@v-U94EBqkEN`Wf@w6;@;D0|LFsipyMN8*kdMC(N|MRh({fAn9=o5a;#S}GKbX`&TV84 z`U8vEKUI>zX6r9A{>OSPKeTFA7URb+zJR$L`K0fInMr#2>WHNy&!Js3Fs&b|Dh519 z>!T1I8UT~>rzz#KR}?P^Uw)5n#zubK14F0_+-H8+RvtA2f0=wpTm064g+~PhdKH1C z9MpC-$ohK!n3bdC)jPiAD+s{1p3)79KcE@7E;i_5$lU3=bYqa0CXm&t$iUXLAmm$A z1dvVapWKh`w=W|rF(4ptCiW=sy&>4eZ_&pXt5cTWL%?(E6fHeYK0>LoJ791>U7a69 zZ1#$rmRTK~39CfOTnLBpwOp>2Z#{ue$$(uU7cz zXTi#hajiZy31U=QKX>+FQ4qAx?Nz}QIAdKx?P~u6Q6Fz+1$`E=LEuAnMrHqg2Q~Ec zGnc?=pb!F^WIT@ zr!I&BqsUrAj2UkD3qmIb&}l&iXagFZBFlAy%2}kFVCi=g3{;L6c}tH5;?7iT80zlx zLV*5nUP`p@bo9r95W_GpY_7JLqtpRARfW=Fb`dhjm%!DqiH|o>N_F)Jx8uE#WLlCP zf^3=XJ8O{GaY4ev2gIkU#+|LTiLuayy)%p71ll9l+QdPd6J)_{og%Sm@x^4!Sx+yI zW`7P}_PXbch8z?QQl&2ItLw8qAYn=oKxO8pJje)^?>z#!J-o`JZ5;2(aA_n*z%ppG z$Xe9HSxLb`6THPD_b-R&1a2x@R5eVs5}Invs)b@LK6kKs?1*IkLZs3#k2%c$NDd$p ziaL&w0Q=%QuEcGWkVa`BdS8mZYxC-xTYf}k0e3dy4)AXq#a1MptF#{`G-RYrYUim% zObi|UwJ(RkE(6Zy?-%u3OKZ)(EAu5|2srk|Gyp_uY6L3^0t3mJK?tG#ZS6h|Em7CL z|1OxWW1Y=yTE{SNn1ezkRmdf;sRIIX$P#}5()N$v$9avt^K&Oeg%{h%UaP=%?G6>y zYWH{*NMZo$-^?OMu#efDFE?(UfK%*v1GX&hM>v}#4U3>l-fJ?<3~K#ra_LQqeW2nO zB|< z{sF0|;?rD=Dv9J&u*`XztwT55S7l;-`<3RDU3f&}&#s>J&$-tHZ{z{*zkmGNbf4;n zwu|4awz0&tHn_pL=Z34)hvS`McXkn6+uF`w{R|3MxADATz4pU5bfFar!|?eNTev&{ zQ$Rs)Ux4_H>BBqSJ@Qs6ohHDvXPi`xzLfipY$ah^b-j4OVuL^dxWF0%571OZGl79) z)UarmAY0!(VGlxLOe=**BCpJL!<;5Wx;59AG_rmGx06VB50hAV`VpfDkXrX6!!oJ- zxN(3OsgRSjGIl0|TIj>}8}C0ZODkB025ujFbKDG9SzMEHqM4gF=KU3D!i*;f(WB`m z0=*)F56xWiex>Hl=MP>E!<(QpVdR>?ghfafowJ6!Wl}J6^mWZdfd}lTlzO!xek=_a z9xGi!T$@T1Q?n3joL>U^iVN6FNL@nsSe*6^i?qLwXo7e^L zZ72s9kAMj=M;{RAfT!OvYHpCH!}eAA+qls(&2ylo;tSArUmej#Qh;gm#|fIvVlrGc!C2BKMP zIpj-zvhi)ecLQ8~v!@69=z(IGyVu&z4+C->GdDU5oJ}Inkll=DmZU$K5Xt_pidajhfQ{uica`yw16ymk z=_4b*e0IWn#2?83euIpcyx;D6osZFcgo(6NaDc6!K3(Li8N%B5YDS)LvS_*@_pi@= z`6-e)h5sJzHRr5WK(x=c1J_5H+iN6$g}nmzPuG8+n)yO56=b=0)~8DVM38}OPu&m_`xITnI;x$Id`9ZZYNDda8vj5y^S1GWJF2kl$2xE-FgK zBOTGfM7CWr&L8acSNAfrG@QDzlMATSu*w~8(Z4VD{{%56#Z(@%oA7$cs;XLXbrwxe z%n2n+GPyrVu2~+wuAm^fK`b60rTZcz6cuN99k;<0{Vo137gtVnU<3TK%wblcTPlGW z^>W_MAAQXTA9L(2YkVrh(NM$HkmyJE)!!Z2Cdz7!*~y25zCToJk`BvtGI-K?s-Zm* z7zqCv#;EujYA%3p2dX@&PW&t$QsSaI*To?!8$Mb!^)9|4+s9tx`TX~9F}YvrRWy`Y z*4G=K8tSP%9J33GzT-3c72giqJ2~~NB1ug+bE>6o@ER9yj`bj@s9%@R0xXzWPZH~! zQzv`!OR%K`G&eqXFf}VHbkC(Um@Ymo%Z9OuH*#J4O#eppKviIa9Svt~c#7%gWwmb9 zYX1;1v_Bs&)wm* z@m#JKf|XKORqPCEJ+c^;7-CVsl2@IV7}DsOy`TjxRj{#nSy}$BL%H$x+BWc$&Y@dt zQ>~56xIM+Mo1f?}F<@M%p{qS(-{KvGSg~5S2L)&OT)sn09bW^JveK^~R zZga1n*lyF&g7d!$3Dd{-cg}oL!IxVn#C4`x0s=#JiDj2MxHZroD=`S)pA$v;tF1(6 z$M}a8^G}j%yGdDgI$ncJ_V}s2K2*eeoT{Z|P2pBvyGV=pN#WLw+E*@RW-{H>DaGFzW}QQuw;v*ik?nZF^@nCM@HfgC0?r?IvC(Ai%~h*RT^lmDmf{g z3Iz>YF{5gXj!9&c{N>K#l`XsX@!oe00d>51I;TOFL|ms^9oCF9TS52$_5zh?r40)8 z!3^Oyik0ZDO~p%8d?9vH#XwEOwJ~|Z7`SdR^*a#$J%~XHtJoL@vu@Po1iLm|Yirq3 zJ3{O+DnSw(>9f~TjW4s~D;{(kvs!IEso3HC?Q0IQ_`=(gUc}zeHL6<*a&qtb0yB5Z z<%Q?JVPlzvp3?SjH7~JpCXEGH4wdeee4YOsym)yWYJLzp{x<=u>KRBCMaE%S7#uF`Tw0hoGtfg-~x^1~+lvb|qMXP*&og z(|1z^Nc{JyRyPqMDY^P4Z;JEkv;hM0NnnDBCn8Gs>?7G4qQU&obuuO6q6R=atfBC; ziG5zAQ>K;^GKg+h0A8Fs>rM|bIxp4sJ)d3zIP98P+6@o!Eh|~!|0a)-HD5YT6^vi&&j+C zD%gg-GRf%N*7w>X7-L*p1F2gl*1wMPymr+S%np7mu{A9R88L;|=PE5--`1YH49B7M zYx~NU@T8uYGp!=08hi>p+(LH7ChE&@JBdoz8H+(V?4QPrZ|n@K|9pPdE2sr&l}1VSg?p+hOTAA*xjc^v5M#4`sehET^xU-`cTnu5x4H~W?yHgUUt7YcL3n%ux0Io4 z@9r^3TT6c^;akHT#v^!4+l1lLeGNuYq!1Qf-d5J806dSs(HkT`gp4jU4L=_;7 zNiP>WoF*^hU~=={_m{P*{p*uvF@8f2vv;|J(dkrv0{x(X1Y5MgC*LJA)JGslt2N}8 zaKs-d5c4mOaNIeBMvR1%Es9?|psCh7-K2Ntx!%Z`U$OsJA{nu>vchM} zVe5uvSQBotI}5kwekd5UlDFt#{XB0xspVx3H9Z^EgRuJ4d>-I#%Y2reh)!Ymnr8DT zT^cTndayZ;Q84$vl>;>+=Q7d>x$6^M&>F721k4=^G5a~Bo+v>izxk~KrE>$Ip&L)! zUbNlWO7yS^up6YahgUw@UEcIoSp2i&&udwr_&K-e1tuf5b!rp0S<5k3>eLC$783`d z?T}xwYZTq7c-u_wktTXD~;1sHf| z4gQAUe>|F+=h2PtoeB=?d=Wn2?e+a9*;VB630u$Bgwj5ZXf)h2P@SSXO4VQ|h@-K; z5k^6goJ)iEgJ;d{dpicN6tN=1YR}dsmzwBLqG}BFbh!FL#rJ!rsOPez#(Xh5`jaApIFE1W8L_C3UmzioNF`Mh$C@%t1BrB z2tDRGF088g?BbX%RtY=T_V+Ry1*kqCbcJov=HvO)h1#5Mv3=?W8(LO7KxpE2o3WNo zO$cz+KGnQ3fj{5$zAVeOk}zLr#kUL&lgX4%2DcFLy4vYNjkZ7_^f!w45EAUV1y=1&O@Z7R)4b@1j1`(_oV4$+9AX@ zm$W4L2EC2QjEpXo6tm9OJ{xQOhU8So4W7L)uxk^nt^?k9a%bZdo#e+?Y3vVXZRhx% zPMED@Z;-cldPdn+oD+%UZQ5P~wX{yG+CJ9rb45uweX6Ne3C?DAp?5nrW5Z_`K04RE zfh15GXmRq@l*_8lZ3{o0E6z9*-bvy0LslyI+L^HvQQ`t2P5u)zt3v}mWjQ_rV-swv zD;QK+l)H071bA661CpYu6B-R{XXeYqU<74rlGF+{<2ly)boFqbG%cW5dcr;a1Gp$m zRb|HrWNSNMj#X4j&m#Vn^6O`9_689PUT5dzos#eD@|&o@MXOiPvvKq+pa4&nT)~34 zSw%2kU5$z5IfRx`Auq;Z!$2tBA$w=`^9o{MGJ_Ht-j2p4XNfY~^Tmplh3eh*`EW`> z?)}$_n=6F%!lANY01)@Ez}M5v-;xzVyDv`JNfknuEMsl)ZePptQ8*-9BJb0!4TZ#x z{AalNLdi*Aqxq>!fP>iI&GJxq)<1NAn6z*jbM*d1k(FkMcdcW&?O<%4;Shi7Wta81 z@{;NrcJchQ`bOfAk}p@Q2vbK-c^in}y!Dn}U z+h%|)il&UvJy`5qu!+->BwpiGk49U?-cDp}KI~XA2EP)&zSX6@A@VvHvqOh-dMD|G zVz{CF#1}DO|4*h-EC&l~bFZ;jpNkSe?^cg)w-rnoJ(tJqrfV3AzZ>19qali*cN-r8 z$);Lg&!eYzvKA^_4aUj_6JqlX`>UpwB$e6_{0}3XOe9@`t5KO%jwI)rMKSbx2|zd! zW|H;WS#u?24?cL|jx)Lh3*?82z1^3A3BY%~w>C|Pm>1$}-vlPW6fPk8^AisT1VIjTRSM(z`+a{1oFe%AJ*CgTs5^T5j8$%&hg1Re|7;KFE-7KW{lx7G!eX zwWN*l#OZf5xOUQa8?tb(P0%cUnlymtElijnQl@D4QESnykTtM4!RKoYh86U;9MLgW zPky53{Ca01W2UU}ISV=G5@(9#&?WqUYJ1JUH{F_klOtG)4|kz+tk<{i=Lxy__BgU? z?K1As;KrrB1usLpXmQXOnOBj@rrPi`T4YKuquFC;ean8l{;YVSo>pNu^h#kCh-y-H#CS+UXxaAC&S`S+wgi8*M#_g^ONZsVW1(YyK4cd}G}B>f zV*M$g(dAl_aI9Q7eR1JQWO2OXP!M8X0KEkKaiQG{Y+0uAqz8^Au^*W;zcsaF-kdHV z?lww1i>f8)Z-D_Pgg9k-F>{A0S($gEeE=5rj{hk158vf~;-1aQ@lx)gQFo39J)u|UHf(eO*jQhLf6mDrDC;8r5qc^B)JXq<4NoID6CsxBA$rM zyVAxq=CW6aPh?{`#yTtC8th-}h1^y-@%FlNgOuiVK~u?f79|}e?OI{G7l$^O9dt}fk08gUm}dq6m~`&1})g|n~;7p)WEw_oTokyK!lZ%&8>^?WtrxZ9!r#1vo9U(Gjn?Ij`zY|8PV=fA_n1P;gXC9| zsg!KZI}JWrrTj-_?pY?~U78SyQR<4F1nJh5r5iuen)QHVB$KpJl=iWm84FetU>wM} z5cP$pd)brr-em@`#j*LU7p7Y_BK;@wP@->>00tuyXZ1PneQCS#d#N!MTZ`jDE z5W_UAYHv@^BRs1CbTFZi>DF$>;&rpY$}_yXKj@y+?MRaAHGud0Rm-;Qq_OwrGrTdB zo>iICM#t0F#*{-9DAlaIIvL-}Dg|g-or~v3IQWL$o&#PEM2iNW&T~$9T{i7kK|(@i zk*qa4F(>UfM$4m=Yut%Z99GtgcxDtf%*lPTcL^|<6U8&{4!^GU^(e|H6Hr89X2PjP z?M~@DR#s0<#Y&PeX5<7oE9>Ql$GV~qz3|fOM4OBjZPjDoJYfxXfJ@74z6^?Y;63m~ zS&a=4j`^A-VwM`Z1%)impTCrTd~r19V*Hi%VJGC*2LaRaQx&bdV>bpDwz}p?ry=oC z#mq~w@A}|Qk}C}=j6xSLGImu+@|9fpUaD?woaX&=Gpef?mey7wj8*+!h@6#5kR;=2 z9TXaDn1eJ=M}YKlSd2gMS=ei!qPIER!RX4=6!Y~GVV7j|NE`5n5Q%}V@3Fk9*h%?d z!l|E&=aQ)wXD8Z)n{wX(j?oY(O+&t2U>x4S987P9eEL=F6cyzQehCU-aD=oYRU z?9}D+iFUdc!R4g%Yh+|way=rXy%yTO#pG+2>;&46p*^Ruv95B0Iy6l5oH9f6sOVk8D-9$3kdAL_WI)$^dee~2ftESkfnB8e-qOaR*@V%+Rf&g*+ zYMJAU=pGTlAF{Ux>#S(HY|U602PY8EGD(ee6}YwZej)?pHn#dH`-p51mwJtBI7<3Ct+f zYw4gB;5hw$x7Julh|u}jPRu%vfF8J(exVnEpdaQ_CP!*j;^wwz>xJS6R@T`WWr|ok zXj+z6EtoYlY>`bsuG?V$prfR!2_qmViO zu8(0uHsq|@dU3T_%;3_>i$^S8vmd#<*r*zvoZ<9@&_bwlL+Mn=IXILVpt*EfVo`|o zYpe^USJm^-w$BMjzPulQXC{EE=;H`tv~6E& zaIN|Ty$wn;s5kp|_@v<=^PBiPCFx+Y025-vgrv5lfDXD!7NpMrz*#vOHhA6jB8<2t zLnOLCyU_6$Xa=*FsO$Ssv$WIl zst=OCtPzkLKB_4$$IRnyWntWLq7hOY`S;E+a$(1{08`Olu=YM9BRFE-LUWFu z^UHN{o!vdxbc+6fqP@q-85yG~GN#`~SV0Bd*WEgZje}gnD9Zm>q9XjGU(tLJ8VJz7 z=)@7CeTHF)XMRYPVfKqvKOnkb{F8DXI=T9DN)FLPga9zl7ej8NEOv?}Ww~5^Ln4!EJ zWd5O~)W7zj4FDP{x|;b}S%+$k+3N4y(Q`AFbU79J3dC;FhFxPGtm^*Ked_)u)x5j( z{M+*4=LNCDMy2yLDxj3tHI5F(%$}O1bGiZXd!=3Bib-RCX>(V%XFqKBaaYI?B}v0N zu|kE3?0saweE49kAdrj$O{Sms#?ToLKmsBV)vg;_m9z1k2&42unQ)h$!7|B8F-Kb` z&yWxV!vNnMSOSf0reIwKf2Je|@@!|(n|7H}3`4H^BSzgF8#RjvJ=-ir_+g$dP4P=`0 zFSqabvpARmk-{?d#dG!&(^-W=q+{?u%qSCxNDQe?EccqC3Fx7#QN23`XQxlhxlO!H zm@BP_0_NG`0dY?YjtA_N(A20o@@s{b-V#%r$GL|eEHurZtMy?)HkH&?5nXc)Xal^& zW{y5SsM6{Ib{VX<->ZJ70%;YCZ&s_%x?eEQSj5GFw3OVkrcj`RQ6p;J8!lXW9dcRx zz3Ru*$=$W)DsuuHCIyN)Gj6uo1z!;&R3$KT#W1jNKX5gNLqb|^JFCIIpMDh7r#!Vj zN5``3D}_MtZ-gDY=&t$n1+2yeOnwFiGSeOd8Oi?JHY@^3F6x*bOGXb~tZHKc((&v( zAJ$m%=)Ofryi+#6P3|$AI<4p0B5yO^-lkD4@+oaE9{V*KLSB3XdZ3R*wEe-F#|rWEOt zSZr!Y>#kXDecYxH#iacP8Cn}h`-XP0l6<26sWT9rVo$HKQ}gxsU0iBLhT=9mklcwA z%@qQF%HCYEpU~$i|AfHQ5@ybUGV%W5OnYGe^HnS1RMfPeFI=xyaZV%ozYbr$&M2y( zp`4ex*xB*jK35o}Wv^uUn6T8&X11{eD`vJQOA4(~Kk63z){OUV#biPa5Buf(%?PSc z&Sif%PT>A(%ZF8k8cR-W|1iw0_dKzGRri!+ALI1QfTLFc-Zov?ra(YG*v(A72>*jI zrMVVVmfnMB939*38f~nY|?H+10|~^Hm-%$^8u#b&`UW$jd>%QaOtD_8D2o zhk%1(ysPBq=ewex7{sg8EZ>u8Mi>)b@2RTyx&WH0R|vcsptS(6CVN%~K-SqLNHWXi z3xaBD{e0J-|L!Tm9f?QvuAae~ApO^SLba4Cr8X|w6e17O2ITB#)nhYF^m`=7pb*H1 z=1qn$4t;hrhkPy2nK89VUUj)QT`$WxZ)8P2`l2cb^j;G7sq%EO+08-|<1v6*ul2n5 zUo~fSun5=ADj%~$itoh}&m8XhSb5-1oMxbpU(1U*JIpV`e{rxsD-^bPTNQYj5MST? z26$E6Gd5MP9dB=E(=&$5#MWI;%5sXfAX1}V+qQTAP}S@fJw)s;&b#t*UXFi4#UByt zJ+~y7I+*^sfqG*(GTtQSS7Hpev+U?Rif&12(m;xD;JqK;9aG?So8|6bh4ULk3k~wicaS@m z{M>P9YYgEX%xu1A?S&&SMMEVvD%rKZx7SfEg8`dfsqa!n6cXXHk1N+#A4U7Rd%4*+ z2c%Lzp9M`XF3fOBf|5siGgW#oC&;;c8+WRo<^Ec zVkRF#atp6YYGUV`ut$=Lg@vUu=$+>mvu$Qs-`wScFqtc1mEUd+G`rVc>T2Arq;Oyc z!Q&y&SOAIVbg<1pjQ&R!r*-+)@2^lUMIA&2Y2raKNE);TOn`21Aew(J);%c0=gUpz z3r(5$6s4YiR=#uZ-UkwKDl_Ht3+JA}&Xg03mHACKiBR~P7yi#tpbU_bI{8+X+r>2G zE+w8%xMlZ$x|7PTIShC1(r3n8FFEciOhJBiA#(fN99LiCKj1(FUHV0uKz6I5hBanX z_c_0|o3h^f;!Dg&VRYjkkiq8Jg?{SumV2Xtmf0UmWIj_Tak0!|MtPJceAi&X5JbdIbOIn>OZ_o}6 zENCHdc?iqRLYByVtR(ACD*0gc(nIj+k0Dh`jx{7AhYuVXB9;$O90-k8)-9ZTrzgMb z^1cCk6}jt81wrj^(@ELUxr2(0U~BpG^PspH;0&%o!{;wyjMOW^re& z4|kkv@M3aW*xAK0f(X<42^qNxSq5?!(`G+pC!z!KIsAI8Sav2*#gluhuGS8Y{V*cb z9cGNRc^_x{OW193AS?FUvmdCCT5U9x@9xp_Rj%BbnV-IFLU{(_qj)?}=IrTv7OLHxR|*1}&9V zow^@*6x?$cPw0!@km7N#-Dx~6MYHr@X{9WPU`$RI* z^{@8YCJFJIcpEC9>`baiL8n{;%VT0r&6@3fK1f?3me2#k7F?TNYIoFHU2cns8(&xY zUU}I4uKdRk1TN9!d(_YP{?F=O;IW#XOFEDL`1t%0_2ucztSrD=Y8TGJ#-z)}NUjfcYVHM4T3K7S*B$N$=rE&g%X!6>QAotY z*`Bek7tph<-HCjMKB@0lxb$Y$@fWaesh4we(7M%1vywH>gMPCt^3dc^APTo3Z*$NY z>bIeV7LxNnth*ccN_=%?@?HS zXb_~ppaPO=D%+=a*e{{`w}Uwpe&+s%cgV9Xu7KJh@MejLL|LqDYgf-R(2x#RWB6Me zX{E9ZWdOdcW*PNO3Zh42ZBKNe9+hf z-g!m=GH{Kh`Z4I|6ZG&q7WSvr2A|Ps$f9L)hWwk-3atTsazA@ySQcW03T!jQw)h`P z5p%`a9S)%P@|WiM(~V#3k1}BTB)r-^T=NHXb#?hfcGhJ?^&V#nFbY(Jl0>==$+F&o zK=yt0l5O_cPD-DLd_LnI z6eg@p!=tA^R)T6@CZ|^a+=DqaCLrE!@~xy_$ex|q~z`^&|q-{_Es*(bO(?M%V5rgxvcHIf|p0OW`b?R zBQ>wX#J1dgy#7DB-ZQGHZTtU@$D>>oCy$M z(nNaipweq-(gFktp@o2e5JE`utPP&~oO|!@zh7h|ItJNUYwfjW`OeSWuckcMkp6AR zsxl54tk$lYs`fIP1uEpGYuJxzVBTbbpZ7X%`@WlMyYe4&^XEI!)Q0=fTia$Vc6(I5 zkzs#kck^xwwB6|NB#;UZYoLYf-^hCAvsJq}D2^}phF7EZGXRMuwVoBX7P;IN#2Fj6k_v_hQ z7!lsg5WeMLjC;O0*h7bkgllu_S<`LqZM18hxk20>v8G6*BGpOL%h|U&I~yc^=AeN4 zusaYZJNKqe$IgNz^%9dnW0UfJ7QRv%NFc>!cOpf`YIt4mziVnHrE#<|yV*B6muAn0 zMz6AY=eoSU)D|?SJH1soxl2%YZSw+~W>*+P7?>X;>hA4rw(G;g?jXqIj7w6-uNp9< zh&@mYXLNW`O}cQQ(06N z6&01TPKW@V8DX$R?|4-gayt^q%+(NeMO0M#5m0SRlL}Yl-W3TKba(PZ@~nCrfK*kQuqsDeU}u&^ zX#a3+SvGA{XT}Qr&?c3YY6xiuwQ$?4yzlZ>{S~1w#{(@8!f-~14T*Zi$#rg{>$g{5 zsA_5%gu&G>c+LyKZ4wUnm5&@KE4Dmn&g9` zq(kl?!NuO#$S0r@C!%IQ7MjL4~RrVVzWuAiajMl*H3(v4b$k%sqp+u zb5*Jp>J*<~*Hz@s7Eh&}WAzsb{fbK0=Q*N>ZkJUUVQHC<#;vmEjeYXvug~$)8eP?X zPcI*W!csVc1>Y->!ll_S6WH#?zKGbQ@trb>>xMO(wb3l+wJst(We5On#+ZWf8TQ3}j~A`PAxnsi=5z z)nx36%yihohu9BzDs5Y(AjZNnNO(GcP?d{16B=DklpnD)Mz3I_8ASoItgf zfSR|eU0DSaw$ENS2}yRqxkAvY#p2(TR?^8ZgyM8Pyb`i zyDb#w?crOyjO~=|*{aH@mm?RrUU9X)RJ+=l^K>yi9Wl7{K}H=jHaQPKSMg{jgyug=#cvV%-jiV={E zXES#1n^32m=9O_Tj$Qij2FV4X1flGz>~NyBS8V}p%e6<2SH-SpIp4U*ZEKTVu7^b8Hz?4<&!Oc0VZMRAkys1S$xR zVnVEnqDmjj>Qg`#K1$wDT3d@$zC{rPr}r+`#P&eiO?lKYGN~-0tMnv|E%wjw3lYr_ zK#h}ROma=mM?2kjU+s?m)gyy)xoOZUYF~9LtZJY-c_Brny7de#hS=hnw9?a2MxR!m zGu*pV6SijOYv{UrgK;*^civOsY0oR3R5!iySsaG%skNBPl?$?EO>hGVkSs03JN(563K>tqn->hl^*(-+@*iCJ55>JsVMOhw zCo%zER6DzcW(8g+W2gyw)1Ty>hZ=lRU&$$2h?`}KIBd=2kXj-;L^oHVr)Ifl2&KlX z`y{qkhN=Zl+167LdeO)vnJ<<8u44H)G7hq4^Wb5b^7F;@;c_ruv);j5TBA00VK)es zr=^xJSQxX7M<*n3gKT_aqKVNF*v$o*tzoTFv+nb%y+%&0^g?dd?IZCp*n2FXtzlc$ z#X#Y2Dr@A%L@Ls)3(b9aYAJ-?#}<+E^Blm#2zg1|lL5}I{jCHj0PwayPT*OfNwD(g zIiN~Cb8beTqbbF{dzyV?TO2jFXLZ=EO}2;Zm~2~_)-MZ6r_RebNw)SMoW}pa3&RQY&kjJ3*0Qs3WW z>zr!x=CrQCoCh^&H2Y(CxR5eKN)1YqjnIT}Z7kRuIxcP~bBppTPfNtDhbo7@hVY$r zDVbdr45kTfPj5<%=o|C+hDF|2W9}AX5ez;O`rU6<17JA`UVV#MKqk z)BW-z^w=uembWxKSk~M|aj|9f6cpw-u8yt8&m&7_XSOO)st9f!TK{ul6FUrV$P~6K z+j@z*DkJhR+U2P%)(gj7HUebyffxf1BY76&Stx5<%lbMH-@XraBeu&^F8dHxfzwzq zYRq$%OAP=KZxU`CZ!<>|3qjxy7b;qqEPA^zRrc}OfGL^?Whbv#PJ)H&8X%*93d)}) zpaKiV<`0xZ96&jwqTKb_%o8mU6#lP4M$ceW%8oLBvfSN2_M|DsY!+IeroG9__c^Ca zZ&JVRD(SW4g5|;Vr*S)w#i6&Zd0${~FHE|M>BCfsZ;vfKj-dGrK_$k-lF^zN=Fs_T48EzU66NiJei zu)9*V_uR!rE;_Woc@EIU%S*dt$^aFHZNy>WWW;j6TKqtD2;4}-c=xKJm33Y3lBATg z@qd}J76`IO)>d)}`oa-s^BY~XXzv}1!6J)%{C4e$5v`Oe$Vl?fZ;E)jp9bOqEv=S5 znSK2lQv<4y;lPR5v)%nmb;Qe!!l?vooj;!}Jojbs3LFe(>Y_d58DmG^JI(ex^_2R@K$B2{4Zoqx!dlauI2f~ZcDGa41#ua) zN*ze(`vCU*9-sNg28Z5O#XI3G7EC8aOg=E(yLL=4T?*v{DXAEcI*0s?!)KZ3%J4JJ(LBP zaD6V)+F#tjX;-3qrRa(h=^m_ik~gtT7aRYeyNh(LMmHd9^5g-O+*s zVi}f70A~S+9ruHo8`KZk5h$}P`}H8JCe4M0EC~*?#eGe`qj504gJ@iUmY~|72vTHf zCphrqhFk6@+Zh3MNdf?oZuCr*aa`?yTikngr9ePrCH5BvzY@=6BF#;SXnH?VSb7qZ zNdTD0cMeoCPt6J~PFYLy%$2#YH~bZ`FZQc@*6pcEGe8d_M2fi#seU1)BPUeUYmtOr z;@XbpD4M>6X#6qENiZ-714Xt)a*ibhpEA`qO0K8~XNj)1|C3I6Tw%P$q3Attw{hJ- zrF?oWC@(Xe9vU4B{%fM^nl1PB+~K*&{|eamQFhmqadn$&ELTF{lvqQrk!#0(626a* zFcO}xZ#DqY7YFZL`|XzDSKDidzVNLWi>Ktd3#1T}ebvB|*MozaU^avX$s@Bc*yy=) zGd$wS@(R&zfNV9lB_L+=hm01m`hnYQwL#lBZG7g;V$LzxB$~iXcR%&ip5KIt$lF&( zNh+W)G&z7Pfwb*oPg9M-|Gq*61SQtAl zsBmiWvc&^dfIlOgaVXkOy=a#OQgcN2Eo1%Rof11x+3?QDl61JPg!aU#jrh48M-Yq9 z0pT<=5+g_`{AyZ}Y7-;7Z?U4bRpsA7dwW*qx)@W{6cX9K&57Gt>~FJUx%`sU(*6E& zC!~Hn<{m9S=P;JQr!u-052A2NKz<(e0e;1dUbGSk!q1}qf2yG8EKw9UAeJyPwljmZbB6Jb*T{5Frlw0+EW#+03U5tF29e%1h z^};?eGs&56LR(MW>(q$)ia>HJ$Rk%kVrPSeF1chczhOo`J8^Y5@F@Gw6NyA;!juP) z_U1X+Q6^oGb{ngtJsT0aH1*Uu9%N6peJbvB}Hx45qrdiN&y5Tv>^*n2{ z!JnYCZ-&yvV`I7=co<6E3QMG{e|R@=_)NqR&lpgLxp~(~bA?wiz&pi~?@5a! z;39O@V#c*3-W(*?zg*vsC63*C`UX-xhwpE&gxh}~!GT+#_CLU9A7F6~VsR)3dGZ!m?bqeoI$mx`N>D}7V?U7n=?B~TdC%R1GY5?u)4ZK`o{^IY# zmkmGG{rK1k>o=MgK=B2Yq$fJoCr)@L+_FQ{F#^27{$;)y+BA8PlQ{SX@cIS2GF7Lm$QKe40`L*AJ`>ASy#&eh zB2L`OSgHUNCOkVM32;yA?*ZV`&+o7q5H~81L}~(^&+sdZ_M;I^^Tn?^w!LS77ORR^ zSY$+8Cx(%!jZW=j&w<+a%d>-+>%YGdd?$B>j^+EPD9D3K>gHnzkG_e3gQE_V=9jvy zomLGX2?yJsnJWI$o&tU+qv$0N{_+eI1*`sH+E%+p;ivNY$D9!}9+y*AfYoU>(jua| zYBoOq5>#aWI=c(2q;bx|TM*9^L;B<%-x-x>PNJF1T4I#|AwZz$FS zrSEP>9pPbhbt|1xpF7E3K3+&faSZ^S($-4fV(Mf zTnCj={yBkcl8+$)uBA|XQAAaeOk(>%fmFcv{~>Jz41s1jsRhIRk#lpVAUHka3mHvN zXj`9)V41MD*-M`YBUC)Y-C8=$3~qz*NI1yLf)YhCM5x@oh2$=@ivYPXNv{V2sz2`n z`oKmfVM)mAm5=eH31AR_!>Oy|(E+x3e=rWfvj3O^7%ZpE0?EoU9-o*9SqVu)eogN` zvfKDIK8xTr{E&XkQ65l0HT3~8h^#G2$%jh(K^g6nbBS3kZ>+x2LFHM)B{7WNwHDKG zo-)pCP&G~;Td^?}csQ{~+-DhL(?Hi3<^P@jrGq7>qNH>hfk1#VTM4d=cPlHMfE$Wi zE8>d=I5E`#ABgjK_tjBLXNPHH<3RyQWhUwo7;6TI0)4iT&8e;|2(~o~YyfOOd>8M# zp5|6aeb-kVe-B4cffD>K9CzPz9D50n>i^IC$OVC^?l?XJkqXU}&u% zazDQw4`Nx634*)_rr`{9hhJTpY~rRVnP35B~{h1?6{N6Abbi2q6$)` z;XW%R=2rk}RF9WQ4d)lxd{it(@SX^kUR22Z=0_mCrzN?BT;-3tGMajwH#bU)Tlj8< z!-(lvaJb3TFTqkryTF3?Q^x@;)p<4M(BDi>(Z5BA|Gt445o;S8Y+h00;II&who#Y? zR8FuE&~vA`0rGq_X3)3PG@e(lLig;<1O(0v5=>8=`~Ws>6PhikQqW{7{Nnl+_R%QY zxmYGJ6(V1U8n#=_6GR7O5i}sG?Z9JO-qmU1t#tQ(0Qkeur5A?YIMARRd8lMbDLZfZV@c%L0#iIrFvdKAlXqE0@Q%XOziP!1qqsi zZ@;NKlWh3!TR3>*2oQ!ROP_rGLv>p{{eQrARz>`BF$H9wWG4Xy zuLVFf5KV9}ZSrIs=27?^(Xaitj_=>M<9OU=BtLR*&sUW%Bq%8I&|wI`{iUJ@_&^X_ z$g}`FA2k-MS5yORK>2?Z2*0YX7Jw3-eP|$`rgX|;1!8Qh3+D2Re&}#X|-4x=J zf}X@-^=J~&8Ov&ro2y;;UJ_by(6xAQlpTCHcuhkAf27lAts$qgFGms=~R8e`q|5+VQZ%}rXcMKj)`dm;D?*yQ{KtcqBL+3z$SJjk)+HAFb!NOax zhS^)qzC&qni^=Y<%^ancqu+R_2FV=W)|{< zVKb6(cAZgxn5CMM2ZY*c7nKt(CwgzctPrx%Oynd$fG!q&%xB@i6Mne|H(~^_Cjawt z&7+gwdpI~WBs%V~oSUP3|NdLBtPMwBr7H>fbiq_dgq1bU7oducIodP3W0hZqPsI+D zoCRLwz>iz)oUku1SEL_ZlYOR#8XfuG{pvER<8TbhVMCT zL`B|C64p3M0YkSB)@KEHE=u8RiS7410Ba+f0#YBaFJ-n9E@Su*uucGt6+^>i^+$Ma zk;6N{AB;`l+WyW+0My7SsnRx4i}1hL95SSseh$UUaP1fhn$`&gjVPUaD>heb5d0RDkSahMreB@uMBRsqXQ7GzG1=zipX=h~4J4jqw z*Z7(^sr6I|9PJ68kHKWr{hz)Lm(jZOvSaKPn5!B<{2YIm!h@MCUvWlYkOUyjNX&O? z?Rh%8&~3GOFc?#>(LMhd7U*r7ir;3hc%@MD?Ci7T5+n*`U|;>?D8Nk*flA=X?xH>x z4t7$jO{wwxk7qT+5`ipW+*kyx>ORus20M7-Wc2!bX8FuFfWos#3-gS7Z6kb@f1)A8 z2G5=M>9jl>8>2J;i3MbX2Ry7N5%9ms0CmgHqR$S%eEjdl?*F~b9I&$fd2fqnw6(Q` zJXQ_808%5fuu#o{MVhoymSurV0cVDzI^C3KaEpSw(N|>So!1*EgdYbm2&4|X7SW?l zDLJN*&gmz-gmD*}(0{_$X*t6z}1(H7j`P%59h#+Y(GNBE`|+D_sUbb@nn zYl0{Lg*M3)2zXRSAZ9nmwJ*Y{kc$Scq~GH2gHQXf#gjjp-(bJeu*JCHMwTAn0#7n? zLQV!)=p@iAGNuXbSh}<8I%UO*65g2G=4z^>FE}*C4MYO78MTG|WqDqr{=j`#He`s4 z`y-%Czhvv(pGUln$MrOZvBt{f$l=b*ZZT z!=g|nCY7*qJ2%gvpD_(*H|=tF(v9wyy-eIm+Mm(WL8qk-!&2I>6{-Rb$($tcQLr(B z4Lc1-FYd0r;1eoEym<9`2Y3Ts1QcGXw9i3+Q2-#Ee;@4qM*nMFF1fFaT~?Rfikb94 z`<1#bY33Fbd`Fh^b8;&9lThg3)YQ~I7&x=QgLKJ4bvY;3CLa)hD8Ig4Q3Y(;GWLBU zbPXGug99Vz#Q==&YzW^v#|T`ema26k0(el#haT$~>Ts~}PIC{bFJ=g@Vliv(onWOT z<_ngq=RaT@HTZk!ojp+M{$pZq0IX(1zG00ftMAWSUZ69Y88E{J`}@;U?LNE$5`$(o z%BA%5bTBFb7DPiAY-wB;egs!31n|L3A5jKeyrixn}=q@ zRY4X;C^*`u#k+5}@l&RzH{or}Y4WVw(c-lPx{GA=wzwjlwIS1!MQw)* zsddkQO|^fyivN$1)PEU^#a0e}QxSpN|z&7mOOnlP z`lTK=@>{sM`Zxdi{~zDPPoF-$1NMWY=g+jvoSg1#)eolFuGmt`fh)wlO(gcaE<9GA zN<>!v(VUawtvuiRfeTgT5Z~3MOg@Ddx1W?CV%VtHKo?70>%)MF+j{S4H>N3p9}pm< zhD3o9GY&1+_(kXDpL)4z)c_yoCt4FfQG1l}JDS`T1WRjxlC&B>j12lGjlhDz#*{SJ zwhrGkklCahlrIoA=5-DD1cXnX+>SR8U;;6o{j2ZGK^_hE^K7p0{Ng9GgcGa7krunA z1MW4%^axQ=kG}G+8!NJ9qF&j!RRsJzuL{s2r~t_mluCm}!$O?0VF9r^v|Rol1=X9fOy{IFev*mr0xoS(hZgILeUy% z{OieUr0z;2gw9_5nz!EE-fjTM?ra}mFgo`+%bJyL{&R3Rfqy6O)8|;waU52WFEuwi0PoM`}pRO3vGJl;02V3~lw~f3UNpTCNFYLf*4$+q=tm z=86zx9^iGu#sr=8g760&&)Y@HHc7oGSR##1K?z4d4~8 z5DETgF?4wNQO(wf0k*1%TyXd9-9=u|OSE%^`|z9vC<$MdB9)%N#v@X>K*I^wqc_?| zLfNI9>Ew)!0oGjLuum&=Tvbl#D^3+wZ+ikjtdN&y@UI8|8f8qgoA)nobV4h|&fJtw zcA~4JV~wTqkA3Wv0t%#!92>5`sqDi4ivl;g!p*Hz*hKLr4y97AHV2*@(g%~6XdobW zOO16%MQc>Bi?)bFk{PdGDDHzLm+iB{fuX)@ZG+C!)ljWi?LI^IzV;hff7Fg)q+$| zgTnG-0mm0HCDmZiH3U?_bA1cvyFQ$#1ZSgvx0r>JtLHn;QJu%ed?rUZl?_e7xWYm| zjxM*E9Q80gC!-DmA-g#WINE+WP}bEsFssZsEnsXh*$kvlF+j8meEP4robi#n2czVu zwl@zRv;Vk~qmq(%F>PVd5N&m}k!0`nYd{gZoL3Y#kf8{Ol`xp_t0ScDA&;JzG5c#8 zHkN;R0j=l;Qe5|b!|4F`Yha@KFUhMG76AIH8dK!;uZLFGH(>$#aSolOEP2(@r5o1k z+Z$0(tQM+(IWn=90P^|!NB$eA3k%>Xg1a1L2#tj#K?k=s6Z)UW>dm@d^r)g@fY*Fq zGDHgZ*d!3*i;Hgr0rN5@=G+pxsVVfLq$b#EIYC^dGM1h)FWwYM!|M5Edyl*zPu2I| z%7b@80J8?~t-&?mhUPy3fwHW?)0YoP4OPhL)oa;PM|CwdjSGZt;-G*U96l-^mJ4cS zfYV3spj-e;3j(O){V*o$ah1=emZ=g@V=s$33tBOFJ8f`ZfY z(_*(3Sui~~5MBaTQfD}s=sd)px_=tF7PP#7==CdZC{tZCvk%6HN_Kk`-2GXkh7(ND zF;L_H49Mg|u)X1U9)dDd-!Q6E(5?fV`bskMVkls)*8EH%V5e==qhJWOWH&o_{uoax zUj^0phA`+K)WuBbjbjb7`P~9YLVUET`~bYOe=EOV0^UH5I4il=b$t_`qIJi4Lj}t~ z=f@c`vIcgkn!uxxMl{C{>LrwdPiBBEdF4h5=(XEZ474;LSjR2=$|{8n9P5kdQM)eM zCjI0AGXOG>r}`d;Hf-qP|2GZy;Pb&Ng9wP@$hbCh&*HIJ!bW+Yv(;Ap{Uc?zR;_^p z)~`RK$Wv*i^z6Y~&QUF3WHk@Yf+7yt;9A%h+cq4PGI<58b>Jqbv7iigf4v1JrHi}S z`HqR?aUruupMh5VwGE;B4H`de+TfzTEHI=%0KVb=Ww8%N`{%8I_W>b^GFR@c)_O-} zudX*0Rdw=3_;J6^(v~{>_R*v7%Amdv+y>~o#TBv2@%4~D*q#8~xIiCj2h%AEihWfA ziXtAc+;d{;+3F$LfN-pTq9ID$MriIO2%GB*h{_qRR@=VdJowh?KmNzW0{>w+rXRiA zIi;(9283)DkAeph+tuXD3xcVOv@%nJsx-i!x*3hT!K!eJ(kSG1wN(c;b028C@RCEZ z^szdfW6y(x${mvWVDmfPs)3*=z2lu+i4>;xeEuX48~=1}r#BF}2`yx6*-{TSp8(v? zgY3{uIw%et(C7x`NxAIEZ|+Vj(f3f;`8RSS!;}B1+tDxPHPUhsm_j`7NfNnv)=&fL zTLCm)?iTYZx12z$j*|(XGGa(W^v^ubo{(CR<1J%bI&p(Yn{oV!v17|C-!!QG9ho8IWRVmzV{V zoPO-WCE}ZpWR*(Fj=Gb=@Jx$qL!KXAa)=34JJoS2nPQOru}OYDOu84)wbHtfz7KGT zas}-T-Zk0DUmWIA+s(d<({;_Zd!R|U-om$e=IIn28Nar&>n+xXN3rg)9?;Hg`e_g$Ix2p7bfpmz+93Mqdt|GAHX(Cc2Z6C zOXY`)6bjZ3z8qDL)@tAWZ79QZ_sc}m-hcbesR{pfYN5=#`&P|NxVT7#{a*1SFKP*o z2#ZO6+WDe!o+6}y0J^CA-9{G^`GL#&K)N%<>JGLoq)o;45zgW6jbJ7UfvDg`>Q*h4 zoT6xV-FdlZHc{QUvANkcp|(;rk!>Wo0f8X_sHxNq`7}4TUg!jgyun{T0D3?Z9k~j{Mxi*okoyJJk5`sTx_- zw`*T^o-L^n*XmD}`VJj3$bBo@x&C86A-vg!H=Arr-Gu;KD1`6lCB;#3Io8z%$|F@4 z3z-zOrSC;R>x?)Tud{619r`UA${4Gd)5b?0mL{~70f~tPkDgVYD7Eh1nP;~}SxoB1 zWVV{jN}pO(_U(0e9wzju`&;lV9h&j|H;$%Q4q~iJ1#U&w=&?a0$3Lt2e?Q%h_CPS+ zHHAdjkYp`9n7}qmac}M%#8jhCeiQD2HyWHVT5J^eW>C5Q*=*zIqxE(7lJg3%#iNo$ zv#4bFl|oNvYmj6KWqo()bb6tF+rJhFUG-s=&lX(NmWzZ7m!R5usQR+D4XMUfwqX_dUC-_o&prT;!WP~oMGH_W*zqdej+j(r zED)094v&y`w(#5)mJw4l8`$8w>B`u(3t5*6V%;tPN>PKfUJ!3=|KgWAsPbZFm1&`@;o0b#5}9$vWD z-Cp|SyK(aKoUxS11x>R+K*KyUv&N&PxD7cc6PC@ZhVeYYyr4#O1|| z$@>&nm%699ideNtwp#w7d%hcxY*FbiUaB*!y&JD;;0L>tTeb@m)7@!`bM%AyUCEk- z+#}iNm{)ovp7AJEZw3iue(ZAURI;F7^fTYP=wfVqRTsS(UXY*O5Pn{FtV_$Ey11vK z!gJ9n3r}2bx50jso_=QsLC;XyI^VnGsbwwhb;0E~*@fHpzMaari~R=?@?2z3{gRm% zS*x8x%AA;9+&sn~zqhKI&}5p!hZ>UR2Fx9hLVXPl@Q9*a^KOUSzQYOr@#biv1h0Nd zJ>K=$Pu#R-Gi1O}(JHoV3PFF#+zC9=#9Y+{na;wOGy;Exe`kcf2BeVGxxYFFJzP^T=zwp4L@Y+cJUTUt`&A?TztZDmc4>Ot*T*ZJL z1m6snp$?q|LC! z&_y6ehvf>(WmElpUQd#GbTth|*PYKaZ-mjXE$dE)IhKH6So6(?XmG*fao*mag6f05fBdoIJC*z>^b(*7tR z#^(mcAq!&0xWsw3*fjZ2ei`Uov?AyE2*On`jz&cqU5#j}PzDCp;)Br}BRmn)QbxCv zo=hDik^;hi>wenb9;b@}a0Cue)obyXFuxbJ@#Vw`QMc*lB44h$?S=8S{pt&#OSPNS z2bK5xys_o?q!jXF9s9mv)3CKsiw;#f|IA!Bpv6^ra2HiHV|~tDW^2B*jb!(-&vhDL z&LZg;?7t7Y_f^XpY>azI&#h67Gjlh^@LiE;vP+8T{Q2bv007BrF013e93&psMS?pF z42yAv-;ZqpNveWwDNWvpCW_w&!s}_JbMCf&J( zN`_Q`ZDLdw^FNLf&J|JNq1nNKVIK-0}{~jr;G=QeK0_x+S{FQQd9=1R7jDgp; zoRBINCH+``x9(69IXq82s?6TMV*G~_hJCVLju;G=@kjO-wkQG8{Sv$&@vFFjS@)_Td3pZ!%foXxhQer|c1pJT0C-GL z*KLfy*Vy(Zb5RH%RE@QLu?J+wD;qR?RvQ*jm7=f(k^c(Wu{7QO`CrCl5_sg}O5{rS z8F(1rU&?6x7b6@j8C|y>%bH2boNnpbJ1>T(OSBo)a~nf%x&-=Ixu4^!VP}(2AoXxn zY|u+3BNT1Lb@xrz!(h%oV{Aa`xU^w=bCExndPB_v zt?p3q=}B+m)fxafJ9F+y)2C}qpA0F#hW{Y0)Wx0PpfxtWV#O_3DlH7RxclNTdG4!$ zc?T#BtnzDwz@S14*wzhjNV#R#T=v6YyB84YxqcV%Wems*{7rS<${&otAeM$0*hyDWHlPaO6<{j z@)Ri#8g=t0k8htXF?#AVy^i$SSbfo(n5YtZGFq}p_Kwhm*c)3BoXKfynTlRS(4T#aqOdCcNZ^=DCS3m zx9@(k171YR-<^vLwLq+F?+3`Flle&u@=Ml0nBcs5!~|RJ)Zlis@H*~(&|IbStBl znwj!+DNsFe>E}>sI1q9e=m%)bJ}Js?{%df@jc(GncG7eGPrxw*?TvsRrx-1{O2Kw+ zjIAN9wQ62{ty_Ony=8G0%T|?~F5Jr^rD@C4SsYxV3a6s7D$m4>0HY9iGm+}4^$H)q z;hUb%g&{|9pInm6eC#J;O?XO+a~zaiF=92f-%C$5S6}X|ERywE2Aj7`M%p}GL~oVB zh@kTmI;a_pG%xPPg$Qm;$riwJo`$325GS9VdwBuXY~8l4Pnl4yyq#y$$HG3u^(#7v z-A9a=mJfclgfui6wD}P$;II(OkJ#U+VF9a84IeGSt9suhoZVf1K}Gl)VT#- zZ7Ii}6hx4EA23Q^)z`vN))url_&|q47dHPgZN+&B?5mLz%#WQrdrm`OTh(4a;0uNK zn4Qb7rw~+t=T?cfIGS-2)5xqoG@PWd_$21OYh0Nvl52Wr+MY2`!;A~XR>-Hs);p=4z*QC? zw$e+T(0v-ixc%0x@Q>Wt!Rzbm+i?H~qAb%CeKbG~RVkppvZr5xdZhCmf|M0>ID)2? zeSaA7fIJe^0kDiSag+6V;ZNd*>;{O{)ZwdrKzT0_Cy*mmKgJDx|DOEz>S4K}GC4Ma zE~>PCt^watauyYooIEz}b3^D-=na)?53k|cIS~`(=a?Q}6F$_H{g?UeqsJKk{MIo& zl+gEcTBWpdZ`6xCR)Wd0YKSU4(YGLjv7D>mZK}$2IT4VuAA$N}f6-%c&T}f4CR-nO zauI%>A=$$-5&u}{iX(+vcqrdZIXGk%Uo^Gl!0!9Av(;+YDU0J?3A*K})rk9=*Holc zd4@EbzhIcuXj21qSfc*qk!vWag%-vdp|{Ca)8*W{69cD-8=i&6x@QrM4*rSw#S8~o zPR@ve2W2BX*LmMM_%4eU@aK)kehzb6Z$M8+n@jJ0d!rT+iQhR{yM|~UsPjb^lDeZy z(rfv9rF3Cp>F%@iG^$pRQ>MG;XzA9^&WT% zPy8Y+Nu6~do$b7YZCmv<9zL})JfFdLqI`>#+iY?5&-|A|`S{?F6POnEZPhXs+1&^2 z$E7#0>-F1}TpvqHBzr5xT^+sZ@uGG7ug0Tq9o}svp*>v_E07KjUc8^JmxpY9Xz=1v z#%_~^@)Qp)(xzYcxHNUg($Y4VX5P(sy!SlTjANaR>g%0&2=>c%Bht5=k7$XU%fNR+ z{uAsS!dTR!X@_EAOwS&;vd1v#8lT_slcotFVN4k3!H6Rg<4Ls~L|k9{`PPoEU=f_0 z{+ow7j&2?015P`KOgt{e609hc`s1k3157Rs8xC&{cH4%ad51S z&FrTHlObiwF7Bm3D}%qcj|_44b9pJDSJu+kcioRGdp}&AHFpr`*pqKHjHL=(BXdUjCU&chdLVv#eo-Py&hurm8byNpnl zU3j@ys{P$_tVaLW)H}&F=uaXO1Hq!-t;#Kkd!EKVsCw{O+So_$*P3pWIbOIJq0dx- z)UJ|CQIPf?^?H+|LAvNMCI=QhDMjzSLh?d@pF+!y#>*kl-fS%jEJ$BJ8Ei&!bOcOl z^wp4nDim+;kQe5pivY!|qiv^$+B0MKO3d%r`EKbFT5tl5*9(cLA*)#5(n>7yQyo41 z`MauiCJz|pMRcRIbTnh!VT-gLvW*f)e+j6Tt)_Rp^K~O?6WYgJvNQGlA6M2&HE!0? z%#I=w8G3t@H&t$-*nLvAvk0k^>2QDOti0*J84ImM{+Ox!CLR~Mlyk3HEaTscS$Q(y zEx%8UFsRrH`k^D8Cex#AwK6-;M|2a5KRCax+zT8BzlfRn1Lj9geCBw# zvESYyt6^E4!rbsTDUXxPQ9OLy!NT)us%6`fmg28@>EvoQt4@I0w0F>0_{d<{iTj7e znC-)R`o8$)oc4P~lGS(MMQhi2M(jfc$SZvkYr;)oxHZp8gAl#3=_z&I@ZgPbvUA$@ z_3ON$yMftb4wL;7<|8{7hI`EnU=0JcpKC9Sg{8vj8KaQ?{zE2${&Q*Xg&Ktl=28t- zz2xMm8BOgbo4T2?t4r>As+hPrMBAIOh67#KbJ8T9U&F(TW+xdB;26AT|s{P&yTvu@FM@6a>K7r z<@V?7XEX|N$(V< z76vThvIoM=SH-V~No7;{DWRkG9c#DG!va#&aG>@cfaC3jlXO_pjiB0B(0$iVbKfB(7O-Ve{byW8g@huRhN zm7FFHrSa64+ZsJOwGwac^XAGO@8IsDdU;)Q2~z;3_ zk`Ui0>*H0(-q;+-1nej6Ln{|=W68CvRq_OMFRrjqdu)JStYWVy=Yu%H3oP~J%%@hv ze#Vb$#lqZwMcc5wJ(dHX_+f%gT>iyWRpow1_4n*e-;-PRKA5_GBL&(eHqee`e7&#C z;@(r%s)&5UI>AN?&IgmEPUfT#5@}4r;3K7@GCzL}UJ&-Zndnwf!MyxzDEn=5PDEHU z-G#GepkFObK;f^IZ=zPiTjv-DqfN8=2t5WDEiP6#JYMo2cgd2UBpUAF=qOAca+TK# z+>1OKyxo2GzGZ+N1+3P_eWuJ!ffzF9a-WVa`a*Mukzp4m6kov2TwIVj9M;iciGxCir0LQJWOuVM~r{|EHXhVWqWJ0{Gv%3 zh#CZl*QlL}(pPG%j)NzmKUq!jec*T7neE5;J+L1 z^hJ_-)}n!`xIRFo`1x)!c(kb(`CKZj-CD0EhFi>5`Yg1=SAG0*6x~$)yzS=^NrOQ)g_=fSTf&ZKd(V-~31YDsRcl$gquzV8S> zsp*{>bgMj>z~-FAFX|R%^`_4mby%S7?Pc;%zKh+b!iWlHYm=54%KCB*sr9RtVipT* zI}TVClLN6M+TVdJU8{S6I1o&`q+wsZSz~EQ9FtuM5VXo7O>VZ#?#!y&N5CoTL3%?Q zd)#d2&Yy2V)Gxe}puQpx?F$=>T`&0elV5*aG)NRv?o8fCMRR}-bVYhV$ zJ^YCc{QBg>2HdxBir3GVPd|v+DT8Bl(SJi@Au3`*0ZMAaU>m(bZyp5mQ1Fuyp39%g zqo~%)Oc+9y{Mj{9k$elYoQL+_99=|PDLC5WD{D7P?j`FuS2TX+XJYzbLRD&>Eoa{j zdYK&>`t93`@)I{b^lI!)a^h)qMn&#^Z`-{fYkRYBapjAjVkXO?exuLUVL_MFAA(*z zGr%k{m6!WDN&^o@QWw|O5#n-8C*mFMOB0_$2OJ^Vq7^#h>7iTPy#hreV76Py=t-6} z(%$zPbbxX@7K2G3|Mjyl=A7GxgSx|;s9B>Xx`kvJVL8tqll-!K4@F=wgAT=H6*+6^ zgR`?kkv;HNM7Nx~IkYciAevUG*c*0{^i8JsL>ByZtJVtzC~}3>#C5&O$2CuF8j4Mg zLN7j!G`G{$d-xagXB@lOy%l*U%Op=QU)F77pBA68DZ(1YGmr)MGr|q(()pP_B)X*H zBIG@vg)$4?z~4lcSz-fsuxzPs%NADSb+*I5gH4!#Kyb=!;^o_ms3HOasdZ|Mx{UHf zs_|JZE?QL{==c88-p@F7)aW*Tlh1t5eHAM1LQ_)7ucxy zr8jpr?F4Ej%DF#g7YZtegv~czK|7Ke_keMRO^-dX8HQd(9kW$D@acim+*(xs$P%OYt0dZJ+1{Dg#nWF96SoTimOh6E)}biCXOOC3rwd%6 z&o)fY20wk>-xqf0o?6j(H`cMj<*OQ}gdbAG(U1nt|s9>@sl&N|*{JeJT-R_9Za zCg$X4UW-2@M;?*X(9AD~V6*|fliEP-baQX!vyX|NwjJ;arxw^w>l*H6zn3t-|M;oL z266pj`G;@eqPV)Izf4x%-U9Xs2ak9r*y~(b_V+sc@4Zg8bxCoRS$7ZR<5mQ>0@ibF_`%u-P6ae{DW)9( zr8}b@EDUhs42V}ckHQgnC7t}K3%X=%?#`Gv^@0VZ3EtM;TnS$M|8p2HR%PFwhtYZI#a zVbE0laiIZRJD%j>IQbR~#6|xv@2_3EcAw$q+6GR(H)O+~!|7)^Xikd}E0=jwiy3&m zK9$E7s&43Rv$r?jZZds>XUN{a`*;s^4Q|X#3g1$>35~{B09Gg~!d@So;`&1hIpBk@vl9+s2}=1UZtXAq_Ktlo^`^SW z!k6{+ZiKwRwA08f4b4fPF1$64*`-w&U9lIXcW}IfM&7wTs15t|h#*^YH8|K^>wY!& zv*xzlvEh2|Z5HvXYBH{x7iC=xLz$M*Fz>4TmCcR3)rhi%2TDA6!fceA(~!|7Ca1Wv5#0w7_qmgSLu7Hi;V;UAAOkiZ?x+o)fO8UtITE>0> zBe1jSn0xlz!T__Ol4{%h4a+=R#D}CocuqC1FF8>EKg!-StjTP9AI9-GoMYp76hR?G zhf!3TNN)iL6$ODo1f&a*-V8`DK^+At38)n5f&xmD-oXM1(u?$_2_yh4C4=kgU_9Z+TbDeiSv}%)(qeMwf@UqWpIg0FpD-)1X zL>E;eX}Xw)o%zuM4I>|HhVhUWeto5Bc%51Tz>`QKUN73-v7tgp<=`v&EV|gqAu%+K-OX@yecxZ0+BweZSJW z$VRrToF9{7(k3{Pl>pZ?B8|HiI zRYm2-ld76J$Z0wyVKej~zVo4SCVvTbWUS4I*;J)F_{fFyj@@f#yPAwLTJG|oPpPK2 zK_LMZDTL2&wfHgTh73AA2rtXGMK54g*1MvqKg}g!mqA>QH~gP&|AxEwxTPCOxzbm) zobFr|R5H7HrF==N>e2FM7n(BUyHd2$)WKFQ%viZ#h$rXKBOw=Jjn_Y_A$$WBr0Wo{ z*x@o>utRaoBV}ah*^W(BXLH-ldX>TmP98Dy3#C7-MX=jSj>Z?6pZFAM?$a*s}GW50q`Q^Gaa6wWc>Y z?^n$$>>HTeqWCuj6jiK+irJQ_R&J74-p$Ua=1mujxF{@qdhFiFihpd;Cp+wygPWEd zjJL3#4^oihPS}`0x7m%&lu&kxq=Z!YZ1(I*r@RQNjD#OG8(k@$NOuGX#pC86MQZGW zf?D2moYSYLEA%np%Xx8={~?YIp}mg}ZoD!{=^@C>t&WdDag?yt8)99Uyj;FjyVCEa zuAUc%;F?s%7d-Y|TYEV~j*i^rEC7Ei zKzY^uduX#ZL(C?@yGeQaxE46|xAhU3Sp@XP)|Zvd>9VcC17$j`**~kO21=l7#$&lS zE@?i`J;JhN*B14z1g`{xqp|e5*ZI4BbnShx0yio#x)&-gdg$S%L#|WL-V@@JvpHNd47E`H<@6YMqWAai6)$?t z5;mdPk>9HmTy^Cd9#70>Y%JyH+E(PeN#>J_@6r8%!0?|P4Ls>;QTx`HUY1>%sWxjl zy5w&RX#>9MQR$iy!=knGkn1g9=lNthqte?4yi3C1?K|*p2LyG@)GrdjtR!@el8~gO zzog=jtK!h}mfKy(E@=!W$17nT6AMqEKPuawK%a;I^Tz(x8Sru4nmR}40g5KX%sxwi zVdj1_=j`9Ntb8&Ut6uo{VY>{>4>73%hu%Womz@#t>WS;teOBZE{TY*`X}vchbzEl$ z$sD6~Li$=lVb%^aKB#s1FLZ%Z0V`vY&0xjmRaX`S6IQinri(fOx#XGM=%1;V>7}@& zqB#AVIU@mJU&@|^V!qWRDd&}RX1+QW>%1{X@}~wbZ=T&+db_8DO6p5cFN2icg;{hB zL;VFyHF|c|=~qLiRvdj^wdv85{c%s%Jq00nx$S#>DoCT!Tz!K^={hBf2p1BSnDw2H zj+&8@+}uK&`_fBoYjXtj<{>H+2~2QBx2a6#Pq-A74^Ax>ExJJe8d*t0@DURK_+@P- zCo!wFry=E=s-osEZ=Ln^{h*X%=HjA1VAq~fTY*+6+j{Q4N%rL#!!KCUZ`ZGP>KE9b za;vQqGQLrMa>je*Wqxk5_M`;Kh**BewzKO+c&Dw+;Gt$gL)5Zd;jzpqE5JgEmvbKE zWWAQioHEpKmm6{?Wkkt(U5lQ!q6aS0OBu^~D=WGVwVRTbLRSmqQhrm9%fc>Z0&u!>~vvbkGCR{wt$Rt9`<{R-Za7`g(! zc2m!R?l@FZV04kUM=AGqPigUbs}a887CI<%HEIV7&0(&!9;}BJ&g3+hJHFIw*$}$& z-b*7m!FQ$rHwCny^CKcwih7^ABx@iMFL8QoBn?Ba!NQB`ABO;Cav*OReeel+??q{sgXZu$j)wI>ysA#j2x|IS}R5@4CD- zb9G5%rDQoa*22rRKCZdCOt{2`h);N^t5e#~+D@J3 z^D()D5t9vB{{a&6SFh$035bKRl51rU0E2rCT|pFt};A@nOt2#scL$#@N&f zMvF@|7A_){gYLQ{1}@#DU{s{EqIVs*uRrojc@v$0y9S1A)3ULEVvu!Y+kioeR= zXKQP!d~$tuvpX`|(d9qtUbkKfMf$ilGaMQ{`ih)S$e zFyb81`)72;WB7;tarBPN-#xHZS-7nv$#HArmf?I+D%QuvNFTPQchV0~A)hhSQDyZZ zI)^C&GASxguQnm0gx7u}R?V+SAug#?M9;dJZEM;ENjkC0dsWhXR5d*0^13!h7;diV zb@EF;d!bCWy3;97lV!%Lyn?zCTyJiC9x~zBxfb~{yy;0rv);3MNrm~|eE1V{nwCHp z5WSgNuLX95)WXZmwiJ)5a#ZsTo#Q)6>{%5)4L|7W_`dc$w0p`O_x<`zmw(&G)-(C{ zW2tWvk5$f>I8!0-Q{lIdWIyA*crcq#FO1=6yfL`> z2h1|G=^Og*a|IH|Sg(!zV#;G@Djsvkra}6)VK3O7t0j`xn+&-aZcNON)tvU%*slOJ z8|LR4&gL?jXe*y^kT*|*Pqcl7EpT}w(bD*4~%4R5^iPjpW-_!~c`;p})*Fp6v zsMoWyhrC^LtpyM!l5L(h8qDMqbw86SH3 znfC?9V`vwl)ytS4JPYN`f1CBar33XGW-NKBcL1C66`4uYJ6p(V96U5cx9g|V-Xk}{ zryZBaSIwmncfemApr6}_vdeDBMDj;$f%@sGP57qZmr!hbXynAv4ezS z7mMFuW^vkCb$PP{_r7PWBnpmTUUXT)qansJ7gdRa`@o0Ia~F}{pZjgL7V%(l767ivEluT$^|c0{PHsc~ zhTArd#8RqzWgEm_Xee^2AtoseBZIc1DCQ7W~WLv_sqm0$cClnIHL(7|*oJx*S zk2`Qsd7ldOExsL;EKU+=QZQw#Eb%o3@>hK=T}hqaAMz3Vw|L zVIR2CU*tfj;qOchM^%gm>mjIXXw|oDxH1{cX1~JCtKPJGyp%|Wukpsxp6noE`IlO$ zFQJc0C~(p=75@S`4xiZ)f6_9>#dYHge((^w>MJd(VyG6u(2xgIWZUkog{pVnkbAS! zkxZ^~Qj&vO(r|~eEpSdjY(C??E7O9+m*J>52}_$PN!*QS*tuchZFD1X_Nc74V)>V+ zvj&A$WX!`Dg1z8ptlW^>q|{m2*{SO~ zL^RIg%{0AN`S3v{jtp1B%~Za&CIS?El)PDt2*T;j#cap6w}+{h_6Ca*zw@3(x5aXc=)K&&GE+%JC;=l(cu_Dsb^ycRYDmW6&&hwsP*B7PZr{{6yvQt30aw z82A7D(PvL0Rs(dt(z}$y)_YmrN}P=KwLUuCe=kNM?vhV?K~ZB6n>RfgEZ$ZQ;^Z4E;-(+H<4yvYZIsVD$s`-Bk$z7};9MK$4b8(H;)^-Y zJ(s&2CQXLiRLa*kc-!_Sj>*iuuQ&Txw-3HSRXCa_e5WdyNE2p#N~}&{u61UcSd@R@ z{jV08zm&$vTC+d3baM*}8F4fV>v1&;8*|M&lcR5xC!L8N$lb}(!UyCxhZadY1$%j> z+_7F0bRSvBuYqSe3yqg7ewc}DHn}QtF5#-qr<^+@4<*7~5UwEH1%62W;r0$I8iXI> zAo)`HsR*^T9P519a7}}+CR+jTyRmBE7-F)~S3)1bV@_b^9`aJ}0lN~rlU!4+c|WPR zb{a^ zF7;!m%TabDN#=P}T5;6m}+GY$pv<)W2xwJ;~u#4at6LIN^w~-T@|F1R4Hi zewK<4VI0PXRdpOL=b?-|TNl!}Z#=fJcU$VQOx4^9Bf4r}dPN~hogU`(>+I3Gv@)Y? z@ltbr*qQ0qXhIzY`&wJN`<=u_2x|{Vq27?TwB4uH`gDNj=_Wp=@3+DVQ>(r*e+m1t zyy@EVoW|fn!5NR*m z>sp~L9MiK@YJalKbJgD7tx?ECVxN<%ubM?9KB6z!V1BG%V7)Xbvhh}=eNk>>eZi=U z<8tmZiOP+_!ZKeDN9;Psz-Y8lxt#@vaND{5j{4N|O+s1YZ|f}z;|fQcZ8##QM$JtM z)5+&7`zi|Ix4LF2(bI!f_IAsK#<<49ytRli5wG^&!tR@aiHo?d_(dd-$eGQ1c-QMQ ze5VfU?8fL3>oq|Sp&(MnWw zlf1x>PuJCw6=#!w$9;GcQ-Pv%ML?=QJ_d(U5Upto86|-=L@17sKKxweO8fF4QYrM{ zT0Q*9{XI|2=DO?BxUcg-)uegN@X&qMg&^xE56R=ssU-3c&d_kPpr~d*fuZRAwbA)0 z^XkWMU;XcYDO2mstBXf>viN-ZOZ`tTo*MlB;T2gzXaAq%?lEAUdCeHv5Gbnhz2;iu z5zeuqKK|T$H-&TjA-#MF^GvzZx0UqqU$unfj+SdO$R4Ddp@DdTO4aRH{e7`4G^PX~ zzx|~`x!`E!bRRt)&oE+=831u4&TcckzyCDL+DU{>N3{T;xAk>7m2!`0av-&0nH5*F zkL@Dlti4dg(PXz{^Y6dqSBX#xihLe(tL*ew*#n&Z72^i<2eX^-YQ7r@Pzv}D@cduL&ck}wwcP?B<(jfgWwLAH$-7szr z{hRY_)e2SC>U&X!@vhrXH$Yx1|PVKG2TRIB@d z!BnRXy8I%y5yM8-#kjgoDR^AywXWje$PQtwR#lN>i+p687_?@JWtYMsShY2zM#mKX z{@W(KBzVvef5eq9TT_Y9G2y2jJ6_#V9HX4Tl@r{*B6sW@C?*ANd<&jtp`j#+m- zY0eH{tPCblze@Uu4zBf>)O6rIf0~#8wF9!gzuz8DN#ynz(OSl_RD%Q$`~LYnw(4}^ zQTF?59I0^xYXC>_C9|t5pI>${_Yboa&PB;mHVy;^7!H=jYPXZm;wCh!EHJ^>O6lLa3RW@A7T$ut6y=su*EhZrW(gH{h z{r~E}SX!7eiSD4>$ApXwUjFHo+2w`+$#^M=lLP^cGE@<$EH{Q+*hmJL`Sd84cU{y3 z#(XdHm_Yq|2iB?R8~V3{@x&kxKJX&RL^Ia=>(}Cy_pfjt`<99A`?(I>KNHyQKt?ib z+pUcY<%~VLGUVa~LUx*s6uVS7mYEmV#-{XTMC6zT6bI~^wWCts5&jQF+CRG^+ID|#O&T8{m~7)H}hN(S$xOCx@d z^ZPvFjozF=mWXTe#~<~tS~Z|Q%O2t^8jw{u$`#WNUYTX!?@qi{192Cgeql-~)PC$G zGTvBB9^EB)K08z*-sC>SM%6M|S3+?VZz9GC za6fbHb-aD?O01OE4e#L%A8I;7Omxtvvs%i#H7@86HEyD=i-D)%3iFHKBoz znPv!CD1_TF(68QP0%702xupwH)zy!)kxL(?)cuF9eiJ^%)N1tS(& zxj<~EiaHJoH_15N3PyDbBh^``2@;1BCC{Ad-u%->w`eiHQxs;)K9Y7Gt?n;z#?B3Y zv@USI%G06H6elaQwP@c?37VBTW{mHT>UOkyz%>Fvvz&Qc6*a1oKAuGo2ETt4HD1D# zAJf=(UPI_E@Zt%mtk$;P3!leEPS|B{X%m@GqGwXMAe;t4-d;o zon8$EZ$;nz4NM5)hyJ1HwvBJr81CO$(A z?hIQ#@?Ak&Sl7Te=;ZgOr(u{k`OV|UkE6t_uQfaqtmIt%K1DnEmn#EruRs zSS+?W-~bZn6KDS(0b~*oe~L+h=QybreMp%bcYzzfLC3w_!CKw&T!|SkhrZ!ezwgE! z=F)sx{C4a#8}eBWL9Qu5dNe9Z#>HmuQL$6g;IkG`e?J$d5}ii6S|~EH#wwdYU{)p86;&dkFYH4tJl%4fum0088WyxysH86SO5I5H<>d$r(iC1dnbhu&aZpP$jHc{Li_=$ zuh(s(#eK|{Eoe`Z)TtkzMy7NOs+qE~_?&l9^T~kS(|sQ%o2@q1UoN9l7_3_uoHyUQ zPrUVD)&I0x=ladNL$^eda-podEHgIBE;zO&Qa&PAZjQNivufem!X;&6cRc~UlHr*khi5%F{c3u}llS{sJWDg8K0ml zQ~Fm^Ws{!~IR9UY8pqJnK69GQ-x#3n%kt&{TrZa15k!aIC$!}f?b7f9=$|BKV!-cb z7_R|mxN5dKk?|C(dW1ZY`GC8}8=HBJ;Qct<1>qA8NEDPx_6eF0KG?8OPEap&bjQi?kiqa|hp)2L-2+CUeQxiEQxt`kSf9BNAQoh=a1Aj zX;c*d#LV&DRM3-uB%g;re0M#h*AroYrrV5n%UbcT(#*l##a+ZCWez82{l#Byn?UIW zS6(VHyF>vI0x)$It_`N5q?!`G#(=Ik&zpNQPN}A^s)8jtnGbag09=lqH{M~=CJU~rd24BEpgo;lf?bDE*Y5=4$ffu-cYR|EVy%C@ z1!#Iz4P$2Tmte)L%Wr0vEYly*lhbE|6gD=;0bW#3M?D$1<=J#al(LwL=45iSqpa{0 zQw^_OxTpk>N6Df+PS1FsV(gK5$aW^=fRYM!I5d~D^PF#qA9h~kmg0K-e>{_4+pEg8 zc^J7U378lRIei*w+7}WxFPFxD>T7pJ@}QH4fN{?Eh+)pUr4FvnV7uqk=ZW{HvX9CY z-)MvFZQtJV?n#{tP?s5b;SF)1G>M6jt{z%ocK~%9JtF!4 zMz>Io8HB+3($`h9vpEC6k|wV}8IUs>yKL;hy&Gq(31e07PM7?de~N|1m3xn1C{5-y z*e#=T!OgeeC0)<~`ytzv{-8q>VZ>R)59kRSeX2?D+u6CO-PPs&rSkP`lRtiE2uFdrV z2C2?SvwKI2mzZPkp=C_rSqJqKD3D-2ab1dkzEjodC3oN9J9}TzKz2x5oj4keeHR#g ztr1SJLea8Kh)V#S-|Gu~!ua&sGNR(2Epsc+0**5EdtKXD#Gr8dVMR{C*CRTh;D zn`fDxX&c-(6O*uR=sPLjOqzf`lT=&wd~V){PwfRqx}Bhrtk-)-zS7c$b!%O3<}RL| z94l=#F|nCA;e8Q+RrTNJBOP&0snH{=2f+=pPPNqRem4jv7^*SM>v<5`HvW>&Z-?;m zob>kud;1LAK(Bbi82(vz(;iZOuLn$(rvv~92{|oEj|^|%y|iCN);<-MIrdRS+M$#> z-aj^5CBO0ubil#kKViQUe56x&DdFs~{Z`T`A=v?2=5^9EPqoGv%7d3&)K?EW=)?D3 zM^(M>%s%9PDBrsUE#`7(#-nB2Ifb-iJs3K;AW89h0udIXJWUlcuWvm0_Lbhg%^t}} zlB!>rBIJPgcIlUQw9m+NxSSqmJNi@;H!9NZw2Oy{-x@&nqS*Wu)Yp_z*@TZMwk8Aa zMz1fbCzAamYPP7Xc7o$+wA94=GhN-tgarDhdl6VuZMmvDSclAXHBR}T)f4heW;|NM zSk-FT(?<9qD5-(}9ypJ=*Z8|S@SCsszOu{*D1%$gRtfIbO8u+V(eAVo7vPS>HE?+` zSMufvqQqxM{hPVb4|bJRJ-ZIe^R3%0J%jhw?7uT6ic_r@!GD>^Z+E%0SEw=E`PK=P z-g$CjASHk2YIU*^S|Daz({5 znXZ*n7H!blPZD9(s6#Phn=nW|LKSQ#k5aRj;Z0)W#fw>%SkV82b?)W5esrCf-EG*` z>U4d7ZFbuZD`M%xQFjZ?#nB!9FL;$8w+TEJsUlGJGE72I0vD_o~YyP3QB#oloY zq<1lJcS-}j|Apd1e^j3SvtayB;2BL1sRcqMXG+H6ZO5x7mUSS)aVNmyLf_hIxp$^JkLoyMxp5)WCk`}l$#>#tNaP6Z!47n12s~`^unM9 zUZi;b{!w(?-q33%Cg}OGX5v@^9wRgP%4SL5*sxTD$J4=Q=0-;5-qY5^+XEsgp zy?yk1!rt%q%gO;I>dHt6u{s>@Eg(5_=HR6W^1Jo@z_;!t(0SKhYSYRjK8cZ(nk|}( zI%}Tnc@3gr+sdh^aF<&zQFZbH*gANu^mHS92fdBVxRAdazyzPFJh@yc?3{39be}N?i&K5=;Q(`-ZZ3 zA_#yVS6ZzX^hN}57`q=oEN~-K2i9k=HFK#gqZ~V^stp$`*0nSqwvm9$Isq|P%}Qe< zkrYy-fD(7vXPr8aV28n1b|SF28G=2PXG{j6y9WzvxOzP5bEds5y>{)|H7-8oqi0Hv zm?NyMtxea-6~oIw~C2T(#HpHlg`sYVFrn$ zkycvroBQ6!&^z9U&S?%ELoa&IX-*<&% zmN^Ou5j^o#7#?fs+;haN7vN-l0H@%pTKVt+H-bhJ5eZC36HLRvHS}8kn)QO0fAW;j zL?y+4@O4_+skP-`6V=htLk!7s z^rz)`{hyMiPTzMvfzl#fzcaCK%cp~1Rk~1qd9q8`=%Sas!63cPStIxLh;--9W;>x- zcZVx3GtxIKk4ifI8jGK}OCJ@rtof}~35v|qQ^!mI-0%tV{xn~!3|GihTG= z+2#5OzA0%5}R z8@G3|SN!7a>?~khE_GN?|4_P4rb@aIR8Ay!r}Nr!9Zt8#*e562)%%c@mLP+A@KyM; zzE0CSk=DKZUg=BwPlqI@=mJXq(3O_5R(avH@@$({ogAby)UDJmNZmR~qI=SlM63Mt zpqq(*W`*2^I>JOwGQoD^e}PrX!zzD5FA71?l3(=C8=3ut-SyT8YR_ST%lt-g9hBr& zuW8E_+;+Z8j^4M=+7enqSnOt30fE8ez1$2}$z(t~ToP0bk|9^+#@JuxmiM`Q^@u^3 zPEYu|`>bPx<4O;Q3Gi007bwrN0^2SJw_6u^R&Uz7DD~4*k!^KMF}tnyG?wTMD-1-*!6!^!!@TyvUz|Hrz+2W~~PyWLWT*Zk;Dd-8X7 zj0MX2;=6Kh7!*u$HL<(0T)1TtzS1t=T*Kz;=D0C^mjld#9p(eveZop=ZRcmg*2QV; zZj|NofXEvJNf&bO%Cr_t)JV(D9(rD#oRcFm?MfVrbZB6A>tFxW3-+Osjw)&{u49U2 zxtgNbH`k|2ZzJmlC?}M`9OIEAJJ(8pOlN*m>JO7hEJDbw;=6$uQ&k*!Zlu0lrK@bC zl!F5IE47CJTkO*VblXY?gbZRe<&{_3!ilE;LpG@9;HosWk&I2?5wMBKlA zKE=lx;DTz5*tj=ZcPRUiSkv)C1>{ns#p`#9Lqino6HFj zO5f+%`~9AKR{xEl^j-Ch2tX1xV zX;j1ic*A@;*A^$8YfwF51BSglu#M$Yvuu_BRoH+Yk;#GPi_U!Br-3p%yT8ZrS8n-= zbHH+O?%HLYOgtkjJfz={GjfVH$+mmoB>$AV`6FeWsT@ftuF*vbl`=E&MJGG2i@)d~ z^x)?LifQE^s2f@qB;4#q7Hp#6>c4M-nxZtq`vN8mHqrhcZFHAlXNKMr{+Sy&W*4(+ zlM$3?trUT^7S)I(Vs?c>yf4liw$Pf&S{-{N9M}En9q81ebk^fD60s{^zlfMs2LL-1 zoST~qIpb+B-vXzRx=ixm+1Zz`i^o2Smg z@N0}tpW}6NJ!Jbvn=*orvrktYsN~}p5D0#*#e9!+Pd3Gm3fnRr}tU zD)o*Z-51h`V~9>tn&7mx_N40%`u5U(hy*(G4C|SxL^pt8WiDYRyyp&7Jo3)BMV9pY z=XL+5dG$3Ia0{^OGuYxeo= zT@kzPH-_iQU%z}vPE0&DtvLHwp4@xwa~R6S#RcM6roIWfsK4r`8Fw?aPvT+_f}NQl zJAhOR#&ZW0Cz)NYN!g)9V}t|z{gXI`lz_!|ck4fY_3E@v#*LhU^5n`&%=A=m{BGIG zjhsAch-HI{s9*e~WRcuag|&fAIxSDNU1dES(v^NV-n!?!X4RkD@_QwpMnsT+CMk-z zvoJfPFs(S0>pIgc5f;PZs)m{1o;zT765M$u z`cI7Ag3k6?p63!56SEVXsU>7IU@e!fcZW%je!fD_a%LlHjZJYp0J~>D#>l*3gie!(Wlfs6b zg~>XuFO)*%XMkYUgY;e{>iawka^jB7wlj)bC1W|e5DbmT<%pMoQ5x`v)Q%V&NaZ;v z2Uq#_!h^viNKdC#WY!kvrO~}fuU~@^GZ}@FtSq7FJN@@Y#9@)TBp;1z`_+xkO5tZ< zaM@3YewAQw(7}w@orm{!3&r*kZ)ejEiTBiVaa0mgkj(tpHnq|lu2EF_25aCbEYfh zvWm*$l9FR8vW4<8AJ!&F#nWNhxV{hk$)$y-GYgwu&c=iA6*?V34dN-fn&vaiOOpXY z;PXE^ygPSOQc~Q<7|ZF!(_4{kDt#z`YRV`3KTsA*+7XRN<_}Zy2vvndk*wk`UvA`8 zp3E#XxmcAXwUua!qrCfIcKPDEqgAsTyX5)@RERn&c*l|_JemDNCi zl6_g8oMWxkzd0PeLfy%arN8dYFZKFX1U|=vG9tDHB|;vO8;Gr5Ed6`!!0m;+#t0o_3pA zQRaPC*6D1m!ZY%B-|>f}Vl+@T_Xi@pRrW>4Qq1x-?G5@ncKXUZmzi4vJG<-KtdGiy z8Yj>N&;+!qgsDUSvoUh$<&?_!It}ck&rhO*p@Au-V~L+%kl?HleP9;D2#~s&aKM^9 z(HX!H5>m(MexeW0^Fy8r=#A*feZgA$kMM}{vGtdC@7c#AC#BmKhU($0Rp8gnf`sAL zE*^1laq9w~i0n+F0ow3@n_T6|36OkD)F1k`z@N4k2qOlJ|BnUQ!c4&-#^OhK0o+Uw z%!YfcBRh(S$jX{z1)8E{1p&}+KcmgCT9-warmRdRr&F8RGK0mn_gQP3vgU&b zdKe6H8VvH;|C!@XUDPvG*69ypcZW0&C2nSQG1hIa!F~Q&9=7U{!%S`qBI}@Ld^9ugxN_X=F42Oy*R-F-$k3 zY*}{JpwWg$garoD-t6p!{+GGC-k)5dX<7)<1nNKEmHXkgubHAFh04*b8wCznh_&}q z2!wg{_yZiV82)W5Gyfv`&>X32kw zY8Bx??7iK0y(I*gA?jL{{1JunwMutrQP1xcsi}E@YdfGt*_Vn2)}z40VgG^=l5m*} zEL=wNZe|O50Tu`yI9es@C#8qvukR|dtIgm}k0c^av0Os%m}Q@iB<3oh+t2O&lVcLRD(?^6KU z165%D?uEmRg7huN<*HBsu*M0g$%R=^;9Wgm53{B2;^y9c0F}wz5)VgBV`H9VWnxqK zoxNNV0+~P9WtWtA*y6~KPpCT0XTb~4kj}N~kpZ_MnJn`_;`B^Y4Pay&>G>^?mH62w8lNAwT# zHSzE`TU>{Ufu{P?s}N6}cA@k%k;Dm{%K9ynYexB2npwqIc(6<&WAO%96cz!Rzw!*#Mp5vE`r{w$FDh>7d9N-Gw%N{QZTW}7h#Ud&`FzDM-u0x7HON53~Wjb-GBNZ!1~s#-7&_7rdbSSrZIn*UN^UAv#5*JO?i;@*?Ty%%%OwmqL2=KkaxU2}uqq>0*#m4GLhc%jx#O z1Hg#2dypX^x(Ftu_x&tE!+jAj7?7rVh6(}<{@T`xupV#B<<@9$uvs93(Byk>sLJF@ z?Cq6G#Jnh z%Xf2a1XA=Q0+i;d+I|&|A0MA6nInwUN2Z2%0-$Qoi#|Wghb{mHei$ml-HAP)Hds zsDxBRumLGIP)XGpK0ns9ik_h+e%zT1(Bt&NekK3?1NxsduU&f#nZOX#aoBhFcICL! zDOOfim($Bqwl@t*!3n9=e%noTSl&3vSsFccc&_TUw?9_ZD}lLOiLokmcqkwR+x2!@ZGAgD)N z_Cw3d_@6l|zd`03p%#u!pPuUOB$cK>$yk6JD;I~6p9n@70=@o7_bEaCmeUL;pmDu- zE0ZgqpPunDGwt8{9E2k)36qfd5y*_hz7j;^`sUSrDs4Pm#Kmw{AO{l1;m#z&y?gia zcegm(_ZN%k_J^Ss7Z*z)t8bBj(9F$j3iccPi_V$WgH)o5Y;CPTQwTz}?IxGQthRL= z;n8*qm)k8ym<%h!V5eI;S`n{Sv}2WFGMQ_eqGa`E6P>Y1P1&xM2Q_6 zy_y}2AnTN*L0!NkA(0rbMPMj6yg|z^?;jwnv-9W+_C)bvUXaskLTT(*3Gmn-21WDO zUR18>hlf$n-6f!(e=75i;o*N9-`Ga_>vM!6vaTJ}4)$VM<8gX?wK(yYc6oGAk9(xlw$5@{wnPhCADGh(r-n#wvLWd&UM zz%a*Zn(bfcJC$Gj{aFj*>RQ zpiM)R2w+Q^$(LTTv-rtBAtrh;A=f``3XB6sN?sQE{)vus09ooIg*Eu&EPY(Ca${rN5Qfg^HUWFQ@s;(r_wXag@Gg>GVG z+N)QO9_)c(Ewa(k(SZBD%5)4Q8+ZSg4O513YZ~=Z^3c1&T|AT)Rl$gg61Tt85HE3Z z>4;>$E(d3eJWR+z#x7TX0K-;}H|{-Wd~{DlmRgyS<3@ll?rSBIwg6j`+A(NLYk6)E zBoi1E)P9CJd^r(2oLuo&vG%v_&WaXDBq$F!j041NJ70u1bwEQ+yy36xZ1QCogahc* zmV6OcfxUTAuOV7S#zKwjVBYeOAw|UZ)93s>Ud$1+a(Q>0MU=A=u~!;Q@@1AReh~s( z>@;?r{7&mfvZ)rU^2poA`R!hSUpfemb7H*Rq05@4KX+g%-usjMpRYZ*MWz(6B`DLV zOyaPxaV-BV?TlWcyXiQ|{cDd4y~TMF+Y?>d$mP}3@@}N$2N)Mi{k&<=BuGW3dKj(c zl1QWOW?OTHBIFMm!XMdPq5ik{pb09P&W{xTQ$W_@6r`mBzoW==sG zFV{|%JFL)`{tKp#_0O&vgr&?O(}|c;vi!n@^M_Zmj`)6N?e5_ zqG#}8h=_Rg(ju@|xxL?ZbDn!+()&`fPDLvB97uSus^`gwvk~^$9lEe6I z2Trjb^uiZG*YRRt&=EwdaBRDGuQlN%Swe?k`b!$%CvyNy{K=TMF?yD@sF$jdBqR$Y z55BqOVk8${C!0G@DxEp4-i^?iQ=(btU@D#15{fYwmI0&*Yy{LeT#OwQ!8&dH{%jIYlk5!qo$Vf>AR_3(lM- z^zo1UMSBRD0CO(!g63pbHW8tdAcaT*G$YeBQ@}^SQ1jsYH4id?F3CW{O}l18GdriO zQ_JW%qTyZTGxJu`M6|qA;O@LLKQ5&pY{Jw%!3W&q<+s%w47IfqvL<|!&(u@=02uQ# z)KtD$RjIde4n)p|SCm~BfT_v+fn{OuT1-$4*fxn*M_6S`X6=)VX!JZt8#_0S~ zH-tzVi|l~hE8Y&sY(rFt+A4=84A#fC(T>Li$>si!czrl5+$)#|a~6moL{jhzL0klH zdzw7D3d*N;?N#&c#I|nyFBie=*M7Szl9nVjy`TnZR9!d-4@6I9!ksr{HpU@iIamK` z<=c~B-|Fz|WCVP}ESU1%8Tox7F_e-M9R_>kjBn^X;a{w^1SO(~-DL*nppzX&w_FY# zo2hL#z$I>{II}h=pc)0kjH+K3bmTZqlc20Ka?Ntk>ysNg*Fp-st`0;6`*vjYrU(L)U6-iXO&u`0er(zq+l$5Z} z<;CSEjSUM|Z@fu5c{sa{anFBX99s8vDIzvj7xx~yQCZTTJU3!SJP^*VsiV*RvgRT( z8RdkavYu;Gqd}+YZmc3BccE8C7bZc$+dwZW)oVt^am6^z3o1*Pls!MGTbfhijdi9Y zYLgr@HHkrB@}Dg73kH8oULymkkkcF$F&_W{;);id2fWw!oNk+l_sUnq^}^&+*z7vT zxmEyC{&ZnjzMew@(_4p*&Q1qGCZw%Djd9u6NWTVI5w-Ii(cE^T&0$DO)A;C#ng_2M zc*DJ4hw+->6Kr{uM9I2_moL`#seL%gKLfNh>cGS%;M;J>eKDi%@8CU$^Z0rS)Y-b&oI z&1Sh?MJ|^@h*Xu6AO#jI9-n%1QSalZ6X8m-J|S$=c`Pj4Tr+g3XE5R(VaiY^rTSki zH!VR>b7nQo{;!7CEss37V%e<+C_S9A&gU?8kKvf!wG>3PQT~+wYnt^D$KY_F@`Nh% zbecqbFL+#Ss*~0yJmOs^)1KE!FWuS>B#2xc1_prUG%Wk~sk`5wA#st3&!Y;>Y61xfi8W$WMM@$P_tai!EKMK; z%G%_!Wr;EUc*bVQys1AbLU#FQq|XI#i8O@E0LSOobQ0YPNYY=0t}KdVCaqq2!QOrv z03TqYUv$JsBu8+2ADxFbrI>8O9&g%_f;dgG0QIcl(N4moy;8vS3 z*1GyvkXDVly1IU;1a=ONvE4F-hg=|&Pk~uOOFym#bb=n?Z>_y?s)(4dW#qfvDC@Yk z#Mpsm3RGuUB{fj>7oobuM(QxRIPH3UZF}s(gMaDh8*=Vk=YZ*^5xla?!o6~XGI$TU z;*nDV4OQ0&110M-Wmw?QOX#%LWTa7{E@ZxS+ro4rz){fDfrTpBhWMkX{ThPfb0&XR?uzk*Tm-%oQ%)`fCUX)kHGEJO3Yh?->?V(lv@QnZ|Jh1p$?uQIddw{Y54KVwZ4D- z1j(~5;dr~e{tQ8Y7?BH-ic9pTsZlqa1N^&pS65fYo*vWL{xY+fLQHJu5|T|rAz*C; zrv!k!Z=}?8TVCE5QjkZb2G7ocPj-8IA^-7_aYU7>$_5qSHf;FWlv!Y zX8q5h1mVbddx|DdolT3{+}vEo9wJfAGjy*Y)^2xSo7onk-i?ioFPUa45f^D$xhGZg zVavh*4f_kUj^96lFHY<*-#L2e&_G=ph@?XtD%GN}$`CZ%196ZpOP$R!BPUKo?=laH zlHvn=MqdF+0wEv+78V>50=*Wgnig_l*s}%p>^t;KPMYt0U03Yew`U+P=#_x$VH(P7 z*WgS9dHjZAa-wZ zl@#!jndA=nze`M%WXe}kR6H3MX0399j4Z~l&h^l#v>v=Ue-9+kN(#SCM|x%dRj&-% zPl+emlF;A@L;Ufd>xC9u%Y%;aNM5z&gh`lQO7LkNUDG++S-FAX8 z8ucJhz?fyGvRW{0PgbRb1~NGPhYux~lH~5(IflbV;7;w?fA|(8(Sj%ctTot=T)cki z#6S3FRsR?N-@RGHrKF^~Vp8nZW-A6Dw@oTNi*G8UxqmSQI@Vva{i~g$neE177TcLZM7(^ijp0B0Dr@NN+(po^D82!-X5Di8VE>~Nv{tmoSrm> zO9!`(HQ2^_eY^@tv|xwtFtgtGf}FXyYQ`dREvRX`?0k??yLGKWc8|3x60KCHGE&RY zP)lR{s?c-N7!AH|g^2TECrt3-tXVwSlg$G?nd#j%PZ|?Dd#qTetGKB-q_}0FcXmw>6 z7@UOk?6#Ag=-OUxfGZ?4ZOi{q_k1D-qxg@Mdc_WPgz;dD@jOz_NWOIhg{07xXHQ|x}2s5oNx zBZ_Ru9g7WtvudOa+W7Ut?R25|yp4l^PvO+06I>3(ND1L_bQ2zOprlhHzz293#D$$a zd;JAew$X9u|A~yki;InM-7r0a7XI_+&zqH>(u?j))@j#n&$_1C z2Wgv#k$x9*fkGc!6V%#R!;ktU0IdA0h3PfKtdxmOpRk} zhB>q4a7vBUJ`&27*kfLkU6VRpZXCX2kRBBvE(OldWVQK3<QM7)C=_YmS)WmZtX#R3jc}4ULb|h#ci-qeP z$4!^o!TDMHI7^GJcT5e6UiUETsdj zyXrp$V#CMS;Wfe?C-plL>cZ#%94Y={ZN0z@b%`s9r21?cS{HNs#RCkWNhDt=;o>FT zj64kw(wT~n3wPg3d@?%uQU$GpQ9^J^$7@j}jU2<*E%(;RlC*5sg2F z-wDcz2?-Jk_aTGUn}Xj`e>|8i-+Qvi{q|%LtoMl${GG(HUZ$47leZhALT;XY{63Hslu?hEy^>&jgo8SPjg}{uVRSk9$$r9zYeMCkWt358EY0ccp4$nSO18cFX zec<~8PhE@v3S0_9QPkdW3SGy-&jWn2Il#|`DTOB+gjbEmtHrHvb*3U6R{zvt?q-L~ zf(wme@fSsg9E|`36Bf>d@-pk@+7r3FmIv=-gAhh-oZAz~8odIEz~D=eC zv*>U5fB0$txRLuDLS~2#Hp(+rBq$`_+36qIFF)FL|Dx^5>T<0gS`(Gx4g!Waa#>9` zx8wrp`_W`IwjO7{G#QlOiibeglh}HvV164|?H{dr_n2K`8=N4Tzz?hgKU$>F5&SUr z>R)Vp1YWy%xSvr|Dr}Y0YMNl3e97@smUW4}!Z%zO5&*rp%yHRFcgu6VS4z=9?)%ZY z_H13;Tj&s%a36{$m^dzfbBl*P&nSX;Q^6h@n|xm?On`7HuHjMoL?nol@m)D~^TRO+ z2-XVVfJyiatBZX8(ez2T;E-oEaZ<>B;f8t%{)-`_>F(V4haDi~(x~TKO93MMXpOY^ z^>O)q5e$+FBo4rW@k`jv_0ZW)T+q zJ4pz?9>K(`z46$=*a&K$e}Zcgs6M^+6G;fh`FbPXga$jx<`zD})pXvR#p9(e!xYex zXXVE9BAmDtU=TxE5ZW34@GdA`laRlH!0$)vBHjdYB$y*8z*0C)xilK(T@Gd`{0LXl zEJ7>jP=Zz@XeUfhlw6$juW$bce&tahVLCSoy+`^A0_B$4m(639{4b&@NbV=3@zt%Z zl3Xx^#(xlt_BC>K-#k|dW3W*-g>aj*saO%sBQ~K|9stx7iu!65+49j1f@^n3= zyVPwVbDv=AHA-(1fHM%L#jHTZV>RA_=z_@JAFHZ20A1%!w%OCrvxJDY$>mNMY#Al; zTnp#x1@`Vm!Lu?HNCm%(7GQcE;tlTxu&O_(e0lmO$c3n>7s~G;nv%yIJq}y-X>&Pj z)n!eaJ|`Q5cv_Lv44KbPnW6+he(|M8#{bPvN#i+FO2Oq|dnU7%ceiKD*qqs|h(4Cv z?hX!QRHA7*50}gSGvFn_dXb4quKfe^@<6a*@^i$M4)jamIIg)a)@KHDMk`8 zupkiHX`&9B)w1-{k7>rOz&FmO>3_^&%9^^%CRF65hD8u z2t?&3@lpIRk(^(ytQSTGyF-c+Q~d38fSUPDL9jaDO|mco?y$-3f#(e2&p-#xdG~U0 zQf(yEqW*c9b=L){9|MGUXUwghI!hcNVpLrhzjaHY{70?9V?>w_|+BuZhWsBijyy5F4 zYd}pIqH!SgTYv)8efxFC+>b}X9av3rzPUmMl9W%s_M6jAD+|wo9# zB7jJ7o^wFYBxU!y1A|z%bAV-OdN>PKh<-$io&>eu;CCX<00K*c`FY^M-+#ME)NvJ5 z$m2?yPFC-g)9IyDVl77M+3$UH>Cg#K@0W{Mk+%f9>Zc@eZ`!ew03$wR1`wHHWT^_F zx&_$b5Kv4^OS>`+o0C-N;XLLF)LMmO4nI+&dGGGvscJt!zmNOh5#2j(k6XtKz)dfd zH0;j9%0(7fO?7d>=AM6S+o^LhuLlrM#1x{k-C;`n0DHGJt7_$wCPn&R-mckwf*@Hf zu+gD<)BgO-?06|(+Bz4QxMd=XDcB~xQkT5^w>1)r#cM9omQ5nLSl`ZL5e@lR`C6baOI== zP(A|{dw%Oliip+jkq1Bwv9e-Bk&AYOln~i>bdkTi)EQythRgtl70ogtG$7ea%7N%_ zI+a$#ia3*aM|TV9^v^VN?g1lT&Vd3 zQOAjb-BInnOu$23NM(Qfc=Gk$H?_fBOyTz9@vlj*fP+Hn0&y=yR^1JK^!dOS;N+Y= z1rTL;3K)Ya@TK&@Csj6pmb@U`4sb+ZZ-pFi|CfvT$ghFawx>AwbiaZ@4~;%Ht%9JL21gARfdS^kK10wPGwTBAj#-?F+SXPOT7QHfE_6$Rnt zuTLPe!0Nqv{!)W#8(t-uEMMkITwtb$1jCMG5*lv0na zVUD~+%(~W>1X5&b9XERL$)WTKA|hjtUvFT*FBPeidFtTm{F()cDuLi-Kq_9T=MQCp zsI}adUF1hPXGo&_a#=x1oouEU=Nz2TJ)J*83x;@AL>HvH+R@ksVVai4M3L0L#yWV& zz4QdggT&5{j65MpXCdaR{hc%oYrCT6@A@2umHS5aW~)EIQRq`F+=TV z;{AuI14%DaU%DrXunGmD$ilhZnT4{+h_ELtiU^q>Phx;Gf@H(d&r^(r0#`Fknpg>H zu;|4z)t8WpP$Q<)ad(^2qvEA++-QSIFa3*XS@qZJ58df=C?=_pc?+-TBQjhnz=o5h z8&;jxjmG-!_`&AxOC{4i`4uC=nA~N=?%R`R1$)Uw=HHG_G(=8Sm5M{R_Ssl-91_IZ zlwknus%X~JwDjd^v8HGAv|nS+|zYDeJ_ARCV#zD!pv+oSosR; zRJ|k>czW~p&DX|WyyOQTBJ0Lshpa(KNz?-{PJhX@7~wQlgNUYE;et@dLdB0hA_ItK z&dPY=d^^ik5bFBZ<{P|yr1>w<8T~;d`(o0Y)DvuVJ1yp-k`h}hk*Gi`sDS7#){dA%9o(@p5ZU7*0t4C81BoIWV0a+Hu_4E{h=-{|%8-PwEu7g4l zYSpG}273&|5yZ!UFsku05R*+M7klfb`T+R7XtgT5>QIEk5Z;u0p_B6r#FUfZhZ^Ue zenKkz3^AQq9YtgYBoWVKz#8f{@`9fMk^Fu%Q89C?#XBUMUz{HRamNF-nvL>6wAGs> zd6r|xfCSmS*DMyMzZH1IusvCdiKHeO$A+6@L-uy`*7|RCNU~{oflraqjw{U(UPz&0 z^IWxH&iApg^oVW?mI9DKxD}y{D*FdsfrA@; z3lMQ}Ls{MN0Cl3L$G2<+qRPDE@1ovU`Tl7?VsiM=TpsLnXf&CHHu>^K?3?Lh zo%T8t0!37Gb_X`x2ww;9;SKd>L}q*Y`w;@YYneEreiNr7-yfppy`&(8=%%~%K#;jo zcY0HFKX8GWehsmn>@*jWon8MPDd(r)3Ch;Br*s5c<-_S6$ohfSUg0G$9hm0{5l@=( zii)uWW*wIYJN->g7OhT$o#C%1`v~m}F2kEf5*S=3kV2UR?&O!iqIR_pW_UdTzF`zl z&$GPQT25w8V09qkmd2|_aD`6X%MYJnR6oIb*E24hYy9vZ9uOvABi&lQJ?yPf=%3n| za@dv62lpaozaK5*1zsJ3FRGgf}qlsD! zj*rJsZhpb-0me24h|luNlS1MUK%EEd2uYB_V^XMX|8qixnNegLIvr<<)~8JIW-uiU zM28f?R>=_VG}-W-?b-3(OJrkN-Y>#jn42ilwo`mQ4HJ_ev=;}YUo4V^^R?y%2yXK; zGDd5}?ewEnzuH-{Xb7af1`@lRQXm+%5H(r7Ic-8W`@;1sna(1Dsc%^>pd0;kY2I)D z$de5Nn`gWjc`4t-I^@BLe3>6lfOkVX?7+AU$!WHk>5XT)b@EOQh>>_)_=0LpvfK+Jx-=((*?g7Rf!c7G^U7HKMK$nhB?!l-W_lXb3lmJm zmt$uQ?eeGd3=z&1&s6IpBYcXOoE3yD?R29giq7`>C4xt|6mM@K(VM(*9M;)@nwaEE zi0^F0!&TR_sz`SU&Mw*2I$mzCi^ONd((Eu(Xfu9reloqG9CRrEyvp{@_wbn7BJdmU zYE+vRHsB>yytuXbC^5JG-hNn3iB?yu(`hMwPXAV5J4;L<`2FJ^SbRj!Lu&5!rRBjB zE^>nvRj%M5|W5k)kM&5DRrP>t4H&obR8Be-c$s z?~pu31H{#z;NJckO~~1mw&@QeG1|1)2?CX9w?! z(qVTnH#=3V38klCnVr#(eJ>%EX=UKb+9e49Fz@elK^d#nPcBMsGs~quDbqY;scP>y6OuHB7NJ50#^w@59 za$pSIqR;kB#7IK}5=L5XgQ&Ahoh&KGUX%+rX#_+9=%SIk!W1iA5o>~dywvfIR#4q4H zKUuJBTc{bfhv)~9z+b{=LUVVRRd4&mf~!S*8;yRtSV{OjmT}r) z(l2M|6M581YZ+J*L>(Bmb{GC)BKNJ2F4o`1I*I$25;|wU9#6Sm*JWkUWxl?$^g_;y zhFZ(3hs}Dl=d9FkMEZs+-hqKz-qOu3015iHRx#43FyBa_8%}z=6{JElPtGFK?4LL( zf3$*x&KJx%)*oFehnisH8506h-)U;w zmF`7FG7-e*qCod!oY#@7O!1{+bG!BM#F|0x%Iq zE<&g+Zcjnm>F)gP?)izn3g3ir+gX5GmpP4jE`{?~7hbEuuM~VnvX<{VE+&Bvn?Q(2 z6I=SFXqBD)(%(6S53L2im(o3`1D}m?uCtRv`GtzZUhEaq8^IHv=}S@=*fcchdGwFjm~cD&flS zvm?FFyxX&TQ!+4AIqISI-CudfDxKasWLI-SXgS^;vHg57PH!Uvw_g2Pj2T+2)vO&# z$fl8T0SpTBY`lEDx)_QayMId^VJ!qRu*;Gt0bXYaZ>>qj0lGHF6PUFX40}uhzlNig zS#Xw`n;NSt9q*sgG<>|*4^y3>Vak#K{+hw?J4xs3;1x9AV%%CG*WIs$!NXL4~5I|X$F3b5TdLvwNu7LGa`z@N+e1AHByw{}S58B;d( zQ$8kPM@t%V=*t~v+Hxko1t41^qs!4R>|%fES&SDtnU_nq+tNhs(aML8H#Xjo; zRTFbWqK85}+{sA|g?WEB>n%NW2Izm7E>H4S z(WuAlny;Bzm0d+?c>aQPB4KA4R$FvQzY*}>?34Gj_i3$U_XA3b*A^2!nk8x$CeR#3 z97`Vp?dEgMYKG!UN6#*~dy%Qe{4^?wr(4`{=@FZcx`J`UAbLdi?bh(qn@Rb_Z)R| z)G=Qh9r4B!sfRU_Jdg5ojJluM-mlIHIgYRaNTl1{WWBbqHDeD) zB6;avkvtLC7r7Vd)s)FvL7ZS>X-+Y1Sg!9Vc`#fzQqB?(aV*NagNa|!$nWP->1~aw zx&v-jn5P1`TW+)am*Ex0vx;@o*>D+>p*n4~>V@q|%9l@n%!%l&zKjsuSwHjZeq<()l@tsY$d(m>~pkh50*PSdZ}W}P`lXFvOzu^X%%V0WxU zcVRYh+^i2hGiv8`U4o zUDJFq68FMGvR;6GsXN975}S567m+PqCi?&(HKyujnp>piVuGf6sG>@&W?%ShSgKoD zZAgQsDyzu(>vX9~cs@+HhFdXYz+7Fj1Cn3d%&vd-O;7E(R*{Wi_j+YbsxBmG8y8he zlbQ9ua;Pv?3Z>*Q;pbuHb-Fv*m@oeGs64kgdgFCG#R*>)dr>&*#XHF4GaxR45*%hz z30G9rEq;tH(;2v4N(`tKJT@xzqnIfWHliH-L7J<6V+E9jV}~8->Fc8na3z`U-F74O`~B1%gRgwTN(7Q||eU zJobgh%>kKb-^BJ^Weqq>d5dDY$W1`=2d7FfN z{4bOT^s4^><&l*z&n@TqF<+NEe!rA6UdF?c$mtcG%vP%Ns)%qp+m_v*qWlXXlSm~Y z9wU}qc<)g{upY!I?2d7CS&G^W8zqW7U@^?*>5*c0&NZC-LVfN+xUErJf#Ly<$zN=V zpImxGjlD;SH?DtI{kmn1w_$XQt(&Pmey;v?=_C}<@Fa)Tpmuy`JNDedwm?r zKV3#NqnQ^%%(}gfCf(-P3+yY;3g2p#DT2SBph<}DXv$rg$c_+*U1yEG6$YvGY(I3P z6LHi6ysq1FJ&_UjW(d;1gPGW-(A}7f5T$qyO%HUUZpA=D(a{OjS*6%tNTfune{abG zn}gfdw_L0Z5b0+E~t?ZbuQg@2A9fLa%;w2k&Gr z{qJF0%~tq7k?73{0^7}$l-vk$yT&D6g*pzX_A39I?2A}uVbh1IE0}9ueY2)F{~y0h ztuOz!?DKzbcN4$?|Kb0TBF`lx;&X;}ci5P*ger32oX`zxQWXFW; zM3&(vq3^VrhCuW&LI@n8W}P|#kghQ6aW^gc``29pHga*~`j%W_)Pguz`*0hWfq>#Q zo%d?Fm%&y|(6;E~-aug|`&)sRP9quG_y}=AMVM$ScAqHnPvw{2AU-I7lpDz&YCa*+ zFbm2XDjO%AD%HSha7A*eF;3iZnj^p58f`5D2@bp3PFThX9jGj6241RiOfha9apgCi zkf_LM-e8?x#;}PmhV{9Rn9`AFOAB%pt!9=qU94l*A2A*v5Ab}hobAk^QMCGZ&IE(z zb3{>F$8-p*?{YlC^BA{$7%sYqA0J7S#ls8oGy`H~RqRchSq=+45_QDp>}mSPe|$E+ z9;$z>Yk_t=@N#`64&v~4wH-4KOWM6pf9F7ic7KJ)hFJmRcY`ptmV#K~Yc)gBU#-_k zi+qy_3=y*STi{LV&urK5NKDSVNG}skJwIFrL7tHh5)Wf#OI)*r(T*3@iFZAcC~{#- zY*A5w+h#*j`TpHT9EU1kgO93d*0n5Tebun?%ce*JX`QTKluF5f!h#1F++$wE=^l+D5AK8-WoRjX_{z~B=#$5yg@oX5Z)^Ipu^%MylPlr~IV@;(XPi4jwb-~n zm8vM5-`#A?s@QA78H;W)9%blTzY;3=pcvkUVT51wHK-mV?$e-UQgS+BwTN3BRXnwx zJwdiQ*~YM9G#_tS$1*UmXtlVCk**EGX)rsX6k6V^lZOc?T*a(7b*IWSP;lNucQ~V` z$GV1MvaFqIl|OK9EZ4i+I*hrcKCBa;{gUS$WjNyXCEa19BTqb_!=YU`Rcr>*9E`=Y zX4o2>7&J7OHJDXX^ES*9Jz4$8V2dTEu1ceaG5K%b7HqJ5nAAhhXrS^pYz-e^tApZ)757b#B;6KE~=${UJE$)8ypTbU87u=J2h@zoRoJ<*$dp?C+D&pZA6NSBXrQ<4#i_vP9@1bBvkoMr}s@27z@tfHcnfi*saP9XGukJ1gtzK zTFepyS3hFzC!V$n$x&LIDgR-++9k= zBwjLBW4^H=z3&4yD8Nv7MR2XQd--b#xRpLIH_nVU9Dc#RSdoLHMaLN!1h03Yu_OHh z4TVS98q|+XJQR^;qRQ^c>KT~XH*-Q0`}sHQ_YcGT>z^;ohUoR(P#*vjVt5Z7F_(4&O@D7< zd2I4f8c|8e42m6ROO{60i802kMEvCj-YPE|ZpOpC*{Bw8l^%cl^%JYMf(~fx7fdsi zYpiq#I|F?W_gTDuYwg++WS{iTw4^j3R>vF7{eq4?%BdADz42(-rNXWeNnB7~KjJ1b zYhC^lZx~d!xNMwUVQArM+muD1^SHDrEyo?k@7s;)?BeyQ<(2kgS_lfW2+jycl6zS5 zC)09};ssT&%b(P_G+{)%H-r&(gcx)o__nq{5EHiCUPW5*O;01Fcq(>j*LNJ2k6`h|ix6 z9)Kx89|(`N~a|lF3Ub=u$Zrs}VaBmmgrotD%Yl z+6^`z1h+CcG#l33NnTMsP2gMbyb5VYn_xRTmd%T(Y70QOkivs59-U@ z+Qi&E?vc~RYR9pdHCXPnp3xn{$~YnO$WA4vss%bZNJTlwb#`^1pH z+rLaMc3NyWh}bdW3aZ1kk_^6~YX%a@p<0JU7SKfx|M$=xqacgai;# z>xIYcKuHev_O)3yJ3$3ih1Ph(TmD1<>!nb0q0kI+FA~L}zA!jx$uPtCNnrpaS)L2+Fx zY@PYSLguA=ZX$aJN$4P>*|F9+wQm}IEugv_cgRmNf;NTK0sHr5Hwo2SdJ>U zNiI%-P|S0<(5|FD?%TJ&ETi+o_)W+hrXU1h8C$3|_~9=Dl~5KeLdAB=LN0ASc!M!; zph%khZ?07Rh|Hiq;3d2=%8MQJfoxnj@w^-ow6vf!g8`g3x-fPeswcgGa=tM)ukK0) z=3baiQ!x7)?{g>n4YTMt!u<1M3v)-;c{kRmw94EJo3zEi9a~;%>iOcdgGmHw#>JM; z*#Q;r1Nz)&HkLo_E9pu*l9)^C$YxcBwRKW2D7t4*8$NICh#Mcn9?5nsm~9lfR;KtA zr+PC$12d5`9Z(FBpw>w^4b->qLRyuy=n*mM^vJRyruNcA(;}*7-TLPh5e{eRK4h^g zTX*Bs__*nsI-qPk|JjZ85%0KZpES`_=A6lY8m7p=y~vO?)_EQf+nCuI^ThF9UypYI zHCy3^blwt!Q-Yxmo;_$q&>A#xhb}(Jf6(=U52`C9@ee|dX(x*-Nhjaot~gEbN;xd7 z$&ZZQ#dX(sp{74$`XNqdpbZWp-s=$%r^+=set=*JahLQ#_I^W!D0bY%r1tR8(WB5?`f_AG7A@*&ARA4(2WA3qsihb#=01{hf$VHq%9c!|!ld>vkFG z23)O)7qaWKaqEwlTT?WpeMr=CPuR**-MHB*FEuOD7S~~IzZ7v=6+I$|znE93em=5e zk8D)Lu1XQ9x`I;p@c@*0@{L3a6G8>oeh9zzh8%Gu<8Py&wWS3~QJrtEVuhr-Fq2mM zg9kX*G?55fc?E?sP}G9xlMJCyS~VnT((t!nN$T2E9=j?Z`Fa3nD_6jcG6*(eB>pFV zER7v;fi^|kI)r{7KqS8Ljko6?yP}LMFZetdTTKM?mLk*da0oFmo6Qv;dD2cfzY2@^ zmxl7)j`Bl24iz~gBE`XZ{X(;AA+vr5vQ0UeO;glYOQUC_=1;3o`SdIWG^5A|Qr>sz z%c@!Ind6Qr|D8mJHdPbx*zJ8echQ%QY zyKBPF(%He8=YBws=BS>dnSN1k;N&7MMI?+Cvp!5}(DWffeFbB-a2kSULzzbxK5!&U z^|%Hf*AH~^cJnNxM+9Wf&c-FQwfDrvq9pcvK`gWK(tS0%nin}^MI+7HV#>0kYYDU1 znpofJiMZ5?0aKk%2^Egk7+&q-ja02Z+Am2KaT#+AtA{5;NE6moqv}`f5TY)JA*UHH zepOt!7=n$g8?Fq;>~F>49*)h)Y+y~$N%>{(S5{evM;0^<6TSO}Z42~8g84O%=vT%L zI{KOSV|OA{GZZ$QkAL+4QXrF#my1KBPRjB^0j$8wIudJ;dn~@zEV3@=IHB6-&Xk;U zCK=+LApuR`0YtdZE;P$jK*@n)rbSp?q~I2vb1VK*RAgh;JIba#nDc2J8?jj)uu4E%Q>9hjPS>hg#7(p5v&sAA!%-to|mugJ>e%5 z8p->0Na45aKX{35A3aJP`FCREB3XB2^mJN?rX?bZ$^{$swn28%(w91X}&3GBm=z9r^hEintf` zD<~vV4I$?AP|nE*bX-k;7FBu(CHFqZfTq1SI0Xi{(-64p4+jfCVx?5(I6pee*eA>H zuw;mYc(hT~t)$<>=gTXYbiSpaIn%i#8+0y@mbV3edUP{0ZTKsfR%CG0=PP2`5_SYGa-;Y?rp)Xha{mu-k{Ykham zWTNd#o`!-ZhoNM@^}|7xa?#=j&0MiA?xbY0iWd|ew^ytTl7lkC_P-v?kHCF-uRmn< z{*72O@%uX$yFx!aTkW6X z&o9#WsMmZ|)4>6Al9Ei#tQdFD0kvCt+63K4yF*BQAfy#sy?)&lOet)0@K*z=hD;FW z?l*c!JoC}%j zBP-TcEZ$KQ=l>KXmVS1K)K5c+r-eD2CI8r9M9=eJKGu25EatV=rLIPbugWQ|7OM{d zY-(oz8Eo!%B_!M(A*cSb`QQyKl)u%10!8*DF8%i^inQiNqp`1jqMoAS+- zveV;s@w&M>IuWm|RQtK+rOWSq{48j#$`eoj=KSAWHB*(T@}6oH6lZK~*wDqM;#Xb$ zUcPZc8|Y4rh*(SBnY&QuE`5czIA3Du%qB!y7_-;*QLZ#?96w2UhE2FzA^mf1y4!k1 zzmg>P!@->MW&*X}o@6b|^j?Yjo2ecX!8Ah{$B#!BUbl3HO?+}W^V-kvyvW-3Cy=Ur z-FXA6$AQ_8Y$?bls)m?*76F^-mV}9O(QY-SZVA;ZrS7kT6|N+@I7CP5R2Md&bZm~u zk5#^&`$p_kCkcmHIO}+Z9zXKurzR+SArgcc{{oS@Dm%@b?%zS=hT_eH+X1DJ?F)?Dfee_N6 zkiXOL`?U||iMrP+D7y7!`e!XY4^B%s>>=Su=Sr&!Scjr_rPkxpZxn5#j%POXmVZ5PYH7dFZ^;i1y|uUP&rX{VeXVHDu`jm} zFbBaP#jg+5Qxe!7Thn*Y2nU~;ea^sDgZ?sLFxTE@TW8L6^w_x`W}NhW&J?AaXAMys zTC0652R$dQN>(UlS{PqX`tVuORbQKh@4VRAnfq&~6jLQ74#SBo>Xvt-@}6Ezm0jM6 zSqActxDtI|#c)jfoNu0~%WO^2abS#iyv|^{o}b;w$TL8ZIi6A&Jk&rDnQxRi^;aX0 z<-^bsXMgf(5j2g+378>xhhOh8A+T{|eIFjV^dxXPmO^XJbm8@4gq&6bht zK*?Gat1zg|R1KN)+HiQl>p`pq@k)&Gwy0i#J|SG-SJv+yph^J~9v5mfMKn&YGe&@^#zx^>nE0Tgbh| zks~)j-wIpAZse%v+!AJ~gi_g1CFS+?r^jg(uS9iAM{DbA8v}D2EIU<0oLPq(qgyv& zdU-U5Q4VhVj-4`bXjHqdo7KHk8h3dhvDN${hh*aPK+>vr_N9F( z)`e+By16WOb6dZy>i4GAQ4T2M*`qdK(SuM>)vvbpR?-QzyLSUyl2nzT+MM3u%TO~T>tFl#Ph>tNr=ptp{-F$V zgG0nl7+2NT`va#BR#o($*na^s{)5D*J#i()U-~{OKfh_vlz`)`J2*1l7EoDxAp555 zJr_l_#BU@%=Y>k_`!2#(5hzAo;TTc3UghMo7nDlxwq~=v^Y;^K-23R+=76dNzC^AX zV-Sv-QVcEXLNT3xFU}245OdZfVOl*0d-P12YKz3_oeXX62Il)6BJrP^7k}uF<}hV> z?OmiE7i6(wV|pRw@XQy_BEuG2F7cR3LeZsF$D zzvTHW+E&gdzk4RzDTpzHQ8ziu4c#@*1K@_3MeyCIzwOZPEm`pwd+?C8a#X_HRLf)F zRw)%5b}?rpCFp9L8JXJDhU#+@r)`(q#*@Q9?_Je8j9 z++S+B2lx`E!c03IYefVW_z}4-7{r4doS+lxQ}$3hTj?RgH?J(9a$fw=d!Ei@MgLUn zs8@K*HZ5BXA&S)Jb#6Poh4yh!(CBKf?Ep!f+bIo;I7 zPUTfY-e(xz2dNKE93; zQ3W)7{t2%}bhLHR)OUtGFU#oFl+%c7*Y|tQRlA8)1sZq^rUs1EAROedAt=-2+}TeK zFf0n3U?X{mrn?(x*_2x0FVOQPDyF-aW#*GAgB-`858cM=$NsBvRZ=OE5#qwH$@Q26 zV$1~2bM;_P*N|)Bs`^@uSzkT;62nkPgqj|J2fS51QKO58K35Q$q%XSA9BO?RTKPQpNqr9(0p*Slc`O!9m*@Q8q2c z!8nn%^ESfkxtw`s?hCfx#q8EvXSBQYimPg|6N3{mA=+OOrqUkNv0@FTOhQy|@0Qe%*Jv5qwN2W1(~G=>yu09i2^+{yc-O;(FB%{%ap! zX%{MdO2rMbHJb15(bZcXWSdy3{BnFOxRcwolit&O!d}Pef@aqSd*jjnhW?qPIj`FX zap-yJdd17fzwWkbSHEn~bk4$7^XfnA_a%D2dW&qlgnI2ab?ZYf95`?Q_`uQ>x&{j5 z#X!xJ;g{kc(S^KDL6ZWOS2%31Xx}~H`93C^kK2-Ue&Lkoqu#2PLv~~9Wae0P(;7Kb zW=^-{Q+sCDZfe_pqf?#MJ#^V|C0u%Labi#O{V8`9tJQAPR_GYVlCD8(PJ$w_ zZe95v^S*h_8Y@iw%OOK+11?l=9?mudusvF9qAPf4X|c(Z5=2o)pX<2_@kh=pWfxuL z_&1aO-JDkvRIy^EsEKo)MjX=4NJWmXISUJxc2KSbDj{EEvLhxY_JN}qWPq*5`n^3$ zMa2ZCi3F2*(n|&3fRby`pj4<_pje^eWn#Y|rLq_it85Z;R#KvmH5b!RoK5$tl?r31 zJ5_ENQmGnc(pZ~G*?UR3iR1l#dQb>nhxLiP37TikcM7H!3Wq!M$ptTb`pXNY*t9%W zqrDQ^8a%|Uqs=zfo|&s#&#`a1bz(hOH`gz%+a{!lHa5tqhi+MxdrI)FvI&o7yL^HY zYf_NIi!~YX1Bd=-e6L@~BOpy*dp9{~HECnvw8bUWzgnj^(n9$R*N-X5Uwvm3zM7-^ zlwhKwpRT4cC* z>d*l1QuTn)xdQEHibhOctKM-l-t#Z+zrlD%#3`H9h)^&CHEf^!dty4|G#W$GJo&fy zOo2o=g=MC0J=0-~=ItKM?^4)BV)hah{lQScxQG9`8>RV_?c3~*Sp=a=A5~{J=!qC9 z@%kO7HhkmafmCrsc4OTfRQ=(ygP?&JwOn(R3;fsk8b3g3n5IGp8-vcY7{yRA)E>Pd zuEq~0i{@!(te@$QM2GRS@Cb8DW=-F0anID7Dc0E6*QChNen0ZQ$<3;`Xq{pnu9~EW zWp|EYs-6UQ+6-uM==Au5RJ!`eQFE+2Ib65M7(|4*%4k!rbQZ=-qRGapO8lD2GAi8f z&iFB1y%|*b`WUql&dhB6D@F(18x=e>T(^fL!p`uOL_~ymHJ7#ZV>cX_0-DpZ(@0$YE34y#4o3 z^@_0Cs!sc-X1S=SxZ9~L(>{&s-n3I>C5JpD;G~VAaEIwvapCp}jU|VElX3rp=`@`n zD$%!ItFm2^!#|{?M2+QRp!QQ-KyY~ctIVd`OEVE3ek^3MuQCU!;yCAw#bu&v0<%vV z=&FMBJ~Tq=7A#heD1w}cN;fb19%!%#yl-ZGxphM;5%BSP@679mIz!Sm>s(V~RN7N| zq&0Jx{WS>zD zV1{TYYo@Z-JwQdFrV<@x>MJU6{8L&(sNa5#PzKOjGW#h%{gs8wi12eNe@Njk!t30$ z@sUN`tzIGNuEbeGH?LUzLA3C)y=UmHy2jcruyOdwFf7`19?9(g3WCw~Hi;qj+7@(c zqO!(xVXkMbla>oJ?%uP7i7vs0Pp*;!)?GC3_3q&=1Pa)9(0+CNdL!+9Z;mDhyZ1<6 zatG}B_56I3KREvzUhV;A!Mkt*2WNVUO6J4iOCl&Z%7&h&&oTX0DDQ24tMO=s$mP7) zy7O}_LhbsxbrjFIZM)lF+wrS1JtbH9y!5BM*0MtR7<1iPg^0s3t~AAD%be?WiJ-_` zZ`)X5&^X%%@Td2DZxC1$v@5s*U1N7FH=>o(L#X$I#*S?aZKa#)xb1P@;Jr zG!o5oDrwfNd7e(^ylbEEj;$`2YY;*PVuL^a(rX}1Dqk@CpE4JpL zW$JZ-`AY?~haf5&f883ZX?Gl6?91L-lw3#BlxAx9N31ev|-xdE~5ML7(AGPtH|WFGGmKdWjh-iTR7umd?4KV!7B|NAyye|3LEj|Sqj5KbpOs8Y)}M^xw|tl5ZJfWcP+{4THkrnh zo8BvstR)xGniw07{qLv7Ujf$MW;hbEii%E?U58>$81!f|8}8K1F+Z*-z8H)L{8|VI zh~L~d<0^O}EWn|>>*$%gWSUi6aGs@d)lcbuasA0n7r88%Hn+|+MV1klVrvgbLERkI zopvvh$;fCh9e(am;?q*8S>ve^t37tIZmvBQ%kP_1M|65T@kK39KcJ_UF2z{wiSFsK zY(KYvR~5U23{(FB#ZK%L_CdO(LSa(3ofJPd@@reuo6)UXzev<4X_lz5jBKUobRRn@ zTuHc1C?pDxKRLuDSZz^PzA;x2X^>x(dYtpWCQr8iOrGG*g82!NS-L&e{Ap_DuwGNl z8FD9p`wW3TUhwJLkKDfOQQCVtCxPqL)MRY9paJCJKc}4}Z|AmB)nUQbs7?pBXw*~h z6th06am+34EdO$+>rCEI@48&(y>;yP;nk@Tt_Y2SOq@qaij`Uelf2pETkgJ5ORtO{ z*q&mOeZm@#9X?ncLepOP^~pv(E#JEN`#VlnIU6s6ru?GHhAgKM_o zE8_$ALwAHeOToSj$NtwC`{aL?z=r@9Swl#%Ms(~ybcp-lX}iYS<{DsAulNE@hLD+v5LaB-E=q)?Q6+~+R&i4 z^qR9i^m@sm8uP@@wYMODFjx9`eu5_Q@eYoF5!dSq)=DvAZVt|MNgFwC(S-|c{o5rN zJPM}{Ej|$Ao7GBo^!n~Zm7rC!=no4e?S-dF{ct6gdEnIr_tBZ}**< zgj?F3Im>U14=ju}O3BNHey+{_uNH#tmy4# zq?a9-n`tt6F^+TV03m;QHP!Hab+TqvH1GXe)kz_{`9&{tv>hpvHo6{NBfxRP-uT26 zP+4G|!<#F2TWnP5H8oDI30Y)4Dtv*z6Mvg{+~-*;_6V!AhhWXKC?*d1g<-iPUY?)=w4A zqtT%uq2qps6kFs8P#YTD7_kbli7U&xVX=^PKI5pR*YoPy=0^jNp{urWN#9^2)V6fY zMW<&PbvY|c(rk!E-Y&=IPCFB@`9rgQM4~+z*^%1`Vf+SKlyjoi!9(2sxe~-n@2FO# zjCt0ylocb}ur{6V*sdJ=lycJRhDAq6j0zTIZS@^Q9n2}S@LO~lI~0!0(|HO{X7<*S z`Ijqk8|={4rD47lKs%fg@`UIc!1kKcpQS>1k%4!bd7yZ1f4h#Z8Vi;&=U^zew80Qc zlYETr@*^7{AY0*r-_UDz_{cUqV7AdFeaC{p*R>#8Sy>x;n5Q;GmaR_6Yq7(CiQKI> z4GPibuL~uxajF*1Yf;#v@3do$pYVF-)BAM~B|4aW`kFpyr;%6>3UR?4*AAQ`=C0p;!0OhkXN#d{S+}P zssWz%XuPrMCs+CNp}|oH8EzWu`BobZCWK}S*wR`R5(_5@|AI}!OU7A{iR@>9I6_i| zbZqS`88!1oFJGGzLRwF1#$%AWX?>KPm|Cm}=wj}=LM?OiB$T%`=7N;fJBMj*P=)0; zusY{XF6%Nou-&^eO)qEaQt+g+-#*ir>mADa%`uPxg}T(jyLT^IamNiFe)UOJts$^f zWe}}1;Mk#lId)Lo@HiZRzJF%tsT)@broSG#?GCBqy#dou1kdq2_Yc~`xGFJ z@g~;fd1zUMveEM0qg4_Ht`iJ)23XrSDiej-n(3-V%4TNWu@PC8+L!Lwo3n>hcQVhM za$DmImw=jDzF;Q4kkNsuX=2O3@|E_v^*74A^78k$)}-$-vtj4`)UR(9efc{NL}G2V zB9GlWEoqzuJiCYD&UWmmF^GAM4Ed1!11-0BlcOSnS80wNt$7_OYiNbvSrlhcMq%e) z!Szh&q^DmtvB7ybtp-oGe&%hZl8Eb?&+1A&mYMHR%iFQ=xz06L%_?+=zks}|eF)#M z#X*&V^_o?hYXwi!dv(9QNifob_PnfTkB%9>6S-cu;?87ZlZzG<}V>RJBny{6TVhu1Vt#PDPQ1ma z{qE5^8-7ny0-?%7Iqu#_+x7EK#C=}tyFM}g42^zHDg0?IUQti^vWfsQ>w?I%%H*%+MKYyje?>&3Ca*f3`5z?(>#T%WL;oW|Ky!fx7@jt)fB4INkVS}MV zHU9EJaL2bkzrMss&u{EQMR!u_<*QfOl%<{L!X5{w9_wXQ%T9_5xmWPws=+EgL^Sr| zH93ABz0+NVcJW_Tsw2V>Zp12{CU{LSl3C&aoI7<7_DDz3yCkb>$J-X%$q*hsWE=A| z(au~&tJvMyUrZv#W9#;x%ka#vLOQ)bSI&MR77wpZ=QbA_M{e z?@`(J-Xji#Sv9xy)gi~hqgzzQ^pDyr8~Wto)XR%DC|T;{yx_YV>b!|ZhHCQMWAu{~ z4iKVIf#Sh*4~t^A?WMb($I;QK^If+85Hpqicxft>jB6@*x-Ds3CqCyq*}84N%Z@PK zFViS(lo8WcV?9Gg6r1-gc+LAE66)N&t zOOL1CM9>eoo+>>J0E@5HZ#Mo+#vuwIoAPFp!ccCfZ0 zG4s3Tlbx@o$B#-@&;+0$y7j|sE=1Yoe^u41eTMuYL?W>@A#Jx6`~S-s8praZD2KLE zUksFFDz7Sv$Aw!!yMl)T*ih#;K|)$3Zbez ziOv@;_}_o9T>)T5HPi311d5MpY6`wRHp!FB+RrMz05zcToR2lB?o$DhIZVMi6oKHu z$_f?F-n&=ZA9m@x%(G?L=|o1kxVeBel_@oFN5cafy)QZa=Id;k+reFqsOQ{?ADWAq zkZ{xv4CGorZ=4g%{`XO%mmg{mdxi-noPZM!3#{P1Je`7+hLEn@y}az!ks*46r^e3URyVgWk=%?LdIR17EG4E;7^_Ujz+-2eIWqyP(Q27$)^`Cz1f;Iik} z{n!SD8c)JGgXPzi{`g|%(r=gTl`2b1J4uSY{`eu%H>E=V*~Vwx$f*@VIp6*%HT3J> ztQ`AQXTN+wQL();=l}Dv_Vzh4Ilpf6>w24C;8G2K%AfUZMK|cvfa0Mc)KB=v3nW?D zWFHf4PLKPz%$4b(ylNn%aQ~&zM7j>HVC$f|>5r^@=^0u{e43$=k(sf@++fvidiuBY zVsXFM!5?|}l@Jy7Cx1PrwagT<@-ayBw)UcYT-=q(N6qu!J)2V%Y(c39uj00Gwl-}) z0AV0lC6&+rc=|rcEsH;-o2AGG1#27s`upz}FniW*AM|po=L8F$1ENkC&TgR}C;eGV zrW=2whyS`zX~-|fl6OW*3ioIH^6SU?p8fi$%X4pwMuZTr!x3qWgkK**NEByR|z@o(SKQRYC|1bKJsr=_o`u%Tz z`&#MxuO<51-~RsPw*U7fejG8-zp`$Gz6*jGT*r>dusACFrUVIOSP);v3!;-rpVhzj z{oW8b26yBvKmEuS6%1#yISX8Cch>Ab z(jQu*{P&C9I^4}&Cqg81QU09a^9i1S{ugU17~H+(*bA9oM}P_wutX zl`lc{M)u_q;hleDxXafLVU)DfiYaj4{J_5`X`_4KzIpz9@wh#7rlXOY3#IfB+D%IM z$|KBbx68fAwNOJ9bvGzhPs<(nLM=?j%xio~7lcAbm zH&S>2GBGaXa8X=|K1}?1FPM-%t5FE?ak)D_D{M~s&);!JLIT3Mu1e~#PEr)JWfrdo z1;Gn&D|4)0AMLzt6EY++lic7wAo3SZk@ObTlBUT@=h4LokB}pG-1W=${kSCVNG{|W z?C@4Tg=;0ztdpP3z+m+0DYx(s4Sk7@9f+aR0Jo+}7PEq$4ub~27nTJET~n&*m(AO} zTAz%Fh?AAnEt_HU%TbJdK9D0raK^dbblbt1roHIOy)+t8dx-P3=JbT`%fq&;n7s$! z88K;SNpyLjXT-wXPFrokz1;0@@PhZpV^UBbJbjI&^Tv%E0{7TjM^DSKbT0AS+4LKP zV93dbN^wWEH>3e%Z z%s$M_W%R_K{)V|=k3#eC>F*7SKKkDdXy~EY&^nvFw+DUgOlSJ=<+&0{y$=KQDGN34 z#Q9Ls$NqbkDrLQ}ciN?(n>J4K49zJT)cILg_U+tB(~JdC($g9pCWEQTUWSXk6i26~ zT{GY@27+ywz{X;_mx=0ODsadYw~$k}=e zId#z<9${qc(!B0^vdjONqZ9nax-2|}xz{r9F*c6y|s@>mh-hovx>ME9U&a464$_WW5qy@a~1Z zkkb&oouLmbyiQ{Qmd~MC47Vt96%pQx}$JLh3YQty9X9!8;VOlPk<@gJaK~SmK3kZR z0%x6@PAQB>mY1>dt@y}nv2Y3DenyR4R$UHEpA%Y-mA>#0d9-MH^3hCTtUmrU*=Ra2 zxEn_fA3g&I8CGEP`DbI>Z-NlhblCHV!yb@LgQb=gmsm-8+iDU&x9v?{m#Uer(*u;)0vCK;vySp}RcGBep|DWoBLj&a=crTMO6_fv31uIX2}!?F?!5au)Q^~+n_K!8u$o~in?IX4<^GTGW(1apXXhE z+VJ3sFq{x%6gRH$V`iApY9I7NW8IF%y7~$x9MgmQ={iVb#ppsaI0a}uB8o7Qs3e=% z78n>P0D7$JwK_R+5HO`^^dP)lZ;9ZAg!5srk1&KdnIXPm+x|=Kf=%*0!^EufZra(G z_%YU!=$67y;Ff!7&@G>kZh7AKU$-=cUa!OdltF*1XC7db*`GA?XAE}aPSOq)eSson zHNdDYc>Di@h8FEJ^1)28_n%zt-fJ9AjDm}@Rbr9J^ziz?reG-1t%Q*uz}?%tmG{4H zH3)s3LedQ?swX-!5pD(~>GmqNj3kA^ONr=chl!l~R;D8eZ^Bc}YdN?a%B`6^0GN60 zo-G3dVkQj;&EZ}uG@$y;yPzY%Zy#L}$_ko3S3)x|R#-deE_&tOo+w*yymbEj{c2+Q za?tL>XJ8#*wh!d<+IJ-@pU8++o#2nMz1qwN_is0VJXeYMBF~OcepsM}?*?j|N^-B_q0iiZqG= z#Qyby4($c}E)o=IrDx*EhpIIFd971RtJ zLRr&8yXpRl0Y+QpzM zfzS=IYP9K<5p+ugHOx{66obJb8EdQs;QQthXN5YjD=bq}x5I%z&{&&uo5&P8eSmnR z;>p1lO4u!EHFqK7sE$@xsW`F_IB<-=w;w8{wz07>?EmlpVL&y~uHOxZ_=gs4KbCcZ z^HuC|dWIwzh4uZ}E;BK&VUzxZ$lV7HutAX}EH*wKyASi6G@xY^@3f&CSkt2Tqz}T> zALm!n8naH{$D#Vvg9?&-956JbkVfc_m$ZkP%>`@!E(ZlI7>m@IE?Zlz`FsJMXUnf6 z!e(b@=b%Mm)l|2Wq!783E?QxI60pMl5kj}p;10 z5H$3@h-@9ilz3TK%_#T5-wCGYFvR0GVF6ISJR5F32023GoXLlZLA6Pl#?OO-ShRA? z10WA6r>YvNL5`74M+>3|9-wp^X+ebXZ&X0f=rJ^*Wq-apr3=uNDGd5qXxuO`s8f8i z9Ym-%GAwhSi#&T3ZXu-Gc@F$>pASAtp+Ph1aqgiDtrO47yl88zN;ZyFRaI${;qaup zZJ@h}knX0Zzvc%`YHk90uk_TP0~JP{+B0spo`8m!4yeeA7K(dvhn*5j=RJ=takqnR zqRnKIl`a;>(D2r&gFZT?X&ZD_gqLWtlmQb*+EL7~R7fTdv&?akI16O+7Izq$*q_Jk z7+hdbkWpQPV1~_*yxhf$KoJoz|Dtr-VG1pgPZh(FvH}^C8RaVT;%C6^4st=Hon@+| z!QV-9G^&|BcVfakGkPdi8uJ9L7Th|F6K6|WGm@k=bJ=e4Hv@>F;ghgfYmg)c!_v9n z;!>!p6AvIbKEukt=p|h8AVy->ZL<=EWXEJgD@u0kEgxDHi=R@gZLItXt(lFW@B?1w z$P=t*M3=8F|c>J+=BRS1-`nn`&6I=y|VOEp+FD29%A_@yh zPP(+0wAo4TvsCBL6?5Hdw!8+~aaMo(^wa=VW~vyU)<*1|T!eKTvR zXF&<_zy5*RNeWCjyAQDNK35hO$u`4@75vaC%dR){n8E+Qo0b76zwV4DV%gP5UOD|A ze0T78YKbm#HdX*(hy5A!t_dYq0aLC-7Z5t~85lR8Yjf`Ji3g}PBxf_+iEecebD?$Q zh)fRQ35r1)UJ&73PJQ?@2zorxnX3pBeADfb9b(t$#6x3F@Y<01Re;(pXg9MHb_Xg$ z7FcJVfdLk-T3(?>PeXE*nFhmV05l293Uq&K@)D91|k@^<^T5CPq6OF9m_sf7wdGHqrstQCGV2(iZm^5Q4U zLS#}+|2l(~T;s(DgA|oAv{4@j)%OI?O`@7?r=shdIVm0U28^--_$8*(b{F8u4cr3P zpm`uGH}_@4^3upM4XBM2RWq)AdKiVF(3JI>j1S%6)WW$(AIrCrNTJnIs1z`lo|giOXQ+ zkGmAd(wx(*FJeFO6ka+cM2BN?-+NFf_%aA)QLaRN{(P+?-!@*P(wcx@9ll;RJ5W&r zO`C?G9b*vSh7@4;4-O8Fs$phScCJQR)9Ic?MwBvORV+8^Voh5mFHnHncKo+#1n>Q4 zeif(ZO(nv`#c`}UMCBXnX)&F|l&jEb(g}o`2AgD=LqO2Xbl;4mnVH$#NVI!3{Kt(P z31C>{A<31bo_-bx=CQeFZ|&Jj=RdNYXwN5jm8BD*!@%UF`1jgk?+nxXGTF}bov}Sg zi`h=v7yHq^@FDGsmqc7@=3>+0*hY+?kv(omRWeB`gd6d0R~m=5M`tS@7?miCgIMy(IxkHG2=zEhL+dn^j%;k0D%oDy_<523 zlYGyAyH~>?j2DPUfRt&Z!bzei7iR(k?`t60cTSQwq50FkyRq^OW@RNkWmi-64jY}Z ztExJ_!gzAm4S?OueS6GP4c)Vk^739u#1JgN29p@I&qZvziuJZw`z5(t7UsN~5Gw;fo#U)|1wx9NRgawp#J639^``Cgl2apwfYvvk000EHe&^isY8Kt zDGxkeRY=8{%+t#-K-h?qzYhXmyl3dJA5OAmV>)*9sOi?y=>PI+;Rh-Hj0j2)RkMvv zHMo~XCFK5sb@H7jyh#=y_B;n{EjdV{tCDG(gNPcR{)eq1E-Pu^M`4x7gEc3^4q&`t+^r{YkLjbo0=qo5 z%6ktRoX^pfHjjVcLb}i(VDBDBi*tqNU(X);^w2Q?i23JObjm{;#_XG@YQoYk;xrfQ zvN{yTXFs973T5|f%DzH4(gGbZ0D6t1xCr7}CP_DKunG`}pd2B5qRzs?!x1Sf(;Ml~ z_wYj=o-_v&0xZhCmu3q8w`6r?vFo}a1OR~%5efSm-l`;q+Ksne(#*Bwf_sIsDuj*- zIwdN-xCerNXZTB<%Khu$EYs2D(|-?GvjWSsiUmtwv2pH1LIl~2D&7^M(*}+UC0c*! z>+27nX2KCs=#Lvgt2LE0zhb1-dh_m`KbkN;M$AeWDi1h_pvFd};y zHyIP9l5p)fV&{BL(a~ZMvgAzG%npQ5K>;G{A!x!J3I>ZrAIF>jArH$KeAKcc^)7mMf~)K+r}_{Z%gI?+EajxFN2(tlD}&5 z&>(EV(^|QfAuu7P+a1ID`mWm&M}a+qSY&h19ljDII|n1MDNR~=72s!%QqUgyj0!8b z0Ehzzy7XUGg8Q$P(Dw>a(|}lH)7HEtO5C>1rw%`%QDc8tLa%|B zr(qnT>jj;r8*x5i4xg%kt$F;`A~xS3Ha{{qV_? zr5W4g{hjDz!tU;-yYB5#Ur{bMG;(vq(!krcoA5G~7l?)oBVmlWqD1l9PI^77s=9Zp z*`b}`VIw(@iOeGg{JAcY^UZUMzz(k?3So#R0S)bI{@B~QX-Cwx-|Dw8Yb($2YY(34 za|u*Gn;mQF%(Wt&*guJ0d!uv)S`^37D=ql+dnBqR2SUGeg|lbxsqSi6S)TyijBlZL zy)l%2B@JYdvr75yV8Oe6T?nYm{1}2K$&*8}4_AURXq!1}T;h-L|B)0BN@Jr=bD53B zbA^Qm8ha}m87crwe*WFn@DXnQ%UY-Am2I`M=ksR;iS9Z%tKwJej(m{6P__HLGT-Nn z@UX)NK9vuZ*d#v)PhYesli&WVm!FUG+K~^w3N_2Q+7vOPq-3qyi@h4WtxH%8x1vdknA+S&xh8K+3rq*l4yV^>0S-KAp*mjjRs-Y&Xyx zsAuP-@7QlPkHx4R->1>cWa;QusUJJk%;aJ^*#9CwMbzEQ~CTNvzB60WO^u{f*41}pZ5HC z?2hTs6Dsnj?M5Np;ZDj1G{D9#)gzsFoRFO_ZT(S98i8`yg>SP0A~!pB`^9VJT$7WR zV3mCm7m+=1eB_3KwLTot-S%N*AB0iyQXEu0!F=54)rVL>mhhjVIHLLOkx^OPjrLbCqv%ey>T~|>%Nul|!{9;-l$$?mjDx^cXNg);~)nzTX>C4zp(Hy)KK<*VZG?RYK_Co*a-3KFH zdk@K941oIZ9W18jB~Y%E<8FK=(n=<&*Jp%ypB$(jVu`ym)Qp(MJq+v;f2^d{?H9{d z?|P0TtEYcpGIzwU+)B~0oa3f+U^(Qs#WRiNO!gilkW&Vnb^c@Oow=GiWC;Df1x)0X7<(~82 z-JEZ0QioY#Y+EMWUA)?#UhKepD0)T~9ZxvcXo;n3DKn#zU0xMzc&NNU1d_dpRlpqy zgX$Py@N{Bv*TnsPy+mw@ch5^A`C=D;0Bn_nqdtL={LJSb!VX z1m+z?WqB(8t%bqqRt)QJ(o-4MC$bdP!q;=tc^KET(ybWRS8gxYom_S@AQG-mY0j%( zXWHXq0L}_NQny;(US&f8YM0A=-7wo_@=6P!Xet9_qK>luYT4PlFEi{XHEoq9QIvQ1 z{p=nS_*dFvkXc2CObq)JI)MGm4B&qNBpk2Zyz@E<#0rKvd)R|a2uJ*i#Plqk@CNx4 zOJ>R?4Okl>z70j0j8x_=hgN&d6a0afY*axo2y}|LYmDRJUz!Egl<;*I0DjKl3lwS% z?%uk1@(FeFnj*g!GmZ0*XgD7>&WVcm32Qm;rbtey7KFtY5Siz_r}&+PleQROB2d(z zKDYh-{hG(00@%lN>q-u&wpByo#|VfFD8&KUElh*3^HP!we1Ul+`iC#y`?HRhck%1n zmbr$hb5OB0=7M<{c3bos!HEG0&5vzm)LD-sgENc7m1JH_jHK$Dwm^~I~>cXoX-pwfCw zm1`bavtyp`+F6CIa_Uuo9oIObF7Fvtl4X8}-uQDZ9v>HHoL|J7baLX`J6)5{{Z8f9 zWmE<=V!8C|-T{n@SLsJ?%)e{V2*q~|<>Ott^Rl!}++0J4#_KP9e|u3*L6YluXdNBh zP4h~v)<@pk6F?+d{uK@pF&S-Mt(l1qbtmr{C*$G6@6W7-NX>?YxXSGIV=SX?shfObq#!Th;8Y7yhEJu28-&{+{;#4`8vVq0ohI(_hSe}q~W-^O2l7R|8G-X@)4-$FLO zCk514MzcRD0?;1-y8e_#N9uJ#1-V(`Zgg0`Relj1?0v$FhCNC5ZI;_Mj4XZGWnVHc zpazHY)YIQOtDFGbcjJ74IomLR+OO^Vy`;+9k9ZWv+?hA< zkkhvlQF?+w@+$j#H?rFdA@a}2DLJBgt2J`??wD24EAMcmHCWOAHf!rayN5GuxUp=Y ze5TBfzsF(aK4jJta+fSEBCZ9EbEk5&Yvv%r***f`(SF&Tc;OSmTuI6Mdp*q~R)HHJH1}wy>B3}?sUUQZS>`sYrf1@D$Cyt+; z6)~MK*I>xKn%PzCWE-=3*K+3IbL$S~#fGfq0&_7c5M%N*HvtASk6R6OQBGwzD3J7^{6MI1*41a2ztRr*gxW@dLG-zHp)GU}-h3@pT3(52^Nuhac{y2q7mqg?^KF)U#|QG=Cq{?e7}>*}(Eb%qzxA zI0LYCR!)I)C0b3I1*Ht`kT?;?1#L!J zq7^(Of`)oVN&*$#R}`KwDYR-isv<2YqnZet={k$SRf^L!J|mU^%suo+$4w-UX_Xv2 zT+_qM$y{PraFL-+=TQFqiTrF^ezW#MPm#Syf}ms^xIJX%l4 z%G0kSz(yzj?_u6=Ubz(E6;uOXZZ%x8s5OwwZ`NPa5gTu8+Pk{4UNQ*L+S7`*0$KON z%=PQi-}Wee=h_?wWhxvm`EGqXhms2S?|&gSdOd&6` zWG!9HU%TX7FN)Q8@@aFp4~(ezCg9`%y92DNW*y42RfllI(<>EbTXd?jR3L>Q7R(Zg zmp~(d3lfGwkmmY#Pqk9P&4b;FKhV5tUIh);#BIE;ej{`MNpmeQEZ+oA*wvQ&z~`V% zq|52IB}pL7(Xp_2a`jGiH{Wdf6q0GQQK`{XK9&#*)-vz%1HS%Y-r*9V>`=L~cQx&) zymB)D%yi?K&vEYv}yhK2FwE-_W75AV2Uk-XDjbLZ>oG_~R&K}On9!Og+dKL(Hy zWbvwzA`O&tG>c*&am_&XNekjQ){~91xdO?M1-l$2_Ld&wjOyR-?`hoV zPaa^mV5i`2aD)5pA>bYI*GhO1wT=&z01$4Z{hjJ{Dct8&4MYt%Ho*M-Nblu?>;-O) zXN%pj{ud85UG-cj(ne%ol@sU2)Bv{kRx>?VyL)Xn{nyk;#1(K#;(MY|o?avDNneox z5_XS=8i)7Ohj+{YI||9&#I=aG40ZFkhXMI@QFHU@Mo@7QM@DW4Xr^YMjwEj>W`P0=Ofi;Dk=5t2pG8m1QVy9FHQqvE2cfqo@D{S31=Lqf|s6uYy@nfFydR`Y_UE4Bta#VcPrT4bD)L;N!$7@Z{ac@PAr#Xm>SOTimXGty630>FiMqM< z3fhPYsR4Dz`P-KuDY2u-sGq)K0^z|=(>&5oJ4_mswKtTLDh>R^k3oI6jk54con_Em zm%rA=+M=LM7tj|Chik(l-bdbaa2J8`pgI?-!`1MVaDvHg|Km+5iFMpjZ280pK#m_T zY)^S(VtkLfDGeXq{4RDoy^N=qd>F^~syqtOnr8atD&}ZOPAiF4SvcTx1A*y#GNzPB zhn`t@aZDm(YF@V1U=VS5>L$dHq*%*v09nW6`2>X+?b7kQ$AxrpT)5uye0!o0DuN-t)f#PJgug4NZ{h-*nXV0s@ z#oqo7@rR^<(7)({uk^U`4(K|bp*bY>M&o@j`<1hndHvhRy7Du(Zk;*(Fmcw=J{oir zy&per;j}6ra0Z%J#_e&{I;Z*LzbGF>idVI|zYiInpZKfJ zyk>m-U=vVM=gAWg0B#B>#>vCU=Pvk9;0ZhHn1Xr@@V!5U? z*P^(#HzbeU&lCGgMkUQ(5o3sH5E`YNBa#6qb~omc=YS50PvOTe(KH(2{JMrs5@=RV z%-qtRQ~@B$VD{-YVP$~UmN`Pi_Vv-DgRV#RU>eqqSB=Mn*=5R$as_&WsHvaX9|{=h z(Kw<;6e`DSI&`K_1AqSeE>h|WbWK;ITudG+ikTJ5zFcNuu8LH2=Z36TE4DDYWTOxk zsWn&Ia?b;lQpdQ^Z+JP7pb)rJeZ){X$yPg(O*T_F_?e1cz&^((Jm&(`BCy%lBia)= z8)%9yx4A8)xh&bZ&jr*VN3IUL2|D;y8x@ZrxsBh}kMzz7R{B3dKk_mhberr`TGtRrnK9~V9LKZtmcCQkprPbE%S@t zZlySYZ{R7n#m#D`!8%TcE20m9m6P-0s}E2!2tX(rNbwEMRxpR<_PS|7F8zRr&EUhH zEi=?`kQSnF?6L2(P=?Z3^1FHjxA|EY1)P^End8^1sXPLT)*MO5jC&UG^@`nXQt`1e zaxr~%>uhW$bC+ZK#6%|Fov(g;PS9|AmYc9N52{}BIKn*Ia0$8Zo(c+w`l1*9+I?7j4$uN6E_EVpzd8W7+(8?@% z6t;tIbr?-MmdQZuz{0^=kkQKe&QSgnDjUYB@lvH!@W=;+r_2nkucW2T zR8s?kscugQ>p@UvmzR_S5=~vTQT_=mBpHqreV1OSHC}*fbY0E-vw$%6D<7C*O{u&^-JK+8fXg@C z2YrYN6o04=gysUQN}8jcsK(j+?1Sp+D=|}4x`ZV|$B!XKw zbKkYrR6Y7~IAX|35r1oJV@5XcdBls5E0k(TCvDA_-2DoW=e=|3m%iT8$}fGr)F(p@o#WqS zY&6PF49kUke!$xbGVlg^t8dyN&cOZrFva9@bfc!=QW# zcioWZW#70a)+Xf?yQd)Y6)f$|W;7J-Op>r1c*1fAivhT&R~GS|CcRm$=ZKSd9r zjY7}{`{IK4jaqw!2PqcFPy)x;Oq&fP(NBc>`Zou#3QFHPQ?l#l**j@kqgStV?NAg# z7C}97MsI-`{W{R-UfMD$*;k{kw?(Q6k{=K>9wvYEH2sLXVRP=VKZh)mKs4~u<#A0h zi`@rRfw{>?Tytk@l|^hgRXA4pC04CKoh#x!BPuukpec9>U4O~ml)AqQ2|<4Q=#9ix zsEQG87(kV)&~bnjpzNt+cn=oHCn#LJ7>uOq;iQ!PP4idsDPka!*|v43PPzA0A+gg} zb0)%Wx@jR_ryVBT$vWTTO|wjc+cT9maqlbdc?3`mxkbzKHl{$)Ok);w#r@DBxz z(_5^8wnBKkC_e7owmgznEPLf=GLUBt@Vje%wxg0tdwU;QLHqU_yxtfEnAyNp z`$Kt?l&fQ9haokAyHUH6l@)!%tFqB;lF2Q=Y3XIj(5ge2>5m-23W?!qE-G0%laQDa zh?I~+PN>u};j*E(M>U*b2B9lWz$uHbrmeRD!N7)4=zs}Q_%w4>a~m*pc4EJ9^md4M zG|u43BX`+lyx_SBCW_N#q+~V9+|*Q=O>?;TR&Ex=2C7LL>8mlT`r7p;FaPCwqng%U zu^0<{np(HXdNIXf{;gY|uUqpB7%C6A{+&a|wr26gUOn?=KPldn(oZXPpc-F)NvdF$ zIyAZqdlFualIVA(dS7(oP>pfsp^yYY#n^Q@-q?v>7o*O%Awln|#|DJ?rW1f?K$?LK zz}5(@%~Sj;nEIl%(DkH4GTKDO$n1dqn?^<(FC4fL!y#&P0rKLhP((2Yj=(fmX^=yEVO z7E1s|p)#!U9=($T`C5pX4a>uAx&C2zrY6m?=OCLu7gxrLNCKyUBrs=E$n$NsK-AQD z(jy-$aDrjemF?X=z7F_f6A}QZJ%(7xyg`9#e7^wQj~?(8qkss_j>N}f8Vs}Ywo%gU_Lx`AK@yvN%%XjLw7C!+$0f%vuPB=I1)c9)I9RuO>d)_DAlu{n4_cH zFc6zd6V@7f;Lya&aCb@?%3z1+e7Wk->UELkP@vE_5$@K5)OhjqQ+&}tn(-64OAW#F zwyIcTix01KcG=w+bfWFCe{k)D)%y4_altP(c3)lTHTQKVcv4D_MOOlfYhlDV$n_2S z5jK7K%n$7U`9751GX8p`ZekZDmH%7CWl-<|gN`Xxqh@YAqs!RTBDOSA;Yh<9^^-cN zw{Q3EmjM|mWH|9=mQXp(I-tGtXLzEm`WJy{Tp5bqmuQcFcj0}N5Vhi zyg=Tr8nsR^)`DOM^6p{VGrGf^1TB=b{J{p7a!XK6K7l|` z70m8kOv3=S7Dk}a+QVLIdal_B2wxq_#X(k1PmiPh3K94(n%Sui$y?pryB|LGa93)V3b;{XC&3ngXZxXL1HWBq(r|EuG>qaBqq3lEA%9dozv zZRgAd#!qwI-1J@CV(E)L}#TS(ahfZKh68DJy*OsJ>><@`;2!l9*M zw#1`QqpdS{Cgy9!oq=W+WElLVmUkhwBlimF8dzH-v=C$&eQ@`7P*MhhyHj|)p9@9` z@?>FD%o5t52YeJ7u>>I!6x19B5#S7R0TJZ1o!MA6F0GtkgcJj4Wt@D-iDAsgnHlSi z6r2MfXoEE}jjJB>6tiR7Q(6-Ye)g{3rX>^h zSS$jRodbylgNV*$^P`f_NmUDs`<~63_{`PcB26iMR@UgiQx1i!h>dq6S*=25I9`ej za}vm+88ht`5gNO8(gX@diyIaTQ#CODR(pO~f~?$i#Xm~UWNo8rk!8Jlg?s!=mc4y_ zL-O*3fn^6ZP?Tsl&WVeStppuyc7TAkJ;I)sl~sVUe;nlEHT!4#8+HdZ$Epy`B8F6d zRGBkvi`Q3~o%%jGMQAXBo)kS%=>X_plH~DO6f$>#NK{q*bTo(z{R%E}yLUwe_x%G( zrY`seBRv8_-7)!Q=t(!8h{)n_5cL^nGVC4{UIi>8lfbL#vf1tX+?vc25WdGUD5eyXyqAWJX?W@1 z?E>bAm~v_35T z5Ci^4xy*x51`t{%X=1|2T?Ck*CX2WeSY5I|VVgF3@=f$2Fci5eit_IyBknLm2(Zeguxw zaW=&$U;){Y6tBJ%I9S=H9q!{^?rpn_0P!B8!5n*109$#e7Bf|J=^>})!9HDvyfuz!7T#c6 z*0Zt)8XlEYLjLrqVD_j)5jE+_;EGP}_*t*Qg=Pgl+hGzqJYhTwRG!QIn0a7lg@7nv z@|LOjZwp39#-^^1CP1H6AR{zz_{&bO@c0JPL1z5q2q1B+_q8ogRjd{Fk?iQoF{lf_ zBC-qrX-Bh!q7TSu3cW=<+7TqA(*H64fEz87@IR77d?tRrK{7Bh(xUChqhX4%kT>OX zU9;;ba7YDZCSaHG8Q0PwEoMmNLo=olV2|4L=A{l@GY*BeF@N_jDGFb_BjA z9-H}Q zmD@Ac^vX*Bu%jH?$_C2Ze~OybBtsi55}9rUU$pU%B;bril(!y++aAUbT4p?}0;BX@ zw-^8sw_|lOeC$10FZMGBobeAZYrFM92^u%v=00am?iXQ z^K9{LNmg4U8|}Yu6Rbs^s(*p_x7ryu>l9hthwgpdOMU3MQ0ob?jq+1!W%h=SaYcXF zvzh6lm|LioHc?NqXdo*+(a&SfZuT~P#123T){tu!6=sDO z&aR|dlp;8F&TWoZ&&}b!&_$nI<*Vh zJp_^b1E+nDYMe8{=OCD3GH9|gEdM>c0_1C9&eCsmvJ^E zTR>Ae<>|ubttu@k31S$a!X1dg0C<4F@sj^Lj%)supQ9t6K0OMRLIfBsS$&bn!6{!r z3N6GnS#f2^xfAy8!1_0E5k9=-172Kv1Tb2*yLz+dY4^jfa zstSwGJ90gh`UTev--3|l@AISphfDnbJx^{)oX_HaohP}GKPc&>+k;g;<)vR5MkvLD zBr4v(4rGLrcTRe#0Nz)vos-BrSr(4SWz+|C96bp`VF@5dukB(42bE9sYWP4-G5 zikm;WcYr8+L1*d#8=A*cV;!D>aaGP&Bj$^+a!4-h`7q*NgJ9tnJG3&q;WIG>m0v#P zAhu+e$@((c$u~yC>~Cu$8@(b2VK2+#`c8_cXyX@L^gXBq&x1A#@g9IF@|T>?N7ll= z*bjg)%@^=orJiR@D-j%Qth>9>(oXT9&1ihGpS|*xJlvO#PmiXxY~6z!pjI$A+NQJ; zH-sYz+{`sN4?jv?1RGlwQq`$6MWqA5Miq%sV7%Q=a_9d6W#UUe7|Mu)yZkQ zmLVG4K$lzBz1Bw+F;;otEDqC8;EO1LHB5d{)OIkt_k--})(w9BcJ=}T?#WMxHX4kG zmeAk_fgEHA_djp&iVto0*+|&h)4LZ=Zt&DY#1M8;9|o*DU}pC%rd#y6oda?{KGOaN zUvS_5(HHzUxRcjOgor;Oe;9D&XIhWPwedRq4jm+X_Dw?XFTfAA#4+ZhaC~|Q{1YxB zkgCT978F)BurQ8K1=e@Fol7GMJ765|ByAEOC$=NWTvv`?v zqj0N9{;2tdb9H|a-H$uRoU226rU<&h9Yvv%CSak>Ile1<)u3|wEMu-_akc2fEoVtn z_)?mCzW(5~J#atu=cEc5o_K@}eif#Cnp=4_2^wP6tP6Cc^E~Y0DAbaDScsobNPtfW zEkCnp(IcH-49527<0po$c<%~5-c-x2V>RguX7I$xZvMZ5uxb%<4byd!py=e zLre&+OW9SXO^-n~6Z}$pRkU-eSeFt!&0a$MljK0ll%Xi=ZUj?H<{y4Pdd{@=YwLl+44q%cY{8GyiCUx%XBUigJeY*4og<)ixy0BGG0(25spJne?hp^597!` zwoyt&-(CE5admhOdPT6TUF=+cq;RxLjy^ws!}!Co{nb5JJCHY=@d36U3|2^9gj0=L zG4pXm|Aq0%cHsM<;=B)UILWH--{iV`28foLj#!y5aI?Xp!t4kmpqd%aI`Z)wm=r+h zZ=@jh)&h+3dja23Ez6L;bR=_K!0`$Qh;HAtFZ{2CZ>xw2$nU8xBGwiya?|roXj#w_ z@yqvPUN|f^e=!+vqQt20dff(GVsWKv(U_ju$l48~(9J8bexv8=i0droq+1C4C&Y?1 zu!u9%-l#bJCdpy0^V)z^M(T?qx9SZ;BUU?|L-XkGx13-+qNNOO<}CtZJXs8VtEYX3 zum)z~L{Fp5U3+FS*E5i3A_HLmzs~|JC(h`B*MtK6h?c>v>u&h43^b1 zI^t2fcA&Wi=^^f_^6w9-)uav!FD6e}J7-g>Ac&*IeMzj>Hbt-hdnc|> zTf;blh4NBKK@{V)5Wp4!b(n3Pet~Di-6fyiM(xP;)2G@O)e5L!*2Q8+ z9gmzs|{fZi*!;HG+5sAp~{@vgG6YGvv5EU@Tqh(goELc}soL7J3U=&EpM zw0Y&htrx{F7@zT?2r;U@66PYg(iSA3^i&M&)a{j1KUOY!u|=C{4Lkq1t)bx6L%4jP zTmGV4px#CP2aX;et&w#8#{|#n1I)*ZtT{(y6Q9vzz0+u)at)EGL*foY6k)` zZ70e-4KYg}P_2#@Kh9q7>PCD-JS;xD+$8p9>F4E~75_E@_Ri#1EM9H7{w=ifXe77R zVL|+YP;Lc71I6|tP;3J7=J%e;741i(ukgay+fF|JhY!I+q}+vOQ9tr{1-%*|?mP4Y zj-S~?u6&a3vmgP=`IO#q0#uvUV0$N(ZFs}eaQJ$zjh-6eywEX8tc7=xJ`;Tt$ zIW@G#2@K{5MJ;kKvov5kONG%1#_`N8UvH<_vu33gvI?A+FQaaWh#>xBA3k5d(k3Sw z5SG$7zx|31fqDo5-;tRK*AaaH+BJ?KWX<2M-c!o&Xr>K()Pi)5y$bglX$58%+Ie7yEip)5_Pzy_23I zJiGoB!9vFXmRgvAaD2#-&Th)bI$v=OC=w~cW zeXWtc!VTAt-lqUvE4Y^=3USVhBYOJTyMzy!*+cRHNFC9?bJDaXI+N@V`<8lSl zr%Gt_Ks{GHUlZ(0>TZ^CQ&twA6va3i86_6oOub$F+h16k|JXmq77%E<6p%?J^2$A) zKji0_c06E{Px-gH&9^tc9Jw#Hpnkj(M*ji9osUl9LG!&8Gn{ctr@{S+jj$;a?9om+ z1ivdH?&JJCFSz-r2dKHe>icUx987cjaDM&~&aF#uJCEH3%Ldng!+gQC;6cdzz?swj zA9rm>-T%>D8z}bUh(}_NkBzqIF<4lTx506Y0+J=?U@MS)2Cn%pUphuvEWX=Ayn469 zmW}5{aO~0T@*fIs$Xca*IuMZPc8}6D0jsX0orfrc+=wyg$I2~Xb=AEsbma$V1;8=w zi?nOAzBLjy(9xukp{d4C>+&y1?A_+a3TJ%JJ8ayNh3}nQ=(Fw`GV44pgFJ@o zJOhQ+$B+dZ+qUmSY&^hiAd)V>q5FIxf9>A8-%7x7o3R{s?#79h3NS8YbjI80o_FiK z4Yv5>uqH0Ww`I{{J{Y!tEW&!f#paK;MPu^Ni$AZESot7rZ?N*t5LubDKoLA1#{KDs zU$<@3U*0#uW?Y7C&(m!qH$V0Y!kU$jKBu4ozJ151ZEYmtuP3sEMif-=8I8Y;V!sVK zj92hY=N!o2c<>G>qq5o273R9XDW03gPJd2Z8OKvLj)G*=lMB|!9U@I4ZX?X?ln4`o zw-ER+&PY!kA~9j5#_1*s`V9Aw>m!d@5+~11=$=l5`S!QyNRvZM!yWIW>wGTO8QgU4 zy(TH0BUKchf3E9lUUu^}YL4!Xf8xR)%W@4)ET(b>VmIJO1W({1y@v#E(ie z*Pn5-VB_&qZV6N8r$QxbhMY%M61)=jpx(HS_^!{L0v5eL#vBIgp#tRz6eSLwYn7*E z%T0u9nL?eIv0Li3;IKRiUbGnGw zW>LfNb8rJ$csqJieh&uAneBCXsWHBH{o+f7kYj|3v@GiKsxCNrDguy?D56Cv- z@TjP?tIL5wL1vuIl`zDWWH+iij3o_|AJy$-@cNS}9?YdXd}XuS)=P;eW}wr&iOSNY zgzZZ36-n?lcWRDS!dSHGeH(O8{E47p5JUF31F_!|*FGOxH?Ls#W+32O8RBBy0eZXS z{;|=a#hHiG61bVTXxVDTeBw?w;c1=+JC`1}$jLcEk6yvIzKRxs9i8=wZ3yBV;6qmL>(^uQ_sF4p$SLS3Ni^T_Z>RRdT zW=;8=Tu~ZkeWKC3)%H^#=%q*yvK0drT$(wCcV)XBDyQZ1dNug#KHK|u)9SCpgwYx< zm`PNnrASmcde^ViuSh9Vy^?ayagtIbI9A@1=t;DcGJ_kH^wJtx_^F=$QtVA7yES;V zE)o4?J;75%TPMmVxg~97pv5Qn*75 zt8=Sfda@xD+2gO|UQ7En)AAKO|M1LWpXfugN4sfbAUiU$y zYPo24Swz%n%VGoq;+Ro=>*FHS&T6Iao-0Q`FaE0idcGOWG1o_t*(hMky;*NO7DiMo zsJHN69}n&C&s*2Tu`ZrGmy8j|}^Ne)ur(B^m0j;7xG z#8zDKq+sbb==#NX@Gber)SRnw{|c0Bt*#C zm8_BGRjO!P?Kc#TrQPxiO1%VS(`$q6_TVji0}MWt1uZXZ>Usamb?ULB?+2EVFi ztn@8PRzKO_RxXiSHP`R%JeFP9n^_ilKk(HGB}dyrsNvV=GFMq2N!%!8?8=Fvz8MS9HI%j=2z-ESKIoY z&>30iCzq<}QGN62YSh9#jzRpF!$LA7)w+yO_L{DHH`a&6>vhFTMDcctv$6OPS%{Wd7_hu{V^g}e_m5BX<^QbI zw%(*prrK2U>Z~u8L=jhJR=03rDpwA6WO+>$l4d5u#R3%sJ(Q}}X?T)YBInZVT3r)^ zYagMEHSNyqSuvwOOR?7UBOg;JR$?@cmn^2HF}U^y;71oXBtFklLPN_1y_E2F2G3`s zJy(^nY~oWp*XEYc%J?9KQ~<23cEj*Y2)MnZX0!7NPkluH_4#a6FF_S@>W8-A*tlf> zo;1rVRqx2?Rwc#yk)@oHWg>|*ok$Ta?!P~5)hjl4>(NSDTa&EZMnn28s-&d>e=OSf z%8|w8>e>~&o8yo-M?}J8akfzCLKEF}zR#u0hfrHuT`sim{G50mD^2_fC|JeBN*3RF zZ?6%SoJ>*DjS`R~viizcW}oa!&8%IoZEk+hoC?e9&nuQtJkPA;0rz9XXHBzX!1e>- zUq_^UU@LFz7@wtVD5!*_`INinbwxfHD;M(palUG!)}8I|SWl>SwmJei{L@I0+?;k% zV4yjDF&14b?WTyf+!$-^qm7H01=ZjM5;0T$a-6_jV~%dshuSL6oxeI2m8Oc4O7t)f zS|q)u&3j7VgBwG&`z34_hVp2G)fJMtmDES>tQ_uS)9L)B$C>7&dQBfwtBtktfciZg zMWuOm%@g=mZ-(-u6jEi1oy9AKR8Xi}=3osbVcr-Xo>Mt%Yi_({Nb%?U@QeB58?`(s z7_-Gx=G0H>b7dGWgL4b~o*68MfVW9TxS=kB?XR;(MG<;RWJIw2-gBj&4W5$q4-+kI#nbl zC$8Y;;>E|q&Xar>*81pulsX+%whaCnpU3p44T;kVI_9M87`qDJL^)56{aCW2Kse^4 z1*x91{_Z=LJ|)4h(8qHCt%f8KZ5-r($F>tr$)O4d z!l7r_orFO~HSHa3f=pXF^EmPFsWTHnBBq^%r4rK*>|X5O-{slaU0UkisxPfJr_(81 zjFvy^I`kuUXWbjoT@ztiE%rA&RN|IuV#nybBkB<|A@XK}JUwkk1CBiVamEysT~H~2 zG0x5Zprj%}JW)RpWt@=j?=oPWRtLi5sB1eeQZ3orP*PG`8R?szrLQQebNS03OPH3VpQBn;GHxDZ&j)o8YrQ;9?M zyu=&)%I!4A6@wvBa!XEc(}doopOfBPi`71eZax!|QF;Pv$qGNraKhhb2$Krtq0?>Coqz%I9IsAOU%UF~}S2|Mb!L=ekaFVeBy0%~uGjm}`eoZ;Bgv zb!$@-*R&gTdV%d&t?nXT(c3IZ*lWM_dPU*&ib`_e^_nBEcjq6kx4ZpwQ)0g``#!Be zIIFwLuzYp#sRF5A$S1kZ&>Q>4>Pl7K=;{-_2Q}FpqrpSxL{4hP?hldPKi&7zCmSl+ zs?pKFlL55J#pSh?+bMLD8>D^H-(Bz#&A82{WtnYvtHd;3`gELpLB7f8QongmRo)%@ z@qJ;elWDPB(@~B_tMFv%C;6A!2x@^rokpTH$%}y{pES8i#twL~$j!EGi~J;CMPGak z{-%yJ3{QM{Ht~2iYby=)*gaR5X&_Lb3)m==ft7}bFl!xQH+P~gXff9I6e?cg=D0K) zm&loCdCmJfuKJxrSzYLtW|@%K%H~-jVm9a~A0JwH4-|Xtu7@exFLa%&+BI+v$~r6k zNi^z$Sv%rq8*^Qqi%V$OOJieho|n48@%rIlr1+JdtNio|qf#wY>UE9GNv|O^GBQ=dwAb zFw!h+$m2XInr#r3YtSazG^4kHSsp6OjscZIcy8&`%tsfm`rns5>vqzZjRa2l_@ai2 zX!ZGNN$N?`G%w}5=V>kK5myc6dF#Te${fAfzt7n!;;pRuz8saQ(ExNPm~JYY7crIz zc%^D~4VwMCaW5I@8(z?dx;4TLd({a4YoulQEAfziXWmph7jC2Fh>ZZaytt07Cv|8h zERw==a1>m!pPrXvirjvBlk=GvF~S&=*^X$#QEG?JvVNH0qPn_mXwU8_w+C>R9!^neS0dBi$CPyZg=*Lu5xeto3o`a1yM1ouGY5W zAD+_Tp{8DKDIT!NlG|MBV$jW_3=e{lV-u;U1I!{zJ|zbwgVj;SR}hADBn->F+1x!w zZRHcP#=-GKeT+Hk?LedQg@q4}#!>k_%kw%sym<4V|2q!t`T24`BLyIZ@;Na)CtSK) zf%Q0kOf6vU&~W*|G@C&QkAb0$M~xYhSE&!|;>R*1r&3%PvP#(@+25Ix;i>xfN!#9! z#>(@$1-HfrcFGg)(uQu{jLVu}aQc}~ebnR$eQD9wx;`*Av*9k3?;CAU`_f8C47B8FA)IUEtOAwvbEB zH(fkal?FpQSre?2{<>3mTg!#bv-sPyLGpKG*8LK4fApjAFbMW z5kGKO>&*ZU~hba{lP22}cX`AV1hAGQriQg_f?lVCaRbVd77(K(vt1bwh$kU)WNLXD6JJc>@ zYY;7cX7;JErHf8uOkQZ&^mK{IQs3z?rT&G_ZpSc&6GEyse>`J#M{wena2o%xQC92< zMFE13+|-!{*?gd7qK}NZH273K2@)$iRlO5hNcYVh`U#po41xqRBm?dl$Lf^~qyc~i z^fp$O!nqnp4^q%7F5~K*`~Fy%VR`JPp{9Rv(<+>jNV-ycB($KAO##i|Lt0r>`@@;8 z_Ok_VysvCbFsH@>`AOrk^i9IPxxu=lUi(72l!>->(1K@NwZE(WX|g%X&OuIyGXCaV zLacF`T#txt>82CSqZD9Kxku7k>KOm3cdzR+4=ePwpe&Dth6~^ zA#|QrBg(JHW!b*1K1{3{W1cnW@LUi#V8Wl8?Q8IVJea}udyfu;aB&tA&BkgxvSekN z?Mmr>a^8ue)W@0*hqte<{G!cQv+*d1q1OLf1T8G7H_uK zTo*e{_{I1D`HZb=Z;@KsC!J?lCt5CAZ;EO+t$)N&!E*h;6k~>&M!%LIBkSPvxu=Bs zw0ErNn=SwZD!syMdqWQk3JEIPg@o+YZT~ajkzoq~b;!9bq|9Jo07i|+U=mETKQp(I zIpDrQCu!*vxXumKwfQm&KEY%~CcNjqt>^PWO_k*0RvDe&6YsGhNS_<}3MCaxF<5us zkSAt07!5K*+VD=-8)rz%cdg0+{z|fj+t>aDYZppN6aiHvthPWEDcsQawQ)ELY7M@zTS&frk zzuRWJySMrLo-t$Y>KLq1(3Fu6Mq9U+Xc=_~wI2wlKB_EN91dVOB2!aI;Xk5=sqK5JL)78Kgkf>Qd)UWR2_K`p*ZXAg3wK z*jsgI?PE!J&U_czSZJR>mB#=1WYS;qAy0;|-Za-n;%qW9qOrxNw6lsy`}petbNW$v z`N_+UN?TlJr%t$d?&FlENK(Fe(;_WJ%^Bw)UvkbkGDyUhwdv$hl`xn<5hrr+47+t3 zTygG@+eELCOJbvagt2UFpvAiRAOklrRc$OpYz4KW7_l&HAIqh@&>_+BP~Xc--chuEZP|kWtg$oQ|C^_ z8wH?${$_zD)HzS7=zj0xvRn;n(8kjqQ-WAPUko&+Sse|z9SQ)gt4%WR*r>mm8G%psGSJ~I-R8A){K1b^PP>ji-+O=GOy zkuZ|6ySN~pJ?uWZEX*2+xl0=IaUD4xI^>om_mPSY(ohlTj4bQ;^Qg5ZayF*iXEM@m z>J%g=CvO!IFwdQFv#7JP^U!&xyWpB}T-&CYmRnwbMJOKNV-(+Wq#0;X-k5?O`4_#O z`jOR~PhADa%~2P8eB>NW?7X@G4ja%@wf{agha&xtZ+jp4wynsw4Mo1~?SV9aquPHv z;5Kt8U`|>pm)&rKK8Dc@OY~v9?XzyWXidw^w+KLx1z(>zDsG%e2+D!}TyDA|c1)9~ z%ul7nzF>ZJ=TR@^#do^Hi`U}ZM?&(JpH_#oC9sIA>hp)znoAnAWh9ZKJC#EYON{ru z!;bb|W+jFoutOz+C>FYaZFsttWKHwMT>`hvBx|k}YZf~i-leE9mA0X}RhYO}J)-T; z&KMR~3_L2f2WU~fBSvXuU|skt6!|ifofwl%sdf%T&9owyP$*nNX2i<5f~#=1ks#QrY${QeC}{;HbuzZ&=A@{94DGMM&h{PXT2KH zW+XE_FJ+A-fTQ||lM40Bt;PL{k0~%W83|EivAi4+*VUl~Q_gqzz(fQ31;w+IbJ2+k z7P$=wh2W;S@w1{wOYc}D#akkj)4h*n2Jg+*5~>~H%y>a1&+d#XCdH1-=(2R$%70L2 z$KM8J877_R|D2SlTi#y0JTr2BZDl$pKeO^9($;<}JzPsE$KJRv%zWo{VRNfvk${dx z9_d)*C((sFv_WR`Y7Z*p5(0}^)gdf}H&SlZ=qB=UZ_>k8M|D?1l-!2S${)yK)zuy@ zm?DXC2M0;wJ#=U94=qrsB#v>M>!>|$LS2)Dz%42h2LQZ_6jw+M@$k4AT!y>mz5Lst zX|K3Z0)`py(lCr0d_bsg=AKGZ($$6I?QPn3nPq0{8tn5)Gp!Z@-|(|LP)R1i{IX*8 zp#rh_0}XsUuAp%-mu_O_sBN#k##Az=Ad|CMgMixugux)F12pkQ#zsDE-^{}HRlg!j z1l_J#6?}^XY~WVFZXM6BoZyY5rH|Unzjlms8gHeq1cim@I-EboUh8@VZe0O&{@cCM zlrm+YDn@QQ>Te?GU?d_Bd9I$oz11azE^JOxaGTYndfWY}r2L7dt`XED+v)rXiTOEe zITi6OoUmh#xE0Br?t8348tk~7c>*2n7IR&A9#|ksP1h-UotLb1+NaO zBsQV31!i_;4WZx;Vc!ETr&_lZw(s2g*k@%}*1RZ6>7rO=A3m_f*t|Beg>Q;;O8fme3eor)F-DwuVhUeF7 z-8A4y95R1i@{zUa&uNDxH z4Ho1lR7<|9r``exD39`4otj3G`vITrz0`JWOek$G5##SFHXqHjQAD?5qaBOCMztSQ z0tu~z@5U-*X*km1$z@qIvw{WDbwL2idq-RKBu*J4WAQ)rq$L(UduG?Z-XG`}`_Z;JN99QSU*Z{3JhP-oQ zF*$jo%DF+@6xY->h?vyD|oIx#xb~iGq%#5!`qcb|UOow@r5KAvYS4+Qxh2fbrT=D9g-Tt1;%V zFFTGuW+M(*;!|LN6rViMf9C<0De!KZdc)>nEmfD15CJyZY7cV=2XmrThK-p_LV&T_ zckq-rp6P4O)}(!Nrk_4K2yaivP`yxAKvAJ05blSLa6cg#!;5h|+fnwn)YbPO$VH%E zk@n!pm$Cci`8lf-IEf@plZwx>M7tY`D>Li#4O^|TN4;saL5|l9vvy(y6bi!t&3XKe zwiLYFJEvFLDtd{WWk47tcojP8ZmRr}wA>Vv=zF$63a}vl=gJ=<&r1mN5uJ@j z%|Q2PSIzRwqaNID7VvVr8Itek4THMKlhWq(6{|yTgfO=>@95J#{4Vvy!kLMe_MJbj z(p~rXyJI(R6~RPG%Gap$EN~k5F}HLw20|wzErGAbpG!?|6Om-&CL(m9Nz{-VeOP4k z`fF4nS1ze1tk-z=^J+^QYV-nIi7n}B3J6%vYb{0R8rel#V51rjiiO69ZTk3Dp2Y5* zK4^KQ6xT=&r8W2=M@$fom^N}#P?4L0&OYfk*`b^RTI{bD$*=WreX@iMmt$G=WVka{ z$Hii6kst`3K5Vg74P%`l=j@~Tt+-#<~ z^LDDZLgDUy=kvBhD@!8J$0pZ}pQv$|KeNv#N-qx1JrptR8p^u^c~}rhOdAqoy}inU zvLowGY_8q#9tLD2n?u#n{GGD+>@}nL=m>#ww)0%?A}N11+Lio`*JK#(QD^g;_EtEH zEhb;?BcOo1f!wn|XqFu0M%oQU!NJ)A=Ve*ByRyG*%(e0YwANi`?1--#h~<*RI`%24 zplsoUqWHq-N^di_0x%j0z??qk#yObVSdi&q{t9rhhIs~lSFST5Tv z+msc9MqBACD;u@bk@ek&Q|RxqI~$jqhvbRgXA5Sli>3>jY=*<%6vNfYhqaUX!QY{q zQ%wWRwfD!+UHu|b_|0Bt9K9#3b|cK-$Qs4@lJ@2JJo~^Il8{kP+rQ#42(}er94hGb z5Ql&6kG_R#_8CDzJ)Tf#8$yUo_tL;0|GwmP`*RkZG3!!#NA3G z33nBQ`e{$Y7XEh0tahwA~&hfHU%q zfbZ2|7(!8P)Q_y$r*KAjIYSd##XH*n2sav%5F~wZmW`Rk4QoDQFEQ~0r;Qj8PLYPj zBbyIJbi6b>IBSjXE}2fX@K0XSQn>%=+g*b0cN+bQn~@U>FwNT-B=6OngS@wh#gq5B(@}8UTeZ6Ute+YP{J)#ef&BWwr>}HkSe9mB%iN;M!ea z@#sNsgQ#$8%;93D|4S%Jj&Uvr;T$#9A|moNgEks^SDMgf=cMB?Qc`w;4(Yr6{I&J< z`HrcE2A@!i!B^;`Ra8`P9V)ykFb|`(19j&_FLj1Q6Mxh|kt~WZ9PDGJtC_t^o|*En zOsvrLruKy)kk@mH(aO&TPAz7_S^8IS0joV3*vq7ST+Wr1;D46~{6orKt0n}8uOtbHow>=wec)yK|&LQ*>Q}@sxowB_q2mF_J*L#E636P3%r|PS+5?N<=}ggy}8Ptk$)4I)v;#_NBGwFQI2b$?z#VWWRulphj|cz zQKNn;xI1G)#D)AFbP-ndh)q1mW}d~>PSTXXQ#no z&U2RK1{I&<~j*{J|K@&Lx)xq#wk|I~!d~ zRKlb-f5@?nsGIfJW9BfO9IX|Dg-~rQ$*g~Be}k-ujH>$w=xwhJ6>!3lzs9L()eexk5{keeV~Do?YUomPE0rfB8uYsp$WtCQ`Cgg63wt@ zhuVqQy)%?!)vYlHE!OkP2GO3E4^X-&mfodSzD4@ zs9@YA=NsO8w?pF2TR(WPx19b?ySyokCbKlEuQ4@1c6t8B_bWy?C-(MdC_n8=AUS6- zW11|6jmy$enxTnnj^(=E*7;`Tz zPu4mTyc84g_E$5rZ4lmb;+R_~b>DzYnTxQ7_DrVTMGu>MC8sE}pKG#NCgi1iBbi*^ zPEC**lTjqVH=V=u;*2f#@MPwmh+kAAibc>sI`&GnO2WiOBf3tBE!0Me7tkXAb#pa+X%D!QJ&Ll1^bC-WU6z933-g;^nCLupk)Qiyq)?JApySw^# z8l9Pug|ex-RaClv(u`JLEv9so^A3x;kTUz=@Rs~(+0Ej0V~jx6U>WX%7}vUq2-qtI z8M^kLFh@bj{YD1P{7gN>*G${SgW^_L%^VW|c(>m-hoxTnyH_dE$Gqq?Tfwk2;}_wl zvlOgWTE;&35Cb2q^eJjvoi^7qtJx96DbKZYzn##gE2V7U5-+V{@T^T&OwIISu@bS} z)kS2Q$8b^o>mc@E@MnDN_r6lCws=M8f_3t=HBUQ6T>_YMuY3Xu9eTwE zEQ`XYR+@UiXCas|n7?_`p!?;e`_sTOUJX3Wzju82 ztbPiidwVe|U*I-BMUADd8-;RDiC*jJL4s=6LY{}W4dErd!BFOk_H8eyM;5ub8C?6L zbYw1O2WvUko@uqokTBK3b{wZy4;J_bmb$R>^hAlRw`9J)roO!(^*6Nj*^+$L$Hvs( zSSPA;@(+&&ZYr<2Aeu_Nz17z%VICs$o=eLm>v^(^>Oc3sc5D;dk^)Wb8B$2ZkcEeKTh_Tk=`>t@Q7(~)99yGRuRvO|oUic3p_EN}JvN&j*Oh2yRilLvi1 z>s+RvE^h~Nx9~f^)8>Sv3V9QKMHZa#pB)Y}I$xi{mdF8u2)#M=c@0Fgz#IG7a#||O zKW16Gi*@Nz&E%-RC#26PBTws!HJdr*ZG|cQ;44nWQr2|fh!wZONu+-{i9Ri&SRSwV z`{vCtE_T; zZ9Z~t`8*$72v-ijy$WgSx+I)Pe-n^>NK113v_0_qFE9{k!`Y(`PIljFBffAxSlhBv zd4y9km4b*EZy6R;DV5hc401P!^4AM0*nNutD8;Bk`~4@|T4lw(#~!VWVZ<2NnrfRUk%As%Y~od%Fknk=~fpn3m5K zs~twQN0tieVvO*@*VqYq{B4zMzDF3t)glw zCwdhRLd*Qb+kjt1V34#D+JD@C@2M*h{zNFoRA3G8&7E&fBgrU+t^_>;B%{n1_zOL- zxjo4PA(x_mzqsEfbZT%9LGuYd*jLyAzglz(d%av!_b^oJdk3Aa?;SL~vv<&DvyW*; zyPTF>&w72p@297gr6#ldTGZ0sk+$m5qu4gkIoszLF@-||7AjQ`iFjU3`>z=T_x|zy zAGNXgP^Wm1ONVX%Nw#^Q435ND7N)X@EUR@_W-!S(&a+z#!HiUHsP>9(vr>w@btZ&= z!RI`3@fWSNcOJ;+r&rUbLriHQWocJy5T^D^ZKDl$@>XQ?ML|$!-(_#>`FFlOpXk`X zC)~^^fhSCP#lgWt$SD47&c4Kw&ZEU6_v0H+23YG6jH#7(zG>$fNmLe3Fz%>0ORQLA z7N)1)jx5#@FLy8KIZ3M(^0yB+cJ24vyzKMflKK?nmoHMB&*zP|qaMA7u$4#=w4?u_OTM1M}0C$kMk0 z497vpqRlY6xVzO)d3cel!ga{$x?Od@r^NkNY=jCM*nRyr=pwg32417Y@7tzwxYCsw$=x&BrIhE!(~Q!l-lAPSoy4G~BY8 zqAs+tUDxwt_u)Nz9u%>^Ee-?ef8ZSwH7o{C*z$7MkA5&(*_e+se6ILkpLiJs&5m2E*$f3;-4 zCpr?;qXokhS2Pr3u=N#+!Ux6mVv4&*^`mps z!8(2bQ|JpVfwGj?!;TtpFPbdLr5+}!P@Q^H$(8>0Jc%Dfv380-*js!4qf&T3<;{iS z*^RVD?zu=+esoJZpOZ+rL9l)P!gcOP8NqG{iXz`H$HeKnx7`EZ4rLetYO(8IoS@e$ zNRE~Erq(hDRiK7ML*CH9(sIoLTyZl;`Db)s@ z+XY(-_BPwLe-%@ai{99qc~V9mw)z#TYuyN^hE&93@hg~X@DJk?b6J!A{dJYuqb9|6 zRVJKIJ%+C?CHW%aWFVyk9jjzTM%*1Q`zraujr31bRah>?NLJ@0#PU+2`H)$S zFnxu11((NNVSQ%-{Fa&`jE#-;!B7S~8ZSuTg;MZC6glFeA*@|e0{?0&^%ohUUKgco z9ikoYMe_+*i2t4&f(*Q@ZTGBAa`CKRqb+@?Q*y?I9jeeEY?MKuTWcoeyf|-pu>xc7 zaII0a-*a)vgJY=Knp0rbIq<1BORWkwx(|D+YV;0is0S_MZp z5p1h2GB$fZf{T*pdX?<$5C1QT`kGl8i>y=uSM89XLIY6Dt-|LF$4MEQG{7-uyBE#Z_i46ccL00ubZ|$j^ZsK`yB-b$= z1=iDr5L~bf zNi0Qmn+T$$b-v0wiOIQF=jq_Ux;OGZ`ka~3wRpXL5bfPA0X)d_78OqIg7@?HTuy4m zAgHVZqBT`XKka`@)wl9#`>U&%^b&ZV$=-SV+}o@+1Lcc@34F>Q}-sB9HMM*C&LdZG&H;ed<^c}@&CGh5*%%1U}DK#oLI5W4xrC>H(CVfDbgRD zS7$d^!RW$dEI$(zpOn?J*eQO&)RT`zh%TWHhJmjjR}6X9-HfZ+%@dlxW8y~H9b9vp zsQDgeH8IXTBj`Fx%>kTgRtwqf>_JYyS64jg&bEJJWd8j90j@m-C;j=edqqG6jYpzK5 z{@j4HIh@E&Emb^svQzfqU>1JQAM z;|w7i2K|bDI`;;E)1*J5SmyM`%RiuL9_1+@ zfv%S*U&qutBQRgfbnbd$aEE4anC^&h2r;!;6CRF-j6k1s@kqMY-u2sUhuX95DJwdI zon{`W!&3Gp;Q#<>*N1rEL1;+*Jq+&jeS-=da%5)(VI;4U{63!~==F1$VD8*@gu?fW`~U%F4#L2s6Hw!<{i|60z{v5a z1m*B5Tma1pL>@hRa^Y8{aitj`S%gJ*&U|U*GJI)176)!nF$0@~@eP+76_0aj$sq*iZss>8FGcmdJVtj@KMGx+)5NOH6+2HR)` zdgmL(_voDLCJw*&?QyLED^JjVtMrP+Cu6S^^KfJVY*+0a8|pmoxqQ3G#N^=0wBEC- z?;rhispkDSG@o1707^8Le&l+@;^LzF_)}F-8~q4g=S4jLWA?%F(PVIw)JDblBjl(e zlw{C20ZAYNd-mEe@-8!Q4_?5g0#lImj!)`n8?iV8U_FP7OuC7~X2%KL*lMdQ%0|Bv zCdL4+aR!+B#~e-awKuk8t2eJtmEEPaqMtB4%pbgO^pRH~YV+~)M`Hg&7LDzvM2 zzTg7l8UBT8jxWFjYkX2x*X@YIK$=+z!Xs!u3w@H!)^n(Vs%q63;luc{FYaIT-kzi^ zC3WT+LW69T^zHeF+qU)SmEE^iWQ{++p|2kUZ`06aVMGZ;utXR#1>8xB8=mcLr0gs* zgJ)~o2LERI)%C)isDU@xzv{beIgWu~=fcqjhu}V-MInuyf&eP}(E75!w7bQBE3o~F z%)Gg;15ylA+7RM?(jCYw#UFpHaNt)js4!n*R_M5p^E>J~Z-1$zLV(58O~0SuWT2Lj z-*toEy^et&7hIb2fu{cQ$M0Zj(W;xPx?zG6jUvyuKGp3 z2T)H3#4qjtAA9fN7S*-3jbn_Os7Q<`N{um!sDOp0ltBq%14Np173pO}dYi#x1O)*V z1nCG;q)P9M3JeO;dmUv2ls*i@0Mou_jmbI5`=0N+et*DkdtDa9aqqp>dg^`Oj{@Aw zHTQv&F3pl!88Xdjw*^jHZBD>hn9R?fsnCol?K ze^GUSm#b<5i`&kGr?Nea_C#RH-(O4?ZK~&R>40^d!pDI1H{jDk-FuB1TY`9sy#^|d zC}vnqmd*%ACrlT*imE!m>rr*M3A^MO`m|8=X~cGCZ>?YeZk&}{2?){ED>+Y3jQEx3 z>dXHJ^PNZ4)dkXe+kuCZ0mM?6I}!QexpvLeh*+JT6t!NI}BJ9##1!(L0Z0qj`Z zX2#Oj9q5@sPCg@-$0-iXq+}?pdNa_fR4<|vBeMbRx#S-KtEB4x7m}4*1xmI$k+?p# z4m4L&VYcF~BUgWdvDgn`@VL6Sw>JWK5{{Tv%HUIPl=7&my>}M;5Czox-$7#*Cm|&j z2IC(z&YwRIim3Zx4)ZRcm_TZoj9L)3+u*c1MZkV|~Q;BQ=<QpudjE<{Quwnw>J}NySg|fV0%7F z%EWvYG%3Da?WS2E1EwLsBdAd|eo|s1;CBZA$fl*!a{wWE29w&_FQ-m(eYZF0 z#r?|N$8P){oF!-9oyotBr={Ur6_Ky|TNUw7>2QDp9^zI5X1fIc`k(&xYjW@3&-;J= zV(QZ0EXjYqoZO1O{l>yN0mCZzYPNCV&GW%oy|p#bBmem(^t*uGwuBz^o68zob{#pV z(*x%Oh^PO!+I{|fC+=L>;@|%+;M;z=Y=idcKdwJ*i@O}2&E(hryS?LnTe2jVlE=d{ zWeaolB(jX7rOf{C|F52|S{=;ZNC$z2zhB8TI2h;)Q<>?3fi*s~3m~)m_e*s;?VDlh z?trN_U`hU;AMypH=V29nXj4yr{rjh&xAdp;$h^Bsoos}W;DC66F^?Jlmm3POmIY`m zf5}#C4b339*O5i*)BeBRTFVXQ3dIHFB8jeT%F%};>xQs|gp@4W+=ybO+t()mGyePa z*PYm&@l;;+*$NEiQ<4Lg$+9rG=Z2|!kG{+M{n7Q=`L(fGl8uV<)e$LKpecV4DBu6M za^t?Oo6G~4WZ78KXD$S@%C0LhW{O@879O#vttJKrqHbXDKmHXDkFoqWCv2;imX_wy zr77RwJ((a7j$wOcm0m(b8vrG|$gz)eEIj|e{%M&E=`ZhohkYQV$i|P$&m&wpbAXl=l&$!0sMR5S8tL6Dgt_X?Nt2N=Ewf$J9T|t%+D?FNCVj-jNP!AD!)wz_Q%~ zqVWUq#CP(?<5g;=2$NaGk%55&ZSGvspS^~dzuOG7ZU6=r8@Evbm0SOog8uQoh)fC( z4@crJsPYXF)A*j+mXG~5lbT~6mE}T0`{pCEc$^U9JNF*=;!n``rU{2x{Q6Qy8(QS^h3p$K+M$C)a%ndmloN+?w2vwFM_w-PAB2 zqHOmluGa$Oq!i^a*2?Mf2xv@N#65w4VR~^md%ls5qs}u= z&Tk?RIB^+6d)XipJGu|>~s%B#kO3xkZkVkYir7!7;MZoO>YIuYFq_#?dm}| zKs4IS!wBZQspy+zj5kL&A|QLIH85^`za7xbd>{t641fyCh<5p}c{S8~2Q5q=qnn6I zpt9HUCoRi{PcG2qnT;oZvfYVpARFBP>byEVMK^Hpn_o)qg+X#Z@FO=4^`0K89^b6b}uyV2^h^BiwRBNNv&n=I`ufKw-3;y*5n-5%utlM4vtiN{eyTspnw8#bM|sJoMAu=Hhx>sU1ImSy~EbJgO1 ziPura;%dj0a8ebL{aYw{%?T3ISj3H?yndF2c{z!MqD0DeKRa%3`8h3>Tv=s)3CMK{ z^Y<0p+MY|KNY@a=QK24%NCy)BB^U0_7@86H`ZR60ixW4D_A%u)n-=@F%InQe-a}O2R!}tkomhHhRM`Z<% zQJ>38vjh7pJtbSEl`B28rkm10y~7R*wk$@hHQbxpOucA_t2sz$jRG`leGz#y{Ft=% z1>gJ{WYF9(iU(A{Zs@H$cnN~h;@{yXNfePvK8B73?>{;gN+erNK<8Z*6ugoErXjSW z{iyGITlIZ)v4U&4xn~@0VXVS-3}c{e3@~EaPh}OE3w7B}n}6hy5#znZ6L99!nkoy5 zHvpfId4byCS|>SC+}+S^=CR|GmdUnYv(i1nb!DQ$Lwsh^!KXaVnXF4*Jp!5p(zVBA z6LH?RA9{P=P-09mR)v0^&UQGTQNAXg6gpBm^ou^vX08>90V{GH6}eHzykrsq1yaAo z%BrJvd>CPbCp5vCcP!FQLI#L zc(qEpA-fExm{+mzY=u}L77l=3QcEBY|HGO1VyeM(V_*1)EIzNP)o7sNuwqb;hDR$C z;pIV=doSEr5HfG5`u+*^2ur}m@fZV*6{WZDgicsriU(N)7l;`egT!#pvYajg(2@C7 z8y}pJggd35MXzY{mjXpEt~I+{;xU_Lk-Yyaa0^PdbQ6&r6sBVAPGpZc0`Gkw)9*(+ zuNg3B;x-Y13m*+9yZKQyMc<_JY<4ahDM~JTE2?1L<5v1Dx+%oA*hbV zWsP<%b!-SAc5suj06BXIDl;;K_?($3Z+IQ4 zBeYLiM5J#-pSI!7;a0_8w~e^kHra-Nw|n?a?Iij1U9|g;U4Q$Bo}KZ(-Fb`6^2`8* zLE@;4;yEk?0U2@@vf!-s!PD}mY~OeGMW#Ir4MKt5y?0*Qj58Q)s)wm}i%IoOJ0^8Bn%o4uQ^ol{w%X)inS($oZY4$mU|d%=Bzr@l zfeWt)MZGKoM0Vb+gUTd4$s3F+9lfiWy_-OgjXc&Aml%ei`-nZoWPygnV;j-~B-xah ztGi4k0A^)3tA1q#sGJSs9Ir!C3`T@Y4=7P#=DZ~my(l%P1u|G=*Aid!i>UuxLiuu- zz!;yr(oRAZ8?!op%z?df`Y^}yIn)as3{Y9e1?FJMo1CaSLm70)Z$M_jSpEbsd2Qm| zI?sReBFS>*ewOwR%RiPHlN|f=%<9q36J6_)aA9V6+$!43ldI+7%ouwVddRS^7whVWw<4-Q@%51EEcpA#Fy>hY&0 z-7+-f!jiUPeHVJTDpsYpTm}oRr3#OcT z0VF(;x%}(ugwS$$n@G8)uqO}>fD)2*_F=V~+Z<`RAu@L=m>PCpjV>H}d@$v&)T`u# z=iKma49@RTOs9fCk{rp8ifS6eu&G{NsrghF)c9UJDZViMX^o6Wqljnyh$kr_+yNE9 zYUwre4KT0h$_Ac;di%~kgq#TG6rqe@^J9u|u@vgXn~R(6DVmTv_jJk~dLwuR`T|5S zp-{szCLr;%4AxSqagF$|h(W+?39hO1)Y{3d6a#DrD#g1|J?sP=u;ibLwH@HlZ|+C5 zB!RQ+ePK$}N<f-iQ2gONZ%EaneJ?k0L!PGbec zvn<+&}nh3XMu$0pI+I*UIKvO=$!g2plAY{98# z_qJ?>Ax;7otSLj;6Wnw$GZl&7?oeGb+# z$#K+{ebe?6K~!K9a1N7xaQRv|D0}7Z+97G_a2GPMVLhMHPdmi5F7*VS0H`g{k#>wB zqWtx`z%={ou^2pV7$QfP){~RH0G-Gv-Gf^t>`lEd@u6YBY8u2sQ7WK z!Q8sAsw+2zPgYHE{raVRB5V?1kvQLx9WGQ>{)?QWn(?Q^RWOTUC`ZeZsm^))@jRyb zrMYxDhZ1Eo2B+ZMz+e@e7Z*lde%e++BFdeyH&@oC^CyLbThXW9B;N<{QREsB{iIA!Cs7B`NW6cJ(=KXu3`Z-lELidQyw$BEf|A+s33dc&qtj` zmj7g0$dyuS=*=T&=Q>#V;{+w@qy8J@brL2;h=BW49usjqfC%+bF6HsEJUZuiZWL)- zrc_l2+Sa$L4fpI7GV5@dM*?H)u){pGAu| zsI^_XuK^@^*%lwX!dQe$la1$jqn6P`CBTnE=Z5nOxNo zBE)70FzV&dnNw`j@?YX$euQ84qPECG_0&c1UvmTw+vVe(O=l64Bh6lZ)XNeXYKiR8 zg->MAPd{_gMgH2IWY}VS`rr`&qZS;gebz)>8k?2u;|1w&(wm z_VfQrK54sJD8vg&g?t6qbZBC7U4Y0Kme2C&%LD8~jFJw$=>GJVi;u zM%%3r_r6*Nw`ku89+8VRZSO|OPQU>ugOwoAGg08|=qut`Kcm#wB+!pSa3y%V%l&b4 zz9(BN+}vs(o9hGdvu=ga(3qYxr=>Jc^t$$82o`8II`Jn(=VM2$+^G?un3?TtM9o+e zE+4X{P_bhC{=OdPpUV1@NA^&PFe<`)DrPi#%<3}5w?3vKtyJsOe0n+1Pb5stmgg6z zfu1qsTyU#^;b>nzQCPam=l1~h2v9SD&=lbMHLizK)wNGTgRS@j5Ch2*?@t%B_+=CT zJYz%)|Jp(8z?hl0GaZ{8cl4QhU2>bbO6!((h+pYk;k#n6+Z=Cm*3^Hf2tDH46*0Wu z&D>a^Gm^RxC%D#SrV;1?Ky7NDb0s{7-PI=Nu1XqibwPO`*v}V(9Ry3PCVB!g{Y7)zsv@~PxM|6fTmc36JhlR7pbT^ zOPezlRm?ph>0v&37d1e# z14(q^&t`@?tA|)tu}_SVr!^m}GXo@Q-2fPZv1tpAPdskzYXLN(((I?BWRHVeS0=yR zBK>e*xYBV{TP;P;&2!lT!KL|g2kxhOyrk2_cx)XCU9COla^905%vI;%Md8XnSa#s6 zgPoD8Bsux(1$#TSay!jrxW}uG6$ah$d+q zC4`b~!8$~kgB)NG?Nimgwxrs%GC4`3D^-1-chcoS_Ea$cGz}0-C=>zWPzj|$&GSC! z*MZu~q(zb-rt>^^OGL2pZyhh5&GjHAaj|1ci~T_hnBB@j zPLU}+%8aSc{IdB-d!?#o3Q>@rRVoTfFm}Q&_1j(E zY!Il28TBGCMa%|ScBc*SoXL;)cj|L0zy52(mMh=$$0}x3^gx%LS1=ZE|sW5h*=23qG_Y^FICqS_wPmHD9hp_@a}?HQBVXX1TlBj;9ca z4Ql&92ct|4b%BJ|T@TU`^>#NEQ$1k-$%-e&lsYfX4$12awU)b($3Ot>L3Uo{AsCAq znI(A<;Ifv`rl-8u#vQL+e41a6#WRLh<~#{Po5cKXZQXtJms#}Ss?Q-lGS1UT^c7dv zKMZu~TF}RU*kfw!bK6WjCfZ=Khu*X}J!3o%o4WHx{_1!4-k|OJKWNmqqU;xg4hR8W@w>FUDo=w?}p=n_SK@f6H`Dw3q;$h$Q}y_7bqodvw|A) zgqB0i&O=U*mai5eg%}W2NORPWb844H`Xo)sUt6wT{u#NL87RW7Zp87Ge-X%%+;0Q%uCGl(ZA<98r-1#?V*a38%I z3aWZ=7%*7pyajqO0a2=IYPK=Eju-;~d=1x>Mm?jk z$1zROdbMrO0UcwGTOId;R?Cgm*wOg!UTuWE-(C(I1m*kzM6R5s+&A0(x*3aml+xo= z^7WL2v7*_9Q)#yP0BB6hT&-SiUEyua6FTYw1VQH@bA)jUcBM4hUgxI-P|f9cSLT`HucN!fDj-Opm0>e{#E(#DDtw?&CMl z)fSKd7bVir&;Zm4B<$q3?+vt}PH@hfpqp*Kip*|GmgLn}zo7fI9%ex64`?=){ZV(3 zBtfHAg{z&1R&MK%u7Q|zTY{oI?3xIR_1#<$(|;3Df%}zn=+Vx#y8r=!J(ItRDCfT% zi)Yu?WD~BJNC5n7B0W5A>s;Kg2alk>)C|O$$K1ZOb0IQvKqZc<7x5f^jCEXjy`B$X z6L87opf+Kqy`bQk>prwuJJ7P(X0kPhvhhcrWFG(w5liE8;|jAh6Lo05BD*Aw`C&}? zr4MoP()s{|Mu!iQJJtP=-y?Z>5Fb760G;}SJP01HL%mvC?JXoI1?)Wa>}i85@hKC! z;4k6#Lq)4XQg35#hHeG*2CAQB9WZQV^o6uM)=fd?WfSi?>P@NNq5bDAZsp~DZY8M5 zzRR!gw9}9T$kp)uK{i2mven{eszB~4Yq!ze1%Rgk zF~l7mzW=FT^`~KOj+WNe8PXeRBT3OMTn_^{Kc&ZAA|Np2vdKuLdx(ff|K8bl%eZr3++pbBIHaBVg!75aWuYL)C%XRSX~ zj(4X2dP`SV!%hdbOj3H`iyKD428P|&TR0wA%A_;Zbx z-?)qUEu3zG3MB;F>9D57?y$ew-ME+;E&@k&-NCuyiFB`|QJavJ(FaMk-TN8El@r}S zH-|ez`>Z9y;k*tsAg*;h;XmEnRfZ+?JC%)$6?bWcfL^wOKB_?{AKfadq@eB~2en!F zCV6fv+qBEZkaW{+MNSrzzb;^K$ZC43E!TCjZ%&yP5@q8fCZ!X6zTXcXKrw|ek*;cj zU~HPGplZ973l8897*)P-rMQw0sAf9TJ=qL6q@5dN@v+*L(;zj2?(Y>k0fU3iRkLF= zMQvQUWRL=WmW7tIy}Ht4R#4ez31o$2WM0U6&s9v0bzYPXg~56m7n)D__cGxqq@MN% z6oJeip?&%6;ZvSC_24YjYeA_dFfb6wGWLI{TB`jw42P`)N~X(~K_{g&Yd&%1fdY$K zm6mhs&z4UagnL8M%6mPAQCoNvmpM8EI9)2cQum zGe9ks$R$@v~!-K;@fUzA2&bHA$-|cj-;ZofO%+d|7Sv* zl~XZ<0Jt8i6GUGN zuC#TNK^g7r2sthY8(A1T3u@guR|+Ti(!L+uMP>j!@mq28+uG~AXQraU9xnni+HU27 zS^})~M#Kk!^%KcoVlKot7YAV$W$pvm92Mn0=8ZLAIGx*GEQ-{OP2D=wDWDZgZ1@c= zeryj^bdplCY9Mg@L^ZVwO@!7s;y;t2Fdq7~%K@Ki;u;5HAnN+lqiMRqkchSC2D(mH zukHkSHqTKbS29oXEMj*2SFK~!b^RVi?z+X5h)$NvGXIb(ZzQgs?Q6&EhMSX=6NN~i zXS{1MdA}W`iYR|xB?h7}O$9-)0@6$0ABcm#1jxWXfQB>1s(lT4c^5eT4M-*duo5qg z%O{>bg|-Qj_x*v#7Hp!4K%}&$&TKW<)&eieSmZjy#{k*P|Dx{Av-$OM9N$BjZvndr zaXfXUH7^-W7lSfWDiCQRbL~GgN8B(UNP&_cDhGCDSm=%)2UbI|VNWT^uLit%$K>b( ztK1s$Z%)R5JVSvtr6`GY1X)o%Za9^W;;`Qt%RPjKuMo9qZZ9@R@(vG$Paa1tRlj|0 zXG*-z!+Gk>4H4S5E_tte{-&LoO0R^2b@`Bo8axgXSxn?q#}uw1mL28ov~HGZ)MvI>&wyVY8+09#(uL6`fdPIG`Jil6OJB!)9X|q}H zy9KCWzLS@$Ms~O4RU|O&09x~9@Hke1*==r84|)_oL!s@(W(S9l0ip%;R-r}^Cd$~% zL+hvsbal|256Wx;Xhzbn;1g;yN>P&pA`zsDd)eeayZf7cyAQO%Q|j4O55=9SVleD9)^SgOe+}J z$Qm2m68^x3&8F@4Y~JHS%_saMfTITVL&c_36f!KjU~BHqi_>iD5b#*flzlz8`ZI}x z;EZf{e>?Q2onX;rwxZ6)H{sXIzbuQ?+HEy2Gi)-@hmv6{YeZSXMA4||4K$u#-PFYwkv${Y`F>mlq~o@Gp3(I#TdnEO+{jaV| z7#AV5P?TggBco2&^J27QzQ^;gm%s)goieUbshCW>*fUY`B2Z|XFYQZwN>nz`5`nNS zM4aRsRnfm{f=U!-rJ};(!ljm5N!GWrzPl_mQYFXa4T`brN>BR%Nyxke^fd@4eAA(y z0yBuH{kF4zVF!`A1QZZbEQ6LQv(j^kg*_~rnfjFhF)=M876gF=g+(z+O9=bvAzHNA zib;eaDKRl+@bFysv0C65!#)9hrAA-fi5EG`pz8eqYwo9kx^aiH*Jf%>GBSOVglo^U zzgvujQA^M;(KYZjBrQ9d`c7_9LgsmGkW+S{_tY<-|l^6+qe^>G;3`D8aBU9#lDXYQ6{bwQp8$VT4h z>3p|x=6Q{b$TxZZXB=?1H!q7WTq&*OFeY^=AsEchD5JbE ztEYE_I}K+&!N*+*reUpGE$tw8^{x#7Ukq#+xTE0xJ9}Wdq`uav8yWrAuI0o20JxR{ zYDA->mu8KcVbTwo8cMXzdOf2aIMj`kpkHFu(=4c!xHcdwZ~6f$iky64)LwczWhFgj z!->LFGTC}}qMTrpP+0SL4AQ3Cee{|t_wA_G_50Ih@xQchMkur+`Jb%CZCkif2LP}! zg}jp6$p#dA6(9sPjEsz$P>zby0Up~!C`>Emf+#Pm7HWqwdOWvACFnK<8tct+)ycAcm*zl2>@AV7N6<*}bA)#7uOfYt7x62!+WB$ui z(kgAxP6lB-t%0mlJKgVF_%S}p;(SI?aqV;l>m)}pbIKwAGN^#$mAhP;@tsN)e~o(fL?oI+uC3fS78&SvOW4pNW|IymZ|Vj(3MF_m9zek zn1sFXqvUB1%T?4kLWnOn;2m%e+O^r6VwpOo(2mH`jFXc@qKL7I z35Aw4l88;F2MHwxqfR{YX7}A=WB)R-4BwG|KLNuDTA^@8#Ly^(a8rqFGj=$r@Oln8 zRyuF}(j{q?T{Vxv5*MURMK>iaPby615E^h9Y>86ksm}gS&zi?b;Wdw!jYpuu@so|8 z3q3Md%Hiz_+Lnr9^dN=Bp}q!BsS3p;o0fIpJNxI#GJJY7D4lxTIK`d6K7MTim` z*w7DYvd=*0ntEbe)-uT&CO&b8C57?^i7*&`)b|m1FI{2aqY&3w)SN0kwJ7hh*5Fyc zLbp!W&_lyaV2@X0h6Thx&64t7mksTxuTGRW2eI%fR{}t5jL*0ZVhJp6R|~0%1qa)c z6!_r;0}rBxSPbbU}(<^&o8qUPUVkEn+m{N@`bPUrw%ZF$T3O>1Fl^d_!|FyKX!zb@PUVNAsbdLP5Bg|iti_5y zw0Zb@%s}Cf91`T5RG6iI#4HM1s{liND8#B0Acek#N-H2|O!PS{&H^3<+W1aTVs>0z z^s*lQywa#FJq}uhn!NB%9|(||Vah@4{nVgFB)Qu(Wev)c0#p6C^mq~o$*|q02M;i3qioVTDx%|9@-t|PoFtJ)%Ks# zg~$yYI{w?4W(oT(y!p0WB`s>H_Ke4ojql_?k z5b*)IoyQ59C&+|PL7^!O!}?s*k$aIQZ_}%RWJ3_}h7`(l%j#~E(3t&Mh<7TXaL{+P zh3`tSHEJ9Bk>3P%Lw%GvHngdcPisJ2e@dKDTbLfgyVt?mt4=yBL^Eh91UN-kb{a<` z4L%(Wn5bxa>oio?>XbauV%z#&xNu=CVEwjp1F6wYo@VB7jSXfPeElDS`Q77 zWegtpma7i~PyXRFZn>fyDUOXQVueKp`)Ym!BCC#YZCjKJBTc*>rk}}`f;8e_;WCIy zV&>LZ(Tkx!I~;cSC|~BL)09=l$%`W*8D5MqDoQ9W~QUf%otBy=1g)lI#FT$ylVW)&t~s zONVbae+#=~QHkYPqi{swl=5=FrOSwWAE3R|vv>}pBycr7X)+0qLt-mnG7V%AmL4*6 zNt7wT{0tOlJALb)-$R-L?--$ zus@R&mdP$O?XX}0tdcSgv)HxD5~_R6R)#l$U8M<-KkxHslD{+qLgc4BY{g*A(Rkc( z9LPe0j=V=Gp1D}=^?7Rh>TJnVmS2XSN3<7H+9FgDM^96j{9HqRJtBvuBPDUXLr!_T zlQv4Nm%PoH2b7K=Mv?W}3#koHSm5_^s%(!8%yVF(7k}HxLMV)J+7`NxK5_`j6f)_+ zWMsh4NU*xPmM6p%C(TXXGGO8f9LAwf+zhjS2 zjUnml!&skFR@qG|rZZpGm!2QUN^dz7g7lEj!_=bA)euYXIRXf-q4}scvNbn;#=OXp z097p|I_pvhsE6!CZ4cl8|30ZDlIlC>D=3p}<5+r~a5dk8UhFx9;&ft-vgBy2%wfAyHv4- zzMl#`Z)g@1jG*so_$EKV>bYW5J*q?JA>{eE*Fmg@i+u zNIaS0#A?+@L{hZPMJ^4LUe?Ab~j^4UDLUyn$f)QZr4gL399Uh^6URh}h z$DTK$6~;x6)=pPJ-6WPB%IQ<&u+0;ko3fgDgV0PoUXG{`rbdU;0pyB%rkgTFM?Mk!n*|5yNIo}{0J5?ze)u4w*6 zj?b*?H^Y2nVT8h@7n)iL?e zgzb!kwG8-bFnQoHsaA@MR+^rG2tiE1e>yob_mHoYv-@W(^f~c_m42?~p8;s7_$&sj zTYn=X!Q;Xnq}yP4yw>9V3Jz3+LgB~ZJ*50Ur`u)TWEVVHZH$e+Uld!md><4@WT#UEu1_u*O77LMgOCI|3$C#{uE48oVcw0Z|BpZAzQllCc7T$6 zhz7*K9+%Kf{~T8wib_MZjJd0?k|*R>)t(E=IbMy2uC2@4AI0lo5uw=yU4=Gi|CE1C zk4r(+mglQCGzJ7mt{0$XcG>g`B_=2b=jF$8Dt@zoCg&DW=lUff{BQV42r|d)bV2+IDDrsqIRiM z#5W=t_n?JD$;v9hFsc-ArZ2Dfh6qT90f1eBi?!jyuhgvoBtsB%NUx$4Fe<+x^kBR2 zG5~MUh?KEcb=yJ!uBYd;+h|`M5X$$F`WM)Yd2RivY=>wqmnog9`ZvCgqDV2&O)77M zl5I$DEkILp074XTD0}cGtJdXRVjLo8T}iv1aH~HI3AmN8aYCJF%qq-1h$}4dL^CeX zRAei6&(^e5DoIz3G3%}knt6mLg>NHRHFKL=?OF zPMRF^RH#$SQlm9~x8=}+GR)8`DRlU>>>KqWAxd)(sWh-oawv=JF2=ND`ct~>GN?B- z@2?^-HW)@YE>&-BO^wyTPt%}Wfs}t&CK99VzN|8+h7Fn7Cwy5^zc= zY0~}@rA|Xp9;ea^3y&iz5`vFxh05s~RI@%Kt%;>Q4Q;exchoLv1fpkRN>qa1;(M3n z0h^3WJD_bngn>L#?1doAi-cBLpQSI)0QxKJztmxu;b|szxX&?6&D>i(Sg=XZ+j(ty zRbsG4925?vagFpFtn~DGGo!m7tmb3IHfak*JLK8r?r-jE5TPrJ%vUjE55(0J1}1CZ z=@t_9af6j2ly|z>Fp^3-JcO_mWV++3t|-(3G?EH?Ib~(it7~H9X$;3C*aMrthM(>V zi`%tnUS6v2W{m8ayrFVQQNJ5jrud;c7ivPd#>M$3ErL-v>b<`4*n>l3Asj~Z%91Bm zOUKfGEs{8pA-p?745OSrd-7Bu-&X-4IsJyhr$S?Gp32(^OafzURKws!xU=ImPH_3B zX>73a*~$6oiyk#93oA{-E*#4?B8SbM+r`OE!hX1ahcdR7H1zz$fzPoOYdxG{Ii~^9 za7nWr_$*G0neVikPD#xHf48neVlk&?=Bb3ev4`YM(hw^g6X)=*YAT)4wU2jJ-bzoY z(#^fQyE`o*O0se#t%5k(>ob%_2+PLeeo+s7`ZTKEC1`GsG-frRA3uNWm`8W=m!XU! z205cw@%XFJjNzGgv0LIIWarHoJ@UmbJ8tW;sLN4n_<7FCihhgSA8fjJV*|d{$0OKy zGF?%$S@v|Vtn2CO<>I?zBKff+V>Fg6tK`<(xZ2Sf*{8DdwTu#tJ_|)BvC%5W9-;y{ z!EmBg^W^wD|FI!4#l!0No*%|1nO?!CD$%-ib-!PdTVy1BrnfyNHP6TWO2D4Ok)APY zoj%i5v1#o7^DK%mEod!OVk$haTP*Y?X7DWQ^s#Bp)%~g}#~>KJ{OGhilJQWkTom|y z&wAc<0XM9Y_wqcFhCS??YgQ#!OHG)shxq@QNAgOsb@C^v!-jbeLB&Om4K>&d*pqgh zFNUwxsqrZn8;;DM%KmiJp<9uaU`SNc&by$pRG2WIoTcR}hxblQNX_{cuTIpe+01Mw zu$dLGy-nDZ->WB5#N>y5koC{+aA~+F{a&^}R-7@M#QBt1zObc_xIC3ERAbzAIa)jY z1LtPm_LBYM{!L>k@+}XjtqL+_&RWaNwFN`YPXv}ORnsSC-t@LXykEVFguPL3zweB9 zE`#*1LSm0@SiGQyu)?wB-6s?_>Md)A&$zu-vAiAnI+s%CFc-E3gLeuRY@QRaSbM#v zB7fjX&KoK#sY(v#d6CLF0G5&;pugF!p~X&=yQC2jfgXzxO^IC24a`dY$%^R$*{Hm$ zVi~n8#R}`T^bd)$Cvjc_Cvz*Ml+o?q6jJ0}6(xBM=4PdJ|3r`z4%$01!L zcUu~hF30jQRrY*2^w+}6YvQB{By}7~Y1M!F{rsKL3#@{OHS)=+@bs6MZn3INOl$_* zR++Y`AxC~ZnrHO|O<(w1m;iBTq7Vc~)xa(Zm9PH9i*&to{JUS$Qeka*SbFzvHv_f^SC*Z}g12t4prY5{N_jfl zc+?DH;dif_Rt6hvh>8}yq_P^z*#)|Ob>lOZ*qXJDWEltZ7W98xPApMlg_q{SzFJOJXtJd$))0= zB|7+vhN$;VQ=hMC2r7M0T3WlR-B&YS;n?V6R2i2cf$CC&vr2r*OP7UJti6Thtkt(> z=Uk{N{!GQJxSE0ul(3%}jusXMx`=J?yP1l{S1Y7u^F66Se3ulf`tnnhYAK(h8$?q# zWh4*_lhhrKtgVv9zS_h&R||p*_G6?yQE_oE@igEu&iCF*8qzf_*8MW@p0WLn_m{AaZAztuU>wg zs5-W9BT*i+SopW<*pcN{f&UVgd_Ma`tp1+oeD42#q%GaX;@B$kLW^2cu5#c-=9Y!Af=mt z=Xk9)TOtuabT;?lo$;YADe0x4 zA4X*{JnH8p|g;&o4WOaE#7YO6W*Yba? zBLlZ5#^DwDWWGP;O#x@r$>FL`t#=VU^ksxbdS-zIr(k>{4UGP1e{spzy$PGo+o@mGLr453$px^# z_)D}2!HeZfBCfjKCkxNMbJCZEGrzCzA~FtMLx*EI@~fm>f+8lz?N3Cm5=2)Pw?ozz3sJW=vS|<%&BeTey-zKr&k9_T-`ANKiv22v=X_XR3Gw}UWaboAP ziG{xNZ@P#8w=mYmkyQTLnIs>yGZknWj7-eth_%#XG>z$(7#<#;muR}=l=hZ%q%GRjEypqpZ z%U^*gMhuIi#*qQU_z=3}z_Cmia^qRO_WsF!N+{NEAL?I}&(}@}Wehq1Ni9^-;9)2s zfAh&r8ow9Zr&sD6_C?z3n4{Hu=)mC&XttiSkYj+~SyxGv{ zp^bs_IUTj^UgxkXF~0-qyjGeP)G30qhH!b?vts+1yiKueSKkQs({UF#(HWTq_+gHl z@pup|uC!sKg*kkR?DKx>jKy|w;ZY{xy{4y9lz|f+r9EKV<5L1l4fGpLRMwhJscs(H zjJD>y;IzZN85%;d3Ldt8tLr0pANla`aF)*hep=7wcO$#T%EN6j^01n)&<%DazS=59 z5No-iOu~7Kbl0sPRE6Hp`zHSNX6Ju{lRfbg>q+rZY9hTp111ZtycMYZ3C15Y$dXv^i`8R0^Y438CmObE2ycg(zTpV` z3;HOQ(B19;v%94K3ntgJ;yAbak``?)h&o1H&XX}Rc2~IkbA-chl4NyCX|8sAvib4M zp;S0@$kK+L^turIW%ItkrSQ8M;o3TubmcWiW7#Eo15($L@VXPD+Xw_m5uq`ojxz1M zmw6J04X_uoM;KHy?fR6YkYZX?8s-V!lHXE-UMHTy{7!g}!ghfC+ zzwQ^YO!Uqz=@7z`yT#CEK4VyzYHqxqr>48UB05dKE6Nmq-FThI`07Sg-+XF9gH<#Alb`8Y-%MYN9Pk3^mgSznb+mHp#}39~lDuC2%?MsM5ELQ^LW` z85)ap4K_4caBjVp= z%pr}|exAlZ%;zw%@M?AU8^joy_}crotMDBcnW$Uv_D&i|@fj z(lL4U*}h={x&QIqu`muRoWEp7&7xAJ*0Tq5rCTLG9&=cQHL9!I?V~$^FMNNXDyPDk zl0O=evTRa=yD03oETG$cx%c66yS~8hNh&QC4n`5f1(UKY!Uho~CqGkKLtk1ZId7%I zsbV8Jy_)<~qk%zE5LXw8kR3`WTriQax6NN;v?rP060^^q@iAQxBZXRJ%cUpuGMYBE z-H-kdlb90bJH4L}MjGjKtNVyzOZId%`AT>71}w*UnEGy!U$)zb9-TNwf3Irzm;?t5 zAI7YueWpuBkmL^#NarD>-{d1rYt)(wpUlJQ z9=C(P*fTB(KQ;)p;x*OuwqLC*wm;&q;QOhqN?F5IGj3YWSu=aoss0hWB2@xvLKJZS zSGuW%6U2!R{l0F-?!zh(XFm%D#XT`A5@BhNh6~I6g2G8zhKF4TPU<4JyX z!}{_gNd_&x_5+m=^fUA$8~s>OOt>K40qp4IVe%~Bi% z5R)hV6F~3;zvi$=obio&fDcRvotl~|9zvuV@_uRW^L}GHlI}-n_X_tJ6;71p`+xax z@UY~0MYobD!EJpx*vblQ!<437535wa=XWQwO^S`d^|iWZ)AcPKfPGRNZ1 zHi*d;94b#clq)z`?e1$#1F;(!Ve7NoL>?K0%F>Ibe-x6J=hV0@Q~fVSdsWq&~)7gCu^DDi|G#&r)Gu>R+@;Y+LH{6oYY;mQvIKsOEolMW3r z5j2k_9#j~Q*|sMaU$m)Q0#lF?m3wjf$n|T438CUx2mb6q^EiX07k4CO`bxS#_l;zg z_Px-zlw^qvrlxHq=IZy@^|*-Prq8=96jLPZb8?D*t6lvR-T3IvQz%0woWNSk^fi0Y zlIFrE)^0~b&du?$^$r#kRJ?sz*niG9soBn*y-vfsuKrf+;7;PHsNV$DI!TJmSQnHr9dM8 zf0J_aQpf4xiLn-wIBapwmm%@oQwJRC{i#9t4o9^)DKXAOs7o^@@tjVd*ErJ%o(k)1 z9B;tO%DWd>SEQx#OD<0`_)F%2zcLW0f~{{ifnsjlTIwxsoT8+G*3Ub(t@_{j-L__S z>Wrkw<#SCJE*dKxyo5B$tD*iH?pZT!Rxn@7NH-gF_}tE>JT6NZ{#d?^Y6-f9$ecZ|0n_Xc4=jv8aCaTs`vI$*A>^1*KAGBjL#V> zD{3fC$g``s&mgW;hJ(E_@FQ=KqQ~#m)Cj}IeHRTf5+-_jXYWI;5PRcmFb%e?q=GeJ zw@mV{u$HdWyE?iJ?n(h`}3$=~1Eb1P)atmYGQV&*daZ0vRe>bzu`PKpw`9Rz+$>QKm{&5CKuyE7l@anIa%tK|o}QYyt#pT_D2+$QBh;mh4SbMo?r3$c88& zd&o*4A<6&TK`FNVzVDywdi&~S@;vu*KlfR`^E>BIH9H%hyQbQI8V%-eS){x-j;Fnf z@8il>j!En`DL!joGF(o$k)~fOOZNEPS}k5~=C5sFTj!|aE~94JN#~R8oxJy_@hXn? zvp229bZGgVP<@N8T}CvhrB6c; zDo`_@du~_>^_`#OdT$6fN|-rL&p({{%oVfoN$nv_OLI$Qrv%+yDf`lqj$wYkw^9Bn z=OKKAaP&{}U+r&P&~nwZ?^Ea0N~sD@>xeXP%T0ZlDu2b~{J^*q?v@k7$9w*bKIkH_ zm_bXZW@=#}-r75`V~|Qv;*V#(iU$bq=_gIuLlXXD?OvqMt&g9w6qK1iuV%T`}xEG`sA#@&@3DLGe{0}xBb^>89bdVz|XfUKL2HLR7TV3oJ1BH_JNdNf)8 z$U%xgv_Ww9+{=TtGS=_C4bt0V6r)b|B<~|XIJ8qudGh5mP{#OT+hgGDkS2_x41xvZ z+%=4IyQ^yTr;@msJ7pXlsf>%Whwt_gNc;D+HqSq!#6)@U(JJzt0ufprsL(1uW0RzR zgippX2q)Cjeq*87M9_g;=-u*$1JXxsF^grkZzk8>T`ZGYdd(i!sSKLK+X8UMYlM`9 z-yZkeP^H}W*S4vugIqOf7Ekk>)Jy1ie}NN4A5~_u?ru0ww)G$FR*dGyd(N;I&aAW6 zY}+GLs10h(wR#c3?eZnKcGI$bxCmA_~f!eGoQu~5?g^&@fsA*8LwtzdlpJYBTaJz5Obre<{k-XAlat6vyBCoFY@DI^j%ZEZpf!9@M|G z7gKqd1!neW`jf&Sg~^3+e8@uECILMDgZ>bO?yK$sQC02a`@7p!MBOR%j_PO1)q|da3o2Is)E$Cn@3p6%vKY z42?gBW^2iVGN<+EGj9ME|M)3XPWOm|k+36<^RQFrG<8Q&%Fd-SlyN7qN`*?k+xO8f z*us!HD;k_(=4*3{S7rP7Avcr(TpeGyTP=1lX5k>1U&RSCUP76R3kx~?IJU)K2Gg){ znwEE)#IqX-6s>Ltpci?%_?+Nx=!M$`Bvh>{a7oPCE+CEYP5KTh_KiE^abvlL3~5qB z4kVp_;VB)S=LQ^)&qnjQfL)ucT;+m4o)&n!*ZO|N5jUqqz!edmEu?Uxm{*bI1+6}k(&9YG zo0ZkqVIp)qbW7P7N!b28jUF!q874!Md|?$DU6lwBTbu_kbmiM=PPubM?;akZ_56Mf zC>27Ar}-^XLxUi&M%nv8|BuO;7sdy2nsfkapNG_kmhNaXAgxUAcIUpSUE~s24yDIZZBu?_wX=PdEgR^_d&|#d*CL z=O~Ww%^ZmN=>3#5NM0yS(~{myDr&J17g<2ypCPzK*Q;4bQxESJ1GEq}j2q|Q2_j4a zc0F{jW-+Py@0{p`o?TkS3l9^Wjer9}uX^n)_b$pc%jSW}gwM|LLwPPWRbmA9$_H8AH=J|0@p@_Zzx$p_%GKcJ3%*5qhPUTejuB*Vye)}Gnwpw~kl z>FA254}>lrFek?eEz>Wv@|?M`BEsL-B<2z$zt^^vv?)5zNjvn= z?8i-FeOb<=d-lD>%uL%RCo2>#dJ^*7>z_1I314h`JdM{oJd~db6zUGQuYMP`CVNdv z_&$qVDM;}Vh?&l(xlu$%4Ezw?D14jdeNHvnGBfQtWIo$6dSfH#GOa&!#Ei+aGN!g= zFpaB=!i@2V_V~m%STXd8U9UN3%;!ydYv-iV9S>gQ?030LHcHq9GMaH(!H3!RLVku^ zLPbzDihYbrj<$XvDH5iF2$j#AnNav$##1&t-{u;67SjG7M)ND4SP-Nb^ZDvcT1VPv zXzM2N$0p<(x5WET{>ci6c;7N4P{7^y{)zo1)##8Y05tgJT~7uYdo;g$lSv$UCAwD- zy?*C`9q@3U zp@oEu%LGK{IpB{)8eqP}{2z=UOvB9I{GKYns;t0Im2&PW=~56X9r|Dqf}lglX!%d% zvYdiba{iaP3B6>z_)U&@(`{U;g+-d2`0_QBAiq7Kw;%}^*c8$U6WXF;1lvXJU%%zO z8J>Dt=tOu%C{D;I&c5327+Cf(X_wzoYC-Pv(`Qq?eMwK$jmfH{0;w``_CQ9aS=O~D zfO8RFGB#&gcal$+`RFN?xoI{xw>$~;s`IwxkFtMFBWEx{Vxu9$&97h;D(6NO%>39! zw|sYFfUiPgnGwXRkieM4O$v*hoQ)YHSxr*$p)QZssF9{sGJU!SPUl^+3To}0p-)<8 z+yY~IC$VLr+>vWAN-}$(Ap91;OajAJMYJk}pSzrclEIWs4W5gB4(aDsqF-qGjXm*3 z5h_`BlggAxFA&KefzZ+K#J4YA5@*hT$kCUcDi})AJ0_L!(Yft$cFi_I)bvB&0XqxQ{F|~0f?YW)0X{F{_s;&dg znT3OY5Z+FA5r}tdTBUpK)IJw0ZJYmVF>#DQ8R{Y}sG7T< zy0x`YRk=|HnH(=layqo&P@$DI^^O&CBt7-&av?RE3VXR;=SgmZPfBtnBWZRMN0K)<}w#%FaJyrb^J8YaKLGnEuDQaU)`yt^>M zSeP6#X?_VvP2tkAag21aK8DtO@wu#l_bjHyhxi`Bc*aDnUA}d({k&Z|5QA3HJ`9@k zC71RU7duuv1bGt3Lj@n*!MZy7Gp^(M{;Xeg%GW$6;6j~h>Z=iw6INSDE4)_jzxlJ2 z_hN(B$0>mH`i^o6{cPy>$-U5~C5hjC!q5sJ6IdeCcWw-!FDG<~i$fIVEef7NdA~X0 zM9co@ZVqaA#FN+o_kMqmzWknF5Z;|wWlp;sUlGq>cm;M0bYzt6Ad_$!fgQVx^96kC zHfP$M(C@I@SG-}8I*dmUZj;tj!6&kMFDDOENi8^7(0F4+Ouj{62XXT5L&_aez6RJ1 zXR!sprhW?N8+bv}xP<(Z_#6#z$pN;C8G4znI7ss@Ly5^A*U+0{5(>)W z-03QQ$NOl^nZPZ4A38vwFHb$HF>iOsK3nGV;aN5`Emb&3Q5w@g$en>K-@%RC5P(#D>*1%wSvaWcCyT1K^2s+^1pknJT9Dm%im?e-jba9#x8kW zOV!_Jab7PY@Zl8?naB{3AkT^8dR3e?v4}*JPVF7F9C=KZ&6vyB7phI5G|xAfX#Jr$ z?m4}YRw1;dRBC`f&$eT@0J-!8+O+pn9PCHqojW-uZAkwR7_SRm-syyK2~(q z;|Zby&Qaq(B?~Bur_)FH`Wm+39>k!O zZu`+Nw%E@8wX+fcOzr`TLiu5Vt~E_d7bZAEepZCDPp=x2o?l>u#qr{+R`0$5qLwqqC(S=_B~^ELPrScA0_-a)GLJM( zOd!N&ACMPWh!%>biZ=>h^YAPG)IU}47mp6TeTNT|Z!qUsyOjM~pURR4E=U?Ox-?x+ znrLi2_^bbyDc4JyktkNXcR#Q6*b8u0Vq9L|ny=+C=V9X7#jL8#uO6(<$-UNW;Yotw z0EnQmjix2|z{AA0Uin(3Eps$ye%RJr0KsI%SM4ULgYPp`Je_>|$|Zx!JKlTAU1|&P zYPAmuA($?-bj`if;(*uY8GC4#y_YieBU#pHu(-Q4Z-anNoB;;0O4h?k^3z^ARba0N zfZAr6#1L5zCrMp<=~VHKghE;x6F~l7O|vJ_|3Sf-SARkVR73(sB59-~i5usLq=6jz z^q>;pNa>WBs05$agJsOYc?bIYn25LnJbJ^AZ}{qf1Ix&qAD$-=lz+h&d)lR%X3HC- zb^g+sXGr|Wwz=?Hg%K?zXhD54+P+Ox+zxlp%VLU9dY;Z{KT$P{;08Wqa)@Nl`Yd&DU>6)AU?aD~Tqe_C0c3|90C@uab z3QwssO(rQzOS`&gT=u>47Kv8wAdUJ%UAl3)QqK_m1d$&oRDhqx`rfK2e zb6-aw#w?^bUqcSbm&H*P2cLTbP*&N2r-cj_R`vjlnIa?nE5VPYJci6wO9mzizRVzt z^``H7RXl;#!p&CsIF0jq!vmDGoq9I8D5}OupW<^4VX=kg`RUY*&rxa7Gevs4E8f$% zv~_9oeg|gFr*T82{gl~X7fQjBLTVN1t)XK}s;cmK)6$#d0PJK~Vp8{$Pd^7}&E`VrWxzQ%tjB8`vtL-P(#}(Jv3yOqIx{ef zn=L06lCBfGm$Z`yV9G_1Jn@GAPbgiXt1$|dv&!m_3}m=44+6_wz_n8~{sP(ka|O@1 zK>79A6S^)P-S#7bkM=gLO@P1(F5^E@?8ze=%O6xqT3%aFbRrZee#tU z&Jg$YNrE~=VJ7;TN>Bs`={?%w$C2VF#{%TV#<=yXi0;**C>QNy;eK|w(8+iM%s9~2 z5)`Y!Y-6^8iRwPg0@A(%H?YZafEX)`zDW1V{-(X#xLt7IeKQuxwZ@uAs0wDPvDccaz) zQ%CxsLO&+4_g?8WMgqgT_0BWg`Wt0_IcqTjdkEKij`(YP-bH4b15zjKK46l&HJ5U> zLl<@_jy!={?1swSb*1~j0{2tbLDD5IySOz}Z8GkG!Fcw6tI#103;M7{UmvMNR85lx zHuuI=TcO)K6Lc0odU_J)@ZKU&9iY!jtT>kbWOc0~NA!{9D;HWNR02eLJhY2n=newC9m04_4{*JFsE_EoHGsXTwA0J`fBrwY0 zB%Z&F)DX*t-4jMSGIfX46w9LYvVr@Jh5C^O&?LcV4HIYnW}aah>~@C;@T%8F-AhbL zGtS?IoL*=P7OV{HK;v=qmh)ayuQ%zPDuLinIn#$8&MocO@%XaTIjnb}Lek@3?Ja)r zQ3N0^7BJw*MZpA=7l=KKND`nbH>^N?F|i{t-T;hxLxYC#Oe^)Zn2)RDjLTHgj6D$T zqg8b=Ye>(a%Q-kB1^<3=I@I}u?o3Dz-pknC6dHsWvy~!+5W-5pa3J3#AO!L*i0)Ms zv;yzLCi_geG$o=GR}^`uQF`ig{8*XGs(>C_5WZC7VtF;q8gttoddH(aTtu7zI}JRN z%28kzo!Dpg{?aBJLSUAhSNsmq5joE5FC`$krSRL*b0O8E@Y~ntlK5W_We**HHES0t zjuyiN^kzXhK9uStss$n9ll}NaxBRYMc5JH?^3p%AD@tu%UF)hcl@{GArn+Dc@6Z^( zX>lsqd^36>9+>TxeFM+u`+-u%rBrqx&NNQ~Oguj%;iW9W`YG7`4z)-ba*)uF%2Ju& zbXp*8nu-eYFX`;Cd=+$*xGfu^m_8WQ{YZ-rZSfbQ6m{J3-)uc~Q&y`cR{Je+8lt`mB;+Xe;vOH?6b~MHR2JL#w3)C+d`;iipc^muNs;eDXVp+`6feATOwgTJxha#q-_*}+i6sV>-$;1@4ew4H9c){(S zj%Mp^e(4H^r~&A@0U@B&v52J`5NESe&Yz%A-m)UBMOwUzRvjp3{VBgU9ItfS1C!uc zZBEN-eTf*a9>y{t+9hXuD!ARt&~VhvSU4`2Hsu9n?4S-F^Kt@R+4nmQ@&uut&VI9> z-vg^|JjVgftk<}j>P^YTFD-4E!j7x3x8ItNs?3y{^h)#4%D#1FBXd=LIq+F2xD|2Tb$Z> zA&Z_im1u~U?_n<3_kBt>NLDuv?qj1{YQnxZ{g>r8j`}N7Lq2G8nTyB9P!Uhv~$|5+z0Z@FyhT;D6j=)?aFJ|b; zN?ST4QZI|?u=30h3hGflnATwnGbX{6(lOm4VH#*1+P!2?${8kqOu`2Q(Yrg>A>;MjyFGI%o3c4Azojm?z;@qVYJT{ zRWrQ5f}ly!ZsiUSzqiMG7gyi4YU#Psq}8f0QP5}k@#SUFRp_W;DmDDM!Yn{la37rG zaEqbHvdykXq3G&uZo=P|i-ht}EhHhfTg=ljl@)UuwzSUD6TNdnRBwllllMIoY|cOi zt|4d2rNO_?5@j*ZW7Q_MDkWqw+H%ux+%8}9xE?yYJcF=^Pu8&Vn%kJEb4_fv6(V|2 z*lT(xI3g+`-e|IQ*RUpKc?~|$vz(mjo}o%ZITC6M9*D^DT-b*|@8OmJalU$#&elz& zMFTw^Oj5v~>x*s=@?pj^i(6S?bQBUtRKpfv+3S-ew$CJ2s)zn2rB9OSdte-cDSj8J zBx3IQ_OGonFOBmroBGToyR%I|cUo25Iwls7cNeY*+>L;A z$j$~-AsAWvJD1f3l@%7u;hck!IzDAEd#o7L&pnE0u=n-gz!RkX;vtbT`^G)uL2|2L z@PytE4gR1e!bt3HJg^hUvyQV}p?$)5)^MfX;wt<6*Zhnpi8sUiqRy$=4_-fFCv|#~ ze+^MSROK2zB=RSRpqvl$lvS&o-=!5z%P3HzG%Q zyz!=0((2pypw*uuk1yntwV_s($O%jpM4B7yiwo60#`GAK8i}Fl%Pr8t~jGo@$j@~ zfpgI*uAyvLm2C$Sl&Uy0ZcGX9waRdz_XUVvfneRp=MW+0;_IK@XIK!p+1$iI%C7$5 z53{6^l_)Jk#G*Go8()J1MH|#S?|R zQy-4%yPKVI%upSvH(HMw|3FCGx0f1z)Y{wb)V&BbLSUn*)u%8vze|G;*=wxk6Jmp} z-S?ZxF8p#8_1SELo?Rz@U`1E`?4YG56BwYNpQF`d5p zb*FNQii+l&;u+i~`A(XO7_2(fHcO%b*U($Wjw1nA4f=luUQkpLNI+dOW4i@Qroy11 z&9~3$9rk}ks`&Xpi`2TX(!2{YKluEKyp4D;QFfri0UO}Ld|Wt(dV(%}u&=f%dN^pr zDaotB9nWPvYquA}Y9sL-g#Q5Y%7%$W)W4Fjl|Jj?b{OD-hD$(;w+>;Pc&)h}n@<$F z6Y>@SqC_P);4N^k0OJDwJZRsNIz%GiVRd=c=0~zyPX_oRN&y*U8#o2f<4GItbcnd( zTqk^-g-zH1Lt=+I^PM}`Fvh~T@pmhKi&hznev4L_Q?c^5+c}}p@dnk!FHcibHDE(e zWVOB<%RPwWTwN^-qJN$bUK1oKq015+sFxEf4L5h{jw9D9pt$0;B0HvbCh8~dRg}G$ z^8y(UFam?-YcXkk(wi{nS0*z9{**yV7CL8YMDE`K+Oa;O^r%h7{dW7^*fONNYLGfa ziv(l_gGoc>!5FtkrF+(ErzCZQdjq&d?1c9@ZwR}`zQEtm`w8etd;IuUo4S~7sC_;p zHTR6K!cK;l?zYJYZnr;2HvUOR1TNcv;uw2SVXR=L!2qcntZWCa@do(uexbaOx;R2n z>6*4LFZgsHEG7D!+pQI|6};>>v1|#lGf_Wsvr`UW+TPgj#J0L-tPY4R*}ZDXt%gPV z?aotb_|l^e$2H+0PS7aMK$A}~b!Qs7PPJh>{&C3@_O&Qk7R1pX1jEEw{fWVgmV(~W zIqNW`N5~x!rE6?5uC~MFAHrrdL?bgFfy}%H{cz^_5oOJKRVag5ic%U*XvW}B68Oy= zPtxWFUDaYnoY$nSe?(%{(e=YZ__FCVsTUTc9Coa89)$UFRCkMD>Cyb8*s7lW&X)Z0 zey0Qf2cH0=GbZEE_A_eb`{YE#QAbC|j@1FZx&{VYHtp89adXq2s*kU(G)Z7xK!59u z!Oku~3J9BtURdmtL$Q#ubb3Ll*a+}3N~C@!74K5R%zDHxlH-l}Z6deHmKR}l#h{I7eAN4AS^lFW+;ZTDRgY7*X784Sc0z%BnXMCrqLelS&twkGahIAJJ>}M+dd?ElXxQEhC2nFv=b!y6?7T$R-!XZ;j1fumI-%iIYjf2g{-QlU zGs(GsVm$4Aa_X-=3yr0gub;k!koEhIat%5?LuUbf;I?3XIf1Z62O6_3;)$Wq>dM%n)MCF6}2L<`2kxemKhNL5ZXLhW0Ayz99!<+EO}QG1jZ z`=8Ih)n>9-d#G-|yCqu6Tc^a1QL(ixL%U;`RaW>_zLxJ1kj^qa{SWpXVZPO7@B(aD z3*30}C&LFX=1>YH-*+}*i55A2{KRoc@@u{0l=XcRGb{yUVxJ!Z z>T;a=@(Q4Uaw?i{G8B}=9X_p2^YS(KiJj&LcI^(Gi0~+i1NQ@)2`P-_=YT&XEJ48D z4)i3)sdR0I3}ccEv=$nwIeNqu$B$5YEoCSIXv=Vh`;gmmp6o@%f^aWdpQNYiwp@1s zX8h?59k`1zvYwW+DIzBnyUYKV=UH{JPaw3C$KT7ot8jier%4JmVu31Tq7;YrGu7S1 z9ZlrwakhpM09WQ|e%iz|xJQ1^-0xlVk6BNjK|t*Bu333ag`N7Xo5Oe4B*jkXojmyq zjJLiJh`|J|L9xLXKh@e#`1zlL8B>TXaQ6aj^k$oV=qHyycrSVl%}!;K;vOX)!odoWCFBsq%gAn* z;j@g46=Fr`(rYM_o7A<0wh;OED^;ye`J-6b8Ae*(g0YuSC!SES(!+xre?6qD@_gn- z3ZOrr>u9l1_s{uV*$NYWmR1rI7wBR&K%MP#RhJpMNR4}B`8smPux`L&*13fuua7tN zT?Tuf6n?tusr*I5A!VfK@QZp`*ZNm3vux#k38l~mV(}7qkQHDz0iD({MFO$nGi1yX z^vlJc!%Zyvs$l-BQ=93g{BDAbQ>n9N>S>ev9>wZ1{TJhp30p#`fGe?iOv&z?2DEHC ze!P)`&F%IW{u9cFdJR3(pZaolPMyB+kUAr*ofZNd*d}%NP^t30y+ict#IbGVmO4xo zU<4qxT?q6c1vrsgXoY8vR#g;^{Ck~`;ron!K`pSMwzU62ZQ-kHo+>#i&!3MrI#Cdd z0`lJ*_4Wkc@=G4$zZA)-7z5<6dr@vb=I8>-kDwmK>swlc6gjr0hp0!Shd={>;YUSa zL+tqTCL3S?=GjcjJe!>?LBQ+dWi%!7e_6^8FeoJNbg>7the=6q-^eB2%}r4*l-klN zRMT?miMo$Lyvh?P|K^X8ayEaA>EbmY8NB;eZQUF(@|9E>!_?ry#~rgW?Jr;3#+eD7 zFh~teHgvf0WNr|jF-nOyD%^45f{)W5qcg#L=G$o6+qNFu%@s)Bz5bSp^;Oq;)a#Dl zy;&EDh}M6L$d9Qe`4TW-l<@dGrNtpNgcjE(-?g9b(rNuzp)0SV4gj^7$& z|6PG2m!{e_vRidMJuLMCuSWeNK?ijYK-KJ@Q)Dakpqo?^aGx7D^8sT^w&D)e%ZP5Z z@I1@e=v`!qYrrQqy)~6DE`J`r{rVt|JhoNA?L5*KcUMGY=oNm|7r$sL&zj>o&S!4%$;%<%de^Su zO#u>jyA=&GI{9l1oNs*=8x7TuwrqdSSvWIIEwwHz4MwT8*=-9MIg9}*YX?FXrhKf; z-od3ydxPA^fJi7XM~jR2@5SxpQeC__F?8ekNRgNCLb%tZ%9gH$o10B6$E!wW&wq-7 z?BXo}sr|Bx7Z-ZF>X4kzy-xrep_C6kCIR4yO_{3b3b{P=bg@V za&^L<_1Kr98t3nEgqr$V+E>S0V_TCdnZH#PtOt)?6&Wz?#@X{OkqYh?Ccs_b{BL2r zJ$&ooHOU-r6Gx>y2Un#sUwfyQpZaR@D#D+4z^{4b9kA%S?>Z%o$Xl~`XL5g3;C|pon>l)0aEDiqeefv#YY3lcV<|T4!W>%l6<5LyW;+f|@ zw|M!?<(xCC`Jf-ZAC^0Vi- z^=M$3U!nzl(2y)%?-$#pONbcPTLgEtB5&+zhqpu8^Sa7*M*88ufczR-YbW=q%51P! zpDAb%spy;*I@;Ra*FN}*l;uUzR@KBT#?u?e9?>fANztwP!^(!=_nd_qM=9&K_du>^ zzsse;`TS~J{!oTV7cP^flq&G>8?{ z0d;4u*PGa0`B}`fl9NK46%8u$JN~GoWZ&DGk5Pk4pe90ySZREfo zZD6qikpO=Ed^IaO4fORlqb`ZoHQ`TU<8<|kg~QX{T;nqsSIT%6Xq$ET`e>ed?42LZ zKWc2e)AjK+!oIq`1iJOezkH!>bc`x;psy-8Xxl*>)YTS{k0G=FKD3fAVCJ3|09>x@ z8)lAy8a`e6P{ANAXgiZlH$g$jRp|JuA=vQrB=KO_aln{PO zuw|L_(sxOk(Y={O!61n0lVV@%8(P#kfHmdIdu-)8=Q@g?v>qI3%Sw~sR&8+4VhU<9 zyTV>i1FWv?bo%TSD=eKsX!T3XsldNV%GLz*M)uuB0QONNz}kpUoOif4{SS9;My(!h z?uokrqvjsR_U3yu)m^?Go!0`ipWMvC=Q4RMLWN!?j!r{o^YX1b>*Q#shtjehUSZ$+ z7Ls!G!Yqa@DOHZ|q@2SUZ>mO7XT{A;R&Vc#vZ}h-F)vxp+QMtT zUqyGP+bVQktJQZYC&k}TWx5_y%D!NgYMQ?*&tO5>OojJA!p_~dw(;X`@pJ3#*$~te z+Ah0hZZcXB-rs`X4nWK>Izv!`!lJjzvXYuCUqmwBeYB-ZryLy8y?M^0IFI%x&x@Qu zARRuQ{ZM!Kx?-#1^&L*#<~)F*f|0LpCr%pM4vzID6kC_C5u=5-2-Pb_*bX*6eQGi3 zv$$|&t?QL_*@v&rjRsOfcM;}bSSFf|$!F6BcrL&~FV~@VKy z?n_y|AW>F9RhPv)fHvd81P)duJz(Wf3Br*Rw|rVxZ~Nk`tx9*BIGuYzzvJP-Q>|k+ z96#jh-sf{Wjc?9~<_#z)W%NC_9~l7=aW`&l`K*F(_0Q{ZuOnyGCx1D|&R#=1r+#eK z@uJpfR^w1KEpm`dYsv8B6nUq@B$cnNX)-sqjXyHQ3)3B;<&|I|J0_qTbzP|D@fT8u zjv-Ck(u?Vt1+&HYkPZcBi+yYE`_U?j&0V}=T*k`m_NXf5S{_-PkPNM0(&;z7Y(7-w ztP8Wq8W?X1eZZUXz!Q6Go6Pp{Roq(^{9F+7iGW?moCXF_*%P1*Lc@XOx4HH}!fhDR zQJH03b4fjKHxp{}y5-0A%VMPX{7)0okxmpSv}kT=iMNl#_vH4>dC@cNyT7=?liwzf zwz^MEx|-3=4NkVikAymu&X_VqndY(zw(+eM{u8bvOi7yJpYQVUmw2OW@Qd|aDCHRwUmrV4c{|cN7k}CyT-p32f%Ii@axR_jkl|lC8Z&N9 znoQpTs+ZncN2cmG<6X`_Lg^V8s0wRdgGrb}Dh~j1qAsKo+?qZ8DfRPJ`ku)*ET^B} zwXML%`FREU)Mb5$?oA<3)w?bd`|LOp_LuZN9-hjJ5aiwbxyJ;HPBP@xxF30z_I{BYe7sF`#Gj&)cc6#zgc-ycozl1gdv=?mdiU8xM3WEHh`b7kC^QS}bC zIg*edZc!@QL%*up&-;{Z`oUtEC(3%E?SS$#AC5T=ED@!@d|4^-h6_iot$)MW83jmo z40OmM+e>p|p*ev(|vA95_Lk#~JI6Nzf^}Hqt%(gP^RWuVtToYhcQn0N$vM>wRrws-nNXL?_3i1k=ys%cVT$&@b&T(ovVE zRHN+P`M%K5yIKmOveov;V(LCRszxgFYf@juT?X)bSE+b0(V9{;78lV?%fg-UkUaE~ zg_{KQjFBs$61}uCjj~TOC7m)8J)tcY&^trx6oee>;ts;3A8bM_w6(Att_Vg>jxQ$@z9YpY3~!?Dm+{mH=YAVNjNr6X%S z1yD70=qgN@_CHhep^p$pCp2P_q7B*WG|>y~?J(ltjn#Ev3TOGd>MwpQ!dcnty8|Uf zI$nOywGGcTbX%W3PY*7fWRQS30nljWV1B%h+O4gS1i4plvzY*d~q2Zze% z8ud!gyA{dpYB6bPX$WbfWgMv#c}3JwSY=fL?v#N+)yvE55aqwT*jlI^uQDtQX$?t+M^Xi00H-M+;qDRnos4#vtFuCI6T(n5#mF*NrFD zYiwMA)MkS`Y`+1aricgp8HzkAWqSzQtJVYlhw*8N;_U4GAhh5Pj~IA2iCAngmB`ID3#|pF zkP?B4R>Vi)1_C4^+h9jo$xc?9KcFO>a|<8Ds>lwab|6)+IE46#{I0BFx>_*8PHwtd z81+w=avy2#BBIt3(3h{tmc7)-L$Z3}r}okv#p>rMfn#yEyA`u=e|Si~nGkI+-9?KW zGq;L_>={yhj2hnUCRRf)*VbOcnr~Ann47dS%5}0gX2ZHbp6M#ktT0#M7<2E1bYxgP z%Y$BPE|cm2xl1(CtLsIUQMOGbjNiG>XCMOuSP)AB%}-*ZT7Hn0&l4B^!tRwp^T2vEez&`Xky)F#lSU?vNae2o|yDF#Xk& zmw!X8N?#{3Fl$kV(rQB%w4j!jlXD1B-h_|dny0)hXXjGdkCK*hh+i_%RagiS3wuM> zW!t7C%^*av0FN_*&nMi^-`m@p8i@6*j&p5ymBekZsjnQ9f1oUzJ$RmM>i20z7N=!f zKW@gpE_=|IywDCaWxoFm@fJ}*-%0L!YPLxy?8k+itG_=ce^=Qv zYfy)5`Zi9l-Bk=1VqKp*CLf_p$r?OEHhmX&x1DHP|9-46O4&AhP~!W=VH#YIdo-W0 z$0S5Vt!N#N>DVcj|2!qd6Ue8{hZJnp&CJZG#~WsjpE%*l{zJAfpVs{AnTZgX!!mmx zgE^C2JW(VDqh#aYjKlO1>9nYD&JPpEQ8LvDD~kzOax8L)V^>KhQo{X)O00S#A8b1L zyNWTPaBp4Vydmf%!yZ}H4N(fa)y(?TW%q@M`Fp4bM#=h|W)@8MHtGEkCZtvRk@!B! zb2{E@=w89>qP*y;A!w%43z_X9r6t0Oh~NkpYUmlzJ;T@?z-ptIu${eHuN_-%R?cbR z1zwnp0^wqJ^KCy(>oYDjYdCDmIcna%jZ)6q@t35jDzgjy3*Z(G7SIOJa;mpdbgu-O zE{rf&Ecu-uF#LIT_Dfp(px zMfA9r?DuEfzJFUhEgp~l;xtixXmh?>&*!UC6X&il`@jd5dGNJN?o)T|6{rSM*NtUtycDWad-(bUr zN639deoWw6L$YTzfq9D9Z`ug)Eh7_T^ChC z5GzaBMsm^I7`pZi3Tz_2iwWB~{hkVuVO=EwIwO`%mo2z7G)qB?E7hX2E~Zo2iqJam zeL0nQpC>*pv86L7S0TM{{5JRDBb_PhX7I$s8G(cLmKxg>e^pC^E@!G*DdDmIJl59- zt0&vlme_8U5JT4M;$J}gQ53SmpGFVh{pop1dLW5D;VHUzAB=o4j`8>DBo+J!$k5kV zNRW3!kh-(IoN1t8kHv1%-f9X44tGFP| zziQ#AzlBmi<;C5_xIs|x{X8&eKnMR)YlJHf$RlPfF56K%g{3qhHZ%&_{IB1-f4kaM zVOm`FqyQ`{pf}$U2W~Mmh5iMS#F&I)@D(s39^YPA7!MGlI@4bT5QXr*$%2me{p#B( z8{mgn7ocxi*5pAx8-uwDbU%Q!5OoYwdifh@*B@NyI#^YGTUf7ILChfa2I`~|d+D4- zig?zfG!2Br_~gmPX|}76Q*$0yvSR|1UqEqZ-YI>^Bw<9(t$3W^<;QWZjg|#>%ND#|M_!#sKL@hBT#@_EaKIsfb$IT~5(1pg{yiMfho$Toba%n%qT;Lk}b3B%SM? z>4?(=j6DFk6R4U1e2IXb=jYT*bJn2mz-!3{NDx)So@`cd9jptEAS^;_q7F&_sUX(K zy=Da-Xo!e-N^0=+oT{(puV0f`Idql|jxDcz4!)%K2tnh2QXykSMacR!`-rtTgiy>~ zjsy-l$~g51cG_Ri`=PdYsHQ zpfi`?b^=RLU+MXse%KxY;Q&jkZ!ApjN$4_mw##>>78uQ_@1c}s#SQ3W4(Yo2mmDf# zi7oQrBlSvWc%$urfnY5%{DLLUtuo2)UBp@)gP#BgUAN{C|H*3b+^ed@JN14Lhn5v+ z(gRrM#rG5A`456lyx=-u^NbW4ner&kbJv2`LxM7ya##d8eMq?AASeG_FwuW_M1N8 z{tJzp1^gE-1N~%AqzoR)ZM`#A|Bm5+UUZ;|S$9ZVQJMn0M(hqyhnOX{Hs+h&(AiF< zOp*p({Rv%aNxiq#1&`_Wx3rtX8f?h6NJr|RHB^M4gR?do_}mIZv(9Znv8 z7$N*kJ6s!Wsb-|+ZO~=O=NE9oD)Yvr!36=A_V1s!y#eT!^;vt=&dx5zX9QX?#lp;% z{p#?5Oo<|a0Nms zu&A%1xfGHf(>PQ$f;i?^HKDXl1ZoTwSR{GAZ@FBNKVY8>eaG!BPUsH$jGB;m(HMIq z8$&l*4)KTIyH_zOsk%q4KZVpoz398Z&~Nh-JT8Og6LTpxBbN7XPCgw@PD6{ z^N5PV`f!)9o`vRK)r$VUo#5DRAOKtWue%&rzKa)}=U{}~s5wUXIgz1E5FWui7q;JC z|DQS?<5B-ji~?W7trAmH_o<~t_-T;~(a*T^(;(6Rk1aSu`DTm~MAmOR@GEi~5?g9i z_RvhxZvqY7HO)@xwrkbV6!wVc3GsM(keFEzi7iOSPFKuBf5TEzk^;jck2%4On z3*x}^M?-g8UE9Dzuw|>4U;WjTe|Gf5zL$p)t!R`abcV(4qisc(4m5Ne4{0;j|Hm4D zz`U&L6A!TzP3jXO`hmy>ljr|>D+%Mv+bbgQ&Erwt(^(^kbTDjHMtUu{rr1v_RQR~w zfAuHFVEQAvKODsDFJiXHIlP3)B=A;7Ni4C zwt@bmc5ssd|N2`)pI2QzG#5hC`R*8SvLuc>p5>B#fU@WBT(ShK<^2Yr%wSu+18<~a z7E9PF?Q8P>?Q(;5zqKsYrRuF*Z{T&ndC7ogUTt}$yZ>os1ePmB)SUasWyr&YxFXj* zniWitC8X&955%C#Z}{)v ze}b@3rV-==sS>Y681duMp;#83ShWE<45TkidyB3T**9W{G8N>=(l0o>4%ITdf}Jv9tY+-7?jA}*s~ zhgyGjn!YrvAAJJO%xz*U()A0pXY6^#vnXdgqs7?775hs>92gjkvNkJB>la&4R)+FK zWV9euJX{7fy>}t?vV>|b2jpmLu!r9;Iwwq04)FnZT?(+pZ@x?{i{XjBf<6h`LCJ1{ zN^bbG$oUl;?RtN#y6PHKGN(+^CrHT`Z^3iNBUzW00! zswdyI)J)I}@V-4UGq3VKfC&z5reqyG3uFZ}1MZxSo3RoxX zS!jpO_d)t!#%W0KzbX*m2mZSC@F<~pa?w$F3DV!cY3nekn9%yqoq2a#`_@@qSCpW7y``GQ0R|4<n;!<87Ucm zu=szfT^9&vn))e7(4*_@Z+vo^Hp21 zKmPpJ_Q36di9h~$W3|pvOxuUgR?Nw?B65c(Xg&ky$rA zUtUz4?dM@bE*td8P#%0xYvVD{E<5<^Ok95;1D^EKce-P{ZjDgzC+7Sabif*N47}?GZIIh(k)e;Tgh3Oy45~ zJ+XoWE%5a5uQUL9aQSyqp(r~d>+^kGU8DQZNg*L@`6mqxxF{7rOoPy2b{A`X4_0bM?BhPLe9^C+V!mAsx^g^5h~Z5?8d|9mhh zE^Kc3i$mu>Z`RK&DLG&bU*56u%gc5WeYauwc*K1ceBw3&7IM4c?7y{@!iTKSoBzF2 zAc5avQr2CE4t+q|@~oE8mncktmhOM=N44ax z4^_eN=nxiOn5_^Mz0h{+*&b+g>@)Nrzi%u>@c1@Zm`RqKx032O{oaSxWZV4Hj^{}C za=RKHmY+QJ|44fes3^~_Z4_U>gfA9IB8q^3#wZX31f)nC)F28X0t$i@1?d8g^fC;I zK@@k6w_+KjLjyO0P!m^(x>YE1D zsu{;p%BVc`A)ns2ASO^;dmTr-&nP+%gImA-<_7upn?ti=&d+a*{eDLHrnvn7l=3cP z$d?Em!<`ha?aN?o+90{WV4u}uo|0^ZgHWA%jr#T43bsemDVBR#VL;rb71$y`_KP*r z*Z(0r{L0@q?ngw5##&0`hhOZg>=0owQEliabg8ZrfkxRADA-BZO(ze|>V?VNh5jH8 zIGBH>;oK|d-TvRsJO@GQe@G%vbw+Tp*tluqc$6k5} zM^QEB6Co;m^;=%6o=(-O3ZaKVi`vn#V6_&8Y`Nk3O$IS1tP45Rk8sAfuPPbeK6g#* zYW}fbGRj?}Mn--=lbE3c-eFnUAqAhd|LeB15oNGfpMyoz^OhfU8FOA6V1- zl23e z)KsqtXG#3)IPQF?{wPla*$G#mEsdo&}I$K-ruc>zy@8wAyMCwsq5 zwGX{uSi3r4B2j&^M>|8rjMnB#f1cv zRF2*%G=f9hLd*^sD}RcO5UY7R8K8ZRM|E6}z|Fm^ob?=^7Wrv*iYHJuyJ2=N{9|@h z(+t6~EKPO|J+7^V<(=&MeJtbU%RAt~Tux2V=%`Lg{yjKRb?VemI%-KU{~qGe{)U{j(#S{S<7YPt_f}kL39dVJ%+H-7JEBu zXKSc-8K44?ZNfJxW!{$eRq zy=^CywGvdIH_MSO8C@1{c`<(hNuv0!n%sUx}(?6KSeAj zUU4?5jF^N~dX`JYzb4j8qJut&*q5AtdNk#KZJekOh%qkMKSYhdomJTYwn8Gy4eRR+ zoEnY4cUM`l`oHl4V=zvhpa^ko9+%x)H=JX)-=az3{yk}eDu*oD;@EiotoHd5h;JHD$1Rbg%_`8@5wRX_ZjS2UZK`-bUntFa zj%RJ^S%7J%GtT=b%f6ELukER~+j3u~FLd85-N$|4KPJIcyvIwDZ6Gy1`y2)Wz9k6w zn5XoX1YOjqoD=d$!=96+DWR-|+xU^CTbemo4P4r#pEvDI`K^1?$nuKoF|mwuf3x_B z9>_m?JMlm-7a-cFC)lv`pLk_tOJv>p3m_F8{eNzftwl*T;q8{Ae|K42+*^FnzH5c$ zKYWVrbWQkkTnyE~4fvf-{pyXXzi{Npw@*}i_AFfe%2+yhn#A{D8a`u6 z^yZSciOXH$Ms`ov1jT~J39E@$YBf8?Q*rJ2Q_*}kLB&+to{M<1&J?^8-?DNE@?kro z){`BU1V2V2reRA_hHBa`A|mI1$RbZ@lBzjd%F3?PzKT$JgxBcMuycF_I1=EkAGMR> zkc@}RI3UVA)B%nE*Y6s4fQMHlZ~j_rHqS;!!wbOCURvF>lEs@3vrGEa)D%}6Z;2N* z-QMwae&$aAEO+Y>ih`-}#=3C4{Vy`xWT~8Y&Lgh68flX9`SJUYzV4I%Ok8iM|0O9Y z_ZRS+F8>3=OM>C4GEcDpK;r7w&-&4zaqk~bqWMe=TwQ+!lLV8`n}(OzHATzT0#DDi zlc9d273<=F1OOAf8_s+pY10vh&t3@fJzDlJ2fbT{G1fw z9)ER5g?Zhd@o?lp3X}5EgFz0%SoH2-=zd$0j7^E`ZON}$JuI%RLzLn^FzhzAO(Z$R zk=DXTrr8T<8#e5kA}D5`oLv-YnEQIr;;?jqoXP&fdfk%iZatdl<^nA&0q(vC61~_b zWZ5L=z5YagCALhr=1IzE&aIN293QZ89`mb_ulwvo?D5K>Wu+^phf`;At0UzZ^WTYV zhXxR|kTiVDMGQfulhS&81HHK@G1T3tp)1dse)lF(i9|%i#kwh_^${$_H=3xYkde|- zTrh z+OtPFDt87zgE4};K8)msZA$<^i2w$7rDcrU6s=H?aE1u`XHAXSMqU!^n?&_rWNr)Y zz^c|Fv|)3b7zVu0rzepuOWMoE$Ca}CnyZg(1bQ+(2`BrRDA=gKyIK3M{&V6-5G^6j^8|88p&tcA z4qG5>;`G;l3`2Z*So(V(@JxTV8YWwczEt@k1WGDZID#OcO<`B|s}~B=!w1+V+W*@v z&F?kkD!Kf@7Vv36fX~sw{_9;Z1CK}{)KQeh-0$sSU6fw4(2#J01Cdg7{0txsd{bp= z1krE@oB@=u7R7n0f-5UhTJnnZ9@+z2m`Hw% zRbXrOEk?Y}86OPK%}#+cy-!?Rljl*>1NP9+?_#o^<&F(37H7n`>X5{*J$%r?nea#o z8lK=K1mOIh!EiQ#tN!H5CKQ$gTYbJb7zAaUfb~#))82B^I`KwFG_Q@vyH~X8Ibsil zGi+;)(|4PL44t`CGV$unJD1@q6k*Fpil1C_@%z^v@Mn6}=G}rY?&SrZN5MNee#<_~ z@}VXHRDo#iFP^QYz7=rFY=Lns8=WtN@C+^vo4rR|I^YDg{2IkP?wSBWF^4Wm zIPgnXpmCye@~Rk%g7EA9?_R~012*@UjC24hTVnn{H(6S?iIMd5^kkQR?z@{`cRUQz z#29SqR?q|uMK=ADt?Y;YtE8k~>YtUpM_B#ezQllQFP~FRV5n?~7Mp)_B2MvQotNsN zC|_D=o&YFF+H)7UU~c^{eh$(6d^-Qho4^?qPrv198D?-f zK+Un!RVjcz5G=omfNK5ziwW}+{}5kBdVpn2n`Nm0UWg3)C#{uuX!AZ&<<|XoTB{Xl zYw>B@!kc#f3$4W#yu~t=-v3uBi;b;s(<;IiIpz8*MB!oZ?r#v6`zg4#`F(S6-TF-! zf_hwC|8C|^Y`&R_P54fDco(vL!S!#Zm)N4eWB`#N2;V`b4S2F0n|OxS&+wKtNVwz- z_c9Q`%0Fh;c*}JCAo@>wkFDuz;O2mxu1Z`I^gqSakw-kH>egPp>5zuv+8e@6h~`UU zu03D<>wHh`cie+}u%*j=#iP${$@7b(nha87(8-+|_9#-7TEj>%MdhK8Y1G~#=6G=b zP7bWwI|ll_w$pvVIIO$U!e8Dx!adiXbq)&e+Tfb%l$SBHX=Cv70}?x)xX9F@z4Fxl z*RRvMD{ALc`?L72(8-@30M zY}Lw-Y^qOz0{ag#T68P+(*LrCdTsMLX#Jyyz&IYFu(%>W+rnAHN5Vwv57cIQ1`%iM z1%l3CUG0^m9o&rkpEVdWjllRo?8=*rPy7BQL;!(z*YBQAWWrwS-)ND;+QMv!dRMHo zpVV7K4AO7;jAts2WJT?4*QkwD#-5M8{YDu*Mi2;wAjeh)d%0(@&I!0ZN=TteS zCEA)FSf73s0v|YvbctnU|6gIRUg}*EH9vax(E) zi;G6@vL^HP)wnm89!{;G-7uQ;IU*ys(9>=y4*7wFyHvc&va(nT*j*a|hB}7IX{3R~ z1NrQmjsf5|=n0fWe^k;-^0p@MNB(?~b)YB*Qkl+0-QJL82V)lWa1)#4BWcTl<)4sZy3p zcBB7IRK>^NBG=dd%5V3C_~>KWMtq3C=^B_+)`nl4MDeCE6Hl^sf%j&knRr&s@=EL- zGA8FbIXC}_AjEpLBHTmV4bKc->|K4!LWJoEMa2Z#?0Y2o+wm0E{sn98w;(-?j+SS#^Dg1Nzl`cb0;hP=9jN{pr zq%PpfCVsd(LSw(h-xH5FJK+9aHfKQJ{;g5Qt_P;dW$Ne8|JoujWQVd22sQ{leAH(={6ug_3;yMYZ}Q4lK{k73*mJB3UZz=3(&DeoP?VX`G2FDPWzE%6HZxR&)l z_gDAzU5r+-aLH8gx!##Cz+~3#QXEW5CCGb(?k2`s2-P@+4j(BTx*pyr;q(K8ovF#( zrYdRwneO@O160|K94I0%hMz4~R$aTd?*PKeHFm9t`66?Tqu=3f@#-Jvb82PnQ^Uvl z>;~)6H9sg;BkMq2nR~1sGd@#^+6QM)Bv~}$WgmM33;Mjrz9NbI3Y?hVU!DEyhouwe z%ZYBGak6I0StnY~+6Uj);~bLoT?(H~!Y0Jq7I-cR(j(TP6JyW6ft}L)0Rhj$sVzp4 zxv9%DZDPLEVEz$%Z^tlwBkQ89?)wBR);zPI{!xB=zTx7&+F(xnGpW+t4JfsF?#h`H z0w~&82s!)#Uut-FpJh-NafU=nWhP!>ZDaM#S(k}iI84=7+{+*3rdr;M15){-q;K+- z4vm3K**lkF(Qhy2tV}$&O|k8v(?(fF!bJ_7WOBI`h~qCsP~%S{a98+(7ztHcE5VuY z{eVNUhLLSd+hHItV-bd8LipyN%Hxhw^^gp0t~g z{@Zv0ySBH;GXJW$OX(FZ9Jn1GR)BkahE_{iA^c*gw9+T!{AU`h;R)6n zrZ5v*k=%n{2-1N1^V9k&JwtJP1i=O)kGY364c#mZ_!QT;*y=7KDCk6Q1#U%U@u^_^$;`Vkj7jEGnKmWDO)-tztYgq&<(rR zQYk5LpVReh z3T8T;lq$O^8hGz18U&UB^kgKWtZu{ZdO3+wiO3BB4hrVNq?yRk73r+D*qt1j8X6-AS!y_kxMBoZLCVH=Pj_&Ykkhl=5K1fH z8e6Q_am(O=n=^H*%Q}i_nZ%)m)@k&dtM-dyWj>|vZ@+!yi>?+Ct9<``;^A4(!LGJg z_XP-@>g1+q&-4g#p;Q5cS@#Qh&a^qnP+y!t0ja}kkNSru06 zb5L^oHSmrFu^^g4tBA0Sgcb@eGGDoQIGLL;xoTQ^Hr%4+*mSM0@YMYVJYJqY!V4Ctjc;_Owew-}wvU0qF;tGJ5GGK-X%t~~F+ zI~m%zF$Uh5TU<-0HY2-a8=ESemu19lCR$9OrVxUXt(E7WNaRkMLFib8e{OENvv{uk z94V$DE&IRw4o|4dlTk@ESM>F(M^YN}o+<8(2ul$zTW?wg_Bl~>BR$bhUr$!DEJ;SZ zcB1rV6u5!5N4pb!D|Ew#$^?&T=*%_74wMs|FENKjraXWd0Qq_#3;e+1JS-=n#(ct( z23h{~Uq@o!8Ms|9Y)I6pMN`M|f;XiKNqpqiEYA)dzPD@UX>N#tt}|2xq`o9gBjhUF zE=60nC|y5%2ASYX^sRH_>gpPJ$G&rZ%;Yv)l9i_$#ur+7LRzgaSU^%(twhIU>zmrJ zohhs#=4~A!g6T)Qy)rm8b=Q8OS}9`R zTG2a_n5(MH=g8ZHeYaTt_Ivgm+BzMM#iTAS*Gxr0?~FcfImi6&`v?`Vc9o!g1sRo& zoemRS$=Z4&Nao`6gIM7Vy|8PDeG%p4dz3rlh*@3s_|SAxWO_e{JJ6&25-&1sV;(lm zeiQI{^4Be*sO!Ig+hB7MX4KXq4uj1_b}Q}#-Y{v9HuKCvw=;hchn1=qP1o&S2Tb)~ z^?lV5kp@Tl*^HV$VU?fp0jy=M>AD4S)FwRqJF%B9Poa>Znr{g~>Qj9J(*)%mJKd&7L>%9Y1QES{5`wScHGP521`o zB~{oQIe&N0}Yx*ZVR@xgqu)`xuJXv`?t2sH#)MVZ6lb?4F z24Ea)BbC5cfbV%i@vElv>Bl|9doa7!0lVdhiF^0*7uMWqrYCbGGrW27LQyGq2s~b7f`K zg1*Nk-9RZ*3M@vQ3}Rt7>o* zVk6Qs^xFSWsVD^!FfaxH<7HTWVI?YO;w3P?em?rTCWot8pZ$&HW?5V5SPo``{?@8|Q$^jvzq>qO&bX#PKb^pC$+ zjXZYZKA^HzpD91)uBZ3yrC10h$>fsRo{JlL98fE%&VeB?I?L2ig40ow#)Ngs+9F~5 z#$u=|Amx9dQlscYy2yY0MquZbBD~*6b_RRvUgTRCe^r?vQG#@$6R!78ML2w*kF2q? z$F6J7o$8?l=_|N<5#X*L9Z(M>e&DK}U0=-wK(j}9DRdRrHm-y-M;&5+g5-23MO6|~ zdx*#m?ihjN=JM?(Ou{C7Zs6AOUsiZgvX*Ss7K^S1fn>g{XsL}~%mM7Dx{mxJ!lJqC z+wzN7QS#TP_ZN)(8MciJf8#E-riGJn0luO=_^xV%5LyFrgo_Voz1FDBwj%NR@^ptZ z^a*cns~kJ5`kb#7XFy+3ObEUqx}*ig$OSK9h>)E3qo=|UA0R`#wPlE{-A0z@jF{`!)vEB-KW^Xh)jbXetb{Ix5)LD@ zhk5S~Ovf*(>wKM+?g!S^n(QTF1(eM%8GYl2vY>sSw zzu%?2M#8vcZq;<|(e0EOav?RKmw4n-Gx48QZ@Jl%t$MhiSDf0KhM0)hQnMKq-#AuQ zv`}TDJW|G8r+zBt&P4Hksn^!^Mvm<-&O`FS$owCYzJ@cn+L9jS$GJ07-0Kc3MPG=b z07iPw_l_6h0)<6!7c#iY!tbqU>$u%zUwHtmx85_NQqAs(0nu&&<)1CNa`%3_ z^x(Ug?0scUc~(Z->abI^5zvtVRV?!Jl(*kX8dF#R#GStZafk?Y7anieE!8(tt;ZF& z?~XxE$wu$pg{M2A?*2KTeOn|#l#mclUUMvG78Ea%i*&n-aTf-UuMFRqh2!VggpXvl zwNDJ?c`wa&P)(m#46goZPi}Q4LG&JzB`pQKV`$hmRmTmnY4Zy_^A7-hK!YORMM1B2 zMNrv}8Y*C0z(O{4?4LFQOLV&H#4T2lUp2zO)@h5&9~1ERd2`60M4wK0m@(&Z$THae z-8TUVvY77Quf8rmMqQr!0b>`^+&Z|ELmG80DnSws&&DK3zapU^S?5hMyQ4t|i=>FKKWyR$N|N%6NWT9{aKAnxIF@ zo1Q}hkJn_X>wUigyqz3u=y`kA-)A~g_86iK0EJ*O5%gAd)TzNbAO$s8hn}b*Gc=!$}Sa57>QQ zP4ii8ET?92sR9O^-KFD*BT&umoJMIZgCpPS2-tEF6maYH*nF>fMYx6kwhD_kNtOlN zg7BOEESUFE!-1JolST`bLfCq>&k`iz>j^Q(#R~^+7VIxQO~^leEtpqQ*sb5L>8fq@ zZ?@kAb~InZ@$hBJNO>*K#Ov1yWn`U@SIMj9l{BC5%Wp5h-00bDF&^!_2zn5>G7iF~ z_&3|BZ)+^nyG?z1i`-ixi*COP;)L*A6#-m+#%smQ{f}W=AnAv|z)v%9>Cce01vhk) z6K9|`j$x|gx-3cV5n-<(n-L_3H0?9{pxmX3bA(F3$Xq<>6X7Dk8qtTlv}&vA%*)>7 z8=-SUb`nbTKdS=}gT1jLy95W#z)-2`eCGWF-_Ad0SkyMvzCGpb7_D!UaSEoSn=d2; zH(TL(E3a)Le@Ar+R0r%=^t$RZCp}$VR9UQLbR=PyK(A2YkVk?1&4qnAYsEUY1=GB} zmF~9+-lUV)Ol0APK7b~IXS3vAul!XdW*;&&b)PaWh9*Pw%O(63w*;O#?;6YnqzwFZ z7%-kMUfw`7`$^f8sorKG$t}f_mdmrsH;iMk?H|KjwF2V3OfFzNjOwS#K6Wz9Ddg!F znYSCGDu0$m&Bumy6?CVcAr3ciX!D4n`_83f%x52vK`Zuf{X2z}3 z28ij`63!c%V3jNhz4o=sy884P1K!-_Q{&Z{B|*CSgs?NU)sKEt*6Y55T*mwZTkDVi zP{m&p@KSEBn0pZRRe;OmKT>frXoR4B0mqQHK4lvgZt%iefzWs|$YLcx6HJ!tSxzmT z_5CWvX64rwV`Yylrp~z!o2{asR6}rPKHGLi_n9DdY07XBvl1MBZ}Ok*vAQfaAon40@yg}>GFk@^8EieNEfEcG3(#%W`!Z5Na+cpo#%$! z*(|sxRcn@ZUY*>IZ5>8F&p%@e@NhYVM4d<&M_(GD8Q(fr=EWFVBQG`x+$XI&+8qP! zHGtsO$DI@xE@bf`p>awbp^do2zuKe3?VAO!!Uu3ok%CB!7pcGagF^itTw|bK3Qa=6;GvT+3!CnIC$Nr>$lWEu#3;~Ot_~>CDu?MPDc2v!9M!cn9vDQAt zHikyOg-AQkjjRrnQfnYz10`On-nxXRnqV%$DKk%rPon&~?f#i{0n^64K!pBH--yfp z955VPa?sbc`V64WMCDhccL*w1?MY!C>|ssRmfZiuPmW%(Ps#byZ?gX=p~J*+WF9PDidW z_U}>Q#WH%N(S$ut$SG>K-dA}N)Kf#D6+bYG7yXMrQfrBvSd6@Q@fZrdrlno&z=`K= zsaWwn2GZ|@IKHT!@$jOtx3ioT`>=TOJ9#FF`3hsq-J^uBB#@1jmKp~notxDs^A;OG zVie3CA1wgY3NEvzOp7LbsoT^dnWRpb2&;&H+(N?u|69y_S2R)|gYv~UuMHe7zMV#UeyI%v9Ek(zAiv{KPla+CUu%)G1i!mi@P(iRgi-Lk=;59vADUjO@Ff zqe+$lX_+_rd@;_52O*P!D#LTN2g&pH! zN2B^r-61ubM(XqRWWD&gJG-wVq0i^S44$EovwSZ(+3J-^xESsw|Mk_DGP6LY66NCT zx^2CND96KDS<|dBW4!51ephr`o;t-vdmw*_uA`%~S8kZ5OJ6o?so5ie=euIKJ}J4V zG$-jhD?hXITJ57#m=3$zx*i5TGxMi)bk9z5(Lnrz@w5uTzV#HhA;~JDU$k>ogph;L z_~7jkk`r!iIDWG|?=C)#5@Z@&W0u=zH}`7~@cW#~Yt~~fza`-J91hrhuCG?gwfQ90 zTRz^?Ro`gs*D>RjDXm&H!mx6O2D+D;xR}ck5xaqzmkEokXi;pdHde!KN7$$OsDJYW zYa^@9Ony!j)3H9f`!Uu`4Q<;@ux0c_xSOCt`mh;c+b-F3QmW5j%s`6FvWaV_Sr*-2 zd&4sFzk!aB3IPB*{O%z_v8&XmnGGbmTe|i2jV68@52CU}^(!phy^(SIyu+|@6$Bdz z{N%pK@hKW619k|07Nomvt(Wa-K$s;=Kj@*P-C;PqSZ>o?ejR|s5%JOhtZBsn;4=j*NZV*gV zROI&CtUd@4u<7liy-L}>+lkKTF<(R{+YuXMltO8h*NA4En1EH}W1hzFwSuS{mf=@s7nwRHz8!iw zwK`b4<>T285gSw{=xJ!|x!7Tw^7^J}L>|sdSjD|@)B%2zywdnh0dBFGQ2O(nchYi; zy;W~FcPK-X{xMdu|3u?)M6Vior>`QX<2iS27H9breZ`Aom726=OG>o?c7d{wQ@XKk zml3TgVJ_(K#j-=s!mqsODs1Rs#Czg>J;}-iXI!o+G#)?fta8#ygBH(cV{|AUMWDSW zG74^!b64BZ*e3Yj7L6|tA!4)AC!mLe>LDn)D(QW+kEgTJ;8u5I&_ix9llY%Nx^o)D z$Os!eUkRlUTmZXO$)DNhM1K0Jdr=R^pLQ7;j+mo(W=xDdJGnrAEF#{exwHR`w`IeC z%JJ-^q;$9W;V1*8NBTR?jGd%^Ff8g)nQNr9##@zF9^_D&BxQMBH1%D)+p8#jom^eW zd6k||85a+9N?2*>f8##7x5<0)x~AnyH`$sY+FU_>++Qr_=sn*hKf~Qqv^M>b=8Kvf zR2&KIQHjp&ZiwXzVa$q&Bqzh)*ISLT?@R`LE(fE}l}w)|rFGS0<$MP08?I1w;Iq22 zv#rt$Cr=N$RvWLF$;TJM&x7%zoTJ>7^SGYSdm~R0fr{-KCiYnh$BxbxJ3id6a4;($ z$AZI!!!NB+!z(V;P1@C6MW~qELfZI{L^Ubf=eVVq`(I#(Fc)TLq2Mxbdd};RSenuXl9jb9hg~a>@aOL z2K{b#Xj-Q0f@h`K9R?9S+N7P9Ih)O-1fhu)5^0&sfond4`fK?K0Ki=`^MM+XnXNb} z*tOnAo>-J_*Ko5q`+2Y%gU|omsYw+&-7Y=U;~*Rnr%sL&k-%eEnNRSX%xf%3o+R{? z_(2rU-(p5#tPbEfA3BjLwMvV!b24@Z?bKfLK|&Hc6qAA)R`gn#h@W#PGZT=Obfi}G zjD+)r29=2`oM@(gFm0=J!nrurdX04%icsH1Lx5?)!7CWSpzlOCoHT9*u+KAtUFc4irAIEec(wW0QAWnk~D z=u7ua>;kS@IWLsB*LVy1gyqs*TZm3I;YBA@&SgVn3e6oe4a$TBOBU)P-4@AYs8oLI z%v?1cbbfb(jIGrQ#JKTtS9nx)6`sL?AY)u#9%QXXIDT#UDb zqLS(QIHx&v7L|?3a;$vMM_x>J3yv!^%6rFf2B1?wyHv;nqGwMm_Ge4M2BlEN9;Nt3 zB9-P;XRf+$wL@n3U#|8*TT_QxWR>xaf-|0z_`moI7twl)8Hz zi|%w}MU{#YO8F~mWi#An4@nqH8WMO>GqsNy={`&979CqeU;8-VOC91waU&6CKjCm5 zN(yBiwWw<$;5!y4&x{7`&ldSFNT1$(l6oed(tIW!dIsxea?H5=SXO5j(EW7sM~r=d zXt1g6Z6k;H#&PR=g`m_~XI_5nX*?amBS0e+>Hw)Coi)}Bks^`)^k^+6f?oio@KHKv zz|Fq)=ybL*EwZrB#>K~h)I>~|=D0r~v1)bewLY;5m!5IhcfA&ymgyGPS` zlw+tXT}qy)wJLt7U>V)ZUbEX;&{*-cb9=~iP5NPj`zjUQogCjCkb3Df`?_em8==_k zsP~+!YVNY=xE2y7| zaGEQ#oPGUgpCohoHUaVk=d$sKE;Fnp>0?$96YO8rzr>>jBWZ7ca< zxs{=x5Gv!UQ}Bm^7J}nINHDPyZ!zdRd82@KVqmdHzuHH|@qy2eU0E$B zypP{JiziV6>{i~JgyQ3KsYr#$>Ntrro8PoItOa9LQ9K%ptL@LgMe5r)ReP*A&cvu^ z%jdfNIoCt!Q*s-!x;1<0t+pUsmUA&-HxL-<*V?&SZR@JcfDr z4|m%&Fi|~8C&lTt7UW@e!IaGG#z*B1zU%&(+eg<8tXfAn@ug>g+q?0rS#i4EK2aZR)qQPaCZ2uA z3k7VGwOzW(-Y%gTKq}3)7CzfAZFeqqJ?;S9)uYG0K2>t0w@ZNwWZD4uga84uvk@~qe zY&P6ni*lNLR?VHF#abSe6?mwkrQ?0jxSPkOB+eVOK@zI zE&2H*GKD#y<};C*co<2$2c9`!z=RuKO3S}eLI6^r#aqI=x&L3pkYUxF&rPFQ=Z@aW zgEO!DB8wLuNbmRtp`5nfaNv+e+H-rS8pdU) z_u^6UxlS_$L@y{P3Jgr|U3tG~u~J@bJGv+8ja!Q;ZD>C*XGZS?*%Mr}2EqM{WK7@7 z;|vk&F*{-@ws@B?{38-Thhat@i-z8E>Ag`iEj?B(PADyYlklo>xP;PPWwET2C3snG zaspMm*fFf#C&V#m@pN@I$2&FCGdB(;h4|$hrlT02)vDPQ8SOt;%xD(nirzPjUQN#k zV#M*Ur|*f_8^g(gnxkr2vy-?sXB+3rmU~K!`o>-oyMdb8VWx$reI@1LX@!lrszEq^ zaeOICuqGtHI5L;2Qr2Wd9`9JuHtfj<8m(*nfUH&hb0X9kc30-OA~}cOpS4x$UYM~q zvS2>Ng;K^&tXnUoWf^t|?w;tOZ+ri-IiE+c(8gn34DP4i#osAs`7!9Jc)8r1=M=*5 zgYL8Dk0$+~uCpA0WdaHD`p>gXig@=R%3UNsF?gGhVJlPCg0&i2{a{e2#RFHyW6Taf zg!SBVnena6GGl7WI~USSkDP!s1G)bJI_*Eu2x6Pd&tGbbd69zb>yy^G5MO}S{-D`(dUCEz^~S~ewfRElY|*jFX-z}BfnOVpKry*i5+ zR^@))5W}J|M#~lT^bM@OH@7-yZqJyjXD4PxCm%A1L#tlsy%QWZ8ah;oF)UviV~15o z&{wj7-O&7>2<34AJ65T?@}Nv&T|cve8VF{^AYzzroXJ2TruD#a>7QSVU94P+LLFMb()l4YXk(_5JXu>KNv~$aJf-uz*Wx&+K9@ z1xXYR9IrCZCHIS_ymZyj_=#h{DI=^ag6C4SmPJ*Q6nxDqI<~F;nI&ZEC8xG# zsaiQKlJ3+TkRoDN0#t;UnyVNTKyb-A~i#-zSnu5oIgCmMCXCEC4mj0)~Q z%ZKY&ZKy50Z~^ zpZHHdxHKY!M4w9aSR7ijP04O#%SNn5X311*{%P+RdEeQy>@^iAcb&%AMM&sH(>^@$ z80(4>$;dEhnalBR>Tw7Pt_iuIgVC;RpC=9Uoeka}nM9rQSS{cx7zFDbf;FRO6;CIf znLc2TQ#pn?iy<`{eecv_{3y5d9_OrJOsGAL?|9L$jmzCL3n2VY6UN?D47hnOUG@lp zLR(m<_m~Xk1gj=6Kuh>-@xh`H^bxwy>$1$%c4a0%sz=Ez3uRTk|Ktm7{Xt6MRj1Lb zG7SX6wnxlPib*I{1vKT8x4>~inQQWN8}_3FaF%fTK5>@Fa*xPiOC{!fXM&-GGbq_D zh+mfPsg%NBulG``tqkuCRP@$8%7;aj0Lj1tO4ign1+kg+MrrOi0a%ijur3+kD!623 z-=wA00u|YxN?aErXqbtWeRnN0Dv2si8{b2o$;i{~zB8SPH_ueG@`y`zBHc?!c$jAD z=ws7oEo+wCcIcUyBqYS;7yKM7m_xGZ&JPJcGlvIH3OD!~7kd~6@vFIAC^quGqT;)s zxeKpiVb@aH`SSEG_aJs&2gCP}KPstkvZu%(aLVZQ%gJpnOjp_&T=gV3p(B+zMl(GR zQ=sg2Rp{F#dynt?a&rS$+c}xM+-8)k2<@7|KR#N-EAVTSq+{?05xX)${)H&{=>YF8 zXd7{Rz{P1DGIbv+!gNaWCwmUVJ_rh?$6DPgd6N#^x47!p_P~w02N?chy1(Wq&i(0- zbgih6b3ToDq2Dpe7A3jG~k1Qm~M#lRuQb$iySnV?jGfA!3z2rm?qIX3-EW zy7k_!;vq@Eftd~=kELs8AaY{j0;aN3q2fbA$HScDfYkdwAL!q)J-U{xe_%hWQ3Y3q z1gY@Ut;(F==KSCHsLvuX%XuD`a>$}S*i$L1Vu>^z!Sn#KIWXmY2g#d23Ze8{hWZEK zj_o0h==axW`A}$Xo8F*#NE6P#OOK7w4jtSxF)x-YK+00xz`AnBdDP&Oe6HAMiO|N$#=kedH^W zR05-sTXBxg(SMfUq!7S5va?8uz0ZP`NOJE@Q-TG)*s{LPy^5U@lvi1FZI?i+VwP&H zp~J@=G6yd7>qUFA17~pv;Ej&Ffx{L`J3%E z=z2M~`vOB1n4Cx-OiM7Usno;MIn5K#(eEB41j(G;eNnV^y|C~4W#c8Hvc>$LDz@MF zf$T%#;uP(#7kD9V)iZ%%0H*x_#ldg>7gRLlVsv)kG{>&m?sS8U1()H#Et@fCV3f!IMNnnP6w z`uA``O(7T>C?SBm>lo_fRxFnagPk8~F?Ff<|F)IHrn>vjH5IvkNm{Qz>81batlKS1 z>^|^=-1_?aiGebUZ*f^=Em1nKbe0JdAcQYRPjl*Zd&ThIzKAd^^;1ahqF@4Rukxi0 zO=+`&FRm9mauz^$wPr+Z@jGjXi1xy^M5v#76>?vd_=BF|_?X;5`^m*#L#ey}>x7*z zD4rJ#toeHds-iZ%PFLrj-BDrn7XMzX`So+ zo;9t7e%wvz<6n?-?(<3>L9n5vNzdO)ObYSYQOHHJiIz*yz>^lWQV7MUgUqD?w009D zvqmDzUY|hfYrNmdf&Tk@QJnlir08oEl-qXBfelNBJBh=MEyTg-gj&#L=+BKm9(zaU zUzmTxFh{6wX;9f@>=KNG^sp%OvjW#bh7~sgKMV4j$a}Q`QGBG?hR}G;1*nV0G6QZ8GcBW1%#Y#=wm#>20F+`aFhzKN|rbO1vb3>Q(6Oy(>Vn3nr7B=3?jj}$lgtM)g2#ew=& zPBu%JIg{hYT(KnUHj#QBF^yd>XG$f_ZlCMd!*iZ!q%iQ)A0lcpI>uq@S9q`6Lh8D| z)NCi2ZVPP^zLv4D&L{lXxL(uwA7wAD)xX`_z1zbGI#XR(9}W-Z_)xz(S%l&Xm@T?e z-yizhJy%P<6$YLw@`Z%*caEjL=-k z$Jg@9btV=K%LcFd5+?n<2n)7f^=eI`3P%1#}W@)B8sqkFc z2T$Enxks5DP zsLXq12~+&F?iQcHbo|kZ(k@KS?dMB@%8!It=ditBB@ofoDleW&z+h? z2*m}VvaMZXV0o_Vu$rsoJ!`RRrt!Ji#PCUH-OGg5z0{PK*)j(F(Mi;JPfM#no8SVw z_<_6-g6R4}#&+1FP}qoXaPs;E=K7@9)xarlSLn3XW(+h*0FZlX%N5b1E5>8VS3@??gc>&e`Z#-@f-aVdY7Ms%Xb$ljLx^{!3)E!E+2sJPrh9=J6c z21;XmBQm9c0CBFaqIadDX)m+2dieK3+Tenri8FUt4L06e$kGJqE5wIVnl4nRl>h)T zG@yXck@ndNCoEyQ6^Pz>L>qO8pFrb@YR`ChE|x7DtRBC zd+@|$cFZT{BbxM(7~EqZaoh&-U=oHs+)a%!v^>`klqt;ySpyL9-;#7hF!&pKwMe?C zbmMJkpNNom0u{u^wlKOzyeBn0YPZ0sOr^TyJFsSRkssR9+^e=9vu?R&tawY>Y;VI_ z@ew3m`1*V~WQp-@qPs&Dwfp5t-9^ufx?Z__x%!97;^%FL9GheugMWbY{&;-&JX|z^ zp*iQ+oHwjj=swbe5*XbZE@B_IGu!io+Ok9LT)m`=KOXo!5Cf#X#K(}ZCrz4Jz7$|pkj(tx z9cBa29*N3w=XI)pV(RTb6t??axeDs!ct}`*7SuX7Ub`BdOYfSOuWD4SD%@@9J=w$w zC;a6P!JHg}&H=9G)rS~*`aR%JI?GpZFEU4m6Utt?T{S)|ZKm~QgEW68l0nPFojMBwz7ck_Ar*M-!i*xi=7<%2(FS(Sz0WFZze@gxZO?e3a3>MHybQsT>GM-|dCKT`0poFYKu3HUaX`^>@%RGxCqNp|R4OWsgO}k~P*!fz-tkAry2I}V6W0?N-3vxJLXrL49%lU{_E>Kmc2 zA9!6`BO%On(mL z)soUn6^5e<4hnd9c|mqjXL7;g_1Joep!j)Ft!X49aA(RFIj@j#Nr;t}ne$p&hGwJj z`q89E?_$(L1$Hx^ssR97rHb^_v@lmmX9L#7BygFGib~h1U%{EVR-7 zDNcho#^x$*V{| zdUhN%9w*SD$?KPCyqM$6r{h$tn33*2EQErqx0(dJ>Hh8=b{Oje(vnC;E0poa2l0^P z7U?;OC$dfum`tj+jLP@8Bjag41QMa&DPw=p*nKGQfStv{r5)m>iipg`C@TY+L=E1i z1WA(bYuZ;vj73Ug&(D5e(fv!4Z-8$Az6{|t8>e0dHU{1@GIN#7A6S#mTj(_R7E(%A*@%N&({>xAf5 zkD(ZhknxeWajUl(PAv#|Y~QB(<`5J(C}iOFBbirkjMdP7$T3dFhl+`2+z-NeAG2yS z-7h_CwqK%r-S^nlFw8k!isO--v56ayb9l^3$BwJynU)HbAra{8qr%k8occ%mWqdB} zn&?r~h!6_}4Q@!$aGc=Y@MU%neksqO{zLx{d+!<6a*unAF{ft2*2;^Ld*jqBszARHR~b|Jt=mJ+qf7u0ROQsQe~0euMLYCq zX48KHzoFD3ihw^9N5ESfXp{?6rYnb_whCeD(!w4iez#kb(7>AZ9Xr`Z zThVR-jIgcYN}ov<$lHFqvSpLn(5h2W!9TWX{AlrUX}P7~jkLi}rgURx0`9m@Wq{g= zcOF)c?u#nPAdOtjI&3dpqNeyZ2#fS!Cz8gIB;*A#{zZ(og@iQQ(l>-7^ENY-v{uc> z8BuH#Whc5RQ7k03|GP5nBB%f6>PPkmYxg?lmjNUYm!@5;rip}bax5pl5?>mUO`{M= zBL3<%YilDzdwn{@?ScYI(NXS59TD!uPY!m~I2%l=hTq1#hOea|zqMJtrIKi&+9I-0 zdTr!UiVr%6(u&?n9aP*5z_xO8>NSVH+i%lpzu(lW1I1q`oo0UUyPB`1!?R5xR}R1V zTDtpMM!=+-L?+c1J9MmX!O+Cfa-*Czzh1U=AB8&L2vESgM`>px>{kiaw=F8rLzv0| zPc)uYzHnwZplYt)a`HpMc<$DEJMCw?7KD|BM!xI}3M;*0={!@pc#+!fkr&vhF72id znkPw53MsZb%^tr*c8}<8hs@#lC&7cvRs$s_OjZ?}8O zMe&;p61Gj$gtqyhc`(n?N-f{yvl|KDQA1BslTi zT}jeXE)?lW9+|3##}mogM$-|8;A&bdH3o^^3=q^Je3UCh`)Z917r=zz5 zCQ2dAfbfh3_!<;T=&$x5;DR9rF%8|!oYL70u*QDv5QKY-5D<# za;8Q`T6*429Vo@q2iLGETEpC8uL??mtEj6O4tB-})g9lzQHnsVmvD?$H$iEz$I;0Z z8V_3(PnPRddsyktKs|O+(+g-$Y;pX?A~e><2({J=oH((AZq05DWIbXKoAN6%l(#d; z@(_TeasyYUnW~4v@`pS-G{2%zYv1}1X@4*Co;?CTHvxOes7%X#9GS8nM>QqZS<`ES z*7}R}g#at}&NOJvYHvc%f!2{5i*PlNu%H(6m@M`M_s!%-Gv6W%n+{v@jus3@M9K=0 zEU5Xal5P)K2L)~idF;!fz4oKGZgty`TWI6usG;T@Cycq;u2!oAtz_VQgR&iqf(oO2 zb`nUE!ehN7#h#5RA7g!~rRP|TSEjZ=h}G4gxvjJ2ThLpEvh@WPh!XS5V-Cal2EG9; z3kmH?%;F}-RXL`o=GH4}-KKx{u&O^j>{KMRWnnyUb6Sd$*&^bT_1U`Ani`1+%1y60 zk7;nLP(Uu*rt#BfcE!uK_`7Lxoq*i!I~KnQBE}LcFYUtAQIu-6BO5{AM~AIKW%Fp3 zp8M2c=RRhd-edH`*16&tzUA?BUDWjb?J@7I3LL>GoNDL#ja;u)@lf(XZq9ifvk7m| zX492@Ah_aJ(*IE0cY$Yo=)w|g;m3ey0=~y)c%f`@!0S6grBMSikkzSRQ;;vo2BX;`=hrxTAod3bYX;o`a8YeYFyiW3@?&hs27pqUZ){Wx&vt6pFZySsOuBm40%) zLf#$!`-Hg0{jate?>ly3uJxEazUuYHj}idre{DNisimvQu2H*cNZN!VQBcOQNUA9S z4M9*lZ*Q>cYqdvxKlgkdo39;A-3~T5*Oi|+-HHV)3ygR2JZTJS_x5!Cp7l zXVNS-@Qd`h5lpA%qjW`@9gBPx3Bo{QR{21kqjU|ZFSkiUSYz8GJuL%Ih1+o4pMkC| z49bJ8iT*kleC)lqgLbI1ZA54X$by%RyWy!lLtq~_Y-u^V8G!WAgz=5jV_ud4HHwaR z+j9rC!LHvKpagNvw}aM&8fJIQi^)-Im<$ysugP0Oq|&6Na)6o}uqE0jVFn=s4leQX z_DcKP9rH=j<%?B|12xj+^c!F~qyibD^66xREIJHc6>Vg*$p{A1+HK8?T6brHGV;GK z=Kr?0?Cziw^6DEW16-Ea3VhyTB?|DT^3_V-mX)FV@hKFZAh zTG(&8KU?9I|Nk~L(E>`a{J(8QDv8+M@O-;tin`eAt<*YkmGV`vtM7lg-VXk=Blho) zAGZH<@5f*F-!}c%4w7FV?(72k>+P=>-+tSLBHG(RMvVty+(1d}_a}?> zm?z!oepLeg%XSb+dEIzZ&+~=-Q%3J`lZd1HpxCRj2zhN9TIEpREI!QK+*Uws=X~htqD?fCQ`&GSF+g5z`k_{XlJzivOS`IF_Jf$+}{yibDuoBw(( zbAv6I{_8cRwtG79?;m}A^N$T;{{HBt^f5X6y|FF@4oz=?o^3*N!G*fG%54ewaL)&@BLX^2teb;+VbPLL4#3C{Sut771T^&1kf>4DYFp#*EQ$ zgsE@_o&&d$oJ6w`|9MRe*wv+JX$BF<<*_K6w3IUc*%y7iqAj#oM0Eu+# zg0liprEi{UQ0tB@=sS^7ftOY0xu$(FLvGktR|5;0pf01!?==X)DZzMYl}w)ixxK;a zCmz+p_6W^}YZru1qrJ~?Mj%8?F4>2P6C6X6IXbG$p+0>vKQuw->f@`+n`(QMGUN=Rp0+bP_|{Dh|MCt!N_w-g!giHpP6)jQq0YuGdasL(nRIuRZ0 zwkhXAWDD008}*Qt)EU9fo(I2eRY?QZ<2JLezW(?xm43W;wbK*UJHM}?r3_25DWo3Q zI+Y_~(V;HsD(tIeboSX%Xh74@K=Km)ql0dqAcb@7!_7~)gTg$laH8%d2)mBRP&@!kJKfWBwENI9)uO;xO|3xM;OF!Cc zRP559PIDQTe;-Tb|+^wkF)L`kd9KhJN@qP7Q)`wlAj_FNZ%V65KWl{2uE}$k)yS zWwfWN-zZYz21>D3Rh|Vj*c3+blge4X>v~mg)>WVb9em+dPqw%-C0M`v*P;Ofi*FB{aeeWiUm(0MH@>lc?9KV4a)~kd1_pSmdmE}Y zr>hd8YrwBpdvRmqPAvh2->5M94rS?G3AmG5PEg>fyig0D*eAF;RN-Zw$Eq$ATFap^ z0c-;Y;(h3vva$xCx(^ z&PK-SE5fVa)ySQ5R-(_6NqgFyo@COKw3&ep!7iY`KZUp|5ONb%)<@nxawI@4_cLU$ zwW9^lwsqJIHU<8$6-mm<*)IQfc~W`PsYlhuc0cMu3#Yvn(6R+b0-~-S0EK*VwS0ua z1K#s(-pPLQUlmBwB+sCYp$Q+VNIX8Hom#NH#J4)1&2xt91$x+zl+QR$wxGvvs%(D% zz7!MdI>7&@BK^gynn_f-qF-;MJsHV5Nd^|pU#V(b=;mz^SI!NVoLhE=Z={12#?q$r zZz)hPT;-QFmn#f}SrRLa(6t&jU(UB9-t?>|U;E?&gIL;(IDv9Uy)^HVBj%xL<>`0X zAWA2Y3vJ%f12t=M=-wI2!(Mf?B||zch)K82eG-llYHFCZw{x3#-?9#p*#FLX5(>8|De05#8#UvE-{dT#zoTyG6j-vD3z4CXKo+X zOp9sv=W5`7cKsMYGT)CpFlVyC+(a#e%ID=ZnvIoNLcrU_bd$%gZ$`PA; zXO9I=Z=~6eRa{sxN{(r+*f=rO8q9d)_*FgEnJvtlcYb4GH=%OJq?^Py&0OWgl2hY1 zvY>f_qf45mc3x&L>GDn^vA*U}DDqW(*_Qcx@349km1ERlzpdD{2j`k|9Ty{wwidCC zYKnMYTpHy&rwMxO9A^8#AMj0KHm)lf$ycw2Yd2SEs-{bfnt!)5tmc-$zk4ZZeD{5a zEzPAULi>hXgHfd3vO?)>Us3-G^MPY?Vp^Y>z_>S2+icV9efiZ6#^-3#0J{Bjx3AW zqNpC3^HNPpC-rHlSHty!zikra36hC*$%u13b2dgw)8X#>DxESPgFHRLQjuta;owXu z)Z(&@`5RMLXadXyx}I2*T6jMgyP~CYeMJhm+QOsPrWR=<^->p2c^yN0g(A(}F&>4Y zg?bQLzsq6-*Q~UdJJy`(!AIvqRNBAcx1nB>%8s36Dr4wKOL4%fAzNZ`vna<#jja$0 zvnN00A*riDLq*kAMTTnIsn@C8^H#4^+l9L-CTvA$ldQNbTrTx3i48fyg<$+MU&==P?x1&#J5w2Xqdb7S zzmWW(z1mM%rrT4`lP#388i#HAf*?D1)Yf9|$ovEur((}ryf$+CAR;jWQ&?UoP0?PA z(X@oWa0xw!pQ+_^#1|#sSGk_=+;EODp#6 z^y+@&EH>@;rZbye7>H95&(%pSZx0NdDUIc?G>i(@PTd+$anvSENKS=3+MSy#q*)M#*H}Ww#w6@(um*1@7^_x?_BMGp0vlQ z&?&NW5|Q&J>mOlZfdLkJzb1e-KYO5rd;Impg*T@54w^ZnX|}djwZ$0U^uQO5U!)|7 zWul19QfUc?Ir+xkA76vNa%pIm+gY#n$Eo%T>bp%y_0B{(KdHX--9P46V)M`BT>!l%&>XKay37g_D9 zzNVtS#QE|NCPU9Xk}%|C2dkv{(iLoygnfIB33|?tAhaS?*ot-M;Vh7(J~*$#j!V9L zvtqqU8n;QY*0m!S8-*H?KIoaWWD>UT=>x? zE*Aqw7My3OxY+5FD5bJo6|K@Myi!95xB;+W{0OW<(9rwIrsN4j&mGh4bZiH+zRhe; zmQe_BUuVaSl#}gA$iVVT1$AydGCiJ-Sh-V_MGZ2S!}?$;u7$Fqfzp7D9*3)!Wc_W_ zq27y00}sp$N=)vR+qu)7X%Opcj@gXA-kAbx7I3cPc+hZ;RgmrZtzLmJ{f!4L{%^!( zM;ERaMmH&_o;9<)_NR8*CKDHA5m;AILXlGyDpvkEE#gj~>7zE2EPM@q^pigum}h!E zt;Vn;&->>R2*+3RfCoV^BKUn0kp;dkH4GAt{Ikdx!Imx;aqfD4hyy0UIlb_1xv<?lhpA`NzTCr5Wdp6wq$WQSkF84Wzeaq}TALT;O2k^yLbeKys=RI`L51nI>%*3Fqc$Rz-Lc zGT8+mzX5LJX%v_}$9*)xK600#)$1!pFAO%LvVGA$KgPW8iamNzl>p09O~}@xO6BEu zm+T*&BshL8&3thB=K1$;A5{YNnju&Gcyzw2T2s35BLInErOp$7^iS#}n$Gef;nFXb z@~ghHx8uF4xw>jy_v=)0pe}#Kd-JZYBxMBSp(ggnAnlWJP{D*EohyolI7P>!^V-)O zLWX<16LZh{u_Z|~C2hJ!)YZbh3pZCyJC~5A;+K8o3lW|LQ@EixeL6{no)84i5a``{ zUHsGv6hXnCO)G4WHj=DNg-H9$d+Z=Gr#n9ZO@I1&F)G){kU^0|RVXqkU&Ot;!Yv#7 za9C#2k%H?ZehJ*rs=>O#7;OV6*vTwO&zxTpWc)#|Mry8mG5L~1=q6G!Q+BFQf#uQW?uAhqrJjO;Xoq8U&9fN6==})2auYu`8%AZ0glSzC$q`OIt-P;-mbI7q1z%{+ z-?~r`54T0mL_)2#t42A&1GtBqP;uZj|B(u*(VDj%xOVTl1@XmJ@wRd)2evTR&pV!= z;pwhXG`XF2j~%ugG;G>NAq5fhjn=iDx8l6F4$gWn%6iF>zZaG_s%QtCQz)9GGaW6L zfY&K?VECyE2`=F~42AlPx$#1f&G>0uhM}6Zg_p;@KNwW-qC?G0>BQe>Tb5rd_){P( z1f8$vtZ-~SNEuljM(>sqA|7gcyJV^pRWM^f6J#Vo0{vpSTkB}^Bg&UEPTZmclY5gO&eV(kN z_t{!blW&dO*Oy?u)Q%V4Jg(1gzB5{>T>?fpeN+mYPOLSm<_RF?z>ZUFaP6<93Pe*d zX`KbJIEY3qJ#6)R^Lt7=wi&ir2x*K(z)tdLWN#aC>QryM7mUvjkhJi+wY3}<0&d7Z2W);WUiw*`( zHy>yn8=-hwpiB!Jg-9C>n6XL)4|ol6E!A|vrSX>v!r-TX>r)$-1Pr|$YFwO7ZFqOwEkHZbL2Mz1iMZf~mH2u81;iF#7W|B(dz%UV zBiG&cJ+%m64}|>GW+B2Qlri~R24-D952PiDtg@2mov4K84j!_aE2?c4_l&g z0vF#nH&_Pn1mGkkn#akg+^&)C)Ulr&;OyNKYn6BE3j@6K^phRX@4>F|(7H3D?*M4( zd*vXK>@`+(v=4O$<_GX?x#+T=bj_#cqt28hHIb3DQLxsh$k0b$cTm6a>@Mn0R>8jx zBjPr!anlGRW;)VHA1?Y$HoS4J)vb&Y#o-tkLYbH*N>aR)^a(BFQE6MtM$Ksf)o0c? z9n>9naloGBB4R4n-8T+|>;P}_-FF?f$dK%b?;lb$6C4b5GK3Age$=?LDnOL{`Hd2u z_iMq6MzG64T+yYEjGp8}vJUv)3H~soD1_U(hx{dmMdv2TGr&Db9|F z(g<|YBF!+On}qyHMPB2Yu^C0_{3(mDwWv-nyS9E}>G--jKWPEm45utoLJI>{S_a14 zcx$&;0EpDfHyb*2qS(wwdGxfc2HU38@WyDKtJtg3Vi$F*qq^6^UA@5+!r%a5<=wh! zOQniA!*C&xrhG-hrZc)W@a3p_ zbBr`q_`&sk-&}$US*@WIsw~1QsaBmXGFtO;Q2u&}jpa0lx6R0L$ZD}T5a&py2WP13 z{tW)^(N>ra)S{=-xqOHVdhySEF4Zxi7)zT70mLyv_(z3!LB1OfOQdCK?d2$(cvG<+ z7{3C-*15MiFB$uN#>;}Y3RX}aaj#-KEaY|HC2jmKdAMC4325jg_NCRFB?lT+aL4l} z{Uwf4$tn(7$ynS(<&OJ_Dv%v1D%(yCwkA9N0$yep85LEq%CPe=d+L4rgpAnN%RaJ5 z`l%5GX^tZ7)XN1k1$`W>1R}0`%SpbGTst1tdh@>B!{W334h|7V35Ae%R?cy+PWX&@ zEX=`!4D%pLJ=r?NCfD=6^4rF$mN+Yo!0Hkx9|OEStptkmmXrnxp^A`4(SV=RSmhD( zyi!_h;!)*&B~tG!%);RQLTjaEg_J{{h9u%1>yZ_yL`k~qUElEWnun3wmM&|TC4ale z;&wrpd3j&6f52K>AoGgix*kr9f_np96H1Ff z8xGT_81VGy{nUw@@2y+>+s?x5zFiK+vYbocxZAK%8f`21>6^)FM5$rJ?ty*N7OQBXC>H8%pZ9gb6)C72 z*W9ml%poBrE8GFa;{{hk6>m&-w#)#sPmWVK4A z`)62{TDzjgo<6ZYZ@qY@kM`u7v`S+s!L(4V(e$7$Q-pAa$3!~GB=#n+O-J_E3zZdQ zIp~M6vzk+x4^qpU1rRfCX`MOmIYKsAeIe=7OuF-0oNdVbsJ-?i`b40Rv{nxa6bR{$ zW-41nmShT-(%XU1rc<9_!IPTpLngQ2C`D&1P z`$^>Srcuh~2C;8^?A1@|q5cQbmi7~4sp?XjB0~vSu9goM)V-$kAaonE#VVJ?V8xjwgq)VVqU2Gif;XEGQ_u*T zt?OX}@utfJ3E%D#Ta_x!%rLTd+ua!j`50AK{ujmgRqyaQ=l75-#wwwkW&&tlGkg9@ z^p_XaRl2qMY@_D}_ zi`Xj0f>(F=7X4S-2@5~<+UwVrT%?R#E5{fCc0B;jo{j5)&bas|Ul>P=A_`U3l@E#e z`1oVnkVzw{Iq#$rs;2`uD#wDScIJz1H(NLLz466Ks3|Mh!yxDKie)G6Xc z8^<^1AXmJPAz15u3$Gri>WpxpUm{_}-)f#m3`-xJ48X7XF?69`1}+rj%wIyT@QfQ9 zkJHZqE?N53IJ!m5>b1xzBOaH?G49|=GCmWzxv(?fbj{tMWwvPmYKm&*D~zbd*2yvm z>NAOpi(_t69=u9uBB^pWYEZlkNHYjTxY6baJ#=b@*}1D%1OswqdzhADD5F-6M`(Fk zD9P{2sjgP}<4{m|y5K1Hi_6o08GbZ4k*g)B?s-tF^RAp=o=#f%P!QBgSg84|58Iq$ zJ0ZX>s+1bf7RQg6ymoJkkJs1F_h^w9d5JIs*jwaA&aLt)b7v!trY4~6O+_Y@t25NW zpQe%DQtwGTvS+{2E<(^Kw&)1cbExEUsKxhJtahvRbbYCCo2k(8u(cnd6l*sX3c2Z1is5QWuuuO%G~BRCZm zQZ7V%IGHc~rN{w6^soS1W>0WFH6}~3aDst%`%r|gBJcg}t-)-0{ zuP9d7Fux4?itcf?X$yrv9jR^#r&)r!ZAZ43yKvft+ka^5lF#aF#X?crS0FV{-Xda4c2TI(qv@ zp5*l(Qh+q;HH|1JD4=*=^o>j);V&JEu8LS#*M0Bw-5R6<-Di?9*m=Vw&P&iajQu*#_-7D?$QN+j?wFMP)~Ux>k- z$3JQgLI!i1O+OdnCbg=kQprKqu5m|c)+WRWY}S{ZMnCe7-0$5gwR2Bp)bM00e@Q@H z{h4%VRkz3--cx@_{2%!-D(qUf0Y_7$$a-2NJfoq@&e%VH&DOGJ4212N^)1|FSq5hI zKSybLg}1=g%Df(ufn+|Y?f5#3Cg5Kvo0pte_}yE{2=K>Vrhz>BB>8A0X3Y0|S9;A= z>t}^jI9e?|>J2%+Pu%Kr)=s44oT?&fdk0Hbd7%s~5V9$D8fktv6}FwwltN6WL|H~ zzt68c!0z8@+9l)P-iTnAl@P3)iqR>tx;qlEx#-*>j%<8&;eNO7KZXNd@(S+4_3Kt7 zBF=ezIsv{pP9aw;mJLr*?fQ$8JlQ{4rrnZ5x(V6aCvxeQTh7Q-rHfapS){a=a+@w1VDw$y+#fdR z>T?%Wj=Tu@csK5@rml0d2f?TJeVAvt*ovlROMpd7ge4(%U91ca$qloPg*PP+wP55! zLJ5?1?F?r`G{_dy1vne_MsUV0O*>+`voH)(@P8{R)Wj?4G9XHY+uc1pQjf7N4VMc& z)YB_Q0Wm|ktuI`_1^GIJAx8ZDBRKWqqT(fhq$oc{@eG+z-p$x$3Rf$%^^=lg*hF`mEW1tuO(F z76;P^C|<5k%b&~hR%d;S`|-OoAW=qq0`himpS!ucH<7nCi`%Gd0t zQU68^(GY>lseSTQca4nK;R=h~~)cv{Kuz>Qp}EB5cHWV~ed!&@=x-lX3)txO$Z zSlqbdJ|-3*sgF6q(Q$ij^)|x|Ul0iaF|^ zig-ro3{U#=X)vwAFC(=*NtdD9l`>S+@MAwXVf69~A1ZY)C`2)@LMkTcUy@!jDC1Rd zCE!H@>@;O$NC4E`;a_9Bksg#|5=5g;b0l_ahN0_=NlYWHB_jD$g2lOz#Od@4gYHF& zIUX(&!C$}qbtzNle|qwPsL>GAd|)jXdAW;mau(O`R)TGg;-F6>eIpSka~PWFU9+<@ z8WO-HJjpWwOoK@>#ynL!OA%T`8jhcD+(}(mwq8oUAVLXCbl##b9mF5i?r(lR z*M$+_J%2?hEbc!`sPXeb(w8+I*u)3o5}hHWvw%!FiM!sz)10Fqr>NjdIO>eKE{>V~ zaoXw-NDq{kz*QZWI+c$YedTZ2C@m)_tEg!E9FZDcNQ|A_;Il+IHk z8hncHKQDg$p}6OUx1Th%?xO|hSm$Z3Y8 z%!X!kBytrC(%=M+y(ZYi$xS&g`!2SsSljFK6}Q3sAP z`;9>|UP+}%m2f+R`wxSY#0jB|WW||lplBH7Kr^daA7`s;= zjw@?wHHM4_UiX^;lzECIqC+_%EE+sCXbO2Ro$9r;*uJdpvEH>dK`+GL#*b<~AN}R7 z2((I+J0idR;E`h0qCgv2v9xQnu~rjKF*T@^YeymHog3O+GArey*fa<|xCIZ<_(AL( zi=ksQPjmxe+{t<5VW9I!jINP)ONm=>>IiAQ(5zt;y|T>&g9OAg#D6xw_16C;OLhLs z3Qo2#Qe)iRKtJ%hz05;4;NfOl$PFDhuZCe<;|jL%elcyIe! z^^-44=F7x7`0%YRsMxs>%*GGg+JNhOf#MPi-CCxI_gIxN!dM3p@4LH-tU-2UL%N1^JR5JGE zjkLkb~WoD~<9wKcQF zo&lg@Y$oG1bxn>uGMsZRxRCKmz0(78Fl;Z6JSSy~lxws(>hHta6V$^RyH2tL>z;ba z$?Kxq>jla3WBvcc5LvCZj8IdU|^;| z3OkEfb_7I^;rx?^a8&<+ghq3B5D#0Q_@6EN*THiTxf5`8x5n5)wlE$;>Ep6%Wtn0@ zBDO=%E9U$8P#NV0^jO%$IETUol|Hu9sl2z_V%WlC(ZrFvMkL#60a-D0cVZJ)QWaTdG(+1%}s zR(%?5dFyE~1m<@-fH?F{YG@=nilI3ZXF91AjA)!%*eHM8m~)x z?FVyT8L_*w0T-KpLJY9|^e4-`y#GP$rWR_iG~ACNc7_i}fz8@EBhceAC)iVhwsO$a z{PSjH0(FF=KAN{vg}GBOoL7_{PvmEnp5ySfv0W=AVFQR6QclEcGGd=vMcYTQv~)&TTW~-=+zj+OOSIk~HUL;q||8 z-(LsU!9?0PEJkqF`S7wzj+9kPvkN4LEf?vyjV1#q%V*j`QxH|fe6lBz3Lt0|ZBLK83SmVOoBrPn%JrF%`V#Uf7Xtn_Yu?6X<&`~3qlcmqVh`;ALa78F z2HZ%JqNj!5YFTd4lLqeu#0?c!P+cV~N16pVWA>z@S%Rg}AhW@<9}Jd@uezM^3pk+M zeWriVGW)Qn@D$%|K$cm?v%@Fzvu73tF2A`iE4@@T9kxKYE@`C5!}?lK>wh&eNh_~g z%R*g3FxN||UhBq}YP_X}WDm}yWycPvpO7TY+G{s&&LEdFpAEiQ?_}a`F0;QWH$Q`KY-EtF&|WeAD4WBu|Jkal zgKOG*xFb1Faz2!kT&lviR=9SJP$k{D{>f=zbgGC;W8)BCboCg-lvuHv0ZRl?&9G;H z_~_5%+a4zUUv6|e)|vvH^9^F9CGJh}NIG*=u;Y?kY7~RviQ!7~&rQyHTU>+Ft*Y5s zV%QTvlQ;zO*>M^gu((Jj@@TAL*jC7!p2R02?k1Z0^3_$cCa-mEni;iU9oqiD zk{e@}YUjr;$VVSlrF(TZj^26ri|S;7UO@yGFdscOAA1tt?N-C>nD9MROT1^hEcCRc zB58uobiB?VV@O$)?PgH)!d}=NSKJZ9O{{ z*wBPatS*31>!m~-+P_@`m7o6zeT|){jOfl}W##7!lsSyDIM(8|PR*sgj)g3H+;;^l ze!hA^=3BSC$YTpc@~c`(q;FK_IW(9uCMHm76a^!8uHe2AjM^ROUP+5JD{oDo%m`S@ zd@b*PTjuaNBycHRKfuoH`3+QpwW~{77$*3#kv8`IqZ5+1&xYJwaQd{H=iHg5`tRU3 z@7a!fXNwK0J;1Vs&@oCVmr`!%$!#@H*o`>N7obEQP+|nE4&9N0Ym_umLlj3aH3Q3& zQEnxlTHD$tKUU4@2z#20cr|6dmaD^di5@gGH#d)95x@BH$Z;qfV zKhl1ezST!MKPJWvWXFyKLzvcrqVUF8$jQ|G@!zZm7V^we6BlZgwXNI1140@X}=+bKYN zToWA0sD1O=l?M-YnAlx`JV-^&)ayV`SJz*%o=Xw=dgaQluC6ipbO?7Z83Bd^;;pKuJ$_L;#)E4Rk!xF~SOC`Da({Mx z#S)&Q=wjeU>a@-90WokA@U*{11HuRWZH?Zuhc*llu>+N^mX{r|Y+5Qohz-3r!q~aLy_N6817yvpVS~Q_vhH4`oi?0H%!&%x(klaQjnrg=W(a3m=bgD@>@sfsG0%^Me}0Er z#1U0#P%YZWnwOsCW2_!gc?)MO2%0?wlUU8oF~&mwUZI7}Vh(AXkhmQWazj}e`yIgq z*$w;%l&_RM#x5K95?JulXT2qH*g&EMX=2>&#dfLbP~h~mx$|h&$;qu18yJLCQuL_7?B=9w5NNvlQ4r|up_fN_lQW5xfH4~!@HzthSR}__C?YbZ zSjY`h>t|Y9yI=fevoHY7X$Z=RFN!9=1;X%l!uMRrO`?i5MM=H9dRmT22KO}r2e~crAFt}tKrM%XEeo+8ftwB7D^#OfF+4=1BGn3gmM2f zWGhq;Zew_}yNg_Dvqr3#9!jdfwB8i)dEhN0vwVJUgLO}K(<-JXBRd-${>G8gdD;0^ z9c-xFaU5eVT(jH>B~Ikhpgth!RPRx2mdYz+GS{j57z9yQ7F3MvgC3$m^wUnSl)Y3L*i1 z6D1WEonIpeYOjUQWUHqn9c5B~BO%ZVmW`QLpoO55voEBjduS-B^VAsmoIS2KhtP}y z5la7Bfm?|a2WhhAJ+shnI`z}RT)sKGun+;3CpC(-th6*s4DI>u?L^?Zrz(o-{73gQ z)zwjb2y5VqTg{J*Y`07-wE{t}F#iSJsFZxR#>ZPKD!~9(ycRWY#e_}(&)3b&qzlZ^ zDVk$!QtVP}hXm|XaL*EsHIK_z3$aS`pZd*O^YZV$y`}E!yNUVqsOUVjAyuE(>UBjv zIYy^$!5=rFR}i{fROEK*EphQ5Tty?`O@J>_OVOeC6nxFXSrc$8;={)qDyl{&gyrZ( zZZmwhYatli9QpC!`wyV$riY}6`Z($;2DNm4yr)gnSo<<@;*2r)o}Z>P#hr|jLx&CTUw6_<0p z@cbNHb`pvvz)ca0;V6L=jFrQGlAHR_-oZg;BO(mO3<0TbnHU(AHRCt(xIf}PuSsoA zh}uV+3Ml#}NsfSvWKuMG@_Y12uwI&w523?_X)KCbisIbb1bL$70uW=9nf62gL?RaM zX==uG?%9ta;!sdu!qPyorN))XU=Y)pt^j4qFhK`{|l8Ah75qyuoP13!E!wwTJ?&M1fm_39J}xG7s3h4=8+3BJvY5qd1r1Na#os zmDyG^b3?U=kNlwh1=0KAe(~Oh^A=JLBNc9^m=1>=V{Z*U8e2cnm7zkFo#_-)AW8(V z@gRHTm?8adp~c%zyUu|Ly2c^J5lAWrJHh*J4pIqA_Qh(z7i@F5;c5D(sG&0Z0p5uI zvM8_FO(6@V;KI66N${njc9%u2laoqEazK#-j~iY5Tj0IS&jq){*zIq!1o6}0r$;BG z;9gb$6t2e8aLWvXCo+hjl$*)nD<2%!{In! z%{!1CFQ(HfE-cmIKT?SwmA%X5AXx%vZwxV94be1V3UKOpBtY!t`g*ZPnLA(0$*>Cu zpqeAY6U8ho&IRAkQCCxWVuI}JbC^qII!QfjD^^2(EEr~hq8 zS9dEBAB&y8(g1AeAID<9JqlCROIaydoxJvpy zSe}u)#}U)GEuB^N~{*=AJ8U6kJJ-`i)YE#1n zjN~ymA#Id#I4SA(rK;aus<$+o$2cI0TOLZ({wMghd7vzE<4V#S>H!{XE#^;W%dOsuiJ}*n8yJv|xmok$!B^oIEc>$1K$vqH zf`L7}p|V1l=|oY>Q$#@7qD+k9Z^rOv$@QMq^o$I?x-A4)B*1Wr6)xOX*~}>_l3UWh zB&pzw#N#HKw9N=lqHWqyA7C^ zMp}3zYeLk%bD!TSg#dJL-pLDWedy-)W7iQ~M$C-hjjJ?A$`m)U+;XLk;!#pBAsQDr zx9bnZDcUYEs(xnTmBDdqsSdD)ZXBn#Y9Cpm4{8fzd zBq_DvWXbQQi0qU*E~KbHUg-e1;wv^7iu2ZfXVNq0+e%wC24C+e7Fu3hgMZ{{S|z63 zi-4HE|H9R0S3X$)Uh>VoebsHT#rr0Ma4F8>5RqCk`fqrxO#HR59 zCVbk~D3K0U`r))l15n~o^OKVaiq5)uWTZAc1>bXv+d>L}V`>`P1UK2_JZxXy6sK)? z!QxP|g#A#-YsJ8T5ob6%)M?_&``p~{Wf$1NZPG&c1nm^(O&(6)_mo3#o}i^W)h;Ni zcW!_5_zUh0Y5NIY=3IzvZWan8_j@gCP}D%*ahpjOX%G}k)!;hG#7IRy{xL%3cz7DQ z)Ui1j7AOtcKDu>{D~762mq{B)&TwiYGBJ@t?C>IT8b-zUlZ}Q=RkRyJ7}Ucl=)h|3 z01Rro=n9k*WEs!(esCUjM>f$Y5qHF4fsg&}d%Tf_D#+6UEKl{FXYa zh#epkf*5nYd;86UxK3I}dU|>h%g*GA^_e%O)VaqsF{%J=MCQoLH|Nb>|8dk2wzXC< z5zJ~bRAP;xrOj_IC)NrIC%bv1EVysa^!6kho9))>Jlzk<4rIpTL3MJA+CU@ej9 z&T;cZ#?HZF%ka#5mjvrJKN~VKsS9q+I<8gyZU2Rferow%ssrWRp5;XX7Vx-d5 zbfm%=Lwos=T8fN#LG@Bq#n#$z@!r1knLBkXr#jbEV6PmyII~DnGAi2-aqH)9AheH* zibB^D)I)^?E2YTuVYVo=f~agkk^y_-#8WAd=<%EHVl-LbqH8*uMoy`4>=@rpAv>>n z+4>wYep~ZH`9292xT=ABmqzi~X&WTt;ggBl9?dPWn4=rkq=D9o;(&*wA#_0~O~BHe z-FbHx{ChVKFIF*&+xi}Z=G*$JCOLWv)YaUw+;h-yndQ|V4`N^1oOqBTVyY|yGMM06 z)jk3G=ew#*Y73jzq!^a#UM)kn1t`MJoJVYT`-rz`9NtsWZn>5;kTUqmLbeDVv9_gW zK@d7Et$4VAq&}OfL$!>8&#*3BW&4>#mf2eSKwo z0=64kPAj@D`3R5BB`PMFNmc%nU2g3NDu6tZ=tZXeXG82w+V5 ze`B$!MmH-ufV9Vr>ih+X`_nnUgV{Rm$#@tbS-{qNO-?_<^#X#$OVtuEapvZK9Vx8j zWtE_k?Qm+Ai`MCk{bCAeJF<_&%8`}*C@qqc^%Exnyf;v=)gKWp=P0N{gPC)N+KbZd`6sLS>ET`6D{UW3&GZGhD4@);_{ zMSe_`$HTm7ZznGNBnYUi$`L9-K=+(aD3L)mrecDoAZ)(yJ#cyV|G)OGJszrc4Nuu= z7j36d#<Fm?`gSEc7tZ%*R{l4{n&-1+RAY*=*KDzBl*X)}W zu1@(I0yc+XZFkkF*+1+EH8|8adVv>|fi{a6?K!A3h3S(tvv>280jruU+F;pEsfUQO_*%pIryYrx3hMVRP~H{d z6_jyNSC@7yAuX#!pME&h5{Z?#gHZ)(?RR#w*^TFG7dCL%vWM!TSiI@~;$^Crc;zd}kyLk}^Rg^gs_7U`F(|K6czm&QThpD9BF{@1K=<9q3N2+GK z{H8UV%VZA`iFjudg1?~;b^Uh-okBKR(N?VhXr2v>5&dZR&e7D%IDFx&tBUNWO$oIN z_k@NzIEPh^6hg@T>@iK|yetGOH!?F>8zj%}2gzxVx_M9IEmuoJpOC8M1y@uMJs&cJ zn2+k~>t$cPdW96Wfz7-JnTO_=)0JokkD-UJUem}Ov*$JE&M2$UuR<~w ztC<-}w)0m541m#1Ia)d5^DJja%>@H3I5G}!$Ie7`mVP)iZiw+e<{3z&&$otT4#?u& z%A!E@w$XBK*P}s-C+Dz{JV3=jJuOtEiG6zf(JoE1Bm8+SMN0dg>Vd3ZRC|%(W*T|< z^fwZp-X|Ay0CG=@lk4Y%8`03aY?s+vjJ2q`80ls+Fv|Ov9+`s(0Fe-GjL~G~SnUnh@SHmAArOV=gv^g$e*nDwx$g9>lW}=^)DA(-O3bKE_VqVH=etT`l8d z`m(8LiEO&;YG*r)MD_*QqaS+HEge?d{Wa*%-jM0W(~=y*^K4GOuakmFh>oHLLm+|&x<+LX zK!QUfAz@g3BM{h7FxiYa4D>}JyPu*^OE=b_osb~-_MPl{;o1A$B6qQ|qM7k>ol7-|CV{MB7H?pymOt-!WOJda6t1+X=o0Ym_a-NBL0&%%ZS1k>6 z_~skizU4GLQ+WKb+YjNOf|Py0bKPv!;%dZ^Rnk~}a-e${_et2ltf=-$0R8$;)j zmcHWLC1uYGUe`n!&u+fXdQ&*mF}MwU_t{=u4M359@Yv)O82AompWJyUnZ#l4WKT%j z0Y*iQh-pHT`pm4XEI>1X*5QKizNeeX0nq{A=DfH5ogqLCkAQ+n8M#do*_k!kc|U!; zaLVOPq;8M)RrP2YwOggCjv<=(5mrM9yN#XP=HhogDe2)={fhGXfbt51WJ9OgtxD>89>Ha^aGfj+@t*tGu>5f*hWYq52j@&z|4p12voycn1!7L!f z5!8Lf&5H|?9!CUkEC;a=@EIH=!pb*PI+=wlN-B_-avy%t7OK>Q zJl_%%^G4OK0*?ji!K^7la~Cx`SfToWGLD_t=G|SxKr23X6N}>JEh+2ORnd=49=&Y8 z0EQVt)}*1B_<;xo=@HO;HQGQ1D=E?*4mYgbzdzJ@JMJ!y2y=GblYI-!7&OBrC9>fNFC#7?Ro(#9 zQU4gi2Rq3oA&UQA6g2Pj_zwSyF=3^$Its1 zns^fgZ(PtV0DR+?jL^gAyJ}X{(_>`}H{@q%uyaw8vci6PdV9x!;9ejhCIQCuN#&MIEnAmvy{uZLLD&BwZgnq+Y&rZ=r63P@-C+UN^Lq(?7DWrntSV z$Dm%fC{r&}Q|l-19Tu@H?X%=rC4^862vfUx`X4{KueFHPtVTq z5TPw*DUTu@M4lt1ux5Uklv;D^{IYf*E4xr`-V=F#!}lAAL7f>&PO|Wr ztK;mG|K7^=Ar>E*RPZKB7m%fA!6-f4k`Paj2Eja{m`g99EBaXVpY^dgYEs^UYu zUKdjJ!>y{RCOWqswP)t$>R|wQ)zeK>}Y3cBtJ@AQ+4_B?`dzlAIb zcxWArej~vE;~R8qCIS&1HAm8iRG4igVGtv!`f&grrYyXaPs!$lry2w)d&ilQn_PzP zyU`jSGvW(~*9u&W)K{)NvS=)Z~8iNWzp3vtrFSe8L(tz zMP~Y3$-&thLCyDFwz73rG#sE2s{qJF z?zZ3fSx`ez7?}gmT(;8rI2rfjC%g)EqUF^3SaaE>Yp*jH)#8#iCnT$?s_M|FRGI0X zxTp?zmhd6VkO4f_QT~Dxj_VmR_F*4EZRreJ2GI7)s0bgoJIt+%%~Cj7$? zje=3a64hx-7PYpQWp{UP;*veqOX2k5eRFFWwUhI0#{vHKj2NcKB**;yIiuzqUTAq$JicIjV zrs~3^&PTjqbY6oLl-B7&In*q6TN^zNqgDlUXWHGn#t`D4{YKKpLUI|f(h%dk<#iN? z9X0Ex{d!n5`jVp~qi7uP#G5OCRA8vTH4N*=sjoj@3svBD?^di!w|Tt6_L^06OiT>e zQe?w-P6%U2-zP)@C^}C{c})ss?IEC^SWyy4bQLE@fnbz23DdymUm|Q1KS^JXSlKKM z7(SMOM50)U;|F1l;elY-nFHgTjw(LGcJcvf696;gSm+sQ4r`S!0h}ocn;rXs`SSBn;#{Za#5ET;r7Lec; zydjR)&zjndI;}tMe4n+VzJ%Jbf^%%F$reIORz2 zG@4-cgybCg%)i8)DM#_~pJ=~EXn+t#ak96h1@?l<0h4Xxd;Y=)%+&V(N(pj)dGDzm z;dgTTm*06|#51+~|EGoD1x7$7LFT9DwTjZvuvik3&h&ZY#ZxUbew6&@52wheKY6dY zny6-C;thJ2mrU$W?wp<@DsLCIldPtwWQ5IbYu5>PMgA|A7R0h5ZLs^b%aiu_YUN2= ze02;FTYPm45o3IvF(!@i)iEY*@z - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + kubelet + + + + kube-proxy + + + + + + + + + + + + kubelet + + + + kube-proxy + + + + + + + + + + + + kubelet + + + + kube-proxy + + Kubernetes Nodes + Kubernetes Control Plane + Cloud + + + cloud-controllermanager + kube-controllermanager + + kube-scheduler + + kube-api-server + + etcd + + + + + + + From 913173fa91a84b925efc2e5dbfe167b8793bc43f Mon Sep 17 00:00:00 2001 From: tkms0106 <23391543+tkms0106@users.noreply.github.com> Date: Thu, 16 Jan 2020 22:50:22 +0900 Subject: [PATCH 02/30] Fix typo (#18726) --- .../concepts/workloads/pods/pod-lifecycle.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/content/ja/docs/concepts/workloads/pods/pod-lifecycle.md b/content/ja/docs/concepts/workloads/pods/pod-lifecycle.md index a798653cf3..42fc0a86d3 100644 --- a/content/ja/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/ja/docs/concepts/workloads/pods/pod-lifecycle.md @@ -43,7 +43,7 @@ PodCondition配列の各要素には、次の6つのフィールドがありま * `lastTransitionTime` は、最後にPodのステータスの遷移があった際のタイムスタンプが表示されます。 * `message` は、ステータスの遷移に関する詳細を示す人間向けのメッセージです。 - + * `reason` は、最後の状態遷移の理由を示す、一意のキャメルケースでの単語です。 * `status` は`True`と`False`、`Unknown`のうちのどれかです。 @@ -138,16 +138,16 @@ Pod内のコンテナごとにStateの項目として表示されます。 ``` * `Running`: コンテナが問題なく実行されていることを示します。コンテナがRunningに入ると`postStart`フック（もしあれば）が実行されます。この状態にはコンテナが実行中状態に入った時刻も表示されます。 - + ```yaml ... State: Running Started: Wed, 30 Jan 2019 16:46:38 +0530 ... - ``` - + ``` + * `Terminated`: コンテナの実行が完了しコンテナの実行が停止したことを示します。コンテナは実行が正常に完了したときまたは何らかの理由で失敗したときにこの状態になります。いずれにせよ理由と終了コード、コンテナの開始時刻と終了時刻が表示されます。コンテナがTerminatedに入る前に`preStop`フックがあればあれば実行されます。 - + ```yaml ... State: Terminated @@ -156,7 +156,7 @@ Pod内のコンテナごとにStateの項目として表示されます。 Started: Wed, 30 Jan 2019 11:45:26 +0530 Finished: Wed, 30 Jan 2019 11:45:26 +0530 ... - ``` + ``` ## PodReadinessGate @@ -288,7 +288,7 @@ spec: * Podが実行中で、その中には2つのコンテナがあります。コンテナ1は失敗終了しました。 * 失敗イベントを記録します。 * `restartPolicy`が、 - * Always: コンテナを再起動します。Podの`phase`はunningのままです。 + * Always: コンテナを再起動します。Podの`phase`はRunningのままです。 * OnFailure: コンテナを再起動します。Podの`phase`はRunningのままです。 * Never: コンテナを再起動しません。Podの`phase`はRunningのままです。 * コンテナ1が死んでいてコンテナ2は動いている場合 @@ -307,7 +307,7 @@ spec: * Never: 失敗イベントを記録します。Podの`phase`はFailedになります。 * Podが実行中ですがディスクは死んでいます。 - * すべてのコンテンを殺します。 + * すべてのコンテナを殺します。 * 適切なイベントを記録します。 * Podの`phase`はFailedになります。 * Podがコントローラで作成されていた場合は、別の場所で再作成されます。 From 558c513c05ecb1ef51972b8668c6f42e13c14b5a Mon Sep 17 00:00:00 2001 From: RA489 Date: Thu, 16 Jan 2020 20:02:23 +0530 Subject: [PATCH 03/30] Add more weight to minikube over kind (#18719) --- content/en/docs/setup/learning-environment/minikube.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/docs/setup/learning-environment/minikube.md b/content/en/docs/setup/learning-environment/minikube.md index f4d24e37fd..3135a6af30 100644 --- a/content/en/docs/setup/learning-environment/minikube.md +++ b/content/en/docs/setup/learning-environment/minikube.md @@ -4,6 +4,7 @@ reviewers: - balopat - aaron-prindle title: Installing Kubernetes with Minikube +weight: 30 content_template: templates/concept --- From c4a51a2ecca4ae151c5c16a0dc817b6704094b0d Mon Sep 17 00:00:00 2001 From: Sascha Grunert Date: Thu, 16 Jan 2020 15:48:25 +0100 Subject: [PATCH 04/30] Add note about service CIDR bug to changes (#18489) Signed-off-by: Sascha Grunert --- content/en/docs/setup/release/notes.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/docs/setup/release/notes.md b/content/en/docs/setup/release/notes.md index d96a1dbc01..60d49c0f3a 100644 --- a/content/en/docs/setup/release/notes.md +++ b/content/en/docs/setup/release/notes.md @@ -83,6 +83,7 @@ The Kubernetes in-tree storage plugin to Container Storage Interface (CSI) migra - volumeDevices mapping ignored when container is privileged - The `Should recreate evicted statefulset` conformance [test](https://github.com/kubernetes/kubernetes/blob/master/test/e2e/apps/statefulset.go) fails because `Pod ss-0 expected to be re-created at least once`. This was caused by the `Predicate PodFitsHostPorts failed` scheduling error. The root cause was a host port conflict for port `21017`. This port was in-use as an ephemeral port by another application running on the node. This will be looked at for the 1.18 release. - client-go discovery clients constructed using `NewDiscoveryClientForConfig` or `NewDiscoveryClientForConfigOrDie` default to rate limits that cause normal discovery request patterns to take several seconds. This is fixed in https://issue.k8s.io/86168 and will be resolved in v1.17.1. As a workaround, the `Burst` value can be adjusted higher in the rest.Config passed into `NewDiscoveryClientForConfig` or `NewDiscoveryClientForConfigOrDie`. +- The IP allocator in v1.17.0 can return errors such as `the cluster IP for service is not within the service CIDR ; please recreate` in the logs of the kube-apiserver. The cause is incorrect CIDR calculations if the service CIDR (`--service-cluster-ip-range`) is set to bits lower than `/16`. This is fixed in http://issue.k8s.io/86534 and will be resolved in v1.17.1. ## Urgent Upgrade Notes From 66372da95ea3fb81d196cd0023d6f314b837115f Mon Sep 17 00:00:00 2001 From: Ismail Alidzhikov Date: Thu, 16 Jan 2020 16:58:22 +0200 Subject: [PATCH 05/30] Add Alibaba Cloud cloud-controller-manager (#18255) Signed-off-by: ialidzhikov --- content/en/docs/concepts/architecture/cloud-controller.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/docs/concepts/architecture/cloud-controller.md b/content/en/docs/concepts/architecture/cloud-controller.md index b4dab1ac26..61dc26da7a 100644 --- a/content/en/docs/concepts/architecture/cloud-controller.md +++ b/content/en/docs/concepts/architecture/cloud-controller.md @@ -224,6 +224,7 @@ rules: The following cloud providers have implemented CCMs: +* [Alibaba Cloud](https://github.com/kubernetes/cloud-provider-alibaba-cloud) * [AWS](https://github.com/kubernetes/cloud-provider-aws) * [Azure](https://github.com/kubernetes/cloud-provider-azure) * [BaiduCloud](https://github.com/baidu/cloud-provider-baiducloud) From 9b9910c0d49392a4c16e9f057774bffc6d964684 Mon Sep 17 00:00:00 2001 From: Kartik494 <52158641+Kartik494@users.noreply.github.com> Date: Thu, 16 Jan 2020 23:18:22 +0530 Subject: [PATCH 06/30] Update k8s.io/docs/tutorials/hello-minikube (#18673) * Update k8s.io/docs/tutorials/hello-minikube * Update hello-minikube.md --- content/en/docs/tutorials/hello-minikube.md | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/content/en/docs/tutorials/hello-minikube.md b/content/en/docs/tutorials/hello-minikube.md index 2445e40f89..92a465ea4f 100644 --- a/content/en/docs/tutorials/hello-minikube.md +++ b/content/en/docs/tutorials/hello-minikube.md @@ -187,7 +187,6 @@ Minikube has a set of built-in {{< glossary_tooltip text="addons" term_id="addon efk: disabled freshpod: disabled gvisor: disabled - heapster: disabled helm-tiller: disabled ingress: disabled ingress-dns: disabled @@ -201,16 +200,16 @@ Minikube has a set of built-in {{< glossary_tooltip text="addons" term_id="addon storage-provisioner-gluster: disabled ``` -2. Enable an addon, for example, `heapster`: +2. Enable an addon, for example, `metrics-server`: ```shell - minikube addons enable heapster + minikube addons enable metrics-server ``` The output is similar to: ``` - heapster was successfully enabled + metrics-server was successfully enabled ``` 3. View the Pod and Service you just created: @@ -225,7 +224,7 @@ Minikube has a set of built-in {{< glossary_tooltip text="addons" term_id="addon NAME READY STATUS RESTARTS AGE pod/coredns-5644d7b6d9-mh9ll 1/1 Running 0 34m pod/coredns-5644d7b6d9-pqd2t 1/1 Running 0 34m - pod/heapster-9jttx 1/1 Running 0 26s + pod/metrics-server-67fb648c5 1/1 Running 0 26s pod/etcd-minikube 1/1 Running 0 34m pod/influxdb-grafana-b29w8 2/2 Running 0 26s pod/kube-addon-manager-minikube 1/1 Running 0 34m @@ -236,22 +235,22 @@ Minikube has a set of built-in {{< glossary_tooltip text="addons" term_id="addon pod/storage-provisioner 1/1 Running 0 34m NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE - service/heapster ClusterIP 10.96.241.45 80/TCP 26s + service/metrics-server ClusterIP 10.96.241.45 80/TCP 26s service/kube-dns ClusterIP 10.96.0.10 53/UDP,53/TCP 34m service/monitoring-grafana NodePort 10.99.24.54 80:30002/TCP 26s service/monitoring-influxdb ClusterIP 10.111.169.94 8083/TCP,8086/TCP 26s ``` -4. Disable `heapster`: +4. Disable `metrics-server`: ```shell - minikube addons disable heapster + minikube addons disable metrics-server ``` The output is similar to: ``` - heapster was successfully disabled + metrics-server was successfully disabled ``` ## Clean up From fc4de6b721e7f4086ee3bc22f3902cd68560ec23 Mon Sep 17 00:00:00 2001 From: Ajay Kemparaj Date: Thu, 16 Jan 2020 15:14:44 -0800 Subject: [PATCH 07/30] coresPerReplica and nodesPerReplica are both floats (#18733) https://github.com/kubernetes-incubator/cluster-proportional-autoscaler/blob/master/pkg/autoscaler/controller/linearcontroller/linear_controller.go#L51-L52 --- .../docs/tasks/administer-cluster/dns-horizontal-autoscaling.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/dns-horizontal-autoscaling.md b/content/en/docs/tasks/administer-cluster/dns-horizontal-autoscaling.md index 3a7651f08c..2cddad2d72 100644 --- a/content/en/docs/tasks/administer-cluster/dns-horizontal-autoscaling.md +++ b/content/en/docs/tasks/administer-cluster/dns-horizontal-autoscaling.md @@ -135,7 +135,7 @@ calculated using this equation: replicas = max( ceil( cores × 1/coresPerReplica ) , ceil( nodes × 1/nodesPerReplica ) ) Note that the values of both `coresPerReplica` and `nodesPerReplica` are -integers. +floats. The idea is that when a cluster is using nodes that have many cores, `coresPerReplica` dominates. When a cluster is using nodes that have fewer From 8aba9c656b2a9bde3567d45df4a584b344ea7340 Mon Sep 17 00:00:00 2001 From: Rodrigo Queiro Date: Fri, 17 Jan 2020 00:31:44 +0100 Subject: [PATCH 08/30] Bump nvidia-device-plugin.yml to 1.0.0-beta4 (#18725) This resolves `no matches for kind "DaemonSet" in version "extensions/v1beta1"` with Kubernetes >=1.16. --- content/en/docs/tasks/manage-gpus/scheduling-gpus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/manage-gpus/scheduling-gpus.md b/content/en/docs/tasks/manage-gpus/scheduling-gpus.md index 6d1de803cf..97500e6beb 100644 --- a/content/en/docs/tasks/manage-gpus/scheduling-gpus.md +++ b/content/en/docs/tasks/manage-gpus/scheduling-gpus.md @@ -104,7 +104,7 @@ To deploy the NVIDIA device plugin once your cluster is running and the above requirements are satisfied: ```shell -kubectl create -f https://raw.githubusercontent.com/NVIDIA/k8s-device-plugin/1.0.0-beta/nvidia-device-plugin.yml +kubectl create -f https://raw.githubusercontent.com/NVIDIA/k8s-device-plugin/1.0.0-beta4/nvidia-device-plugin.yml ``` You can report issues with this third-party device plugin by logging an issue in From f5bfa04aa44f02cf987a64aafc7155089152c440 Mon Sep 17 00:00:00 2001 From: Alexander Zhukov Date: Fri, 17 Jan 2020 01:32:43 +0200 Subject: [PATCH 09/30] Fix the typo (#18732) "AND of exact match" in the "Affinity and anti-affinity" section should be "AND or exact match" --- content/en/docs/concepts/configuration/assign-pod-node.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/configuration/assign-pod-node.md b/content/en/docs/concepts/configuration/assign-pod-node.md index 14c8d230b6..9a51a1d294 100644 --- a/content/en/docs/concepts/configuration/assign-pod-node.md +++ b/content/en/docs/concepts/configuration/assign-pod-node.md @@ -111,7 +111,7 @@ For example, `example.com.node-restriction.kubernetes.io/fips=true` or `example. `nodeSelector` provides a very simple way to constrain pods to nodes with particular labels. The affinity/anti-affinity feature, greatly expands the types of constraints you can express. The key enhancements are -1. the language is more expressive (not just "AND of exact match") +1. the language is more expressive (not just "AND or exact match") 2. you can indicate that the rule is "soft"/"preference" rather than a hard requirement, so if the scheduler can't satisfy it, the pod will still be scheduled 3. you can constrain against labels on other pods running on the node (or other topological domain), From 08ce770ff667942893fd76be06d53c61f39d4a8a Mon Sep 17 00:00:00 2001 From: "Lubomir I. Ivanov" Date: Fri, 17 Jan 2020 02:42:56 +0200 Subject: [PATCH 10/30] kubeadm-upgrade.md: add more details for upgrade rollbacks (#18424) Introduce a couple of paragraphs explaining what backup folders kubeadm creates during upgrade. --- .../administer-cluster/kubeadm/kubeadm-upgrade.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md index e6097f44db..b0849c2cb1 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md @@ -398,6 +398,19 @@ This command is idempotent and eventually makes sure that the actual state is th To recover from a bad state, you can also run `kubeadm upgrade apply --force` without changing the version that your cluster is running. +During upgrade kubeadm writes the following backup folders under `/etc/kubernetes/tmp`: +- `kubeadm-backup-etcd--


- KubeCon vom 18-21. November 2019 in San Diego + Besuchen Sie die KubeCon vom 30 März-2 Apr. 2020 in Amsterdam



- KubeCon vom 30 März-2 Apr. 2020 in Amsterdam + Besuchen Sie die KubeCon vom 28-30 Juli 2020 in Shanghai

From 50c24e3e4ebaca7c30632036dbd518f5592e4171 Mon Sep 17 00:00:00 2001 From: makocchi Date: Fri, 17 Jan 2020 20:42:57 +0900 Subject: [PATCH 14/30] Fix the link for conjure-up (#18529) * fix the link for conjure-up * Fix the link for conjure-up to docs.conjure-up.io --- content/en/docs/setup/production-environment/turnkey/aws.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/setup/production-environment/turnkey/aws.md b/content/en/docs/setup/production-environment/turnkey/aws.md index e203be1c99..922f4a3eb9 100644 --- a/content/en/docs/setup/production-environment/turnkey/aws.md +++ b/content/en/docs/setup/production-environment/turnkey/aws.md @@ -18,7 +18,7 @@ To create a Kubernetes cluster on AWS, you will need an Access Key ID and a Secr ### Supported Production Grade Tools -* [conjure-up](/docs/getting-started-guides/ubuntu/) is an open-source installer for Kubernetes that creates Kubernetes clusters with native AWS integrations on Ubuntu. +* [conjure-up](https://docs.conjure-up.io/stable/en/cni/k8s-and-aws) is an open-source installer for Kubernetes that creates Kubernetes clusters with native AWS integrations on Ubuntu. * [Kubernetes Operations](https://github.com/kubernetes/kops) - Production Grade K8s Installation, Upgrades, and Management. Supports running Debian, Ubuntu, CentOS, and RHEL in AWS. From 8de8d173bb78d46387ed623d0f74c870d89c5c66 Mon Sep 17 00:00:00 2001 From: "Lubomir I. Ivanov" Date: Fri, 17 Jan 2020 13:46:56 +0200 Subject: [PATCH 15/30] kubeadm: remove some CNI plugins from the kubeadm setup guide (#17694) The kubeadm survey for 1.13: https://docs.google.com/forms/d/1A855D054FZfdvNbx6mAa54tcZ204GmPCIhxe1UrXKd8/edit#responses The kubeadm survey for 1.13: https://docs.google.com/forms/d/1A855D054FZfdvNbx6mAa54tcZ204GmPCIhxe1UrXKd8/edit#responses Revealed the top 3 plugins in terms of popularity are: Flannel Calico WeaveNet The kubeadm maintainers are in contact with the maintainers of these plugins and can provide support and updates to this guide. The rest of the plugins in the guide are unmaintained, by the kubeadm team! Some plugins are not in the CNCF landscape, or maintained by the kubeadm team, but still present in the guide. Remove the following non-CNCF / unmaintained plugins: AWS VPC Romana Juniper* Canal (it is an alternative to Calico and already explained in the Calico guide) Add note that users can still defer to this page for more options and a more complete list: https://kubernetes.io/docs/concepts/cluster-administration/networking/Revealed the top 3 plugins in terms of popularity are: - Flannel - Calico - WeaveNet The kubeadm maintainers are in contact with the maintainers of these plugins and can provide support and updates to this guide. Some plugins are not in the CNCF landscape, but still covered in this page: https://kubernetes.io/docs/concepts/cluster-administration/networking/ Remove the following non-CNCF plugins: - AWS VPC - Romana - Juniper* - Canal (it is an alternative to Calico and already explained in the Calico guide) Add note that users can still defer to this page for more options: https://kubernetes.io/docs/concepts/cluster-administration/networking/ --- .../tools/kubeadm/create-cluster-kubeadm.md | 82 +++++-------------- 1 file changed, 21 insertions(+), 61 deletions(-) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md index e85b5be875..46290693fc 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md @@ -100,10 +100,10 @@ communicates with). 1. (Recommended) If you have plans to upgrade this single control-plane kubeadm cluster to high availability you should specify the `--control-plane-endpoint` to set the shared endpoint for all control-plane nodes. Such an endpoint can be either a DNS name or an IP address of a load-balancer. -1. Choose a pod network add-on, and verify whether it requires any arguments to +1. Choose a Pod network add-on, and verify whether it requires any arguments to be passed to kubeadm initialization. Depending on which third-party provider you choose, you might need to set the `--pod-network-cidr` to -a provider-specific value. See [Installing a pod network add-on](#pod-network). +a provider-specific value. See [Installing a Pod network add-on](#pod-network). 1. (Optional) Since version 1.14, kubeadm will try to detect the container runtime on Linux by using a list of well known domain socket paths. To use different container runtime or if there are more than one installed on the provisioned node, specify the `--cri-socket` @@ -221,7 +221,7 @@ To start using your cluster, you need to run the following as a regular user: sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config sudo chown $(id -u):$(id -g) $HOME/.kube/config -You should now deploy a pod network to the cluster. +You should now deploy a Pod network to the cluster. Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at: /docs/concepts/cluster-administration/addons/ @@ -255,19 +255,19 @@ token can add authenticated nodes to your cluster. These tokens can be listed, created, and deleted with the `kubeadm token` command. See the [kubeadm reference guide](/docs/reference/setup-tools/kubeadm/kubeadm-token/). -### Installing a pod network add-on {#pod-network} +### Installing a Pod network add-on {#pod-network} {{< caution >}} This section contains important information about installation and deployment order. Read it carefully before proceeding. {{< /caution >}} -You must install a pod network add-on so that your pods can communicate with +You must install a Pod network add-on so that your Pods can communicate with each other. **The network must be deployed before any applications. Also, CoreDNS will not start up before a network is installed. kubeadm only supports Container Network Interface (CNI) based networks (and does not support kubenet).** -Several projects provide Kubernetes pod networks using CNI, some of which also +Several projects provide Kubernetes Pod networks using CNI, some of which also support [Network Policy](/docs/concepts/services-networking/networkpolicies/). See the [add-ons page](/docs/concepts/cluster-administration/addons/) for a complete list of available network add-ons. - IPv6 support was added in [CNI v0.6.0](https://github.com/containernetworking/cni/releases/tag/v0.6.0). - [CNI bridge](https://github.com/containernetworking/plugins/blob/master/plugins/main/bridge/README.md) and [local-ipam](https://github.com/containernetworking/plugins/blob/master/plugins/ipam/host-local/README.md) are the only supported IPv6 network plugins in Kubernetes version 1.9. @@ -278,24 +278,16 @@ Make sure that your network manifest supports RBAC. Also, beware, that your Pod network must not overlap with any of the host networks as this can cause issues. If you find a collision between your network plugin’s preferred Pod network and some of your host networks, you should think of a suitable CIDR replacement and use that during `kubeadm init` with `--pod-network-cidr` and as a replacement in your network plugin’s YAML. -You can install a pod network add-on with the following command on the control-plane node or a node that has the kubeconfig credentials: +You can install a Pod network add-on with the following command on the control-plane node or a node that has the kubeconfig credentials: ```bash kubectl apply -f ``` -You can install only one pod network per cluster. +You can install only one Pod network per cluster. +Below you can find installation instructions for some popular Pod network plugins: {{< tabs name="tabs-pod-install" >}} -{{% tab name="Choose one..." %}} -Please select one of the tabs to see installation instructions for the respective third-party Pod Network Provider. -{{% /tab %}} - -{{% tab name="AWS VPC" %}} -AWS VPC CNI provides native AWS VPC networking to Kubernetes clusters. - -For installation, please refer to the [AWS VPC CNI setup guide](https://github.com/aws/amazon-vpc-cni-k8s#setup). -{{% /tab %}} {{% tab name="Calico" %}} For more information about using Calico, see [Quickstart for Calico on Kubernetes](https://docs.projectcalico.org/latest/getting-started/kubernetes/), [Installing Calico for policy and networking](https://docs.projectcalico.org/latest/getting-started/kubernetes/installation/calico), and other related resources. @@ -306,16 +298,6 @@ For Calico to work correctly, you need to pass `--pod-network-cidr=192.168.0.0/1 kubectl apply -f https://docs.projectcalico.org/v3.8/manifests/calico.yaml ``` -{{% /tab %}} -{{% tab name="Canal" %}} -Canal uses Calico for policy and Flannel for networking. Refer to the Calico documentation for the [official getting started guide](https://docs.projectcalico.org/latest/getting-started/kubernetes/installation/flannel). - -For Canal to work correctly, `--pod-network-cidr=10.244.0.0/16` has to be passed to `kubeadm init`. Note that Canal works on `amd64` only. - -```shell -kubectl apply -f https://docs.projectcalico.org/v3.8/manifests/canal.yaml -``` - {{% /tab %}} {{% tab name="Cilium" %}} @@ -327,7 +309,7 @@ To deploy Cilium you just need to run: kubectl create -f https://raw.githubusercontent.com/cilium/cilium/v1.6/install/kubernetes/quick-install.yaml ``` -Once all Cilium pods are marked as `READY`, you start using your cluster. +Once all Cilium Pods are marked as `READY`, you start using your cluster. ```shell kubectl get pods -n kube-system --selector=k8s-app=cilium @@ -376,42 +358,18 @@ For more information about `flannel`, see [the CoreOS flannel repository on GitH ](https://github.com/coreos/flannel). {{% /tab %}} -{{% tab name="JuniperContrail/TungstenFabric" %}} -Provides overlay SDN solution, delivering multicloud networking, hybrid cloud networking, -simultaneous overlay-underlay support, network policy enforcement, network isolation, -service chaining and flexible load balancing. - -There are multiple, flexible ways to install JuniperContrail/TungstenFabric CNI. - -Kindly refer to this quickstart: [TungstenFabric](https://tungstenfabric.github.io/website/) -{{% /tab %}} - {{% tab name="Kube-router" %}} Set `/proc/sys/net/bridge/bridge-nf-call-iptables` to `1` by running `sysctl net.bridge.bridge-nf-call-iptables=1` to pass bridged IPv4 traffic to iptables' chains. This is a requirement for some CNI plugins to work, for more information please see [here](/docs/concepts/cluster-administration/network-plugins/#network-plugin-requirements). -Kube-router relies on kube-controller-manager to allocate pod CIDR for the nodes. Therefore, use `kubeadm init` with the `--pod-network-cidr` flag. +Kube-router relies on kube-controller-manager to allocate Pod CIDR for the nodes. Therefore, use `kubeadm init` with the `--pod-network-cidr` flag. -Kube-router provides pod networking, network policy, and high-performing IP Virtual Server(IPVS)/Linux Virtual Server(LVS) based service proxy. +Kube-router provides Pod networking, network policy, and high-performing IP Virtual Server(IPVS)/Linux Virtual Server(LVS) based service proxy. For information on setting up Kubernetes cluster with Kube-router using kubeadm, please see official [setup guide](https://github.com/cloudnativelabs/kube-router/blob/master/docs/kubeadm.md). {{% /tab %}} -{{% tab name="Romana" %}} -Set `/proc/sys/net/bridge/bridge-nf-call-iptables` to `1` by running `sysctl net.bridge.bridge-nf-call-iptables=1` -to pass bridged IPv4 traffic to iptables' chains. This is a requirement for some CNI plugins to work, for more information -please see [here](/docs/concepts/cluster-administration/network-plugins/#network-plugin-requirements). - -The official Romana set-up guide is [here](https://github.com/romana/romana/tree/master/containerize#using-kubeadm). - -Romana works on `amd64` only. - -```shell -kubectl apply -f https://raw.githubusercontent.com/romana/romana/master/containerize/specs/romana-kubeadm.yml -``` -{{% /tab %}} - {{% tab name="Weave Net" %}} Set `/proc/sys/net/bridge/bridge-nf-call-iptables` to `1` by running `sysctl net.bridge.bridge-nf-call-iptables=1` to pass bridged IPv4 traffic to iptables' chains. This is a requirement for some CNI plugins to work, for more information @@ -431,16 +389,16 @@ kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl versio {{< /tabs >}} -Once a pod network has been installed, you can confirm that it is working by -checking that the CoreDNS pod is Running in the output of `kubectl get pods --all-namespaces`. -And once the CoreDNS pod is up and running, you can continue by joining your nodes. +Once a Pod network has been installed, you can confirm that it is working by +checking that the CoreDNS Pod is Running in the output of `kubectl get pods --all-namespaces`. +And once the CoreDNS Pod is up and running, you can continue by joining your nodes. If your network is not working or CoreDNS is not in the Running state, checkout our [troubleshooting docs](/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/). ### Control plane node isolation -By default, your cluster will not schedule pods on the control-plane node for security -reasons. If you want to be able to schedule pods on the control-plane node, e.g. for a +By default, your cluster will not schedule Pods on the control-plane node for security +reasons. If you want to be able to schedule Pods on the control-plane node, e.g. for a single-machine Kubernetes cluster for development, run: ```bash @@ -457,11 +415,11 @@ taint "node-role.kubernetes.io/master:" not found This will remove the `node-role.kubernetes.io/master` taint from any nodes that have it, including the control-plane node, meaning that the scheduler will then be able -to schedule pods everywhere. +to schedule Pods everywhere. ### Joining your nodes {#join-nodes} -The nodes are where your workloads (containers and pods, etc) run. To add new nodes to your cluster do the following for each machine: +The nodes are where your workloads (containers and Pods, etc) run. To add new nodes to your cluster do the following for each machine: * SSH to the machine * Become root (e.g. `sudo su -`) @@ -625,6 +583,8 @@ control of your Kubernetes cluster. * Learn about kubeadm's advanced usage in the [kubeadm reference documentation](/docs/reference/setup-tools/kubeadm/kubeadm) * Learn more about Kubernetes [concepts](/docs/concepts/) and [`kubectl`](/docs/user-guide/kubectl-overview/). * Configure log rotation. You can use **logrotate** for that. When using Docker, you can specify log rotation options for Docker daemon, for example `--log-driver=json-file --log-opt=max-size=10m --log-opt=max-file=5`. See [Configure and troubleshoot the Docker daemon](https://docs.docker.com/engine/admin/) for more details. +* See the [Cluster Networking](/docs/concepts/cluster-administration/networking/) page for a bigger list +of Pod network add-ons. ## Feedback {#feedback} From 4e1f73a73627051b44ea2b4b9c9ad0595f678b76 Mon Sep 17 00:00:00 2001 From: Gerasimos Dimitriadis Date: Fri, 17 Jan 2020 14:44:55 +0200 Subject: [PATCH 16/30] Add HPA as aka for Horizontal Pod Autoscaler (#18502) --- content/en/docs/reference/glossary/horizontal-pod-autoscaler.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/docs/reference/glossary/horizontal-pod-autoscaler.md b/content/en/docs/reference/glossary/horizontal-pod-autoscaler.md index a82df528a4..4e3ace729e 100755 --- a/content/en/docs/reference/glossary/horizontal-pod-autoscaler.md +++ b/content/en/docs/reference/glossary/horizontal-pod-autoscaler.md @@ -7,6 +7,7 @@ short_description: > An API resource that automatically scales the number of pod replicas based on targeted CPU utilization or custom metric targets. aka: +- HPA tags: - operation --- From e3a7a56878516820ddc9daa3285388d5c170357c Mon Sep 17 00:00:00 2001 From: wawa Date: Fri, 17 Jan 2020 23:54:59 +0800 Subject: [PATCH 17/30] Remove redundant information when deploy flannel on kubernetes include windows node (#18274) --- .../windows/user-guide-windows-nodes.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/content/en/docs/setup/production-environment/windows/user-guide-windows-nodes.md b/content/en/docs/setup/production-environment/windows/user-guide-windows-nodes.md index 399bd54fb8..297ec97d79 100644 --- a/content/en/docs/setup/production-environment/windows/user-guide-windows-nodes.md +++ b/content/en/docs/setup/production-environment/windows/user-guide-windows-nodes.md @@ -140,12 +140,6 @@ Once you have a Linux-based Kubernetes control-plane ("Master") node you are rea kubectl apply -f kube-flannel.yml ``` - Next, since the Flannel pods are Linux-based, apply a NodeSelector patch, which can be found [here](https://github.com/Microsoft/SDN/blob/1d5c055bb195fecba07ad094d2d7c18c188f9d2d/Kubernetes/flannel/l2bridge/manifests/node-selector-patch.yml), to the Flannel DaemonSet pod: - - ```bash - kubectl patch ds/kube-flannel-ds-amd64 --patch "$(cat node-selector-patch.yml)" -n=kube-system - ``` - After a few minutes, you should see all the pods as running if the Flannel pod network was deployed. ```bash From 571d2ff008d75227c0b47186e3fb20aed113e773 Mon Sep 17 00:00:00 2001 From: Marc Bihlmaier <30314040+rdxmb@users.noreply.github.com> Date: Fri, 17 Jan 2020 16:58:57 +0100 Subject: [PATCH 18/30] fix version link to changelog (#18747) --- .../en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md index b0849c2cb1..fd8dccc92e 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md @@ -30,7 +30,7 @@ The upgrade workflow at high level is the following: - You need to have a kubeadm Kubernetes cluster running version 1.16.0 or later. - [Swap must be disabled](https://serverfault.com/questions/684771/best-way-to-disable-swap-in-linux). - The cluster should use a static control plane and etcd pods or external etcd. -- Make sure you read the [release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.16.md) carefully. +- Make sure you read the [release notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG-1.17.md) carefully. - Make sure to back up any important components, such as app-level state stored in a database. `kubeadm upgrade` does not touch your workloads, only components internal to Kubernetes, but backups are always a best practice. From cc3001ff0bcc5d2c9d5dc1839874b30c0372f629 Mon Sep 17 00:00:00 2001 From: yulinshan <48340709+LinshanYu@users.noreply.github.com> Date: Sat, 18 Jan 2020 13:23:36 +0800 Subject: [PATCH 19/30] remove seealse (#18741) --- .../generated/kubeadm_alpha_kubeconfig.md | 12 +----------- .../kubeadm_alpha_kubeconfig_user.md | 10 +--------- .../generated/kubeadm_alpha_kubelet.md | 13 +------------ .../generated/kubeadm_alpha_kubelet_config.md | 15 +-------------- .../kubeadm_alpha_kubelet_config_download.md | 19 +++++-------------- 5 files changed, 9 insertions(+), 60 deletions(-) diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig.md index 2061ada1ff..5848022549 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig.md @@ -1,5 +1,5 @@ - ### 概要 @@ -74,15 +74,5 @@ Alpha 免责声明：此命令当前为 alpha 功能。 - -查看其它 - -* [kubeadm alpha](kubeadm_alpha.md) - kubeadm 实验子命令 -* [kubeadm alpha kubeconfig user](kubeadm_alpha_kubeconfig_user.md) - 为其他用户输出 kubeconfig 文件 diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md index 62e5ca99f5..d679798f48 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md @@ -1,5 +1,5 @@ - ### 概要 @@ -169,13 +169,5 @@ kubeadm alpha kubeconfig user [flags] - -查看其他 - -* [kubeadm alpha kubeconfig](kubeadm_alpha_kubeconfig.md) - Kubeconfig 文件应用程序 diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubelet.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubelet.md index 396e2f1c47..01985c5b1b 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubelet.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubelet.md @@ -1,5 +1,5 @@ - ### 概要 @@ -68,15 +68,4 @@ This command is not meant to be run on its own. See list of available subcommand - -查看其他 - - -* [kubeadm alpha](kubeadm_alpha.md) - kubeadm 实验子命令 -* [kubeadm alpha kubelet config](kubeadm_alpha_kubelet_config.md) - 用于 kubelet 配置的实用程序 diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubelet_config.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubelet_config.md index 916d86e76c..c40a97e097 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubelet_config.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubelet_config.md @@ -1,5 +1,5 @@ - ### 概要 @@ -68,17 +68,4 @@ This command is not meant to be run on its own. See list of available subcommand - -查看其他 - - -* [kubeadm alpha kubelet](kubeadm_alpha_kubelet.md) - 与处理 kubelet 有关的命令 -* [kubeadm alpha kubelet config download](kubeadm_alpha_kubelet_config_download.md) - 从集群 ConfigMap kubelet-config-1.X 中下载 kubelet 配置，其中 X 是 kubelet 的次要版本。 -* [kubeadm alpha kubelet config enable-dynamic](kubeadm_alpha_kubelet_config_enable-dynamic.md) - 实验：为节点启用或更新动态 kubelet 配置 diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubelet_config_download.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubelet_config_download.md index a998474edd..37c2d85a84 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubelet_config_download.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubelet_config_download.md @@ -1,12 +1,12 @@ - ### 概要 - 从集群中形式为 "kubelet-config-1.X" 的 ConfigMap 中下载 kubelet 配置，其中 X 是 kubelet 的次要版本。kubeadm 要么通过执行 "kubelet --version" 自动检测 kubelet 版本，要么传递 --kubelet-version 参数。 @@ -29,7 +29,7 @@ kubeadm alpha kubelet config download [flags] ``` # Download the kubelet configuration from the ConfigMap in the cluster. Autodetect the kubelet version. kubeadm alpha phase kubelet config download - + # Download the kubelet configuration from the ConfigMap in the cluster. Use a specific desired kubelet version. kubeadm alpha phase kubelet config download --kubelet-version 1.16.0 ``` @@ -37,7 +37,7 @@ kubeadm alpha kubelet config download [flags] ``` # 从集群中的 ConfigMap 下载 kubelet 配置。自动检测 kubelet 版本。 下载 kubeadm alpha phase kubelet 配置 - + # 从集群中的 ConfigMap 下载 kubelet 配置。使用特定的所需 kubelet 版本。 kubeadm alpha phase kubelet 配置下载 --kubelet-version 1.16.0 ``` @@ -129,12 +129,3 @@ kubeadm alpha kubelet config download [flags] - -查看其他 - - -* [kubeadm alpha kubelet config](kubeadm_alpha_kubelet_config.md) - 用于 kubelet 配置的程序 From 375caebc9f04902add89d448a716152b7a8630c7 Mon Sep 17 00:00:00 2001 From: Jie Shen Date: Sat, 18 Jan 2020 21:33:36 +0800 Subject: [PATCH 20/30] Fix broken links for zh tasks/administer-cluster/access-cluster-api.md (#18757) Signed-off-by: drfish --- .../zh/docs/tasks/administer-cluster/access-cluster-api.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/tasks/administer-cluster/access-cluster-api.md b/content/zh/docs/tasks/administer-cluster/access-cluster-api.md index b689d9413c..e281aad13a 100644 --- a/content/zh/docs/tasks/administer-cluster/access-cluster-api.md +++ b/content/zh/docs/tasks/administer-cluster/access-cluster-api.md @@ -260,9 +260,9 @@ import ( 要使用 [Python 客户端](https://github.com/kubernetes-client/python)，运行下列命令：`pip install kubernetes` 参见 [Python 客户端库主页](https://github.com/kubernetes-client/python) 查看更多安装选项。 +as the kubectl CLI does to locate and authenticate to the API server. See this [example](https://github.com/kubernetes-client/python/blob/master/examples/out_of_cluster_config.py): --> -Python 客户端可以使用与 kubectl 命令行工具相同的 [kubeconfig 文件](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/) 定位和验证 API 服务器。参见这个 [例子](https://github.com/kubernetes-client/python/tree/master/examples/example1.py)： +Python 客户端可以使用与 kubectl 命令行工具相同的 [kubeconfig 文件](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/) 定位和验证 API 服务器。参见这个 [例子](https://github.com/kubernetes-client/python/blob/master/examples/out_of_cluster_config.py)： ```python from kubernetes import client, config From d886feac19ffe570d6de381871a23d1b4c490de2 Mon Sep 17 00:00:00 2001 From: yulinshan <48340709+LinshanYu@users.noreply.github.com> Date: Sat, 18 Jan 2020 21:37:35 +0800 Subject: [PATCH 21/30] remove seeAlso (#18722) --- ...eadm_alpha_certs_renew_etcd-healthcheck-client.md | 9 --------- .../generated/kubeadm_alpha_certs_renew_etcd-peer.md | 9 --------- .../kubeadm_alpha_certs_renew_etcd-server.md | 9 --------- .../kubeadm_alpha_certs_renew_front-proxy-client.md | 12 +----------- .../kubeadm_alpha_certs_renew_scheduler.conf.md | 9 --------- 5 files changed, 1 insertion(+), 47 deletions(-) diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-healthcheck-client.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-healthcheck-client.md index 0194896092..02b44bf6a1 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-healthcheck-client.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-healthcheck-client.md @@ -169,13 +169,4 @@ kubeadm alpha certs renew etcd-healthcheck-client [flags] - -查看其他 - - -* [kubeadm alpha certs renew](kubeadm_alpha_certs_renew.md) - 续订 Kubernetes 集群的证书 diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-peer.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-peer.md index 5085618abb..48f62bb510 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-peer.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-peer.md @@ -169,13 +169,4 @@ kubeadm alpha certs renew etcd-peer [flags] - -查看其他 - - -* [kubeadm alpha certs renew](kubeadm_alpha_certs_renew.md) - 续订 Kubernetes 集群的证书 diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-server.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-server.md index eedd86c678..4675efcfbe 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-server.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-server.md @@ -169,13 +169,4 @@ kubeadm alpha certs renew etcd-server [flags] - -查看其他 - - -* [kubeadm alpha certs renew](kubeadm_alpha_certs_renew.md) - 续订 Kubernetes 集群的证书 diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_front-proxy-client.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_front-proxy-client.md index c884822db3..139bfc4f40 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_front-proxy-client.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_front-proxy-client.md @@ -1,5 +1,5 @@ - ### 概要 @@ -166,13 +166,3 @@ kubeadm alpha certs renew front-proxy-client [flags] - -查看其他 - - -* [kubeadm alpha certs renew](kubeadm_alpha_certs_renew.md) - 续订 Kubernetes 集群的证书 - diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_scheduler.conf.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_scheduler.conf.md index 540a57455a..6543b615f1 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_scheduler.conf.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_scheduler.conf.md @@ -169,13 +169,4 @@ kubeadm alpha certs renew scheduler.conf [flags] - -查看其他 - - -* [kubeadm alpha certs renew](kubeadm_alpha_certs_renew.md) - 续订 Kubernetes 集群的证书 From 7879c46450daa7ffc591ca3060b185ac53d5ccb2 Mon Sep 17 00:00:00 2001 From: Aanand Ramachandran Date: Sat, 18 Jan 2020 08:39:35 -0800 Subject: [PATCH 22/30] Added a new section on Azure CNI (#17830) * Added a new section on Azure CNI Azure provides a CNI for native integration of Kubernetes Pods in a Virtual Network. I have added a short description of this CNI and provided links to important documentation * Update networking.md * Made updates based on comments This is much closer to what you are recommending. Please take a look --- .../en/docs/concepts/cluster-administration/networking.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content/en/docs/concepts/cluster-administration/networking.md b/content/en/docs/concepts/cluster-administration/networking.md index 46bc88e72b..f70e6f7a42 100644 --- a/content/en/docs/concepts/cluster-administration/networking.md +++ b/content/en/docs/concepts/cluster-administration/networking.md @@ -111,6 +111,12 @@ Using this CNI plugin allows Kubernetes pods to have the same IP address inside Additionally, the CNI can be run alongside [Calico for network policy enforcement](https://docs.aws.amazon.com/eks/latest/userguide/calico.html). The AWS VPC CNI project is open source with [documentation on GitHub](https://github.com/aws/amazon-vpc-cni-k8s). +### Azure CNI for Kubernetes +[Azure CNI](https://docs.microsoft.com/en-us/azure/virtual-network/container-networking-overview) is an [open source](https://github.com/Azure/azure-container-networking/blob/master/docs/cni.md) plugin that integrates Kubernetes Pods with an Azure Virtual Network (also known as VNet) providing network performance at par with VMs. Pods can connect to peered VNet and to on-premises over Express Route or site-to-site VPN and are also directly reachable from these networks. Pods can access Azure services, such as storage and SQL, that are protected by Service Endpoints or Private Link. You can use VNet security policies and routing to filter Pod traffic. The plugin assigns VNet IPs to Pods by utilizing a pool of secondary IPs pre-configured on the Network Interface of a Kubernetes node. + +Azure CNI is available natively in the [Azure Kubernetes Service (AKS)] (https://docs.microsoft.com/en-us/azure/aks/configure-azure-cni). + + ### Big Cloud Fabric from Big Switch Networks [Big Cloud Fabric](https://www.bigswitch.com/container-network-automation) is a cloud native networking architecture, designed to run Kubernetes in private cloud/on-premises environments. Using unified physical & virtual SDN, Big Cloud Fabric tackles inherent container networking problems such as load balancing, visibility, troubleshooting, security policies & container traffic monitoring. From b647b6ec555eb88fedb0448202bfe262e08fea54 Mon Sep 17 00:00:00 2001 From: Shivesh Abhishek Date: Sat, 18 Jan 2020 22:11:35 +0530 Subject: [PATCH 23/30] Update field-selectors.md (#18641) --- .../concepts/overview/working-with-objects/field-selectors.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/overview/working-with-objects/field-selectors.md b/content/en/docs/concepts/overview/working-with-objects/field-selectors.md index 1b0b4791f5..44cd54e72f 100644 --- a/content/en/docs/concepts/overview/working-with-objects/field-selectors.md +++ b/content/en/docs/concepts/overview/working-with-objects/field-selectors.md @@ -3,7 +3,7 @@ title: Field Selectors weight: 60 --- -_Field selectors_ let you [select Kubernetes resources](/docs/concepts/overview/working-with-objects/kubernetes-objects) based on the value of one or more resource fields. Here are some example field selector queries: +_Field selectors_ let you [select Kubernetes resources](/docs/concepts/overview/working-with-objects/kubernetes-objects) based on the value of one or more resource fields. Here are some examples of field selector queries: * `metadata.name=my-service` * `metadata.namespace!=default` From 5772d582ea85e50e9013be54fc70acd04eff3aa1 Mon Sep 17 00:00:00 2001 From: Gerasimos Dimitriadis Date: Sat, 18 Jan 2020 19:29:36 +0200 Subject: [PATCH 24/30] Fix typo in manifests path (#18753) --- .../en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md index fd8dccc92e..73878bbd9d 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md @@ -408,7 +408,7 @@ can be manually restored in `/var/lib/etcd`. In case external etcd is used this `kubeadm-backup-manifests` contains a backup of the static Pod manifest files for this control-plane Node. In case of a upgrade failure and if the automatic rollback does not work, the contents of this folder can be -manually restored in `/etc/kuberentes/manifests`. If for some reason there is no difference between a pre-upgrade +manually restored in `/etc/kubernetes/manifests`. If for some reason there is no difference between a pre-upgrade and post-upgrade manifest file for a certain component, a backup file for it will not be written. ## How it works From cda86d62c01af9ab028ab51cc4473dc04ff8a9a2 Mon Sep 17 00:00:00 2001 From: Mariyan Dimitrov Date: Sat, 18 Jan 2020 19:31:35 +0200 Subject: [PATCH 25/30] en: Fix minor semantical issue (#18752) On the page, it says `as you .KUBECONFIG` whereas it is meant `as your .KUBECONFIG`. Minor annoyance, but still benefits fixing. One char PR. Signed-off-by: Mariyan Dimitrov --- content/en/docs/tasks/administer-cluster/access-cluster-api.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/access-cluster-api.md b/content/en/docs/tasks/administer-cluster/access-cluster-api.md index 3fb92da351..5aa79d4406 100644 --- a/content/en/docs/tasks/administer-cluster/access-cluster-api.md +++ b/content/en/docs/tasks/administer-cluster/access-cluster-api.md @@ -88,7 +88,7 @@ directly to the API server, like this: Using `grep/cut` approach: ```shell -# Check all possible clusters, as you .KUBECONFIG may have multiple contexts: +# Check all possible clusters, as your .KUBECONFIG may have multiple contexts: kubectl config view -o jsonpath='{"Cluster name\tServer\n"}{range .clusters[*]}{.name}{"\t"}{.cluster.server}{"\n"}{end}' # Select name of cluster you want to interact with from above output: From 9bfc5d8966623488da068758a424d74bf7ce4106 Mon Sep 17 00:00:00 2001 From: YAMAMOTO Takashi Date: Sun, 19 Jan 2020 02:43:35 +0900 Subject: [PATCH 26/30] Stop mentioning LegacyNodeRoleBehavior for ServiceNodeExclusion labels (#17542) The text gives me an impression that LegacyNodeRoleBehavior somehow affects which label is in effect. But actually it doesn't. --- .../reference/command-line-tools-reference/feature-gates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index add125aae7..6c0ca8f273 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -443,7 +443,7 @@ Each feature gate is designed for enabling/disabling a specific feature: - `ServerSideApply`: Enables the [Sever Side Apply (SSA)](/docs/reference/using-api/api-concepts/#server-side-apply) path at the API Server. - `ServiceLoadBalancerFinalizer`: Enable finalizer protection for Service load balancers. - `ServiceNodeExclusion`: Enable the exclusion of nodes from load balancers created by a cloud provider. - A node is eligible for exclusion if labelled with "`alpha.service-controller.kubernetes.io/exclude-balancer`" key (when `LegacyNodeRoleBehavior` is on) or `node.kubernetes.io/exclude-from-external-load-balancers`. + A node is eligible for exclusion if labelled with "`alpha.service-controller.kubernetes.io/exclude-balancer`" key or `node.kubernetes.io/exclude-from-external-load-balancers`. - `StartupProbe`: Enable the [startup](/docs/concepts/workloads/pods/pod-lifecycle/#when-should-you-use-a-startup-probe) probe in the kubelet. - `StorageObjectInUseProtection`: Postpone the deletion of PersistentVolume or PersistentVolumeClaim objects if they are still being used. From b57509bbf6f9db589cca718b704146fae3acad66 Mon Sep 17 00:00:00 2001 From: 0xC45 <56617252+0xC45@users.noreply.github.com> Date: Sat, 18 Jan 2020 10:45:35 -0700 Subject: [PATCH 27/30] Install legacy iptables binaries for Ubuntu/Debian (#18625) On the latest Debian 10, the `arptables-legacy` and `ebtables-legacy` binaries are not installed by default. Although the (non-legacy) versions are installed by default, it appears the respective packages that provide the legacy binaries must be installed in order to switch to the legacy alternatives. If you attempt to switch to the legacy alternatives without installing the `arptables` and `ebtables` packages, you will see an error: ``` update-alternatives: error: alternative /usr/sbin/arptables-legacy for arptables not registered; not setting ``` I have confirmed that the packages are present on Debian 10 and Ubuntu 19.10 and they provide the legacy alternatives. See: * https://packages.ubuntu.com/eoan/amd64/iptables/filelist * https://packages.ubuntu.com/eoan/amd64/arptables/filelist * https://packages.ubuntu.com/eoan/amd64/ebtables/filelist * https://packages.debian.org/buster/amd64/iptables/filelist * https://packages.debian.org/buster/amd64/arptables/filelist * https://packages.debian.org/buster/amd64/ebtables/filelist --- .../production-environment/tools/kubeadm/install-kubeadm.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index 26acd03cf3..ffa8229b6e 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -66,6 +66,10 @@ switching to legacy mode, and is therefore incompatible with current kubeadm pac {{< tabs name="iptables_legacy" >}} {{% tab name="Debian or Ubuntu" %}} ```bash +# ensure legacy binaries are installed +sudo apt-get install -y iptables arptables ebtables + +# switch to legacy versions sudo update-alternatives --set iptables /usr/sbin/iptables-legacy sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy sudo update-alternatives --set arptables /usr/sbin/arptables-legacy From ad1e9be770e989916eb5e6d2f736543505437d00 Mon Sep 17 00:00:00 2001 From: Sascha Grunert Date: Sun, 19 Jan 2020 02:39:34 +0100 Subject: [PATCH 28/30] Remove outdated Japanese/Chinese notes in favor of default (#18490) The notes for the other languages seem outdated and we should stick to the default version. Signed-off-by: Sascha Grunert --- .../setup/release/building-from-source.md | 2 +- content/ja/docs/setup/release/notes.md | 1334 ------- content/zh/docs/setup/release/notes.md | 3159 ----------------- update-imported-docs/release.yml | 2 +- 4 files changed, 2 insertions(+), 4495 deletions(-) delete mode 100644 content/ja/docs/setup/release/notes.md delete mode 100644 content/zh/docs/setup/release/notes.md diff --git a/content/ja/docs/setup/release/building-from-source.md b/content/ja/docs/setup/release/building-from-source.md index 731300748c..e9fc081a25 100644 --- a/content/ja/docs/setup/release/building-from-source.md +++ b/content/ja/docs/setup/release/building-from-source.md @@ -7,7 +7,7 @@ card: title: リリースのビルド --- {{% capture overview %}} -ソースコードからリリースをビルドすることもできますし、既にビルドされたリリースをダウンロードすることも可能です。Kubernetesを開発する予定が無いのであれば、[リリースノート](/ja/docs/setup/release/notes/)内にて既にビルドされたバージョンを使用することを推奨します。 +ソースコードからリリースをビルドすることもできますし、既にビルドされたリリースをダウンロードすることも可能です。Kubernetesを開発する予定が無いのであれば、[リリースノート](/docs/setup/release/notes/)内にて既にビルドされたバージョンを使用することを推奨します。 Kubernetes のソースコードは[kubernetes/kubernetes](https://github.com/kubernetes/kubernetes)のリポジトリからダウンロードすることが可能です。 {{% /capture %}} diff --git a/content/ja/docs/setup/release/notes.md b/content/ja/docs/setup/release/notes.md deleted file mode 100644 index bb92fa5820..0000000000 --- a/content/ja/docs/setup/release/notes.md +++ /dev/null @@ -1,1334 +0,0 @@ ---- -title: v1.15 Release Notes -weight: 10 -card: - name: download - weight: 20 - anchors: - - anchor: "#" - title: Current Release Notes - - anchor: "#urgent-upgrade-notes" - title: Urgent Upgrade Notes ---- - - -# v1.15.0 - -[Documentation](https://docs.k8s.io) - -## Downloads for v1.15.0 - - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes.tar.gz) | `cb03adc8bee094b93652a19cb77ca4b7b0b2ec201cf9c09958128eb93b4c717514fb423ef60c8fdd2af98ea532ef8d9f3155a684a3a7dc2a20cba0f8d7821a79` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-src.tar.gz) | `a682c88539b46741f6f3b2fa27017d52e88149e0cf0fe49c5a84ff30018cfa18922772a49828091364910570cf5f6b4089a128b400f48a278d6ac7b18ef84635` - -### Client Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-client-darwin-386.tar.gz) | `bb14d564f5c2e4da964f6dcaf4026ac7371b35ecf5d651d226fb7cc0c3f194c1540860b7cf5ba35c1ebbdf683cefd8011bd35d345cf6707a1584f6a20230db96` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-client-darwin-amd64.tar.gz) | `8c218437588d960f6782576038bc63af5623e66291d37029653d4bdbba5e19b3e8a8a0225d250d76270ab243aa97fa15ccaf7cae84fefc05a129c05687854c0e` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-client-linux-386.tar.gz) | `6a17e7215d0eb9ca18d4b55ee179a13f1f111ac995aad12bf2613b9dbee1a6a3a25e8856fdb902955c47d076131c03fc074fad5ad490bc09d6dc53638a358582` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-client-linux-amd64.tar.gz) | `0906a8f7de1e5c5efd124385fdee376893733f343d3e8113e4f0f02dfae6a1f5b12dca3e2384700ea75ec39985b7c91832a3aeb8fa4f13ffd736c56a86f23594` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-client-linux-arm.tar.gz) | `1d3418665b4998d6fff1c137424eb60302129098321052d7c5cee5a0e2a5624c9eb2fd19c94b50a598ddf039664e5795e97ba99ae66aabc0ee79f48d23c30a65` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-client-linux-arm64.tar.gz) | `986d6bec386b3bb427e49cd7e41390c7dc5361da4f2f7fc2a823507f83579ea1402de566651519bf83267bf2a92dc4bc40b72bb587cdc78aa8b9027f629e8436` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-client-linux-ppc64le.tar.gz) | `81315af33bc21f9f8808b125e1f4c7a1f797c70f01098fe1fe8dba73d05d89074209c70e39b0fd8b42a5e43f2392ece3a070b9e83be5c4978e82ddad3ce09452` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-client-linux-s390x.tar.gz) | `485978a24ba97a2a2cac162a6984d4b5c32dbe95882cf18d2fd2bf74477f689abc6e9d6b10ec016cd5957b0b71237cd9c01d850ff1c7bd07a561d0c2d6598ee7` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-client-windows-386.tar.gz) | `9a1b5d0f6fbfc85269e9bd7e08be95eeb9a11f43ea38325b8a736e768f3e855e681eef17508ca0c9da6ab9cbed2875dba5beffc91d1418316b7ca3efa192c768` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-client-windows-amd64.tar.gz) | `f2f0221c7d364e3e71b2d9747628298422441c43b731d58c14d7a0ed292e5f12011780c482bdb8f613ddc966868fd422e4ca01e4b522601d74cdee49c59a1766` - -### Server Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-server-linux-amd64.tar.gz) | `fee0200887c7616e3706394b0540b471ad24d57bb587a3a7154adfcd212c7a2521605839b0e95c23d61c86f6c21ef85c63f0d0a0504ba378b4c28cd110771c31` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-server-linux-arm.tar.gz) | `2d329ec0e231dbd4ec750317fc45fb8a966b9a81b45f1af0dde3ca0d1ae66a5ade39c6b64f6a1a492b55f6fca04057113ec05de61cb0f11caeee2fb7639e7775` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-server-linux-arm64.tar.gz) | `0fb64d934d82c17eee15e1f97fc5eeeb4af6e042c30abe41a4d245cde1d9d81ee4dad7e0b0b3f707a509c84fce42289edd2b18c4e364e99a1c396f666f114dcf` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-server-linux-ppc64le.tar.gz) | `5cac4b5951692921389db280ec587037eb3bb7ec4ccf08599ecee2fa39c2a5980df9aba80fc276c78b203222ad297671c45a9fed690ad7bcd774854bd918012b` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-server-linux-s390x.tar.gz) | `39a33f0bb0e06b34779d741e6758b6f7d385e0b933ab799b233e3d4e317f76b5d1e1a6d196f3c7a30a24916ddb7c3c95c8b1c5f6683bce709b2054e1fc018b77` - -### Node Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-node-linux-amd64.tar.gz) | `73abf50e44319763be3124891a1db36d7f7b38124854a1f223ebd91dce8e848a825716c48c9915596447b16388e5b752ca90d4b9977348221adb8a7e3d2242fd` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-node-linux-arm.tar.gz) | `b7ddb82efa39ba5fce5b4124d83279357397a1eb60be24aa19ccbd8263e5e6146bfaff52d7f5167b14d6d9b919c4dcd34319009701e9461d820dc40b015890a0` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-node-linux-arm64.tar.gz) | `458f20f7e9ca2ebddef8738de6a2baa8b8d958b22a935e4d7ac099b07bed91fe44126342faa8942cf23214855b20d2a52fcb95b1fbb8ae6fe33b601ecdbf0c39` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-node-linux-ppc64le.tar.gz) | `d4d5bfe9b9d56495b00322f62aed0f76029d774bff5004d68e85a0db4fb3b4ceb3cef79a4f56e322b8bb47b4adbf3966cff0b5a24f9678da02122f2024ecc6cd` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-node-linux-s390x.tar.gz) | `b967034c8db871a7f503407d5a096fcd6811771c9a294747b0a028659af582fbc47061c388adfabf1c84cd73b33f7bbf5377eb5b31ab51832ea0b5625a82e799` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0/kubernetes-node-windows-amd64.tar.gz) | `dd021d8f2a3d9ddff6e88bce678c28cc0f38165a5d7a388df952d900dcfd1dcaf45c7e75c6387d061014cba15aaf7453905a46e84ddd8b3f8eff2539d50fce9b` - -# Kubernetes v1.15 Release Notes - -## 1.15 What’s New - -A complete changelog for the release notes is now hosted in a customizable format at [https://relnotes.k8s.io/](https://relnotes.k8s.io/?releaseVersions=1.15.0). Check it out and please give us your feedback! - -Kubernetes 1.15 consists of **25 enhancements**: 2 moving to stable, 13 in beta, and 10 in alpha. The main themes of this release are: - -#### Continuous Improvement -- Project sustainability is not just about features. Many SIGs have been working on improving test coverage, ensuring the basics stay reliable, and stability of the core feature set and working on maturing existing features and cleaning up the backlog. - -#### Extensibility - -- The community has been asking for continuing support of extensibility, so this cycle features more work around CRDs and API Machinery. Most of the enhancements in this cycle were from SIG API Machinery and related areas. - -### Extensibility around core Kubernetes APIs - -#### CustomResourceDefinitions Pruning -To enforce both data consistency and security, Kubernetes performs pruning, or the automatic removal of unknown fields in objects sent to a Kubernetes API. An "unknown" field is one that is not specified in the OpenAPI validation schema. This behavior is already in place for native resources and ensures only data structures specified by the CRD developer are persisted to etcd. It will be available as a beta feature in Kubernetes 1.15. - -Pruning is activated by setting `spec.preserveUnknownFields: false` in the CustomResourceDefinition. A future apiextensions.k8s.io/v1 variant of CRDs will enforce pruning. - -Pruning requires that CRD developer provides complete, structural validation schemas, either at the top-level or for all versions of the CRD. - -#### CustomResourceDefinition Defaulting - -CustomResourceDefinitions also have new support for defaulting, with defaults specified using the `default` keyword in the OpenAPI validation schema. Defaults are set for unspecified fields in an object sent to the API, and when reading from etcd. - -Defaulting will be available as alpha in Kubernetes 1.15 and requires structural schemas. - -#### CustomResourceDefinition OpenAPI Publishing - -OpenAPI specs for native types have long been served at /openapi/v2, and they are consumed by a number of components, notably kubectl client-side validation, kubectl explain and OpenAPI based client generators. - -With Kubernetes 1.15 as beta, OpenAPI schemas are also published for CRDs, as long as their schemas are structural. - -These changes are reflected in the following Kubernetes enhancements: -([#383](https://github.com/kubernetes/enhancements/issues/383)), ([#575](https://github.com/kubernetes/enhancements/issues/575) ), ([#492](https://github.com/kubernetes/enhancements/issues/492) ), ([#598](https://github.com/kubernetes/enhancements/issues/598) ), ([#692](https://github.com/kubernetes/enhancements/issues/692) ), ([#95](https://github.com/kubernetes/enhancements/issues/95) ), ([#995](https://github.com/kubernetes/enhancements/issues/995) ), ([#956](https://github.com/kubernetes/enhancements/issues/956) ) - -### Cluster Lifecycle Stability and Usability Improvements -Work on making Kubernetes installation, upgrade and configuration even more robust has been a major focus for this cycle for SIG Cluster Lifecycle (see the May 6, 2019 [Community Update](https://docs.google.com/presentation/d/1QUOsQxfEfHlMq4lPjlK2ewQHsr9peEKymDw5_XwZm8Q/edit?usp=sharing)). Bug fixes across bare metal tooling and production-ready user stories, such as the high availability use cases have been given priority for 1.15. - -kubeadm, the cluster lifecycle building block, continues to receive features and stability work required for bootstrapping production clusters efficiently. kubeadm has promoted high availability (HA) capability to beta, allowing users to use the familiar `kubeadm init` and `kubeadm join` commands to [configure and deploy an HA control plane](https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/high-availability/). An entire new test suite has been created specifically for ensuring these features will stay stable over time. - -Certificate management has become more robust in 1.15, with kubeadm now seamlessly rotating all your certificates (on upgrades) before they expire. Check the [kubeadm documentation](https://github.com/kubernetes/website/blob/dev-1.15/content/en/docs/reference/setup-tools/kubeadm/kubeadm-alpha.md) for information on how to manage your certificates. - -The kubeadm configuration file API is moving from v1beta1 to v1beta2 in 1.15. - -These changes are reflected in the following Kubernetes enhancements: -([#357](https://github.com/kubernetes/enhancements/issues/357) ), ([#970](https://github.com/kubernetes/enhancements/issues/970) ) - -### Continued improvement of CSI -In Kubernetes v1.15, SIG Storage continued work to [enable migration of in-tree volume plugins](https://github.com/kubernetes/enhancements/issues/625) to the Container Storage Interface (CSI). SIG Storage worked on bringing CSI to feature parity with in-tree functionality, including functionality like resizing, inline volumes, and more. SIG Storage introduces new alpha functionality in CSI that doesn't exist in the Kubernetes Storage subsystem yet, like volume cloning. - -Volume cloning enables users to specify another PVC as a "DataSource" when provisioning a new volume. If the underlying storage system supports this functionality and implements the "CLONE_VOLUME" capability in its CSI driver, then the new volume becomes a clone of the source volume. - -These changes are reflected in the following Kubernetes enhancements: -([#625](https://github.com/kubernetes/enhancements/issues/625)) - -#### Additional Notable Feature Updates -- Support for go modules in Kubernetes Core. -- Continued preparation for cloud provider extraction and code organization. The cloud provider code has been moved to kubernetes/legacy-cloud-providers for easier removal later and external consumption. -- Kubectl [get and describe](https://github.com/kubernetes/enhancements/issues/515) now works with extensions -- Nodes now support [third party monitoring plugins](https://github.com/kubernetes/enhancements/issues/606). -- A new [Scheduling Framework](https://github.com/kubernetes/enhancements/issues/624) for schedule plugins is now Alpha. -- ExecutionHook API [designed to trigger hook commands](https://github.com/kubernetes/enhancements/issues/962) in containers is now Alpha. -- Continued deprecation of extensions/v1beta1, apps/v1beta1, and apps/v1beta2 APIs; these extensions will be retired in 1.16! - -Check the [release notes website](https://relnotes.k8s.io/?releaseVersions=1.15.0) for the complete changelog of notable features and fixes. - - - - -## Known Issues - -- Concurrently joining control-plane nodes does not work as expected in kubeadm 1.15.0. The feature was planned for release in 1.15.0, but a fix may come in a follow up patch release. - -- Using `--log-file` is known to be problematic in 1.15. This presents as things being logged multiple times to the same file. The behaviour and details of this issue, as well as some preliminary attempts at fixing it are documented [here](https://github.com/kubernetes/kubernetes/issues/78734#issuecomment-501372131) - -## Urgent Upgrade Notes - -### (No, really, you MUST read this before you upgrade) - -#### API Machinery - -- `k8s.io/kubernetes` and published components (such as `k8s.io/client-go` and `k8s.io/api`) now contain go module files including dependency version information. See [go-modules](http://git.k8s.io/client-go/INSTALL.md#go-modules) for details on consuming `k8s.io/client-go` using go modules. ([#74877](https://github.com/kubernetes/kubernetes/pull/74877), [@liggitt](https://github.com/liggitt)) - -#### Apps - -- Hyperkube short aliases have been removed from source code, because hyperkube docker image currently creates these aliases. ([#76953](https://github.com/kubernetes/kubernetes/pull/76953), [@Rand01ph](https://github.com/Rand01ph)) - -#### Auth - -- The Rancher credential provider has now been removed. This only affects you if you are using the downstream Rancher distro. ([#77099](https://github.com/kubernetes/kubernetes/pull/77099), [@dims](https://github.com/dims)) - - -#### AWS - -- The `system:aws-cloud-provider` cluster role, deprecated in v1.13, is no longer auto-created. Deployments using the AWS cloud provider should grant required permissions to the `aws-cloud-provider` service account in the `kube-system` namespace as part of deployment. ([#66635](https://github.com/kubernetes/kubernetes/pull/66635), [@wgliang](https://github.com/wgliang)) - -#### Azure - -- Kubelet can now run without identity on Azure. A sample cloud provider configuration is: `{"vmType": "vmss", "useInstanceMetadata": true, "subscriptionId": ""}` ([#77906](https://github.com/kubernetes/kubernetes/pull/77906), [@feiskyer](https://github.com/feiskyer)) -- Multiple Kubernetes clusters can now share the same resource group - - When upgrading from previous releases, issues will arise with public IPs if multiple clusters share the same resource group. To solve these problems, make the following changes to the cluster: -Recreate the relevant LoadBalancer services, or add a new tag 'kubernetes-cluster-name: ' manually for existing public IPs. -Configure each cluster with a different cluster name using `kube-controller-manager --cluster-name=` ([#77630](https://github.com/kubernetes/kubernetes/pull/77630), [@feiskyer](https://github.com/feiskyer)) -- The cloud config for Azure cloud provider can now be initialized from Kubernetes secret azure-cloud-provider in kube-system namespace - - the secret is a serialized version of `azure.json` file with key cloud-config. And the secret name is azure-cloud-provider. - - A new option cloudConfigType has been added to the cloud-config file. Supported values are: `file`, `secret` and `merge` (`merge` is the default value). - - To allow Azure cloud provider to read secrets, the [RBAC rules](https://github.com/kubernetes/kubernetes/pull/78242) should be configured. - -#### CLI - -- `kubectl scale job`, deprecated since 1.10, has been removed. ([#78445](https://github.com/kubernetes/kubernetes/pull/78445), [@soltysh](https://github.com/soltysh)) -- The deprecated `--pod`/`-p` flag for `kubectl exec` has been removed. The flag has been marked as deprecated since k8s version v1.12. ([#76713](https://github.com/kubernetes/kubernetes/pull/76713), [@prksu](https://github.com/prksu)) - - -#### Lifecycle - -- Support for deprecated old kubeadm v1alpha3 config has been totally removed. ([#75179](https://github.com/kubernetes/kubernetes/pull/75179), [@rosti](https://github.com/rosti)) -- kube-up.sh no longer supports "centos" and "local" providers. ([#76711](https://github.com/kubernetes/kubernetes/pull/76711), [@dims](https://github.com/dims)) - -#### Network - -- The deprecated flag `--conntrack-max` has been removed from kube-proxy. Users of this flag should switch to `--conntrack-min` and `--conntrack-max-per-core` instead. ([#78399](https://github.com/kubernetes/kubernetes/pull/78399), [@rikatz](https://github.com/rikatz)) -- The deprecated kube-proxy flag `--cleanup-iptables` has been removed. ([#78344](https://github.com/kubernetes/kubernetes/pull/78344), [@aramase](https://github.com/aramase)) - -#### Node - -- The deprecated kubelet security controls `AllowPrivileged`, `HostNetworkSources`, `HostPIDSources`, and `HostIPCSources` have been removed. Enforcement of these restrictions should be done through admission control (such as `PodSecurityPolicy`) instead. ([#77820](https://github.com/kubernetes/kubernetes/pull/77820), [@dims](https://github.com/dims)) -- The deprecated Kubelet flag `--allow-privileged` has been removed. Remove any use of the flag from your kubelet scripts or manifests. ([#77820](https://github.com/kubernetes/kubernetes/pull/77820), [@dims](https://github.com/dims)) -- The kubelet now only collects cgroups metrics for the node, container runtime, kubelet, pods, and containers. ([#72787](https://github.com/kubernetes/kubernetes/pull/72787), [@dashpole](https://github.com/dashpole)) - -#### Storage - -- The `Node.Status.Volumes.Attached.DevicePath` field is now unset for CSI volumes. You must update any external controllers that depend on this field. ([#75799](https://github.com/kubernetes/kubernetes/pull/75799), [@msau42](https://github.com/msau42)) -- CSI alpha CRDs have been removed ([#75747](https://github.com/kubernetes/kubernetes/pull/75747), [@msau42](https://github.com/msau42)) -- The `StorageObjectInUseProtection` admission plugin is enabled by default, so the default enabled admission plugins are now `NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,StorageObjectInUseProtection`. Please note that if you previously had not set the `--admission-control` flag, your cluster behavior may change (to be more standard). ([#74610](https://github.com/kubernetes/kubernetes/pull/74610), [@oomichi](https://github.com/oomichi)) - - - -## Deprecations and Removals - -- kubectl - - `kubectl convert`, deprecated since v1.14, will be removed in v1.17. - - The `--export` flag for the `kubectl get` command, deprecated since v1.14, will be removed in v1.18. - - The `--pod`/`-p` flag for `kubectl exec`, deprecated since 1.12, has been removed. - - `kubectl scale job`, deprecated since 1.10, has been removed. ([#78445](https://github.com/kubernetes/kubernetes/pull/78445), [@soltysh](https://github.com/soltysh)) - - -- kubelet - - The `beta.kubernetes.io/os` and `beta.kubernetes.io/arch` labels, deprecated since v1.14, are targeted for removal in v1.18. - - The `--containerized` flag, deprecated since v1.14, will be removed in a future release. - - cAdvisor json endpoints have been deprecated. ([#78504](https://github.com/kubernetes/kubernetes/pull/78504), [@dashpole](https://github.com/dashpole)) - -- kube-apiserver - - The `--enable-logs-handler` flag and log-serving functionality is deprecated, and scheduled to be removed in v1.19. ([#77611](https://github.com/kubernetes/kubernetes/pull/77611), [@rohitsardesai83](https://github.com/rohitsardesai83)) - -- kube-proxy - - The deprecated `--cleanup-iptables` has been removed,. ([#78344](https://github.com/kubernetes/kubernetes/pull/78344), [@aramase](https://github.com/aramase)) - - -- API - - Ingress resources will no longer be served from `extensions/v1beta1` in v1.19. Migrate use to the `networking.k8s.io/v1beta1` API, available since v1.14. Existing persisted data can be retrieved via the `networking.k8s.io/v1beta1` API. - - NetworkPolicy resources will no longer be served from `extensions/v1beta1` in v1.16. Migrate use to the `networking.k8s.io/v1` API, available since v1.8. Existing persisted data can be retrieved via the `networking.k8s.io/v1` API. - - PodSecurityPolicy resources will no longer be served from `extensions/v1beta1` in v1.16. Migrate to the `policy/v1beta1` API, available since v1.10. Existing persisted data can be retrieved via the `policy/v1beta1` API. - - DaemonSet, Deployment, and ReplicaSet resources will no longer be served from `extensions/v1beta1`, `apps/v1beta1`, or `apps/v1beta2` in v1.16. Migrate to the `apps/v1` API, available since v1.9. Existing persisted data can be retrieved via the `apps/v1` API. - - PriorityClass resources will no longer be served from `scheduling.k8s.io/v1beta1` and `scheduling.k8s.io/v1alpha1` in v1.17. Migrate use to the `scheduling.k8s.io/v1` API, available since v1.14. Existing persisted data can be retrieved via the `scheduling.k8s.io/v1` API. - - The `export` query parameter for list API calls, deprecated since v1.14, will be removed in v1.18. - - The `series.state` field in the events.k8s.io/v1beta1 Event API is deprecated and will be removed in v1.18 ([#75987](https://github.com/kubernetes/kubernetes/pull/75987), [@yastij](https://github.com/yastij)) - -- kubeadm - - The `kubeadm upgrade node config` and `kubeadm upgrade node experimental-control-plane` commands are deprecated in favor of `kubeadm upgrade node`, and will be removed in a future release. ([#78408](https://github.com/kubernetes/kubernetes/pull/78408), [@fabriziopandini](https://github.com/fabriziopandini)) - - The flag `--experimental-control-plane` is now deprecated in favor of `--control-plane`. The flag `--experimental-upload-certs` is now deprecated in favor of `--upload-certs` ([#78452](https://github.com/kubernetes/kubernetes/pull/78452), [@fabriziopandini](https://github.com/fabriziopandini)) - - `kubeadm config upload` has been deprecated, as its replacement is now graduated. Please use `kubeadm init phase upload-config` instead. ([#77946](https://github.com/kubernetes/kubernetes/pull/77946), [@Klaven](https://github.com/Klaven)) - -- The following features are now GA, and the associated feature gates are deprecated and will be removed in v1.17: - - `GCERegionalPersistentDisk` - -## Metrics Changes - -### Added metrics - -- The metric `kube_proxy_sync_proxy_rules_last_timestamp_seconds` is now available, indicating the last time that kube-proxy successfully applied proxying rules. ([#74027](https://github.com/kubernetes/kubernetes/pull/74027), [@squeed](https://github.com/squeed)) -- `process_start_time_seconds` has been added to kubelet’s '/metrics/probes' endpoint ([#77975](https://github.com/kubernetes/kubernetes/pull/77975), [@logicalhan](https://github.com/logicalhan)) -- Scheduler: added metrics to record the number of pending pods in different queues ([#75501](https://github.com/kubernetes/kubernetes/pull/75501), [@Huang-Wei](https://github.com/Huang-Wei)) -- Exposed CSI volume stats via kubelet volume metrics ([#76188](https://github.com/kubernetes/kubernetes/pull/76188), [@humblec](https://github.com/humblec)) -- Added a new `storage_operation_status_count` metric for kube-controller-manager and kubelet to count success and error statues. ([#75750](https://github.com/kubernetes/kubernetes/pull/75750), [@msau42](https://github.com/msau42)) - -### Deprecated/changed metrics - -- kubelet probe metrics are now of the counter type rather than the gauge type, and the `prober_probe_result` has been replaced by `prober_probe_total`. ([#76074](https://github.com/kubernetes/kubernetes/pull/76074), [@danielqsj](https://github.com/danielqsj)) -- The `transformer_failures_total` metric is deprecated in favor of `transformation_operation_total`. The old metric will continue to be populated but will be removed in a future release. ([#70715](https://github.com/kubernetes/kubernetes/pull/70715), [@immutableT](https://github.com/immutableT)) -- Introducing new semantic for metric `volume_operation_total_seconds` to be the end to end latency of volume provisioning/deletion. Existing metric "storage_operation_duration_seconds" will remain untouched, however it is exposed to the following potential issues: - 1. For volumes provisioned/deleted via external provisioner/deleter, `storage_operation_duration_seconds` will NOT wait for the external operation to be done before reporting latency metric (effectively close to 0). This will be fixed by using `volume_operation_total_seconds` instead - 2. if there's a transient error happened during "provisioning/deletion", i.e., a volume is still in-use while a deleteVolume has been called, original `storage_operation_duration_seconds` will NOT wait until a volume has been finally deleted before reporting an inaccurate latency metric. The newly implemented metric `volume_operation_total_seconds`, however, waits until a provisioning/deletion operation has been fully executed. - - Potential impacts: - If an SLO/alert has been defined based on `volume_operation_total_seconds`, it might get violated because of the more accurate metric might be significantly larger than previously reported. The metric is defined to be a histogram and the new semantic could change the distribution. ([#78061](https://github.com/kubernetes/kubernetes/pull/78061), [@yuxiangqian](https://github.com/yuxiangqian)) - -- Implement the scheduling framework with `Reserve`, `Prebind`, `Permit`, `Post-bind`, `Queue sort` and `Unreserve` extension points. -([#77567](https://github.com/kubernetes/kubernetes/pull/77567), [@wgliang](https://github.com/wgliang)) -([#77559](https://github.com/kubernetes/kubernetes/pull/77559), [@ahg-g](https://github.com/ahg-g)) -([#77529](https://github.com/kubernetes/kubernetes/pull/77529), [@draveness](https://github.com/draveness)) -([#77598](https://github.com/kubernetes/kubernetes/pull/77598), [@danielqsj](https://github.com/danielqsj)) -([#77501](https://github.com/kubernetes/kubernetes/pull/77501), [@JieJhih](https://github.com/JieJhih)) -([#77457](https://github.com/kubernetes/kubernetes/pull/77457), [@danielqsj](https://github.com/danielqsj)) -- Replaced *_admission_latencies_milliseconds_summary and *_admission_latencies_milliseconds metrics because they were reporting seconds rather than milliseconds. They were also subject to multiple naming guideline violations (units should be in base units and "duration" is the best practice labelling to measure the time a request takes). Please convert to use *_admission_duration_seconds and *_admission_duration_seconds_summary, as these now report the unit as described, and follow the instrumentation best practices. ([#75279](https://github.com/kubernetes/kubernetes/pull/75279), [@danielqsj](https://github.com/danielqsj)) -- Fixed admission metrics histogram bucket sizes to cover 25ms to ~2.5 seconds. ([#78608](https://github.com/kubernetes/kubernetes/pull/78608), [@jpbetz](https://github.com/jpbetz)) -- Fixed incorrect prometheus azure metrics. ([#77722](https://github.com/kubernetes/kubernetes/pull/77722), [@andyzhangx](https://github.com/andyzhangx)) -- `kubectl scale job`, deprecated since 1.10, has been removed. ([#78445](https://github.com/kubernetes/kubernetes/pull/78445), [@soltysh](https://github.com/soltysh)) - - - -## Notable Features - -### Stable - -- You can now create a non-preempting Pod priority. If set on a class, the pod will continue to be prioritized above queued pods of a lesser class, but will not preempt running pods. ([#74614](https://github.com/kubernetes/kubernetes/pull/74614), [@denkensk](https://github.com/denkensk)) - -- Third party device monitoring is now enabled by default (KubeletPodResources). ([#77274](https://github.com/kubernetes/kubernetes/pull/77274), [@RenaudWasTaken](https://github.com/RenaudWasTaken)) -- The kube-apiserver’s `watch` can now be enabled for events using the `--watch-cache-sizes` flag. ([#74321](https://github.com/kubernetes/kubernetes/pull/74321), [@yastij](https://github.com/yastij)) - -### Beta - -- Admission webhooks can now register for a single version of a resource (for example, `apps/v1 deployments`) and be called when any other version of that resource is modified (for example `extensions/v1beta1 deployments`). This allows new versions of a resource to be handled by admission webhooks without needing to update every webhook to understand the new version. See the API documentation for the `matchPolicy: Equivalent` option in MutatingWebhookConfiguration and ValidatingWebhookConfiguration types. ([#78135](https://github.com/kubernetes/kubernetes/pull/78135), [@liggitt](https://github.com/liggitt)) -- The CustomResourcePublishOpenAPI feature is now beta and enabled by default. CustomResourceDefinitions with [structural schemas](https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/20190425-structural-openapi.md) now publish schemas in the OpenAPI document served at `/openapi/v2`. CustomResourceDefinitions with non-structural schemas have a `NonStructuralSchema` condition added with details about what needs to be corrected in the validation schema. ([#77825](https://github.com/kubernetes/kubernetes/pull/77825), [@roycaihw](https://github.com/roycaihw)) -- Online volume expansion (ExpandInUsePersistentVolumes) is now a beta feature. As such, it is enabled by default. ([#77755](https://github.com/kubernetes/kubernetes/pull/77755), [@gnufied](https://github.com/gnufied)) -- The `SupportNodePidsLimit` feature is now beta, and enabled by default. It is no longer necessary to set the feature gate `SupportNodePidsLimit=true`. ([#76221](https://github.com/kubernetes/kubernetes/pull/76221), [@RobertKrawitz](https://github.com/RobertKrawitz)) -- kubeadm now includes the ability to specify certificate encryption and decryption keys for the upload and download certificate phases as part of the new v1beta2 kubeadm config format. ([#77012](https://github.com/kubernetes/kubernetes/pull/77012), [@rosti](https://github.com/rosti)) -- You can now use kubeadm's `InitConfiguration` and `JoinConfiguration` to define which preflight errors will be ignored. ([#75499](https://github.com/kubernetes/kubernetes/pull/75499), [@marccarre](https://github.com/marccarre)) -- CustomResourcesDefinition conversion via Web Hooks is promoted to beta. Note that you must set `spec.preserveUnknownFields` to `false`. ([#78426](https://github.com/kubernetes/kubernetes/pull/78426), [@sttts](https://github.com/sttts)) -- Group Managed Service Account support has moved to a new API for beta. Special annotations for Windows GMSA support have been deprecated. -([#75459](https://github.com/kubernetes/kubernetes/pull/75459), [@wk8](https://github.com/wk8)) -- The `storageVersionHash` feature is now beta. `StorageVersionHash` is a field in the discovery document of each resource. It enables clients to detect whether the storage version of that resource has changed. Its value must be treated as opaque by clients. Only equality comparison on the value is valid. ([#78325](https://github.com/kubernetes/kubernetes/pull/78325), [@caesarxuchao](https://github.com/caesarxuchao)) -- Ingress objects are now persisted in etcd using the `networking.k8s.io/v1beta1` version ([#77139](https://github.com/kubernetes/kubernetes/pull/77139), [@cmluciano](https://github.com/cmluciano)) -- NodeLocal DNSCache graduating to beta. ([#77887](https://github.com/kubernetes/kubernetes/pull/77887), [@prameshj](https://github.com/prameshj)) - -### Alpha - -- kubelet now allows the use of XFS quotas (on XFS and suitably configured ext4fs filesystems) to monitor storage consumption for ephemeral storage. This method of monitoring consumption, which is currently available only for `emptyDir` volumes, is faster and more accurate than the old method of walking the filesystem tree. Note that it does not enforce limits, it only monitors consumption. To utilize this functionality, set the feature gate `LocalStorageCapacityIsolationFSQuotaMonitoring=true`. For ext4fs filesystems, create the filesystem with `mkfs.ext4 -O project ` and run `tune2fs -Q prjquota `block device`; XFS filesystems need no additional preparation. The filesystem must be mounted with option `project` in `/etc/fstab`. If the primary partition is the root filesystem, add `rootflags=pquota` to the GRUB config file. ([#66928](https://github.com/kubernetes/kubernetes/pull/66928), [@RobertKrawitz](https://github.com/RobertKrawitz)) -- Finalizer Protection for Service LoadBalancers (ServiceLoadBalancerFinalizer) has been added as an Alpha feature, which is disabled by default. This feature ensures the Service resource is not fully deleted until the correlating load balancer resources are deleted. ([#78262](https://github.com/kubernetes/kubernetes/pull/78262), [@MrHohn](https://github.com/MrHohn)) -- Inline CSI ephemeral volumes can now be controlled with PodSecurityPolicy when the CSIInlineVolume alpha feature is enabled. ([#76915](https://github.com/kubernetes/kubernetes/pull/76915), [@vladimirvivien](https://github.com/vladimirvivien)) -- Kubernetes now includes an alpha field, `AllowWatchBookmarks`, in ListOptions for requesting the watching of bookmarks from apiserver. The implementation in apiserver is hidden behind the feature gate `WatchBookmark`. ([#74074](https://github.com/kubernetes/kubernetes/pull/74074), [@wojtek-t](https://github.com/wojtek-t)) - -### Staging Repositories - -- The CRI API is now available in the `k8s.io/cri-api` staging repository. ([#75531](https://github.com/kubernetes/kubernetes/pull/75531), [@dims](https://github.com/dims)) -- Support for the Azure File plugin has been added to `csi-translation-lib` (CSIMigrationAzureFile). ([#78356](https://github.com/kubernetes/kubernetes/pull/78356), [@andyzhangx](https://github.com/andyzhangx)) -- Added support for Azure Disk plugin to csi-translation-lib (CSIMigrationAzureDisk) ([#78330](https://github.com/kubernetes/kubernetes/pull/78330), [@andyzhangx](https://github.com/andyzhangx)) - -### CLI Improvements - -- Added `kubeadm upgrade node`. This command can be used to upgrade both secondary control-plane nodes and worker nodes. The `kubeadm upgrade node config` and `kubeadm upgrade node experimental-control-plane` commands are now deprecated. ([#78408](https://github.com/kubernetes/kubernetes/pull/78408), [@fabriziopandini](https://github.com/fabriziopandini)) -- The `kubectl top` command now includes a `--sort-by` option to sort by `memory` or `cpu`. ([#75920](https://github.com/kubernetes/kubernetes/pull/75920), [@artmello](https://github.com/artmello)) -- `kubectl rollout restart` now works for DaemonSets and StatefulSets. ([#77423](https://github.com/kubernetes/kubernetes/pull/77423), [@apelisse](https://github.com/apelisse)) -- `kubectl get --watch=true` now prints custom resource definitions with custom print columns. ([#76161](https://github.com/kubernetes/kubernetes/pull/76161), [@liggitt](https://github.com/liggitt)) -- Added `kubeadm alpha certs certificate-key` command to generate secure random key to use on `kubeadm init --experimental-upload-certs` ([#77848](https://github.com/kubernetes/kubernetes/pull/77848), [@yagonobre](https://github.com/yagonobre)) -- Kubernetes now supports printing the `volumeMode` using `kubectl get pv/pvc -o wide` ([#76646](https://github.com/kubernetes/kubernetes/pull/76646), [@cwdsuzhou](https://github.com/cwdsuzhou)) -- Created a new `kubectl rollout restart` command that does a rolling restart of a deployment. ([#76062](https://github.com/kubernetes/kubernetes/pull/76062), [@apelisse](https://github.com/apelisse)) -- `kubectl exec` now allows using the resource name to select a matching pod and `--pod-running-timeout` flag to wait till at least one pod is running. ([#73664](https://github.com/kubernetes/kubernetes/pull/73664), [@prksu](https://github.com/prksu)) -- `kubeadm alpha certs renew` and `kubeadm upgrade` now supports renewal of certificates embedded in KubeConfig files managed by kubeadm; this does not apply to certificates signed by external CAs. ([#77180](https://github.com/kubernetes/kubernetes/pull/77180), [@fabriziopandini](https://github.com/fabriziopandini)) -- Kubeadm: a new command `kubeadm alpha certs check-expiration` was created in order to help users in managing expiration for local PKI certificates ([#77863](https://github.com/kubernetes/kubernetes/pull/77863), [@fabriziopandini](https://github.com/fabriziopandini)) - -### Misc - -- Service account controller clients to now use the TokenRequest API, and tokens are periodically rotated. ([#72179](https://github.com/kubernetes/kubernetes/pull/72179), [@WanLinghao](https://github.com/WanLinghao)) -- Added `ListPager.EachListItem` utility function to client-go to enable incremental processing of chunked list responses ([#75849](https://github.com/kubernetes/kubernetes/pull/75849), [@jpbetz](https://github.com/jpbetz)) -- Object count quota is now supported for namespaced custom resources using the `count/.` syntax. ([#72384](https://github.com/kubernetes/kubernetes/pull/72384), [@zhouhaibing089](https://github.com/zhouhaibing089)) -- Added completed job status in Cron Job event. ([#75712](https://github.com/kubernetes/kubernetes/pull/75712), [@danielqsj](https://github.com/danielqsj)) -- Pod disruption budgets can now be updated and patched. ([#69867](https://github.com/kubernetes/kubernetes/pull/69867), [@davidmccormick](https://github.com/davidmccormick)) -- Add CRD spec.preserveUnknownFields boolean, defaulting to true in v1beta1 and to false in v1 CRDs. If false, fields not specified in the validation schema will be removed when sent to the API server or when read from etcd. ([#77333](https://github.com/kubernetes/kubernetes/pull/77333), [@sttts](https://github.com/sttts)) -- Added RuntimeClass restrictions and defaulting to PodSecurityPolicy. ([#73795](https://github.com/kubernetes/kubernetes/pull/73795), [@tallclair](https://github.com/tallclair)) -- Kubelet plugin registration now has retry and exponential backoff logic for when registration of plugins (such as CSI or device plugin) fail. ([#73891](https://github.com/kubernetes/kubernetes/pull/73891), [@taragu](https://github.com/taragu)) -- proxy/transport now supports Content-Encoding: deflate ([#76551](https://github.com/kubernetes/kubernetes/pull/76551), [@JieJhih](https://github.com/JieJhih)) -- Admission webhooks are now properly called for `scale` and `deployments/rollback` subresources. ([#76849](https://github.com/kubernetes/kubernetes/pull/76849), [@liggitt](https://github.com/liggitt)) - -## API Changes - -- CRDs get support for x-kubernetes-int-or-string to allow faithful representation of IntOrString types in CustomResources.([#78815](https://github.com/kubernetes/kubernetes/pull/78815), [@sttts](https://github.com/sttts)) -- Introduced the [`v1beta2`](https://docs.google.com/document/d/1XnP67oO1i9VcDIpw42IzptnJsc5OQM-HTf8cVcjCR2w/edit) config format to kubeadm. ([#76710](https://github.com/kubernetes/kubernetes/pull/76710), [@rosti](https://github.com/rosti)) -- Resource list requests for `PartialObjectMetadata` now correctly return list metadata like the resourceVersion and the continue token. ([#75971](https://github.com/kubernetes/kubernetes/pull/75971), [@smarterclayton](https://github.com/smarterclayton)) -- Added a condition `NonStructuralSchema` to `CustomResourceDefinition` listing Structural Schema violations as defined in the [KEP](https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/20190425-structural-openapi.md). CRD authors should update their validation schemas to be structural in order to participate in future CRD features. ([#77207](https://github.com/kubernetes/kubernetes/pull/77207), [@sttts](https://github.com/sttts)) -- Promoted meta.k8s.io/v1beta1 Table and PartialObjectMetadata to v1. ([#77136](https://github.com/kubernetes/kubernetes/pull/77136), [@smarterclayton](https://github.com/smarterclayton)) -- Introduced the flag `--ipvs-strict-arp` to configure stricter ARP sysctls, defaulting to false to preserve existing behaviors. This was enabled by default in 1.13.0, which impacted a few CNI plugins. ([#75295](https://github.com/kubernetes/kubernetes/pull/75295), [@lbernail](https://github.com/lbernail)) -- CRD validation schemas should not specify `metadata` fields other than `name` and `generateName`. A schema will not be considered structural (and therefore ready for future features) if `metadata` is specified in any other way. ([#77653](https://github.com/kubernetes/kubernetes/pull/77653), [@sttts](https://github.com/sttts)) - -## Other notable changes - -### API Machinery - -- Added port configuration to Admission webhook configuration service reference. -- Added port configuration to AuditSink webhook configuration service reference. -- Added port configuration to CRD Conversion webhook configuration service reference. -- Added port configuration to kube-aggregator service reference. ([#74855](https://github.com/kubernetes/kubernetes/pull/74855), [@mbohlool](https://github.com/mbohlool)) -- Implemented deduplication logic for v1beta1.Event API ([#65782](https://github.com/kubernetes/kubernetes/pull/65782), [@yastij](https://github.com/yastij)) -- Added `objectSelector` to admission webhook configurations. `objectSelector` is evaluated the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. ([#78505](https://github.com/kubernetes/kubernetes/pull/78505), [@caesarxuchao](https://github.com/caesarxuchao)) -- Watch will now support converting response objects into Table or PartialObjectMetadata forms. ([#71548](https://github.com/kubernetes/kubernetes/pull/71548), [@smarterclayton](https://github.com/smarterclayton)) -- In CRD webhook conversion, Kubernetes will now ignore changes to metadata other than for labels and annotations. ([#77743](https://github.com/kubernetes/kubernetes/pull/77743), [@sttts](https://github.com/sttts)) -- Added ListMeta.RemainingItemCount. When responding to a LIST request, if the server has more data available, and if the request does not contain label selectors or field selectors, the server sets the ListOptions.RemainingItemCount to the number of remaining objects. ([#75993](https://github.com/kubernetes/kubernetes/pull/75993), [@caesarxuchao](https://github.com/caesarxuchao)) -- Clients may now request that API objects are converted to the `v1.Table` and `v1.PartialObjectMetadata` forms for generic access to objects. ([#77448](https://github.com/kubernetes/kubernetes/pull/77448), [@smarterclayton](https://github.com/smarterclayton)) - -- Fixed a spurious error where update requests to the status subresource of multi-version custom resources would complain about an incorrect API version. ([#78713](https://github.com/kubernetes/kubernetes/pull/78713), [@liggitt](https://github.com/liggitt)) -- Fixed a bug in apiserver storage that could cause just-added finalizers to be ignored immediately following a delete request, leading to premature deletion. ([#77619](https://github.com/kubernetes/kubernetes/pull/77619), [@caesarxuchao](https://github.com/caesarxuchao)) -- API requests rejected by admission webhooks which specify an http status code < 400 are now assigned a 400 status code. ([#77022](https://github.com/kubernetes/kubernetes/pull/77022), [@liggitt](https://github.com/liggitt)) -- Fixed a transient error API requests for custom resources could encounter while changes to the CustomResourceDefinition were being applied. ([#77816](https://github.com/kubernetes/kubernetes/pull/77816), [@liggitt](https://github.com/liggitt)) -[@smarterclayton](https://github.com/smarterclayton)) -- Added name validation for dynamic client methods in client-go ([#75072](https://github.com/kubernetes/kubernetes/pull/75072), [@lblackstone](https://github.com/lblackstone)) -- CustomResourceDefinition with invalid regular expression in the pattern field of OpenAPI v3 validation schemas are no longer considered structural. ([#78453](https://github.com/kubernetes/kubernetes/pull/78453), [@sttts](https://github.com/sttts)) -- API paging is now enabled by default in k8s.io/apiserver recommended options, and in k8s.io/sample-apiserver ([#77278](https://github.com/kubernetes/kubernetes/pull/77278), [@liggitt](https://github.com/liggitt)) - -- Increased verbose level for local openapi aggregation logs to avoid flooding the log during normal operation ([#75781](https://github.com/kubernetes/kubernetes/pull/75781), [@roycaihw](https://github.com/roycaihw)) -- k8s.io/client-go/dynamic/dynamicinformer.NewFilteredDynamicSharedInformerFactory now honours the `namespace` argument. ([#77945](https://github.com/kubernetes/kubernetes/pull/77945), [@michaelfig](https://github.com/michaelfig)) -- client-go and kubectl no longer write cached discovery files with world-accessible file permissions. ([#77874](https://github.com/kubernetes/kubernetes/pull/77874), [@yuchengwu](https://github.com/yuchengwu)) -- Fixed an error with stuck informers when an etcd watch receives update or delete events with missing data. ([#76675](https://github.com/kubernetes/kubernetes/pull/76675), [@ryanmcnamara](https://github.com/ryanmcnamara)) -- `DelayingQueue.ShutDown()` can now be invoked multiple times without causing a closed channel panic. ([#77170](https://github.com/kubernetes/kubernetes/pull/77170), [@smarterclayton](https://github.com/smarterclayton)) -- When specifying an invalid value for a label, it was not always clear which label the value was specified for. Starting with this release, the label's key is included in such error messages, which makes debugging easier. ([#77144](https://github.com/kubernetes/kubernetes/pull/77144), [@kenegozi](https://github.com/kenegozi)) -- Fixed a regression error when proxying responses from aggregated API servers, which could cause watch requests to hang until the first event was received. ([#75887](https://github.com/kubernetes/kubernetes/pull/75887), [@liggitt](https://github.com/liggitt)) -- Fixed a bug where dry-run is not honored for pod/eviction sub-resource. ([#76969](https://github.com/kubernetes/kubernetes/pull/76969), [@apelisse](https://github.com/apelisse)) - -- DeleteOptions parameters for deletecollection endpoints are now published in the OpenAPI spec. ([#77843](https://github.com/kubernetes/kubernetes/pull/77843), [@roycaihw](https://github.com/roycaihw)) -- Active watches of custom resources now terminate properly if the CRD is modified. ([#78029](https://github.com/kubernetes/kubernetes/pull/78029), [@liggitt](https://github.com/liggitt)) -- Fixed a potential deadlock in the resource quota controller. Enabled recording partial usage info for quota objects specifying multiple resources, when only some of the resources' usage can be determined. ([#74747](https://github.com/kubernetes/kubernetes/pull/74747), [@liggitt](https://github.com/liggitt)) -- Updates that remove remaining `metadata.finalizers` from an object that is pending deletion (non-nil metadata.deletionTimestamp) and has no graceful deletion pending (nil or 0 metadata.deletionGracePeriodSeconds) now results in immediate deletion of the object. ([#77952](https://github.com/kubernetes/kubernetes/pull/77952), [@liggitt](https://github.com/liggitt)) -- client-go: The `rest.AnonymousClientConfig(*rest.Config) *rest.Config` helper method no longer copies custom `Transport` and `WrapTransport` fields, because those can be used to inject user credentials. ([#75771](https://github.com/kubernetes/kubernetes/pull/75771), [@liggitt](https://github.com/liggitt)) -- Validating admission webhooks are now properly called for CREATE operations on the following resources: pods/binding, pods/eviction, bindings ([#76910](https://github.com/kubernetes/kubernetes/pull/76910), [@liggitt](https://github.com/liggitt)) -- Removed the function Parallelize, please convert to use the function ParallelizeUntil. ([#76595](https://github.com/kubernetes/kubernetes/pull/76595), [@danielqsj](https://github.com/danielqsj)) - -### Apps - -- Users can now specify a DataSource/Kind of type `PersistentVolumeClaim` in their PVC spec. This can then be detected by the external csi-provisioner and plugins if capable. ([#76913](https://github.com/kubernetes/kubernetes/pull/76913), [@j-griffith](https://github.com/j-griffith)) -- Fixed bug in DaemonSetController causing it to stop processing some DaemonSets for 5 minutes after node removal. ([#76060](https://github.com/kubernetes/kubernetes/pull/76060), [@krzysztof-jastrzebski](https://github.com/krzysztof-jastrzebski)) -- StatefulSet controllers no longer force a resync every 30 seconds when nothing has changed. ([#75622](https://github.com/kubernetes/kubernetes/pull/75622), [@jonsabo](https://github.com/jonsabo)) -- Enhanced the daemonset sync logic to avoid a problem where pods are thought to be unavailable when the controller's clock is slower than the node's clock. ([#77208](https://github.com/kubernetes/kubernetes/pull/77208), [@DaiHao](https://github.com/DaiHao)) -- Fixed a bug that caused a DaemonSet rolling update to hang when its pod gets stuck at terminating. ([#77773](https://github.com/kubernetes/kubernetes/pull/77773), [@DaiHao](https://github.com/DaiHao)) -- Route controller now respects rate limiting to the cloud provider on deletion; previously it was only for create. ([#78581](https://github.com/kubernetes/kubernetes/pull/78581), [@andrewsykim](https://github.com/andrewsykim)) -- Removed extra pod creation expectations when daemonset fails to create pods in batches. ([#74856](https://github.com/kubernetes/kubernetes/pull/74856), [@draveness](https://github.com/draveness)) -- Resolved spurious rollouts of workload controllers when upgrading the API server, due to incorrect defaulting of an alpha procMount field in pods. ([#78885](https://github.com/kubernetes/kubernetes/pull/78885), [@liggitt](https://github.com/liggitt)) - -### Auth - -- Fixed OpenID Connect (OIDC) token refresh when the client secret contains a special character. ([#76914](https://github.com/kubernetes/kubernetes/pull/76914), [@tsuna](https://github.com/tsuna)) -- Improved `kubectl auth can-i` command by warning users when they try to access a resource out of scope. ([#76014](https://github.com/kubernetes/kubernetes/pull/76014), [@WanLinghao](https://github.com/WanLinghao)) -- Validating admission webhooks are now properly called for CREATE operations on the following resources: tokenreviews, subjectaccessreviews, localsubjectaccessreviews, selfsubjectaccessreviews, selfsubjectrulesreviews ([#76959](https://github.com/kubernetes/kubernetes/pull/76959), [@sbezverk](https://github.com/sbezverk)) - -### Autoscaling - -- Horizontal Pod Autoscaling can now scale targets up even when one or more metrics are invalid/unavailable, as long as one metric indicates a scale up should occur. ([#78503](https://github.com/kubernetes/kubernetes/pull/78503), [@gjtempleton](https://github.com/gjtempleton)) - - -### AWS - -- Kubernetes will now use the zone from the node for topology aware aws-ebs volume creation to reduce unnecessary cloud provider calls. ([#78276](https://github.com/kubernetes/kubernetes/pull/78276), [@zhan849](https://github.com/zhan849)) -- Kubernetes now supports configure accessLogs for AWS NLB. ([#78497](https://github.com/kubernetes/kubernetes/pull/78497), [@M00nF1sh](https://github.com/M00nF1sh)) -- Kubernetes now supports update LoadBalancerSourceRanges for AWS NLB([#74692](https://github.com/kubernetes/kubernetes/pull/74692), [@M00nF1sh](https://github.com/M00nF1sh)) -- Kubernetes now supports configure TLS termination for AWS NLB([#74910](https://github.com/kubernetes/kubernetes/pull/74910), [@M00nF1sh](https://github.com/M00nF1sh)) -- Kubernetes will now consume the AWS region list from the AWS SDK instead of a hard-coded list in the cloud provider. ([#75990](https://github.com/kubernetes/kubernetes/pull/75990), [@mcrute](https://github.com/mcrute)) -- Limit use of tags when calling EC2 API to prevent API throttling for very large clusters. ([#76749](https://github.com/kubernetes/kubernetes/pull/76749), [@mcrute](https://github.com/mcrute)) -- The AWS credential provider can now obtain ECR credentials even without the AWS cloud provider or being on an EC2 instance. Additionally, AWS credential provider caching has been improved to honor the ECR credential timeout. ([#75587](https://github.com/kubernetes/kubernetes/pull/75587), [@tiffanyfay](https://github.com/tiffanyfay)) - - -### Azure - -- Kubernetes now supports specifying the Resource Group of the Route Table when updating the Pod network route on Azure. ([#75580](https://github.com/kubernetes/kubernetes/pull/75580), [@suker200](https://github.com/suker200)) -- Kubernetes now uses instance-level update APIs for Azure VMSS loadbalancer operations. ([#76656](https://github.com/kubernetes/kubernetes/pull/76656), [@feiskyer](https://github.com/feiskyer)) -- Users can now specify azure file share name in the azure file plugin, making it possible to use existing shares or specify a new share name. ([#76988](https://github.com/kubernetes/kubernetes/pull/76988), [@andyzhangx](https://github.com/andyzhangx)) -- You can now run kubelet with no Azure identity. A sample cloud provider configuration is: `{"vmType": "vmss", "useInstanceMetadata": true, "subscriptionId": ""}` ([#77906](https://github.com/kubernetes/kubernetes/pull/77906), [@feiskyer](https://github.com/feiskyer)) -- Fixed some service tags not supported issues for Azure LoadBalancer service. ([#77719](https://github.com/kubernetes/kubernetes/pull/77719), [@feiskyer](https://github.com/feiskyer)) -- Fixed an issue where `pull image` fails from a cross-subscription Azure Container Registry when using MSI to authenticate. ([#77245](https://github.com/kubernetes/kubernetes/pull/77245), [@norshtein](https://github.com/norshtein)) -- Azure cloud provider can now be configured by Kubernetes secrets and a new option `cloudConfigType` has been introduced. Candidate values are `file`, `secret` or `merge` (default is `merge`). Note that the secret is a serialized version of `azure.json` file with key cloud-config. And the secret name is azure-cloud-provider in kube-system namespace. ([#78242](https://github.com/kubernetes/kubernetes/pull/78242), [@feiskyer](https://github.com/feiskyer)) - -### CLI - -- Fixed `kubectl exec` usage string to correctly reflect flag placement. ([#77589](https://github.com/kubernetes/kubernetes/pull/77589), [@soltysh](https://github.com/soltysh)) -- Fixed `kubectl describe cronjobs` error of `Successful Job History Limit`. ([#77347](https://github.com/kubernetes/kubernetes/pull/77347), [@danielqsj](https://github.com/danielqsj)) -- In the `kubectl describe` output, the fields with names containing special characters are now displayed as-is without any pretty formatting, avoiding awkward outputs. ([#75483](https://github.com/kubernetes/kubernetes/pull/75483), [@gsadhani](https://github.com/gsadhani)) -- Fixed incorrect handling by kubectl of custom resources whose Kind is "Status". ([#77368](https://github.com/kubernetes/kubernetes/pull/77368), [@liggitt](https://github.com/liggitt)) -- Report cp errors consistently, providing full message whether copying to or from a pod. ([#77010](https://github.com/kubernetes/kubernetes/pull/77010), [@soltysh](https://github.com/soltysh)) -- Preserved existing namespace information in manifests when running ` -set ... --local` commands. ([#77267](https://github.com/kubernetes/kubernetes/pull/77267), [@liggitt](https://github.com/liggitt)) -- Support for parsing more v1.Taint forms has been added. For example, `key:effect`, `key=:effect-` are now accepted. ([#74159](https://github.com/kubernetes/kubernetes/pull/74159), [@dlipovetsky](https://github.com/dlipovetsky)) - -### Cloud Provider - -- The GCE-only flag `cloud-provider-gce-lb-src-cidrs` is now optional for external cloud providers. ([#76627](https://github.com/kubernetes/kubernetes/pull/76627), [@timoreimann](https://github.com/timoreimann)) -- Fixed a bug where cloud-controller-manager initializes nodes multiple times. ([#75405](https://github.com/kubernetes/kubernetes/pull/75405), [@tghartland](https://github.com/tghartland)) - -### Cluster Lifecycle - -- `kubeadm upgrade` now renews all the certificates used by a component before upgrading the component itself, with the exception of certificates signed by external CAs. User can eventually opt-out of certificate renewal during upgrades by setting the new flag `--certificate-renewal` to false. ([#76862](https://github.com/kubernetes/kubernetes/pull/76862), [@fabriziopandini](https://github.com/fabriziopandini)) -- kubeadm still generates RSA keys when deploying a node, but also accepts ECDSA -keys if they already exist in the directory specified in the `--cert-dir` option. ([#76390](https://github.com/kubernetes/kubernetes/pull/76390), [@rojkov](https://github.com/rojkov)) -- kubeadm now implements CRI detection for Windows worker nodes ([#78053](https://github.com/kubernetes/kubernetes/pull/78053), [@ksubrmnn](https://github.com/ksubrmnn)) -- Added `--image-repository` flag to `kubeadm config images`. ([#75866](https://github.com/kubernetes/kubernetes/pull/75866), [@jmkeyes](https://github.com/jmkeyes)) - -- kubeadm: The kubeadm reset command has now been exposed as phases. ([#77847](https://github.com/kubernetes/kubernetes/pull/77847), [@yagonobre](https://github.com/yagonobre)) -- kubeadm: Improved resiliency when it comes to updating the `kubeadm-config` configmap upon new control plane joins or resets. This allows for safe multiple control plane joins and/or resets. ([#76821](https://github.com/kubernetes/kubernetes/pull/76821), [@ereslibre](https://github.com/ereslibre)) -- kubeadm: Bumped the minimum supported Docker version to 1.13.1 ([#77051](https://github.com/kubernetes/kubernetes/pull/77051), [@chenzhiwei](https://github.com/chenzhiwei)) -- Reverted the CoreDNS version to 1.3.1 for kubeadm ([#78545](https://github.com/kubernetes/kubernetes/pull/78545), [@neolit123](https://github.com/neolit123)) -- kubeadm: Fixed the machine readability of `kubeadm token create --print-join-command` ([#75487](https://github.com/kubernetes/kubernetes/pull/75487), [@displague](https://github.com/displague)) -- `kubeadm alpha certs renew --csr-only` now reads the current certificates as the authoritative source for certificates attributes (same as kubeadm alpha certs renew). ([#77780](https://github.com/kubernetes/kubernetes/pull/77780), [@fabriziopandini](https://github.com/fabriziopandini)) -- kubeadm: You can now delete multiple bootstrap tokens at once. ([#75646](https://github.com/kubernetes/kubernetes/pull/75646), [@bart0sh](https://github.com/bart0sh)) -- util/initsystem: Added support for the OpenRC init system ([#73101](https://github.com/kubernetes/kubernetes/pull/73101), [@oz123](https://github.com/oz123)) -- Default TTL for DNS records in kubernetes zone has been changed from 5s to 30s to keep consistent with old dnsmasq based kube-dns. The TTL can be customized with command `kubectl edit -n kube-system configmap/coredns`. ([#76238](https://github.com/kubernetes/kubernetes/pull/76238), [@Dieken](https://github.com/Dieken)) -- Communication between the etcd server and kube-apiserver on master is now overridden to use HTTPS instead of HTTP when mTLS is enabled in GCE. ([#74690](https://github.com/kubernetes/kubernetes/pull/74690), [@wenjiaswe](https://github.com/wenjiaswe)) - -### GCP - -- [stackdriver addon] Bumped prometheus-to-sd to v0.5.0 to pick up security fixes. -[fluentd-gcp addon] Bumped fluentd-gcp-scaler to v0.5.1 to pick up security fixes. -[fluentd-gcp addon] Bumped event-exporter to v0.2.4 to pick up security fixes. -[fluentd-gcp addon] Bumped prometheus-to-sd to v0.5.0 to pick up security fixes. -[metatada-proxy addon] Bumped prometheus-to-sd v0.5.0 to pick up security fixes. ([#75362](https://github.com/kubernetes/kubernetes/pull/75362), [@serathius](https://github.com/serathius)) -- [fluentd-gcp addon] Bump fluentd-gcp-scaler to v0.5.2 to pick up security fixes. ([#76762](https://github.com/kubernetes/kubernetes/pull/76762), [@serathius](https://github.com/serathius)) -- The GCERegionalPersistentDisk feature gate (GA in 1.13) can no longer be disabled. The feature gate will be removed in v1.17. ([#77412](https://github.com/kubernetes/kubernetes/pull/77412), [@liggitt](https://github.com/liggitt)) -- GCE/Windows: When the service cannot be stopped Stackdriver logging processes are now force killed ([#77378](https://github.com/kubernetes/kubernetes/pull/77378), [@yujuhong](https://github.com/yujuhong)) -- Reduced GCE log rotation check from 1 hour to every 5 minutes. Rotation policy is unchanged (new day starts, log file size > 100MB). ([#76352](https://github.com/kubernetes/kubernetes/pull/76352), [@jpbetz](https://github.com/jpbetz)) -- GCE/Windows: disabled stackdriver logging agent to prevent node startup failures ([#76099](https://github.com/kubernetes/kubernetes/pull/76099), [@yujuhong](https://github.com/yujuhong)) -- API servers using the default Google Compute Engine bootstrapping scripts will have their insecure port (`:8080`) disabled by default. To enable the insecure port, set `ENABLE_APISERVER_INSECURE_PORT=true` in kube-env or as an environment variable. ([#77447](https://github.com/kubernetes/kubernetes/pull/77447), [@dekkagaijin](https://github.com/dekkagaijin)) -- Fixed a NPD bug on GCI, so that it disables glog writing to files for log-counter. ([#76211](https://github.com/kubernetes/kubernetes/pull/76211), [@wangzhen127](https://github.com/wangzhen127)) -- Windows nodes on GCE now have the Windows firewall enabled by default. ([#78507](https://github.com/kubernetes/kubernetes/pull/78507), [@pjh](https://github.com/pjh)) -- Added `CNI_VERSION` and `CNI_SHA1` environment variables in `kube-up.sh` to configure CNI versions on GCE. ([#76353](https://github.com/kubernetes/kubernetes/pull/76353), [@Random-Liu](https://github.com/Random-Liu)) -- GCE clusters will include some IP ranges that are not used on the public Internet in the list of non-masq IPs. Bumped ip-masq-agent version to v2.3.0 with flag `nomasq-all-reserved-ranges` turned on. ([#77458](https://github.com/kubernetes/kubernetes/pull/77458), [@grayluck](https://github.com/grayluck)) -- GCE/Windows: added support for the stackdriver logging agent ([#76850](https://github.com/kubernetes/kubernetes/pull/76850), [@yujuhong](https://github.com/yujuhong)) -- GCE Windows nodes will rely solely on kubernetes and kube-proxy (and not the GCE agent) for network address management. ([#75855](https://github.com/kubernetes/kubernetes/pull/75855), [@pjh](https://github.com/pjh)) -- Ensured that the `node-role.kubernetes.io/master` taint is applied to the master with NoSchedule on GCE. ([#78183](https://github.com/kubernetes/kubernetes/pull/78183), [@cheftako](https://github.com/cheftako)) -- Windows nodes on GCE now use a known-working 1809 image rather than the latest 1809 image. ([#76722](https://github.com/kubernetes/kubernetes/pull/76722), [@pjh](https://github.com/pjh)) -- kube-up.sh scripts now disable the KubeletPodResources feature for Windows nodes, due to issue #[78628](https://github.com/kubernetes/kubernetes/pull/78668). ([#78668](https://github.com/kubernetes/kubernetes/pull/78668), [@mtaufen](https://github.com/mtaufen)) - - -### Instrumentation - -- [metrics-server addon] Restored the ability to connect to nodes via IP addresses. ([#76819](https://github.com/kubernetes/kubernetes/pull/76819), [@serathius](https://github.com/serathius)) -- If a pod has a running instance, the stats of its previously terminated instances will not show up in the kubelet summary stats any more for CRI runtimes such as containerd and cri-o. This keeps the behavior consistent with Docker integration, and fixes an issue that some container Prometheus metrics don't work when there are summary stats for multiple instances of the same pod. ([#77426](https://github.com/kubernetes/kubernetes/pull/77426), [@Random-Liu](https://github.com/Random-Liu)) - - -### Network - -- Ingress objects are now persisted in etcd using the networking.k8s.io/v1beta1 version ([#77139](https://github.com/kubernetes/kubernetes/pull/77139), [@cmluciano](https://github.com/cmluciano)) -- Transparent kube-proxy restarts when using IPVS are now allowed. ([#75283](https://github.com/kubernetes/kubernetes/pull/75283), [@lbernail](https://github.com/lbernail)) -- Packets considered INVALID by conntrack are now dropped. In particular, this fixes -a problem where spurious retransmits in a long-running TCP connection to a service -IP could result in the connection being closed with the error "Connection reset by -peer" ([#74840](https://github.com/kubernetes/kubernetes/pull/74840), [@anfernee](https://github.com/anfernee)) -- kube-proxy no longer automatically cleans up network rules created by running kube-proxy in other modes. If you are switching the kube-proxy mode (EG: iptables to IPVS), you will need to run `kube-proxy --cleanup`, or restart the worker node (recommended) before restarting kube-proxy. If you are not switching kube-proxy between different modes, this change should not require any action. ([#76109](https://github.com/kubernetes/kubernetes/pull/76109), [@vllry](https://github.com/vllry)) -- kube-proxy: HealthzBindAddress and MetricsBindAddress now support ipv6 addresses. ([#76320](https://github.com/kubernetes/kubernetes/pull/76320), [@JieJhih](https://github.com/JieJhih)) -- The userspace proxy now respects the IPTables proxy's minSyncInterval parameter. ([#71735](https://github.com/kubernetes/kubernetes/pull/71735), [@dcbw](https://github.com/dcbw)) - -- iptables proxier: now routes local traffic to LB IPs to service chain ([#77523](https://github.com/kubernetes/kubernetes/pull/77523), [@andrewsykim](https://github.com/andrewsykim)) -- IPVS: Disabled graceful termination for UDP traffic to solve issues with high number of UDP connections (DNS / syslog in particular) ([#77802](https://github.com/kubernetes/kubernetes/pull/77802), [@lbernail](https://github.com/lbernail)) -- Fixed a bug where kube-proxy returns error due to existing ipset rules using a different hash type. ([#77371](https://github.com/kubernetes/kubernetes/pull/77371), [@andrewsykim](https://github.com/andrewsykim)) -- Fixed spurious error messages about failing to clean up iptables rules when using iptables 1.8. ([#77303](https://github.com/kubernetes/kubernetes/pull/77303), [@danwinship](https://github.com/danwinship)) -- Increased log level to 2 for IPVS graceful termination ([#78395](https://github.com/kubernetes/kubernetes/pull/78395), [@andrewsykim](https://github.com/andrewsykim)) -- kube-proxy: os exit when CleanupAndExit is set to true ([#76732](https://github.com/kubernetes/kubernetes/pull/76732), [@JieJhih](https://github.com/JieJhih)) -- Kubernetes will now allow trailing dots in the externalName of Services of type ExternalName. ([#78385](https://github.com/kubernetes/kubernetes/pull/78385), [@thz](https://github.com/thz)) - -### Node - -- The dockershim container runtime now accepts the `docker` runtime handler from a RuntimeClass. ([#78323](https://github.com/kubernetes/kubernetes/pull/78323), [@tallclair](https://github.com/tallclair)) -- The init container can now get its own field value as environment variable values using downwardAPI support. ([#75109](https://github.com/kubernetes/kubernetes/pull/75109), [@yuchengwu](https://github.com/yuchengwu)) -- UpdateContainerResources is no longer recorded as a `container_status` operation. It now uses the label `update_container`. ([#75278](https://github.com/kubernetes/kubernetes/pull/75278), [@Nessex](https://github.com/Nessex)) -- kubelet: fix fail to close kubelet->API connections on heartbeat failure when bootstrapping or client certificate rotation is disabled ([#78016](https://github.com/kubernetes/kubernetes/pull/78016), [@gaorong](https://github.com/gaorong)) -- Set selinux label at plugin socket directory ([#73241](https://github.com/kubernetes/kubernetes/pull/73241), [@vikaschoudhary16](https://github.com/vikaschoudhary16)) -- Fixed detection of non-root image user ID.([#78261](https://github.com/kubernetes/kubernetes/pull/78261), [@tallclair](https://github.com/tallclair)) -- Signal handling is now initialized within hyperkube commands that require it, such as apiserver and kubelet. ([#76659](https://github.com/kubernetes/kubernetes/pull/76659), [@S-Chan](https://github.com/S-Chan)) -- The Kubelet now properly requests protobuf objects where they are supported from the apiserver, reducing load in large clusters. ([#75602](https://github.com/kubernetes/kubernetes/pull/75602), [@smarterclayton](https://github.com/smarterclayton)) - -### OpenStack - -- You can now define a kubeconfig file for the OpenStack cloud provider. ([#77415](https://github.com/kubernetes/kubernetes/pull/77415), [@Fedosin](https://github.com/Fedosin)) -- OpenStack user credentials can now be read from a secret instead of a local config file. ([#75062](https://github.com/kubernetes/kubernetes/pull/75062), [@Fedosin](https://github.com/Fedosin)) - -### Release - -- Removed hyperkube short aliases from source code because hyperkube docker image currently create these aliases. ([#76953](https://github.com/kubernetes/kubernetes/pull/76953), [@Rand01ph](https://github.com/Rand01ph)) - -### Scheduling - -- Tolerations with the same key and effect will be merged into one that has the value of the latest toleration for best effort pods. ([#75985](https://github.com/kubernetes/kubernetes/pull/75985), [@ravisantoshgudimetla](https://github.com/ravisantoshgudimetla)) -- Achieved 2X performance improvement on both required and preferred PodAffinity. ([#76243](https://github.com/kubernetes/kubernetes/pull/76243), [@Huang-Wei](https://github.com/Huang-Wei)) -- Fixed a scheduler racing issue to ensure low priority pods are unschedulable on the node(s) where high priority pods have `NominatedNodeName` set to the node(s). ([#77990](https://github.com/kubernetes/kubernetes/pull/77990), [@Huang-Wei](https://github.com/Huang-Wei)) - -### Storage - -- Fixed issue with kubelet waiting on invalid devicepath on AWS ([#78595](https://github.com/kubernetes/kubernetes/pull/78595), [@gnufied](https://github.com/gnufied)) -- StorageOS volumes now show correct mount information (node and mount time) in the StorageOS administration CLI and UI. ([#78522](https://github.com/kubernetes/kubernetes/pull/78522), [@croomes](https://github.com/croomes)) -- Fixed issue in Portworx volume driver causing controller manager to crash. ([#76341](https://github.com/kubernetes/kubernetes/pull/76341), [@harsh-px](https://github.com/harsh-px)) -- For an empty regular file, `stat --printf %F` will now display `regular empty file` instead of `regular file`. ([#62159](https://github.com/kubernetes/kubernetes/pull/62159), [@dixudx](https://github.com/dixudx)) -- You can now have different operation names for different storage operations. This still prevents two operations on same volume from happening concurrently but if the operation changes, it resets the exponential backoff. -([#75213](https://github.com/kubernetes/kubernetes/pull/75213), [@gnufied](https://github.com/gnufied)) -- Reduced event spam for `AttachVolume` storage operation. ([#75986](https://github.com/kubernetes/kubernetes/pull/75986), [@mucahitkurt](https://github.com/mucahitkurt)) -- Until this release, the iscsi plugin was waiting 10 seconds for a path to appear in the device list. However this timeout is not enough, or is less than the default device discovery timeout in most systems, which prevents certain devices from being discovered. This timeout has been raised to 30 seconds, which should help to avoid mount issues due to device discovery. ([#78475](https://github.com/kubernetes/kubernetes/pull/78475), [@humblec](https://github.com/humblec)) -- Added a field to store CSI volume expansion secrets ([#77516](https://github.com/kubernetes/kubernetes/pull/77516), [@gnufied](https://github.com/gnufied)) -- Fixed a bug in block volume expansion. ([#77317](https://github.com/kubernetes/kubernetes/pull/77317), [@gnufied](https://github.com/gnufied)) -- Count PVCs that are unbound towards attach limit. ([#73863](https://github.com/kubernetes/kubernetes/pull/73863), [@gnufied](https://github.com/gnufied)) - -### VMware - -- SAML token delegation (required for Zones support in vSphere) is now supported ([#78876](https://github.com/kubernetes/kubernetes/pull/78876), [@dougm](https://github.com/dougm)) -- vSphere SAML token auth is now supported when using Zones ([#75515](https://github.com/kubernetes/kubernetes/pull/75515), [@dougm](https://github.com/dougm)) - -### Windows - -- Kubectl port-forward for Windows containers was added in v1.15. To use it, you’ll need to build a new pause image including WinCAT. ([#75479](https://github.com/kubernetes/kubernetes/pull/75479), [@benmoss](https://github.com/benmoss)) -- We’re working to simplify the Windows node join experience with better scripts and kubeadm. Scripts and doc updates are still in the works, but some of the needed improvements are included in 1.15. These include: - - Windows kube-proxy will wait for HNS network creation on start ([#78612](https://github.com/kubernetes/kubernetes/pull/78612), [@ksubrmnn](https://github.com/ksubrmnn)) - - kubeadm: implemented CRI detection for Windows worker nodes ([#78053](https://github.com/kubernetes/kubernetes/pull/78053), [@ksubrmnn](https://github.com/ksubrmnn)) -- Worked toward support for Windows Server version 1903, including adding Windows support for preserving the destination IP as the VIP when loadbalancing with DSR. ([#74825](https://github.com/kubernetes/kubernetes/pull/74825), [@ksubrmnn](https://github.com/ksubrmnn)) -- Bug fix: Windows Kubelet nodes will now correctly search the default location for Docker credentials (`%USERPROFILE%\.docker\config.json`) when pulling images from a private registry. (https://kubernetes.io/docs/concepts/containers/images/#configuring-nodes-to-authenticate-to-a-private-registry) ([#78528](https://github.com/kubernetes/kubernetes/pull/78528), [@bclau](https://github.com/bclau)) - - -## Dependencies - -### Changed - -- The default Go version was updated to 1.12.5. ([#78528](https://github.com/kubernetes/kubernetes/pull/78528)) -- cri-tools has been updated to v1.14.0. ([#75658](https://github.com/kubernetes/kubernetes/pull/75658)) -- Cluster Autoscaler has been updated to v1.15.0. ([#78866](https://github.com/kubernetes/kubernetes/pull/78866)) -- Kibana has been upgraded to v6.6.1. ([#71251](https://github.com/kubernetes/kubernetes/pull/71251)) -- CAdvisor has been updated to v0.33.2. ([#76291](https://github.com/kubernetes/kubernetes/pull/76291)) -- Fluentd-gcp-scaler has been upgraded to v0.5.2. ([#76762](https://github.com/kubernetes/kubernetes/pull/76762)) -- Fluentd in fluentd-elasticsearch has been upgraded to v1.4.2. ([#76854](https://github.com/kubernetes/kubernetes/pull/76854)) -- fluentd-elasticsearch has been updated to v2.5.2. ([#76854](https://github.com/kubernetes/kubernetes/pull/76854)) -- event-exporter has been updated to v0.2.5. ([#77815](https://github.com/kubernetes/kubernetes/pull/77815)) -- es-image has been updated to Elasticsearch 6.7.2. ([#77765](https://github.com/kubernetes/kubernetes/pull/77765)) -- metrics-server has been updated to v0.3.3. ([#77950](https://github.com/kubernetes/kubernetes/pull/77950)) -- ip-masq-agent has been updated to v2.4.1. ([#77844](https://github.com/kubernetes/kubernetes/pull/77844)) -- addon-manager has been updated to v9.0.1 ([#77282](https://github.com/kubernetes/kubernetes/pull/77282)) -- go-autorest has been updated to v11.1.2 ([#77070](https://github.com/kubernetes/kubernetes/pull/77070)) -- klog has been updated to 0.3.0 ([#76474](https://github.com/kubernetes/kubernetes/pull/76474)) -- k8s-dns-node-cache image has been updated to v1.15.1 ([#76640](https://github.com/kubernetes/kubernetes/pull/76640), [@george-angel](https://github.com/george-angel)) - -### Unchanged - -- Default etcd server version remains unchanged at v3.3.10. The etcd client version was updated to v3.3.10. ([#71615](https://github.com/kubernetes/kubernetes/pull/71615), [#70168](https://github.com/kubernetes/kubernetes/pull/70168), [#76917](https://github.com/kubernetes/kubernetes/pull/76917)) -- The list of validated docker versions remains unchanged. - - The current list is 1.13.1, 17.03, 17.06, 17.09, 18.06, 18.09. ([#72823](https://github.com/kubernetes/kubernetes/pull/72823), [#72831](https://github.com/kubernetes/kubernetes/pull/72831)) -- CNI remains unchanged at v0.7.5. ([#75455](https://github.com/kubernetes/kubernetes/pull/75455)) -- CSI remains unchanged at to v1.1.0. ([#75391](https://github.com/kubernetes/kubernetes/pull/75391)) -- The dashboard add-on remains unchanged at v1.10.1. ([#72495](https://github.com/kubernetes/kubernetes/pull/72495)) -- kube-dns is unchanged at v1.14.13 as of Kubernetes 1.12. ([#68900](https://github.com/kubernetes/kubernetes/pull/68900)) -- Influxdb is unchanged at v1.3.3 as of Kubernetes 1.10. ([#53319](https://github.com/kubernetes/kubernetes/pull/53319)) -- Grafana is unchanged at v4.4.3 as of Kubernetes 1.10. ([#53319](https://github.com/kubernetes/kubernetes/pull/53319)) -- The fluent-plugin-kubernetes_metadata_filter plugin in fluentd-elasticsearch is unchanged at v2.1.6. ([#71180](https://github.com/kubernetes/kubernetes/pull/71180)) -- fluentd-gcp is unchanged at v3.2.0 as of Kubernetes 1.13. ([#70954](https://github.com/kubernetes/kubernetes/pull/70954)) -- OIDC authentication is unchanged at coreos/go-oidc v2 as of Kubernetes 1.10. ([#58544](https://github.com/kubernetes/kubernetes/pull/58544)) -- Calico is unchanged at v3.3.1 as of Kubernetes 1.13. ([#70932](https://github.com/kubernetes/kubernetes/pull/70932)) -- crictl on GCE was updated to v1.14.0. ([#75658](https://github.com/kubernetes/kubernetes/pull/75658)) -- CoreDNS is unchanged at v1.3.1 as of Kubernetes 1.14. ([#78691](https://github.com/kubernetes/kubernetes/pull/78691)) -- GLBC remains unchanged at v1.2.3 as of Kubernetes 1.12. ([#66793](https://github.com/kubernetes/kubernetes/pull/66793)) -- Ingress-gce remains unchanged at v1.2.3 as of Kubernetes 1.12. ([#66793](https://github.com/kubernetes/kubernetes/pull/66793)) -- [v1.15.0-rc.1](#v1150-rc1) -- [v1.15.0-beta.2](#v1150-beta2) -- [v1.15.0-beta.1](#v1150-beta1) -- [v1.15.0-alpha.3](#v1150-alpha3) -- [v1.15.0-alpha.2](#v1150-alpha2) -- [v1.15.0-alpha.1](#v1150-alpha1) - - - -# v1.15.0-rc.1 - -[Documentation](https://docs.k8s.io) - -## Downloads for v1.15.0-rc.1 - - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes.tar.gz) | `45733de20d0e46a0937577912d945434fa12604bd507f7a6df9a28b9c60b7699f2f13f2a6b99b6cc2a8cf012391346c961deae76f5902274ea09ba17e1796c4d` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-src.tar.gz) | `63394dee48a5c69cecd26c2a8e54e6ed5c422a239b78a267c47b640f7c6774a68109179ebedd6bdb99bd9526b718831f754f75efed986dd01f8dea20988c498d` - -### Client Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-client-darwin-386.tar.gz) | `6af05492d75b4e2b510381dd7947afd104bf412cfcfff86ccf5ec1f1071928c6b100ea5baa4ce75641b50ca7f77e5130fb336674879faf69ee1bb036bbe5b2e9` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-client-darwin-amd64.tar.gz) | `72e4ac298a6fc0b64673243fd0e02fe8d51d534dca6361690f204d43ae87caaf09293ff2074c25422e69312debb16c7f0bc2b285578bd585468fe09d77c829c8` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-client-linux-386.tar.gz) | `06f96a3b48a92ec45125fbcff64ed13466be9c0aa418dfe64e158b7a122de4e50cf75fbee76830cfb6a9d46612f579c76edb84ab7d242b44ed9bee4b0286defb` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-client-linux-amd64.tar.gz) | `ba97ccad5c572e264bccf97c69d93d49f4da02512a7e3fbfa01d5569e15cca0f23bf4dd2fb3f3e89c1f6b3aa92654a51dc3e09334ef66cc2354c91cc1904ddd9` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-client-linux-arm.tar.gz) | `6155c5775ebe937dabcfeb53983358e269fb43396b15a170214be0b3f682f78b682845ca1d1abbf94139752f812d887914dfff85dcb41626886d85460b8ba1a3` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-client-linux-arm64.tar.gz) | `ff6ef9f14be3c01f700546d949cfb2da91400f93bc4c8d0dc82cea442bf20593403956ffbe7934daad42d706949167b28b5bcc89e08488bbc5fa0fdd7369b753` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-client-linux-ppc64le.tar.gz) | `09dbec3378130acd52aee71ba0ac7ad3942ac1b05f17886868bb499c32abd89ff277d2ac28da71962ba741a5ea2cae07b3dd5ace1fc8c4fa9ffc7f7e79dd62e4` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-client-linux-s390x.tar.gz) | `8f1c211ef5764c57965d3ca197c93f8dcd768f7eb0ee9d5524f0867a8650ef8da9c21dced739697e879ba131e71311cc7df323ee7664fb35b9ea7f0149a686e3` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-client-windows-386.tar.gz) | `4bea6bd88eb41c7c1f0d495da6d0c7f39b55f2ccbbc0939ccd97a470aeff637bf2b2a42f94553df5073cb762787622f2467fca8c17fcc7d92619cbc26f4c3c95` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-client-windows-amd64.tar.gz) | `235e83e4bcf9535fb41a5d18dae145545ca4a7703ec6f7d6b3d0c3887c6981bb8fd12c367db2ba0cae0297724c16330978d569b2bad131aea7e1efcebef6b6a4` - -### Server Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-server-linux-amd64.tar.gz) | `7de5aa86903ae91e97ce3017d815ab944b2ce36b2a64b0d8222e49887013596d953c5e68fa30a3f6e8bc5973c4c247de490e6b3dd38ecdea17aa0d2dc7846841` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-server-linux-arm.tar.gz) | `05d42c2a72c7ec54adc4e61bccae842fbab3e6f4f06ac3123eb6449fe7828698eeff2f2a1bfb883f443bae1b8a97ec0703f1e6243e1a1a74d57bf383fcc007e2` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-server-linux-arm64.tar.gz) | `143152305c6b9a99d95da4e6ed479ab33b1c4a58f5386496f9b680bf7d601d87f5a0c4f9dce6aceb4d231bb7054ff5018666851192bd1db86b84bef9dedb1e01` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-server-linux-ppc64le.tar.gz) | `7cf9084939319cf9ab67989151dd3384ffb4eb2c2575c8654c3afac65cabe27f499349c4f48633dc15e0cdadb2bf540ef054b57eb8fbd375b63e4592cf57c5e9` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-server-linux-s390x.tar.gz) | `aaca5140e6bfeb67259d47e28da75da9a8f335ed4b61580d9f13061c4010a7739631cbb2aabbe3a9ec47023837ac2f06f7e005789f411d61c8248991a23c0982` - -### Node Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-node-linux-amd64.tar.gz) | `ec53dc1eb78be6e80470c5606b515e6859a245136e6b19a6bbb1f18dbc0aa192858dcf77e913138ef09426fc064dd2be8f4252a9914a0a1b358d683888a316ff` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-node-linux-arm.tar.gz) | `369e6a6f1f989af3863bc645019448964f0f1f28ace15680a888bc6e8b9192374ad823602709cb22969574876a700a3ef4c1889a8443b1526d3ccb6c6257da25` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-node-linux-arm64.tar.gz) | `c3ffd6c293feec6739881bf932c4fb5d49c01698b16bf950d63185883fcadacc2b7875e9c390423927a3a07d52971923f6f0c4c084fd073585874804e9984ead` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-node-linux-ppc64le.tar.gz) | `edeafe6bf1deeee4dd0174bdd3a09ece5a9a895667fcf60691a8b81ba5f99ec905cf231f9ea08ed25d58ddf692e9d1152484a085f0cfa1226ebf4476e12ccd9e` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-node-linux-s390x.tar.gz) | `3d10142101327ee9a6d754488c3e9e4fd0b5f3a43f3ef4a19c5d9da993fbab6306443c8877160de76dfecf32076606861ea4eb44e66e666036196d5f3e0e44ad` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0-rc.1/kubernetes-node-windows-amd64.tar.gz) | `514d09f3936af68746fc11e3b83f82c744ddab1c8160b59cb1b42ea8417dc0987d71040f37f6591d4df92da24e438d301932d7ccd93918692672b6176dc4f77b` - -## Changelog since v1.15.0-beta.2 - -### Other notable changes - -* Resolves spurious rollouts of workload controllers when upgrading the API server, due to incorrect defaulting of an alpha procMount field in pods ([#78885](https://github.com/kubernetes/kubernetes/pull/78885), [@liggitt](https://github.com/liggitt)) -* vSphere: allow SAML token delegation (required for Zones support) ([#78876](https://github.com/kubernetes/kubernetes/pull/78876), [@dougm](https://github.com/dougm)) -* Update Cluster Autoscaler to 1.15.0; changelog: https://github.com/kubernetes/autoscaler/releases/tag/cluster-autoscaler-1.15.0 ([#78866](https://github.com/kubernetes/kubernetes/pull/78866), [@losipiuk](https://github.com/losipiuk)) -* Revert the CoreDNS version to 1.3.1 ([#78691](https://github.com/kubernetes/kubernetes/pull/78691), [@rajansandeep](https://github.com/rajansandeep)) -* CRDs get support for x-kuberntes-int-or-string to allow faithful representation of IntOrString types in CustomResources. ([#78815](https://github.com/kubernetes/kubernetes/pull/78815), [@sttts](https://github.com/sttts)) -* fix: retry detach azure disk issue ([#78700](https://github.com/kubernetes/kubernetes/pull/78700), [@andyzhangx](https://github.com/andyzhangx)) - * try to only update vm if detach a non-existing disk when got <200, error> after detach disk operation -* Fix issue with kubelet waiting on invalid devicepath on AWS ([#78595](https://github.com/kubernetes/kubernetes/pull/78595), [@gnufied](https://github.com/gnufied)) -* Fixed a spurious error where update requests to the status subresource of multi-version custom resources would complain about an incorrect API version. ([#78713](https://github.com/kubernetes/kubernetes/pull/78713), [@liggitt](https://github.com/liggitt)) -* Fix admission metrics histogram bucket sizes to cover 25ms to ~2.5 seconds. ([#78608](https://github.com/kubernetes/kubernetes/pull/78608), [@jpbetz](https://github.com/jpbetz)) -* Revert Promotion of resource quota scope selector to GA ([#78696](https://github.com/kubernetes/kubernetes/pull/78696), [@ravisantoshgudimetla](https://github.com/ravisantoshgudimetla)) - - - -# v1.15.0-beta.2 - -[Documentation](https://docs.k8s.io) - -## Downloads for v1.15.0-beta.2 - - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes.tar.gz) | `e6c98ae93c710bb655e9b55d5ae60c56001fefb0fce74c624c18a032b94798cdfdc88ecbb1065dc36144147a9e9a77b69fba48a26097d132e708ddedde2f90b5` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-src.tar.gz) | `c9666ddb858631721f15e988bb5c30e222f0db1c38a6d67721b9ddcfac870d5f2dd8fc399736c55117ba94502ffe7ab0bb5a9e390e18a05196b463184c42da56` - -### Client Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-client-darwin-386.tar.gz) | `084e37b2d5d06aab37b34aba012eb6c2bb4d33bef433bef0340e306def8fddcbffb487cd150379283d11c3fa35387596780a12e306c39359f9a59106de20e8eb` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-client-darwin-amd64.tar.gz) | `7319108bb6e7b28575d64dadc3f397de30eb6f4f3ae1bef2001a2e84f98cb64577ff1794c41e2a700600045272b4648cd201e434f27f0ec1fb23638b86a7cac1` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-client-linux-386.tar.gz) | `5c4c8993c3a57f08cf08232ce5f3ecd5a2acffe9f5bc779fd00a4042a2d2099cc5fcf07c40d3524439e2fd79ebaa52c64fa06866ff3146e27b4aafd8233a6c72` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-client-linux-amd64.tar.gz) | `607cd737c944d186c096d38bc256656b6226534c36ffcaab981df0a755e62fe7967649ff6d2e198348d1640302e799ab4de788bbeb297c1577e0b20f603f93c1` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-client-linux-arm.tar.gz) | `9a0aac4210c453311d432fab0925cb9b275efa2d01335443795c35e4d7dde22cbf3a2cee5f74e50c90d80b8f252ad818c4199f6019b87b57c18fa4ea50ff0408` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-client-linux-arm64.tar.gz) | `6f416001e9fb42e1720302a6a46cee94952a2a825281ac7c5d6cce549f81b36b78585228ecee0fe2de56afbf44605c36a0abf100d59f25c40352c8c2e44d1168` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-client-linux-ppc64le.tar.gz) | `4c0e4451b6bfd08cdb851ef8e68d5206cbd55c60a65bb95e2951ab22f2f2d4a15c653ad8638a64e96b5975102db0aa338c16cea470c5f57bdf43e56db9848351` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-client-linux-s390x.tar.gz) | `d5c47fe6e79e73b426881e9ee00291952d70c65bfbdb69216e84b86ddaf2ffe5dc9447ea94d07a91a479ed85850125103d4bd0aa2ecd98c503b57d9c2018a68d` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-client-windows-386.tar.gz) | `d906d737a90ca0287156e42569479c9918f89f9a02e6fb800ea250a8c2a7a4792372401ecb25a342eebc2a8270ec2ebb714764af99afae83e6fe4b6a71d23f5b` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-client-windows-amd64.tar.gz) | `7b0c9f14600bdfb77dc2935ba0c3407f7d5720a3a0b7ca9a18fe3fabb87a2279216cc56fa136116b28b4b3ade7f3d2cf6f3c8e31cf1809c0fe575c3b0635bca6` - -### Server Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-server-linux-amd64.tar.gz) | `636ebe9044f0033e3eff310e781d395f31a871a53e322932f331d2496975148a415053d5f67ba4ecd562bf3c9f6e066518e6dc805e756f552a23ad370f1fb992` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-server-linux-arm.tar.gz) | `ff656458f1d19345538a4145b97821403f418a06503ef94f6c0d0662f671b54b37aedbce064dc14f2d293bb997b3c1dc77decdaf979d333bc8ba5beae01592e6` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-server-linux-arm64.tar.gz) | `a95199a2b2f81c38c6c14791668598986595bedd41c9e9b2e94add0e93c5d0132f975e7a9042ae7abd4aeefd70d6a63f06030f632ecabffa358f73a575c7733f` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-server-linux-ppc64le.tar.gz) | `856d949df9494576e2dbd3b99d8097e97e8c4d2d195404f8307285303ff94ab7de282b55cd01d00bdafce20fa060585c97a065828269e6386abca245e15b2730` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-server-linux-s390x.tar.gz) | `7215091725f742977120f2ee4f4bc504dcff75d7258b7e90fcb4e41a2527d6cfd914d621258bd9735c08c86f53100300878eb0bbc89e13990145b77fe55dcbe1` - -### Node Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-node-linux-amd64.tar.gz) | `47b8c18afaa5f81b82a42309e95cf6b3f849db18bc2e8aeaaaa54ee219b5c412ba5c92276d3efe9c8fa4d10b7da1667fd7c8bede8f7a4bef9fe429ccadf910c3` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-node-linux-arm.tar.gz) | `64d5ad334f9448c3444cd90b0a6a7f07d83f4fb307e850686eb14b13f8926f832ef994c93341488dbc67750af9d5b922e0f6b9cc98316813fd1960c38c0a9f77` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-node-linux-arm64.tar.gz) | `62d1e7fb2f1f271ca349d29bc43f683e7025107d893e974131063403746bb58ce203166656985c1ff22a4eef4d6d5a3373a9f49bdf9a55ad883308aedbc33cfb` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-node-linux-ppc64le.tar.gz) | `215a2e3a40c88922427d73af3d38b6a2827c2a699a76fa7acf1a171814d36c0abec406820045ae3f33f88d087dc9ceee3b8d5e6b9c70e77fb8095d1b8aa0cf7d` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-node-linux-s390x.tar.gz) | `d75f2a2fb430e7e7368f456590698fe04930c623269ffba88dd546a45ac9dd1f08f007bef28b53d232da3636c44c8f5e8e4135d8fe32ffc1bcdd45a8db883e45` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0-beta.2/kubernetes-node-windows-amd64.tar.gz) | `c8eeb1d9ada781a97dc368d308fb040124f644225579f18bb41bff0f354d65ea9e90fa2d4a161826c93c05f689abd4f7971fa80ea533c88b5a828cfc6f5a0801` - -## Changelog since v1.15.0-beta.1 - -### Action Required - -* ACTION REQUIRED The deprecated flag --conntrack-max has been removed from kube-proxy. Users of this flag should switch to --conntrack-min and --conntrack-max-per-core instead. ([#78399](https://github.com/kubernetes/kubernetes/pull/78399), [@rikatz](https://github.com/rikatz)) -* ACTION REQUIRED: kubeadm: the mixture of "--config" and "--certificate-key" is no longer allowed. The InitConfiguration and JoinConfiguration objects now support the "certificateKey" field and this field should be used instead of the command line argument in case a configuration file is already passed. ([#78542](https://github.com/kubernetes/kubernetes/pull/78542), [@neolit123](https://github.com/neolit123)) -* Azure cloud provider could now be configured by Kubernetes secrets and a new option `cloudConfigType` is introduced, whose candicate values are `file`, `secret` and `merge` (default is `merge`). ([#78242](https://github.com/kubernetes/kubernetes/pull/78242), [@feiskyer](https://github.com/feiskyer)) - * action required: - * Since Azure cloud provider would read Kubernetes secrets, the following RBAC should be configured: - * --- - * apiVersion: rbac.authorization.k8s.io/v1beta1 - * kind: ClusterRole - * metadata: - * labels: - * kubernetes.io/cluster-service: "true" - * name: system:azure-cloud-provider-secret-getter - * rules: - * - apiGroups: [""] - * resources: ["secrets"] - * verbs: - * - get - * --- - * apiVersion: rbac.authorization.k8s.io/v1beta1 - * kind: ClusterRoleBinding - * metadata: - * labels: - * kubernetes.io/cluster-service: "true" - * name: system:azure-cloud-provider-secret-getter - * roleRef: - * apiGroup: rbac.authorization.k8s.io - * kind: ClusterRole - * name: system:azure-cloud-provider-secret-getter - * subjects: - * - kind: ServiceAccount - * name: azure-cloud-provider - * namespace: kube-system - -### Other notable changes - -* kube-up.sh scripts now disable the KubeletPodResources feature for Windows nodes, due to issue [#78628](https://github.com/kubernetes/kubernetes/pull/78628). ([#78668](https://github.com/kubernetes/kubernetes/pull/78668), [@mtaufen](https://github.com/mtaufen)) -* StorageOS volumes now show correct mount information (node and mount time) in the StorageOS administration CLI and UI. ([#78522](https://github.com/kubernetes/kubernetes/pull/78522), [@croomes](https://github.com/croomes)) -* Horizontal Pod Autoscaling can now scale targets up even when one or more metrics are invalid/unavailable as long as one metric indicates a scale up should occur. ([#78503](https://github.com/kubernetes/kubernetes/pull/78503), [@gjtempleton](https://github.com/gjtempleton)) -* kubeadm: revert the CoreDNS version to 1.3.1 ([#78545](https://github.com/kubernetes/kubernetes/pull/78545), [@neolit123](https://github.com/neolit123)) -* Move online volume expansion to beta ([#77755](https://github.com/kubernetes/kubernetes/pull/77755), [@gnufied](https://github.com/gnufied)) -* Fixes a memory leak in Kubelet on Windows caused by not not closing containers when fetching container metrics ([#78594](https://github.com/kubernetes/kubernetes/pull/78594), [@benmoss](https://github.com/benmoss)) -* Windows kube-proxy will wait for HNS network creation on start ([#78612](https://github.com/kubernetes/kubernetes/pull/78612), [@ksubrmnn](https://github.com/ksubrmnn)) -* Fix error handling for loading initCfg in kubeadm upgrade and apply ([#78611](https://github.com/kubernetes/kubernetes/pull/78611), [@odinuge](https://github.com/odinuge)) -* Route controller now respects rate limiting to the cloud provider on deletion, previously it was only for create. ([#78581](https://github.com/kubernetes/kubernetes/pull/78581), [@andrewsykim](https://github.com/andrewsykim)) -* Windows Kubelet nodes will now correctly search the default location for Docker credentials (`%USERPROFILE%\.docker* Windows nodes on GCE now have the Windows firewall enabled by default. ([#78507](https://github.com/kubernetes/kubernetes/pull/78507), [@pjh](https://github.com/pjh)) -* Added objectSelector to admission webhook configurations. objectSelector is evaluated the oldObject and newObject that would be sent to the webhook, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. ([#78505](https://github.com/kubernetes/kubernetes/pull/78505), [@caesarxuchao](https://github.com/caesarxuchao)) -* Deprecate kubelet cAdvisor json endpoints ([#78504](https://github.com/kubernetes/kubernetes/pull/78504), [@dashpole](https://github.com/dashpole)) -* Supports configure accessLogs for AWS NLB ([#78497](https://github.com/kubernetes/kubernetes/pull/78497), [@M00nF1sh](https://github.com/M00nF1sh)) -* Till this release, iscsi plugin was waiting 10 seconds for a path to appear in the device list. However this timeout is not enough or less than default device discovery timeout in most of the systems which cause certain device to be not accounted for the volume. This timeout has been lifted to 30seconds from this release and it should help to avoid mount issues due to device discovery. ([#78475](https://github.com/kubernetes/kubernetes/pull/78475), [@humblec](https://github.com/humblec)) -* Remove deprecated --pod/-p flag from kubectl exec. The flag has been marked as deprecated since k8s version v1.12 ([#76713](https://github.com/kubernetes/kubernetes/pull/76713), [@prksu](https://github.com/prksu)) -* CustomResourceDefinition with invalid regular expression in the pattern field of OpenAPI v3 validation schemas are not considere structural. ([#78453](https://github.com/kubernetes/kubernetes/pull/78453), [@sttts](https://github.com/sttts)) -* Fixed panic in kube-proxy when parsing iptables-save output ([#78428](https://github.com/kubernetes/kubernetes/pull/78428), [@luksa](https://github.com/luksa)) -* Remove deprecated flag --cleanup-iptables from kube-proxy ([#78344](https://github.com/kubernetes/kubernetes/pull/78344), [@aramase](https://github.com/aramase)) -* The storageVersionHash feature is beta now. "StorageVersionHash" is a field in the discovery document of each resource. It allows clients to detect if the storage version of that resource has changed. Its value must be treated as opaque by clients. Only equality comparison on the value is valid. ([#78325](https://github.com/kubernetes/kubernetes/pull/78325), [@caesarxuchao](https://github.com/caesarxuchao)) -* Use zone from node for topology aware aws-ebs volume creation to reduce unnecessary cloud provider calls ([#78276](https://github.com/kubernetes/kubernetes/pull/78276), [@zhan849](https://github.com/zhan849)) -* Finalizer Protection for Service LoadBalancers is now added as Alpha (disabled by default). This feature ensures the Service resource is not fully deleted until the correlating load balancer resources are deleted. ([#78262](https://github.com/kubernetes/kubernetes/pull/78262), [@MrHohn](https://github.com/MrHohn)) -* Introducing new semantic for metric "volume_operation_total_seconds" to be the end to end latency of volume provisioning/deletion. Existing metric "storage_operation_duration_seconds" will remain untouched however exposed to the following potential issues: ([#78061](https://github.com/kubernetes/kubernetes/pull/78061), [@yuxiangqian](https://github.com/yuxiangqian)) - * 1. for volume's provisioned/deleted via external provisioner/deleter, "storage_operation_duration_seconds" will NOT wait for the external operation to be done before reporting latency metric (effectively close to 0). This will be fixed by using "volume_operation_total_seconds" instead - * 2. if there's a transient error happened during "provisioning/deletion", i.e., a volume is still in-use while a deleteVolume has been called, original "storage_operation_duration_seconds" will NOT wait until a volume has been finally deleted before reporting a not accurate latency metric. The newly implemented metric "volume_operation_total_seconds", however, wait util a provisioning/deletion operation has been fully executed. - * Potential impacts: - * If an SLO/alert has been defined based on "volume_operation_total_seconds", it might get violated because of the more accurate metric might be significantly larger than previously reported. The metric is defined to be a histogram and the new semantic could change the distribution. -* metrics added to kubelet endpoint 'metrics/probes': ([#77975](https://github.com/kubernetes/kubernetes/pull/77975), [@logicalhan](https://github.com/logicalhan)) - * process_start_time_seconds -* NodeLocal DNSCache graduating to beta. ([#77887](https://github.com/kubernetes/kubernetes/pull/77887), [@prameshj](https://github.com/prameshj)) -* Kubelet will attempt to use wincat.exe in the pause container for port forwarding when running on Windows ([#75479](https://github.com/kubernetes/kubernetes/pull/75479), [@benmoss](https://github.com/benmoss)) -* iptables proxier: route local traffic to LB IPs to service chain ([#77523](https://github.com/kubernetes/kubernetes/pull/77523), [@andrewsykim](https://github.com/andrewsykim)) -* When the number of jobs exceeds 500, cronjob should schedule without error. ([#77475](https://github.com/kubernetes/kubernetes/pull/77475), [@liucimin](https://github.com/liucimin)) -* Enable 3rd party device monitoring by default ([#77274](https://github.com/kubernetes/kubernetes/pull/77274), [@RenaudWasTaken](https://github.com/RenaudWasTaken)) -* This change enables a user to specify a DataSource/Kind of type "PersistentVolumeClaim" in their PVC spec. This can then be detected by the external csi-provisioner and plugins if capable. ([#76913](https://github.com/kubernetes/kubernetes/pull/76913), [@j-griffith](https://github.com/j-griffith)) -* proxy/transport: Support Content-Encoding: deflate ([#76551](https://github.com/kubernetes/kubernetes/pull/76551), [@JieJhih](https://github.com/JieJhih)) -* Add --sort-by option to kubectl top command ([#75920](https://github.com/kubernetes/kubernetes/pull/75920), [@artmello](https://github.com/artmello)) -* Introduce Topolgy into the runtimeClass API ([#75744](https://github.com/kubernetes/kubernetes/pull/75744), [@yastij](https://github.com/yastij)) -* Kubelet plugin registration now has retry and exponential backoff logic for when registration of plugins (like CSI or device plugin) fail. ([#73891](https://github.com/kubernetes/kubernetes/pull/73891), [@taragu](https://github.com/taragu)) -* Windows support for preserving the destination IP as the VIP when loadbalancing with DSR. ([#74825](https://github.com/kubernetes/kubernetes/pull/74825), [@ksubrmnn](https://github.com/ksubrmnn)) -* Add NonPrempting field to the PriorityClass. ([#74614](https://github.com/kubernetes/kubernetes/pull/74614), [@denkensk](https://github.com/denkensk)) -* The kubelet only collects metrics for the node, container runtime, kubelet, pods, and containers. ([#72787](https://github.com/kubernetes/kubernetes/pull/72787), [@dashpole](https://github.com/dashpole)) -* Improved README for k8s.io/sample-apiserver ([#73447](https://github.com/kubernetes/kubernetes/pull/73447), [@MikeSpreitzer](https://github.com/MikeSpreitzer)) -* kubeadm: flag “--experimental-control-plane” is now deprecated. use “--control-plane” instead ([#78452](https://github.com/kubernetes/kubernetes/pull/78452), [@fabriziopandini](https://github.com/fabriziopandini)) - * kubeadm: flag “--experimental-upload-certs” is now deprecated. use “--upload-certs” instead -* Promote resource quota scope selector to GA ([#78448](https://github.com/kubernetes/kubernetes/pull/78448), [@ravisantoshgudimetla](https://github.com/ravisantoshgudimetla)) -* `kubectl scale job`, deprecated since 1.10, has been removed ([#78445](https://github.com/kubernetes/kubernetes/pull/78445), [@soltysh](https://github.com/soltysh)) -* CustomResourcesDefinition conversion via webhooks is promoted to beta. It requires that spec.preserveUnknownFields is set to false. ([#78426](https://github.com/kubernetes/kubernetes/pull/78426), [@sttts](https://github.com/sttts)) -* kubeadm: a new command `kubeadm upgrade node` is introduced for upgrading nodes (both secondary control-plane nodes and worker nodes) ([#78408](https://github.com/kubernetes/kubernetes/pull/78408), [@fabriziopandini](https://github.com/fabriziopandini)) - * The command `kubeadm upgrade node config` is now deprecated; use `kubeadm upgrade node` instead. - * The command `kubeadm upgrade node experimental-control-plane` is now deprecated; use `kubeadm upgrade node` instead. -* Increase log level to 2 for IPVS graceful termination ([#78395](https://github.com/kubernetes/kubernetes/pull/78395), [@andrewsykim](https://github.com/andrewsykim)) -* Add support for Azure File plugin to csi-translation-lib ([#78356](https://github.com/kubernetes/kubernetes/pull/78356), [@andyzhangx](https://github.com/andyzhangx)) -* refactor AWS NLB securityGroup handling ([#74692](https://github.com/kubernetes/kubernetes/pull/74692), [@M00nF1sh](https://github.com/M00nF1sh)) -* Handle resize operation for volume plugins migrated to CSI ([#77994](https://github.com/kubernetes/kubernetes/pull/77994), [@gnufied](https://github.com/gnufied)) -* Inline CSI ephemeral volumes can now be controlled with PodSecurityPolicy when the CSIInlineVolume alpha feature is enabled ([#76915](https://github.com/kubernetes/kubernetes/pull/76915), [@vladimirvivien](https://github.com/vladimirvivien)) -* Add support for Azure Disk plugin to csi-translation-lib ([#78330](https://github.com/kubernetes/kubernetes/pull/78330), [@andyzhangx](https://github.com/andyzhangx)) -* Ensures that the node-role.kubernetes.io/master taint is applied to the master with NoSchedule on GCE. ([#78183](https://github.com/kubernetes/kubernetes/pull/78183), [@cheftako](https://github.com/cheftako)) -* Add Post-bind extension point to the scheduling framework ([#77567](https://github.com/kubernetes/kubernetes/pull/77567), [@wgliang](https://github.com/wgliang)) -* Add CRD support for default values in OpenAPI v3 validation schemas. `default` values are set for object fields which are undefined in request payload and in data read from etcd. Defaulting is alpha and disabled by default, if the feature gate CustomResourceDefaulting is not enabled. ([#77558](https://github.com/kubernetes/kubernetes/pull/77558), [@sttts](https://github.com/sttts)) -* kubeadm: v1beta2 InitConfiguration no longer embeds ClusterConfiguration it it. ([#77739](https://github.com/kubernetes/kubernetes/pull/77739), [@rosti](https://github.com/rosti)) -* kube-apiserver: the `--enable-logs-handler` flag and log-serving functionality is deprecated, and scheduled to be removed in v1.19. ([#77611](https://github.com/kubernetes/kubernetes/pull/77611), [@rohitsardesai83](https://github.com/rohitsardesai83)) -* Fix vSphere SAML token auth when using Zones ([#78137](https://github.com/kubernetes/kubernetes/pull/78137), [@dougm](https://github.com/dougm)) -* Admission webhooks can now register for a single version of a resource (for example, `apps/v1 deployments`) and be called when any other version of that resource is modified (for example `extensions/v1beta1 deployments`). This allows new versions of a resource to be handled by admission webhooks without needing to update every webhook to understand the new version. See the API documentation for the `matchPolicy: Equivalent` option in MutatingWebhookConfiguration and ValidatingWebhookConfiguration types. ([#78135](https://github.com/kubernetes/kubernetes/pull/78135), [@liggitt](https://github.com/liggitt)) -* Add `kubeadm alpha certs certificate-key` command to generate secure random key to use on `kubeadm init --experimental-upload-certs` ([#77848](https://github.com/kubernetes/kubernetes/pull/77848), [@yagonobre](https://github.com/yagonobre)) -* IPVS: Disable graceful termination for UDP traffic to solve issues with high number of UDP connections (DNS / syslog in particular) ([#77802](https://github.com/kubernetes/kubernetes/pull/77802), [@lbernail](https://github.com/lbernail)) -* In CRD webhook conversion ignore changes to metadata other than for labels and annotations. ([#77743](https://github.com/kubernetes/kubernetes/pull/77743), [@sttts](https://github.com/sttts)) -* Allow trailing dots in the externalName of Services of type ExternalName. ([#78385](https://github.com/kubernetes/kubernetes/pull/78385), [@thz](https://github.com/thz)) -* Fix a bug where kube-proxy returns error due to existing ipset rules using a different hash type. ([#77371](https://github.com/kubernetes/kubernetes/pull/77371), [@andrewsykim](https://github.com/andrewsykim)) -* kubeadm: implement CRI detection for Windows worker nodes ([#78053](https://github.com/kubernetes/kubernetes/pull/78053), [@ksubrmnn](https://github.com/ksubrmnn)) - - - -# v1.15.0-beta.1 - -[Documentation](https://docs.k8s.io) - -## Downloads for v1.15.0-beta.1 - - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes.tar.gz) | `c0dcbe90feaa665613a6a1ca99c1ab68d9174c5bcd3965ff9b8d9bad345dfa9e5eaa04a544262e3648438c852c5ce2c7ae34caecebefdb06091747a23098571c` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-src.tar.gz) | `b79bc690792e0fbc380e47d6708250211a4e742d306fb433a1b6b50d5cea79227d4e836127f33791fb29c9a228171cd48e11bead624c8401818db03c6dc8b310` - -### Client Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-client-darwin-386.tar.gz) | `b79ca71cf048515084cffd9459153e6ad4898f123fda1b6aa158e5b59033e97f3b4eb1a5563c0bfe4775d56a5dc58d651d5275710b9b250db18d60cc945ea992` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-client-darwin-amd64.tar.gz) | `699a76b03ad3d1a38bd7e1ffb7765526cc33fb40b0e7dc0a782de3e9473e0e0d8b61a876c0d4e724450c3f2a6c2e91287eefae1c34982c84b5c76a598fbbca2c` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-client-linux-386.tar.gz) | `5fa8bc2cbd6c9f6a8c9fe3fa96cad85f98e2d21132333ab7068b73d2c7cd27a7ebe1384fef22fdfdb755f635554efca850fe154f9f272e505a5f594f86ffadff` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-client-linux-amd64.tar.gz) | `3dfbd496cd8bf9348fd2532f4c0360fe58ddfaab9d751f81cfbf9d9ddb8a347e004a9af84578aaa69bb8ee1f8cfc7adc5fd1864a32261dff94dd5a59e5f94c00` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-client-linux-arm.tar.gz) | `4abcac1fa5c1ca5e9d245e87ca6f601f7013b6a7e9a9d8dae7b322e62c8332e94f0ab63db71c0c2a535eb45bf2da51055ca5311768b8e927a0766ad99f727a72` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-client-linux-arm64.tar.gz) | `22e2d6fc8eb1f64528215901c7cc8a016dda824557667199b9c9d5478f163962240426ef2a518e3981126be82a1da01cf585b1bf08d9fd2933a370beaef8d766` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-client-linux-ppc64le.tar.gz) | `8d6f283020d76382e00b9e96f1c880654196aead67f17285ad1faf7ca7d1d2c2776e30deb9b67cee516f0efa8c260026925924ea7655881f9d75e9e5a4b8a9b7` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-client-linux-s390x.tar.gz) | `3320edd26be88e9ba60b5fbb326a0e42934255bb8f1c2774eb2d309318e6dbd45d8f7162d741b7b8c056c1c0f2b943dd9939bcdde2ada80c6d9de3843e35aefe` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-client-windows-386.tar.gz) | `951d1c9b2e68615b6f26b85e27895a6dfea948b7e4c566e27b11fde8f32592f28de569bb9723136d830548f65018b9e9df8bf29823828778796568bff7f38c36` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-client-windows-amd64.tar.gz) | `2f049941d3902b2915bea5430a29254ac0936e4890c742162993ad13a6e6e3e5b6a40cd3fc4cfd406c55eba5112b55942e6c85e5f6a5aa83d0e85853ccccb130` - -### Server Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-server-linux-amd64.tar.gz) | `9049dc0680cb96245473422bb2c5c6ca8b1930d7e0256d993001f5de95f4c9980ded018d189b69d90c66a09af93152aa2823182ae0f3cbed72fb66a1e13a9d8c` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-server-linux-arm.tar.gz) | `38f08b9e78ea3cbe72b473cda1cd48352ee879ce0cd414c0decf2abce63bab6bdf8dc05639990c84c63faf215c581f580aadd1d73be4be233ff5c87b636184b9` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-server-linux-arm64.tar.gz) | `6cd0166162fc13c9d47cb441e8dd3ff21fae6d2417d3eb780b24ebcd615ac0841ec0602e746371dc62b8bddebf94989a7e075d96718c3989dc1c12adbe366cf9` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-server-linux-ppc64le.tar.gz) | `79570f97383f102be77478a4bc19d0d2c2551717c5f37e8aa159a0889590fc2ac0726d4899a0d9bc33e8c9e701290114222c468a76b755dc2604b113ab992ef3` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-server-linux-s390x.tar.gz) | `7e1371631373407c3a1b231d09610d1029d1981026f02206a11fd58471287400809523b91de578eb26ca77a7fe4a86dcc32e225c797642733188ad043600f82e` - -### Node Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-node-linux-amd64.tar.gz) | `819bc76079474791d468a2945c9d0858f066a54b54fcc8a84e3f9827707d6f52f9c2abcf9ea7a2dd3f68852f9bd483b8773b979c46c60e5506dc93baab3bb067` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-node-linux-arm.tar.gz) | `1054e793d5a38ac0616cc3e56c85053beda3f39bc3dad965d73397756e3d78ea07d1208b0fdd5f8e9e6a10f75da017100ef6b04fdb650983262eaad682d84c38` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-node-linux-arm64.tar.gz) | `8357b8ee1ff5b2705fea1f70fdb3a10cb09ed1e48ee0507032dbadfb68b44b3c11c0c796541e6e0bbf010b20040871ca91f8edb4756d6596999092ca4931a540` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-node-linux-ppc64le.tar.gz) | `cf62d7a660dd16ee56717a786c04b457478bf51f262fefa2d1500035ccf5bb7cc605f16ef331852f5023671d61b7c3ef348c148288c5c41fb4e309679fa51265` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-node-linux-s390x.tar.gz) | `60f3eb8bfe3694f5def28661c62b67a56fb5d9efad7cfeb5dc7e76f8a15be625ac123e8ee0ac543a4464a400fca3851731d41418409d385ef8ff99156b816b0c` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0-beta.1/kubernetes-node-windows-amd64.tar.gz) | `66fb625fd68a9b754e63a3e1369a21e6d2116120b5dc5aae837896f21072ce4c03d96507b66e6a239f720abcf742adef6d06d85e19bebf935d4927cccdc6817d` - -## Changelog since v1.15.0-alpha.3 - -### Action Required - -* ACTION REQUIRED: Deprecated Kubelet security controls AllowPrivileged, HostNetworkSources, HostPIDSources, HostIPCSources have been removed. Enforcement of these restrictions should be done through admission control instead (e.g. PodSecurityPolicy). ([#77820](https://github.com/kubernetes/kubernetes/pull/77820), [@dims](https://github.com/dims)) - * ACTION REQUIRED: The deprecated Kubelet flag `--allow-privileged` has been removed. Remove any use of `--allow-privileged` from your kubelet scripts or manifests. -* Fix public IPs issues when multiple clusters are sharing the same resource group. ([#77630](https://github.com/kubernetes/kubernetes/pull/77630), [@feiskyer](https://github.com/feiskyer)) - * action required: - * If the cluster is upgraded from old releases and the same resource group would be shared by multiple clusters, please recreate those LoadBalancer services or add a new tag 'kubernetes-cluster-name: ' manually for existing public IPs. - * For multiple clusters sharing the same resource group, they should be configured with different cluster name by `kube-controller-manager --cluster-name=` - -### Other notable changes - -* fix azure retry issue when return 2XX with error ([#78298](https://github.com/kubernetes/kubernetes/pull/78298), [@andyzhangx](https://github.com/andyzhangx)) -* The dockershim container runtime now accepts the `docker` runtime handler from a RuntimeClass. ([#78323](https://github.com/kubernetes/kubernetes/pull/78323), [@tallclair](https://github.com/tallclair)) -* GCE: Disable the Windows defender to work around a bug that could cause nodes to crash and reboot ([#78272](https://github.com/kubernetes/kubernetes/pull/78272), [@yujuhong](https://github.com/yujuhong)) -* The CustomResourcePublishOpenAPI feature is now beta and enabled by default. CustomResourceDefinitions with [structural schemas](https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/20190425-structural-openapi.md) now publish schemas in the OpenAPI document served at `/openapi/v2`. CustomResourceDefinitions with non-structural schemas have a `NonStructuralSchema` condition added with details about what needs to be corrected in the validation schema. ([#77825](https://github.com/kubernetes/kubernetes/pull/77825), [@roycaihw](https://github.com/roycaihw)) -* kubeadm's ignored pre-flight errors can now be configured via InitConfiguration and JoinConfiguration. ([#75499](https://github.com/kubernetes/kubernetes/pull/75499), [@marccarre](https://github.com/marccarre)) -* Fix broken detection of non-root image user ID ([#78261](https://github.com/kubernetes/kubernetes/pull/78261), [@tallclair](https://github.com/tallclair)) -* kubelet: fix fail to close kubelet->API connections on heartbeat failure when bootstrapping or client certificate rotation is disabled ([#78016](https://github.com/kubernetes/kubernetes/pull/78016), [@gaorong](https://github.com/gaorong)) -* remove vmsizelist call in azure disk GetVolumeLimits which happens in kubelet finally ([#77851](https://github.com/kubernetes/kubernetes/pull/77851), [@andyzhangx](https://github.com/andyzhangx)) -* reverts an aws-ebs volume provisioner optimization as we need to further discuss a viable optimization ([#78200](https://github.com/kubernetes/kubernetes/pull/78200), [@zhan849](https://github.com/zhan849)) -* API changes and deprecating the use of special annotations for Windows GMSA support (version beta) ([#75459](https://github.com/kubernetes/kubernetes/pull/75459), [@wk8](https://github.com/wk8)) -* apiextensions: publish (only) structural OpenAPI schemas ([#77554](https://github.com/kubernetes/kubernetes/pull/77554), [@sttts](https://github.com/sttts)) -* Set selinux label at plugin socket directory ([#73241](https://github.com/kubernetes/kubernetes/pull/73241), [@vikaschoudhary16](https://github.com/vikaschoudhary16)) -* Fix a bug that causes DaemonSet rolling update to hang when its pod gets stuck at terminating. ([#77773](https://github.com/kubernetes/kubernetes/pull/77773), [@DaiHao](https://github.com/DaiHao)) -* Kubeadm: a new command `kubeadm alpha certs check-expiration` was created in order to help users in managing expiration for local PKI certificates ([#77863](https://github.com/kubernetes/kubernetes/pull/77863), [@fabriziopandini](https://github.com/fabriziopandini)) -* kubeadm: fix a bug related to volume unmount if the kubelet run directory is a symbolic link ([#77507](https://github.com/kubernetes/kubernetes/pull/77507), [@cuericlee](https://github.com/cuericlee)) -* n/a ([#78059](https://github.com/kubernetes/kubernetes/pull/78059), [@figo](https://github.com/figo)) -* Add configuration options for the scheduling framework and its plugins. ([#77501](https://github.com/kubernetes/kubernetes/pull/77501), [@JieJhih](https://github.com/JieJhih)) -* Publish DeleteOptions parameters for deletecollection endpoints in OpenAPI spec ([#77843](https://github.com/kubernetes/kubernetes/pull/77843), [@roycaihw](https://github.com/roycaihw)) -* CoreDNS is now version 1.5.0 ([#78030](https://github.com/kubernetes/kubernetes/pull/78030), [@rajansandeep](https://github.com/rajansandeep)) - * - A `ready` plugin has been included to report pod readiness - * - The `proxy` plugin has been deprecated. The `forward` plugin is to be used instead. - * - CoreDNS fixes the logging now that kubernetes’ client lib switched to klog from glog. -* Upgrade Azure network API version to 2018-07-01, so that EnableTcpReset could be enabled on Azure standard loadbalancer (SLB). ([#78012](https://github.com/kubernetes/kubernetes/pull/78012), [@feiskyer](https://github.com/feiskyer)) -* Fixed a scheduler racing issue to ensure low priority pods to be unschedulable on the node(s) where high priority pods have `NominatedNodeName` set to the node(s). ([#77990](https://github.com/kubernetes/kubernetes/pull/77990), [@Huang-Wei](https://github.com/Huang-Wei)) -* Support starting Kubernetes on GCE using containerd in COS and Ubuntu with `KUBE_CONTAINER_RUNTIME=containerd`. ([#77889](https://github.com/kubernetes/kubernetes/pull/77889), [@Random-Liu](https://github.com/Random-Liu)) -* DelayingQueue.ShutDown() is now able to be invoked multiple times without causing a closed channel panic. ([#77170](https://github.com/kubernetes/kubernetes/pull/77170), [@smarterclayton](https://github.com/smarterclayton)) -* For admission webhooks registered for DELETE operations on k8s built APIs or CRDs, the apiserver now sends the existing object as admissionRequest.Request.OldObject to the webhook. ([#76346](https://github.com/kubernetes/kubernetes/pull/76346), [@caesarxuchao](https://github.com/caesarxuchao)) - * For custom apiservers they uses the generic registry in the apiserver library, they get this behavior automatically. -* Expose CSI volume stats via kubelet volume metrics ([#76188](https://github.com/kubernetes/kubernetes/pull/76188), [@humblec](https://github.com/humblec)) -* Active watches of custom resources now terminate properly if the CRD is modified. ([#78029](https://github.com/kubernetes/kubernetes/pull/78029), [@liggitt](https://github.com/liggitt)) -* Add CRD spec.preserveUnknownFields boolean, defaulting to true in v1beta1 and to false in v1 CRDs. If false, fields not specified in the validation schema will be removed when sent to the API server or when read from etcd. ([#77333](https://github.com/kubernetes/kubernetes/pull/77333), [@sttts](https://github.com/sttts)) -* Updates that remove remaining `metadata.finalizers` from an object that is pending deletion (non-nil metadata.deletionTimestamp) and has no graceful deletion pending (nil or 0 metadata.deletionGracePeriodSeconds) now results in immediate deletion of the object. ([#77952](https://github.com/kubernetes/kubernetes/pull/77952), [@liggitt](https://github.com/liggitt)) -* Deprecates the kubeadm config upload command as it's replacement is now graduated. Please see `kubeadm init phase upload-config` ([#77946](https://github.com/kubernetes/kubernetes/pull/77946), [@Klaven](https://github.com/Klaven)) -* k8s.io/client-go/dynamic/dynamicinformer.NewFilteredDynamicSharedInformerFactory now honours namespace argument ([#77945](https://github.com/kubernetes/kubernetes/pull/77945), [@michaelfig](https://github.com/michaelfig)) -* `kubectl rollout restart` now works for daemonsets and statefulsets. ([#77423](https://github.com/kubernetes/kubernetes/pull/77423), [@apelisse](https://github.com/apelisse)) -* Fix incorrect azuredisk lun error ([#77912](https://github.com/kubernetes/kubernetes/pull/77912), [@andyzhangx](https://github.com/andyzhangx)) -* Kubelet could be run with no Azure identity now. A sample cloud provider configure is: `{"vmType": "vmss", "useInstanceMetadata": true}` ([#77906](https://github.com/kubernetes/kubernetes/pull/77906), [@feiskyer](https://github.com/feiskyer)) -* client-go and kubectl no longer write cached discovery files with world-accessible file permissions ([#77874](https://github.com/kubernetes/kubernetes/pull/77874), [@yuchengwu](https://github.com/yuchengwu)) -* kubeadm: expose the kubeadm reset command as phases ([#77847](https://github.com/kubernetes/kubernetes/pull/77847), [@yagonobre](https://github.com/yagonobre)) -* kubeadm: kubeadm alpha certs renew --csr-only now reads the current certificates as the authoritative source for certificates attributes (same as kubeadm alpha certs renew) ([#77780](https://github.com/kubernetes/kubernetes/pull/77780), [@fabriziopandini](https://github.com/fabriziopandini)) -* Support "queue-sort" extension point for scheduling framework ([#77529](https://github.com/kubernetes/kubernetes/pull/77529), [@draveness](https://github.com/draveness)) -* Allow init container to get its own field value as environment variable values(downwardAPI spport) ([#75109](https://github.com/kubernetes/kubernetes/pull/75109), [@yuchengwu](https://github.com/yuchengwu)) -* The metric `kube_proxy_sync_proxy_rules_last_timestamp_seconds` is now available, indicating the last time that kube-proxy successfully applied proxying rules. ([#74027](https://github.com/kubernetes/kubernetes/pull/74027), [@squeed](https://github.com/squeed)) -* Fix panic logspam when running kubelet in standalone mode. ([#77888](https://github.com/kubernetes/kubernetes/pull/77888), [@tallclair](https://github.com/tallclair)) -* consume the AWS region list from the AWS SDK instead of a hard-coded list in the cloud provider ([#75990](https://github.com/kubernetes/kubernetes/pull/75990), [@mcrute](https://github.com/mcrute)) -* Add `Option` field to the admission webhook `AdmissionReview` API that provides the operation options (e.g. `DeleteOption` or `CreateOption`) for the operation being performed. ([#77563](https://github.com/kubernetes/kubernetes/pull/77563), [@jpbetz](https://github.com/jpbetz)) -* Fix bug where cloud-controller-manager initializes nodes multiple times ([#75405](https://github.com/kubernetes/kubernetes/pull/75405), [@tghartland](https://github.com/tghartland)) -* Fixed a transient error API requests for custom resources could encounter while changes to the CustomResourceDefinition were being applied. ([#77816](https://github.com/kubernetes/kubernetes/pull/77816), [@liggitt](https://github.com/liggitt)) -* Fix kubectl exec usage string ([#77589](https://github.com/kubernetes/kubernetes/pull/77589), [@soltysh](https://github.com/soltysh)) -* CRD validation schemas should not specify `metadata` fields other than `name` and `generateName`. A schema will not be considered structural (and therefore ready for future features) if `metadata` is specified in any other way. ([#77653](https://github.com/kubernetes/kubernetes/pull/77653), [@sttts](https://github.com/sttts)) -* Implement Permit extension point of the scheduling framework. ([#77559](https://github.com/kubernetes/kubernetes/pull/77559), [@ahg-g](https://github.com/ahg-g)) -* Fixed a bug in the apiserver storage that could cause just-added finalizers to be ignored on an immediately following delete request, leading to premature deletion. ([#77619](https://github.com/kubernetes/kubernetes/pull/77619), [@caesarxuchao](https://github.com/caesarxuchao)) -* add operation name for vm/vmss update operations in prometheus metrics ([#77491](https://github.com/kubernetes/kubernetes/pull/77491), [@andyzhangx](https://github.com/andyzhangx)) -* fix incorrect prometheus azure metrics ([#77722](https://github.com/kubernetes/kubernetes/pull/77722), [@andyzhangx](https://github.com/andyzhangx)) -* Clients may now request that API objects are converted to the `v1.Table` and `v1.PartialObjectMetadata` forms for generic access to objects. ([#77448](https://github.com/kubernetes/kubernetes/pull/77448), [@smarterclayton](https://github.com/smarterclayton)) -* ingress: Update in-tree Ingress controllers, examples, and clients to target networking.k8s.io/v1beta1 ([#77617](https://github.com/kubernetes/kubernetes/pull/77617), [@cmluciano](https://github.com/cmluciano)) -* util/initsystem: add support for the OpenRC init system ([#73101](https://github.com/kubernetes/kubernetes/pull/73101), [@oz123](https://github.com/oz123)) -* Signal handling is initialized within hyperkube commands that require it (apiserver, kubelet) ([#76659](https://github.com/kubernetes/kubernetes/pull/76659), [@S-Chan](https://github.com/S-Chan)) -* Fix some service tags not supported issues for Azure LoadBalancer service ([#77719](https://github.com/kubernetes/kubernetes/pull/77719), [@feiskyer](https://github.com/feiskyer)) -* Add Un-reserve extension point for the scheduling framework. ([#77598](https://github.com/kubernetes/kubernetes/pull/77598), [@danielqsj](https://github.com/danielqsj)) -* Once merged, `legacy cloud providers` unit tests will run as part of ci, just as they were before they move from `./pkg/cloudproviders/providers` ([#77704](https://github.com/kubernetes/kubernetes/pull/77704), [@khenidak](https://github.com/khenidak)) -* Check if container memory stats are available before accessing it ([#77656](https://github.com/kubernetes/kubernetes/pull/77656), [@yastij](https://github.com/yastij)) -* Add a field to store CSI volume expansion secrets ([#77516](https://github.com/kubernetes/kubernetes/pull/77516), [@gnufied](https://github.com/gnufied)) -* Add a condition NonStructuralSchema to CustomResourceDefinition listing Structural Schema violations as defined in KEP https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/20190425-structural-openapi.md. CRD authors should update their validation schemas to be structural in order to participate in future CRD features. ([#77207](https://github.com/kubernetes/kubernetes/pull/77207), [@sttts](https://github.com/sttts)) -* NONE ([#74314](https://github.com/kubernetes/kubernetes/pull/74314), [@oomichi](https://github.com/oomichi)) -* Update to use go 1.12.5 ([#77528](https://github.com/kubernetes/kubernetes/pull/77528), [@cblecker](https://github.com/cblecker)) -* Fix race conditions for Azure loadbalancer and route updates. ([#77490](https://github.com/kubernetes/kubernetes/pull/77490), [@feiskyer](https://github.com/feiskyer)) -* remove VM API call dep in azure disk WaitForAttach ([#77483](https://github.com/kubernetes/kubernetes/pull/77483), [@andyzhangx](https://github.com/andyzhangx)) -* N/A ([#77425](https://github.com/kubernetes/kubernetes/pull/77425), [@figo](https://github.com/figo)) -* Fix TestEventChannelFull random fail ([#76603](https://github.com/kubernetes/kubernetes/pull/76603), [@changyaowei](https://github.com/changyaowei)) -* `aws-cloud-provider` service account in the `kube-system` namespace need to be granted with list node permission with this optimization ([#76976](https://github.com/kubernetes/kubernetes/pull/76976), [@zhan849](https://github.com/zhan849)) -* Remove hyperkube short aliases from source code, Because hyperkube docker image currently create these aliases. ([#76953](https://github.com/kubernetes/kubernetes/pull/76953), [@Rand01ph](https://github.com/Rand01ph)) -* Allow to define kubeconfig file for OpenStack cloud provider. ([#77415](https://github.com/kubernetes/kubernetes/pull/77415), [@Fedosin](https://github.com/Fedosin)) -* API servers using the default Google Compute Engine bootstrapping scripts will have their insecure port (`:8080`) disabled by default. To enable the insecure port, set `ENABLE_APISERVER_INSECURE_PORT=true` in kube-env or as an environment variable. ([#77447](https://github.com/kubernetes/kubernetes/pull/77447), [@dekkagaijin](https://github.com/dekkagaijin)) -* GCE clusters will include some IP ranges that are not in used on the public Internet to the list of non-masq IPs. ([#77458](https://github.com/kubernetes/kubernetes/pull/77458), [@grayluck](https://github.com/grayluck)) - * Bump ip-masq-agent version to v2.3.0 with flag `nomasq-all-reserved-ranges` turned on. -* Implement un-reserve extension point for the scheduling framework. ([#77457](https://github.com/kubernetes/kubernetes/pull/77457), [@danielqsj](https://github.com/danielqsj)) -* If a pod has a running instance, the stats of its previously terminated instances will not show up in the kubelet summary stats any more for CRI runtimes like containerd and cri-o. ([#77426](https://github.com/kubernetes/kubernetes/pull/77426), [@Random-Liu](https://github.com/Random-Liu)) - * This keeps the behavior consistent with Docker integration, and fixes an issue that some container Prometheus metrics don't work when there are summary stats for multiple instances of the same pod. -* Limit use of tags when calling EC2 API to prevent API throttling for very large clusters ([#76749](https://github.com/kubernetes/kubernetes/pull/76749), [@mcrute](https://github.com/mcrute)) -* When specifying an invalid value for a label, it was not always ([#77144](https://github.com/kubernetes/kubernetes/pull/77144), [@kenegozi](https://github.com/kenegozi)) - * clear which label the value was specified for. Starting with this release, the - * label's key is included in such error messages, which makes debugging easier. - - - -# v1.15.0-alpha.3 - -[Documentation](https://docs.k8s.io) - -## Downloads for v1.15.0-alpha.3 - - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes.tar.gz) | `88d9ced283324136e9230a0c92ad9ade10d1f52d095d5a3f9827a1ebe0cf87b5edf713cff9093cc5c61311282fe861b7c02d1da62a6ba74e2c19584e5d6084a6` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-src.tar.gz) | `c6cfe656825da66e863cd08887b3ce4374e3dae0448e33c77f960aec168c1cbad46e2485ddb9dc00f0733b4464f1e8c6e20f333097f43848decc07576ffb8d69` - -### Client Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-client-darwin-386.tar.gz) | `9df574b99dd03b15c784afa0bf91e826d687c5a2c7279878ddc9489e5542b2b24da5dc876eb01da0182dd4dabfda3b427875dcde16a99478923e9f74233640c1` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-client-darwin-amd64.tar.gz) | `bd8ac74d57e2c5dbfb36a8a3f79802a85393d914c0f513f83395f4b951a41d58ef23081d67edd1dacc039ef29bc761dcd17787b3315954f7460e15a15150dd5e` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-client-linux-386.tar.gz) | `8ffecc41f973564b18ee6ee0cf3d2c553e9f4649b13e99dc92f427a3861b04c599e94b14ecab8b3f6018cc1248dec72cd0318c41a5d51364961cf14c8667b89c` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-client-linux-amd64.tar.gz) | `8c62df3e8f02d0fe6388f82cf3af32c592783a012744b0595e5ae66097643dc6e28171322d69c1cd7e30c6b411f6f2b727728a503aec8f9d0c7cfdee44f307f5` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-client-linux-arm.tar.gz) | `6e411c605778e2a079971bfe6f066bd834dcaa13a6e1369d1a5064cc16a95aee8e6b07197522e4ef83d40692869dbd1b082a784102cad8168375202db773ce80` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-client-linux-arm64.tar.gz) | `52daf658b97c66bf67b24ad45adf27e70cf8e721e616250bef06c8d4d4b6e0820647b337c38eec2673d440c2578989ba1ca1d24b4babeb7c0e22834700c225d5` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-client-linux-ppc64le.tar.gz) | `0f2fe4d16518640a958166bc9e1963d594828e6edfa37c018778ccce79761561d0f9f8db206bd4ed122ce068d74e10cd25655bb6763fb0d53c881f0199db09bf` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-client-linux-s390x.tar.gz) | `58582b030c95160460f7061000c19da225d175249beff26d4a3f5d415670ff374781b4612e1b8e01e86d31772e4ab86cd41553885d514f013df9c01cbda4b7c2` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-client-windows-386.tar.gz) | `d2898a2e2c6d28c9069479b7dfcf5dc640864e20090441c9bb101e3f6a1cbc28051135b60143dc6b8f1edaa896e8467d3c1b7bbd7b75a3f1fb3657da6eb7385d` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-client-windows-amd64.tar.gz) | `50fa515ba4be8a30739cb811d8750260f2746914b98de9989c58e9b100d07f59a9b701d83a06646ccf3ad53c74b8a7a35c9eb860fb0cff27178145f457921c1b` - -### Server Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-server-linux-amd64.tar.gz) | `b124b2fa18935bbc15b9a3c0447df931314b41d36d2cd9a65bebd090dafec9bc8f3614bf0fca97504d9d5270580b0e5e3f8564a7c8d87fde57cd593b73a7697d` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-server-linux-arm.tar.gz) | `cde20282adb8d43e350c932c5a52176c2e1accb80499631a46c6d6980c1967c324a77e295a14eb0e37702bcd26462980ac5fe5f1ee689386d974ac4c28d7b462` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-server-linux-arm64.tar.gz) | `657b24b24dddb475a737be8e65669caf3c41102de5feb990b8b0f29066f823130ff759b1579a6ddbb08fef1e75edca3621054934253ef9d636f4bbcc255093ea` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-server-linux-ppc64le.tar.gz) | `2373012c73109a38a6a2b64f1db716d62a65a4a64ccf246680f226dba96b598f9757ded4e2d3581ba4f499a28e7d8d89bbc0db98a09c812fdc7e12a014fb70ec` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-server-linux-s390x.tar.gz) | `c2ce4362766bb08ffccea13893431c5f59d02f996fbb5fad1fe0014a9670440dca9e9ab4037116e19f090eeba9bdbb2ff8d2e80128afe29a86adb043a7c4e674` - -### Node Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-node-linux-amd64.tar.gz) | `c26b0b2fff310d791c91e610252a86966df271b745a3ded8067328dab04fd3c1600bf1f67d728521472fbba067be2a2a52c927c6af4ae6cbabf237f74843b5dd` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-node-linux-arm.tar.gz) | `79e70e550a401435b0f3d06b60312bc0740924ca56607eae9cd0d12dce1a6ea1ade1a850145ba05fccec1f52eb6879767e901b6fe2e7b499cf4c632d9ebae017` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-node-linux-arm64.tar.gz) | `5f920cf9e169c863760a27022f3f0e1503cedcb6b84089a7e77a05d2d449a9a68f23f1ea48924acc8221e78f151e832e07cbb5586e6e652c56c2fd6ff6009551` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-node-linux-ppc64le.tar.gz) | `6037b555f484337e659b347ce0ca725e0a25e2e3034100a9ebc4c18668eb102093e8477cca8022cd99957a4532034ad0b7d1cf356c0bb6582f8acf9895e46423` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-node-linux-s390x.tar.gz) | `a32a0a22ade7658e5fb924ca8b0ccca40e96f872d136062842c046fd3f17ecc056c22d6cfa3736cbbbac3b648299ef976ad6811ed942e13af3185d83e3440d97` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.3/kubernetes-node-windows-amd64.tar.gz) | `005120b6500ee9839a6914a08ec270ccd273b5dea863da17d4da5ab1e47a7dee5b174cf5d923870186d144b954778d26e3e4445dc997411f267b200001e13e03` - -## Changelog since v1.15.0-alpha.2 - -### Other notable changes - -* Adding ListMeta.RemainingItemCount. When responding a LIST request, if the server has more data available, and if the request does not contain label selectors or field selectors, the server sets the ListOptions.RemainingItemCount to the number of remaining objects. ([#75993](https://github.com/kubernetes/kubernetes/pull/75993), [@caesarxuchao](https://github.com/caesarxuchao)) -* This PR removes unused soak test cauldron ([#77335](https://github.com/kubernetes/kubernetes/pull/77335), [@loqutus](https://github.com/loqutus)) -* N/A ([#76966](https://github.com/kubernetes/kubernetes/pull/76966), [@figo](https://github.com/figo)) -* kubeadm: kubeadm alpha certs renew and kubeadm upgrade now supports renews of certificates embedded in KubeConfig files managed by kubeadm; this does not apply to certificates signed by external CAs. ([#77180](https://github.com/kubernetes/kubernetes/pull/77180), [@fabriziopandini](https://github.com/fabriziopandini)) -* As of Kubernetes 1.15, the SupportNodePidsLimit feature introduced as alpha in Kubernetes 1.14 is now beta, and the ability to utilize it is enabled by default. It is no longer necessary to set the feature gate `SupportNodePidsLimit=true`. In all other respects, this functionality behaves as it did in Kubernetes 1.14. ([#76221](https://github.com/kubernetes/kubernetes/pull/76221), [@RobertKrawitz](https://github.com/RobertKrawitz)) -* Bump addon-manager to v9.0.1 ([#77282](https://github.com/kubernetes/kubernetes/pull/77282), [@MrHohn](https://github.com/MrHohn)) - * - Rebase image on debian-base:v1.0.0 -* Fix kubectl describe CronJobs error of `Successful Job History Limit`. ([#77347](https://github.com/kubernetes/kubernetes/pull/77347), [@danielqsj](https://github.com/danielqsj)) -* Remove extra pod creation expections when daemonset fails to create pods in batches. ([#74856](https://github.com/kubernetes/kubernetes/pull/74856), [@draveness](https://github.com/draveness)) -* enhance the daemonset sync logic in clock-skew scenario ([#77208](https://github.com/kubernetes/kubernetes/pull/77208), [@DaiHao](https://github.com/DaiHao)) -* GCE-only flag `cloud-provider-gce-lb-src-cidrs` becomes optional for external cloud providers. ([#76627](https://github.com/kubernetes/kubernetes/pull/76627), [@timoreimann](https://github.com/timoreimann)) -* The GCERegionalPersistentDisk feature gate (GA in 1.13) can no longer be disabled. The feature gate will be removed in v1.17. ([#77412](https://github.com/kubernetes/kubernetes/pull/77412), [@liggitt](https://github.com/liggitt)) -* API requests rejected by admission webhooks which specify an http status code < 400 are now assigned a 400 status code. ([#77022](https://github.com/kubernetes/kubernetes/pull/77022), [@liggitt](https://github.com/liggitt)) -* kubeadm: Add ability to specify certificate encryption and decryption key for the upload/download certificates phases as part of the new v1beta2 kubeadm config format. ([#77012](https://github.com/kubernetes/kubernetes/pull/77012), [@rosti](https://github.com/rosti)) -* Fixes incorrect handling by kubectl of custom resources whose Kind is "Status" ([#77368](https://github.com/kubernetes/kubernetes/pull/77368), [@liggitt](https://github.com/liggitt)) -* kubeadm: disable the kube-proxy DaemonSet on non-Linux nodes. This step is required to support Windows worker nodes. ([#76327](https://github.com/kubernetes/kubernetes/pull/76327), [@neolit123](https://github.com/neolit123)) -* Add etag for NSG updates so as to fix nsg race condition ([#77210](https://github.com/kubernetes/kubernetes/pull/77210), [@feiskyer](https://github.com/feiskyer)) -* The `series.state` field in the events.k8s.io/v1beta1 Event API is deprecated and will be removed in v1.18 ([#75987](https://github.com/kubernetes/kubernetes/pull/75987), [@yastij](https://github.com/yastij)) -* API paging is now enabled by default in k8s.io/apiserver recommended options, and in k8s.io/sample-apiserver ([#77278](https://github.com/kubernetes/kubernetes/pull/77278), [@liggitt](https://github.com/liggitt)) -* GCE/Windows: force kill Stackdriver logging processes when the service cannot be stopped ([#77378](https://github.com/kubernetes/kubernetes/pull/77378), [@yujuhong](https://github.com/yujuhong)) -* ingress objects are now persisted in etcd using the networking.k8s.io/v1beta1 version ([#77139](https://github.com/kubernetes/kubernetes/pull/77139), [@cmluciano](https://github.com/cmluciano)) -* [fluentd-gcp addon] Bump fluentd-gcp-scaler to v0.5.2 to pick up security fixes. ([#76762](https://github.com/kubernetes/kubernetes/pull/76762), [@serathius](https://github.com/serathius)) -* Add RuntimeClass restrictions & defaulting to PodSecurityPolicy. ([#73795](https://github.com/kubernetes/kubernetes/pull/73795), [@tallclair](https://github.com/tallclair)) -* Promote meta.k8s.io/v1beta1 Table and PartialObjectMetadata to v1. ([#77136](https://github.com/kubernetes/kubernetes/pull/77136), [@smarterclayton](https://github.com/smarterclayton)) -* Fix bug with block volume expansion ([#77317](https://github.com/kubernetes/kubernetes/pull/77317), [@gnufied](https://github.com/gnufied)) -* Fixes spurious error messages about failing to clean up iptables rules when using iptables 1.8. ([#77303](https://github.com/kubernetes/kubernetes/pull/77303), [@danwinship](https://github.com/danwinship)) -* Add TLS termination support for NLB ([#74910](https://github.com/kubernetes/kubernetes/pull/74910), [@M00nF1sh](https://github.com/M00nF1sh)) -* Preserves existing namespace information in manifests when running `kubectl set ... --local` commands ([#77267](https://github.com/kubernetes/kubernetes/pull/77267), [@liggitt](https://github.com/liggitt)) -* fix issue that pull image failed from a cross-subscription Azure Container Registry when using MSI to authenticate ([#77245](https://github.com/kubernetes/kubernetes/pull/77245), [@norshtein](https://github.com/norshtein)) -* Clean links handling in cp's tar code ([#76788](https://github.com/kubernetes/kubernetes/pull/76788), [@soltysh](https://github.com/soltysh)) -* Implement and update interfaces and skeleton for the scheduling framework. ([#75848](https://github.com/kubernetes/kubernetes/pull/75848), [@bsalamat](https://github.com/bsalamat)) -* Fixes segmentation fault issue with Protobuf library when log entries are deeply nested. ([#77224](https://github.com/kubernetes/kubernetes/pull/77224), [@qingling128](https://github.com/qingling128)) -* kubeadm: support sub-domain wildcards in certificate SANs ([#76920](https://github.com/kubernetes/kubernetes/pull/76920), [@sempr](https://github.com/sempr)) -* Fixes an error with stuck informers when an etcd watch receives update or delete events with missing data ([#76675](https://github.com/kubernetes/kubernetes/pull/76675), [@ryanmcnamara](https://github.com/ryanmcnamara)) - - - -# v1.15.0-alpha.2 - -[Documentation](https://docs.k8s.io) - -## Downloads for v1.15.0-alpha.2 - - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes.tar.gz) | `88ca590c9bc2a095492310fee73bd191398375bc7f549e66e8978c48be8a9c0f9ad26e3881b84d5f2f2e49273333b3086dd99cc8c52de68e38464729f0d2828f` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-src.tar.gz) | `f587073d7b58903a52beeaa911c932047294be54b6f395063c65b46a61113af1aeca37c0edc536525398f0051968708cc9bb17a2173edb8c2e8f3938ad91c0b0` - -### Client Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-client-darwin-386.tar.gz) | `1b944693f3813702e64f41fc11102af59beceb5ded52aac3109ebe39eb2e9103d10b26f29519337a36c86dec5c472d2b0dd5bb0264969a587345b6bb89142520` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-client-darwin-amd64.tar.gz) | `233bba8324f7570e527f7ef22a01552c28dbabc6eef658311668ed554923344791c2c9314678f205424a638fefebbbf67dd32be99cb70019cc77a08dbae08f4d` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-client-linux-386.tar.gz) | `1203729b3180328631d4192c5f4cfb09e3fea958be544fe4ee3e86826422a6242d7eae9d3efba055ada4e65dbc7a3020305da97223d24416dd40686271fb3537` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-client-linux-amd64.tar.gz) | `ad0613c88d4f97b2a8f35fff607bf6168724b28838587218ccece14afb52b531f723ced372de3a4014ee76ae2c738f523790178395a2b59d4b5f53fc3451fd04` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-client-linux-arm.tar.gz) | `e9d3905d306504838d417051df43431f724ea689fd3564e575f8235fc80d771b9bc72c98eae4641e9e3c5619fc93550b93634ff33d8db3b0058e348d7258ee3d` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-client-linux-arm64.tar.gz) | `a426b27d0851d84b76d225b9366668521441539e7582b2439e973c98c84909fc0a236478d505c6cf50598c4ecb4796f3214ee5c80d42653ddb8e30d5ce7732be` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-client-linux-ppc64le.tar.gz) | `be717777159b6f0c472754be704d543b80168cc02d76ca936f6559a55752530e061fe311df3906660dcaf7950a7cbea102232fb54bc4056384c11018d1dfff24` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-client-linux-s390x.tar.gz) | `4a4a08d23be247e1543c85895c211e9fee8e8fa276e5aa31ed012804fa0921eeb0e5828f8ef152742b41dc1db08658dec01c0287b2828c3d3b91f260243c2457` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-client-windows-386.tar.gz) | `8d16d655d7d4213a45a583f81b31056a02dd2100d06d8072a8ec77e255630bd9acfff062d7ab46946f94d667a8d73c611818445464638f3a3ef69c29e9aafda7` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-client-windows-amd64.tar.gz) | `d4ece03464aaa9c2416d7acf9de7f94f3e01fa17f6f7469a9aedaefa90d4b0af193a1b78fb514fd9de0a55a45244a076e3897e62f9208581523690bbe0353357` - -### Server Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-server-linux-amd64.tar.gz) | `932557827bfcc329162fcf29510f40951bdd5da4890de62fd5c44d5290349b0942ffe07bb2b518ca0f21b4de4c27ec6cfa338ec2b40e938e3a9f6e3ab5db89c0` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-server-linux-arm.tar.gz) | `e1c5349feab83ad458b9a5956026c48c7ce53f3becc09c537eda8984cea56bb254e7972d467e3b3349ad8e35cf70bebcb4b6a0ab98cbe43ab5f1238f0844d151` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-server-linux-arm64.tar.gz) | `e8cfe09ff625b36b58d97440d82dbc06795d503729b45a8d077de7c73b70f350010747ad2c118ea75946e40cbf5cdfb1fdfa686c8cc714d4ec942f9bf2925664` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-server-linux-ppc64le.tar.gz) | `99770fe0abd0ec2d5f7e38d434a82fa323b2e25124e62aadf483dd68e763b07292e9303a2c8d96964bed91cab7050e0f5be02c76919c33dcc18b46d541677022` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-server-linux-s390x.tar.gz) | `3f0772f3b470d59330dd6b44a43af640a7ec42354d734a1aef491769d20a2dadaebda71cac6ad926082e03e967c6dd16ce9c440183d705c8c7c5a33f6d7b89be` - -### Node Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-node-linux-amd64.tar.gz) | `9c879a12174a8c69124a649a8e6d51a5d4c174741d743f68f9ccec349aa671ca085e33cf63ba6047e89c9e16c2122758bbcac01eba48864cd834d18ff6c6bd36` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-node-linux-arm.tar.gz) | `3ac31c7f6b01896da60028037f30f8b6f331b7cd989dcfabd5623dbfbbed8a60ff5911fc175d976e831075587f2cd79c97f50b5cfa73bac203746bd2f6b75cd1` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-node-linux-arm64.tar.gz) | `669376d5673534d53d2546bc7768f00a3add74da452061dbc2892f59efba28dc54835e4bc556c84ef54cb761f9e65f2b54e274f39faa0d609976da76fcdd87df` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-node-linux-ppc64le.tar.gz) | `b1c7fb9fcafc216fa2bd9551399f11a592922556dfad4c56fa273a7c54426fbb63b786ecf44d71148f5c8bd08212f9915c0b784790661302b9953d6da44934d7` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-node-linux-s390x.tar.gz) | `b93ae8cebd79d1ce0cb2aed66ded63b3541fcca23a1f879299c422774fb757ad3c30e782ccd7314480d247a5435c434014ed8a4cc3943b3078df0ef5b5a5b8f1` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.2/kubernetes-node-windows-amd64.tar.gz) | `e99127789e045972d0c52c61902f00297c208851bb65e01d28766b6f9439f81a56e48f3fc1a20189c59ea76d3ba4ac3dd230ad054c8a2106ae8a19d4232137ba` - -## Changelog since v1.15.0-alpha.1 - -### Other notable changes - -* Kubemark scripts have been fixed for IKS clusters. ([#76909](https://github.com/kubernetes/kubernetes/pull/76909), [@Huang-Wei](https://github.com/Huang-Wei)) -* fix azure disk list corruption issue ([#77187](https://github.com/kubernetes/kubernetes/pull/77187), [@andyzhangx](https://github.com/andyzhangx)) -* kubeadm: kubeadm upgrade now renews all the certificates used by one component before upgrading the component itself, with the exception of certificates signed by external CAs. User can eventually opt-out from certificate renewal during upgrades by setting the new flag --certificate-renewal to false. ([#76862](https://github.com/kubernetes/kubernetes/pull/76862), [@fabriziopandini](https://github.com/fabriziopandini)) -* kube-proxy: os exit when CleanupAndExit is set to true ([#76732](https://github.com/kubernetes/kubernetes/pull/76732), [@JieJhih](https://github.com/JieJhih)) -* kubectl exec now allows using resource name (e.g., deployment/mydeployment) to select a matching pod. ([#73664](https://github.com/kubernetes/kubernetes/pull/73664), [@prksu](https://github.com/prksu)) - * kubectl exec now allows using --pod-running-timeout flag to wait till at least one pod is running. -* kubeadm: add optional ECDSA support. ([#76390](https://github.com/kubernetes/kubernetes/pull/76390), [@rojkov](https://github.com/rojkov)) - * kubeadm still generates RSA keys when deploying a node, but also accepts ECDSA - * keys if they exist already in the directory specified in --cert-dir option. -* kube-proxy: HealthzBindAddress and MetricsBindAddress support ipv6 address. ([#76320](https://github.com/kubernetes/kubernetes/pull/76320), [@JieJhih](https://github.com/JieJhih)) -* Packets considered INVALID by conntrack are now dropped. In particular, this fixes ([#74840](https://github.com/kubernetes/kubernetes/pull/74840), [@anfernee](https://github.com/anfernee)) - * a problem where spurious retransmits in a long-running TCP connection to a service - * IP could result in the connection being closed with the error "Connection reset by - * peer" -* Introduce the v1beta2 config format to kubeadm. ([#76710](https://github.com/kubernetes/kubernetes/pull/76710), [@rosti](https://github.com/rosti)) -* kubeadm: bump the minimum supported Docker version to 1.13.1 ([#77051](https://github.com/kubernetes/kubernetes/pull/77051), [@chenzhiwei](https://github.com/chenzhiwei)) -* Rancher credential provider has now been removed ([#77099](https://github.com/kubernetes/kubernetes/pull/77099), [@dims](https://github.com/dims)) -* Support print volumeMode using `kubectl get pv/pvc -o wide` ([#76646](https://github.com/kubernetes/kubernetes/pull/76646), [@cwdsuzhou](https://github.com/cwdsuzhou)) -* Upgrade go-autorest to v11.1.2 ([#77070](https://github.com/kubernetes/kubernetes/pull/77070), [@feiskyer](https://github.com/feiskyer)) -* Fixes a bug where dry-run is not honored for pod/eviction sub-resource. ([#76969](https://github.com/kubernetes/kubernetes/pull/76969), [@apelisse](https://github.com/apelisse)) -* Reduce event spam for AttachVolume storage operation ([#75986](https://github.com/kubernetes/kubernetes/pull/75986), [@mucahitkurt](https://github.com/mucahitkurt)) -* Report cp errors consistently ([#77010](https://github.com/kubernetes/kubernetes/pull/77010), [@soltysh](https://github.com/soltysh)) -* specify azure file share name in azure file plugin ([#76988](https://github.com/kubernetes/kubernetes/pull/76988), [@andyzhangx](https://github.com/andyzhangx)) -* Migrate oom watcher not relying on cAdviosr's API any more ([#74942](https://github.com/kubernetes/kubernetes/pull/74942), [@WanLinghao](https://github.com/WanLinghao)) -* Validating admission webhooks are now properly called for CREATE operations on the following resources: tokenreviews, subjectaccessreviews, localsubjectaccessreviews, selfsubjectaccessreviews, selfsubjectrulesreviews ([#76959](https://github.com/kubernetes/kubernetes/pull/76959), [@sbezverk](https://github.com/sbezverk)) -* Fix OpenID Connect (OIDC) token refresh when the client secret contains a special character. ([#76914](https://github.com/kubernetes/kubernetes/pull/76914), [@tsuna](https://github.com/tsuna)) -* kubeadm: Improve resiliency when it comes to updating the `kubeadm-config` config map upon new control plane joins or resets. This allows for safe multiple control plane joins and/or resets. ([#76821](https://github.com/kubernetes/kubernetes/pull/76821), [@ereslibre](https://github.com/ereslibre)) -* Validating admission webhooks are now properly called for CREATE operations on the following resources: pods/binding, pods/eviction, bindings ([#76910](https://github.com/kubernetes/kubernetes/pull/76910), [@liggitt](https://github.com/liggitt)) -* Default TTL for DNS records in kubernetes zone is changed from 5s to 30s to keep consistent with old dnsmasq based kube-dns. The TTL can be customized with command `kubectl edit -n kube-system configmap/coredns`. ([#76238](https://github.com/kubernetes/kubernetes/pull/76238), [@Dieken](https://github.com/Dieken)) -* Fixed a kubemark panic when hollow-node is morphed as proxy. ([#76848](https://github.com/kubernetes/kubernetes/pull/76848), [@Huang-Wei](https://github.com/Huang-Wei)) -* k8s-dns-node-cache image version v1.15.1 ([#76640](https://github.com/kubernetes/kubernetes/pull/76640), [@george-angel](https://github.com/george-angel)) -* GCE/Windows: add support for stackdriver logging agent ([#76850](https://github.com/kubernetes/kubernetes/pull/76850), [@yujuhong](https://github.com/yujuhong)) -* Admission webhooks are now properly called for `scale` and `deployments/rollback` subresources ([#76849](https://github.com/kubernetes/kubernetes/pull/76849), [@liggitt](https://github.com/liggitt)) -* Switch to instance-level update APIs for Azure VMSS loadbalancer operations ([#76656](https://github.com/kubernetes/kubernetes/pull/76656), [@feiskyer](https://github.com/feiskyer)) -* kubeadm: kubeadm alpha cert renew now ignores certificates signed by external CAs ([#76865](https://github.com/kubernetes/kubernetes/pull/76865), [@fabriziopandini](https://github.com/fabriziopandini)) -* Update to use go 1.12.4 ([#76576](https://github.com/kubernetes/kubernetes/pull/76576), [@cblecker](https://github.com/cblecker)) -* [metrics-server addon] Restore connecting to nodes via IP addresses ([#76819](https://github.com/kubernetes/kubernetes/pull/76819), [@serathius](https://github.com/serathius)) -* fix detach azure disk back off issue which has too big lock in failure retry condition ([#76573](https://github.com/kubernetes/kubernetes/pull/76573), [@andyzhangx](https://github.com/andyzhangx)) -* Updated klog to 0.3.0 ([#76474](https://github.com/kubernetes/kubernetes/pull/76474), [@vincepri](https://github.com/vincepri)) -* kube-up.sh no longer supports "centos" and "local" providers ([#76711](https://github.com/kubernetes/kubernetes/pull/76711), [@dims](https://github.com/dims)) -* Ensure the backend pools are set correctly for Azure SLB with multiple backend pools (e.g. outbound rules) ([#76691](https://github.com/kubernetes/kubernetes/pull/76691), [@feiskyer](https://github.com/feiskyer)) -* Windows nodes on GCE use a known-working 1809 image rather than the latest 1809 image. ([#76722](https://github.com/kubernetes/kubernetes/pull/76722), [@pjh](https://github.com/pjh)) -* The userspace proxy now respects the IPTables proxy's minSyncInterval parameter. ([#71735](https://github.com/kubernetes/kubernetes/pull/71735), [@dcbw](https://github.com/dcbw)) -* Kubeadm will now include the missing certificate key if it is unable to find an expected key during `kubeadm join` when used with the `--experimental-control-plane` flow ([#76636](https://github.com/kubernetes/kubernetes/pull/76636), [@mdaniel](https://github.com/mdaniel)) - - - -# v1.15.0-alpha.1 - -[Documentation](https://docs.k8s.io) - -## Downloads for v1.15.0-alpha.1 - - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes.tar.gz) | `e07246d1811bfcaf092a3244f94e4bcbfd050756aea1b56e8af54e9c016c16c9211ddeaaa08b8b398e823895dd7a8fc757e5674e11a86f1edc6f718b837cfe0c` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-src.tar.gz) | `ebd902a1cfdde0d9a0062f3f21732eed76eb123da04a25f9f5c7cfce8a2926dc8331e6028c3cd27aa84aaa0bf069422a0a0b0a61e6e5f48be7fe4934e1e786fc` - -### Client Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-client-darwin-386.tar.gz) | `88ce20f3c1f914aebca3439b3f4b642c9c371970945a25e623730826168ebadc53706ac6f4422ea4295de86c7c6bff14ec96ad3cc8ae52d9920ecbdc9dab1729` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-client-darwin-amd64.tar.gz) | `a5c1a43c7e3dbb27c1a4c7e4111596331887206f768072e3fb7671075c11f2ed7c26873eef291c048415247845e86ff58aa9946a89c4aede5d847677e871ccd5` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-client-linux-386.tar.gz) | `cf7513ab821cd0c979b1421034ce50e9bc0f347c184551cf4a9b6beab06588adda19f1b53b073525c0e73b5961beb5c1fab913c040c911acaa36496e4386a70d` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-client-linux-amd64.tar.gz) | `964296e9289e12bc02ec05fb5ca9e6766654f81e1885989f8185ee8b47573ae07731e8b3cb69742b58ab1e795df8e47fd110d3226057a4c56a9ebeae162f8b35` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-client-linux-arm.tar.gz) | `3480209c2112315d81e9ac22bc2a5961a805621b82ad80dc04c7044b7a8d63b3515f77ebdfad632555468b784bab92d018aeb92c42e8b382d0ce9f358f397514` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-client-linux-arm64.tar.gz) | `be7d5bb5fddfbbe95d32b354b6ed26831b1afc406dc78e9188eae3d957991ea4ceb04b434d729891d017081816125c61ea67ac10ce82773e25edb9f45b39f2d3` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-client-linux-ppc64le.tar.gz) | `bfaeb3b8b0b2e2dde8900cd2910786cb68804ad7d173b6b52c15400041d7e8db30ff601a7de6a789a8788100eda496f0ff6d5cdcabef775d4b09117e002fe758` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-client-linux-s390x.tar.gz) | `653c99e3171f74e52903ac9101cf8280a5e9d82969c53e9d481a72e0cb5b4a22951f88305545c0916ba958ca609c39c249200780fed3f9bf88fa0b2d2438259c` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-client-windows-386.tar.gz) | `9b2862996eadf4e97d890f21bd4392beca80e356c7f94abaf5968b4ea3c2485f3391c89ce331c1de69ff9380de0c0b7be8635b079c79181e046b854b4c2530e6` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-client-windows-amd64.tar.gz) | `97d87fcbc0cd821b3ca5ebfbda0b38fdc9c5a5ec58e521936163fead936995c6b26b0f05b711fbc3d61315848b6733778cb025a34de837321cf2bb0a1cca76d0` - -### Server Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-server-linux-amd64.tar.gz) | `ffa2db2c39676e39535bcee3f41f4d178b239ca834c1aa6aafb75fb58cc5909ab94b712f2be6c0daa27ff249de6e31640fb4e5cdc7bdae82fc5dd2ad9f659518` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-server-linux-arm.tar.gz) | `a526cf7009fec5cd43da693127668006d3d6c4ebfb719e8c5b9b78bd5ad34887d337f25b309693bf844eedcc77c972c5981475ed3c00537d638985c6d6af71de` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-server-linux-arm64.tar.gz) | `4f9c8f85eebbf9f0023c9311560b7576cb5f4d2eac491e38aa4050c82b34f6a09b3702b3d8c1d7737d0f27fd2df82e8b0db5ab4600ca51efd5bd21ac38049062` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-server-linux-ppc64le.tar.gz) | `bf95f15c3edd9a7f6c2911eedd55655a60da288c9df3fed4c5b2b7cc11d5e1da063546a44268d6c3cb7d48c48d566a0776b2536f847507bcbcd419dcc8643f49` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-server-linux-s390x.tar.gz) | `a2588d8b3df5f7599cd84635e5772f9ba2c665287c54a6167784bb284eb09fb0e518e9acb0e295e18a77d48cc354c8918751b63f82504177a0b1838e9e89dfd3` - -### Node Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-node-linux-amd64.tar.gz) | `b4e9faadd0e03d3d89de496b5248547b159a7fe0c26319d898a448f3da80eb7d7d346494ca52634e89850fbb8b2db1f996bc8e7efca6cff1d26370a77b669967` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-node-linux-arm.tar.gz) | `bf6db10d15a97ae39e2fcdf32c11c6cd8afcd254dc2fbc1fc00c5c74d6179f4ed74c973f221b0f41a29ad2e7d03e5fdebf1ab927ca2e2dea010e7519badf39a9` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-node-linux-arm64.tar.gz) | `e89b95a23e36164b10510492841d7d140a9bd1799846f4ee1e8fbd74e8f6c512093a412edfb93bd68da10718ccdbe826f4b6ffa80e868461e7b7880c1cc44346` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-node-linux-ppc64le.tar.gz) | `47f47c8b7fafc7d6ed0e55308ccb2a3b289e174d763c4a6415b7f1b7d2b81e4ee090a4c361eadd7cb9dd774638d0f0ad45d271ab21cc230a1b8564f06d9edae8` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-node-linux-s390x.tar.gz) | `8a0af4be530008bc8f120cd82ec592d08b09a85a2a558c10d712ff44867c4ef3369b3e4e2f5a5d0c2fa375c337472b1b2e67b01ef3615eb174d36fbfd80ec2ff` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.15.0-alpha.1/kubernetes-node-windows-amd64.tar.gz) | `f48886bf8f965572b78baf9e02417a56fab31870124240cac02809615caa0bc9be214d182e041fc142240f83500fe69c063d807cbe5566e9d8b64854ca39104b` - -## Changelog since v1.14.0 - -### Action Required - -* client-go: The `rest.AnonymousClientConfig(*rest.Config) *rest.Config` helper method no longer copies custom `Transport` and `WrapTransport` fields, because those can be used to inject user credentials. ([#75771](https://github.com/kubernetes/kubernetes/pull/75771), [@liggitt](https://github.com/liggitt)) -* ACTION REQUIRED: The Node.Status.Volumes.Attached.DevicePath field is now unset for CSI volumes. Update any external controllers that depend on this field. ([#75799](https://github.com/kubernetes/kubernetes/pull/75799), [@msau42](https://github.com/msau42)) - -### Other notable changes - -* Remove the function Parallelize, please convert to use the function ParallelizeUntil. ([#76595](https://github.com/kubernetes/kubernetes/pull/76595), [@danielqsj](https://github.com/danielqsj)) -* StorageObjectInUseProtection admission plugin is additionally enabled by default. ([#74610](https://github.com/kubernetes/kubernetes/pull/74610), [@oomichi](https://github.com/oomichi)) - * So default enabled admission plugins are now `NamespaceLifecycle,LimitRanger,ServiceAccount,PersistentVolumeLabel,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,StorageObjectInUseProtection`. Please note that if you previously had not set the `--admission-control` flag, your cluster behavior may change (to be more standard). -* Juju provider source moved to the Charmed Kubernetes org ([#76628](https://github.com/kubernetes/kubernetes/pull/76628), [@kwmonroe](https://github.com/kwmonroe)) -* improve `kubectl auth can-i` command by warning users when they try access resource out of scope ([#76014](https://github.com/kubernetes/kubernetes/pull/76014), [@WanLinghao](https://github.com/WanLinghao)) -* Introduce API for watch bookmark events. ([#74074](https://github.com/kubernetes/kubernetes/pull/74074), [@wojtek-t](https://github.com/wojtek-t)) - * Introduce Alpha field `AllowWatchBookmarks` in ListOptions for requesting watch bookmarks from apiserver. The implementation in apiserver is hidden behind feature gate `WatchBookmark` (currently in Alpha stage). -* Override protocol between etcd server and kube-apiserver on master with HTTPS instead HTTP when mTLS is enabled in GCE ([#74690](https://github.com/kubernetes/kubernetes/pull/74690), [@wenjiaswe](https://github.com/wenjiaswe)) -* Fix issue in Portworx volume driver causing controller manager to crash ([#76341](https://github.com/kubernetes/kubernetes/pull/76341), [@harsh-px](https://github.com/harsh-px)) -* kubeadm: Fix a bug where if couple of CRIs are installed a user override of the CRI during join (via kubeadm join --cri-socket ...) is ignored and kubeadm bails out with an error ([#76505](https://github.com/kubernetes/kubernetes/pull/76505), [@rosti](https://github.com/rosti)) -* UpdateContainerResources is no longer recorded as a `container_status` operation. It now uses the label `update_container` ([#75278](https://github.com/kubernetes/kubernetes/pull/75278), [@Nessex](https://github.com/Nessex)) -* Bump metrics-server to v0.3.2 ([#76437](https://github.com/kubernetes/kubernetes/pull/76437), [@brett-elliott](https://github.com/brett-elliott)) -* The kubelet's /spec endpoint no longer provides cloud provider information (cloud_provider, instance_type, instance_id). ([#76291](https://github.com/kubernetes/kubernetes/pull/76291), [@dims](https://github.com/dims)) -* Change kubelet probe metrics to counter type. ([#76074](https://github.com/kubernetes/kubernetes/pull/76074), [@danielqsj](https://github.com/danielqsj)) - * The metrics `prober_probe_result` is replaced by `prober_probe_total`. -* Reduce GCE log rotation check from 1 hour to every 5 minutes. Rotation policy is unchanged (new day starts, log file size > 100MB). ([#76352](https://github.com/kubernetes/kubernetes/pull/76352), [@jpbetz](https://github.com/jpbetz)) -* Add ListPager.EachListItem utility function to client-go to enable incremental processing of chunked list responses ([#75849](https://github.com/kubernetes/kubernetes/pull/75849), [@jpbetz](https://github.com/jpbetz)) -* Added `CNI_VERSION` and `CNI_SHA1` environment variables in kube-up.sh to configure CNI versions on GCE. ([#76353](https://github.com/kubernetes/kubernetes/pull/76353), [@Random-Liu](https://github.com/Random-Liu)) -* Update cri-tools to v1.14.0 ([#75658](https://github.com/kubernetes/kubernetes/pull/75658), [@feiskyer](https://github.com/feiskyer)) -* 2X performance improvement on both required and preferred PodAffinity. ([#76243](https://github.com/kubernetes/kubernetes/pull/76243), [@Huang-Wei](https://github.com/Huang-Wei)) -* scheduler: add metrics to record number of pending pods in different queues ([#75501](https://github.com/kubernetes/kubernetes/pull/75501), [@Huang-Wei](https://github.com/Huang-Wei)) -* Create a new `kubectl rollout restart` command that does a rolling restart of a deployment. ([#76062](https://github.com/kubernetes/kubernetes/pull/76062), [@apelisse](https://github.com/apelisse)) -* - Added port configuration to Admission webhook configuration service reference. ([#74855](https://github.com/kubernetes/kubernetes/pull/74855), [@mbohlool](https://github.com/mbohlool)) - * - Added port configuration to AuditSink webhook configuration service reference. - * - Added port configuration to CRD Conversion webhook configuration service reference. - * - Added port configuration to kube-aggregator service reference. -* `kubectl get -w` now prints custom resource definitions with custom print columns ([#76161](https://github.com/kubernetes/kubernetes/pull/76161), [@liggitt](https://github.com/liggitt)) -* Fixes bug in DaemonSetController causing it to stop processing some DaemonSets for 5 minutes after node removal. ([#76060](https://github.com/kubernetes/kubernetes/pull/76060), [@krzysztof-jastrzebski](https://github.com/krzysztof-jastrzebski)) -* no ([#75820](https://github.com/kubernetes/kubernetes/pull/75820), [@YoubingLi](https://github.com/YoubingLi)) -* Use stdlib to log stack trace when a panic occurs ([#75853](https://github.com/kubernetes/kubernetes/pull/75853), [@roycaihw](https://github.com/roycaihw)) -* Fixes a NPD bug on GCI, so that it disables glog writing to files for log-counter ([#76211](https://github.com/kubernetes/kubernetes/pull/76211), [@wangzhen127](https://github.com/wangzhen127)) -* Tolerations with the same key and effect will be merged into one which has the value of the latest toleration for best effort pods. ([#75985](https://github.com/kubernetes/kubernetes/pull/75985), [@ravisantoshgudimetla](https://github.com/ravisantoshgudimetla)) -* Fix empty array expansion error in cluster/gce/util.sh ([#76111](https://github.com/kubernetes/kubernetes/pull/76111), [@kewu1992](https://github.com/kewu1992)) -* kube-proxy no longer automatically cleans up network rules created by running kube-proxy in other modes. If you are switching the mode that kube-proxy is in running in (EG: iptables to IPVS), you will need to run `kube-proxy --cleanup`, or restart the worker node (recommended) before restarting kube-proxy. ([#76109](https://github.com/kubernetes/kubernetes/pull/76109), [@vllry](https://github.com/vllry)) - * If you are not switching kube-proxy between different modes, this change should not require any action. -* Adds a new "storage_operation_status_count" metric for kube-controller-manager and kubelet to count success and error statues. ([#75750](https://github.com/kubernetes/kubernetes/pull/75750), [@msau42](https://github.com/msau42)) -* GCE/Windows: disable stackdriver logging agent to prevent node startup failures ([#76099](https://github.com/kubernetes/kubernetes/pull/76099), [@yujuhong](https://github.com/yujuhong)) -* StatefulSet controllers no longer force a resync every 30 seconds when nothing has changed. ([#75622](https://github.com/kubernetes/kubernetes/pull/75622), [@jonsabo](https://github.com/jonsabo)) -* Ensures the conformance test image saves results before exiting when ginkgo returns non-zero value. ([#76039](https://github.com/kubernetes/kubernetes/pull/76039), [@johnSchnake](https://github.com/johnSchnake)) -* Add --image-repository flag to "kubeadm config images". ([#75866](https://github.com/kubernetes/kubernetes/pull/75866), [@jmkeyes](https://github.com/jmkeyes)) -* Paginate requests from the kube-apiserver watch cache to etcd in chunks. ([#75389](https://github.com/kubernetes/kubernetes/pull/75389), [@jpbetz](https://github.com/jpbetz)) - * Paginate reflector init and resync List calls that are not served by watch cache. -* `k8s.io/kubernetes` and published components (like `k8s.io/client-go` and `k8s.io/api`) now publish go module files containing dependency version information. See http://git.k8s.io/client-go/INSTALL.md#go-modules for details on consuming `k8s.io/client-go` using go modules. ([#74877](https://github.com/kubernetes/kubernetes/pull/74877), [@liggitt](https://github.com/liggitt)) -* give users the option to suppress detailed output in integration test ([#76063](https://github.com/kubernetes/kubernetes/pull/76063), [@Huang-Wei](https://github.com/Huang-Wei)) -* CSI alpha CRDs have been removed ([#75747](https://github.com/kubernetes/kubernetes/pull/75747), [@msau42](https://github.com/msau42)) -* Fixes a regression proxying responses from aggregated API servers which could cause watch requests to hang until the first event was received ([#75887](https://github.com/kubernetes/kubernetes/pull/75887), [@liggitt](https://github.com/liggitt)) -* Support specify the Resource Group of Route Table when update Pod network route (Azure) ([#75580](https://github.com/kubernetes/kubernetes/pull/75580), [@suker200](https://github.com/suker200)) -* Support parsing more v1.Taint forms. `key:effect`, `key=:effect-` are now accepted. ([#74159](https://github.com/kubernetes/kubernetes/pull/74159), [@dlipovetsky](https://github.com/dlipovetsky)) -* Resource list requests for PartialObjectMetadata now correctly return list metadata like the resourceVersion and the continue token. ([#75971](https://github.com/kubernetes/kubernetes/pull/75971), [@smarterclayton](https://github.com/smarterclayton)) -* `StubDomains` and `Upstreamnameserver` which contains a service name will be omitted while translating to the equivalent CoreDNS config. ([#75969](https://github.com/kubernetes/kubernetes/pull/75969), [@rajansandeep](https://github.com/rajansandeep)) -* Count PVCs that are unbound towards attach limit ([#73863](https://github.com/kubernetes/kubernetes/pull/73863), [@gnufied](https://github.com/gnufied)) -* Increased verbose level for local openapi aggregation logs to avoid flooding the log during normal operation ([#75781](https://github.com/kubernetes/kubernetes/pull/75781), [@roycaihw](https://github.com/roycaihw)) -* In the 'kubectl describe' output, the fields with names containing special characters are displayed as-is without any pretty formatting. ([#75483](https://github.com/kubernetes/kubernetes/pull/75483), [@gsadhani](https://github.com/gsadhani)) -* Support both JSON and YAML for scheduler configuration. ([#75857](https://github.com/kubernetes/kubernetes/pull/75857), [@danielqsj](https://github.com/danielqsj)) -* kubeadm: fix "upgrade plan" not defaulting to a "stable" version if no version argument is passed ([#75900](https://github.com/kubernetes/kubernetes/pull/75900), [@neolit123](https://github.com/neolit123)) -* clean up func podTimestamp in queue ([#75754](https://github.com/kubernetes/kubernetes/pull/75754), [@denkensk](https://github.com/denkensk)) -* The AWS credential provider can now obtain ECR credentials even without the AWS cloud provider or being on an EC2 instance. Additionally, AWS credential provider caching has been improved to honor the ECR credential timeout. ([#75587](https://github.com/kubernetes/kubernetes/pull/75587), [@tiffanyfay](https://github.com/tiffanyfay)) -* Add completed job status in Cronjob event. ([#75712](https://github.com/kubernetes/kubernetes/pull/75712), [@danielqsj](https://github.com/danielqsj)) -* kubeadm: implement deletion of multiple bootstrap tokens at once ([#75646](https://github.com/kubernetes/kubernetes/pull/75646), [@bart0sh](https://github.com/bart0sh)) -* GCE Windows nodes will rely solely on kubernetes and kube-proxy (and not the GCE agent) for network address management. ([#75855](https://github.com/kubernetes/kubernetes/pull/75855), [@pjh](https://github.com/pjh)) -* kubeadm: preflight checks on external etcd certificates are now skipped when joining a control-plane node with automatic copy of cluster certificates (--certificate-key) ([#75847](https://github.com/kubernetes/kubernetes/pull/75847), [@fabriziopandini](https://github.com/fabriziopandini)) -* [stackdriver addon] Bump prometheus-to-sd to v0.5.0 to pick up security fixes. ([#75362](https://github.com/kubernetes/kubernetes/pull/75362), [@serathius](https://github.com/serathius)) - * [fluentd-gcp addon] Bump fluentd-gcp-scaler to v0.5.1 to pick up security fixes. - * [fluentd-gcp addon] Bump event-exporter to v0.2.4 to pick up security fixes. - * [fluentd-gcp addon] Bump prometheus-to-sd to v0.5.0 to pick up security fixes. - * [metatada-proxy addon] Bump prometheus-to-sd v0.5.0 to pick up security fixes. -* Support describe pod with inline csi volumes ([#75513](https://github.com/kubernetes/kubernetes/pull/75513), [@cwdsuzhou](https://github.com/cwdsuzhou)) -* Object count quota is now supported for namespaced custom resources using the count/. syntax. ([#72384](https://github.com/kubernetes/kubernetes/pull/72384), [@zhouhaibing089](https://github.com/zhouhaibing089)) -* In case kubeadm can't access the current Kubernetes version remotely and fails to parse ([#72454](https://github.com/kubernetes/kubernetes/pull/72454), [@rojkov](https://github.com/rojkov)) - * the git-based version it falls back to a static predefined value of - * k8s.io/kubernetes/cmd/kubeadm/app/constants.CurrentKubernetesVersion. -* Fixed a potential deadlock in resource quota controller ([#74747](https://github.com/kubernetes/kubernetes/pull/74747), [@liggitt](https://github.com/liggitt)) - * Enabled recording partial usage info for quota objects specifying multiple resources, when only some of the resources' usage can be determined. -* CRI API will now be available in the kubernetes/cri-api repository ([#75531](https://github.com/kubernetes/kubernetes/pull/75531), [@dims](https://github.com/dims)) -* Support vSphere SAML token auth when using Zones ([#75515](https://github.com/kubernetes/kubernetes/pull/75515), [@dougm](https://github.com/dougm)) -* Transition service account controller clients to TokenRequest API ([#72179](https://github.com/kubernetes/kubernetes/pull/72179), [@WanLinghao](https://github.com/WanLinghao)) -* kubeadm: reimplemented IPVS Proxy check that produced confusing warning message. ([#75036](https://github.com/kubernetes/kubernetes/pull/75036), [@bart0sh](https://github.com/bart0sh)) -* Allow to read OpenStack user credentials from a secret instead of a local config file. ([#75062](https://github.com/kubernetes/kubernetes/pull/75062), [@Fedosin](https://github.com/Fedosin)) -* watch can now be enabled for events using the flag --watch-cache-sizes on kube-apiserver ([#74321](https://github.com/kubernetes/kubernetes/pull/74321), [@yastij](https://github.com/yastij)) -* kubeadm: Support for deprecated old kubeadm v1alpha3 config is totally removed. ([#75179](https://github.com/kubernetes/kubernetes/pull/75179), [@rosti](https://github.com/rosti)) -* The Kubelet now properly requests protobuf objects where they are ([#75602](https://github.com/kubernetes/kubernetes/pull/75602), [@smarterclayton](https://github.com/smarterclayton)) - * supported from the apiserver, reducing load in large clusters. -* Add name validation for dynamic client methods in client-go ([#75072](https://github.com/kubernetes/kubernetes/pull/75072), [@lblackstone](https://github.com/lblackstone)) -* Users may now execute `get-kube-binaries.sh` to request a client for an OS/Arch unlike the one of the host on which the script is invoked. ([#74889](https://github.com/kubernetes/kubernetes/pull/74889), [@akutz](https://github.com/akutz)) -* Move config local to controllers in kube-controller-manager ([#72800](https://github.com/kubernetes/kubernetes/pull/72800), [@stewart-yu](https://github.com/stewart-yu)) -* Fix some potential deadlocks and file descriptor leaking for inotify watches. ([#75376](https://github.com/kubernetes/kubernetes/pull/75376), [@cpuguy83](https://github.com/cpuguy83)) -* [IPVS] Introduces flag ipvs-strict-arp to configure stricter ARP sysctls, defaulting to false to preserve existing behaviors. This was enabled by default in 1.13.0, which impacted a few CNI plugins. ([#75295](https://github.com/kubernetes/kubernetes/pull/75295), [@lbernail](https://github.com/lbernail)) -* [IPVS] Allow for transparent kube-proxy restarts ([#75283](https://github.com/kubernetes/kubernetes/pull/75283), [@lbernail](https://github.com/lbernail)) -* Replace *_admission_latencies_milliseconds_summary and *_admission_latencies_milliseconds metrics due to reporting wrong unit (was labelled milliseconds, but reported seconds), and multiple naming guideline violations (units should be in base units and "duration" is the best practice labelling to measure the time a request takes). Please convert to use *_admission_duration_seconds and *_admission_duration_seconds_summary, these now report the unit as described, and follow the instrumentation best practices. ([#75279](https://github.com/kubernetes/kubernetes/pull/75279), [@danielqsj](https://github.com/danielqsj)) -* Reset exponential backoff when storage operation changes ([#75213](https://github.com/kubernetes/kubernetes/pull/75213), [@gnufied](https://github.com/gnufied)) -* Watch will now support converting response objects into Table or PartialObjectMetadata forms. ([#71548](https://github.com/kubernetes/kubernetes/pull/71548), [@smarterclayton](https://github.com/smarterclayton)) -* N/A ([#74974](https://github.com/kubernetes/kubernetes/pull/74974), [@goodluckbot](https://github.com/goodluckbot)) -* kubeadm: fix the machine readability of "kubeadm token create --print-join-command" ([#75487](https://github.com/kubernetes/kubernetes/pull/75487), [@displague](https://github.com/displague)) -* Update Cluster Autoscaler to 1.14.0; changelog: https://github.com/kubernetes/autoscaler/releases/tag/cluster-autoscaler-1.14.0 ([#75480](https://github.com/kubernetes/kubernetes/pull/75480), [@losipiuk](https://github.com/losipiuk)) \ No newline at end of file diff --git a/content/zh/docs/setup/release/notes.md b/content/zh/docs/setup/release/notes.md deleted file mode 100644 index 435e16fce6..0000000000 --- a/content/zh/docs/setup/release/notes.md +++ /dev/null @@ -1,3159 +0,0 @@ ---- -title: v1.16 发行说明 -weight: 10 -card: - name: 下载 - weight: 20 - anchors: - - anchor: "#" - title: 最新发行说明 - - anchor: "#urgent-upgrade-notes" - title: 紧急升级说明 ---- - - - - - - - - -# v1.16.0 - - -[文档](https://docs.k8s.io) - - -## 下载 v1.16.0 - - - - -文件名 | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes.tar.gz) | `99aa74225dd999d112ebc3e7b7d586a2312ec9c99de7a7fef8bbbfb198a5b4cf740baa57ea262995303e2a5060d26397775d928a086acd926042a41ef00f200b` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-src.tar.gz) | `0be7d1d6564385cc20ff4d26bab55b71cc8657cf795429d04caa5db133a6725108d6a116553bf55081ccd854a4078e84d26366022634cdbfffd1a34a10b566cf` - - -### 客户端可执行文件 - - - -文件名 | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-client-darwin-386.tar.gz) | `a5fb80d26c2a75741ad0efccdacd5d5869fbc303ae4bb1920a6883ebd93a6b41969f898d177f2602faf23a7462867e1235edeb0ba0675041d0c8d5ab266ec62d` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-client-darwin-amd64.tar.gz) | `47a9a78fada4b840d9ae4dac2b469a36d0812ac83d22fd798c4cb0f1673fb65c6558383c19a7268ed7101ac9fa32d53d79498407bdf94923f4f8f019ea39e912` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-client-linux-386.tar.gz) | `916e4dd98f5ed8ee111eeb6c2cf5c5f313e1d98f3531b40a5a777240ddb96b9cc53df101daa077ffff52cf01167fdcc39d38a8655631bac846641308634e127a` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-client-linux-amd64.tar.gz) | `fccf152588edbaaa21ca94c67408b8754f8bc55e49470380e10cf987be27495a8411d019d807df2b2c1c7620f8535e8f237848c3c1ac3791b91da8df59dea5aa` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-client-linux-arm.tar.gz) | `066c55fabbe3434604c46574c51c324336a02a5bfaed2e4d83b67012d26bf98354928c9c12758b53ece16b8567e2b5ce6cb88d5cf3008c7baf3c5df02611a610` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-client-linux-arm64.tar.gz) | `e41be74cc36240a64ecc962a066988b5ef7c3f3112977efd4e307b35dd78688f41d6c5b376a6d1152d843182bbbe75d179de75675548bb846f8c1e28827e0e0c` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-client-linux-ppc64le.tar.gz) | `08783eb3bb2e35b48dab3481e17d6e345d43bab8b8dee25bb5ff184ba46cb632750d4c38e9982366050aecce6e121c67bb6812dbfd607216acd3a2d19e05f5a1` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-client-linux-s390x.tar.gz) | `bcb6eb9cd3d8c92dfaf4f102ff2dc7517f632b1e955be6a02e7f223b15fc09c4ca2d6d9cd5b23871168cf6b455e2368daf17025c9cd61bf43d2ea72676db913a` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-client-windows-386.tar.gz) | `efbc764d8e2889ce13c9eaaa61f685a8714563ddc20464523140d6f5bef0dfd51b745c3bd3fe2093258db242bf9b3207f8e9f451b0484de64f18cdb7162ec30e` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-client-windows-amd64.tar.gz) | `b34bce694c6a0e4c8c5ddabcecb6adcb4d35f8c126b4b5ced7e44ef39cd45982dd9f6483a38e04430846f4da592dc74b475c37da7fe08444ef4eb5efde85e0b2` - - -### 服务器端可执行文件 - - - -文件名 | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-server-linux-amd64.tar.gz) | `a6bdac1eba1b87dc98b2bf5bf3690758960ecb50ed067736459b757fca0c3b01dd01fd215b4c06a653964048c6a81ea80b61ee8c7e4c98241409c091faf0cee1` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-server-linux-arm.tar.gz) | `0560e1e893fe175d74465065d43081ee7f40ba7e7d7cafa53e5d7491f89c61957cf0d3abfa4620cd0f33b6e44911b43184199761005d20b72e3cd2ddc1224f9f` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-server-linux-arm64.tar.gz) | `4d5dd001fa3ac2b28bfee64e85dbedab0706302ffd634c34330617674e7a90e0108710f4248a2145676bd72f0bbc3598ed61e1e739c64147ea00d3b6a4ba4604` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-server-linux-ppc64le.tar.gz) | `cc642fca57e22bf6edd371e61e254b369b760c67fa00cac50e34464470f7eea624953deff800fa1e4f7791fe06791c48dbba3ed47e789297ead889c2aa7b2bbf` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-server-linux-s390x.tar.gz) | `1f480ba6f593a3aa20203e82e9e34ac206e35839fd9135f495c5d154480c57d1118673dcb5a6b112c18025fb4a847f65dc7aac470f01d2f06ad3da6aa63d98a3` - - -### 节点可执行文件 - - - -文件名 | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-node-linux-amd64.tar.gz) | `e987f141bc0a248e99a371ce220403b78678c739a39dad1c1612e63a0bee4525fbca5ee8c2b5e5332a553cc5f63bce9ec95645589298f41fe83e1fd41faa538e` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-node-linux-arm.tar.gz) | `8b084c1063beda2dd4000e8004634d82e580f05cc300c2ee13ad84bb884987b2c7fd1f033fb2ed46941dfc311249acef06efe5044fb72dc4b6089c66388e1f61` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-node-linux-arm64.tar.gz) | `365bdf9759e24d22cf507a0a5a507895ed44723496985e6d8f0bd10b03ffe7c78198732ee39873912147f2dd840d2e284118fc6fc1e3876d8f4c2c3a441def0b` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-node-linux-ppc64le.tar.gz) | `ff54d83dd0fd3c447cdd76cdffd253598f6800045d2b6b91b513849d15b0b602590002e7fe2a55dc25ed5a05787f4973c480126491d24be7c5fce6ce98d0b6b6` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-node-linux-s390x.tar.gz) | `527cd9bf4bf392c3f097f232264c0f0e096ac410b5211b0f308c9d964f86900f5875012353b0b787efc9104f51ad90880f118efb1da54eba5c7675c1840eae5f` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0/kubernetes-node-windows-amd64.tar.gz) | `4f76a94c70481dd1d57941f156f395df008835b5d1cc17708945e8f560234dbd426f3cff7586f10fd4c24e14e3dfdce28e90c8ec213c23d6ed726aec94e9b0ff` - - -# Kubernetes v1.16.0 发行说明 - - -[relnotes.k8s.io](https://relnotes.k8s.io/?releaseVersions=1.16.0) 现已以可自定义的格式托管了发行说明的完整变更日志，请查看链接并向我们提供反馈！ - - -## 新增功能（主要主题） - - -我们很高兴宣布 Kubernetes 1.16 的交付，这是我们 2019 年的第三版！Kubernetes 1.16 由 31 个增强功能组成：8 个进入稳定，8 个进入 Beta，15 个进入 Alpha。 - - -Kubernetes 1.16 版本的四大主题如下： - - -- **Custom resources:** CRD 是对 Kubernetes 持久性的扩展，用以服务于新的资源类型，自 1.7 版本以来，CRD 已经在 Beta 版中可用。在 1.16 版本中，CRD 正式步入通用可用性（GA） -- **Admission webhooks:** Admission webhooks 作为 Kubernetes 扩展机制被广泛使用，并且自 1.9 版本以来已经在 Beta 版中可用。在 1.16 版本中，Admission webhook 也正式步入通用可用性（GA）。 -- **Overhauled metrics**: Kubernetes 广泛使用一个全局 metrics registry 来注册要公开的 metrics。通过实现 metrics registry，metrics 可以以更透明的方式注册。而在这之前，Kubernetes metrics 被排除在任何稳定性需求之外。 -- **Volume Extension**: 新版本有大量和 Volume（卷）及 Volume 修改相关的增强。CSI 规范中对 Volume 调整的支持正在转向 Beta 版，它允许任何 CSI 规范卷插件都可以调整大小。 - - -### 其他值得注意的功能更新 - - -- [拓扑管理器（Topology Manager）](https://github.com/kubernetes/enhancements/issues/693) 是一个新的 Kubelet 组件，旨在协调资源分配决策，以提供优化的资源分配。 -- [IPv4/IPv6 双栈](https://kubernetes.io/docs/concepts/services-networking/dual-stack) 允许将 IPv4 和 IPv6 地址分配给 Pod 和服务。 -- [API 服务器网络代理](https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/20190226-network-proxy.md) 在 1.16 版本中进入 Alpha。 -- [拓展（Extensions）](https://github.com/kubernetes/enhancements/blob/master/keps/sig-cloud-provider/20190422-cloud-controller-manager-migration.md) 为 Cloud Controller Manager 迁移提供的扩展。 -- 继续淘汰 extensions/v1beta1、apps/v1beta1 和 apps/v1beta2 API，这些扩展会在 1.16 版本中被弃用！ - - -## 已知的问题 - - -- etcd 和 KMS 插件的健康检查没有在新的 `livez` 和 `readyz` 端点中公开。这将在 v1.16.1 中得到修正。 -- 运行 `iptables` 1.8.0 或更新版本的系统应以兼容模式启动它。请注意，这将影响所有版本的 Kubernetes，而不仅仅是 v1.16.0。有关此问题以及如何应用解决方法的更多详细信息，请参阅官方文档。 -- 在名称中包含点的目录中生成软件包的通知程序已损坏，这将在 v1.16.1 中修复。请参考 ([#82860](https://github.com/kubernetes/kubernetes/issues/82860))。 - - -## 紧急升级须知 - - -### 注意！此内容为升级前必读！ - - -#### 集群生命周期 - - -- `amd64` 的容器镜像 tar 文件现在将在 manifest.json 的 RepoTags 节中给出体系结构。如果你正在使用 Docker 清单，则此变更对你没有影响。见 ([#80266](https://github.com/kubernetes/kubernetes/pull/80266)、[@javier-b-perez](https://github.com/javier-b-perez))。 - -- kubeadm 现在会在 TLS 启动引导完成之后删除 bootstrap-kubelet.conf 文件，依赖于 bootstrap-kubelet.conf 文件的用户应该切换到包含节点凭证的 kubelet.conf 文件。见 ([#80676](https://github.com/kubernetes/kubernetes/pull/80676)、[@fabriziopandini](https://github.com/fabriziopandini))。 - -- `beta.kubernetes.io/metadata-proxy-ready`、`beta.kubernetes.io/metadata-proxy-ready` 和 `beta.kubernetes.io/kube-proxy-ds-ready`（节点标签）不再添加到新节点上。 - - ip-mask-agent 插件开始使用标签 `node.kubernetes.io/masq-agent-ds-ready` 代替 `beta.kubernetes.io/masq-agent-ds-ready` 作为其节点选择器； - - kube-proxy 插件开始使用标签 `node.kubernetes.io/kube-proxy-ds-ready` 代替 `beta.kubernetes.io/kube-proxy-ds-ready` 作为其节点选择器； - - metadata-proxy 插件开始使用标签 `cloud.google.com/metadata-proxy-ready` 代替 `beta.kubernetes.io/metadata-proxy-ready` 作为其节点选择器； - - -#### 存储 - - -- 当为 CSI 驱动启用 PodInfoOnMount 时，Volume（卷）上下文中新的 csi.storage.k8s.io/ephemeral 参数允许驱动程序的 NodePublishVolume 实现根据具体情况确定该卷是临时性的还是正常的持久卷。见 ([#79983](https://github.com/kubernetes/kubernetes/pull/79983)、[@pohly](https://github.com/pohly))。 -- 为 VerifyVolumesAreAttached 和 BulkVolumeVerify 添加 CSI 迁移铺垫。见 ([#80443](https://github.com/kubernetes/kubernetes/pull/80443)、[@davidz627](https://github.com/davidz627))。 -- 新版本将 VolumePVCDataSource（克隆）特性提升到 Beta 版。见 ([#81792](https://github.com/kubernetes/kubernetes/pull/81792)、[@j-griffith](https://github.com/j-griffith))。 -- 将 in-tree 和 CSI（Volume）卷的（Volume）限制集成到一个调度器条件（Scheduler Predicate）。见 ([#77595](https://github.com/kubernetes/kubernetes/pull/77595)、[@bertinatto](https://github.com/bertinatto))。 - - -## 弃用和移除 - -- API - - - - 默认情况下不再提供以下 API： - - - - `apps/v1beta1` 和 `apps/v1` 下的所有资源 - 改用 `apps/v1` - - `extensions/v1beta1` 下的资源 `daemonsets`、`deployments`、`replicasets` - 改用 `apps/v1` - - `extensions/v1beta1` 下的资源 `networkpolicies` - 改用 `networking.k8s.io/v1` - - `extensions/v1beta1` 下的资源 `podsecuritypolicies` - 改用 `policy/v1beta1` - - - 可以使用 `--runtime-config` apiserver 参数临时重新启用服务这些资源。 - - - `apps/v1beta1=true` - - `apps/v1beta2=true` - - `extensions/v1beta1/daemonsets=true,extensions/v1beta1/deployments=true,extensions/v1beta1/replicasets=true,extensions/v1beta1/networkpolicies=true,extensions/v1beta1/podsecuritypolicies=true` - - - v1.18 中将完全删除提供这些资源的功能。见 ([#70672](https://github.com/kubernetes/kubernetes/pull/70672)、[@liggitt](https://github.com/liggitt))。 - - - - v1.20 中的 `extensions/v1beta1` 将不再提供 Ingress 资源。请迁移到自 v1.14 起可用的 `networking.k8s.io/v1beta1` API。可以通过 `networking.k8s.io/v1beta1` API 检索现有的持久数据。 - - v1.17 中将不再从 `scheduling.k8s.io/v1beta1` 和 `scheduling.k8s.io/v1alpha1` 提供 PriorityClass 资源。请迁移到自 v1.14 起可用的 `scheduling.k8s.io/v1` API。可以通过 `scheduling.k8s.io/v1` API 检索现有的持久数据。 - - - 自 v1.14 起已弃用的 list API 调用的 `export` 查询参数将在 v1.18 中删除。 - - events.k8s.io/v1beta1 事件 API 中的 `series.state` 字段已弃用，并将在 v1.18 中删除。见 ([#75987](https://github.com/kubernetes/kubernetes/pull/75987)、[@yastij](https://github.com/yastij))。 - - `CustomResourceDefinition` 的 `apiextensions.k8s.io/v1beta1` 版本已弃用，在 v1.19 中将不再提供，请改用 `apiextensions.k8s.io/v1`。见 ([#79604](https://github.com/kubernetes/kubernetes/pull/79604)、[@liggitt](https://github.com/liggitt))。 - - - `MutatingWebhookConfiguration` 和 `ValidatingWebhookConfiguration` 的 `admissionregistration.k8s.io/v1beta1` 版本已弃用，在 v1.19 中将不再提供。请改用 `admissionregistration.k8s.io/v1`。见 ([#79549](https://github.com/kubernetes/kubernetes/pull/79549)、[@liggitt](https://github.com/liggitt))。 - - 在 v1.13 版本中弃用的 alpha `metadata.initializers` 字段已被删除。见 ([#79504](https://github.com/kubernetes/kubernetes/pull/79504)、[@yue9944882](https://github.com/yue9944882))。 - - 已弃用的节点条件类型 `OutOfDisk` 已被删除，请改用 `DiskPressure`。([#72420](https://github.com/kubernetes/kubernetes/pull/72420)、[@Pingan2017](https://github.com/Pingan2017))。 - - - `metadata.selfLink` 字段在单个和列表对象中已弃用。从 v1.20 开始将不再返回该字段，而在 v1.21 中将完全删除该字段。见 ([#80978](https://github.com/kubernetes/kubernetes/pull/80978)、[@wojtek-t](https://github.com/wojtek-t))。 - - 已弃用的云提供商 `ovirt`、`cloudstack` 和 `photon` 已被删除。见 ([#72178](https://github.com/kubernetes/kubernetes/pull/72178), [@dims](https://github.com/dims))。 - - `Cinder` 和 `ScaleIO` volume（卷）驱动已被弃用，并将在以后的版本中删除。见 ([#80099](https://github.com/kubernetes/kubernetes/pull/80099), [@dims](https://github.com/dims))。 - - GA 版本中的 `PodPriority` 特性开关现在默认情况下处于打开状态，无法禁用。`PodPriority` 特性开关将在 v1.18 中删除。见 ([#79262](https://github.com/kubernetes/kubernetes/pull/79262), [@draveness](https://github.com/draveness))。 - - - 聚合的发现请求现在允许超时。聚合的 API 服务器必须在 5 秒钟内完成发现调用（其他请求可能需要更长的时间）。如果需要的话，使用 `EnableAggregatedDiscoveryTimeout=false` 将行为暂时恢复到之前的 30 秒超时（临时 `EnableAggregatedDiscoveryTimeout` 特性开关将在 v1.17 中删除）。见 ([#82146](https://github.com/kubernetes/kubernetes/pull/82146)、[@deads2k](https://github.com/deads2k))。 - - `scheduler.alpha.kubernetes.io/critical-pod` 注解将被删除。应该使用 Pod 优先级（`spec.priorityClassName`）来将 Pod 标记为关键。见 ([#80342](https://github.com/kubernetes/kubernetes/pull/80342)、[@draveness](https://github.com/draveness))。 - - 已从调度程序框架配置 API 中删除了 NormalizeScore 插件集合。仅使用 ScorePlugin。见 ([#80930](https://github.com/kubernetes/kubernetes/pull/80930)、[@liu-cong](https://github.com/liu-cong))。 - - -- 功能： - - - 现在，以下功能已成为 GA；相关的特性开关已弃用，并将在 v1.17 中删除： - - `GCERegionalPersistentDisk` (从 1.15.0 开始) - - `CustomResourcePublishOpenAPI` - - `CustomResourceSubresources` - - `CustomResourceValidation` - - `CustomResourceWebhookConversion` - - 功能参数 `HugePages`、`VolumeScheduling`、`CustomPodDNS` 和 `PodReadinessGates` 已被删除。见 ([#79307](https://github.com/kubernetes/kubernetes/pull/79307)、[@draveness](https://github.com/draveness))。 - -- hyperkube - - - - v1.14 中弃用的 `--make-symlinks` 参数已被删除。见 ([#80017](https://github.com/kubernetes/kubernetes/pull/80017)、[@Pothulapati](https://github.com/Pothulapati))。 - -- kube-apiserver - - - - `--basic-auth-file` 参数和身份验证模式已弃用，在以后的版本中将被删除。所以不建议在生产环境中使用。见 ([#81152](https://github.com/kubernetes/kubernetes/pull/81152), [@tedyu](https://github.com/tedyu))。 - - `--cloud-provider-gce-lb-src-cidrs` 参数已被弃用。一旦从 kube-apiserver 中删除了 GCE 云提供商，该参数将被删除。见 ([#81094](https://github.com/kubernetes/kubernetes/pull/81094), [@andrewsykim](https://github.com/andrewsykim))。 - - 从 v1.15 开始不推荐使用 `--enable-logs-handler` 参数和日志服务功能，并计划在 v1.19 中将其删除。见 ([#77611](https://github.com/kubernetes/kubernetes/pull/77611), [@rohitsardesai83](https://github.com/rohitsardesai83))。 - - 弃用默认服务 IP CIDR。先前的默认值为 10.0.0.0/24，将在 6 个月或者 2 个发行版中删除。集群管理员必须通过在 kube-apiserver 上使用 `--service-cluster-ip-range` 来指定自己的 IP 期望值。见 ([#81668](https://github.com/kubernetes/kubernetes/pull/81668), [@darshanime](https://github.com/darshanime))。 - -- kube-proxy - - - - `--resource-container` 参数已从 kube-proxy 中删除，现在指定它会导致错误。现在的行为就好像你指定了 `--resource-container=""`。如果以前指定了非空 `--resource-container`，则从 kubernetes 1.16 开始，你将无法再这样做。见 ([#78294](https://github.com/kubernetes/kubernetes/pull/78294)、[@vllry](https://github.com/vllry))。 - -- kube-scheduler - - - - 调度程序开始使用 v1beta1 Event API。任何针对调度程序事件的工具都需要使用 v1beta1 事件 API。见 ([#78447](https://github.com/kubernetes/kubernetes/pull/78447)、[@yastij](https://github.com/yastij))。 - -- kubeadm - - - - 现在，CoreDNS Deployment 通过 `ready` 插件检查准备情况。 - - `proxy` 插件已被弃用，可以使用 `forward` 插件。 - - `kubernetes` 插件删除了 `resyncperiod` 选项。 - - `upstream` 选项已被弃用，如果包含的话，则忽略。见 ([#82127](https://github.com/kubernetes/kubernetes/pull/82127), [@rajansandeep](https://github.com/rajansandeep))。 - -- kubectl - - - - 从 v1.14 开始不推荐使用 `kubectl convert`，该参数将在 v1.17 中删除。 - - 从 v1.14 开始不推荐使用 `kubectl get` 命令的 `--export`，该参数将在 v1.18 中删除。 - - `kubectl cp` 不再支持从容器复制符号链接；要支持此用例，请参阅 `kubectl exec --help` 获取直接使用 `tar` 的示例。见 ([#82143](https://github.com/kubernetes/kubernetes/pull/82143)、[@soltysh](https://github.com/soltysh))。 - - 删除不推荐使用的参数 `--include-uninitialized`。见 ([#80337](https://github.com/kubernetes/kubernetes/pull/80337)、[@draveness](https://github.com/draveness))。 - -- kubelet - - - - `--containerized` 参数在 v1.14 中已弃用，并且已被删除。见 ([#80043](https://github.com/kubernetes/kubernetes/pull/80043)、[@dims](https://github.com/dims))。 - - 从 v1.14 开始不推荐使用 `beta.kubernetes.io/os` 和 `beta.kubernetes.io/arch` 标签，这些标签将在 v1.18 中删除。 - - 从 v1.15 开始不推荐使用 cAdvisor json 端点。见 ([#78504](https://github.com/kubernetes/kubernetes/pull/78504)、[@dashpole](https://github.com/dashpole))。 - - 删除通过 `--node-labels` 设置 `kubernetes.io` 或 `k8s.io` 前缀的标签的功能，除了[明确允许的标签/前缀](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/0000-20170814-bounding-self-labeling-kubelets.md#proposal)。见 ([#79305](https://github.com/kubernetes/kubernetes/pull/79305)、[@paivagustavo](https://github.com/paivagustavo))。 - -- client-go - - - 删除 `DirectCodecFactory` (替换为 `serializer.WithoutConversionCodecFactory`)、`DirectEncoder` (替换为 `runtime.WithVersionEncoder`) 和 `DirectDecoder` (替换为 `runtime.WithoutVersionDecoder`)。见 ([#79263](https://github.com/kubernetes/kubernetes/pull/79263)、[@draveness](https://github.com/draveness))。 - - -## 指标（Metrics）变化 - - -### 新增的指标 - - -- 添加了指标 `aggregator_openapi_v2_regeneration_count`、`aggregator_openapi_v2_regeneration_gauge` 和 `apiextension_openapi_v2_regeneration_count`，用于计算（添加，更新，删除）触发 APIServic e和 CRD 以及 kube-apiserver 重新生成 OpenAPI 规范时的原因。见 ([#81786](https://github.com/kubernetes/kubernetes/pull/81786)、[@sttts](https://github.com/sttts))。 - -- 添加了可用于了解身份验证尝试的指标 `authentication_attempts`。见 ([#81509](https://github.com/kubernetes/kubernetes/pull/81509)、[@RainbowMango](https://github.com/RainbowMango))。 - -- 添加了新的计数指标 `apiserver_admission_webhook_rejection_count`，该指标详细说明了引起 webhook 拒绝的原因。见 ([#81399](https://github.com/kubernetes/kubernetes/pull/81399)、[@roycaihw](https://github.com/roycaihw))。 - -- 现在已启用 NFS 驱动程序来收集指标,StatFS 指标提供程序用于收集指标。见 ([#75805](https://github.com/kubernetes/kubernetes/pull/75805)、[@brahmaroutu](https://github.com/brahmaroutu))。 - -- 添加了指标 `container_sockets`、`container_threads` 和 `container_threads_max`。见 ([#81972](https://github.com/kubernetes/kubernetes/pull/81972)、[@dashpole](https://github.com/dashpole))。 - -- 在 kubelet `running_container_count` 指标上添加了 `container_state` 标签，以根据容器的状态（running/exited/created/unknown）获得容器的数量。见 ([#81573](https://github.com/kubernetes/kubernetes/pull/81573)、[@irajdeep](https://github.com/irajdeep))。 -- 添加了指标 `apiserver_watch_events_total`，可用于了解系统中监视事件的数量。见 ([#78732](https://github.com/kubernetes/kubernetes/pull/78732)、[@mborsz](https://github.com/mborsz))。 - -- 添加了指标 `apiserver_watch_events_sizes`，可用于估计系统中监视事件的大小。见 ([#80477](https://github.com/kubernetes/kubernetes/pull/80477)、[@mborsz](https://github.com/mborsz))。 - -- 为 kube-proxy iptables-restore 失败（ipvs 和 iptables 模式）添加了新的 Prometheus 计数器指标 `sync_proxy_rules_iptables_restore_failures_total`。见 ([#81210](https://github.com/kubernetes/kubernetes/pull/81210)、[@figo](https://github.com/figo))。 -- 现在，kubelet 提出指标 `kubelet_evictions`，该指标用于计算 kubelet 为回收资源而执行的驱逐 Pod 的次数。见 ([#81377](https://github.com/kubernetes/kubernetes/pull/81377)、[@sjenning](https://github.com/sjenning))。 - - -### 已删除的指标 - - -- 删除了 cadvisor 指标标签 `pod_name` 和 `container_name` 以符合仪器指南。任何与 `pod_name` 和 `container_name` 标签匹配的 Prometheus 查询（例如 cadvisor 或 kubelet 探针指标）都必须更新为使用 `pod` 和 `container` 标签。见 ([#80376](https://github.com/kubernetes/kubernetes/pull/80376), [@ehashman](https://github.com/ehashman))。 - - -### 被弃用或者更改的指标 - - -- 现在，kube-controller-manager 和 cloud-controller-manager 指标已被标记为 ALPHA 稳定性级别。见 ([#81624](https://github.com/kubernetes/kubernetes/pull/81624)、[@logicalhan](https://github.com/logicalhan))。 - -- 现在，kube-proxy 指标已被标记为 ALPHA 稳定性级别。见 ([#81626](https://github.com/kubernetes/kubernetes/pull/81626)、[@logicalhan](https://github.com/logicalhan))。 - -- 现在，kube-apiserver 指标已被标记为 ALPHA 稳定性级别。见 ([#81531](https://github.com/kubernetes/kubernetes/pull/81531)、[@logicalhan](https://github.com/logicalhan))。 - -- /metrics 和 /metrics/probes 的 kubelet 指标已被标记为 ALPHA 稳定性级别。见 ([#81534](https://github.com/kubernetes/kubernetes/pull/81534)、[@logicalhan](https://github.com/logicalhan))。 - -- Scheduler 指标已被标记为 ALPHA 稳定性级别。见 ([#81576](https://github.com/kubernetes/kubernetes/pull/81576)、[@logicalhan](https://github.com/logicalhan))。 - -- 现在，`apiserver_admission_webhook_admission_duration_seconds` 指标中的 `rejected` 标签可以正确显示请求是否被拒绝。见 ([#81399](https://github.com/kubernetes/kubernetes/pull/81399)、[@roycaihw](https://github.com/roycaihw))。 - -- 修复了 CSI 指标中的错误，即当 CSI 驱动程序不支持指标时，指标不会返回不支持的错误。见 ([#79851](https://github.com/kubernetes/kubernetes/pull/79851)、[@jparklab](https://github.com/jparklab))。 - -- 修复了使用 ZFS 存储池时 LXD 中的磁盘统计信息错误和 CRI-O 缺少网络指标的错误。见 ([#81972](https://github.com/kubernetes/kubernetes/pull/81972)、[@dashpole](https://github.com/dashpole))。 - - -## 重要功能 - - -### Beta 功能 - - -- 将 WatchBookmark 功能升级为 Beta 功能并默认启用它。 - 借助 WatchBookmark 功能，客户端可以请求具有 BOOKMARK 类型的监视事件。客户端不应该假定书签在任何特定的时间间隔内返回，也不能假定服务器将在会话期间发送任何 BOOKMARK 事件。见 ([#79786](https://github.com/kubernetes/kubernetes/pull/79786)、[@wojtek-t](https://github.com/wojtek-t))。 - -- 服务器端 apply 功能现在是 Beta 功能。见 ([#81956](https://github.com/kubernetes/kubernetes/pull/81956)、[@apelisse](https://github.com/apelisse))。 -- 服务器端 apply 功能现在将使用 CRD 验证字段中提供的 openapi 来帮助弄清楚如何正确合并对象和更新所有权。见 ([#77354](https://github.com/kubernetes/kubernetes/pull/77354)、[@jennybuckley](https://github.com/jennybuckley))。 - -- `CustomResourceDefaulting` 功能被提升为 Beta 功能并默认启用。可以通过 `apiextensions.k8s.io/v1` API 在结构模式中指定默认值。有关详细信息，请参见 https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/#specifying-a-structural-schema。见 ([#81872](https://github.com/kubernetes/kubernetes/pull/81872)、[@sttts](https://github.com/sttts))。 - -- 服务负载均衡器的 Finalizer 保护现在处于 Beta（默认启用）功能。该功能确保在删除相关的负载均衡器资源之前，不会完全删除服务资源。见 ([#81691](https://github.com/kubernetes/kubernetes/pull/81691)、[@MrHohn](https://github.com/MrHohn))。 -- 将 Windows GMSA 支持从 Alpha 升级到 Beta。见 ([#82110](https://github.com/kubernetes/kubernetes/pull/82110)、[@wk8](https://github.com/wk8))。 - - -### Alpha 功能 - - -- 为 RuntimeClass 引入新的准入控制器。最初，如果指定了相应的 RuntimeClassName，则将使用 RuntimeClass 与给定 RuntimeClass 关联的 Pod 开销应用于 Pod `spec`。从 Kubernetes 1.16 开始，PodOverhead 是 Alpha 功能。见 ([#78484](https://github.com/kubernetes/kubernetes/pull/78484), [@egernst](https://github.com/egernst))。 - -- 将 Pod 开销功能引入调度程序。从 Kubernetes v1.16 开始，此功能为 alpha 级别，并且只有启用 PodOverhead 特性开关的服务器才能使用该功能。见 ([#78319](https://github.com/kubernetes/kubernetes/pull/78319)、[@egernst](https://github.com/egernst))。 - -- 临时容器已添加为 Alpha 功能。可以将这些临时容器添加到运行的 Pod 中，以进行调试之用，类似于 `kubectl exec` 如何在现有容器中运行进程。与 `kubectl exec` 一样，kubernetes 不为临时容器预留资源，并且这些容器退出时不会被重新启动。请注意，尚未实现容器命名空间定位，因此必须启用[进程命名空间共享](https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/)才能从 Pod 中的其他容器查看进程。见 ([#59484](https://github.com/kubernetes/kubernetes/pull/59484), [@verb](https://github.com/verb))。 - -- 作为 Alpha 功能，添加了 Pod 分布约束（Pod spread constraints）。可以使用这些约束来控制 Pod 如何在故障域之间跨集群分布。见 ([#77327](https://github.com/kubernetes/kubernetes/pull/77327)、[#77760](https://github.com/kubernetes/kubernetes/pull/77760)、[#77828](https://github.com/kubernetes/kubernetes/pull/77828)、[#79062](https://github.com/kubernetes/kubernetes/pull/79062)、[#80011](https://github.com/kubernetes/kubernetes/pull/80011)、[#81068](https://github.com/kubernetes/kubernetes/pull/81068)、[@Huang-Wei](https://github.com/Huang-Wei)) - - -### CLI 的改进 - - -- kube-controller-manager 中的新参数 `--endpoint-updates-batch-period` 可用于减少由 Pod 更改生成的端点更新的数量。见 ([#80509](https://github.com/kubernetes/kubernetes/pull/80509)、[@mborsz](https://github.com/mborsz))。 - -- `kubectl wait` 支持 kubectl `--all-namespaces` 参数。见 ([#81468](https://github.com/kubernetes/kubernetes/pull/81468), [@ashutoshgngwr](https://github.com/ashutoshgngwr))。 - -- `kubectl get -w` 现在带有 `--output-watch-events` 参数来显示事件类型（已添加、已修改、已删除）。见 ([#72416](https://github.com/kubernetes/kubernetes/pull/72416), [@liggitt](https://github.com/liggitt))。 - -- 启用发现 API 组时，添加对 kubectl 的端点切片支持。见 ([#81795](https://github.com/kubernetes/kubernetes/pull/81795)、[@robscott](https://github.com/robscott))。 - - -### 其他杂项 - - -- 将 `--shutdown-delay-duration` 添加到 kube-apiserver 中以延迟正常关闭。在这段时间内，`/healthz` 将继续返回成功，并且请求将正常处理，但是 `/readyz` 将立即返回失败。此延迟可用于允许 SDN 更新所有节点上的 iptables 并停止发送流量。见 ([#74416](https://github.com/kubernetes/kubernetes/pull/74416)、[@sttts](https://github.com/sttts))。 - 现在，kubeadm 在升级 CoreDNS 时无差异地迁移 CoreDNS 配置。见 ([#78033](https://github.com/kubernetes/kubernetes/pull/78033)、[@rajansandeep](https://github.com/rajansandeep))。 - -- 添加端点切片控制器（Endpoint Slice Controller），用于管理新的 EndpointSlice 资源，默认情况下处于禁用状态。见 ([#81048](https://github.com/kubernetes/kubernetes/pull/81048)、[@robscott](https://github.com/robscott))。 - -- 添加 `\livez` 用来检查 kube-apiserver 的活动状况。使用参数 `--maximum-startup-sequence-duration` 将使活动端点将启动序列故障推迟指定的持续时间。见 ([#81969](https://github.com/kubernetes/kubernetes/pull/81969)、[@logicalhan](https://github.com/logicalhan))。 - -- 可将 EndpointSlice 集成添加到 kube-proxy，此功能可通过 EndpointSlice 特性开关启用。 - -- 将 status 条件添加到命名空间资源。见 ([#73405](https://github.com/kubernetes/kubernetes/pull/73405)、[@wozniakjan](https://github.com/wozniakjan))。 - -- 增强 Azure 云提供程序代码用来支持 AAD 和 ADFS 身份验证。见 ([#80841](https://github.com/kubernetes/kubernetes/pull/80841)、[@rjaini](https://github.com/rjaini))。 - -- kubeadm：实现对堆叠的 etcd 成员的并发添加或删除的支持。见 ([#79677](https://github.com/kubernetes/kubernetes/pull/79677)、[@neolit123](https://github.com/neolit123))。 - -- kubeadm：支持任何 3.10 以上的 Linux 内核版本。见 ([#81623](https://github.com/kubernetes/kubernetes/pull/81623)、[@neolit123](https://github.com/neolit123))。 -- 在默认的 GCE 存储类中启用了卷扩展。见 ([#78672](https://github.com/kubernetes/kubernetes/pull/78672)、[@msau42](https://github.com/msau42))。 -- kubeadm ClusterConfiguration 现在支持特性开关：IPv6DualStack：true。见 ([#80145](https://github.com/kubernetes/kubernetes/pull/80145)、[@Arvinderpal](https://github.com/Arvinderpal))。 - -- 为了在 kubeadm 和 kubernetes 组件中启用双栈支持，作为 init config file 的一步，用户应在 ClusterConfiguration 中设置 `IPv6DualStack=true`。此外，对于每个工作节点，用户应使用 `nodeRegistration.kubeletExtraArgs` 或 `KUBELET_EXTRA_ARGS` 设置 kubelet 的特性开关功能。见 ([#80531](https://github.com/kubernetes/kubernetes/pull/80531), [@Arvinderpal](https://github.com/Arvinderpal))。 - -- 允许将控制器管理器配置为使用 IPv6 双协议栈： - 使用 `--cluster-cidr=","`。 - 注意： - 1. 仅使用前两个 CIDR（对 Alpha 功能的软限制，稍后可能会取消）。 - 2. 仅将 "RangeAllocator"（默认值）作为 --cidr-allocator-type 的值。云分配器与 IPv6 双协议栈不兼容。见 ([#73977](https://github.com/kubernetes/kubernetes/pull/73977)、[@khenidak](https://github.com/khenidak))。 - -- 添加对 RuntimeClasses 的调度支持。现在，RuntimeClasses 可以指定 nodeSelector 约束和容忍度，并使用该 RuntimeClass 将约束和容忍合并到 PodSpec 中。见 ([#80825](https://github.com/kubernetes/kubernetes/pull/80825)、[@tallclair](https://github.com/tallclair))。 - -- 当使用 `--cgroup-driver=systemd` 指定 `--(kube|system)-reserved-cgroup` 时，现在可以使用完全限定的 cgroupfs 名称（即 `/test-cgroup.slice`）。见 ([#78793](https://github.com/kubernetes/kubernetes/pull/78793)、[@mattjmcnaughton](https://github.com/mattjmcnaughton))。 - -- 在 Windows 上增加了对 vSphere 卷的支持。见 ([#80911](https://github.com/kubernetes/kubernetes/pull/80911)、[@gab-satchi](https://github.com/gab-satchi))。 - - -## API 变更 - - -- `MutatingWebhookConfiguration` 和 `ValidatingWebhookConfiguration` API 已升级为 `admissionregistration.k8s.io/v1`： - - v1 的默认 `failurePolicy` 从 `Ignore` 更改为 `Fail` - - v1 的默认 `matchPolicy` 从 `Exact` 更改为 `Equivalent` - - v1 的默认 `timeout` 从 `30s` 更改为 `10s` - - 删除了 `sideEffects` 默认值，并且该字段为必填字段，v1 仅允许使用 `None` 和 `NoneOnDryRun` - - 删除了 `admissionReviewVersions` 默认值，并为 v1 设置了必填字段（AdmissionReview 支持的版本为 `v1` 和 `v1beta1`） - - 对于通过 `admissionregistration.k8s.io/v1` 创建的 `MutatingWebhookConfiguration` 和 `ValidatingWebhookConfiguration` 对象，指定 Webhook 的 `name` 字段必须唯一 - -- 发送到 admission webhook 和从 admission webhook 接收到的 `AdmissionReview` API 已升级为 `admission.k8s.io/v1`。Webhooks 可以指定使用 `admissionReviewVersions: ["v1","v1beta1"]` 接收 `v1` AdmissionReview 对象的首选项，并且必须在发送它们的同一 `apiVersion` 中以 API 对象进行响应。当 Webhooks 使用 `admission.k8s.io/v1` 时，将对其响应执行以下附加验证： - - `response.patch` 和 `response.patchType` 不允许验证 admission webhooks - - `apiVersion: "admission.k8s.io/v1"` 是必需的 - - `kind: "AdmissionReview"` 是必需的 - - `response.uid: ""` 是必需的 - - `response.patchType: "JSONPatch"` 是必需的（前提是设置了 `response.patch`）见 ([#80231](https://github.com/kubernetes/kubernetes/pull/80231), [@liggitt](https://github.com/liggitt))。 - -- 通过以下更改将 `CustomResourceDefinition` API 类型升级为 `apiextensions.k8s.io/v1`： - - 在验证模式中使用新的 `default`，该功能仅限于 v1 - - `spec.scope` 不再默认为 `Namespaced`，必须明确指定 `spec.scope` - - v1 中删除了 `spec.version`；改用 `spec.versions` - - v1 中删除了 `spec.validation`；改用 `spec.versions[*].schema` - - v1 中删除了 `spec.subresources`；改用 `spec.versions[*].subresources` - - v1 中删除了 `spec.additionalPrinterColumns`；改用 `spec.versions[*].additionalPrinterColumns` - - 在 v1 中将 `spec.conversion.webhookClientConfig` 移至 `spec.conversion.webhook.clientConfig` - - 在 v1 中将 `spec.conversion.conversionReviewVersions` 移至 `spec.conversion.webhook.conversionReviewVersions` - - 现在，在创建 v1 CustomResourceDefinitions 时需要 `spec.versions[*].schema.openAPIV3Schema` - - 创建 v1 CustomResourceDefinitions 时不允许使用 `spec.preserveUnknownFields: true`；必须在模式定义中将其指定为 `x-kubernetes-preserve-unknown-fields: true`。 - - 在 `additionalPrinterColumns` 项目中，将 `JSONPath` 字段在 v1 中重命名为 `jsonPath`，见 [参考](https://github.com/kubernetes/kubernetes/issues/66531)。 - `CustomResourceDefinition` 的 `apiextensions.k8s.io/v1beta1` 版本已弃用，在 v1.19 中将不再提供。见 ([#79604](https://github.com/kubernetes/kubernetes/pull/79604)、[@liggitt](https://github.com/liggitt))。 - -- 发送到自定义资源 CustomResourceDefinition 转换 webhooks 和从中接收 `ConversionReview` 的 API 已升级为 `apiextensions.k8s.io/v1`。现在，通过在 CustomResourceDefinition 的 `conversionReviewVersions` 列表中包含 `v1`，CustomResourceDefinition 转换 webhooks 可以表示它们支持 `apiextensions.k8s.io/v1` 版本中的 `ConversionReview` API 对象进行接收和响应。转换 webhooks 必须在收到的 apiVersion 中以 ConversionReview 对象作为响应。`apiextensions.k8s.io/v1` `ConversionReview` 响应必须指定一个 `response.uid` 来匹配发送对象的 `request.uid`。见 ([#81476](https://github.com/kubernetes/kubernetes/pull/81476)、[@liggitt](https://github.com/liggitt))。 - -- 添加对 RuntimeClasses 的调度支持。现在，RuntimeClasses 可以指定 nodeSelector 约束和容忍度，并使用该 RuntimeClass 将约束和容忍合并到 PodSpec 中。见 ([#80825](https://github.com/kubernetes/kubernetes/pull/80825)、[@tallclair](https://github.com/tallclair)) - -- 现在，即使云平台所报告的节点 IP 集合发生了变化，kubelet 也应该能够更可靠地报告相同的主节点 IP。见 ([#79391](https://github.com/kubernetes/kubernetes/pull/79391), [@danwinship](https://github.com/danwinship))。 - -- 计算容器哈希值时会忽略 `nil` 或空字段，以避免哈希值更改。对于容器规范中默认值为非 `nil` 的新字段，哈希值仍会更改。见 ([#57741](https://github.com/kubernetes/kubernetes/pull/57741)、[@dixudx](https://github.com/dixudx))。 - -- 现在，`apiextensions.v1beta1.CustomResourceDefinitionStatus` 和 `apiextensions.v1.CustomResourceDefinitionStatus` 中的 `conditions` 属性是可选的，而不是必需的。见 ([#64996](https://github.com/kubernetes/kubernetes/pull/64996)、[@roycaihw](https://github.com/roycaihw))。 - -- 当 CustomResourceDefinition 条件的状态更改时，现在将更新其对应的 `lastTransitionTime`。见 ([#69655](https://github.com/kubernetes/kubernetes/pull/69655)、[@CaoShuFeng](https://github.com/CaoShuFeng))。 - - -## 其他值得注意的变更 - - -### API Machinery - - -- 从 `pkg/api/ref` 中删除 `GetReference()` 和 `GetPartialReference()` 函数，因为在 `staging/src/k8s.io/client-go/tools/ref` 中也存在相同的函数。见 ([#80361](https://github.com/kubernetes/kubernetes/pull/80361)、[@wojtek-t](https://github.com/wojtek-t))。 -- 验证是否修改了 OpenAPI 规范中的 CRD 默认值，但 `metadata` 下的值除外。见 ([#78829](https://github.com/kubernetes/kubernetes/pull/78829)、[@sttts](https://github.com/sttts))。 -- 修复了一个 bug，即当出现 “connection refused” 错误时，反射器的 ListAndWatch 函数将直接返回，但预期的是睡眠 1 秒钟并从指定的 resourceVersion 重新开始监视。见 ([#81634](https://github.com/kubernetes/kubernetes/pull/81634)、[@likakuli](https://github.com/likakuli))。 - -- 解决了由非 2xx HTTP 响应对 `/` 请求的服务支持的聚合 API 的问题。见 ([#79895](https://github.com/kubernetes/kubernetes/pull/79895)、[@deads2k](https://github.com/deads2k))。 -- CRD 处理程序现在可以正确地重新创建过时的 CR 存储，以反映 CRD 更新。见 ([#79114](https://github.com/kubernetes/kubernetes/pull/79114)、[@roycaihw](https://github.com/roycaihw))。 -- 修复 CVE-2019-11247：API 服务器允许通过错误的范围访问自定义资源。见 ([#80750](https://github.com/kubernetes/kubernetes/pull/80750)、[@sttts](https://github.com/sttts))。 - -- 修复了带有 `io.k8s.apimachinery.pkg.runtime.RawExtension` 的 openAPI 定义的错误，该错误以前需要指定字段 `raw`。见 ([#80773](https://github.com/kubernetes/kubernetes/pull/80773), [@jennybuckley](https://github.com/jennybuckley))。 -- 现在，`apiextensions.v1beta1.CustomResourceDefinitionStatus` 和 `apiextensions.v1.CustomResourceDefinitionStatus` 中的 `conditions` 属性是可选的，而不是必需的。见 ([#64996](https://github.com/kubernetes/kubernetes/pull/64996)、[@roycaihw](https://github.com/roycaihw))。 -- 解决服务器启动期间对自定义资源请求的瞬态 404 响应。见 ([#81244](https://github.com/kubernetes/kubernetes/pull/81244)、[@liggitt](https://github.com/liggitt))。 - -- OpenAPI 现在可以为自定义资源公布其正确支持的补丁程序类型。见 ([#81515](https://github.com/kubernetes/kubernetes/pull/81515)、[@liggitt](https://github.com/liggitt))。 -- 当 CRD 条件的状态改变时，现在将更新其对应的 `lastTransitionTime`。见 ([#69655](https://github.com/kubernetes/kubernetes/pull/69655)、[@CaoShuFeng](https://github.com/CaoShuFeng))。 -- 将 `metadata.generation=1` 添加到旧的 CustomResources 中。见 ([#82005](https://github.com/kubernetes/kubernetes/pull/82005)、[@sttts](https://github.com/sttts))。 - -- 修复了 apiserver 中的一个错误，该错误可能导致有效的更新请求因前提条件检查失败而被拒绝。见 ([#82303](https://github.com/kubernetes/kubernetes/pull/82303)、[@roycaihw](https://github.com/roycaihw))。 -- 修复了后端关闭代理连接时记录虚假堆栈跟踪的回归问题。见 ([#82588](https://github.com/kubernetes/kubernetes/pull/82588)、[@liggitt](https://github.com/liggitt))。 -- RateLimiter 添加了 context-aware 方法，修复了异步超时场景中的 client-go 请求 goruntine backlog 问题。见 ([#79375](https://github.com/kubernetes/kubernetes/pull/79375)、[@answer1991](https://github.com/answer1991))。 - -- 在 `ScaleInterface` 中添加 `Patch` 方法。见 ([#80699](https://github.com/kubernetes/kubernetes/pull/80699)、[@knight42](https://github.com/knight42))。 -- k8s.io 和 kubernetes.io 下的 CRD 必须将 `api-approved.kubernetes.io` 设置为 `unapproved.*` 或指向批准该模式下的拉取请求的链接。有关更多详细信息，请参见 https://github.com/kubernetes/enhancements/pull/1111。见 ([#79992](https://github.com/kubernetes/kubernetes/pull/79992)、[@deads2k](https://github.com/deads2k))。 -- KMS 提供商将在 kube-apiservers 的加密配置中安装 kms 状态的运行状况检查插件。见 ([#78540](https://github.com/kubernetes/kubernetes/pull/78540)、[@immutableT](https://github.com/immutableT))。 - -- 改进自定义资源的验证错误。([#81212](https://github.com/kubernetes/kubernetes/pull/81212)、[@liggitt](https://github.com/liggitt))。 -- 在创建时填充准入属性的对象名称。见 ([#53185](https://github.com/kubernetes/kubernetes/pull/53185)、[@dixudx](https://github.com/dixudx))。 -- 作为 Pod Overhead KEP 的一部分，将 Overhead 字段添加到 PodSpec 和 RuntimeClass 类型中。见 ([#76968](https://github.com/kubernetes/kubernetes/pull/76968)、[@egernst](https://github.com/egernst))。 - -### Apps - - -- 修复了守护程序控制器（daemon controller）无法从不匹配的节点删除 Pod 的错误。见 ([#78974](https://github.com/kubernetes/kubernetes/pull/78974)、[@DaiHao](https://github.com/DaiHao))。 -- 修复了当存在失败的 Pod 时导致 DaemonSet 滚动更新挂起的错误。见 ([#78170](https://github.com/kubernetes/kubernetes/pull/78170)、[@DaiHao](https://github.com/DaiHao))。 - - -### 验证码（Auth） - - -- 服务帐户令牌现在在其头部（header）中包含 JWT 密钥 ID 字段。见 ([#78502](https://github.com/kubernetes/kubernetes/pull/78502)、[@ahmedtd](https://github.com/ahmedtd))。 -- 如果 nbf（不早于）声明在 ID 令牌中存在，则现在强制执行。见 ([#81413](https://github.com/kubernetes/kubernetes/pull/81413)、[@anderseknert](https://github.com/anderseknert))。 - - -### CLI（命令行界面） - - -- 修复 CVE-2019-11249：CVE-2019-1002101 和 CVE-2019-11246 的修补程序不完整，kubectl cp 可能遍历目录。见 ([#80436](https://github.com/kubernetes/kubernetes/pull/80436)、[@M00nF1sh](https://github.com/M00nF1sh))。 - -- 使用覆盖参数修复 bash 自动完成错误。见 ([#80802](https://github.com/kubernetes/kubernetes/pull/80802)、[@dtaniwaki](https://github.com/dtaniwaki))。 - -- 修复了源代码 printers 函数中可能导致 kube-apiserver 崩溃的错误。见 ([#79349](https://github.com/kubernetes/kubernetes/pull/79349)、[@roycaihw](https://github.com/roycaihw))。 - -- 当 kubectl cp 操作复制一个文件时，修复无效的 "time stamp is the future" 错误。见 ([#73982](https://github.com/kubernetes/kubernetes/pull/73982)、[@tanshanshan](https://github.com/tanshanshan))。 - -- 修复了 `kubectl set config` 挂起并在某些无效的属性名称上使用 100％ CPU 的错误。见 ([#79000](https://github.com/kubernetes/kubernetes/pull/79000)、[@pswica](https://github.com/pswica))。 - -- 监视某个资源时修复 `kubectl get --watch-only` 输出内容。见 ([#79345](https://github.com/kubernetes/kubernetes/pull/79345)、[@liggitt](https://github.com/liggitt))。 - -- 遇到错误时，确保 `kubectl get --ignore-not-found` 操作继续进行。见 ([#82120](https://github.com/kubernetes/kubernetes/pull/82120)、[@soltysh](https://github.com/soltysh))。 - -- 在文档中更正对不再使用的 kustomize 子命令的引用。见 ([#82535](https://github.com/kubernetes/kubernetes/pull/82535)、[@demobox](https://github.com/demobox))。 - -- kubectl 可以再次扩展自定义资源。见 ([#81342](https://github.com/kubernetes/kubernetes/pull/81342)、[@knight42](https://github.com/knight42))。 - -- 在 kubectl 中添加 PodOverhead 预知。见 ([#81929](https://github.com/kubernetes/kubernetes/pull/81929)、[@egernst](https://github.com/egernst))。 - - -### 云提供商 - - -- 由 Azure 标准负载均衡器支持的 k8s 集群中创建负载均衡器类型服务时，在 Azure 标准负载均衡器中添加的相应负载均衡器规则现在会将 “EnableTcpReset” 属性设置为 true。见 ([#80624](https://github.com/kubernetes/kubernetes/pull/80624)、[@xuto2](https://github.com/xuto2))。 - -- 在关联或者摘除的磁盘操作中现使用 VM Update 调用，原来的 CreateOrUpdate 调用可能导致孤立的 VM 或资源阻塞。见 ([#81208](https://github.com/kubernetes/kubernetes/pull/81208)、[@andyzhangx](https://github.com/andyzhangx))。 - -- 修复了由于区分大小写而导致的 Azure 磁盘命名匹配问题。见 ([#81720](https://github.com/kubernetes/kubernetes/pull/81720)、[@andyzhangx](https://github.com/andyzhangx))。 - -- 修复了在 Azure 上删除节点时的重试问题。见 ([#80419](https://github.com/kubernetes/kubernetes/pull/80419)、[@feiskyer](https://github.com/feiskyer))。 - -- 当其他 Azure 操作取消请求时，修复冲突的缓存问题。见 ([#81282](https://github.com/kubernetes/kubernetes/pull/81282)、[@feiskyer](https://github.com/feiskyer))。 - -- 修复了使 Azure 磁盘 URI 不区分大小写的问题。见 ([#79020](https://github.com/kubernetes/kubernetes/pull/79020)、[@andyzhangx](https://github.com/andyzhangx))。 - -- 修复了 VMSS 负载均衡器后端池问题，以便在实例升级到最新模型时不会断开网络。见 ([#81411](https://github.com/kubernetes/kubernetes/pull/81411)、[@nilo19](https://github.com/nilo19))。 - -- 当注解 `azure-load-balancer-resource-group` 的值为空字符串时，应使用默认 resourceGroup。见 ([#79514](https://github.com/kubernetes/kubernetes/pull/79514)、[@feiskyer](https://github.com/feiskyer))。 - -- 如果现在没有配置 subscriptionId，则可以在没有 Azure 身份的情况下运行 kubelet。 - 一个云提供商配置示例为：'{"vmType": "vmss", "useInstanceMetadata": true}'。见 ([#81500](https://github.com/kubernetes/kubernetes/pull/81500)、[@feiskyer](https://github.com/feiskyer))。 - -- 修复 VMSS 节点未找到公共 IP 的问题。见 ([#80703](https://github.com/kubernetes/kubernetes/pull/80703)、[@feiskyer](https://github.com/feiskyer))。 - -- 修复 Azure 客户端请求在 http.StatusTooManyRequests（HTTP 代码 429）上卡住的问题。([#81279](https://github.com/kubernetes/kubernetes/pull/81279)、[@feiskyer](https://github.com/feiskyer))。 - -- 添加服务注解 `service.beta.kubernetes.io/azure-pip-name`，用于指定 Azure 负载均衡器的公共 IP 名称。见 ([#81213](https://github.com/kubernetes/kubernetes/pull/81213)、[@nilo19](https://github.com/nilo19))。 - -- 在可能的情况下，通过查询实例 ID 而不是 EC2 过滤器来优化 AWS 云提供商库中的 EC2 DescribeInstances API 调用。见 ([#78140](https://github.com/kubernetes/kubernetes/pull/78140)、[@zhan849](https://github.com/zhan849))。 - -- 创建注解 `service.beta.kubernetes.io/aws-load-balancer-eip-allocations`，用于将 AWS EIP 分配给新创建的 Network Load Balancer，其中分配数量和子网必须匹配。见 ([#69263](https://github.com/kubernetes/kubernetes/pull/69263)、[@brooksgarrett](https://github.com/brooksgarrett))。 - -- 添加 Azure 云配置 `LoadBalancerName` 和 `LoadBalancerResourceGroup`，用于允许对 Azure 负载均衡器进行相应的自定义。见 ([#81054](https://github.com/kubernetes/kubernetes/pull/81054)、[@nilo19](https://github.com/nilo19))。 - -### 集群生命周期 - - -- 修复 kubeadm upgrade diff 命令中的错误处理和潜在的空指针异常。见 ([#80648](https://github.com/kubernetes/kubernetes/pull/80648)、[@odinuge](https://github.com/odinuge))。 - -- kubeadm：在某些 HTTP 错误的情况下回退到客户端版本。见 ([#80024](https://github.com/kubernetes/kubernetes/pull/80024)、[@RainbowMango](https://github.com/RainbowMango))。 - -- kubeadm：修复了因 kubeadm 发现无效的、现有的 kubeconfig 文件而可能引起的崩溃问题。见 ([#79165](https://github.com/kubernetes/kubernetes/pull/79165)、[@neolit123](https://github.com/neolit123))。 - - -- kubeadm：重置时将非严重错误视为警告。见 ([#80862](https://github.com/kubernetes/kubernetes/pull/80862)、[@drpaneas](https://github.com/drpaneas))。 - -- kubeadm：通过使用非 root 用户防止 PSP 阻止升级镜像提前拉取操作。见 ([#77792](https://github.com/kubernetes/kubernetes/pull/77792)、[@neolit123](https://github.com/neolit123))。 - -- kubeadm：修复了使用文件发现时未预加载 “certificate-authority” 文件的问题。见 ([#80966](https://github.com/kubernetes/kubernetes/pull/80966)、[@neolit123](https://github.com/neolit123))。 - -- 添加设置 “应用程序默认凭证” 说明，用于在本地运行 GCE Windows e2e 测试。见 ([#81337](https://github.com/kubernetes/kubernetes/pull/81337)、[@YangLu1031](https://github.com/YangLu1031))。 - -- 当使用具有嵌入式凭据的发现文件时，修复 `kubeadm join --discovery-file` 操作中的错误。见 ([#80675](https://github.com/kubernetes/kubernetes/pull/80675)、[@fabriziopandini](https://github.com/fabriziopandini))。 - -- 修复在 kubeadm 重置期间从集群中删除 etcd 成员问题。见 ([#79326](https://github.com/kubernetes/kubernetes/pull/79326)、[@bradbeam](https://github.com/bradbeam))。 - -- kubeadm：生成的 CSR 文件的权限从 0644 更改为 0600。见 ([#81217](https://github.com/kubernetes/kubernetes/pull/81217)、[@SataQiu](https://github.com/SataQiu))。 - -- kubeadm：升级提前拉取 DaemonSet 时，避免两次删除操作。见 ([#80798](https://github.com/kubernetes/kubernetes/pull/80798)、[@xlgao-zju](https://github.com/xlgao-zju))。 - -- kubeadm：在阶段命令 `kubeadm init phase certs` 操作中引入确定性顺序用于生成证书。见 ([#78556](https://github.com/kubernetes/kubernetes/pull/78556)、[@neolit123](https://github.com/neolit123))。 - -- kubeadm：加入节点时，针对某些 ConfigMap 失败实施重试逻辑操作。见 ([#78915](https://github.com/kubernetes/kubernetes/pull/78915)、[@ereslibre](https://github.com/ereslibre))。 - -- kubeadm：使用 etcd 的 /health 端点进行本地主机上的 HTTP 活跃探针操作，而不是使用 etcdctl 进行自定义健康检查。见 ([#81385](https://github.com/kubernetes/kubernetes/pull/81385)、[@neolit123](https://github.com/neolit123))。 - -- kubeadm reset：仅在 Linux `/var/lib/kubelet` 下卸载目录。见 ([#81494](https://github.com/kubernetes/kubernetes/pull/81494)、[@Klaven](https://github.com/Klaven))。 - -- kubeadm：修复 `--cri-socket` 参数不适用于 `kubeadm reset` 操作的错误。见 ([#79498](https://github.com/kubernetes/kubernetes/pull/79498)、[@SataQiu](https://github.com/SataQiu))。 - -- kubeadm：如果在重置控制平面节点的集群状态时发生错误，则会产生错误。见 ([#80573](https://github.com/kubernetes/kubernetes/pull/80573)、[@bart0sh](https://github.com/bart0sh))。 - -- 修复了在使用外部 etcd 时将 etcd 证书与 kubeadm 用于本地 etcd 证书的名称存储在同一文件夹中的错误；对于较旧版本的 kubeadm，解决方法是避免 kubeadm 用于本地 etcd 的文件名。见 ([#80867](https://github.com/kubernetes/kubernetes/pull/80867)、[@fabriziopandini](https://github.com/fabriziopandini))。 - -- 如果基于文件的发现时间过长，则 `kubeadm join` 操作会失败，默认超时为 5 分钟。见 ([#80804](https://github.com/kubernetes/kubernetes/pull/80804)、[@olivierlemasle](https://github.com/olivierlemasle))。 - -- kubeadm：修复了拉取控制平面镜像时忽略错误的问题。见 ([#80529](https://github.com/kubernetes/kubernetes/pull/80529)、[@bart0sh](https://github.com/bart0sh))。 - -- 修复了 kube-addon-manager 的领导者选举逻辑中的一个错误，该错误使所有副本均处于活跃状态。见 ([#80575](https://github.com/kubernetes/kubernetes/pull/80575)、[@mborsz](https://github.com/mborsz))。 - -- kubeadm：如果用户希望修改某些 kubelet 安全配置参数，则可以防止它们被覆盖。见 ([#81903](https://github.com/kubernetes/kubernetes/pull/81903)、[@jfbai](https://github.com/jfbai))。 - -- kubeadm 在其启动前检查中不再执行 IPVS 检查。见 ([#81791](https://github.com/kubernetes/kubernetes/pull/81791)、[@yastij](https://github.com/yastij))。 - -- kubeadm：修复 IPv6 地址的 HTTPProxy 检查问题。见 ([#82267](https://github.com/kubernetes/kubernetes/pull/82267)、[@kad](https://github.com/kad))。 - -- kubeadm：允许用户在初始化过程中跳过 kube-proxy 初始化插件阶段，但是仍然可以加入集群并执行其他一些次要操作（不能升级）。见 ([#82248](https://github.com/kubernetes/kubernetes/pull/82248)、[@rosti](https://github.com/rosti))。 - -- 将主机上的 `/home/kubernetes/bin/nvidia/vulkan/icd.d` 挂载到请求 GPU 的容器内的 `/etc/vulkan/icd.d`。见 ([#78868](https://github.com/kubernetes/kubernetes/pull/78868)、[@chardch](https://github.com/chardch))。 - -- kubeadm：使用 `--pod-network-cidr` 参数初始化或使用 kubeadm 配置中的 podSubnet 字段传递以逗号分隔的 Pod CIDR 列表。见 ([#79033](https://github.com/kubernetes/kubernetes/pull/79033)、[@Arvinderpal](https://github.com/Arvinderpal))。 - -- kubeadm：为 `controlPlaneEndpoint` 提供 `--control-plane-endpoint` 参数。见 ([#79270](https://github.com/kubernetes/kubernetes/pull/79270)、[@SataQiu](https://github.com/SataQiu))。 - -- kubeadm：为 kube-scheduler 启用安全服务。见 ([#80951](https://github.com/kubernetes/kubernetes/pull/80951)、[@neolit123](https://github.com/neolit123))。 - -- kubeadm：打印 klog 级别 `--v> = 5` 的错误的堆栈跟踪信息。见 ([#80937](https://github.com/kubernetes/kubernetes/pull/80937)、[@neolit123](https://github.com/neolit123))。 - -- 将 `--kubernetes-version` 添加到 `kubeadm init phase certs ca` 和 `kubeadm init phase kubeconfig` 中。见 ([#80115](https://github.com/kubernetes/kubernetes/pull/80115)、[@gyuho](https://github.com/gyuho))。 - -- kubeadm：支持从原始集群中获取配置信息以进行 `upgrade diff` 操作。见 ([#80025](https://github.com/kubernetes/kubernetes/pull/80025)、[@SataQiu](https://github.com/SataQiu))。 - -- 当使用一致性测试镜像时，新的环境变量 `E2E_USE_GO_RUNNER` 将使测试使用基于 golang 的新测试运行程序而不是当前的 bash 包装程序运行。见 ([#79284](https://github.com/kubernetes/kubernetes/pull/79284)、[@johnSchnake](https://github.com/johnSchnake))。 - -- 实施一项新功能，该功能允许将 kustomize 修补程序应用于 kubeadm 生成的静态 pod 清单。见 ([#80905](https://github.com/kubernetes/kubernetes/pull/80905)、[@fabriziopandini](https://github.com/fabriziopandini))。 - -- GCE Ingress 负载均衡器的 404 请求处理程序现在可以支持导出 Prometheus 指标，包括： - - - `http_404_request_total` （已处理的 404 请求数目） - - `http_404_request_duration_ms` （服务器响应所花费的时间（以毫秒为单位）） - - 还包括百分位数分组。默认 404 处理程序的目录包括有关如何启用 Prometheus 来监视和设置警报的说明。见 ([#79106](https://github.com/kubernetes/kubernetes/pull/79106)、[@vbannai](https://github.com/vbannai))。 - - -### 监控设施 - - -- Kibana 已在最新版本中进行了稍微的修改或改进。见 ([#80421](https://github.com/kubernetes/kubernetes/pull/80421)、[@lostick](https://github.com/lostick))。 - - -### 网络 - - -- 修复了 IPVS 正常终止操作中不删除 UDP 真实服务器的字符串比较错误。见 ([#78999](https://github.com/kubernetes/kubernetes/pull/78999)、[@andrewsykim](https://github.com/andrewsykim))。 -- 如果清除成功，`kube-proxy --cleanup will` 返回正确的退出代码。见 ([#78775](https://github.com/kubernetes/kubernetes/pull/78775)、[@johscheuer](https://github.com/johscheuer))。 -- 修复了 IPVS 代理中的一个错误，该错误是即使删除了相应的 Service 对象，也无法清理虚拟服务器。见 ([#80942](https://github.com/kubernetes/kubernetes/pull/80942)、[@gongguan](https://github.com/gongguan))。 - -- kube-proxy 等待一段时间用来定义节点。见 ([#77167](https://github.com/kubernetes/kubernetes/pull/77167)、[@paulsubrata55](https://github.com/paulsubrata55))。 -- 将体面终止的日志级别增加到 `v=5`。见 ([#80100](https://github.com/kubernetes/kubernetes/pull/80100)、[@andrewsykim](https://github.com/andrewsykim))。 -- 当存在大量 nodePort 服务时，减少 IPVS 模式下的 kube-proxy CPU 使用率。见 ([#79444](https://github.com/kubernetes/kubernetes/pull/79444)、[@cezarsa](https://github.com/cezarsa))。 - -- 修复了针对 SCTP nodePort 服务的 kube-proxy 问题，该服务仅适用于节点的 InternalIP，但不适用于启用 ipvs 时节点中存在的其他 IP。见 ([#81477](https://github.com/kubernetes/kubernetes/pull/81477)、[@paulsubrata55](https://github.com/paulsubrata55))。 -- 确保 `KUBE-MARK-DROP` 链处于 kube-proxy IPVS 模式。在双栈操作中为 IPv4 和 IPv6 均确保该链。见 ([#82214](https://github.com/kubernetes/kubernetes/pull/82214)、[@uablrek](https://github.com/uablrek))。 -- 在 Alpha 功能中引入 `node.kubernetes.io/exclude-balancer` 和 `node.kubernetes.io/exclude-disruption` 标签，用于防止集群部署者依赖于并非所有集群都可以提供的可选 `node-role` 标签。见 ([#80238](https://github.com/kubernetes/kubernetes/pull/80238)、[@smarterclayton](https://github.com/smarterclayton))。 -- 如果 targetPort 更改，则将由服务控制器处理 targetPort。见 ([#77712](https://github.com/kubernetes/kubernetes/pull/77712)、[@Sn0rt](https://github.com/Sn0rt))。 - - -### 节点 - - -- 禁用相关功能开关时，删除 PID cgroup 控制器要求。见 ([#79073](https://github.com/kubernetes/kubernetes/pull/79073)、[@rafatio](https://github.com/rafatio))。 -- 修复 kubelet 节点租赁潜在的性能问题。kubelet 现在将尝试使用缓存的租约来更新租约，而不是每次都从 API Server 获取租约。见 ([#81174](https://github.com/kubernetes/kubernetes/pull/81174)、[@answer1991](https://github.com/answer1991))。 -- 现在，在 `--cpu-manager-policy` 参数中传递无效的策略名称将导致 kubelet 失败，而不是简单地忽略该参数并运行 `cpumanager` 的默认策略。见 ([#80294](https://github.com/kubernetes/kubernetes/pull/80294)、[@klueska](https://github.com/klueska))。 -- 根据 kubelet 中的节点状态更新频率使节点租约更新间隔更具启发性。见 ([#80173](https://github.com/kubernetes/kubernetes/pull/80173)、[@gaorong](https://github.com/gaorong))。 - -- 现在，即使云提供商报告中的节点 IP 集合发生了变化，kubelet 也应该更可靠地报告相同的主节点 IP。见 ([#79391](https://github.com/kubernetes/kubernetes/pull/79391))、([@danwinship](https://github.com/danwinship))。 -- 计算容器哈希值时请忽略 `nil` 或空字段，以避免哈希值更改。对于容器规范中默认值为非 `nil` 的新字段，哈希值仍会更改。见 ([#57741](https://github.com/kubernetes/kubernetes/pull/57741)、[@dixudx](https://github.com/dixudx))。 -- 修复了当 Pod 的重启策略设置为 Never 时，kubelet 不会重试 Pod 沙盒创建的问题。见 ([#79451](https://github.com/kubernetes/kubernetes/pull/79451)、[@yujuhong](https://github.com/yujuhong))。 -- 限制执行 readiness 或 liveness 探测的主体长度。远程 CRI 和 Docker Shim 读取的最大输出为 16 MB，而执行探针本身将检查 10kb 的输出。见 ([#82514](https://github.com/kubernetes/kubernetes/pull/82514)、[@dims](https://github.com/dims))。 - -- 单个静态 Pod 文件和来自 http 端点的 Pod 文件不能大于 10 MB。HTTP 探针负载现在被截断为 10 KB。见 ([#82669](https://github.com/kubernetes/kubernetes/pull/82669)、[@rphillips](https://github.com/rphillips))。 -- 如果启用了 PodOverhead 功能，则将引入了 Pod 开销应用于 Pod cgroup 的支持。见 ([#79247](https://github.com/kubernetes/kubernetes/pull/79247)、[@egernst](https://github.com/egernst))。 -- 在 GCI 上使用 Node-Problem-Detector v0.7.1。见 ([#80726](https://github.com/kubernetes/kubernetes/pull/80726)、[@wangzhen127](https://github.com/wangzhen127))。 -- Node-Problem-Detector v0.7.1 用于插件 daemonset。见 ([#82140](https://github.com/kubernetes/kubernetes/pull/82140)、[@wangzhen127](https://github.com/wangzhen127))。 - -- 启用 cAdvisor ProcessMetrics 指标收集。见 ([#79002](https://github.com/kubernetes/kubernetes/pull/79002)、[@jiayingz](https://github.com/jiayingz))。 -- kubelet：将 `node-lease-renew-interval` 更改为 0.25 的续租期限。见 ([#80429](https://github.com/kubernetes/kubernetes/pull/80429)、[@gaorong](https://github.com/gaorong))。 -- 如果 `--cloud-provider=external` 并且不存在节点地址，则尝试设置 kubelet 的主机名和内部 IP。见 ([#75229](https://github.com/kubernetes/kubernetes/pull/75229)、[@andrewsykim](https://github.com/andrewsykim))。 - - -### 调度 - - -- 当 Scheduler 丢失领导者锁时，Scheduler 应终止。见 ([#81306](https://github.com/kubernetes/kubernetes/pull/81306)、[@ravisantoshgudimetla](https://github.com/ravisantoshgudimetla))。 -- 如果 scheduler 扩展程序过滤了一个未找到的节点，则此 Pod 的当前调度回合将被跳过。见 ([#79641](https://github.com/kubernetes/kubernetes/pull/79641)、[@yqwang-ms](https://github.com/yqwang-ms))。 -- Extender 绑定应该匹配 IsInterested。见 ([#79804](https://github.com/kubernetes/kubernetes/pull/79804)、[@yqwang-ms](https://github.com/yqwang-ms))。 -- 解决了 PodTolerationRestriction admission controller（准入控制器）中的容忍合并和白名单检查问题。见 ([#81732](https://github.com/kubernetes/kubernetes/pull/81732)、[@tallclair](https://github.com/tallclair))。 - -- 添加一个工具函数来解码 scheduler 插件参数。见 ([#80696](https://github.com/kubernetes/kubernetes/pull/80696)、[@hex108](https://github.com/hex108))。 -- 修复抢占期间未调用过滤器插件。见 ([#81876](https://github.com/kubernetes/kubernetes/pull/81876)、[@wgliang](https://github.com/wgliang))。 -- 修复了以下问题：定义了多个 PluginConfig 项时，正确的 PluginConfig.Args 没有传递到 kube-scheduler 中的相应 PluginFactory。见 ([#82483](https://github.com/kubernetes/kubernetes/pull/82483)、[@everpeace](https://github.com/everpeace))。 -- 将上下文作为 Scheduler 的第一个参数。见 ([#82119](https://github.com/kubernetes/kubernetes/pull/82119)、[@wgliang](https://github.com/wgliang))。 - -- 为调度框架实现 `post-filter` 扩展。见 ([#78097](https://github.com/kubernetes/kubernetes/pull/78097)、[@draveness](https://github.com/draveness))。 -- 添加调度框架的绑定扩展点。见 ([#78513](https://github.com/kubernetes/kubernetes/pull/78513)、[@chenchun](https://github.com/chenchun))。 -- 将过滤器扩展点添加到调度框架。见 ([#78477](https://github.com/kubernetes/kubernetes/pull/78477)、[@YoubingLi](https://github.com/YoubingLi))。 -- 当计分插件返回分数超出 `[0, 100]` 范围时，返回错误。见 ([#81015](https://github.com/kubernetes/kubernetes/pull/81015)、[@draveness](https://github.com/draveness))。 - -- 在规范化评分阶段，使用命名数组而不是分数数组。见 ([#80901](https://github.com/kubernetes/kubernetes/pull/80901)、[@draveness](https://github.com/draveness))。 -- 更新 `requestedToCapacityRatioArguments` 用于添加资源参数，该参数允许用户指定资源名称以及每种资源的权重，基于请求与容量之比为节点评分。见 ([#77688](https://github.com/kubernetes/kubernetes/pull/77688)、[@sudeshsh](https://github.com/sudeshsh))。 -- 为调度框架添加 `UnschedulableAndUnresolvable` 状态码。见 ([#82034](https://github.com/kubernetes/kubernetes/pull/82034)、[@alculquicondor](https://github.com/alculquicondor))。 - -- 为调度框架添加标准化插件扩展点。见 ([#80383](https://github.com/kubernetes/kubernetes/pull/80383)、[@liu-cong](https://github.com/liu-cong))。 -- 将绑定扩展点添加到调度框架。见 ([#79313](https://github.com/kubernetes/kubernetes/pull/79313)、[@chenchun](https://github.com/chenchun))。 -- 将 Score 扩展点添加到调度框架。见 ([#79109](https://github.com/kubernetes/kubernetes/pull/79109)、[@ahg-g](https://github.com/ahg-g))。 -- 将预过滤器扩展点添加到调度框架。见 ([#78005](https://github.com/kubernetes/kubernetes/pull/78005)、[@ahg-g](https://github.com/ahg-g))。 -- 添加对列出树形自定义调度程序插件的支持。见 ([#78162](https://github.com/kubernetes/kubernetes/pull/78162)、[@hex108](https://github.com/hex108))。 - - -### 存储 - - -- 修复 `doSafeMakeDir` 中可能的文件描述符泄漏和目录关闭。见 ([#79534](https://github.com/kubernetes/kubernetes/pull/79534)、[@odinuge](https://github.com/odinuge))。 -- 如果共享类型的 Azure 磁盘不包含 `skuname` 或 `storageaccounttype`，它们将不再失败。见 ([#80837](https://github.com/kubernetes/kubernetes/pull/80837)、[@rmweir](https://github.com/rmweir))。 -- 修复了 CSI 插件支持不需要附加安装的原始块失败的问题。见 ([#79920](https://github.com/kubernetes/kubernetes/pull/79920)、[@cwdsuzhou](https://github.com/cwdsuzhou))。 -- 将 GCE PD 节点附加限制减 1，因为节点启动磁盘被视为可附加磁盘。见 ([#80923](https://github.com/kubernetes/kubernetes/pull/80923)、[@davidz627](https://github.com/davidz627))。 - -- 删除日志中的 iSCSI 卷存储明文密钥。见 (https://github.com/kubernetes/kubernetes/pull/81215)、[@zouyee](https://github.com/zouyee))。 -- 修复了对使用嵌入式卷源创建的 VolumeAttachment API 对象的验证。见 ([#80945](https://github.com/kubernetes/kubernetes/pull/80945)、[@tedyu](https://github.com/tedyu))。 -- 将 csi 插件中的超时值从 15 s 更改为 2 min，从而解决了超时问题。见 ([#79529](https://github.com/kubernetes/kubernetes/pull/79529)、[@andyzhangx](https://github.com/andyzhangx))。 -- 修复 kubelet 的 Pod 目录（默认为 `/var/lib/kubelet/pods`）象征性地链接到另一个磁盘设备的目录时，kubelet 无法删除孤立的 pod 目录的问题。见 ([#79094](https://github.com/kubernetes/kubernetes/pull/79094)、[@gaorong](https://github.com/gaorong))。 - -## 测试 - - -- 修正 Pod 列表返回值为 `framework.WaitForPodsWithLabelRunningReady`。见 ([#78687](https://github.com/kubernetes/kubernetes/pull/78687)、[@pohly](https://github.com/pohly))。 -- 将 `TerminationGracePeriodSeconds` 添加到测试框架 API 中。见 ([#82170](https://github.com/kubernetes/kubernetes/pull/82170)、[@vivekbagade](https://github.com/vivekbagade))。 -- `/test/e2e/framework`：添加一个参数 `non-blocking-taints`，该参数允许测试在带有污染节点的环境中运行。字符串的值应为逗号分隔的列表。见 ([#81043](https://github.com/kubernetes/kubernetes/pull/81043)、[@johnSchnake](https://github.com/johnSchnake))。 - -- 将 CSI 卷扩展移动到 Beta 功能。见 ([#81467](https://github.com/kubernetes/kubernetes/pull/81467)、[@bertinatto](https://github.com/bertinatto))。 -- 添加了验证 WindowsOptions.RunAsUserName 的 E2E 测试。见 ([#79539](https://github.com/kubernetes/kubernetes/pull/79539)、[@bclau](https://github.com/bclau))。 -- `framework.ExpectNoError` 不再记录错误，而是依靠使用新的 `log.Fail` 作为 Gomega 故障处理程序。见 ([#80253](https://github.com/kubernetes/kubernetes/pull/80253)、[@pohly](https://github.com/pohly))。 - -### Windows - - -- 在 Windows 系统上，如果 `%HOMEDRIVE%\%HOMEPATH%` 不包含 `.kube\config` 文件并且 `%USERPROFILE%` 存在且可写，那么 `%USERPROFILE%` 现在比 `%HOMEDRIVE%\%HOMEPATH%` 更适合作为主文件夹。见 ([#73923](https://github.com/kubernetes/kubernetes/pull/73923)、[@liggitt](https://github.com/liggitt))。 -- 在 Windows 上添加对 AWS EBS 的支持。见 ([#79552](https://github.com/kubernetes/kubernetes/pull/79552)、[@wongma7](https://github.com/wongma7))。 -- 在 Windows 节点上支持 kubelet 插件监视程序。见 ([#81397](https://github.com/kubernetes/kubernetes/pull/81397)、[@ddebroy](https://github.com/ddebroy))。 - -## 相关依赖 - - -### 变更 - - -- 默认的 Go 版本已更新至 v1.12.9。见 ([#78958](https://github.com/kubernetes/kubernetes/pull/78958)、[#79966](https://github.com/kubernetes/kubernetes/pull/79966)、[#81390](https://github.com/kubernetes/kubernetes/pull/81390)、[#81489](https://github.com/kubernetes/kubernetes/pull/81489))。 -- etcd 已更新至 v3.3.15。见 ([#82199](https://github.com/kubernetes/kubernetes/pull/82199)、[@dims](https://github.com/dims))。 -- 适用于 kubeadm 和 kube-up 的 CoreDNS 已更新至 v1.6.2。见 ([#82127](https://github.com/kubernetes/kubernetes/pull/82127))。 -- 集群自动扩缩已更新至 v1.16.0。见 ([#82501](https://github.com/kubernetes/kubernetes/pull/82501)、[@losipiuk](https://github.com/losipiuk))。 -- fluentd 已更新至 v1.5.1。见 ([#79014](https://github.com/kubernetes/kubernetes/pull/79014))。 -- fluentd-elasticsearch 插件已更新至 v3.5.3。见 ([#79014](https://github.com/kubernetes/kubernetes/pull/79014))。 -- elasticsearch 已更新至 v7.1.1。见 ([#79014](https://github.com/kubernetes/kubernetes/pull/79014))。 -- kibana 已更新至 v7.1.1。见 ([#79014](https://github.com/kubernetes/kubernetes/pull/79014))。 -- Azure SDK 和 go-autorest API 版本已更新。见 ([#79574](https://github.com/kubernetes/kubernetes/pull/79574))。 -- Azure API 版本已更新（容器 registry 到 2018-09-01，网络到 2018-08-01）。见 ([#79583](https://github.com/kubernetes/kubernetes/pull/79583))。 -- kube-addon-manager 已更新至 v9.0.2。见 ([#80861](https://github.com/kubernetes/kubernetes/pull/80861))。 -- golang/x/net 已更新，引入针对 CVE-2019-9512、CVE-2019-9514 的修复程序。见 ([#81394](https://github.com/kubernetes/kubernetes/pull/81394))。 -- GCE windows 节点镜像已更新。见 ([#81106](https://github.com/kubernetes/kubernetes/pull/81106))。 -- portworx 插件已在 libopenstorage/openstorage 上更新为 v1.0.0。见 ([#80495](https://github.com/kubernetes/kubernetes/pull/80495))。 -- metrics-server 已更新至 v0.3.4。见 ([#82322](https://github.com/kubernetes/kubernetes/pull/82322)、[@olagacek](https://github.com/olagacek))。 -- klog 已更新至 v0.4.0。见 ([#81164](https://github.com/kubernetes/kubernetes/pull/81164))。 - - -### 不变 - - -- 经过验证的 Docker 版本列表保持不变。 - - 当前列表是 1.13.1、17.03、17.06、17.09、18.06、8.09。见 ([#72823](https://github.com/kubernetes/kubernetes/pull/72823)、[#72831](https://github.com/kubernetes/kubernetes/pull/72831))。 -- CNI 保持在 v0.7.5 不变。见 ([#75455](https://github.com/kubernetes/kubernetes/pull/75455))。 -- cri-tools 保持在 v1.14.0 不变。见 ([#75658](https://github.com/kubernetes/kubernetes/pull/75658))。 -- CAdvisor 保持在 v0.33.2 不变。见 ([#76291](https://github.com/kubernetes/kubernetes/pull/76291))。 -- event-exporter 保持在 v0.2.5 不变。见 ([#77815](https://github.com/kubernetes/kubernetes/pull/77815))。 -- ip-masq-agent 保持在 v2.4.1 不变。见 ([#77844](https://github.com/kubernetes/kubernetes/pull/77844))。 -- k8s-dns-node-cache 保持在 v1.15.1 不变。见 ([#76640](https://github.com/kubernetes/kubernetes/pull/76640)、[@george-angel](https://github.com/george-angel))。 -- CSI 保持在 v1.1.0 不变。见 ([#75391](https://github.com/kubernetes/kubernetes/pull/75391))。 -- dashboard 插件保持在 v1.10.1 不变。见 ([#72495](https://github.com/kubernetes/kubernetes/pull/72495))。 -- 从 Kubernetes 1.12 开始，kube-dns 保持在 v1.14.13 不变。见 ([#68900](https://github.com/kubernetes/kubernetes/pull/68900))。 -- 从 Kubernetes 1.10 开始，Influxdb 保持在 v1.3.3 不变。见 ([#53319](https://github.com/kubernetes/kubernetes/pull/53319))。 -- 从 Kubernetes 1.10 开始，Grafana 保持在 v4.4.3 不变。见 ([#53319](https://github.com/kubernetes/kubernetes/pull/53319))。 -- fluentd-elasticsearch 中的 fluent-plugin-kubernetes_metadata_filter 插件保持在 v2.1.6 不变。见 ([#71180](https://github.com/kubernetes/kubernetes/pull/71180))。 -- 从 Kubernetes 1.13 开始，fluentd-gcp 保持在 v3.2.0 不变。见 ([#70954](https://github.com/kubernetes/kubernetes/pull/70954))。 -- 从 Kubernetes 1.10 开始，OIDC 身份验证保持在 coreos/go-oidc v2 不变。见 ([#58544](https://github.com/kubernetes/kubernetes/pull/58544))。 -- 从 Kubernetes 1.13 开始，Calico 保持在 v3.3.1 不变。见 ([#70932](https://github.com/kubernetes/kubernetes/pull/70932))。 -- 从 Kubernetes 1.12 开始，GLBC 保持在 v1.2.3 不变。见 ([#66793](https://github.com/kubernetes/kubernetes/pull/66793))。 -- 从 Kubernetes 1.12 开始，Ingress-gce 保持在 v1.2.3 不变。见 ([#66793](https://github.com/kubernetes/kubernetes/pull/66793))。 - - -### 删除 - - -- 删除不推荐使用的 github.com/kardianos/osext 依赖项。见 ([#80142](https://github.com/kubernetes/kubernetes/pull/80142))。 - - -### 详细的 go 依赖项变更 - - -#### 添加的依赖项 - -- github.com/Azure/go-autorest/autorest/adal: [v0.5.0](https://github.com/Azure/go-autorest/autorest/adal/tree/v0.5.0) -- github.com/Azure/go-autorest/autorest/date: [v0.1.0](https://github.com/Azure/go-autorest/autorest/date/tree/v0.1.0) -- github.com/Azure/go-autorest/autorest/mocks: [v0.2.0](https://github.com/Azure/go-autorest/autorest/mocks/tree/v0.2.0) -- github.com/Azure/go-autorest/autorest/to: [v0.2.0](https://github.com/Azure/go-autorest/autorest/to/tree/v0.2.0) -- github.com/Azure/go-autorest/autorest/validation: [v0.1.0](https://github.com/Azure/go-autorest/autorest/validation/tree/v0.1.0) -- github.com/Azure/go-autorest/autorest: [v0.9.0](https://github.com/Azure/go-autorest/autorest/tree/v0.9.0) -- github.com/Azure/go-autorest/logger: [v0.1.0](https://github.com/Azure/go-autorest/logger/tree/v0.1.0) -- github.com/Azure/go-autorest/tracing: [v0.5.0](https://github.com/Azure/go-autorest/tracing/tree/v0.5.0) -- github.com/armon/consul-api: [eb2c6b5](https://github.com/armon/consul-api/tree/eb2c6b5) -- github.com/bifurcation/mint: [93c51c6](https://github.com/bifurcation/mint/tree/93c51c6) -- github.com/caddyserver/caddy: [v1.0.3](https://github.com/caddyserver/caddy/tree/v1.0.3) -- github.com/cenkalti/backoff: [v2.1.1+incompatible](https://github.com/cenkalti/backoff/tree/v2.1.1) -- github.com/checkpoint-restore/go-criu: [bdb7599](https://github.com/checkpoint-restore/go-criu/tree/bdb7599) -- github.com/cheekybits/genny: [9127e81](https://github.com/cheekybits/genny/tree/9127e81) -- github.com/coredns/corefile-migration: [v1.0.2](https://github.com/coredns/corefile-migration/tree/v1.0.2) -- github.com/coreos/go-etcd: [v2.0.0+incompatible](https://github.com/coreos/go-etcd/tree/v2.0.0) -- github.com/dustin/go-humanize: [v1.0.0](https://github.com/dustin/go-humanize/tree/v1.0.0) -- github.com/fatih/color: [v1.6.0](https://github.com/fatih/color/tree/v1.6.0) -- github.com/flynn/go-shlex: [3f9db97](https://github.com/flynn/go-shlex/tree/3f9db97) -- github.com/go-acme/lego: [v2.5.0+incompatible](https://github.com/go-acme/lego/tree/v2.5.0) -- github.com/go-bindata/go-bindata: [v3.1.1+incompatible](https://github.com/go-bindata/go-bindata/tree/v3.1.1) -- github.com/go-logr/logr: [v0.1.0](https://github.com/go-logr/logr/tree/v0.1.0) -- github.com/google/martian: [v2.1.0+incompatible](https://github.com/google/martian/tree/v2.1.0) -- github.com/google/pprof: [3ea8567](https://github.com/google/pprof/tree/3ea8567) -- github.com/google/renameio: [v0.1.0](https://github.com/google/renameio/tree/v0.1.0) -- github.com/googleapis/gax-go/v2: [v2.0.4](https://github.com/googleapis/gax-go/v2/tree/v2.0.4) -- github.com/hashicorp/go-syslog: [v1.0.0](https://github.com/hashicorp/go-syslog/tree/v1.0.0) -- github.com/jimstudt/http-authentication: [3eca13d](https://github.com/jimstudt/http-authentication/tree/3eca13d) -- github.com/kisielk/errcheck: [v1.2.0](https://github.com/kisielk/errcheck/tree/v1.2.0) -- github.com/kisielk/gotool: [v1.0.0](https://github.com/kisielk/gotool/tree/v1.0.0) -- github.com/klauspost/cpuid: [v1.2.0](https://github.com/klauspost/cpuid/tree/v1.2.0) -- github.com/kr/pty: [v1.1.5](https://github.com/kr/pty/tree/v1.1.5) -- github.com/kylelemons/godebug: [d65d576](https://github.com/kylelemons/godebug/tree/d65d576) -- github.com/lucas-clemente/aes12: [cd47fb3](https://github.com/lucas-clemente/aes12/tree/cd47fb3) -- github.com/lucas-clemente/quic-clients: [v0.1.0](https://github.com/lucas-clemente/quic-clients/tree/v0.1.0) -- github.com/lucas-clemente/quic-go-certificates: [d2f8652](https://github.com/lucas-clemente/quic-go-certificates/tree/d2f8652) -- github.com/lucas-clemente/quic-go: [v0.10.2](https://github.com/lucas-clemente/quic-go/tree/v0.10.2) -- github.com/marten-seemann/qtls: [v0.2.3](https://github.com/marten-seemann/qtls/tree/v0.2.3) -- github.com/mattn/go-colorable: [v0.0.9](https://github.com/mattn/go-colorable/tree/v0.0.9) -- github.com/mattn/go-isatty: [v0.0.3](https://github.com/mattn/go-isatty/tree/v0.0.3) -- github.com/mholt/certmagic: [6a42ef9](https://github.com/mholt/certmagic/tree/6a42ef9) -- github.com/mitchellh/go-homedir: [v1.1.0](https://github.com/mitchellh/go-homedir/tree/v1.1.0) -- github.com/naoina/go-stringutil: [v0.1.0](https://github.com/naoina/go-stringutil/tree/v0.1.0) -- github.com/naoina/toml: [v0.1.1](https://github.com/naoina/toml/tree/v0.1.1) -- github.com/rogpeppe/go-internal: [v1.3.0](https://github.com/rogpeppe/go-internal/tree/v1.3.0) -- github.com/thecodeteam/goscaleio: [v0.1.0](https://github.com/thecodeteam/goscaleio/tree/v0.1.0) -- github.com/ugorji/go/codec: [d75b2dc](https://github.com/ugorji/go/codec/tree/d75b2dc) -- github.com/xordataexchange/crypt: [b2862e3](https://github.com/xordataexchange/crypt/tree/b2862e3) -- go.opencensus.io: v0.21.0 -- golang.org/x/mod: 4bf6d31 -- gopkg.in/airbrake/gobrake.v2: v2.0.9 -- gopkg.in/errgo.v2: v2.1.0 -- gopkg.in/gemnasium/logrus-airbrake-hook.v2: v2.1.2 -- gopkg.in/mcuadros/go-syslog.v2: v2.2.1 -- gotest.tools/gotestsum: v0.3.5 -- honnef.co/go/tools: v0.0.1-2019.2.2 - - -#### 变更了的依赖项 - -- cloud.google.com/go: v0.34.0 → v0.38.0 -- github.com/Azure/azure-sdk-for-go: [v21.4.0+incompatible → v32.5.0+incompatible](https://github.com/Azure/azure-sdk-for-go/compare/v21.4.0...v32.5.0) -- github.com/BurntSushi/toml: [v0.3.0 → v0.3.1](https://github.com/BurntSushi/toml/compare/v0.3.0...v0.3.1) -- github.com/GoogleCloudPlatform/k8s-cloud-provider: [f8e9959 → 27a4ced](https://github.com/GoogleCloudPlatform/k8s-cloud-provider/compare/f8e9959...27a4ced) -- github.com/PuerkitoBio/purell: [v1.1.0 → v1.1.1](https://github.com/PuerkitoBio/purell/compare/v1.1.0...v1.1.1) -- github.com/asaskevich/govalidator: [f9ffefc → f61b66f](https://github.com/asaskevich/govalidator/compare/f9ffefc...f61b66f) -- github.com/client9/misspell: [9ce5d97 → v0.3.4](https://github.com/client9/misspell/compare/9ce5d97...v0.3.4) -- github.com/containernetworking/cni: [v0.6.0 → v0.7.1](https://github.com/containernetworking/cni/compare/v0.6.0...v0.7.1) -- github.com/coreos/etcd: [v3.3.13+incompatible → v3.3.15+incompatible](https://github.com/coreos/etcd/compare/v3.3.13...v3.3.15) -- github.com/coreos/go-oidc: [065b426 → v2.1.0+incompatible](https://github.com/coreos/go-oidc/compare/065b426...v2.1.0) -- github.com/coreos/go-semver: [e214231 → v0.3.0](https://github.com/coreos/go-semver/compare/e214231...v0.3.0) -- github.com/cpuguy83/go-md2man: [v1.0.4 → v1.0.10](https://github.com/cpuguy83/go-md2man/compare/v1.0.4...v1.0.10) -- github.com/cyphar/filepath-securejoin: [ae69057 → v0.2.2](https://github.com/cyphar/filepath-securejoin/compare/ae69057...v0.2.2) -- github.com/dgrijalva/jwt-go: [01aeca5 → v3.2.0+incompatible](https://github.com/dgrijalva/jwt-go/compare/01aeca5...v3.2.0) -- github.com/docker/distribution: [edc3ab2 → v2.7.1+incompatible](https://github.com/docker/distribution/compare/edc3ab2...v2.7.1) -- github.com/emicklei/go-restful: [ff4f55a → v2.9.5+incompatible](https://github.com/emicklei/go-restful/compare/ff4f55a...v2.9.5) -- github.com/evanphx/json-patch: [5858425 → v4.2.0+incompatible](https://github.com/evanphx/json-patch/compare/5858425...v4.2.0) -- github.com/fatih/camelcase: [f6a740d → v1.0.0](https://github.com/fatih/camelcase/compare/f6a740d...v1.0.0) -- github.com/go-openapi/analysis: [v0.17.2 → v0.19.2](https://github.com/go-openapi/analysis/compare/v0.17.2...v0.19.2) -- github.com/go-openapi/errors: [v0.17.2 → v0.19.2](https://github.com/go-openapi/errors/compare/v0.17.2...v0.19.2) -- github.com/go-openapi/jsonpointer: [v0.19.0 → v0.19.2](https://github.com/go-openapi/jsonpointer/compare/v0.19.0...v0.19.2) -- github.com/go-openapi/jsonreference: [v0.19.0 → v0.19.2](https://github.com/go-openapi/jsonreference/compare/v0.19.0...v0.19.2) -- github.com/go-openapi/loads: [v0.17.2 → v0.19.2](https://github.com/go-openapi/loads/compare/v0.17.2...v0.19.2) -- github.com/go-openapi/runtime: [v0.17.2 → v0.19.0](https://github.com/go-openapi/runtime/compare/v0.17.2...v0.19.0) -- github.com/go-openapi/spec: [v0.17.2 → v0.19.2](https://github.com/go-openapi/spec/compare/v0.17.2...v0.19.2) -- github.com/go-openapi/strfmt: [v0.17.0 → v0.19.0](https://github.com/go-openapi/strfmt/compare/v0.17.0...v0.19.0) -- github.com/go-openapi/swag: [v0.17.2 → v0.19.2](https://github.com/go-openapi/swag/compare/v0.17.2...v0.19.2) -- github.com/go-openapi/validate: [v0.18.0 → v0.19.2](https://github.com/go-openapi/validate/compare/v0.18.0...v0.19.2) -- github.com/godbus/dbus: [c7fdd8b → v4.1.0+incompatible](https://github.com/godbus/dbus/compare/c7fdd8b...v4.1.0) -- github.com/gogo/protobuf: [342cbe0 → 65acae2](https://github.com/gogo/protobuf/compare/342cbe0...65acae2) -- github.com/golang/mock: [bd3c8e8 → v1.2.0](https://github.com/golang/mock/compare/bd3c8e8...v1.2.0) -- github.com/golang/protobuf: [v1.2.0 → v1.3.1](https://github.com/golang/protobuf/compare/v1.2.0...v1.3.1) -- github.com/google/btree: [7d79101 → 4030bb1](https://github.com/google/btree/compare/7d79101...4030bb1) -- github.com/google/cadvisor: [9db8c7d → v0.34.0](https://github.com/google/cadvisor/compare/9db8c7d...v0.34.0) -- github.com/google/gofuzz: [24818f7 → v1.0.0](https://github.com/google/gofuzz/compare/24818f7...v1.0.0) -- github.com/google/uuid: [v1.0.0 → v1.1.1](https://github.com/google/uuid/compare/v1.0.0...v1.1.1) -- github.com/gophercloud/gophercloud: [c818fa6 → v0.1.0](https://github.com/gophercloud/gophercloud/compare/c818fa6...v0.1.0) -- github.com/gorilla/websocket: [4201258 → v1.4.0](https://github.com/gorilla/websocket/compare/4201258...v1.4.0) -- github.com/grpc-ecosystem/go-grpc-prometheus: [2500245 → v1.2.0](https://github.com/grpc-ecosystem/go-grpc-prometheus/compare/2500245...v1.2.0) -- github.com/hashicorp/golang-lru: [v0.5.0 → v0.5.1](https://github.com/hashicorp/golang-lru/compare/v0.5.0...v0.5.1) -- github.com/hashicorp/hcl: [d8c773c → v1.0.0](https://github.com/hashicorp/hcl/compare/d8c773c...v1.0.0) -- github.com/heketi/heketi: [558b292 → v9.0.0+incompatible](https://github.com/heketi/heketi/compare/558b292...v9.0.0) -- github.com/jonboulle/clockwork: [72f9bd7 → v0.1.0](https://github.com/jonboulle/clockwork/compare/72f9bd7...v0.1.0) -- github.com/json-iterator/go: [ab8a2e0 → v1.1.7](https://github.com/json-iterator/go/compare/ab8a2e0...v1.1.7) -- github.com/kr/pretty: [f31442d → v0.1.0](https://github.com/kr/pretty/compare/f31442d...v0.1.0) -- github.com/kr/text: [6807e77 → v0.1.0](https://github.com/kr/text/compare/6807e77...v0.1.0) -- github.com/libopenstorage/openstorage: [093a0c3 → v1.0.0](https://github.com/libopenstorage/openstorage/compare/093a0c3...v1.0.0) -- github.com/magiconair/properties: [61b492c → v1.8.1](https://github.com/magiconair/properties/compare/61b492c...v1.8.1) -- github.com/mailru/easyjson: [60711f1 → 94de47d](https://github.com/mailru/easyjson/compare/60711f1...94de47d) -- github.com/mattn/go-shellwords: [f8471b0 → v1.0.5](https://github.com/mattn/go-shellwords/compare/f8471b0...v1.0.5) -- github.com/miekg/dns: [5d001d0 → v1.1.4](https://github.com/miekg/dns/compare/5d001d0...v1.1.4) -- github.com/mistifyio/go-zfs: [1b4ae6f → v2.1.1+incompatible](https://github.com/mistifyio/go-zfs/compare/1b4ae6f...v2.1.1) -- github.com/mitchellh/go-wordwrap: [ad45545 → v1.0.0](https://github.com/mitchellh/go-wordwrap/compare/ad45545...v1.0.0) -- github.com/mvdan/xurls: [1b768d7 → v1.1.0](https://github.com/mvdan/xurls/compare/1b768d7...v1.1.0) -- github.com/onsi/ginkgo: [v1.6.0 → v1.8.0](https://github.com/onsi/ginkgo/compare/v1.6.0...v1.8.0) -- github.com/onsi/gomega: [5533ce8 → v1.5.0](https://github.com/onsi/gomega/compare/5533ce8...v1.5.0) -- github.com/opencontainers/go-digest: [a6d0ee4 → v1.0.0-rc1](https://github.com/opencontainers/go-digest/compare/a6d0ee4...v1.0.0-rc1) -- github.com/opencontainers/image-spec: [372ad78 → v1.0.1](https://github.com/opencontainers/image-spec/compare/372ad78...v1.0.1) -- github.com/opencontainers/runc: [f000fe1 → 6cc5158](https://github.com/opencontainers/runc/compare/f000fe1...6cc5158) -- github.com/opencontainers/selinux: [4a2974b → v1.2.2](https://github.com/opencontainers/selinux/compare/4a2974b...v1.2.2) -- github.com/robfig/cron: [df38d32 → v1.1.0](https://github.com/robfig/cron/compare/df38d32...v1.1.0) -- github.com/russross/blackfriday: [300106c → v1.5.2](https://github.com/russross/blackfriday/compare/300106c...v1.5.2) -- github.com/seccomp/libseccomp-golang: [1b506fc → v0.9.1](https://github.com/seccomp/libseccomp-golang/compare/1b506fc...v0.9.1) -- github.com/sirupsen/logrus: [v1.2.0 → v1.4.2](https://github.com/sirupsen/logrus/compare/v1.2.0...v1.4.2) -- github.com/spf13/afero: [b28a7ef → v1.2.2](https://github.com/spf13/afero/compare/b28a7ef...v1.2.2) -- github.com/spf13/cast: [e31f36f → v1.3.0](https://github.com/spf13/cast/compare/e31f36f...v1.3.0) -- github.com/spf13/cobra: [c439c4f → v0.0.5](https://github.com/spf13/cobra/compare/c439c4f...v0.0.5) -- github.com/spf13/jwalterweatherman: [33c24e7 → v1.1.0](https://github.com/spf13/jwalterweatherman/compare/33c24e7...v1.1.0) -- github.com/spf13/pflag: [v1.0.1 → v1.0.3](https://github.com/spf13/pflag/compare/v1.0.1...v1.0.3) -- github.com/spf13/viper: [7fb2782 → v1.3.2](https://github.com/spf13/viper/compare/7fb2782...v1.3.2) -- github.com/stretchr/objx: [v0.1.1 → v0.2.0](https://github.com/stretchr/objx/compare/v0.1.1...v0.2.0) -- github.com/stretchr/testify: [v1.2.2 → v1.3.0](https://github.com/stretchr/testify/compare/v1.2.2...v1.3.0) -- golang.org/x/net: 65e2d4e → cdfb69a -- golang.org/x/tools: aa82965 → 6e04913 -- google.golang.org/api: 583d854 → 5213b80 -- google.golang.org/genproto: 09f6ed2 → 54afdca -- google.golang.org/grpc: v1.13.0 → v1.23.0 -- gopkg.in/check.v1: 20d25e2 → 788fd78 -- gopkg.in/natefinch/lumberjack.v2: 20b71e5 → v2.0.0 -- gopkg.in/square/go-jose.v2: 89060de → v2.2.2 -- gopkg.in/yaml.v2: v2.2.1 → v2.2.2 -- k8s.io/gengo: f8a0810 → 26a6646 -- k8s.io/klog: v0.3.1 → v0.4.0 -- k8s.io/kube-openapi: b3a7cee → 743ec37 -- k8s.io/utils: c2654d5 → 581e001 -- sigs.k8s.io/structured-merge-diff: e85c7b2 → 6149e45 - - -#### 删除的依赖项 - -- github.com/Azure/go-autorest: [v11.1.2+incompatible](https://github.com/Azure/go-autorest/tree/v11.1.2) -- github.com/codedellemc/goscaleio: [20e2ce2](https://github.com/codedellemc/goscaleio/tree/20e2ce2) -- github.com/d2g/dhcp4: [a1d1b6c](https://github.com/d2g/dhcp4/tree/a1d1b6c) -- github.com/d2g/dhcp4client: [6e570ed](https://github.com/d2g/dhcp4client/tree/6e570ed) -- github.com/jteeuwen/go-bindata: [a0ff256](https://github.com/jteeuwen/go-bindata/tree/a0ff256) -- github.com/kardianos/osext: [8fef92e](https://github.com/kardianos/osext/tree/8fef92e) -- github.com/kr/fs: [2788f0d](https://github.com/kr/fs/tree/2788f0d) -- github.com/marstr/guid: [8bdf7d1](https://github.com/marstr/guid/tree/8bdf7d1) -- github.com/mholt/caddy: [2de4950](https://github.com/mholt/caddy/tree/2de4950) -- github.com/natefinch/lumberjack: [v2.0.0+incompatible](https://github.com/natefinch/lumberjack/tree/v2.0.0) -- github.com/pkg/sftp: [4d0e916](https://github.com/pkg/sftp/tree/4d0e916) -- github.com/shurcooL/sanitized_anchor_name: [10ef21a](https://github.com/shurcooL/sanitized_anchor_name/tree/10ef21a) -- github.com/sigma/go-inotify: [c87b6cf](https://github.com/sigma/go-inotify/tree/c87b6cf) -- github.com/vmware/photon-controller-go-sdk: [4a435da](https://github.com/vmware/photon-controller-go-sdk/tree/4a435da) -- github.com/xanzy/go-cloudstack: [1e2cbf6](https://github.com/xanzy/go-cloudstack/tree/1e2cbf6) -- gopkg.in/yaml.v1: 9f9df34 -- [v1.16.0-rc.2](#v1160-rc2) -- [v1.16.0-rc.1](#v1160-rc1) -- [v1.16.0-beta.2](#v1160-beta2) -- [v1.16.0-beta.1](#v1160-beta1) -- [v1.16.0-alpha.3](#v1160-alpha3) -- [v1.16.0-alpha.2](#v1160-alpha2) -- [v1.16.0-alpha.1](#v1160-alpha1) - - - -# v1.16.0-rc.2 - - -[文档](https://docs.k8s.io) - - -## 下载 v1.16.0-rc.2 - - - -文件名 | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes.tar.gz) | `68837f83bcf380e22b50f145fb64404584e96e5714a6c0cbc1ba76e290dc267f6b53194e2b51f19c1145ae7c3e5874124d35ff430cda15f67b0f9c954803389c` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-src.tar.gz) | `922552ed60d425fa6d126ffb34db6a7f123e1b9104e751edaed57b4992826620383446e6cf4f8a9fd55aac72f95a69b45e53274a41aaa838c2c2ae15ff4ddad2` - - -### 客户端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-client-darwin-386.tar.gz) | `d0df8f57f4d9c2822badc507345f82f87d0e8e49c79ca907a0e4e4dd634db964b84572f88b8ae7eaf50a20965378d464e0d1e7f588e84e926edfb741b859e7d2` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-client-darwin-amd64.tar.gz) | `0bc7daaf1165189b57dcdbe59f402731830b6f4db53b853350056822602579d52fe43ce5ac6b7d4b6d89d81036ae94eab6b7167e78011a96792acfbf6892fa39` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-client-linux-386.tar.gz) | `7735c607bb99b47924140a6a3e794912b2b97b6b54024af1de5db6765b8cc518cba6b145c25dc67c8d8f827805d9a61f676b4ae67b8ef86cfda2fe76de822c6a` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-client-linux-amd64.tar.gz) | `d35f70cea4780a80c24588bc760c38c138d73e5f80f9fe89d952075c24cbf179dd504c2bd7ddb1756c2632ffbcc69a334684710a2d702443043998f66bec4a25` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-client-linux-arm.tar.gz) | `e1fc50b6884c42e92649a231db60e35d4e13e58728e4af7f6eca8b0baa719108cdd960db1f1dbd623085610dbccf7f17df733de1faf10ebf6cd1977ecd7f6213` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-client-linux-arm64.tar.gz) | `defc25fe403c20ef322b2149be28a5b44c28c7284f11bcf193a07d7f45110ce2bd6227d3a4aa48859aaeb67796809962785651ca9f76121fb9534366b40c4b7d` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-client-linux-ppc64le.tar.gz) | `e87b16c948d09ddbc5d6e3fab05ad3c5a58aa7836d4f42c59edab640465531869c92ecdfa2845ec3eecd95b8ccba3dafdd9337f4c313763c6e5105b8740f2dca` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-client-linux-s390x.tar.gz) | `2c25a1860fa81cea05a1840d6a200a3a794cc50cfe45a4efec57d7122208b1354e86f698437bbe5c915d6fb70ef9525f844edc0fa63387ab8c1586a6b22008a5` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-client-windows-386.tar.gz) | `267654a7ecfa37c800c1c94ea78343f5466783881cfac62091cfbd8c62489f04bd74a7a39a08253cb51d7ba52c207f56da371f992f61c1468b595c094f0e080f` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-client-windows-amd64.tar.gz) | `bd4c25b80e54f9fc0c07f64550d020878f899e4e3a28ca57dd532fdbab9ab700d296d2890185591ac27bce6fde336ab90f3102a6797e174d233db76f24f5ac1b` - - -### 服务器端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-server-linux-amd64.tar.gz) | `13a93bb9bd5599b669af7bd25537ee81cefd6d8c73bedfbac845703c01950c70b2aa39f94f2346d935bc167bae435dbcd6e1758341b634102265657e1b1c1259` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-server-linux-arm.tar.gz) | `781d127f32d8479bc21beed855ec73e383702e6e982854138adce8edb0ee4d1d4b0c6e723532bc761689d17512c18b1945d05b0e4adb3fe4b98428cce40d52c8` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-server-linux-arm64.tar.gz) | `6d6dfa49288e4a4ce77ca4f7e83a51c78a2b1844dd95df10cb12fff5a104e750d8e4e117b631448e066487c4c71648e822c87ed83a213f17f27f8c7ecb328ca4` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-server-linux-ppc64le.tar.gz) | `97804d87ea984167fdbdedcfb38380bd98bb2ef150c1a631c6822905ce5270931a907226d5ddefc8d98d5326610daa79a08964fc4d7e8b438832beb966efd214` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-server-linux-s390x.tar.gz) | `d45bd651c7f4b6e62ceb661c2ec70afca06a8d1fde1e50bb7783d05401c37823cf21b9f0d3ac87e6b91eeec9d03fc539c3713fd46beff6207e8ebac1bf9d1dd5` - - -### 节点可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-node-linux-amd64.tar.gz) | `42c57b59ce43f8961e427d622ee9cfa85cc23468779945262d59aa8cd31afd495c7abaaef7263b9db60ec939ba5e9898ebc3281e8ec81298237123ce4739cbff` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-node-linux-arm.tar.gz) | `034a5611909df462ef6408f5ba5ff5ebfb4e1178b2ad06a59097560040c4fcdb163faec48ab4297ca6c21282d7b146f9a5eebd3f2573f7d6d7189d6d29f2cf34` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-node-linux-arm64.tar.gz) | `df1493fa2d67b59eaf02096889223bbf0d71797652d3cbd89e8a3106ff6012ea17d25daaa4baf9f26c2e061afb4b69e3e6814ba66e9c4744f04230c922fbc251` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-node-linux-ppc64le.tar.gz) | `812a5057bbf832c93f741cc39d04fc0087e36b81b6b123ec5ef02465f7ab145c5152cfc1f7c76032240695c7d7ab71ddb9a2a4f5e1f1a2abb63f32afa3fb6c7c` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-node-linux-s390x.tar.gz) | `2a58a4b201631789d4309ddc665829aedcc05ec4fe6ad6e4d965ef3283a381b8a4980b4b728cfe9a38368dac49921f61ac6938f0208b671afd2327f2013db22a` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-rc.2/kubernetes-node-windows-amd64.tar.gz) | `7fb09e7667715f539766398fc1bbbc4bf17c64913ca09d4e3535dfc4d1ba2bf6f1a3fcc6d81dbf473ba3f10fd29c537ce5debc17268698048ce7b378802a6c46` - - -## 自 v1.16.0-rc.1 起的变更日志 - - -### 其他值得注意的变化 - - -* 单个静态 pod 文件和来自 http 端点的 pod 文件不能大于 10 MB。HTTP 探针负载现在被截断为 10 KB。见 ([#82669](https://github.com/kubernetes/kubernetes/pull/82669)、[@rphillips](https://github.com/rphillips))。 -* 通过不发布非结构化自定义资源定义的 OpenAPI，恢复与小于等于 v1.15.x 自定义资源的兼容性。见 ([#82653](https://github.com/kubernetes/kubernetes/pull/82653)、[@liggitt](https://github.com/liggitt))。 -* 修复了后端关闭代理连接时记录虚假堆栈跟踪的回归问题。见 ([#82588](https://github.com/kubernetes/kubernetes/pull/82588)、[@liggitt](https://github.com/liggitt))。 - - -# v1.16.0-rc.1 - - -[文档](https://docs.k8s.io) - - -## 下载 v1.16.0-rc.1 - - -文件名 | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes.tar.gz) | `2feadb470a8b0d498dff2c122d792109bc48e24bfc7f49b4b2b40a268061c83d9541cbcf902f2b992d6675e38d69ccdded9435ac488e041ff73d0c2dc518a5a9` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-src.tar.gz) | `6d8877e735e041c989c0fca9dd9e57e5960299e74f66f69907b5e1265419c69ed3006c0161e0ced63073e28073355a5627154cf5db53b296b4a209b006b45db0` - - -### 客户端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-client-darwin-386.tar.gz) | `27bbfcb709854a9625dbb22c357492c1818bc1986b94e8cf727c046d596c4f1fe385df5b2ce61baaf95b066d584a8c04190215eaf979e12707c6449766e84810` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-client-darwin-amd64.tar.gz) | `9c2ea22e188282356cd532801cb94d799bde5a5716f037b81e7f83273f699bf80776b253830e3a4e1a72c420f0c0b84e28ae043c9d28a49e9455e6b1449a353c` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-client-linux-386.tar.gz) | `bbba78b8f972d0c247ed11e88010fc934a694efce8d2605635902b4a22f5ecc7e710f640bcefbba97ef28f6db68b9d8fb9e6a4a099603493c1ddcc5fd50c0d17` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-client-linux-amd64.tar.gz) | `f2f04dc9b93d1c8f5295d3f559a3abdd19ea7011741aa006b2cd96542c06a6892d7ed2bad8479c89e7d6ae0ed0685e68d5096bd5a46431c8cab8a90c04f1f00c` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-client-linux-arm.tar.gz) | `77d1f5b4783f7480d879d0b7682b1d46e730e7fb8edbc6eccd96986c31ceecbf123cd9fd11c5a388218a8c693b1b545daed28ca88f36ddaca06adac4422e4be5` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-client-linux-arm64.tar.gz) | `0b57aa1dbbce51136789cb373d93e641d1f095a4bc9695d60917e85c814c8959a4d6e33224dc86295210d01e73e496091a191f303348f3b652a2b6160b1e6059` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-client-linux-ppc64le.tar.gz) | `847065d541dece0fc931947146dbc90b181f923137772f26c7c93476e022f4f654e00f9928df7a13a9dec27075dd8134bdb168b5c57d4efa29ed20a6a2112272` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-client-linux-s390x.tar.gz) | `d7e8a808da9e2551ca7d8e7cb25222cb9ac01595f78ebbc86152ae1c21620d4d8478ef3d374d69f47403ca913fc716fbaa81bd3ff082db2fc5814ef8dc66eeec` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-client-windows-386.tar.gz) | `c9cf6a6b9f2f29152af974d30f3fd97ba33693d5cbbf8fc76bcf6590979e7ac8307e5da4f84a646cec6b68f6fa1a83aa1ce24eb6429baa0a39c92d5901bd80be` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-client-windows-amd64.tar.gz) | `ebea0c0b64d251e6023e8a5a100aa609bc278c797170765da2e35c8997efc233bec9f8d1436aeee1cd6459e30ec78ba64b84de47c26a4e4645e153e5e598202b` - - -### 服务器端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-server-linux-amd64.tar.gz) | `2fe7ccce15e705826c4ccfce48df8130ba89a0c930bca4b61f49267e9d490f57cf6220671752e44e55502bee501a9af2f0ac3927378a87b466f2526fa6e45834` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-server-linux-arm.tar.gz) | `6eb77e59095a1de9eb21e7065e8d10b7d0baf1888991a42089ede6d4f8a8cac0b17ae793914eef5796d56d8f0b958203d5df1f7ed45856dce7244c9f047f9793` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-server-linux-arm64.tar.gz) | `429ce0d5459384c9d3a2bb103924eebc4c30343c821252dde8f4413fcf29cc73728d378bfd193c443479bde6bfd26e0a13c036d4d4ae22034d66f6cad70f684d` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-server-linux-ppc64le.tar.gz) | `18041d9c99efc00c8c9dbb6444974efdbf4969a4f75faea75a3c859b1ee8485d2bf3f01b7942a524dcd6a71c82af7a5937fc9120286e920cf2d501b7c76ab160` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-server-linux-s390x.tar.gz) | `2124c3d8856e50ca6b2b61d83f108ab921a1217fac2a80bf765d51b68f4e67d504471787d375524974173782aa37c57b6bf1fc6c7704ed7e6cabe15ec3c543b1` - - -### 节点可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-node-linux-amd64.tar.gz) | `ea1bcd8cc51fbc95058a8a592eb454c07ab5dadc1c237bbc59f278f8adc46bda1f334e73463e1edbd6da5469c4a527ceb1cb0a96686493d3ff4e8878dd1c9a20` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-node-linux-arm.tar.gz) | `e5d62df5fd086ff5712f59f71ade9efcf617a13c567de965ce54c79f3909372bed4edbf6639cf058fe1d5c4042f794e1c6a91e5e20d9dcce597a95dedf2474b2` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-node-linux-arm64.tar.gz) | `5aa0a7a3d02b65253e4e814e51cea6dd895170f2838fea02f94e4efd3f938dbf83bc7f209801856b98420373c04147fab9cb8791d24d51dcedf960068dfe6fda` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-node-linux-ppc64le.tar.gz) | `f54bc5ae188f8ecb3ddcae20e06237430dd696f444a5c65b0aa3be79ad85c5b500625fa47ed0e126f6e738eb5d9ee082b52482a6913ec6d22473520fa6582e66` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-node-linux-s390x.tar.gz) | `afa4f9b747fff20ed03d40092a2df60dbd6ced0de7fd0c83c001866c4fe5b7117468e2f8c73cbef26f376b69b4750f188143076953fc200e8a5cc002c8ac705b` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-rc.1/kubernetes-node-windows-amd64.tar.gz) | `e9b76014a1d4268ad66ade06883dd3344c6312ece14ee988af645bdf9c5e9b62c31a0e339f774c67799b777314db6016d86a3753855c7d2eb461fbbf4e154ae7` - - -## 自 v1.16.0-beta.2 起的变更日志 - - -### 其他值得注意的变化 - - -* 将集群自动扩缩更新到 1.16.0；更新日志：https://github.com/kubernetes/autoscaler/releases/tag/cluster-autoscaler-1.16.0 见 ([#82501](https://github.com/kubernetes/kubernetes/pull/82501)、[@losipiuk](https://github.com/losipiuk))。 -* 通过启用 ServerSideApply 功能的未处理验证架构为自定义资源提供服务，用于解决回归问题。见 ([#82438](https://github.com/kubernetes/kubernetes/pull/82438)、[@liggitt](https://github.com/liggitt))。 -* 修复抢占期间未调用过滤器插件问题。见 ([#81876](https://github.com/kubernetes/kubernetes/pull/81876)、[@wgliang](https://github.com/wgliang))。 -* 修复 GCE 窗口集群的 dns 后缀搜索列表问题。见 ([#82314](https://github.com/kubernetes/kubernetes/pull/82314)、[@lzang](https://github.com/lzang))。 - -* 基于 kube env ENABLE_NODE_LOGGING 安装并启动日志记录代理。见 ([#81300](https://github.com/kubernetes/kubernetes/pull/81300)、[@liyanhui1228](https://github.com/liyanhui1228))。 -* kubeadm：允许用户在初始化过程中跳过 kube-proxy 初始化插件阶段，但是仍然可以加入集群并执行其他一些次要操作（不能升级）。见 ([#82248](https://github.com/kubernetes/kubernetes/pull/82248)、[@rosti](https://github.com/rosti))。 -* 将指标服务器连接到 v0.3.4。见 ([#82322](https://github.com/kubernetes/kubernetes/pull/82322)、[@olagacek](https://github.com/olagacek))。 -* kubernetes 使用的默认 etcd 服务已更新为 3.3.15。见 ([#82199](https://github.com/kubernetes/kubernetes/pull/82199)、[@dims](https://github.com/dims))。 - - -# v1.16.0-beta.2 - - -[文档](https://docs.k8s.io) - - -## 下载 v1.16.0-beta.2 - - - -文件名 | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes.tar.gz) | `d1f4e9badc6a4422b9a261a5375769d63f0cac7fff2aff4122a325417b77d5e5317ba76a180cda2baa9fb1079c33e396fc16f82b31eeebea61004b0aabdf8c32` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-src.tar.gz) | `2ab20b777311746bf9af0947a2bea8ae36e27da7d917149518d7c2d2612f513bbf88d1f2c7efff6dc169aa43c2dd3be73985ef619172d50d99faa56492b35ce4` - - -### 客户端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-client-darwin-386.tar.gz) | `55523fd5cfce0c5b79e981c6a4d5572790cfe4488ed23588be45ee13367e374cf703f611769751583986557b2607f271704d9f27e03f558e35e7c75796476b10` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-client-darwin-amd64.tar.gz) | `13e696782713da96f5fb2c3fa54d99ca40bc71262cb2cbc8e77a6d19ffd33b0767d3f27e693aa84103aca465f9b00ed109996d3579b4bd28566b8998212a0872` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-client-linux-386.tar.gz) | `7f4818599b84712edd2bf1d94f02f9a53c1f827b428a888356e793ff62e897276afcbc97f03bc0317e7d729740410037c57e6443f65c691eb959b676833511fa` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-client-linux-amd64.tar.gz) | `8a2656289d7d86cbded42831f6bc660b579609622c16428cf6cc782ac8b52df4c8511c5aad65aa520f398a65e35dee6ea5b5ad8e5fd14c5a8690a7248dc4c109` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-client-linux-arm.tar.gz) | `418606bc109b9acb2687ed297fa2eec272e8cb4ad3ce1173acd15a4b43cec0ecfd95e944faeecf862b349114081dd99dfac8615dc95cffc1cd4983c5b38e9c4e` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-client-linux-arm64.tar.gz) | `2eb943b745c270cd161e01a12195cfb38565de892a1da89e851495fb6f9d6664055e384e30d3551c25f120964e816e44df5415aff7c12a8639c30a42271abef7` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-client-linux-ppc64le.tar.gz) | `262e7d61e167e7accd43c47e9ce28323ae4614939a5af09ecc1023299cd2580220646e7c90d31fee0a17302f5d9df1e7da1e6774cc7e087248666b33399e8821` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-client-linux-s390x.tar.gz) | `8f0cfe669a211423dd697fdab722011ea9641ce3db64debafa539d4a424dd26065c8de5da7502a4d40235ff39158f3935bd337b807a63771391dffb282563ccf` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-client-windows-386.tar.gz) | `b1deab89653f4cd3ad8ad68b8ec3e1c038d1ef35bd2e4475d71d4781acf0b2002443f9c2b7d2cf06cbb9c568bea3881c06d723b0529cc8210f99450dc2dc5e43` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-client-windows-amd64.tar.gz) | `0e3b5150767efd0ed5d60b2327d2b7f6f2bda1a3532fca8e84a7ca161f6e069fae15af37d3fe8a641d34c9a65fc61f1c44dd3265ef6cacfd2df55c9c004bc6bd` - - -### 服务器端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-server-linux-amd64.tar.gz) | `32688295df1fcdb9472ed040dc5e8b19d04d62789d2eca64cfe08080d08ffee1eaa4853ce40bd336aabd2f764dd65b36237d4f9f1c697e2d6572861c0c8eff01` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-server-linux-arm.tar.gz) | `c8ea6d66e966889a54194f9dce2021131e9bae34040c56d8839341c47fc4074d6322cc8aadce28e7cdcee88ec79d37a73d52276deb1cc1eee231e4d3083d54e5` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-server-linux-arm64.tar.gz) | `12b42cfa33ff824392b81a604b7edcab95ecc67cddfc24c47ef67adb356a333998bc7b913b00daf7a213692d8d441153904474947b46c7f76ef03d4b2a63eab0` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-server-linux-ppc64le.tar.gz) | `e03f0eba181c03ddb7535e56ff330dafebb7dcb40889fd04f5609617ebb717f9f833e89810bff36d5299f72ae75d356fffb80f7b3bab2232c7597abcc003b8ba` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-server-linux-s390x.tar.gz) | `4e7bd061317a3445ad4b6b308f26218777677a1fef5fda181ee1a19e532a758f6bd3746a3fe1917a057ed71c94892aeaf00dd4eb008f61418ec3c80169a1f057` - - -### 节点可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-node-linux-amd64.tar.gz) | `dc5606c17f0191afc6f28dce5ab566fd8f21a69fa3989a1c8f0976d7b8ccd32e26bb21e9fec9f4529c5a6c8301747d278484688a0592da291866f8fa4893dcbb` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-node-linux-arm.tar.gz) | `3d5d9893e06fd7be51dca11182ecb9e93108e86af40298fe66bb62e5e86f0bf4713667ba63d00b02cfddaf20878dd78cc738e76bf1ca715bbbe79347ca518ec4` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-node-linux-arm64.tar.gz) | `fd18a02f32aeafc5cce8f3f2eadd0e532857bd5264b7299b4e48f458f77ebaa53be94b1d1fe2062168f9d88c8a97e6c2d904fc3401a2d9e69dd4e8c87d01d915` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-node-linux-ppc64le.tar.gz) | `703afd80140db2fae897d83b3d2bc8889ff6c6249bb79be7a1cce6f0c9326148d22585a5249c2e976c69a2518e3f887eef4c9dc4a970ebb854a78e72c1385ccb` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-node-linux-s390x.tar.gz) | `445d4ef4f9d63eabe3b7c16114906bc450cfde3e7bf7c8aedd084c79a5e399bd24a7a9c2283b58d382fb11885bb2b412773a36fffb6fc2fac15d696439a0b800` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-beta.2/kubernetes-node-windows-amd64.tar.gz) | `88b04171c3c0134044b7555fbc9b88071f5a73dbf2dac21f8a27b394b0870dff349a56b0ee4d8e1d9cfbeb98645e485f40b8d8863f3f3e833cba0ca6b1383ccf` - - -## 自 v1.16.0-beta.1 起的变更日志 - - -### 其他值得注意的变化 - - -* 修复了 apiserver 中的一个错误，该错误可能导致有效的更新请求因前提条件检查失败而被拒绝。见 ([#82303](https://github.com/kubernetes/kubernetes/pull/82303)、[@roycaihw](https://github.com/roycaihw))。 -* 使用 `--admission-control-config-file` 配置的 Webhook 客户端凭据必须在配置的主机名中包含非默认端口。例如，配置与命令空间 `myns` 中的服务 `mysvc`上的端口 8443 进行通信的 Webhook 将在带有 `name: mysvc.myns.svc:8443` 的节中指定客户端凭据。有关更多详细信息，请参见 https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#authenticate-apiservers。见 ([#82252](https://github.com/kubernetes/kubernetes/pull/82252)、[@liggitt](https://github.com/liggitt))。 -* 确保 KUBE-MARK-DROP 链处于 kube-proxy ipvs 模式。ipv4 和 ipv6 在双堆栈操作中均已确保该链。见 ([#82214](https://github.com/kubernetes/kubernetes/pull/82214)、[@uablrek](https://github.com/uablrek))。 - -* `kubectl cp` 不再支持从容器中复制符号链接；为了支持该用例，请参见 `kubectl exec --help` 以获取直接使用 `tar` 的示例。见 ([#82143](https://github.com/kubernetes/kubernetes/pull/82143)、[@soltysh](https://github.com/soltysh))。 -* kubeadm：修复了 IPv6 地址的 HTTPProxy 检查(kubernetes/kubeadm#1769)。([#82267](https://github.com/kubernetes/kubernetes/pull/82267)、[@kad](https://github.com/kad))。 -* 在 kubectl 中添加 PodOverhead 感知。见 ([#81929](https://github.com/kubernetes/kubernetes/pull/81929)、[@egernst](https://github.com/egernst))。 -* 现在，nbf（不早于）声明（如果存在于 ID 令牌中）将被强制执行。见 ([#81413](https://github.com/kubernetes/kubernetes/pull/81413)、[@anderseknert](https://github.com/anderseknert))。 -* 服务器端应用现在将使用 CRD 验证字段中提供的 openapi 来帮助弄清楚如何正确合并对象和更新所有权。见 ([#77354](https://github.com/kubernetes/kubernetes/pull/77354)、[@jennybuckley](https://github.com/jennybuckley))。 - -* - 使用 ZFS 存储池修复 LXD 中的磁盘统计信息。见 ([#81972](https://github.com/kubernetes/kubernetes/pull/81972)、[@dashpole](https://github.com/dashpole))。 - * - 修复 CRI-O 缺少网络指标错误。 - * - 添加指标 `container_sockets`、`container_threads` 和 `container_threads_max`。 -* 启用发现 API 组时，添加对 kubectl 的 Endpoint Slice 支持。见 ([#81795](https://github.com/kubernetes/kubernetes/pull/81795)、[@robscott](https://github.com/robscott))。 -* Node-Problem-Detector v0.7.1 用于插件 daemonset。见 ([#82140](https://github.com/kubernetes/kubernetes/pull/82140)、[@wangzhen127](https://github.com/wangzhen127))。 -* 聚合的发现请求现在可以超时。聚合的 apiserver 必须在 5 秒钟内完成发现调用。其他请求可能需要更长的时间。见 ([#82146](https://github.com/kubernetes/kubernetes/pull/82146)、[@deads2k](https://github.com/deads2k))。 - * 如果*必须*删除此检查，请使用 `EnableAggregatedDiscoveryTimeout=false` 功能开关，但是该功能将在下一个版本中删除。 - -* 将 Windows GMSA 支持从 Alpha 功能升级到 Beta 功能。见 ([#82110](https://github.com/kubernetes/kubernetes/pull/82110)、[@wk8](https://github.com/wk8))。 -* 为 Scheduler Framework 添加 UnschedulableAndUnresolvable 状态码。见 ([#82034](https://github.com/kubernetes/kubernetes/pull/82034)、[@alculquicondor](https://github.com/alculquicondor))。 -* Kubeadm 现在包括 CoreDNS 1.6.2 版本。见 ([#82127](https://github.com/kubernetes/kubernetes/pull/82127)、[@rajansandeep](https://github.com/rajansandeep))。 - * - 现在，CoreDNS Deployment 通过 `ready` 插件检查准备情况。 - * - `proxy` 插件已被弃用,而是使用 `forward` 插件。 - * - Kubernetes 插件删除了 resyncperiod 选项。 - * - `upstream` 选项已被弃用，如果包含的话，将被忽略。 - -* 遇到错误时，确保 kubectl get --ignore-not-found 操作继续进行。见 ([#82120](https://github.com/kubernetes/kubernetes/pull/82120)、[@soltysh](https://github.com/soltysh))。 -* 通过 IPVS 代理启用了双栈服务（IPv6DualStack 功能的第 II 阶段）。iptables proxier 还不支持 Dualstack。Dualstack iptables proxier 正在研究开发中并且将会被提出来。见 ([#82091](https://github.com/kubernetes/kubernetes/pull/82091)、[@khenidak](https://github.com/khenidak))。 - * 要启用双栈服务，kube-proxy 必须具有以下参数： - * --proxy-mode=ipvs - * --cluster-cidrs=, - -* apiserver 现在使用 http/1.1 与 admission webhook 进行通信，打开多个满足并发请求的连接，并允许将请求分散在多个后备 Pod 上。见 ([#82090](https://github.com/kubernetes/kubernetes/pull/82090)、[@liggitt](https://github.com/liggitt))。 -* 添加了对 gce ILB 指定全局访问 annotation 的支持。见 ([#81549](https://github.com/kubernetes/kubernetes/pull/81549)、[@prameshj](https://github.com/prameshj))。 -* 添加了与 KEP https://github.com/kubernetes/enhancements/issues/950 相关的新的 startupProbe。见 ([#77807](https://github.com/kubernetes/kubernetes/pull/77807)、[@matthyx](https://github.com/matthyx))。 -* 添加 \livez 用以进行 kube-apiserver 的活跃状况检查。使用参数 `--maximum-startup-sequence-duration` 能够允许活动端点（liveness endpoint）将引导序列故障推迟指定的持续时间。见 ([#81969](https://github.com/kubernetes/kubernetes/pull/81969)、[@logicalhan](https://github.com/logicalhan))。 - -* 服务器端 apply 现在是 Beta 功能。见 ([#81956](https://github.com/kubernetes/kubernetes/pull/81956)、[@apelisse](https://github.com/apelisse))。 -* 现在，`apiserver_admission_webhook_admission_duration_seconds` 指标中的 `rejected` 标签可以正确指示是否拒绝了请求。添加了一个新的计数器指标 `apiserver_admission_webhook_rejection_count`，其中该指标包含有关引起 Webhook 拒绝操作的详细信息。见 ([#81399](https://github.com/kubernetes/kubernetes/pull/81399)、[@roycaihw](https://github.com/roycaihw))。 -* 在 kubelet 的 `running_container_count` 指标中添加 `container_state` 标签，用于根据容器的状态（running/exited/created/unknown）获取容器数量。见 ([#81573](https://github.com/kubernetes/kubernetes/pull/81573)、[@irajdeep](https://github.com/irajdeep))。 -* 修复了 CRD openapi 控制器中的一个错误，该错误使用户定义的 CRD 可以覆盖 CRD API 中的 OpenAPI 指定的定义或路径。见 ([#81436](https://github.com/kubernetes/kubernetes/pull/81436)、[@roycaihw](https://github.com/roycaihw))。 - -* 服务帐户令牌（Service account token）现在在其头部（header）中包含 JWT 密钥 ID 字段。见 ([#78502](https://github.com/kubernetes/kubernetes/pull/78502)、[@ahmedtd](https://github.com/ahmedtd))。 -* 可通过启用 EndpointSlice 功能开关，将 EndpointSlice 集成添加到 kube-proxy 中。见 ([#81430](https://github.com/kubernetes/kubernetes/pull/81430)、[@robscott](https://github.com/robscott))。 - -* Azure 仅在 ELB 上支持 IPv6，在 ILB 上不支持 IPv6。如果服务是内部的并且是 IPv6 地址，则云提供商将返回错误。见 ([#80485](https://github.com/kubernetes/kubernetes/pull/80485)、[@khenidak](https://github.com/khenidak))。 - * 关于 LB 名称的注意事项： - * 确保回滚与升级兼容 - * - SingleStack -v4 (v1.16 之前的版本) => BackendPool 名称 == clusterName - * - SingleStack -v6 => BackendPool 名称 == clusterName （所有集群引导程序都使用此名称） - * 双栈： - * => IPv4 BackendPool 名称 == clusterName - * => IPv6 BackendPool 名称 == -IPv6 - * 结果是： - * - 从 IPv4 迁移到双协议栈的集群将无需更改 - * - 从 IPv6（虽然在集群外没有发现，但我们不能排除存在的集群）到双栈的集群将需要删除后端池（协调器将负责创建正确的后端池） - -* 将 VolumePVCDataSource（克隆）功能升级到 1.16 版的 Beta 功能。见 ([#81792](https://github.com/kubernetes/kubernetes/pull/81792)、[@j-griffith](https://github.com/j-griffith))。 -* 删除 kubectl log,改用 kubectl logs。见 ([#78098](https://github.com/kubernetes/kubernetes/pull/78098)、[@soltysh](https://github.com/soltysh))。 -* 支持 CSI 临时内联卷为 Beta 功能，即默认情况下启用 CSIInlineVolume 功能开关。见 ([#82004](https://github.com/kubernetes/kubernetes/pull/82004)、[@pohly](https://github.com/pohly))。 -* kubectl：现在可以通过 `kubectl wait` 来支持 --all-namespaces 参数。([#81468](https://github.com/kubernetes/kubernetes/pull/81468)、[@ashutoshgngwr](https://github.com/ashutoshgngwr))。 - -* 现在，将 kube-proxy 指标标记为 ALPHA 稳定性级别。见 ([#81626](https://github.com/kubernetes/kubernetes/pull/81626)、[@logicalhan](https://github.com/logicalhan))。 -* 现在，将 kube-controller-manager 和 cloud-controller-manager 指标标记为 ALPHA 稳定性级别。见 ([#81624](https://github.com/kubernetes/kubernetes/pull/81624)、[@logicalhan](https://github.com/logicalhan))。 - -* 添加用于管理新 EndpointSlice 资源的 Endpoint Slice 控制器，默认情况下禁用。见 ([#81048](https://github.com/kubernetes/kubernetes/pull/81048)、[@robscott](https://github.com/robscott))。 - -* + 运行：见 ([#79386](https://github.com/kubernetes/kubernetes/pull/79386)、[@khenidak](https://github.com/khenidak))。 - * Master: 将服务 CIDR 转换为 list `--service-cluster-ip-range=,`，并确保已打开 IPv6DualStack 功能参数。该参数已验证并按以下方式使用： - - * 1. `--service-cluster-ip-range[0]` 被认为是主要服务范围，并且将用于具有 `Service.Spec.IPFamily = nil` 的任何服务或打开功能标志时的任何服务。 - * 2. 集群可以是双栈的（即 Pod 和节点都带有双栈 IP），但无需支持双栈上的入口。在这种情况下，集群可以使用 `PodIPs` 执行出口（根据用户代码中的族和绑定选择），但是仅针对 Pod 主 IP 执行入口。可以通过向 `--service-cluster-ip-range` 参数提供单个条目来进行配置。 - * 3. `--service-cluster-ip-range` 参数中最多允许两个条目，并且它们被验证为双堆叠，例如 `--service-cluster-ip-range=,` 或者 `--service-cluster-ip-range=,`。 - * 4. 范围的最大 20 位 （最小网络位 `/108` 或 `/12`） - * kube-controller-manager：将服务 CIDR 转换为 list `--service-cluster-ip-range=,`，并确保已打开 IPv6DualStack 功能参数。该参数如上所述进行验证。 - - * + 使用： - * 已添加新的服务规范字段 `Service.Spec.IPFamily`。该字段的默认值为 family（--service-cluster-ip-range 参数中的第一个服务 cidr）。一旦打开功能开关，该值将如上所述为默认值，这是此字段的可能值： - * 2. IPv4：api-server 将从 `service-cluster-ip-range` 中分配一个 IP 地址为 `ipv4`（根据它们的配置是主 IP 还是辅助 IP）。 - * 2. IPv6：api-server 将从 `service-cluster-ip-range` 中分配一个 IP 地址为 `ipv6`（根据它们的配置是主 IP 还是辅助 IP）。 - * 注意事项 （v1.16）： - * 1. 从 v1.16 开始，IPVS 是双栈模式支持的唯一代理。 - * 2. 双栈与 `EndpointSlice` 功能互斥，不能同时打开。`metaproxy` 还没有实现 EndpointSlice 处理功能。 - - -* /metrics 和 /metrics/probes 的 kubelet 指标现已被标记为 ALPHA 稳定性级别。见 ([#81534](https://github.com/kubernetes/kubernetes/pull/81534)、[@logicalhan](https://github.com/logicalhan))。 -* 添加了可用于了解身份验证尝试的指标 `authentication_attempts`。见 ([#81509](https://github.com/kubernetes/kubernetes/pull/81509)、[@RainbowMango](https://github.com/RainbowMango))。 -* 修复了针对 SCTP Nodeport 服务的 kube-proxy 问题，该服务仅适用于节点的 InternalIP，但不适用于启用 ipvs 时节点中存在的其他 IP。见 ([#81477](https://github.com/kubernetes/kubernetes/pull/81477)、[@paulsubrata55](https://github.com/paulsubrata55))。 -* `CustomResourceValidation`、`CustomResourceSubresources`、`CustomResourceWebhookConversion` 和 `CustomResourcePublishOpenAPI` 功能现在已成为 GA，但是不赞成使用相关功能开关，因为这些参数将在 v1.18 中被删除。见 ([#81965](https://github.com/kubernetes/kubernetes/pull/81965)、[@roycaihw](https://github.com/roycaihw))。 - -* 在 GCI 上使用 Node-Problem-Detector v0.7.1。见 ([#80726](https://github.com/kubernetes/kubernetes/pull/80726)、[@wangzhen127](https://github.com/wangzhen127))。 -* kubeadm：如果用户希望修改某些 kubelet 安全配置参数，则可以防止它们被覆盖。见 ([#81903](https://github.com/kubernetes/kubernetes/pull/81903)、[@jfbai](https://github.com/jfbai))。 -* 在 Alpha 功能中引入 `node.kubernetes.io/exclude-balancer` 和 `node.kubernetes.io/exclude-disruption` 标签，以防止集群部署者依赖于并非所有集群都可以提供的可选 `node-role` 标签。见 ([#80238](https://github.com/kubernetes/kubernetes/pull/80238)、[@smarterclayton](https://github.com/smarterclayton))。 - -* 现在，Scheduler 指标已被标记为具有 ALPHA 稳定性级别。见 ([#81576](https://github.com/kubernetes/kubernetes/pull/81576)、[@logicalhan](https://github.com/logicalhan))。 -* 现在已正确设置了缓存控制头部。如果 etags 匹配，则只有 openapi 是可缓存的。见 ([#81946](https://github.com/kubernetes/kubernetes/pull/81946)、[@deads2k](https://github.com/deads2k))。 -* 添加了验证 WindowsOptions.RunAsUserName 的 E2E 测试。见 ([#79539](https://github.com/kubernetes/kubernetes/pull/79539)、[@bclau](https://github.com/bclau))。 - -* 现在，kube-apiserver 指标已被标记为 ALPHA 稳定性级别。见 ([#81531](https://github.com/kubernetes/kubernetes/pull/81531)、[@logicalhan](https://github.com/logicalhan))。 -* 将 CSI 卷扩展移动到 Beta 功能。见 ([#81467](https://github.com/kubernetes/kubernetes/pull/81467)、[@bertinatto](https://github.com/bertinatto))。 -* 在 Windows 节点上支持 kubelet 插件监视程序。见 ([#81397](https://github.com/kubernetes/kubernetes/pull/81397)、[@ddebroy](https://github.com/ddebroy))。 -* 更新 requestedToCapacityRatioArguments 函数用以添加资源参数，该参数允许用户指定资源名称以及每个资源的权重，然后基于请求与容量之比为节点评分。见 ([#77688](https://github.com/kubernetes/kubernetes/pull/77688)、[@sudeshsh](https://github.com/sudeshsh))。 - -* 服务负载均衡器的 Finalizer 保护现在处于 Beta（默认启用）中。此功能可确保在删除相关的负载均衡器资源之前，不会完全删除服务资源。见 ([#81691](https://github.com/kubernetes/kubernetes/pull/81691)、[@MrHohn](https://github.com/MrHohn))。 -* 在 Windows 上增加了对 vSphere 卷的支持。见 ([#80911](https://github.com/kubernetes/kubernetes/pull/80911)、[@gab-satchi](https://github.com/gab-satchi))。 -* 记录 kube-apiserver 重新生成 OpenAPI 规范的时间以及原因。OpenAPI 规范的生成是一个非常占用 CPU 的过程，它对 CRD 和 APIServices 的连续更新很敏感。见 ([#81786](https://github.com/kubernetes/kubernetes/pull/81786)、[@sttts](https://github.com/sttts))。 - * 添加了指标 `aggregator_openapi_v2_regeneration_count`、`aggregator_openapi_v2_regeneration_gauge` 和 `apiextension_openapi_v2_regeneration_count`，这些指标统计了（添加，更新，删除）操作时触发的 APIService 和 CRD 以及原因。 - -* 解决了 PodTolerationRestriction admission controller（准入控制器）中的容忍度合并和白名单检查问题。见 ([#81732](https://github.com/kubernetes/kubernetes/pull/81732)、[@tallclair](https://github.com/tallclair))。 -* 添加一个 helper 函数来解码 scheduler 插件参数。见 ([#80696](https://github.com/kubernetes/kubernetes/pull/80696)、[@hex108](https://github.com/hex108))。 -* 将 metadata.generation = 1 添加到旧的 CustomResources。见 ([#82005](https://github.com/kubernetes/kubernetes/pull/82005)、[@sttts](https://github.com/sttts))。 -* kubeadm 在其启动前检查中不再执行 IPVS 检查。见 ([#81791](https://github.com/kubernetes/kubernetes/pull/81791)、[@yastij](https://github.com/yastij))。 - -* RemainingItemCount 功能现在为 Beta 功能。见 ([#81682](https://github.com/kubernetes/kubernetes/pull/81682)、[@caesarxuchao](https://github.com/caesarxuchao))。 - * remainingItemCount 是列表中未包括在此列表响应中的后续项目的数量。如果列表请求中包含标签或字段选择器，则剩余项目数未知并且在序列化期间该字段将保持不变并被忽略。如果列表是完整的（不是因为它不是分块的，或者是因为这是最后一个块），那么将不再有剩余的项目，并且在序列化期间将保留此字段并将其省略。低于 v1.15 的服务器未设置此字段。remainingItemCount 的预期用途是*估计*集合的大小。客户端不应依赖于 remainingItemCount 进行准确无误的设置。 - -* CustomResourceDefaulting 功能升级为 Beta 功能，并且默认情况下启用。可以在结构模式中通过 `apiextensions.k8s.io/v1` API 指定默认值。有关详细信息，请参见 https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/#specifying-a-structural-schema。见 ([#81872](https://github.com/kubernetes/kubernetes/pull/81872)、[@sttts](https://github.com/sttts))。 -* kubectl 可以再次扩展自定义资源。见 ([#81342](https://github.com/kubernetes/kubernetes/pull/81342)、[@knight42](https://github.com/knight42))。 -* 支持临时内联卷的 CSI 驱动程序必须通过提供 CSIDriver 对象来明确声明，该对象的新 “mode” 字段设置为 “ephemeral” 或 “persistent+ephemeral”。见 ([#80568](https://github.com/kubernetes/kubernetes/pull/80568)、[@pohly](https://github.com/pohly))。 - -* `framework.ExpectNoError` 不再记录错误，而是依靠使用新的 `log.Fail` 作为 Gomega 故障处理程序。见 ([#80253](https://github.com/kubernetes/kubernetes/pull/80253)、[@pohly](https://github.com/pohly))。 -* 现在，审核事件记录了异常 Webhooks 的存在和补丁。见 ([#77824](https://github.com/kubernetes/kubernetes/pull/77824)、[@roycaihw](https://github.com/roycaihw))。 - * 在元数据审核级别或更高级别上，将使用 JSON 有效负载记录具有键 "mutation.webhook.admission.k8s.io/round_{round idx}_index_{order idx}" 的注释，该注释表示针对给定请求调用了 Webhook，以及是否更改了对象。 - * 在请求审计级别或更高级别上，带有 "patch.webhook.admission.k8s.io/round_{round idx}_index_{order idx}" 键的注释将与 JSON 有效负载一起记录，该有效负载记录 Webhook 针对给定请求发送的补丁。 - -* 解决了阻止块卷调整大小的问题。见 ([#81429](https://github.com/kubernetes/kubernetes/pull/81429)、[@huffmanca](https://github.com/huffmanca))。 -* 验证是否修改了 OpenAPI 规范中的 CRD 默认值，`metadata` 下的值除外。见 ([#78829](https://github.com/kubernetes/kubernetes/pull/78829)、[@sttts](https://github.com/sttts))。 -* scheduling framework 中使用 PostFilter 代替 Postfilter。见 ([#81800](https://github.com/kubernetes/kubernetes/pull/81800)、[@draveness](https://github.com/draveness))。 - * 在 scheduling framework 中使用 PreFilter 代替 Prefilter - * 在 scheduling framework 中使用 PreBind 代替 Prebind - -* 修复了 Windows 服务器容器的 `kubectl logs -f` 问题。见 ([#81747](https://github.com/kubernetes/kubernetes/pull/81747)、[@Random-Liu](https://github.com/Random-Liu))。 -* 修复了由于区分大小写而导致的 Azure 磁盘命名匹配问题。见 ([#81720](https://github.com/kubernetes/kubernetes/pull/81720)、[@andyzhangx](https://github.com/andyzhangx))。 -* 修复了一个 bug，即当出现 “connection refused” 错误时，反射器的 ListAndWatch 函数将直接返回，但预期的是睡眠 1 秒钟并从指定的 resourceVersion 重新开始监视。见 ([#81634](https://github.com/kubernetes/kubernetes/pull/81634)、[@likakuli](https://github.com/likakuli))。 -* 修复了带有 io.k8s.apimachinery.pkg.runtime.RawExtension 的 openAPI 定义的错误问题，该错误以前需要指定字段 "raw"。见 ([#80773](https://github.com/kubernetes/kubernetes/pull/80773)、[@jennybuckley](https://github.com/jennybuckley))。 - -* kubeadm：打印 klog 级别大于 5 的错误的堆栈跟踪信息。见 ([#80937](https://github.com/kubernetes/kubernetes/pull/80937)、[@neolit123](https://github.com/neolit123))。 -* 修复了 iptables 代理模式可能会导致长时间延迟的问题。见 ([#80368](https://github.com/kubernetes/kubernetes/pull/80368)、[@danwinship](https://github.com/danwinship))。 - * 在 RHEL 或 CentOS 7 上的超大型集群中更新服务或端点 IP。 -* kubeadm：支持任何 3.10 以上的 Linux 内核版本。见 ([#81623](https://github.com/kubernetes/kubernetes/pull/81623)、[@neolit123](https://github.com/neolit123))。 -* 添加了指标 'apiserver_watch_events_sizes'，可用于估计系统中监视事件的大小。见 ([#80477](https://github.com/kubernetes/kubernetes/pull/80477)、[@mborsz](https://github.com/mborsz))。 - -* 从 scheduler framework 配置 API 中删除了 NormalizeScore plugin，而是仅使用 ScorePlugin。见 ([#80930](https://github.com/kubernetes/kubernetes/pull/80930)、[@liu-cong](https://github.com/liu-cong))。 -* kubeadm reset：仅针对 Linux 卸载 "/var/lib/kubelet" 下的目录。见 ([#81494](https://github.com/kubernetes/kubernetes/pull/81494)、[@Klaven](https://github.com/Klaven))。 -* 将 fluentd-elasticsearch docker 镜像更新为 fluentd 1.6.3。见 ([#80912](https://github.com/kubernetes/kubernetes/pull/80912)、[@monotek](https://github.com/monotek))。 - -* 现在，Kubeadm 在升级 CoreDNS 时无差异地迁移 CoreDNS 配置。见 ([#78033](https://github.com/kubernetes/kubernetes/pull/78033)、[@rajansandeep](https://github.com/rajansandeep))。 -* 如果启用了 PodOverhead 功能，则将引入了 Pod 开销应用于 Pod cgroup 的支持。见 ([#79247](https://github.com/kubernetes/kubernetes/pull/79247)、[@egernst](https://github.com/egernst))。 -* GCE 上的 Windows 节点现在在启用 Windows 防护的情况下运行。见 ([#81625](https://github.com/kubernetes/kubernetes/pull/81625)、[@pjh](https://github.com/pjh))。 - -# v1.16.0-beta.1 - - -[文档](https://docs.k8s.io) - - -## 下载 v1.16.0-beta.1 - - - -文件名 | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes.tar.gz) | `16513ebb52b01afee26156dcd4c449455dc328d7a080ba54b3f3a4584dbd9297025e33a9dafe758b259ae6e33ccb84a18038f6f415e98be298761c4d3dfee94b` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-src.tar.gz) | `3933f441ebca812835d6f893ec378896a8adb7ae88ca53247fa402aee1fda00d533301ac806f6bf106badf2f91be8c2524fd98e9757244b4b597c39124c59d01` - - -### 客户端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-client-darwin-386.tar.gz) | `28f0a8979f956aa5b3be1c1158a3ade1b242aac332696cb604fbdba44c4279caa1008840af01e50692bf48d0342018f882dd6e30f9fe3279e9784094cfc9ff3c` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-client-darwin-amd64.tar.gz) | `8804f60b690e5180125cf6ac6d739ad5432b364c5e0d0ee0d2f06220c86ca3a2cffc475e0e3c46c19466e5d1566a5b8bf0a33191cba5bbd3ff27ac64ceee57a0` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-client-linux-386.tar.gz) | `8f7f86db5a496afd269b926b6baf341bbd4208f49b48fad1a44c5424812667b3bd7912b5b97bd7844dee2a7c6f9441628f7b5db3caa14429020de7788289191c` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-client-linux-amd64.tar.gz) | `7407dc1216cac39f15ca9f75be47c0463a151a3fda7d9843a67c0043c69858fb36eaa6b4194ce5cefd125acd7f521c4b958d446bb0c95ca73a3b3ae47af2c3ee` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-client-linux-arm.tar.gz) | `249a82a0af7d8062f49edd9221b3823590b6d166c1bca12c787ae640d6a131bd6a3d7c99136de62074afa6cabe8900dcf4e11037ddbfdf9d5252fc16e256eeb5` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-client-linux-arm64.tar.gz) | `3a8416d99b6ae9bb6d568ff15d1783dc521fe58c60230f38126c64a7739bf03d8490a9a10042d1c4ef07290eaced6cb9d42a9728d4b937305d63f8d3cc7a66f8` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-client-linux-ppc64le.tar.gz) | `105bf4afeccf0b314673265b969d1a7f3796ca3098afa788c43cd9ff3e14ee409392caa5766631cca180e790d92731a48f5e7156167637b97abc7c178dd390f3` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-client-linux-s390x.tar.gz) | `98de73accb7deba9896e14a5012a112f6fd00d6e6868e4d21f61b06605efa8868f1965a1c1ba72bb8847416bc789bd7ef5c1a125811b6c6df060217cd84fdb2c` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-client-windows-386.tar.gz) | `7a43f3285b0ab617990497d41ceadfbd2be2b72d433b02508c198e9d380fb5e0a96863cc14d0e9bf0317df13810af1ab6b7c47cd4fa1d0619a00c9536dc60f0f` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-client-windows-amd64.tar.gz) | `f3fafcffc949bd7f8657dd684c901e199b21c4812009aca1f8cf3c8bf3c3230cab072208d3702d7a248c0b957bc513306dd437fb6a54e1e64b4d7dc8c3c180cd` - - -### 服务器端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-server-linux-amd64.tar.gz) | `87b46e73ae2162ee49f510da6549e57503d3ea94b3c4488f39b0b93d45603f540ece30c3784c5e201711a7ddd1260481cd20ac4c618eaf46879e841d054a115a` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-server-linux-arm.tar.gz) | `80ba8e615497c0b9c339fbd2d6a4dda54fdbd5659abd7d8e8d448d8d8c24ba7f0ec48693e4bf8ed20513c46432f2a0f1039ab9044f0ed006b935a58772372d95` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-server-linux-arm64.tar.gz) | `b4a76a5fc026b4b3b5f9666df05e46896220591b21c147982ff3d91cec7330ed78cf1fc63f5ab759820aadbcfe400c1ad75d5151d9217d42e3da5873e0ff540d` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-server-linux-ppc64le.tar.gz) | `fb435dfd5514e4cd3bc16b9e71865bff3cdd5123fc272c8cbc5956c260449e0dcfd30d2fdb120da73134e62f48507c5a02d4528d7b9d978765ff4ed740b274e8` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-server-linux-s390x.tar.gz) | `65ed3d372a4d03493d0a586c7f67f1236aa99f02552195f1fb58079bc24787200d9a0f34d0c311a846345d0d70d02ad726f74376a91d3ced234bbfdce80c5133` - - -### 节点可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-node-linux-amd64.tar.gz) | `c9161689532a5e995a68bb0985a983dc43d8e747a05f37849cd33062c07e5202417b26bff652b8bc9c0005026618b7ebc56f918c71747a3addb5da044e683b4a` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-node-linux-arm.tar.gz) | `7dba9fdb290f33678983c046eb145446edb1b7479c2403f9e8bd835c3d832ab1f2acb28124c53af5b046d47ab433312d6a654f000a22f8e10795b0bc45bfbddb` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-node-linux-arm64.tar.gz) | `8c435824667cd9ec7efdfb72c1d060f62ca61b285cbb9575a6e6013e20ec5b379f77f51d43ae21c1778a3eb3ef69df8895213c54e4b9f39c67c929a276be12de` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-node-linux-ppc64le.tar.gz) | `2cfca30dbe49a38cd1f3c78135f60bf7cb3dae0a8ec5d7fa651e1c5949254876fbab8a724ed9a13f733a85b9960edcc4cc971dc3c16297db609209c4270f144f` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-node-linux-s390x.tar.gz) | `63bbe469ddd1be48624ef5627fef1e1557a691819c71a77d419d59d101e8e6ee391eb8545da35b412b94974c06d73329a13660484ab26087a178f34a827a3dcb` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-beta.1/kubernetes-node-windows-amd64.tar.gz) | `07cb97d5a3b7d0180a9e22696f417422a0c043754c81ae68338aab7b520aa7c119ff53b9ad835f9a0bc9ea8c07483ce506af48d65641dd15d30209a696b064bb` - - -## 自 v1.16.0-alpha.3 起的变更日志 - - -### 需要进行的操作 - - -* 删除了 scheduler.alpha.kubernetes.io/critical-pod 注解。应使用 Pod priority（spec.priorityClassName）将 Pod 标记为关键。这是必须要进行的操作。见 ([#80342](https://github.com/kubernetes/kubernetes/pull/80342)、[@draveness](https://github.com/draveness))。 -* 删除了 cadvisor 指标标签 `pod_name` 和 `container_name` 以符合仪器指南。见 ([#80376](https://github.com/kubernetes/kubernetes/pull/80376)、[@ehashman](https://github.com/ehashman))。 - * 需要进行的操作：标签的任何 Prometheus 查询（例如 cadvisor 或 kubelet 探测指标）都必须更新为使用 `pod` 和 `container` 标签。 -* 删除了 DirectCodecFactory（用 serializer.WithoutConversionCodecFactory 替换）、DirectEncoder（用 runtime.WithVersionEncoder 替换）和 DirectDecoder（用 runtime.WithoutVersionDecoder 替换）。这是必须要进行的操作。见 ([#79263](https://github.com/kubernetes/kubernetes/pull/79263)、[@draveness](https://github.com/draveness))。 - - -### 其他值得注意的变化 - - -* 修复使用 dangling 错误分离 Azure 磁盘的问题。见 ([#81266](https://github.com/kubernetes/kubernetes/pull/81266)、[@andyzhangx](https://github.com/andyzhangx))。 -* 转换 webhooks 现在可以通过将 `v1` 包含在 CustomResourceDefinition 的 `conversionReviewVersions` 列表中来表明它们支持 `apiextensions.k8s.io/v1` 版本的 `ConversionReview` API 对象的接收和响应。转换 webhooks 必须在收到的 apiVersion 中以 ConversionReview 对象作为响应。`apiextensions.k8s.io/v1` `ConversionReview` 响应必须指定一个 `response.uid`，该响应与发送对象的 `request.uid` 相匹配。见 ([#81476](https://github.com/kubernetes/kubernetes/pull/81476)、[@liggitt](https://github.com/liggitt))。 -* 通过以下更改，将 `CustomResourceDefinition` API 类型升级为 `apiextensions.k8s.io/v1`：见 ([#79604](https://github.com/kubernetes/kubernetes/pull/79604)、[@liggitt](https://github.com/liggitt))。 - - * 通过以下更改将 `CustomResourceDefinition` API 类型升级为 `apiextensions.k8s.io/v1`： - * `spec.scope` 不再默认为 `Namespaced`，必须明确指定 `spec.scope` - * 删除了 `spec.version`；改用 `spec.versions` - * 删除了 `spec.validation`；改用 `spec.versions[*].schema` - * 删除了 `spec.subresources`；改用 `spec.versions[*].subresources` - * 删除了 `spec.additionalPrinterColumns`；改用 `spec.versions[*].additionalPrinterColumns` - * 将 `spec.conversion.webhookClientConfig` 移至 `spec.conversion.webhook.clientConfig` - * 将 `spec.conversion.conversionReviewVersions` 移至 `spec.conversion.webhook.conversionReviewVersions` - * 现在，在创建 v1 CustomResourceDefinitions 时需要 `spec.versions[*].schema.openAPIV3Schema` - * 创建 v1 CustomResourceDefinitions 时不允许使用 `spec.preserveUnknownFields: true`；必须在模式定义中将其指定为 `x-kubernetes-preserve-unknown-fields: true`。 - * 在 `additionalPrinterColumns` 项目中，将 `JSONPath` 字段重命名为 `jsonPath`，见 [参考](https://github.com/kubernetes/kubernetes/issues/66531)。 - -* openapi 现在可以为自定义资源发布其正确支持的补丁程序类型。见 ([#81515](https://github.com/kubernetes/kubernetes/pull/81515)、[@liggitt](https://github.com/liggitt))。 -* 如果现在没有配置 subscriptionId，则可以在没有 Azure 身份的情况下运行 kubelet。见 ([#81500](https://github.com/kubernetes/kubernetes/pull/81500)、[@feiskyer](https://github.com/feiskyer))。 - * 一个云提供商配置示例为：'{"vmType": "vmss", "useInstanceMetadata": true}'。 -* 在 Pod 中指定但未在其中使用的卷不再需要在 `node.status.volumesInUse` 中格式化、安装和报告。见 ([#81163](https://github.com/kubernetes/kubernetes/pull/81163)、[@jsafrane](https://github.com/jsafrane))。 - -* kubeadm：使用 etcd 的 /health 端点进行本地主机上的 HTTP 活跃探针操作，而不是使用 etcdctl 进行自定义健康检查。见 ([#81385](https://github.com/kubernetes/kubernetes/pull/81385)、[@neolit123](https://github.com/neolit123))。 -* kubeamd：使用 --pod-network-cidr 参数进行初始化或使用 kubeadm 配置中的 podSubnet 字段传递以逗号分隔的 Pod CIDR 列表。见 ([#79033](https://github.com/kubernetes/kubernetes/pull/79033)、[@Arvinderpal](https://github.com/Arvinderpal))。 -* 更新 go 到 1.12.9。见 ([#81489](https://github.com/kubernetes/kubernetes/pull/81489)、[@BenTheElder](https://github.com/BenTheElder))。 -* 更新 Azure SDK + go-autorest API 版本。见 ([#79574](https://github.com/kubernetes/kubernetes/pull/79574)、[@justaugustus](https://github.com/justaugustus))。 -* Extender 绑定应该匹配 IsInterested。见 ([#79804](https://github.com/kubernetes/kubernetes/pull/79804)、[@yqwang-ms](https://github.com/yqwang-ms))。 -* 添加设置 “应用程序默认凭证” 说明，用于在本地运行 GCE Windows e2e 测试。见 ([#81337](https://github.com/kubernetes/kubernetes/pull/81337)、[@YangLu1031](https://github.com/YangLu1031))。 - -* Scheduler 应在释放领导者 lock 锁时终止。见 ([#81306](https://github.com/kubernetes/kubernetes/pull/81306)、[@ravisantoshgudimetla](https://github.com/ravisantoshgudimetla))。 -* kubelet 现在新增一个 "kubelet_evictions" 指标，该指标统计 kubelet 为回收资源而执行的 Pod 驱逐的数量。见 ([#81377](https://github.com/kubernetes/kubernetes/pull/81377)、[@sjenning](https://github.com/sjenning))。 -* 当计分插件返回的分数超出 [0，100] 范围时，返回错误。见 ([#81015](https://github.com/kubernetes/kubernetes/pull/81015)、[@draveness](https://github.com/draveness))。 -* 更新 go 到 1.12.8。见 ([#81390](https://github.com/kubernetes/kubernetes/pull/81390)、[@cblecker](https://github.com/cblecker))。 -* 如果清除成功，则 kube-proxy --cleanup 将返回正确的退出代码。见 ([#78775](https://github.com/kubernetes/kubernetes/pull/78775)、[@johscheuer](https://github.com/johscheuer))。 -* 删除日志中的 iSCSI 卷存储明文秘密。见 ([#81215](https://github.com/kubernetes/kubernetes/pull/81215)、[@zouyee](https://github.com/zouyee))。 -* 在规范化评分阶段，使用命名数组而不是分数数组。见 ([#80901](https://github.com/kubernetes/kubernetes/pull/80901)、[@draveness](https://github.com/draveness))。 - -* 如果 scheduler 扩展程序过滤了一个未找到的节点，则此 Pod 的当前调度回合将被跳过。见 ([#79641](https://github.com/kubernetes/kubernetes/pull/79641)、[@yqwang-ms](https://github.com/yqwang-ms))。 -* 更新 golang/x/net 相关依赖项，修复 CVE-2019-9512、CVE-2019-9514 相关问题。见 ([#81394](https://github.com/kubernetes/kubernetes/pull/81394)、[@cblecker](https://github.com/cblecker))。 -* 修复 CVE-2019-11250 问题：现在，client-go header（头部）日志记录（详细级别大于等于 7）掩盖了 `Authorization` 头部内容。见 ([#81330](https://github.com/kubernetes/kubernetes/pull/81330)、[@tedyu](https://github.com/tedyu))。 -* 解决服务器启动期间对自定义资源请求的瞬态 404 响应。见 ([#81244](https://github.com/kubernetes/kubernetes/pull/81244)、[@liggitt](https://github.com/liggitt))。 -* PVC 上的非 nil 数据源条目现在显示为 `describe pvc` 输出的一部分。见 ([#76463](https://github.com/kubernetes/kubernetes/pull/76463)、[@j-griffith](https://github.com/j-griffith))。 -* 修复 Azure 客户端请求在 http.StatusTooManyRequests（HTTP 代码 429）上卡住的问题。([#81279](https://github.com/kubernetes/kubernetes/pull/81279)、[@feiskyer](https://github.com/feiskyer))。 - -* 实施一项新功能，该功能允许将 kustomize 修补程序应用于 kubeadm 生成的静态 pod 清单。见 ([#80905](https://github.com/kubernetes/kubernetes/pull/80905)、[@fabriziopandini](https://github.com/fabriziopandini))。 -* 添加服务注解 `service.beta.kubernetes.io/azure-pip-name`，用于指定 Azure 负载均衡器的公共 IP 名称。见 ([#81213](https://github.com/kubernetes/kubernetes/pull/81213)、[@nilo19](https://github.com/nilo19))。 -* 修复了 IPVS 代理中的一个错误，该错误是即使删除了相应的 Service 对象，也无法清理虚拟服务器。见 ([#80942](https://github.com/kubernetes/kubernetes/pull/80942)、[@gongguan](https://github.com/gongguan))。 -* 添加对 RuntimeClasses 的调度支持。现在，RuntimeClasses 可以指定 nodeSelector 约束和容忍度，并使用该 RuntimeClass 将约束和容忍合并到 PodSpec 中。见 ([#80825](https://github.com/kubernetes/kubernetes/pull/80825)、[@tallclair](https://github.com/tallclair))。 -* 可以以非 root 用户身份运行 etcd Docker 镜像。见 ([#79722](https://github.com/kubernetes/kubernetes/pull/79722)、[@randomvariable](https://github.com/randomvariable))。 -* kubeadm：生成的 CSR 文件的权限从 0644 更改为 0600。见 ([#81217](https://github.com/kubernetes/kubernetes/pull/81217)、[@SataQiu](https://github.com/SataQiu))。 -* 当其他 Azure 操作取消请求时，修复冲突的缓存问题。见 ([#81282](https://github.com/kubernetes/kubernetes/pull/81282)、[@feiskyer](https://github.com/feiskyer))。 - -* 修复 kubelet 节点租赁潜在的性能问题。kubelet 现在将尝试使用缓存的租约来更新租约，而不是每次都从 API Server 获取租约。见 ([#81174](https://github.com/kubernetes/kubernetes/pull/81174)、[@answer1991](https://github.com/answer1991))。 -* 改进自定义资源的验证错误。([#81212](https://github.com/kubernetes/kubernetes/pull/81212)、[@liggitt](https://github.com/liggitt))。 -* 改进 kube-proxy。kube-proxy 等待一段时间以定义节点。见 ([#77167](https://github.com/kubernetes/kubernetes/pull/77167)、[@paulsubrata55](https://github.com/paulsubrata55))。 -* hyperkube 将在将来的版本中放弃对云控制器管理器的支持。见 ([#81219](https://github.com/kubernetes/kubernetes/pull/81219)、[@dims](https://github.com/dims))。 -* 在 ipvs 和 iptables 模式，为 kube-proxy iptables-restore 故障添加了新的 Prometheus 计数器指标 "sync_proxy_rules_iptables_restore_failures_total"。见 ([#81210](https://github.com/kubernetes/kubernetes/pull/81210)、[@figo](https://github.com/figo))。 -* 在 `ScaleInterface` 中添加 `Patch` 方法。见 ([#80699](https://github.com/kubernetes/kubernetes/pull/80699)、[@knight42](https://github.com/knight42))。 - -* 在关联或者摘除的磁盘操作中现使用 VM Update 调用，原来的 CreateOrUpdate 调用可能导致孤立的 VM 或资源阻塞。见 ([#81208](https://github.com/kubernetes/kubernetes/pull/81208)、[@andyzhangx](https://github.com/andyzhangx))。 -* 添加 Azure 云配置 `LoadBalancerName` 和 `LoadBalancerResourceGroup`，用于允许对 Azure 负载均衡器进行相应的自定义。见 ([#81054](https://github.com/kubernetes/kubernetes/pull/81054)、[@nilo19](https://github.com/nilo19))。 -* 更新包含自 7 月以来的修补程序的 GCE Windows 节点镜像。见 ([#81106](https://github.com/kubernetes/kubernetes/pull/81106)、[@YangLu1031](https://github.com/YangLu1031))。 -* kubelet 认为所有静态 Pod 都是至关重要的。即使节点没有足够的资源，静态 Pod 也会通过 kubelet 准入准则。用户必须确保在创建静态 Pod 时占资源。见 ([#80491](https://github.com/kubernetes/kubernetes/pull/80491)、[@hpandeycodeit](https://github.com/hpandeycodeit))。 - -* kube-apiserver：`--basic-auth-file` 参数和身份验证模式已弃用，在以后的版本中将被删除。所以不建议在生产环境中使用。见 ([#81152](https://github.com/kubernetes/kubernetes/pull/81152), [@tedyu](https://github.com/tedyu))。 -* 修复了 printer 函数 marshals 操作时，将空字节或 uint8 切片作为 null 的错误。见 ([#81096](https://github.com/kubernetes/kubernetes/pull/81096)、[@roycaihw](https://github.com/roycaihw))。 -* 弃用 kube-apiserver 中的 `--cloud-provider-gce-lb-src-cidrs` 参数。一旦从 kube-apiserver 中删除了 GCE 云提供商，该参数将被删除。见 ([#81094](https://github.com/kubernetes/kubernetes/pull/81094), [@andrewsykim](https://github.com/andrewsykim))。 -* kubernetes 版本不再附带 cloud-controller-manager 二进制文件和 docker 镜像。见 ([#81029](https://github.com/kubernetes/kubernetes/pull/81029)、[@dims](https://github.com/dims))。 -* API：`metadata.selfLink` 字段在单个和列表对象中已弃用。从 v1.20 开始将不再返回该字段，而在 v1.21 中将完全删除该字段。见 ([#80978](https://github.com/kubernetes/kubernetes/pull/80978)、[@wojtek-t](https://github.com/wojtek-t))。 - - -# v1.16.0-alpha.3 - - -[文档](https://docs.k8s.io) - - -## 下载 v1.16.0-alpha.3 - - -文件名 | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes.tar.gz) | `82bc119f8d1e44518ab4f4bdefb96158b1a3634c003fe1bc8dcd62410189449fbd6736126409d39a6e2d211a036b4aa98baef3b3c6d9f7505e63430847d127c2` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-src.tar.gz) | `bbf330b887a5839e3d3219f5f4aa38f1c70eab64228077f846da80395193b2b402b60030741de14a9dd4de963662cfe694f6ab04035309e54dc48e6dddd5c05d` - - -### 客户端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-client-darwin-386.tar.gz) | `8d509bdc1ca62463cbb25548ec270792630f6a883f3194e5bdbbb3d6f8568b00f695e39950b7b01713f2f05f206c4d1df1959c6ee80f8a3e390eb94759d344b2` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-client-darwin-amd64.tar.gz) | `1b00b3a478c210e3c3e6c346f5c4f7f43a00d5ef6acb8d9c1feaf26f913b9d4f97eb6db99bbf67953ef6399abe4fbb79324973c1744a6a8cd76067cb2aeed2ca` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-client-linux-386.tar.gz) | `82424207b4ef52c3722436eaaf86dbe5c93c6670fd09c2b04320251028fd1bb75724b4f490b6e8b443bd8e5f892ab64612cd22206119924dafde424bdee9348a` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-client-linux-amd64.tar.gz) | `57ba937e58755d3b7dfd19626fedb95718f9c1d44ac1c5b4c8c46d11ba0f8783f3611c7b946b563cac9a3cf104c35ba5605e5e76b48ba2a707d787a7f50f7027` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-client-linux-arm.tar.gz) | `3a3601026e019b299a6f662b887ebe749f08782d7ed0d37a807c38a01c6ba19f23e2837c9fb886053ad6e236a329f58a11ee3ec4ba96a8729905ae78a7f6c58c` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-client-linux-arm64.tar.gz) | `4cdeb2e678c6b817a04f9f5d92c5c6df88e0f954550961813fca63af4501d04c08e3f4353dd8b6dce96e2ee197a4c688245f03c888417a436b3cf70abd4ba53a` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-client-linux-ppc64le.tar.gz) | `0cc7c8f7b48f5affb679352a94e42d8b4003b9ca6f8cbeaf315d2eceddd2e8446a58ba1d4a0df18e8f9c69d0d3b5a46f25b2e6a916e57975381e504d1a4daa1b` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-client-linux-s390x.tar.gz) | `9d8fa639f543e707dc65f24ce2f8c73a50c606ec7bc27d17840f45ac150d00b3b3f83de5e3b21f72b598acf08273e4b9a889f199f4ce1b1d239b28659e6cd131` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-client-windows-386.tar.gz) | `05bf6e696da680bb8feec4f411f342a9661b6165f4f0c72c069871983f199418c4d4fa1e034136bc8be41c5fecc9934a123906f2d5666c09a876db16ae8c11ad` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-client-windows-amd64.tar.gz) | `b2097bc851f5d3504e562f68161910098b46c66c726b92b092a040acda965fed01f45e7b9e513a4259c7a5ebd65d7aa3e3b711f4179139a935720d91216ef5c2` - - -### 服务器端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-server-linux-amd64.tar.gz) | `721bd09b64e5c8f220332417089a772d9073c0dc5cdfa240984cfeb0d681b4a02620fb3ebf1b9f6a82a4dd3423f5831c259d4bad502dce87f145e0a08cb73ee9` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-server-linux-arm.tar.gz) | `e7638ce4b88b4282f0a157593cfe809fa9cc9139ea7ebae4762ef5ac1dfaa516903a8acb34a45937eb94b2699e5d4c68c639cbe40cbed2a6b97681aeace9948e` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-server-linux-arm64.tar.gz) | `395566c4be3c2ca5b07e81221b3370bc7ccbef0879f96a9384650fcaf4f699f3b2744ba1d97ae42cc6c5d9e1a65a41a793a8b0c9e01a0a65f57c56b1420f8141` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-server-linux-ppc64le.tar.gz) | `90fcba066efd76d2f271a0eb26ed4d90483674d04f5e8cc39ec1e5b7f343311f2f1c40de386f35d3c69759628a1c7c075559c09b6c4542e42fbbe0daeb61a5fa` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-server-linux-s390x.tar.gz) | `b25014bcf4138722a710451f6e58ee57588b4d47fcceeda8f6866073c1cc08641082ec56e94b0c6d586c0835ce9b55d205d254436fc22a744b24d8c74e8e5cce` - - -### 节点可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-node-linux-amd64.tar.gz) | `6925a71096530f7114a68e755d07cb8ba714bc60b477360c85d76d7b71d3a3c0b78a650877d81aae35b308ded27c8207b5fe72d990abc43db3aa8a7d6d7f94f4` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-node-linux-arm.tar.gz) | `073310e1ccf9a8af998d4c0402ae86bee4f253d2af233b0c45cea55902268c2fe7190a41a990b079e24536e9efa27b94249c3a9236531a166ba3ac06c0f26f92` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-node-linux-arm64.tar.gz) | `c55e9aecef906e56a6003f441a7d336846edb269aed1c7a31cf834b0730508706e73ea0ae135c1604b0697c9e2582480fbfba8ba105152698c240e324da0cbd2` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-node-linux-ppc64le.tar.gz) | `e89d72d27bb0a7f9133ef7310f455ba2b4c46e9852c43e0a981b68a413bcdd18de7168eb16d93cf87a5ada6a4958592d3be80c9be1e6895fa48e2f7fa70f188d` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-node-linux-s390x.tar.gz) | `6ef8a25f2f80a806672057dc030654345e87d269babe7cf166f7443e04c0b3a9bc1928cbcf5abef1f0f0fcd37f3a727f789887dbbdae62f9d1fd90a71ed26b39` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.3/kubernetes-node-windows-amd64.tar.gz) | `22fd1cea6e0150c06dbdc7249635bbf93c4297565d5a9d13e653f9365cd61a0b8306312efc806d267c47be81621016b114510a269c622cccc916ecff4d10f33c` - - -## 自 v1.16.0-alpha.2 起的变更日志 - - -### 需要进行的操作 - - -* 需要进行的操作：见 ([#80676](https://github.com/kubernetes/kubernetes/pull/80676)、[@fabriziopandini](https://github.com/fabriziopandini))。 - * TLS 引导后，kubeadm 现在将删除 bootstrap-kubelet.conf 文件 - * 依赖 bootstrap-kubelet.conf 文件的用户应切换到包含节点凭据的 kubelet.conf - - -### 其他值得注意的变化 - - -* 修复了对使用嵌入式卷源创建的 VolumeAttachment API 对象的验证。见 ([#80945](https://github.com/kubernetes/kubernetes/pull/80945)、[@tedyu](https://github.com/tedyu))。 -* 如果共享类型的 Azure 磁盘不包含 skuname，则它们将不再失败。见 ([#80837](https://github.com/kubernetes/kubernetes/pull/80837)、[@rmweir](https://github.com/rmweir))。 - * 储存帐户类型。 -* kubeadm：修复了使用文件发现时未预加载 “certificate-authority” 文件的问题。见 ([#80966](https://github.com/kubernetes/kubernetes/pull/80966)、[@neolit123](https://github.com/neolit123))。 -* Pod 卷设置中的错误现在作为 Pod 事件传播。见 ([#80369](https://github.com/kubernetes/kubernetes/pull/80369)、[@jsafrane](https://github.com/jsafrane))。 - -* kubeadm：为 kube-scheduler 启用安全服务。见 ([#80951](https://github.com/kubernetes/kubernetes/pull/80951)、[@neolit123](https://github.com/neolit123))。 -* Kubernetes 客户端用户在调用 Kubernetes API 时可以通过在其 rest.Config 上设置 `DisableCompression` 字段来禁用自动压缩。当客户端主要通过高带宽或低延迟网络进行通信时，建议使用此方法，其中响应压缩不会改善端到端延迟。见 ([#80919](https://github.com/kubernetes/kubernetes/pull/80919)、[@smarterclayton](https://github.com/smarterclayton))。 -* 列出配置映射时，kubectl get 没有正确计算 binaryData 键的数量。见 ([#80827](https://github.com/kubernetes/kubernetes/pull/80827)、[@smarterclayton](https://github.com/smarterclayton))。 -* 为调度框架实现 “post-filter” 扩展点。见 ([#78097](https://github.com/kubernetes/kubernetes/pull/78097)、[@draveness](https://github.com/draveness))。 -* 将 GCE PD 节点附加限制减 1，因为节点启动磁盘被视为可附加磁盘。见 ([#80923](https://github.com/kubernetes/kubernetes/pull/80923)、[@davidz627](https://github.com/davidz627))。 - -* 修复了在使用外部 etcd 时将 etcd 证书与 kubeadm 用于本地 etcd 证书的名称存储在同一文件夹中的错误；对于较旧版本的 kubeadm，解决方法是避免 kubeadm 用于本地 etcd 的文件名。见 ([#80867](https://github.com/kubernetes/kubernetes/pull/80867)、[@fabriziopandini](https://github.com/fabriziopandini))。 -* 当使用 `--cgroup-driver=systemd` 指定 `--(kube|system)-reserved-cgroup` 时，现在可以使用完全限定的 cgroupfs 名称（即 `/test-cgroup.slice`）。见 ([#78793](https://github.com/kubernetes/kubernetes/pull/78793)、[@mattjmcnaughton](https://github.com/mattjmcnaughton))。 -* kubeadm：重置时将非严重错误视为警告。见 ([#80862](https://github.com/kubernetes/kubernetes/pull/80862)、[@drpaneas](https://github.com/drpaneas))。 -* kube-addon-manager 已更新至 v9.0.2 解决领导者选择错误。见 (https://github.com/kubernetes/kubernetes/pull/80575) ([#80861](https://github.com/kubernetes/kubernetes/pull/80861)、[@mborsz](https://github.com/mborsz))。 -* 确定系统模型以获取 Windows 节点的凭据。见 ([#80764](https://github.com/kubernetes/kubernetes/pull/80764)、[@liyanhui1228](https://github.com/liyanhui1228))。 - -* TBD 见 ([#80730](https://github.com/kubernetes/kubernetes/pull/80730)、[@jennybuckley](https://github.com/jennybuckley))。 -* 发送到 admission webhook 和从 admission webhook 接收到的 `AdmissionReview` API 已升级为 `admission.k8s.io/v1`。Webhooks 可以指定使用 `admissionReviewVersions: ["v1","v1beta1"]` 接收 `v1` AdmissionReview 对象的首选项，并且必须在发送它们的同一 `apiVersion` 中以 API 对象进行响应。当 Webhooks 使用 `admission.k8s.io/v1` 时，将对其响应执行以下附加验证：见 ([#80231](https://github.com/kubernetes/kubernetes/pull/80231)、[@liggitt](https://github.com/liggitt))。 - * `response.patch` 和 `response.patchType` 不允许验证 admission webhooks - * `apiVersion: "admission.k8s.io/v1"` 是必需的 - * `kind: "AdmissionReview"` 是必需的 - * `response.uid: ""` 是必需的 - * `response.patchType: "JSONPatch"` 是必需的（前提是设置了 `response.patch`） - -* 如果基于文件的发现时间过长，“kubeadm join” 将会失败，默认超时为 5 分钟。见 ([#80804](https://github.com/kubernetes/kubernetes/pull/80804)、[@olivierlemasle](https://github.com/olivierlemasle))。 -* 增强 Azure 云提供商相关代码以支持 AAD 和 ADFS 身份验证。见 ([#80841](https://github.com/kubernetes/kubernetes/pull/80841)、[@rjaini](https://github.com/rjaini))。 -* 如果 `--cloud-provider=external` 并且不存在节点地址，则尝试设置 kubelet 的主机名和内部 IP。见 ([#75229](https://github.com/kubernetes/kubernetes/pull/75229)、[@andrewsykim](https://github.com/andrewsykim))。 -* kubeadm：升级提前拉取 DaemonSet 时，避免两次删除操作。见 ([#80798](https://github.com/kubernetes/kubernetes/pull/80798)、[@xlgao-zju](https://github.com/xlgao-zju))。 -* 修复了在某些系统上连接到 localhost 上的服务的问题；特别是在 Ubuntu 上对 systemd 解析的 DNS 查询。见 ([#80591](https://github.com/kubernetes/kubernetes/pull/80591)、[@danwinship](https://github.com/danwinship))。 - -* 为调度程序框架实现规范化插件扩展点。见 ([#80383](https://github.com/kubernetes/kubernetes/pull/80383)、[@liu-cong](https://github.com/liu-cong))。 -* 使用覆盖参数修复 bash 自动完成错误。见 ([#80802](https://github.com/kubernetes/kubernetes/pull/80802)、[@dtaniwaki](https://github.com/dtaniwaki))。 -* Fix CVE-2019-11247: API server allows access to custom resources via wrong scope ([#80750](https://github.com/kubernetes/kubernetes/pull/80750), [@sttts](https://github.com/sttts)) -* 现在，会定期重试失败的 iscsi 注销。见 ([#78941](https://github.com/kubernetes/kubernetes/pull/78941)、[@jsafrane](https://github.com/jsafrane))。 -* 修复 VMSS 节点未找到公共 IP 的问题。见 ([#80703](https://github.com/kubernetes/kubernetes/pull/80703)、[@feiskyer](https://github.com/feiskyer))。 - -* 为了在 kubeadm 和 kubernetes 组件中启用双栈支持，作为 init config file 的一步，用户应在 ClusterConfiguration 中设置 `IPv6DualStack=true`。此外，对于每个工作节点，用户应使用 `nodeRegistration.kubeletExtraArgs` 或 `KUBELET_EXTRA_ARGS` 设置 kubelet 的特性开关功能。见 ([#80531](https://github.com/kubernetes/kubernetes/pull/80531), [@Arvinderpal](https://github.com/Arvinderpal))。 -* 当使用具有嵌入式凭据的发现文件时，修复 `kubeadm join --discovery-file` 操作中的错误。见 ([#80675](https://github.com/kubernetes/kubernetes/pull/80675)、[@fabriziopandini](https://github.com/fabriziopandini))。 - - - -# v1.16.0-alpha.2 - - -[文档](https://docs.k8s.io) - - -## 下载 v1.16.0-alpha.2 - - -文件名 | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes.tar.gz) | `7dfa3f8b9e98e528e2b49ed9cca5e95f265b9e102faac636ff0c29e045689145be236b98406a62eb0385154dc0c1233cac049806c99c9e46590cad5aa729183f` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-src.tar.gz) | `7cf14b92c96cab5fcda3115ec66b44562ca26ea6aa46bc7fa614fa66bda1bdf9ac1f3c94ef0dfa0e37c992c7187ecf4205b253f37f280857e88a318f8479c9a9` - - -### 客户端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-client-darwin-386.tar.gz) | `4871756de2cd1add0b07ec1e577c500d18a59e2f761595b939e1d4e10fbe0a119479ecaaf53d75cb2138363deae23cc88cba24fe3018cec6a27a3182f37cae92` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-client-darwin-amd64.tar.gz) | `dbd9ca5fd90652ffc1606f50029d711eb52d34b707b7c04f29201f85aa8a5081923a53585513634f3adb6ace2bc59be9d4ad2abc49fdc3790ef805378c111e68` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-client-linux-386.tar.gz) | `6b049098b1dc65416c5dcc30346b82e5cf69a1cdd7e7b065429a76d302ef4b2a1c8e2dc621e9d5c1a6395a1fbd97f196d99404810880d118576e7b94e5621e4c` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-client-linux-amd64.tar.gz) | `7240a9d49e445e9fb0c9d360a9287933c6c6e7d81d6e11b0d645d3f9b6f3f1372cc343f03d10026518df5d6c95525e84c41b06a034c9ec2c9e306323dbd9325b` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-client-linux-arm.tar.gz) | `947b0d9aeeef08961c0582b4c3c94b7ae1016d20b0c9f50af5fe760b3573f17497059511bcb57ac971a5bdadeb5c77dfd639d5745042ecc67541dd702ee7c657` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-client-linux-arm64.tar.gz) | `aff0258a223f5061552d340cda36872e3cd7017368117bbb14dc0f8a3a4db8c715c11743bedd72189cd43082aa9ac1ced64a6337c2f174bdcbeef094b47e76b0` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-client-linux-ppc64le.tar.gz) | `3eabecd62290ae8d876ae45333777b2c9959e39461197dbe90e6ba07d0a4c50328cbdf44e77d2bd626e435ffc69593d0e8b807b36601c19dd1a1ef17e6810b4f` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-client-linux-s390x.tar.gz) | `6651b2d95d0a8dd748c33c9e8018ab606b4061956cc2b6775bd0b008b04ea33df27be819ce6c391ceb2191b53acbbc088d602ed2d86bdd7a3a3fc1c8f876798a` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-client-windows-386.tar.gz) | `4b6c11b7a318e5fcac19144f6ab1638126c299e08c7b908495591674abcf4c7dd16f63c74c7d901beff24006150d2a31e0f75e28a9e14d6d0d88a09dafb014f0` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-client-windows-amd64.tar.gz) | `760ae08da6045ae7089fb27a9324e77bed907662659364857e1a8d103d19ba50e80544d8c21a086738b15baebfd9a5fa78d63638eff7bbe725436c054ba649cc` - - -### 服务器端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-server-linux-amd64.tar.gz) | `69db41f3d79aa0581c36a3736ab8dc96c92127b82d3cf25c5effc675758fe713ca7aa7e5b414914f1bc73187c6cee5f76d76b74a2ee1c0e7fa61557328f1b8ef` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-server-linux-arm.tar.gz) | `ca302f53ee91ab4feb697bb34d360d0872a7abea59c5f28cceefe9237a914c77d68722b85743998ab12bf8e42005e63a1d1a441859c2426c1a8d745dd33f4276` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-server-linux-arm64.tar.gz) | `79ab1f0a542ce576ea6d81cd2a7c068da6674177b72f1b5f5e3ca47edfdb228f533683a073857b6bc53225a230d15d3ba4b0cb9b6d5d78a309aa6e24c2f6c500` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-server-linux-ppc64le.tar.gz) | `fbe5b45326f1d03bcdd9ffd46ab454917d79f629ba23dae9d667d0c7741bc2f5db2960bf3c989bb75c19c9dc1609dacbb8a6dc9a440e5b192648e70db7f68721` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-server-linux-s390x.tar.gz) | `eb13ac306793679a3a489136bb7eb6588472688b2bb2aa0e54e61647d8c9da6d3589c19e7ac434c24defa78cb65f7b72593eedec1e7431c7ecae872298efc4de` - - -### 节点可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-node-linux-amd64.tar.gz) | `a4bde88f3e0f6233d04f04d380d5f612cd3c574bd66b9f3ee531fa76e3e0f1c6597edbc9fa61251a377e8230bce0ce6dc1cf57fd19080bb7d13f14a391b27fe8` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-node-linux-arm.tar.gz) | `7d72aa8c1d883b9f047e5b98dbb662bdfd314f9c06af4213068381ffaac116e68d1aad76327ead7a4fd97976ea72277cebcf765c56b265334cb3a02c83972ec1` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-node-linux-arm64.tar.gz) | `c9380bb59ba26dcfe1ab52b5cb02e2d920313defda09ec7d19ccbc18f54def4b57cf941ac8a397392beb5836fdc12bc9600d4055f2cfd1319896cfc9631cab10` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-node-linux-ppc64le.tar.gz) | `7bcd79b368a62c24465fce7dcb024bb629eae034e09fb522fb43bb5798478ca2660a3ccc596b424325c6f69e675468900f3b41f3924e7ff453e3db40150b3c16` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-node-linux-s390x.tar.gz) | `9bda9dd24ee5ca65aaefece4213b46ef57cde4904542d94e6147542e42766f8b80fe24d99a6b8711bd7dbe00c415169a9f258f433c5f5345c2e17c2bb82f2670` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.2/kubernetes-node-windows-amd64.tar.gz) | `d5906f229d2d8e99bdb37e7d155d54560b82ea28ce881c5a0cde8f8d20bff8fd2e82ea4b289ae3e58616d3ec8c23ac9b473cb714892a377feb87ecbce156147d` - - -## 自 v1.16.0-alpha.1 起的变更日志 - - -### 需要进行的操作 - - -* 删除了 "scheduler.alpha.kubernetes.io/critical-pod" 注解。应使用 Pod priority（spec.priorityClassName）将 Pod 标记为关键。这是必须要进行的操作。见 ([#80277](https://github.com/kubernetes/kubernetes/pull/80277)、[@draveness](https://github.com/draveness))。 -* 必须要进行的操作：`amd64` 的容器镜像 tar 文件现在将在 manifest.json 的 RepoTags 节中给出体系结构。见 ([#80266](https://github.com/kubernetes/kubernetes/pull/80266)、[@javier-b-perez](https://github.com/javier-b-perez))。 - * 如果你正在使用 Docker 清单，则此变更对你没有影响。 - -### 其他值得注意的变化 - - -* 启用 master 的 etcd 和 kube-apiserver 之间的 mTLS 时，将 HTTPS 用作 etcd-apiserver 协议，将 etcd 指标或运行状况端口更改为 2382。见 ([#77561](https://github.com/kubernetes/kubernetes/pull/77561)、[@wenjiaswe](https://github.com/wenjiaswe))。 -* kubelet：将 `node-lease-renew-interval` 更改为 0.25 的续租期限。见 ([#80429](https://github.com/kubernetes/kubernetes/pull/80429)、[@gaorong](https://github.com/gaorong))。 -* 修复 kubeadm upgrade diff 命令中的错误处理和潜在的空指针异常。见 ([#80648](https://github.com/kubernetes/kubernetes/pull/80648)、[@odinuge](https://github.com/odinuge))。 -* kube-controller-manager 中的新参数 `--endpoint-updates-batch-period` 可用于减少由 Pod 更改生成的端点更新的数量。见 ([#80509](https://github.com/kubernetes/kubernetes/pull/80509)、[@mborsz](https://github.com/mborsz))。 - -* kubeadm：如果在重置控制平面节点的集群状态时发生错误，则会产生错误。见 ([#80573](https://github.com/kubernetes/kubernetes/pull/80573)、[@bart0sh](https://github.com/bart0sh))。 -*由 Azure 标准负载均衡器支持的 k8s 集群中创建负载均衡器类型服务时，在 Azure 标准负载均衡器中添加的相应负载均衡器规则现在会将 “EnableTcpReset” 属性设置为 true。见 ([#80624](https://github.com/kubernetes/kubernetes/pull/80624)、[@xuto2](https://github.com/xuto2))。 -* portworx 插件已在 libopenstorage/openstorage 上更新为 v1.0.0。见 ([#80495](https://github.com/kubernetes/kubernetes/pull/80495)、[@adityadani](https://github.com/adityadani))。 -* 修复了在 OpenStack 或 Cinder 上分离已删除卷的问题。见 ([#80518](https://github.com/kubernetes/kubernetes/pull/80518)、[@jsafrane](https://github.com/jsafrane))。 -* 当为 CSI 驱动启用 PodInfoOnMount 时，Volume（卷）上下文中新的 csi.storage.k8s.io/ephemeral 参数允许驱动程序的 NodePublishVolume 实现根据具体情况确定该卷是临时性的还是正常的持久卷。见 ([#79983](https://github.com/kubernetes/kubernetes/pull/79983)、[@pohly](https://github.com/pohly))。 - -* 更新 gogo 下的 protobuf 以便向后序列化，用于提升深层对象上的性能。见 ([#77355](https://github.com/kubernetes/kubernetes/pull/77355)、[@apelisse](https://github.com/apelisse))。 -* 从 `pkg/api/ref` 中删除 `GetReference()` 和 `GetPartialReference()` 函数，因为在 `staging/src/k8s.io/client-go/tools/ref` 中也存在相同的函数。见 ([#80361](https://github.com/kubernetes/kubernetes/pull/80361)、[@wojtek-t](https://github.com/wojtek-t))。 -* 修复了 CSI 指标中的错误，即当 CSI 驱动程序不支持指标时，指标不会返回不支持的错误。见 ([#79851](https://github.com/kubernetes/kubernetes/pull/79851)、[@jparklab](https://github.com/jparklab))。 -* 修复了 kube-addon-manager 的领导者选举逻辑中的一个错误，该错误使所有副本均处于活跃状态。见 ([#80575](https://github.com/kubernetes/kubernetes/pull/80575)、[@mborsz](https://github.com/mborsz))。 -* Kibana 已在最新版本中进行了稍微的修改或改进。见 ([#80421](https://github.com/kubernetes/kubernetes/pull/80421)、[@lostick](https://github.com/lostick))。 -* kubeadm：修复了拉取控制平面镜像时忽略错误的问题。见 ([#80529](https://github.com/kubernetes/kubernetes/pull/80529)、[@bart0sh](https://github.com/bart0sh))。 - -* k8s.io 和 kubernetes.io 下的 CRD 必须将 `api-approved.kubernetes.io` 设置为 `unapproved.*` 或指向批准该模式下的拉取请求的链接。有关更多详细信息，请参见 https://github.com/kubernetes/enhancements/pull/1111。见 ([#79992](https://github.com/kubernetes/kubernetes/pull/79992)、[@deads2k](https://github.com/deads2k))。 -* 当存在大量 nodePort 服务时，减少 IPVS 模式下的 kube-proxy CPU 使用率。见 ([#79444](https://github.com/kubernetes/kubernetes/pull/79444)、[@cezarsa](https://github.com/cezarsa))。 -* 为 VerifyVolumesAreAttached 和 BulkVolumeVerify 添加 CSI 迁移铺垫。见 ([#80443](https://github.com/kubernetes/kubernetes/pull/80443)、[@davidz627](https://github.com/davidz627))。 -* 修复了当存在失败的 Pod 时导致 DaemonSet 滚动更新挂起的错误。见 ([#78170](https://github.com/kubernetes/kubernetes/pull/78170)、[@DaiHao](https://github.com/DaiHao))。 - -* 修复了在 Azure 上删除节点时的重试问题。见 ([#80419](https://github.com/kubernetes/kubernetes/pull/80419)、[@feiskyer](https://github.com/feiskyer))。 -* 在 Windows 上添加对 AWS EBS 的支持。见 ([#79552](https://github.com/kubernetes/kubernetes/pull/79552)、[@wongma7](https://github.com/wongma7))。 -* 现在，在 `--cpu-manager-policy` 参数中传递无效的策略名称将导致 kubelet 失败，而不是简单地忽略该参数并运行 `cpumanager` 的默认策略。见 ([#80294](https://github.com/kubernetes/kubernetes/pull/80294)、[@klueska](https://github.com/klueska))。 -* 将过滤器扩展点添加到调度框架。见 ([#78477](https://github.com/kubernetes/kubernetes/pull/78477)、[@YoubingLi](https://github.com/YoubingLi))。 -* 现在，在 Windows 节点上的 kubelet 摘要 API 中报告了 cpuUsageNanoCores。见 ([#80176](https://github.com/kubernetes/kubernetes/pull/80176)、@liyanhui1228](https://github.com/liyanhui1228))。 -* PodSpec 中引入了 `[]TopologySpreadConstraint`，以支持 “Even Pods Spread” alpha 功能。见 ([#77327](https://github.com/kubernetes/kubernetes/pull/77327)、[@Huang-Wei](https://github.com/Huang-Wei))。 - -* kubeadm：在某些 HTTP 错误的情况下回退到客户端版本。见 ([#80024](https://github.com/kubernetes/kubernetes/pull/80024)、[@RainbowMango](https://github.com/RainbowMango))。 -* 现在已启用 NFS 驱动程序来收集指标,StatFS 指标提供程序用于收集指标。见 ([#75805](https://github.com/kubernetes/kubernetes/pull/75805)、[@brahmaroutu](https://github.com/brahmaroutu))。 -* 根据 kubelet 中的节点状态更新频率使节点租约更新间隔更具启发性。见 ([#80173](https://github.com/kubernetes/kubernetes/pull/80173)、[@gaorong](https://github.com/gaorong))。 -* 将 Pod 开销功能引入调度程序，此功能为 alpha 级别。见 ([#78319](https://github.com/kubernetes/kubernetes/pull/78319)、[@egernst](https://github.com/egernst))。 - * 从 Kubernetes v1.16 开始，只有启用 PodOverhead 特性开关的服务器才能使用该功能。 - -* N/A 见([#80260](https://github.com/kubernetes/kubernetes/pull/80260)、[@khenidak](https://github.com/khenidak))。 -* 将 v1.Container.SecurityContext.WindowsOptions.RunAsUserName 添加到 Pod 规范中。([#79489](https://github.com/kubernetes/kubernetes/pull/79489)、[@bclau](https://github.com/bclau))。 -* 将卷 MountOptions 传递到 CSI 节点上的全局挂载点（NodeStageVolume）。见 ([#80191](https://github.com/kubernetes/kubernetes/pull/80191)、[@davidz627](https://github.com/davidz627))。 -* 将 Score 扩展点添加到调度框架。见 ([#79109](https://github.com/kubernetes/kubernetes/pull/79109)、[@ahg-g](https://github.com/ahg-g))。 - - -# v1.16.0-alpha.1 - - -[文档](https://docs.k8s.io) - - -## 下载 v1.16.0-alpha.1 - -文件名 | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes.tar.gz) | `4834c52267414000fa93c0626bded5a969cf65d3d4681c20e5ae2c5f62002a51dfb8ee869484f141b147990915ba57be96108227f86c4e9f571b4b25e7ed0773` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-src.tar.gz) | `9329d51f5c73f830f3c895c2601bc78e51d2d412b928c9dae902e9ba8d46338f246a79329a27e4248ec81410ff103510ba9b605bb03e08a48414b2935d2c164b` - - -### 客户端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-client-darwin-386.tar.gz) | `3cedffb92a0fca4f0b2d41f8b09baa59dff58df96446e8eece4e1b81022d9fdda8da41b5f73a3468435474721f03cffc6e7beabb25216b089a991b68366c73bc` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-client-darwin-amd64.tar.gz) | `14de6bb296b4d022f50778b160c98db3508c9c7230946e2af4eb2a1d662d45b86690e9e04bf3e592ec094e12bed1f2bb74cd59d769a0eaac3c81d9b80e0a79c8` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-client-linux-386.tar.gz) | `8b2b9fa55890895239b99fabb866babe50aca599591db1ecf9429e49925ae478b7c813b9d7704a20f41f2d50947c3b3deecb594544f1f3eae6c4e97ae9bb9b70` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-client-linux-amd64.tar.gz) | `e927ac7b314777267b95e0871dd70c352ec0fc967ba221cb6cba523fa6f18d9d193e4ce92a1f9fa669f9c961de0e34d69e770ef745199ed3693647dd0d692e57` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-client-linux-arm.tar.gz) | `4a230a6d34e2ffd7df40c5b726fbcbb7ef1373d81733bfb75685b2448ed181eb49ef27668fc33700f30de88e5bbdcc1e52649b9d31c7940760f48c6e6eb2f403` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-client-linux-arm64.tar.gz) | `87c8d7185df23b3496ceb74606558d895a64daf0c41185c833a233e29216131baac6e356a57bb78293ed9d0396966ecc3b00789f2b66af352dc286b101bcc69a` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-client-linux-ppc64le.tar.gz) | `16ea5efa2fc29bc7448a609a7118e7994e901ab26462aac52f03b4851d4c9d103ee12d2335360f8aa503ddbb2a71f3000f0fcb33597dd813df4f5ad5f4819fa9` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-client-linux-s390x.tar.gz) | `7390ad1682227a70550b20425fa5287fecf6a5d413493b03df3a7795614263e7883f30f3078bbb9fbd389d2a1dab073f8f401be89b82bd5861fa6b0aeda579eb` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-client-windows-386.tar.gz) | `88251896dfe38e59699b879f643704c0195e7a5af2cb00078886545f49364a2e3b497590781f135b80d60e256bad3a4ea197211f4f061c98dee096f0845e7a9b` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-client-windows-amd64.tar.gz) | `766b2a9bf097e45b2549536682cf25129110bd0562ab0df70e841ff8657dd7033119b0929e7a213454f90594b19b90fa57d89918cee33ceadba7d689449fe333` - - -### 服务器端可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-server-linux-amd64.tar.gz) | `dfd5c2609990c9b9b94249c654931b240dc072f2cc303e1e1d6dec1fddfb0a9e127e3898421ace00ab1947a3ad2f87cfd1266fd0b6193ef00f942269388ef372` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-server-linux-arm.tar.gz) | `7704c2d3c57950f184322263ac2be1649a0d737d176e7fed1897031d0efb8375805b5f12c7cf9ba87ac06ad8a635d6e399382d99f3cbb418961a4f0901465f50` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-server-linux-arm64.tar.gz) | `fbbd87cc38cfb6429e3741bfd87ecec4b69b551df6fb7c121900ced4c1cd0bc77a317ca8abd41f71ffd7bc0b1c7144fecb22fa405d0b211b238df24d28599333` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-server-linux-ppc64le.tar.gz) | `cfed5b936eb2fe44df5d0c9c6484bee38ef370fb1258522e8c62fb6a526e9440c1dc768d8bf33403451ae00519cab1450444da854fd6c6a37665ce925c4e7d69` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-server-linux-s390x.tar.gz) | `317681141734347260ad9f918fa4b67e48751f5a7df64a848d2a83c79a4e9dba269c51804b09444463ba88a2c0efa1c307795cd8f06ed840964eb2c725a4ecc3` - - -### 节点可执行文件 - -文件名 | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-node-linux-amd64.tar.gz) | `b3b1013453d35251b8fc4759f6ac26bdeb37f14a98697078535f7f902e8ebca581b5629bbb4493188a7e6077eb5afc61cf275f42bf4d9f503b70bfc58b9730b2` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-node-linux-arm.tar.gz) | `0bacc1791d260d2863ab768b48daf66f0f7f89eeee70e68dd515b05fc9d7f14b466382fe16fa84a103e0023324f681767489d9485560baf9eb80fe0e7ffab503` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-node-linux-arm64.tar.gz) | `73bd70cb9d27ce424828a95d715c16fd9dd22396dbe1dfe721eb0aea9e186ec46e6978956613b0978a8da3c22df39790739b038991c0192281881fce41d7c9f1` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-node-linux-ppc64le.tar.gz) | `a865f98838143dc7e1e12d1e258e5f5f2855fcf6e88488fb164ad62cf886d8e2a47fdf186ad6b55172f73826ae19da9b2642b9a0df0fa08f9351a66aeef3cf17` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-node-linux-s390x.tar.gz) | `d2f9f746ed0fe00be982a847a3ae1b6a698d5c506be1d3171156902140fec64642ec6d99aa68de08bdc7d65c9a35ac2c36bda53c4db873cb8e7edc419a4ab958` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.16.0-alpha.1/kubernetes-node-windows-amd64.tar.gz) | `37f48a6d8174f38668bc41c81222615942bfe07e01f319bdfed409f83a3de3773dceb09fd86330018bb05f830e165e7bd85b3d23d26a50227895e4ec07f8ab98` - - -## 自 v1.15.0起的变更日志 - - -### 需要进行的操作 - - -* 调度程序开始使用 v1beta1 Event API。任何针对调度程序事件的工具都需要使用 v1beta1 事件 API。见 ([#78447](https://github.com/kubernetes/kubernetes/pull/78447)、[@yastij](https://github.com/yastij))。 -* 删除了 scheduler.alpha.kubernetes.io/critical-pod 注解。应使用 Pod priority（spec.priorityClassName）将 Pod 标记为关键。这是必须要进行的操作。见 ([#80342](https://github.com/kubernetes/kubernetes/pull/80342)、[@draveness](https://github.com/draveness))。 -* hyperkube：v1.14 中弃用的 `--make-symlinks` 参数已被删除。见 ([#80017](https://github.com/kubernetes/kubernetes/pull/80017)、[@Pothulapati](https://github.com/Pothulapati))。 - -* `beta.kubernetes.io/metadata-proxy-ready`、`beta.kubernetes.io/metadata-proxy-ready` 和 `beta.kubernetes.io/kube-proxy-ds-ready`（节点标签）不再添加到新节点上。见 ([#79305](https://github.com/kubernetes/kubernetes/pull/79305)、[@paivagustavo](https://github.com/paivagustavo))。 - * ip-mask-agent 插件开始使用标签 `node.kubernetes.io/masq-agent-ds-ready` 代替 `beta.kubernetes.io/masq-agent-ds-ready` 作为其节点选择器。 - * kube-proxy 插件开始使用标签 `node.kubernetes.io/kube-proxy-ds-ready` 代替 `beta.kubernetes.io/kube-proxy-ds-ready` 作为其节点选择器。 - * metadata-proxy 插件开始使用标签 `cloud.google.com/metadata-proxy-ready` 代替 `beta.kubernetes.io/metadata-proxy-ready` 作为其节点选择器。 - * kubelet 删除了通过 `--node-labels` 标签（[特定允许的标签或前缀](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/0000-20170814-bounding-self-labeling-kubelets.md#proposal) 除外）设置 `kubernetes.io `或 `k8s.io` 标签的功能。 - -* 默认情况下不再提供以下 API：见 ([#70672](https://github.com/kubernetes/kubernetes/pull/70672)、[@liggitt](https://github.com/liggitt))。 - * `apps/v1beta1` 和 `apps/v1` 下的所有资源 - 改用 `apps/v1` - * `extensions/v1beta1` 下的资源 `daemonsets`、`deployments`、`replicasets` - 改用 `apps/v1` - * `extensions/v1beta1` 下的资源 `networkpolicies` - 改用 `networking.k8s.io/v1` - * `extensions/v1beta1` 下的资源 `podsecuritypolicies` - 改用 `policy/v1beta1` - * 可以使用 `--runtime-config` apiserver 参数临时重新启用服务这些资源。 - * `apps/v1beta1=true` - * `apps/v1beta2=true` - * `extensions/v1beta1/daemonsets=true,extensions/v1beta1/deployments=true,extensions/v1beta1/replicasets=true,extensions/v1beta1/networkpolicies=true,extensions/v1beta1/podsecuritypolicies=true` - * v1.18 中将完全删除提供这些资源的功能。 - -* 必须要进行的操作：`--resource-container` 弃用参数已从 kube-proxy 中移除。见 ([#78294](https://github.com/kubernetes/kubernetes/pull/78294)、[@vllry](https://github.com/vllry))。现在指定它会导致错误。现在的行为就好像你指定了 `--resource-container=""`。如果以前指定了非空 `--resource-container`，则从 kubernetes 1.16 开始，你将无法再这样做。见 ([#78294](https://github.com/kubernetes/kubernetes/pull/78294)、[@vllry](https://github.com/vllry))。 - * `--resource-container` 参数已从 kube-proxy 中删除，现在指定它会导致错误。现在的行为就好像你指定了 `--resource-container=""`。如果以前指定了非空 `--resource-container`，则从 kubernetes 1.16 开始，你将无法再这样做。 - - -### 其他值得注意的变化 - - -* 启用 HPAScaleToZero 功能开关后，HPA 支持根据对象或外部指标将比例缩放到零。只要至少有一个指标，HPA 就会保持活跃状态。见 ([#74526](https://github.com/kubernetes/kubernetes/pull/74526)、[@DXist](https://github.com/DXist))。 - * 要将集群降级到不支持从零缩放功能的版本，请执行以下操作： - * 1. 确保没有 minReplicas = 0 的 hpa 对象，这是将其更新为 1 的 oneliner： - * $ kubectl get hpa --all-namespaces --no-headers=true | awk '{if($6==0) printf "kubectl patch hpa/%s --namespace=%s -p \"{\\"spec\\":{\\"minReplicas\\":1}}\" -", $2, $1 }' | sh - * 2. 禁用 HPAScaleToZero 功能开关 - -* 添加对列出树形自定义调度程序插件的支持。见 ([#78162](https://github.com/kubernetes/kubernetes/pull/78162)、[@hex108](https://github.com/hex108))。 -* 删除不推荐使用的 github.com/kardianos/osext 依赖项。见 ([#80142](https://github.com/kubernetes/kubernetes/pull/80142))。 -* 将绑定扩展点添加到调度框架。见 ([#79313](https://github.com/kubernetes/kubernetes/pull/79313)、[@chenchun](https://github.com/chenchun))。 -* 在 Windows 系统上，如果 ％HOMEDRIVE％\％HOMEPATH％ 不包含 .kube *，则 ％USERPROFILE％ 现在比 ％HOMEDRIVE％\％HOMEPATH％ 更适合作为主文件夹。将 `--kubernetes-version` 添加到 `kubeadm init phase certs ca` 和 `kubeadm init phase kubeconfig` 中。见 ([#80115](https://github.com/kubernetes/kubernetes/pull/80115)、[@gyuho](https://github.com/gyuho))。 -- - -* kubeadm ClusterConfiguration 现在支持特性开关：IPv6DualStack：true。见 ([#80145](https://github.com/kubernetes/kubernetes/pull/80145)、[@Arvinderpal](https://github.com/Arvinderpal))。 -* 修复了 ListOptions.AllowWatchBookmarks 在 kube-apiserver 中无法正确传播的错误。([#80157](https://github.com/kubernetes/kubernetes/pull/80157)、[@wojtek-t](https://github.com/wojtek-t))。 -* 修复了 CSI 插件支持不需要附加安装的原始块失败的问题。见 ([#79920](https://github.com/kubernetes/kubernetes/pull/79920)、[@cwdsuzhou](https://github.com/cwdsuzhou))。 - -* 将体面终止的日志级别增加到 `v=5`。见 ([#80100](https://github.com/kubernetes/kubernetes/pull/80100)、[@andrewsykim](https://github.com/andrewsykim))。 -* kubeadm：支持从原始集群中获取配置信息以进行 `upgrade diff` 操作。见 ([#80025](https://github.com/kubernetes/kubernetes/pull/80025)、[@SataQiu](https://github.com/SataQiu))。 -* sample-apiserver 获得了对 `/openapi/v2` 上提供的 OpenAPI v2 规范的支持。([#79843](https://github.com/kubernetes/kubernetes/pull/79843)、[@sttts](https://github.com/sttts))。 - * The `generate-internal-groups.sh` script in k8s.io/code-generator will generate OpenAPI definitions by default in `pkg/generated/openapi`. Additional API group dependencies can be added via `OPENAPI_EXTRA_PACKAGES=/ /...`. -* `Cinder` 和 `ScaleIO` volume（卷）驱动已被弃用，并将在以后的版本中删除。见 ([#80099](https://github.com/kubernetes/kubernetes/pull/80099), [@dims](https://github.com/dims))。 - -* 1.14 中已经弃用 kubelet 的 --containerized 参数。此参数在 1.16 中已被删除。([#80043](https://github.com/kubernetes/kubernetes/pull/80043)、[@dims](https://github.com/dims))。 -* 在可能的情况下，通过查询实例 ID 而不是 EC2 过滤器来优化 AWS 云提供商库中的 EC2 DescribeInstances API 调用。见 ([#78140](https://github.com/kubernetes/kubernetes/pull/78140)、[@zhan849](https://github.com/zhan849))。 - -* etcd 升级镜像不再支持 etcd2 版本。见 ([#80037](https://github.com/kubernetes/kubernetes/pull/80037)、[@dims](https://github.com/dims))。 -* 将 WatchBookmark 功能升级为 Beta 功能并默认启用它。见 ([#79786](https://github.com/kubernetes/kubernetes/pull/79786)、[@wojtek-t](https://github.com/wojtek-t))。 - * 借助 WatchBookmark 功能，客户端可以请求具有 BOOKMARK 类型的监视事件。客户端不应该假定书签在任何特定的时间间隔内返回，也不能假定服务器将在会话期间发送任何 BOOKMARK 事件。 -* 升级 go 到 1.12.7。见 ([#79966](https://github.com/kubernetes/kubernetes/pull/79966)、[@tao12345666333](https://github.com/tao12345666333))。 - -* 将 `--shutdown-delay-duration` 添加到 kube-apiserver 中以延迟正常关闭。在这段时间内，`/healthz` 将继续返回成功，并且请求将正常处理，但是 `/readyz` 将立即返回失败。此延迟可用于允许 SDN 更新所有节点上的 iptables 并停止发送流量。见 ([#74416](https://github.com/kubernetes/kubernetes/pull/74416)、[@sttts](https://github.com/sttts))。 - -* `MutatingWebhookConfiguration` 和 `ValidatingWebhookConfiguration` API 已升级为 `admissionregistration.k8s.io/v1`：见 ([#79549](https://github.com/kubernetes/kubernetes/pull/79549)、[@liggitt](https://github.com/liggitt))。 - * v1 的默认 `failurePolicy` 从 `Ignore` 更改为 `Fail` - * v1 的默认 `matchPolicy` 从 `Exact` 更改为 `Equivalent` - * v1 的默认 `timeout` 从 `30s` 更改为 `10s` - * 删除了 `sideEffects` 默认值，并且该字段为必填字段，v1 仅允许使用 `None` 和 `NoneOnDryRun` - * 删除了 `admissionReviewVersions` 默认值，并为 v1 设置了必填字段（AdmissionReview 支持的版本为 `v1` 和 `v1beta1`） - * 对于通过 `admissionregistration.k8s.io/v1` 创建的 `MutatingWebhookConfiguration` 和 `ValidatingWebhookConfiguration` 对象，指定 Webhook 的 `name` 字段必须唯一 - * `MutatingWebhookConfiguration` 和 `ValidatingWebhookConfiguration` 的 `admissionregistration.k8s.io/v1beta1` 版本已弃用，在 v1.19 中将不再提供。 - -* 垃圾收集器和通用对象配额控制器已更新为使用元数据客户端，从而改善了内存性能。见 ([#78742](https://github.com/kubernetes/kubernetes/pull/78742)、[@smarterclayton](https://github.com/smarterclayton))。 - * Kube 控制器管理器的 CPU 使用率。 -* 现在，发送的用于 RBAC 升级、模拟和 Pod 安全策略授权检查的 SubjectAccessReview 请求将填充版本属性。见 ([#80007](https://github.com/kubernetes/kubernetes/pull/80007)、[@liggitt](https://github.com/liggitt))。 -* na 见 ([#79892](https://github.com/kubernetes/kubernetes/pull/79892)、[@mikebrow](https://github.com/mikebrow))。 -* 使用 O_CLOEXEC 确保文件描述符不会泄漏到子进程。见 ([#74691](https://github.com/kubernetes/kubernetes/pull/74691)、[@cpuguy83](https://github.com/cpuguy83))。 -* 命名空间控制器已更新为使用元数据客户端，从而改善了内存性能。见 ([#78744](https://github.com/kubernetes/kubernetes/pull/78744)、[@smarterclayton](https://github.com/smarterclayton))。 - * Kube 控制器管理器的 CPU 使用率。 - -* NONE 见 ([#79933](https://github.com/kubernetes/kubernetes/pull/79933)、[@mm4tt](https://github.com/mm4tt))。 -* 添加 `kubectl replace --raw` 和 `kubectl delete --raw` 与 create 和 get 相等。见 ([#79724](https://github.com/kubernetes/kubernetes/pull/79724)、[@deads2k](https://github.com/deads2k))。 -* E2E 测试不再将命令行参数直接添加到命令行中，如果测试组件不使用 HandleFlags，则需要对其进行更新。见 ([#75593](https://github.com/kubernetes/kubernetes/pull/75593)、[@pohly](https://github.com/pohly))。 - * 再次加载带有后缀（在 1.13 中引入）的 -viper-config=e2e.yaml 可以正常工作，现在进行了回归测试。 -* Kubernetes 现在支持 API 响应的透明压缩。如果 API 调用大于 128 KB，则发送 “Accept-Encoding：gzip” 的客户端现在将收到 GZIP 压缩的响应正文。Go 客户端默认会自动请求 gzip 编码，并且对于非常大的 API 请求，应该会减少传输时间。其他语言的客户端可能需要进行更改才能从压缩中受益。见 ([#77449](https://github.com/kubernetes/kubernetes/pull/77449)、[@smarterclayton](https://github.com/smarterclayton))。 - -* 解决了由非 2xx HTTP 响应对 `/` 请求的服务支持的聚合 API 的问题。见 ([#79895](https://github.com/kubernetes/kubernetes/pull/79895)、[@deads2k](https://github.com/deads2k))。 -* fluentd 更新至 1.5.1，elasticsearchs 和 kibana 更新至 7.1.1。见 ([#79014](https://github.com/kubernetes/kubernetes/pull/79014)、[@monotek](https://github.com/monotek))。 -* kubeadm：实现对堆叠的 etcd 成员的并发添加或删除的支持。见 ([#79677](https://github.com/kubernetes/kubernetes/pull/79677)、[@neolit123](https://github.com/neolit123))。 -* 添加了指标 `apiserver_watch_events_total`，可用于了解系统中监视事件的数量。见 ([#78732](https://github.com/kubernetes/kubernetes/pull/78732)、[@mborsz](https://github.com/mborsz))。 -* KMS 提供商将在 kube-apiservers 的加密配置中安装 kms 状态的运行状况检查插件。见 ([#78540](https://github.com/kubernetes/kubernetes/pull/78540)、[@immutableT](https://github.com/immutableT))。 - -* 修复了使用 x-kubernetes-preserve-unknown-fields 扩展为自定义资源发布的 openapi 中的一个错误，该错误使 kubectl 将允许为该对象的某部分发送未知字段。见 ([#79636](https://github.com/kubernetes/kubernetes/pull/79636)、[@liggitt](https://github.com/liggitt))。 -* 添加了新的客户端 `k8s.io/client-go/metadata.Client`，用于一般性地访问对象。一般情况下，对于使用处理对象（例如垃圾收集器、配额或命名空间控制器）的用例，该客户端使以有效方式从集群上的资源仅检索元数据（“元数据”部分）变得更加容易。客户端要求服务器返回一个 `meta.k8s.io/v1 PartialObjectMetadata` 对象，用于在常规 API 和自定义资源上进行列表、获取、删除、监视和修补操作，这些操作可以在 protobuf 中进行编码以进行其他工作。如果服务器尚不支持此 API，则客户端将正常使用 JSON 并将响应对象转换为 PartialObjectMetadata。见 ([#77819](https://github.com/kubernetes/kubernetes/pull/77819)、[@smarterclayton](https://github.com/smarterclayton))。 - -* 将 csi 插件中的超时值从 15 s 更改为 2 min，从而解决了超时问题。见 ([#79529](https://github.com/kubernetes/kubernetes/pull/79529)、[@andyzhangx](https://github.com/andyzhangx))。 -* kubeadm：为 `controlPlaneEndpoint` 提供 `--control-plane-endpoint` 参数。见 ([#79270](https://github.com/kubernetes/kubernetes/pull/79270)、[@SataQiu](https://github.com/SataQiu))。 -* 当 kubectl cp 操作复制一个文件时，修复无效的 "time stamp is the future" 错误。见 ([#73982](https://github.com/kubernetes/kubernetes/pull/73982)、[@tanshanshan](https://github.com/tanshanshan))。 -* 现在，即使云平台所报告的节点 IP 集合发生了变化，kubelet 也应该能够更可靠地报告相同的主节点 IP。见 ([#79391](https://github.com/kubernetes/kubernetes/pull/79391), [@danwinship](https://github.com/danwinship))。 - -* 允许将控制器管理器配置为使用 IPv6 双协议栈：见 ([#73977](https://github.com/kubernetes/kubernetes/pull/73977)、[@khenidak](https://github.com/khenidak))。 - * 使用 `--cluster-cidr=","`。 - * 注意： - - * 1. 仅使用前两个 CIDR（对 Alpha 功能的软限制，稍后可能会取消）。 - * 2. 仅将 "RangeAllocator"（默认值）作为 --cidr-allocator-type 的值。云分配器与 IPv6 双协议栈不兼容。 -* 当使用一致性测试镜像时，新的环境变量 `E2E_USE_GO_RUNNER` 将使测试使用基于 golang 的新测试运行程序而不是当前的 bash 包装程序运行。见 ([#79284](https://github.com/kubernetes/kubernetes/pull/79284)、[@johnSchnake](https://github.com/johnSchnake))。 - -* kubeadm：通过使用非 root 用户防止 PSP 阻止升级镜像提前拉取操作。见 ([#77792](https://github.com/kubernetes/kubernetes/pull/77792)、[@neolit123](https://github.com/neolit123))。 -* kubelet 现在接受 `--cni-cache-dir` 选项，默认为 /var/lib/cni/cache，这是 CNI 存储缓存文件的位置。([#78908](https://github.com/kubernetes/kubernetes/pull/78908)、[@dcbw](https://github.com/dcbw))。 - -* Azure API 版本已更新（容器 registry 到 2018-09-01，网络到 2018-08-01）。见 ([#79583](https://github.com/kubernetes/kubernetes/pull/79583))。 - -* 修复 `doSafeMakeDir` 中可能的文件描述符泄漏和目录关闭。见 ([#79534](https://github.com/kubernetes/kubernetes/pull/79534)、[@odinuge](https://github.com/odinuge))。 - -* kubeadm：修复 `--cri-socket` 参数不适用于 `kubeadm reset` 操作的错误。见 ([#79498](https://github.com/kubernetes/kubernetes/pull/79498)、[@SataQiu](https://github.com/SataQiu))。 -* kubectl log 操作 --selector 支持 --tail = -1。见 ([#74943](https://github.com/kubernetes/kubernetes/pull/74943)、[@JishanXing](https://github.com/JishanXing))。 -* 为 RuntimeClass 引入新的准入控制器。最初，如果指定了相应的 RuntimeClassName，则将使用 RuntimeClass 与给定 RuntimeClass 关联的 Pod 开销应用于 Pod `spec`。见 ([#78484](https://github.com/kubernetes/kubernetes/pull/78484)、[@egernst](https://github.com/egernst))。 - * 从 Kubernetes 1.16 开始，PodOverhead 是 Alpha 功能。 - -* 使用小于 1 MiB 的巨大页面来修复 AArch64 中的 kubelet 错误。见 ([#78495](https://github.com/kubernetes/kubernetes/pull/78495)、[@odinuge](https://github.com/odinuge))。 -* 在 v1.13 版本中弃用的 alpha `metadata.initializers` 字段已被删除。见 ([#79504](https://github.com/kubernetes/kubernetes/pull/79504)、[@yue9944882](https://github.com/yue9944882))。 -* 修复 cli 命令中的重复错误消息。见 ([#79493](https://github.com/kubernetes/kubernetes/pull/79493)、[@odinuge](https://github.com/odinuge))。 -* 当注解 `azure-load-balancer-resource-group` 的值为空字符串时，应使用默认 resourceGroup。见 ([#79514](https://github.com/kubernetes/kubernetes/pull/79514)、[@feiskyer](https://github.com/feiskyer))。 - -* 监视某个资源时修复 `kubectl get --watch-only` 输出内容。见 ([#79345](https://github.com/kubernetes/kubernetes/pull/79345)、[@liggitt](https://github.com/liggitt))。 -* RateLimiter 添加了 context-aware 方法，修复了异步超时场景中的 client-go 请求 goruntine backlog 问题。见 ([#79375](https://github.com/kubernetes/kubernetes/pull/79375)、[@answer1991](https://github.com/answer1991))。 -* 修复了当 Pod 的重启策略设置为 Never 时，kubelet 不会重试 Pod 沙盒创建的问题。见 ([#79451](https://github.com/kubernetes/kubernetes/pull/79451)、[@yujuhong](https://github.com/yujuhong))。 -* 修复 `items` 字段中的 CRD 验证错误。见 ([#76124](https://github.com/kubernetes/kubernetes/pull/76124)、[@tossmilestone](https://github.com/tossmilestone))。 -* CRD 处理程序现在可以正确地重新创建过时的 CR 存储，以反映 CRD 更新。见 ([#79114](https://github.com/kubernetes/kubernetes/pull/79114)、[@roycaihw](https://github.com/roycaihw))。 - -* 将 in-tree 和 CSI（Volume）卷的（Volume）限制集成到一个调度器条件（Scheduler Predicate）。见 ([#77595](https://github.com/kubernetes/kubernetes/pull/77595)、[@bertinatto](https://github.com/bertinatto))。 -* 修复了源代码 printers 函数中可能导致 kube-apiserver 崩溃的错误。见 ([#79349](https://github.com/kubernetes/kubernetes/pull/79349)、[@roycaihw](https://github.com/roycaihw))。 -* 将主机上的 `/home/kubernetes/bin/nvidia/vulkan/icd.d` 挂载到请求 GPU 的容器内的 `/etc/vulkan/icd.d`。见 ([#78868](https://github.com/kubernetes/kubernetes/pull/78868)、[@chardch](https://github.com/chardch))。 -* 移除 CSIPersistentVolume 功能特性开关。见 ([#79309](https://github.com/kubernetes/kubernetes/pull/79309)、[@draveness](https://github.com/draveness))。 - -* 初始化容器资源请求现在会影响 Pod QoS 类。见 ([#75223](https://github.com/kubernetes/kubernetes/pull/75223)、[@sjenning](https://github.com/sjenning))。 -* 将 kube-scheduler 和 kube-apiserver 允许的最大不安全绑定端口更正为 65535。([#79346](https://github.com/kubernetes/kubernetes/pull/79346)、[@ncdc](https://github.com/ncdc))。 -* 修复在 kubeadm 重置期间从集群中删除 etcd 成员问题。见 ([#79326](https://github.com/kubernetes/kubernetes/pull/79326)、[@bradbeam](https://github.com/bradbeam))。 -* 移除 KubeletPluginsWatcher 特性开关。见 ([#79310](https://github.com/kubernetes/kubernetes/pull/79310)、[@draveness](https://github.com/draveness))。 -* 移除 HugePages、VolumeScheduling、CustomPodDNS 和 PodReadinessGates 功能参数。见 ([#79307](https://github.com/kubernetes/kubernetes/pull/79307)、[@draveness](https://github.com/draveness))。 - -* GA 版本中的 `PodPriority` 特性开关现在默认情况下处于打开状态，无法禁用。`PodPriority` 特性开关将在 v1.18 中删除。见 ([#79262](https://github.com/kubernetes/kubernetes/pull/79262), [@draveness](https://github.com/draveness))。 -* 禁用相关功能开关时，删除 PID cgroup 控制器要求。见 ([#79073](https://github.com/kubernetes/kubernetes/pull/79073)、[@rafatio](https://github.com/rafatio))。 -* 添加调度框架的绑定扩展点。见 ([#78513](https://github.com/kubernetes/kubernetes/pull/78513)、[@chenchun](https://github.com/chenchun))。 -* 如果 targetPort 更改，则将由服务控制器处理 targetPort。见 ([#77712](https://github.com/kubernetes/kubernetes/pull/77712)、[@Sn0rt](https://github.com/Sn0rt))。 -* 升级 go 到 1.12.6。见 ([#78958](https://github.com/kubernetes/kubernetes/pull/78958)、[@tao12345666333](https://github.com/tao12345666333))。 -* kubeadm：修复了因 kubeadm 发现无效的、现有的 kubeconfig 文件而可能引起的崩溃问题。见 ([#79165](https://github.com/kubernetes/kubernetes/pull/79165)、[@neolit123](https://github.com/neolit123))。 - -* 修复 kubelet 的 Pod 目录（默认为 `/var/lib/kubelet/pods`）象征性地链接到另一个磁盘设备的目录时，kubelet 无法删除孤立的 pod 目录的问题。见 ([#79094](https://github.com/kubernetes/kubernetes/pull/79094)、[@gaorong](https://github.com/gaorong))。 -* 作为 Pod Overhead KEP 的一部分，将 Overhead 字段添加到 PodSpec 和 RuntimeClass 类型中。见 ([#76968](https://github.com/kubernetes/kubernetes/pull/76968)、[@egernst](https://github.com/egernst))。 -* 修正 Pod 列表返回值为 `framework.WaitForPodsWithLabelRunningReady`。见 ([#78687](https://github.com/kubernetes/kubernetes/pull/78687)、[@pohly](https://github.com/pohly))。 - -* 对于 GCE Ingress 负载均衡器的 404 请求的默认处理程序的行为，在某种程度上已进行了一些修改，即它现在使用 Prometheus 导出指标。导出的指标包括：见 ([#79106](https://github.com/kubernetes/kubernetes/pull/79106)、[@vbannai](https://github.com/vbannai))。 - * - `http_404_request_total` （已处理的 404 请求数目） - * - `http_404_request_duration_ms` （服务器响应所花费的时间（以毫秒为单位）） - * 还包括百分位数分组。默认 404 处理程序的目录包括有关如何启用 Prometheus 来监视和设置警报的说明。 - -* kube-apiserver 改进了启动和关闭序列的行为，现在还公开了 `eadyz` 用来进行就绪检查。Readyz 包括所有现有的 healthz 检查，但还添加了关闭检查。当集群管理员启动关闭时， kube-apiserver 将在杀死 apiserver 进程之前尝试处理现有请求（在请求超时时间内）。见 ([#78458](https://github.com/kubernetes/kubernetes/pull/78458)、[@logicalhan](https://github.com/logicalhan))。 - * apiserver 现在还带有一个可选参数 `--maximum-startup-sequence-duration`。这样，您就可以在 healthz 开始失败之前明确定义 apiserver 启动序列的上限。通过使 kubelet 活跃度初始延迟尽量较短，尽管启动序列没有在预期的时间范围内完成并且缺少较长的启动序列（如 RBAC），但可以使 kubelet 快速恢复。当此标志的值为零时，kube-apiserver 行为是向后兼容的（这是该参数的默认值）。 - -* 修复了使 Azure 磁盘 URI 不区分大小写的问题。见 ([#79020](https://github.com/kubernetes/kubernetes/pull/79020)、[@andyzhangx](https://github.com/andyzhangx))。 -* 启用 cAdvisor ProcessMetrics 指标收集。见 ([#79002](https://github.com/kubernetes/kubernetes/pull/79002)、[@jiayingz](https://github.com/jiayingz))。 -* 修复了 `kubectl set config` 挂起并在某些无效的属性名称上使用 100％ CPU 的错误。见 ([#79000](https://github.com/kubernetes/kubernetes/pull/79000)、[@pswica](https://github.com/pswica))。 -* 修复了 IPVS 正常终止操作中不删除 UDP 真实服务器的字符串比较错误。见 ([#78999](https://github.com/kubernetes/kubernetes/pull/78999)、[@andrewsykim](https://github.com/andrewsykim))。 - -* 重构 watchHandler Warning 日志 `The resourceVersion for the provided watch is too old`，现在被设置为 Info。见 ([#78991](https://github.com/kubernetes/kubernetes/pull/78991)、[@sallyom](https://github.com/sallyom))。 -* 修复了守护程序控制器（daemon controller）无法从不匹配的节点删除 Pod 的错误。见 ([#78974](https://github.com/kubernetes/kubernetes/pull/78974)、[@DaiHao](https://github.com/DaiHao))。 -* NONE 见 ([#78821](https://github.com/kubernetes/kubernetes/pull/78821)、[@jhedev](https://github.com/jhedev))。 -* 在默认的 GCE 存储类中启用了卷扩展。见 ([#78672](https://github.com/kubernetes/kubernetes/pull/78672)、[@msau42](https://github.com/msau42))。 - -* kubeadm：使用 service-cidr 参数通过其 service-cluster-ip-range 参数将所需的服务 CIDR 传递到 kube-controller-manager。见 ([#78625](https://github.com/kubernetes/kubernetes/pull/78625)、[@Arvinderpal](https://github.com/Arvinderpal))。 -* kubeadm：在阶段命令 `kubeadm init phase certs` 操作中引入确定性顺序用于生成证书。见 ([#78556](https://github.com/kubernetes/kubernetes/pull/78556)、[@neolit123](https://github.com/neolit123))。 -* 将预过滤器扩展点添加到调度框架。见 ([#78005](https://github.com/kubernetes/kubernetes/pull/78005)、[@ahg-g](https://github.com/ahg-g))。 -* 修复由于 flexvol 插件中的 mnt 点损坏而导致的卡住问题，如果 PathExists 返回任何错误，请调用 Unmount 操作。见 ([#75234](https://github.com/kubernetes/kubernetes/pull/75234)、[@andyzhangx](https://github.com/andyzhangx))。 diff --git a/update-imported-docs/release.yml b/update-imported-docs/release.yml index 3d3bd8850b..a76a3dd841 100644 --- a/update-imported-docs/release.yml +++ b/update-imported-docs/release.yml @@ -4,5 +4,5 @@ repos: branch: master gen-absolute-links: true files: - - src: CHANGELOG-1.13.md + - src: CHANGELOG-1.17.md dst: content/en/docs/setup/release/notes.md From 59c2b1bc94a7a3d8e3f294ab3ca04b65b0099ee9 Mon Sep 17 00:00:00 2001 From: GoodGameZoo Date: Sun, 19 Jan 2020 10:17:35 +0800 Subject: [PATCH 29/30] Update version-skew-policy.md zh (#18761) --- content/zh/docs/setup/release/version-skew-policy.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/content/zh/docs/setup/release/version-skew-policy.md b/content/zh/docs/setup/release/version-skew-policy.md index 368f6c45c8..c3e751d54f 100644 --- a/content/zh/docs/setup/release/version-skew-policy.md +++ b/content/zh/docs/setup/release/version-skew-policy.md @@ -45,10 +45,9 @@ This decision is owned by the [patch release manager](https://github.com/kuberne The patch release manager is a member of the [release team for each release](https://github.com/kubernetes/sig-release/tree/master/release-team). --> 一些 bug 修复，包括安全修复，根据其安全性和可用性，有可能会回合到这些分支。 -如果有必要，补丁版本会定期从这些分支中发布。 -[补丁发布管理员](https://github.com/kubernetes/sig-release/blob/master/release-engineering/role-handbooks/patch-release-manager.md#release-timing) -来决定是否发布。 -补丁发布管理员同时也是[release team for each release](https://github.com/kubernetes/sig-release/tree/master/release-team) 的管理员。 +补丁版本会定期或根据需要从这些分支中发布。 +最终是否发布是由[patch release team](https://github.com/kubernetes/sig-release/blob/master/release-engineering/role-handbooks/patch-release-manager.md#release-timing) +来决定的。Patch release team同时也是[release managers](https://github.com/kubernetes/sig-release/blob/master/release-managers.md). 如需了解更多信息，请查看 [Kubernetes Patch releases](https://github.com/kubernetes/sig-release/blob/master/releases/patch-releases.md). `kubelet` 版本号不能高于 `kube-apiserver`，最多可以比 `kube-apiserver` 低两个小版本。 - * 他们必须升级到与 `kube-apiserver` 相差不超过1个小版本，才可以升级其他控制面组件 * 有可能使用低于3个在维护的小版本 From ad327d6dbc51a816bfff809b62d2bfb95026683e Mon Sep 17 00:00:00 2001 From: xieyanker Date: Sun, 19 Jan 2020 11:23:35 +0800 Subject: [PATCH 30/30] fix chinese title jump (#18736) --- content/zh/docs/contribute/intermediate.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/contribute/intermediate.md b/content/zh/docs/contribute/intermediate.md index 7b122f4293..d1ce3c461c 100644 --- a/content/zh/docs/contribute/intermediate.md +++ b/content/zh/docs/contribute/intermediate.md @@ -711,7 +711,7 @@ most up-to-date version of that branch. You'll be able to view your changes after you submit the pull request, as well. --> - 您还可以选择使用 hugo 命令在本地暂存站点来测试您的更改。[本地查看更改](#view-your-changes-locally)。您还可以在提交 PR 后查看更改。 + 您还可以选择使用 hugo 命令在本地暂存站点来测试您的更改。参阅[本地查看更改](#本地查看更改)。您还可以在提交 PR 后查看更改。 6.