From 5d322a5aac175bce6ff5c633e1f042e0de7fc633 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Tue, 28 Nov 2017 10:12:28 +0800 Subject: [PATCH 01/39] Fix links in Chinese translation --- cn/docs/concepts/overview/what-is-kubernetes.md | 2 +- .../services-networking/connect-applications-service.md | 9 --------- cn/docs/concepts/workloads/pods/init-containers.md | 2 +- 3 files changed, 2 insertions(+), 11 deletions(-) diff --git a/cn/docs/concepts/overview/what-is-kubernetes.md b/cn/docs/concepts/overview/what-is-kubernetes.md index 61537cbefa..46bce4b2f4 100644 --- a/cn/docs/concepts/overview/what-is-kubernetes.md +++ b/cn/docs/concepts/overview/what-is-kubernetes.md @@ -70,7 +70,7 @@ Kubernetes 满足了生产中运行应用程序的许多常见的需求，例如 * [Pod](/docs/user-guide/pods/) 提供复合应用并保留一个应用一个容器的容器模型, * [挂载外部存储](/docs/user-guide/volumes/), * [Secret管理](/docs/user-guide/secrets/), -* [应用健康检查](/docs/user-guide/production-pods/#liveness-and-readiness-probes-aka-health-checks), +* [应用健康检查](/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/), * [副本应用实例](/docs/user-guide/replication-controller/), * [横向自动扩缩容](/docs/user-guide/horizontal-pod-autoscaling/), * [服务发现](/docs/user-guide/connecting-applications/), diff --git a/cn/docs/concepts/services-networking/connect-applications-service.md b/cn/docs/concepts/services-networking/connect-applications-service.md index 869d0bcea6..bf548162dd 100644 --- a/cn/docs/concepts/services-networking/connect-applications-service.md +++ b/cn/docs/concepts/services-networking/connect-applications-service.md @@ -366,16 +366,7 @@ LoadBalancer Ingress: a320587ffd19711e5a37606cf4a74574-1142138393.us-east-1.el ... ``` - - ## 进一步阅读 Kubernetes 也支持联合 Service，能够跨多个集群和云提供商，为 Service 提供逐步增强的可用性、更优的容错、更好的可伸缩性。 查看 [联合 Service 用户指南](/docs/concepts/cluster-administration/federation-service-discovery/) 获取更进一步信息。 - - - -## 下一步 - -[了解更多关于 Kubernetes 的特性，有助于在生产环境中可靠地运行容器](/docs/user-guide/production-pods) - diff --git a/cn/docs/concepts/workloads/pods/init-containers.md b/cn/docs/concepts/workloads/pods/init-containers.md index e075dbbec6..08611bf61a 100644 --- a/cn/docs/concepts/workloads/pods/init-containers.md +++ b/cn/docs/concepts/workloads/pods/init-containers.md @@ -85,7 +85,7 @@ Init 容器支持应用容器的全部字段和特性，包括资源限制、数 * 克隆 Git 仓库到数据卷。 * 将配置值放到配置文件中，运行模板工具为主应用容器动态地生成配置文件。例如，在配置文件中存放 POD_IP 值，并使用 Jinja 生成主应用配置文件。 -更多详细用法示例，可以在 [StatefulSet 文档](/docs/concepts/abstractions/controllers/statefulsets/) 和 [生产环境 Pod 指南](/docs/user-guide/production-pods.md#handling-initialization) 中找到。 +更多详细用法示例，可以在 [StatefulSet 文档](/docs/concepts/abstractions/controllers/statefulsets/) 和 [Pod 初始化](/docs/tasks/configure-pod-container/configure-pod-initialization) 中找到。 From c05678752d3b481e2907bc53d3971bb49eab6609 Mon Sep 17 00:00:00 2001 From: runzexia Date: Thu, 30 Nov 2017 17:08:01 +0800 Subject: [PATCH 02/39] fix typo --- docs/getting-started-guides/scratch.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index b177f4a24b..8d1cb7b3f2 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -705,7 +705,7 @@ Complete this template for the scheduler pod: "containers": [ { "name": "kube-scheduler", - "image": "$HYBERKUBE_IMAGE", + "image": "$HYPERKUBE_IMAGE", "command": [ "/hyperkube", "scheduler", From b84ac59624b625e6534ccd97bb4ba65e51b441e4 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Thu, 30 Nov 2017 17:18:18 +0800 Subject: [PATCH 03/39] Workaround for Jekyllr frontmatter --- cn/docs/tutorials/stateful-application/web.yaml | 1 - cn/docs/tutorials/stateful-application/webp.yaml | 3 +-- cn/docs/user-guide/multi-pod.yaml | 1 - docs/tasks/access-application-cluster/frontend.yaml | 2 +- docs/tutorials/stateful-application/web.yaml | 1 - docs/tutorials/stateful-application/webp.yaml | 3 +-- docs/tutorials/stateful-application/zookeeper.yaml | 1 - docs/user-guide/environment-guide/backend-rc.yaml | 1 - docs/user-guide/environment-guide/backend-srv.yaml | 1 - docs/user-guide/environment-guide/show-rc.yaml | 1 - docs/user-guide/environment-guide/show-srv.yaml | 1 - docs/user-guide/multi-pod.yaml | 1 - test/examples_test.go | 9 ++++++++- 13 files changed, 11 insertions(+), 15 deletions(-) diff --git a/cn/docs/tutorials/stateful-application/web.yaml b/cn/docs/tutorials/stateful-application/web.yaml index f5f246c47f..6c2770082b 100644 --- a/cn/docs/tutorials/stateful-application/web.yaml +++ b/cn/docs/tutorials/stateful-application/web.yaml @@ -1,4 +1,3 @@ ---- apiVersion: v1 kind: Service metadata: diff --git a/cn/docs/tutorials/stateful-application/webp.yaml b/cn/docs/tutorials/stateful-application/webp.yaml index 0a56f234e0..74a71c90ac 100644 --- a/cn/docs/tutorials/stateful-application/webp.yaml +++ b/cn/docs/tutorials/stateful-application/webp.yaml @@ -1,4 +1,3 @@ ---- apiVersion: v1 kind: Service metadata: @@ -42,4 +41,4 @@ spec: accessModes: [ "ReadWriteOnce" ] resources: requests: - storage: 1Gi \ No newline at end of file + storage: 1Gi diff --git a/cn/docs/user-guide/multi-pod.yaml b/cn/docs/user-guide/multi-pod.yaml index 7f7d0a5745..2ace060d89 100644 --- a/cn/docs/user-guide/multi-pod.yaml +++ b/cn/docs/user-guide/multi-pod.yaml @@ -1,4 +1,3 @@ ---- apiVersion: v1 kind: Pod metadata: diff --git a/docs/tasks/access-application-cluster/frontend.yaml b/docs/tasks/access-application-cluster/frontend.yaml index 382c3786e5..63631c0d05 100644 --- a/docs/tasks/access-application-cluster/frontend.yaml +++ b/docs/tasks/access-application-cluster/frontend.yaml @@ -1,5 +1,5 @@ -kind: Service apiVersion: v1 +kind: Service metadata: name: frontend spec: diff --git a/docs/tutorials/stateful-application/web.yaml b/docs/tutorials/stateful-application/web.yaml index 9f0ba1a343..9b34869298 100644 --- a/docs/tutorials/stateful-application/web.yaml +++ b/docs/tutorials/stateful-application/web.yaml @@ -1,4 +1,3 @@ ---- apiVersion: v1 kind: Service metadata: diff --git a/docs/tutorials/stateful-application/webp.yaml b/docs/tutorials/stateful-application/webp.yaml index 2318837427..705d1207cb 100644 --- a/docs/tutorials/stateful-application/webp.yaml +++ b/docs/tutorials/stateful-application/webp.yaml @@ -1,4 +1,3 @@ ---- apiVersion: v1 kind: Service metadata: @@ -45,4 +44,4 @@ spec: accessModes: [ "ReadWriteOnce" ] resources: requests: - storage: 1Gi \ No newline at end of file + storage: 1Gi diff --git a/docs/tutorials/stateful-application/zookeeper.yaml b/docs/tutorials/stateful-application/zookeeper.yaml index f07708c398..952e5b45c5 100644 --- a/docs/tutorials/stateful-application/zookeeper.yaml +++ b/docs/tutorials/stateful-application/zookeeper.yaml @@ -1,4 +1,3 @@ ---- apiVersion: v1 kind: Service metadata: diff --git a/docs/user-guide/environment-guide/backend-rc.yaml b/docs/user-guide/environment-guide/backend-rc.yaml index 6c57b95dac..28c7eeb097 100644 --- a/docs/user-guide/environment-guide/backend-rc.yaml +++ b/docs/user-guide/environment-guide/backend-rc.yaml @@ -1,4 +1,3 @@ ---- apiVersion: v1 kind: ReplicationController metadata: diff --git a/docs/user-guide/environment-guide/backend-srv.yaml b/docs/user-guide/environment-guide/backend-srv.yaml index 7083b37bf8..1c306bc0f6 100644 --- a/docs/user-guide/environment-guide/backend-srv.yaml +++ b/docs/user-guide/environment-guide/backend-srv.yaml @@ -1,4 +1,3 @@ ---- apiVersion: v1 kind: Service metadata: diff --git a/docs/user-guide/environment-guide/show-rc.yaml b/docs/user-guide/environment-guide/show-rc.yaml index 4de94c06ca..df2f03e347 100644 --- a/docs/user-guide/environment-guide/show-rc.yaml +++ b/docs/user-guide/environment-guide/show-rc.yaml @@ -1,4 +1,3 @@ ---- apiVersion: v1 kind: ReplicationController metadata: diff --git a/docs/user-guide/environment-guide/show-srv.yaml b/docs/user-guide/environment-guide/show-srv.yaml index 25a2d7473e..1761310421 100644 --- a/docs/user-guide/environment-guide/show-srv.yaml +++ b/docs/user-guide/environment-guide/show-srv.yaml @@ -1,4 +1,3 @@ ---- apiVersion: v1 kind: Service metadata: diff --git a/docs/user-guide/multi-pod.yaml b/docs/user-guide/multi-pod.yaml index 7f7d0a5745..2ace060d89 100644 --- a/docs/user-guide/multi-pod.yaml +++ b/docs/user-guide/multi-pod.yaml @@ -1,4 +1,3 @@ ---- apiVersion: v1 kind: Pod metadata: diff --git a/test/examples_test.go b/test/examples_test.go index 87b7e9a54a..a7f837ae2c 100644 --- a/test/examples_test.go +++ b/test/examples_test.go @@ -199,6 +199,10 @@ func walkConfigFiles(inDir string, fn func(name, path string, data [][]byte)) er if err != nil { return err } + // workaround for Jekyllr limit + if bytes.HasPrefix(data, []byte("---\n")) { + return fmt.Errorf("YAML file cannot start with \"---\", please remove the first line") + } name := strings.TrimSuffix(file, ext) var docs [][]byte @@ -217,7 +221,10 @@ func walkConfigFiles(inDir string, fn func(name, path string, data [][]byte)) er if err != nil { return fmt.Errorf("%s: %v", path, err) } - docs = append(docs, out) + // deal with "empty" document (e.g. pure comments) + if string(out) != "null" { + docs = append(docs, out) + } } } else { docs = append(docs, data) From 31e4dbdc25a60e4584ce01a6b1915e13ac63bc67 Mon Sep 17 00:00:00 2001 From: Robert Pothier Date: Fri, 1 Dec 2017 16:10:29 -0500 Subject: [PATCH 04/39] Update access-cluster.md with a comment that for IPv6 the user should use [::1] for the localhost --- docs/tasks/access-application-cluster/access-cluster.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/tasks/access-application-cluster/access-cluster.md b/docs/tasks/access-application-cluster/access-cluster.md index 0ae68442b5..8993067de5 100644 --- a/docs/tasks/access-application-cluster/access-cluster.md +++ b/docs/tasks/access-application-cluster/access-cluster.md @@ -55,7 +55,8 @@ $ kubectl proxy --port=8080 & See [kubectl proxy](/docs/user-guide/kubectl/{{page.version}}/#proxy) for more details. -Then you can explore the API with curl, wget, or a browser, like so: +Then you can explore the API with curl, wget, or a browser, replacing localhost +with [::1] for IPv6, like so: ```shell $ curl http://localhost:8080/api/ From 5d39cfeae41b3237a5e1247bc1c1f98e0727c5fd Mon Sep 17 00:00:00 2001 From: Tim Allclair Date: Sun, 19 Nov 2017 17:52:31 -0800 Subject: [PATCH 05/39] Rewrite PodSecurityPolicy guide --- .../policy/{psp.yaml => example-psp.yaml} | 9 +- docs/concepts/policy/pod-security-policy.md | 716 ++++++++++++------ docs/concepts/policy/privileged-psp.yaml | 27 + docs/concepts/policy/restricted-psp.yaml | 48 ++ test/examples_test.go | 4 +- 5 files changed, 568 insertions(+), 236 deletions(-) rename docs/concepts/policy/{psp.yaml => example-psp.yaml} (66%) create mode 100644 docs/concepts/policy/privileged-psp.yaml create mode 100644 docs/concepts/policy/restricted-psp.yaml diff --git a/docs/concepts/policy/psp.yaml b/docs/concepts/policy/example-psp.yaml similarity index 66% rename from docs/concepts/policy/psp.yaml rename to docs/concepts/policy/example-psp.yaml index f82f7a856f..d8359220e4 100644 --- a/docs/concepts/policy/psp.yaml +++ b/docs/concepts/policy/example-psp.yaml @@ -1,8 +1,10 @@ apiVersion: extensions/v1beta1 kind: PodSecurityPolicy metadata: - name: permissive + name: example spec: + privileged: false # Don't allow privileged pods! + # The rest fills in some required fields. seLinux: rule: RunAsAny supplementalGroups: @@ -11,10 +13,5 @@ spec: rule: RunAsAny fsGroup: rule: RunAsAny - hostPorts: - - min: 8000 - max: 8080 volumes: - '*' - allowedCapabilities: - - '*' diff --git a/docs/concepts/policy/pod-security-policy.md b/docs/concepts/policy/pod-security-policy.md index a1e219c146..f1373a7130 100644 --- a/docs/concepts/policy/pod-security-policy.md +++ b/docs/concepts/policy/pod-security-policy.md @@ -1,70 +1,492 @@ --- approvers: - pweil- +- tallclair title: Pod Security Policies --- -Objects of type `PodSecurityPolicy` govern the ability -to make requests on a pod that affect the `SecurityContext` that will be -applied to a pod and container. +{% include feature-state-beta.md %} -See [PodSecurityPolicy proposal](https://git.k8s.io/community/contributors/design-proposals/auth/pod-security-policy.md) for more information. +Pod Security Policies enable fine-grained authorization of pod creation and +updates. * TOC {:toc} ## What is a Pod Security Policy? -A _Pod Security Policy_ is a cluster-level resource that controls the -actions that a pod can perform and what it has the ability to access. The -`PodSecurityPolicy` objects define a set of conditions that a pod must -run with in order to be accepted into the system. They allow an +A _Pod Security Policy_ is a cluster-level resource that controls security +sensitive aspects of the pod specification. The `PodSecurityPolicy` objects +define a set of conditions that a pod must run with in order to be accepted into +the system, as well as defaults for the related fields. They allow an administrator to control the following: -| Control Aspect | Field Name | -| ---------------------------------------------------------------------- | ------------------------------------------- | -| Running of privileged containers | `privileged` | -| Default set of capabilities that will be added to a container | `defaultAddCapabilities` | -| Capabilities that will be dropped from a container | `requiredDropCapabilities` | -| Capabilities a container can request to be added | `allowedCapabilities` | -| Controlling the usage of volume types | [`volumes`](#controlling-volumes) | -| The use of host networking | [`hostNetwork`](#host-network) | -| The use of host ports | `hostPorts` | -| The use of host's PID namespace | `hostPID` | -| The use of host's IPC namespace | `hostIPC` | -| The SELinux context of the container | [`seLinux`](#selinux) | -| The user ID | [`runAsUser`](#runasuser) | -| Configuring allowable supplemental groups | [`supplementalGroups`](#supplementalgroups) | -| Allocating an FSGroup that owns the pod's volumes | [`fsGroup`](#fsgroup) | -| Requiring the use of a read only root file system | `readOnlyRootFilesystem` | -| Running of a container that allow privilege escalation from its parent | [`allowPrivilegeEscalation`](#allowprivilegeescalation) | -| Control whether a process can gain more privileges than its parent process | [`defaultAllowPrivilegeEscalation`](#defaultallowprivilegeescalation) | -| Whitelist of allowed host paths | [`allowedHostPaths`](#allowedhostpaths) | - -_Pod Security Policies_ are comprised of settings and strategies that -control the security features a pod has access to. These settings fall -into three categories: - -- *Controlled by a Boolean*: Fields of this type default to the most -restrictive value. -- *Controlled by an allowable set*: Fields of this type are checked -against the set to ensure their values are allowed. -- *Controlled by a strategy*: Items that have a strategy to provide -a mechanism to generate the value and a mechanism to ensure that a -specified value falls into the set of allowable values. +| Control Aspect | Field Names | +| ----------------------------------------------------| ------------------------------------------- | +| Running of privileged containers | `privileged` | +| Usage of the root namespaces | [`hostPID`, `hostIPC`](#host-namespaces) | +| Usage of host networking and ports | [`hostNetwork`, `hostPorts`](#host-namespaces) | +| Usage of volume types | [`volumes`](#volumes-and-file-systems) | +| Usage of the host filesystem | [`allowedHostPaths`](#volumes-and-file-systems) | +| Allocating an FSGroup that owns the pod's volumes | [`fsGroup`](#volumes-and-file-systems) | +| Requiring the use of a read only root file system | [`readOnlyRootFilesystem`](#volumes-and-file-systems) | +| The user and group IDs of the container | [`runAsUser`, `supplementalGroups`](#users-and-groups) | +| Restricting escalation to root privileges | [`allowPrivilegeEscalation`, `defaultAllowPrivilegeEscalation`](#privilege-escalation) | +| Linux capabilities | [`defaultAddCapabilities`, `requiredDropCapabilities`, `allowedCapabilities`](#capabilities) | +| The SELinux context of the container | [`seLinux`](#selinux) | +| The AppArmor profile used by containers | [annotations](#apparmor) | +| The seccomp profile used by containers | [annotations](#seccomp) | -## Strategies +## Enabling Pod Security Policies -### RunAsUser +Pod security policy control is implemented as an optional (but recommended) +[admission +controller](/docs/admin/admission-controllers/#podsecuritypolicy). PodSecurityPolicies +are enforced by [enabling the admission +controller](/docs/admin/admission-controllers/#how-do-i-turn-on-an-admission-control-plug-in), +but doing so without authorizing any policies **will prevent any pods from being +created** in the cluster. -- *MustRunAs* - Requires a `range` to be configured. Uses the first value -of the range as the default. Validates against the configured range. +Since the pod security policy API (`extensions/v1beta1/podsecuritypolicy`) is +enabled independently of the admission controller, for existing clusters it is +recommended that policies are added and authorized before enabling the admission +controller. + +## Authorizing Policies + +When a PodSecurityPolicy resource is created, it does nothing. In order to use +it, the requesting user or target pod's [service +account](/docs/tasks/configure-pod-container/configure-service-account/) must be +authorized to use the policy, by allowing the `use` verb on the policy. + +Most Kubernetes pods are not created directly by users. Instead, they are +typically created indirectly as part of a +[Deployment](/docs/concepts/workloads/controllers/deployment/), +[ReplicaSet](/docs/concepts/workloads/controllers/replicaset/), or other +templated controller via the controller manager. Granting the controller access +to the policy would grant access for *all* pods created by that the controller, +so the preferred method for authorizing policies is to grant access to the +pod's service account (see [example](#run-another-pod)). + +### Via RBAC + +[RBAC](/docs/admin/authorization/rbac/) is a standard Kubernetes authorization +mode, and can easily be used to authorize use of policies. + +First, a `Role` or `ClusterRole` needs to grant access to `use` the desired +policies. The rules to grant access look like this: + +```yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: +rules: +- apiGroups: ['extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - +``` + +Then the `(Cluster)Role` is bound to the authorized user(s): + +```yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: +roleRef: + kind: ClusterRole + name: + apiGroup: rbac.authorization.k8s.io +subjects: +# Authorize specific service accounts: +- kind: ServiceAccount + name: + namespace: +# Authorize specific users (not recommended): +- kind: User + apiGroup: rbac.authorization.k8s.io + name: +``` + +If a `RoleBinding` (not a `ClusterRoleBinding`) is used, it will only grant +usage for pods being run in the same namespace as the binding. This can be +paired with system groups to grant access to all pods run in the namespace: +```yaml +# Authorize all service accounts in a namespace: +- kind: Group + apiGroup: rbac.authorization.k8s.io + name: system:serviceaccounts +# Or equivalently, all authenticated users in a namespace: +- kind: Group + apiGroup: rbac.authorization.k8s.io + name: system:authenticated +``` + +For more examples of RBAC bindings, see [Role Binding +Examples](docs/admin/authorization/rbac/#role-binding-examples). For a complete +example of authorizing a PodSecurityPolicy, see +[below](#example). + + +### Troubleshooting + +- The [Controller Manager](/docs/admin/kube-controller-manager/) must be run +against [the secured API port](/docs/admin/accessing-the-api/), and must not +have superuser permissions. Otherwise requests would bypass authentication and +authorization modules, all PodSecurityPolicy objects would be allowed, and users +would be able to create privileged containers. For more details on configuring +Controller Manager authorization, see [Controller +Roles](docs/admin/authorization/rbac/#controller-roles). + +## Policy Order + +In addition to restricting pod creation and update, pod security policies can +also be used to provide default values for many of the fields that it +controls. When multiple policies are available, the pod security policy +controller selects policies in the following order: + +1. If any policies successfully validate the pod without altering it, they are + used. +2. Otherwise, the first valid policy in alphabetical order is used. + +## Example + +_This example assumes you have a running cluster with the PodSecurityPolicy +admission controller enabled and you have cluster admin privileges._ + +### Set up + +Set up a namespace and a service account to act as for this example. We'll use +this service account to mock a non-admin user. + +```shell +$ kubectl create namespace psp-example +$ kubectl create serviceaccount -n psp-example fake-user +$ kubectl create rolebinding -n psp-example fake-editor --clusterrole=edit --serviceaccount=psp-example:fake-user +``` + +To make it clear which user we're acting as and save some typing, create 2 +aliases: + +```shell +$ alias kubectl-admin='kubectl -n psp-example' +$ alias kubectl-user='kubectl --as=system:serviceaccount:psp-example:fake-user -n psp-example' +``` + +### Create a policy and a pod + +Define the example PodSecurityPolicy object in a file. This is a policy that +simply prevents the creation of privileged pods. + +{% include code.html language="yaml" file="example-psp.yaml" ghlink="/docs/concepts/policy/example-psp.yaml" %} + +And create it with kubectl: + +```shell +$ kubectl-admin create -f example-psp.yaml +``` + +Now, as the unprivileged user, try to create a simple pod: + +```shell +$ kubectl-user create -f- <` - Specify a profile as a file on the node located at + `/`, where `` is defined via the + `--seccomp-profile-root` flag on the Kubelet. -1. azureFile -1. azureDisk -1. flocker -1. flexVolume -1. hostPath -1. emptyDir -1. gcePersistentDisk -1. awsElasticBlockStore -1. gitRepo -1. secret -1. nfs -1. iscsi -1. glusterfs -1. persistentVolumeClaim -1. rbd -1. cinder -1. cephFS -1. downwardAPI -1. fc -1. configMap -1. vsphereVolume -1. quobyte -1. photonPersistentDisk -1. projected -1. portworxVolume -1. scaleIO -1. storageos -1. \* (allow all volumes) - -The recommended minimum set of allowed volumes for new PSPs are -configMap, downwardAPI, emptyDir, persistentVolumeClaim, secret, and projected. - -### Host Network - - *HostPorts*, default `empty`. List of `HostPortRange`, defined by `min`(inclusive) and `max`(inclusive), which define the allowed host ports. - -### AllowPrivilegeEscalation - -Gates whether or not a user is allowed to set the security context of a container -to `allowPrivilegeEscalation=true`. This field defaults to `false`. - -### DefaultAllowPrivilegeEscalation - -Sets the default for the security context `AllowPrivilegeEscalation` of a container. -This bool directly controls whether the `no_new_privs` flag gets set on the -container process. It defaults to `nil`. The default behavior of `nil` -allows privilege escalation so as to not break setuid binaries. Setting it to `false` -ensures that no child process of a container can gain more privileges than -its parent. - -### AllowedHostPaths - -This specifies a whitelist of host paths that are allowed to be used by Pods. -An empty list means there is no restriction on host paths used. -Each item in the list must specify a string value named `pathPrefix` that -defines a host path to match. The value cannot be "`*`" though. -An example is shown below: - -```yaml -apiVersion: extensions/v1beta1 -kind: PodSecurityPolicy -metadata: - name: custom-paths -spec: - allowedHostPaths: - # This allows "/foo", "/foo/", "/foo/bar" etc., but - # disallows "/fool", "/etc/foo" etc. - - pathPrefix: "/foo" -``` - -## Admission - -[_Admission control_ with `PodSecurityPolicy`](/docs/admin/admission-controllers/#podsecuritypolicy) -allows for control over the creation and modification of resources based on the -capabilities allowed in the cluster. - -Admission uses the following approach to create the final security context for -the pod: - -1. Retrieve all PSPs available for use. -1. Generate field values for security context settings that were not specified -on the request. -1. Validate the final settings against the available policies. - -If a matching policy is found, then the pod is accepted. If the -request cannot be matched to a PSP, the pod is rejected. - -A pod must validate every field against the PSP. - -## Creating a Pod Security Policy - -Here is an example Pod Security Policy. It has permissive settings for -all fields - -{% include code.html language="yaml" file="psp.yaml" ghlink="/docs/concepts/policy/psp.yaml" %} - -Create the policy by downloading the example file and then running this command: - -```shell -$ kubectl create -f ./psp.yaml -podsecuritypolicy "permissive" created -``` - -## Getting a list of Pod Security Policies - -To get a list of existing policies, use `kubectl get`: - -```shell -$ kubectl get psp -NAME PRIV CAPS SELINUX RUNASUSER FSGROUP SUPGROUP READONLYROOTFS VOLUMES -permissive false [] RunAsAny RunAsAny RunAsAny RunAsAny false [*] -privileged true [] RunAsAny RunAsAny RunAsAny RunAsAny false [*] -restricted false [] RunAsAny MustRunAsNonRoot RunAsAny RunAsAny false [emptyDir secret downwardAPI configMap persistentVolumeClaim projected] -``` - -## Editing a Pod Security Policy - -To modify policy interactively, use `kubectl edit`: - -```shell -$ kubectl edit psp permissive -``` - -This command will open a default text editor where you will be able to modify policy. - -## Deleting a Pod Security Policy - -Once you don't need a policy anymore, simply delete it with `kubectl`: - -```shell -$ kubectl delete psp permissive -podsecuritypolicy "permissive" deleted -``` - -## Enabling Pod Security Policies - -In order to use Pod Security Policies in your cluster you must ensure the -following - -1. You have enabled the API type `extensions/v1beta1/podsecuritypolicy` (only for versions prior 1.6) -1. [You have enabled the admission control plug-in `PodSecurityPolicy`](/docs/admin/admission-controllers/#how-do-i-turn-on-an-admission-control-plug-in) -1. You have defined your policies - -## Working With RBAC - -In Kubernetes 1.5 and newer, you can use PodSecurityPolicy to control access to -privileged containers based on user role and groups. Access to different -PodSecurityPolicy objects can be controlled via authorization. - -Note that [Controller Manager](/docs/admin/kube-controller-manager/) must be run -against [the secured API port](/docs/admin/accessing-the-api/), and must not -have superuser permissions. Otherwise requests would bypass authentication and -authorization modules, all PodSecurityPolicy objects would be allowed, -and user will be able to create privileged containers. - -PodSecurityPolicy authorization uses the union of all policies available to the -user creating the pod and -[the service account specified on the pod](/docs/tasks/configure-pod-container/configure-service-account/). - -Access to given PSP policies for a user will be effective only when creating -Pods directly. - -For pods created on behalf of a user, in most cases by Controller Manager, -access should be given to the service account specified on the pod spec -template. Examples of resources that create pods on behalf of a user are -Deployments, ReplicaSets, etc. - -For more details, see the -[PodSecurityPolicy RBAC example](https://git.k8s.io/examples/staging/podsecuritypolicy/rbac/README.md) -of applying PodSecurityPolicy to control access to privileged containers based -on role and groups when deploying Pods directly. +**seccomp.security.alpha.kubernetes.io/allowedProfileNames** - Annotation that +specifies which values are allowed for the pod seccomp annotations. Specified as +a comma-delimited list of allowed values. Possible values are those listed +above, plus `*` to allow all profiles. Absence of this annotation means that the +default cannot be changed. diff --git a/docs/concepts/policy/privileged-psp.yaml b/docs/concepts/policy/privileged-psp.yaml new file mode 100644 index 0000000000..6b6ec66878 --- /dev/null +++ b/docs/concepts/policy/privileged-psp.yaml @@ -0,0 +1,27 @@ +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: privileged + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*' +spec: + privileged: true + allowPrivilegeEscalation: true + allowedCapabilities: + - '*' + volumes: + - '*' + hostNetwork: true + hostPorts: + - min: 0 + max: 65535 + hostIPC: true + hostPID: true + runAsUser: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'RunAsAny' + fsGroup: + rule: 'RunAsAny' diff --git a/docs/concepts/policy/restricted-psp.yaml b/docs/concepts/policy/restricted-psp.yaml new file mode 100644 index 0000000000..fe1c1d90fe --- /dev/null +++ b/docs/concepts/policy/restricted-psp.yaml @@ -0,0 +1,48 @@ +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: restricted + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' + apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' + seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' + apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' +spec: + privileged: false + # Required to prevent escalations to root. + allowPrivilegeEscalation: false + # This is redundant with non-root + disallow privilege escalation, + # but we can provide it for defense in depth. + requiredDropCapabilities: + - ALL + # Allow core volume types. + volumes: + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + # Assume that persistentVolumes set up by the cluster admin are safe to use. + - 'persistentVolumeClaim' + hostNetwork: false + hostIPC: false + hostPID: false + runAsUser: + # Require the container to run without root privileges. + rule: 'MustRunAsNonRoot' + seLinux: + # This policy assumes the nodes are using AppArmor rather than SELinux. + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + fsGroup: + rule: 'MustRunAs' + ranges: + # Forbid adding the root group. + - min: 1 + max: 65535 + readOnlyRootFilesystem: false diff --git a/test/examples_test.go b/test/examples_test.go index a7f837ae2c..1999d1f158 100644 --- a/test/examples_test.go +++ b/test/examples_test.go @@ -288,7 +288,9 @@ func TestExampleObjectSchemas(t *testing.T) { "nginx-deployment": {&extensions.Deployment{}}, }, "../docs/concepts/policy": { - "psp": {&extensions.PodSecurityPolicy{}}, + "privileged-psp": {&extensions.PodSecurityPolicy{}}, + "restricted-psp": {&extensions.PodSecurityPolicy{}}, + "example-psp": {&extensions.PodSecurityPolicy{}}, }, "../docs/concepts/services-networking": { "curlpod": {&extensions.Deployment{}}, From 47eed4346e4491c9a63c2e0cb76bdd37bff5677c Mon Sep 17 00:00:00 2001 From: Dushyant Date: Sat, 2 Dec 2017 22:14:06 +0700 Subject: [PATCH 06/39] Spelling correction and sentence capitalization. - Corrected the spelling error for storing, was put in as 'stoing'. - Capitalized list items. - Added '.' at end of sentences in the list items. --- .../api-extension/custom-resources.md | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/docs/concepts/api-extension/custom-resources.md b/docs/concepts/api-extension/custom-resources.md index 710a334a48..5ce45d4e31 100644 --- a/docs/concepts/api-extension/custom-resources.md +++ b/docs/concepts/api-extension/custom-resources.md @@ -48,24 +48,24 @@ When creating a new API, consider whether to [aggregate your API with the Kubern #### Declarative APIs In a Declarative API, typically: - - your API consists of a relatively small number of relatively small objects (resources). - - the objects define configuration of applications or infrastructure - - the objects are updated relatively infrequently - - humans often need to read and write the objects - - the main operations on the objects are CRUD-y (creating, reading, updating and deleting) - - transactions across objects are not required: the API represents a desired state, not an exact state. + - Your API consists of a relatively small number of relatively small objects (resources). + - The objects define configuration of applications or infrastructure. + - The objects are updated relatively infrequently. + - Humans often need to read and write the objects. + - The main operations on the objects are CRUD-y (creating, reading, updating and deleting). + - Transactions across objects are not required: the API represents a desired state, not an exact state. Imperative APIs are not declarative. Signs that your API might not be declarative include: - - the client says "do this", and then gets a synchornous response back when it is done. - - the client says "do this", and then gets an operation ID back, and has to check a separate Operation objects to determine completion of the request. - - you talk about Remote Procedure Calls (RPCs) - - directly stoing large amounts of data (e.g. > a few kB per object, or >1000s of objects) - - high bandwidth access (10s of requests per second sustained) needed - - store end-user data (such as images, PII, etc) or other large-scale data processed by applications - - the natural operations on the objects are not CRUD-y. - - the API is not easily modeled as objects. - - you chose to represent pending operations with an operation ID or operation object. + - The client says "do this", and then gets a synchornous response back when it is done. + - The client says "do this", and then gets an operation ID back, and has to check a separate Operation objects to determine completion of the request. + - You talk about Remote Procedure Calls (RPCs). + - Directly storing large amounts of data (e.g. > a few kB per object, or >1000s of objects). + - High bandwidth access (10s of requests per second sustained) needed. + - Store end-user data (such as images, PII, etc) or other large-scale data processed by applications. + - The natural operations on the objects are not CRUD-y. + - The API is not easily modeled as objects. + - You chose to represent pending operations with an operation ID or operation object. ### Should I use a configMap or a custom resource? @@ -102,7 +102,7 @@ Aggregated APIs are subordinate APIServers that sit behind the primary API serve Custom Resource Definitions (CRDS) allow users to create new types of resources without adding another APIserver. You do not need to understand API Aggregation to use CRDs. -Regardless of whether they are installed via CRDs or AA, the new resources are called Custom Resources to distinguish them from built-in Kubernetes resources (like pods) +Regardless of whether they are installed via CRDs or AA, the new resources are called Custom Resources to distinguish them from built-in Kubernetes resources (like pods). ## CustomResourceDefinitions @@ -215,9 +215,9 @@ Kubernetes [client libraries](/docs/reference/client-libraries/) can be used to When you add a custom resource, you can access it using: - kubectl - - the kubernetes dynamic client - - a REST client that you write - - a client generated using Kubernetes client generation tools (generating one is an advanced undertaking, but some projects may provide a client along with the CRD or AA). + - The kubernetes dynamic client. + - A REST client that you write. + - A client generated using Kubernetes client generation tools (generating one is an advanced undertaking, but some projects may provide a client along with the CRD or AA). {% endcapture %} From 8ad19e8ec64ae92e275588bafecc9a89b3ea4378 Mon Sep 17 00:00:00 2001 From: Suraj Deshmukh Date: Mon, 4 Dec 2017 10:53:42 +0530 Subject: [PATCH 07/39] Fix instructions to define HPA declaratively --- .../horizontal-pod-autoscale-walkthrough.md | 23 ++++--------------- .../tasks/run-application/hpa-php-apache.yaml | 13 +++++++++++ 2 files changed, 18 insertions(+), 18 deletions(-) create mode 100644 docs/tasks/run-application/hpa-php-apache.yaml diff --git a/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md b/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md index ee2b0ba65b..d6bc7302e6 100644 --- a/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md +++ b/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md @@ -311,29 +311,16 @@ HorizontalPodAutoscaler. ## Appendix: Other possible scenarios -### Creating the autoscaler from a .yaml file +### Creating the autoscaler declaratively -Instead of using `kubectl autoscale` command we can use the [hpa-php-apache.yaml](/docs/user-guide/horizontal-pod-autoscaling/hpa-php-apache.yaml) file, which looks like this: +Instead of using `kubectl autoscale` command to create a HorizontalPodAutoscaler imperatively we +can use the following file to create it declaratively: -```yaml -apiVersion: autoscaling/v1 -kind: HorizontalPodAutoscaler -metadata: - name: php-apache - namespace: default -spec: - scaleTargetRef: - apiVersion: apps/v1beta1 - kind: Deployment - name: php-apache - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 -``` +{% include code.html language="yaml" file="hpa-php-apache.yaml" ghlink="/docs/tasks/run-application/hpa-php-apache.yaml" %} We will create the autoscaler by executing the following command: ```shell -$ kubectl create -f docs/user-guide/horizontal-pod-autoscaling/hpa-php-apache.yaml +$ kubectl create -f https://k8s.io/docs/tasks/run-application/hpa-php-apache.yaml horizontalpodautoscaler "php-apache" created ``` diff --git a/docs/tasks/run-application/hpa-php-apache.yaml b/docs/tasks/run-application/hpa-php-apache.yaml new file mode 100644 index 0000000000..efe4bc149b --- /dev/null +++ b/docs/tasks/run-application/hpa-php-apache.yaml @@ -0,0 +1,13 @@ +apiVersion: autoscaling/v1 +kind: HorizontalPodAutoscaler +metadata: + name: php-apache + namespace: default +spec: + scaleTargetRef: + apiVersion: apps/v1beta1 + kind: Deployment + name: php-apache + minReplicas: 1 + maxReplicas: 10 + targetCPUUtilizationPercentage: 50 From a48c52ff2107658575aefcc5915419db0808a7f5 Mon Sep 17 00:00:00 2001 From: Suraj Deshmukh Date: Mon, 4 Dec 2017 19:42:55 +0530 Subject: [PATCH 08/39] fix job parallel processing output --- docs/tasks/job/parallel-processing-expansion.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/tasks/job/parallel-processing-expansion.md b/docs/tasks/job/parallel-processing-expansion.md index 6c5e94e8ad..1dbb6d4887 100644 --- a/docs/tasks/job/parallel-processing-expansion.md +++ b/docs/tasks/job/parallel-processing-expansion.md @@ -42,7 +42,7 @@ Next, expand the template into multiple files, one for each item to be processed $ mkdir ./jobs $ for i in apple banana cherry do - cat job.yaml.txt | sed "s/\$ITEM/$i/" > ./jobs/job-$i.yaml + cat job.yaml | sed "s/\$ITEM/$i/" > ./jobs/job-$i.yaml done ``` @@ -72,10 +72,10 @@ Now, check on the jobs: ```shell $ kubectl get jobs -l jobgroup=jobexample -JOB CONTAINER(S) IMAGE(S) SELECTOR SUCCESSFUL -process-item-apple c busybox app in (jobexample),item in (apple) 1 -process-item-banana c busybox app in (jobexample),item in (banana) 1 -process-item-cherry c busybox app in (jobexample),item in (cherry) 1 +NAME DESIRED SUCCESSFUL AGE +process-item-apple 1 1 31s +process-item-banana 1 1 31s +process-item-cherry 1 1 31s ``` Here we use the `-l` option to select all jobs that are part of this From ef3c510839027a422fa204afc670c99009fc5fcd Mon Sep 17 00:00:00 2001 From: potterhe Date: Mon, 4 Dec 2017 23:15:20 +0800 Subject: [PATCH 09/39] 3 cn doc corrigendum Signed-off-by: potterhe --- cn/docs/concepts/architecture/nodes.md | 4 ++-- .../configuration/manage-compute-resources-container.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/cn/docs/concepts/architecture/nodes.md b/cn/docs/concepts/architecture/nodes.md index 5ddc4ee7e4..fa9bb53098 100644 --- a/cn/docs/concepts/architecture/nodes.md +++ b/cn/docs/concepts/architecture/nodes.md @@ -39,7 +39,7 @@ redirect_from: ### 地址 -这些字段组合的用法取决于你的云服务商或者裸金属配置。 +这些字段组合的用法取决于你的云服务商或者裸机配置。 * HostName：HostName 和 node 内核报告的相同。可以通过 kubelet 的 `--hostname-override` 参数覆盖。 * ExternalIP：通常是可以外部路由的 node IP 地址（从集群外可访问）。 @@ -115,7 +115,7 @@ Node 条件使用一个 JSON 对象表示。例如，下面的响应描述了一 ``` -Kubernetes 会在内部创一个 node 对象（象征 node），并基于 `metadata.name` 字段（我们假设 `metadata.name` 能够被解析）通过健康检查来验证 node。如果 node 可用，意即所有必要服务都已运行，它就符合了运行一个 pod 的条件；否则它将被所有的集群动作忽略指导变为可用。请注意，Kubernetes 将保存不可用 node 的对象，除非它被客户端显式的删除。Kubernetes 将持续检查 node 是否变的可用。 +Kubernetes 会在内部创一个 node 对象（象征 node），并基于 `metadata.name` 字段（我们假设 `metadata.name` 能够被解析）通过健康检查来验证 node。如果 node 可用，意即所有必要服务都已运行，它就符合了运行一个 pod 的条件；否则它将被所有的集群动作忽略直到变为可用。请注意，Kubernetes 将保存不可用 node 的对象，除非它被客户端显式的删除。Kubernetes 将持续检查 node 是否变的可用。 当前，有3个组件同 Kubernetes node 接口交互：node 控制器、kubelet 和 kubectl。 diff --git a/cn/docs/concepts/configuration/manage-compute-resources-container.md b/cn/docs/concepts/configuration/manage-compute-resources-container.md index 1e15f39e3f..6b06fc5064 100644 --- a/cn/docs/concepts/configuration/manage-compute-resources-container.md +++ b/cn/docs/concepts/configuration/manage-compute-resources-container.md @@ -15,7 +15,7 @@ title: Managing Compute Resources for Containers *CPU* 和 *内存* 都是 *资源类型*。资源类型具有基本单位。CPU 的单位是 core，内存的单位是 byte。 -CPU和内存统称为*计算资源*，也可以称为*资源*。计算资源的数量是可以被请求、分配和消耗的可测量的。它们与 [API 资源](/docs/api/) 不同。 API 资源（如 Pod 和 [Service](/docs/user-guide/services)）是可通过 Kubernetes API server 读取和修改的对象。 +CPU和内存统称为*计算资源*，也可以称为*资源*。计算资源的数量是可以被请求、分配、消耗和可测量的。它们与 [API 资源](/docs/api/) 不同。 API 资源（如 Pod 和 [Service](/docs/user-guide/services)）是可通过 Kubernetes API server 读取和修改的对象。 ## Pod 和 容器的资源请求和限制 From b98eec6d97ea8d264cf08ec86ad3675a5796846a Mon Sep 17 00:00:00 2001 From: Kaitlyn Barnard Date: Mon, 4 Dec 2017 11:41:03 -0800 Subject: [PATCH 10/39] Updates to KCSP and Conformance Partners (#6551) --- _includes/partner-script.js | 133 ++++++++++++++++++++++++++++-- images/square-logos/alauda.png | Bin 0 -> 14326 bytes images/square-logos/easystack.png | Bin 2906 -> 17672 bytes images/square-logos/hasura.png | Bin 0 -> 15679 bytes images/square-logos/kinvolk.png | Bin 0 -> 10572 bytes images/square-logos/nirmata.png | Bin 0 -> 9263 bytes images/square-logos/poseidon.png | Bin 10881 -> 9723 bytes images/square-logos/tenxcloud.png | Bin 0 -> 13359 bytes images/square-logos/twistlock.png | Bin 0 -> 11447 bytes 9 files changed, 126 insertions(+), 7 deletions(-) create mode 100644 images/square-logos/alauda.png create mode 100644 images/square-logos/hasura.png create mode 100644 images/square-logos/kinvolk.png create mode 100644 images/square-logos/nirmata.png create mode 100644 images/square-logos/tenxcloud.png create mode 100644 images/square-logos/twistlock.png diff --git a/_includes/partner-script.js b/_includes/partner-script.js index d90cc040d0..182734a4ac 100644 --- a/_includes/partner-script.js +++ b/_includes/partner-script.js @@ -104,35 +104,56 @@ logo: 'diamanti', link: 'https://www.diamanti.com/products/', blurb: 'Diamanti deploys containers with guaranteed performance using Kubernetes in the first hyperconverged appliance purpose built for containerized applications.' - }, + }, { type: 0, name: 'Aporeto', logo: 'aporeto', link: 'https://aporeto.com/trireme', blurb: 'Aporeto makes cloud-native applications secure by default without impacting developer velocity and works at any scale, on any cloud.' - }, + }, { type: 2, name: 'Giant Swarm', logo: 'giant_swarm', link: 'https://giantswarm.io', blurb: 'Giant Swarm provides fully-managed Kubernetes Clusters in your location of choice, so you can focus on your product.' - }, + }, + { + type: 3, + name: 'Giant Swarm', + logo: 'giant_swarm', + link: 'https://giantswarm.io/product/', + blurb: 'Giant Swarm - Managed Kubernetes on AWS' + }, + { + type: 3, + name: 'Hasura', + logo: 'hasura', + link: 'https://hasura.io', + blurb: 'Hasura - Hasura' + }, { type: 3, name: 'Mirantis', logo: 'mirantis', link: 'https://www.mirantis.com/software/kubernetes/', blurb: 'Mirantis - Mirantis Cloud Platform' - }, + }, + { + type: 2, + name: 'Mirantis', + logo: 'mirantis', + link: 'https://content.mirantis.com/Containerizing-OpenStack-on-Kubernetes-Video-Landing-Page.html', + blurb: 'Mirantis builds and manages private clouds with open source software such as OpenStack, deployed as containers orchestrated by Kubernetes.' + }, { type: 0, name: 'Kubernetic', logo: 'kubernetic', link: 'https://kubernetic.com/', blurb: 'Kubernetic is a Kubernetes Desktop client that simplifies and democratizes cluster management for DevOps.' - }, + }, { type: 1, name: 'Reactive Ops', @@ -196,6 +217,13 @@ link: 'http://www.inwinstack.com/index.php/en/solutions-en/', blurb: 'Our container service leverages OpenStack-based infrastructure and its container orchestration engine Magnum to manage Kubernetes clusters.' }, + { + type: 3, + name: 'InwinSTACK', + logo: 'inwinstack', + link: 'https://github.com/inwinstack/kube-ansible', + blurb: 'inwinSTACK - kube-ansible' + }, { type: 1, name: 'Semantix', @@ -428,12 +456,33 @@ blurb: 'Kenzan is a software engineering and full-service consulting firm that provides customized, end-to-end solutions that drive change through digital transformation.' }, { - type: 0, + type: 3, name: 'Kublr', logo: 'kublr', link: 'http://kublr.com', - blurb: 'Simplify and speed up the management of your containerized applications at scale.' + blurb: 'Kublr - Kublr' }, + { + type: 3, + name: 'Nirmata', + logo: 'nirmata', + link: 'https://www.nirmata.com/', + blurb: 'Nirmata - Nirmata Managed Kubernetes' + }, + { + type: 3, + name: 'TenxCloud', + logo: 'tenxcloud', + link: 'https://tenxcloud.com', + blurb: 'TenxCloud - TenxCloud Container Engine (TCE)' + }, + { + type: 3, + name: 'Twistlock', + logo: 'twistlock', + link: 'https://www.twistlock.com/', + blurb: 'Twistlock - Twistlock' + }, { type: 0, name: 'Endocode AG', @@ -684,6 +733,13 @@ name: 'Canonical', logo: 'canonical', link: 'https://www.ubuntu.com/kubernetes', + blurb: 'The Canonical Distribution of Kubernetes enables you to operate Kubernetes clusters on demand on any major public cloud and private infrastructure.' + }, + { + type: 2, + name: 'Canonical', + logo: 'canonical', + link: 'https://www.ubuntu.com/kubernetes', blurb: 'Canonical Ltd. - Canonical Distribution of Kubernetes' }, { @@ -707,6 +763,13 @@ link: 'https://www.ibm.com/cloud/container-service', blurb: 'IBM - IBM Cloud Container Service' }, + { + type: 2, + name: 'IBM', + logo: 'ibm', + link: 'https://www.ibm.com/cloud-computing/bluemix/containers', + blurb: 'The IBM Bluemix Container Service combines Docker and Kubernetes to deliver powerful tools, an intuitive user experiences, and built-in security and isolation to enable rapid delivery of applications all while leveraging Cloud Services including cognitive capabilities from Watson.' + }, { type: 3, name: 'Samsung', @@ -721,6 +784,13 @@ link: 'https://www.ibm.com/cloud-computing/products/ibm-cloud-private/', blurb: 'IBM - IBM Cloud Private' }, + { + type: 3, + name: 'Kinvolk', + logo: 'kinvolk', + link: 'https://github.com/kinvolk/kube-spawn', + blurb: 'Kinvolk - kube-spawn' + }, { type: 3, name: 'Heptio', @@ -728,6 +798,13 @@ link: 'https://aws.amazon.com/quickstart/architecture/heptio-kubernetes', blurb: 'Heptio - AWS-Quickstart' }, + { + type: 2, + name: 'Heptio', + logo: 'heptio', + link: 'http://heptio.com', + blurb: 'Heptio helps businesses of all sizes get closer to the vibrant Kubernetes community.' + }, { type: 3, name: 'StackPointCloud', @@ -735,6 +812,13 @@ link: 'https://stackpoint.io', blurb: 'StackPointCloud - StackPointCloud' }, + { + type: 2, + name: 'StackPointCloud', + logo: 'stackpoint', + link: 'https://stackpoint.io', + blurb: 'StackPointCloud offers a wide range of support plans for managed Kubernetes clusters built through its universal control plane for Kubernetes Anywhere.' + }, { type: 3, name: 'Caicloud', @@ -770,6 +854,13 @@ link: 'http://www.huaweicloud.com/product/cce.html', blurb: 'Huawei - Huawei Cloud Container Engine' }, + { + type: 2, + name: 'Huawei', + logo: 'huawei', + link: 'http://developer.huawei.com/ict/en/site-paas', + blurb: 'FusionStage is an enterprise-grade Platform as a Service product, the core of which is based on mainstream open source container technology including Kubernetes and Docker.' + }, { type: 3, name: 'Google', @@ -861,6 +952,13 @@ link: 'https://github.com/kubernetes-incubator/bootkube', blurb: 'CoreOS - bootkube' }, + { + type: 2, + name: 'CoreOS', + logo: 'coreos', + link: 'https://coreos.com/', + blurb: 'Tectonic is the enterprise-ready Kubernetes product, by CoreOS. It adds key features to allow you to manage, update, and control clusters in production.' + }, { type: 3, name: 'Weaveworks', @@ -875,6 +973,13 @@ link: 'http://www.wise2c.com/solution', blurb: 'Wise2C Technology - WiseCloud' }, + { + type: 2, + name: 'Wise2c', + logo: 'wise2c', + link: 'http://www.wise2c.com', + blurb: 'Using Kubernetes to providing IT continuous delivery and Enterprise grade container management solution to Financial Industry.' + }, { type: 3, name: 'Docker', @@ -910,6 +1015,20 @@ link: 'https://cloud.vmware.com/pivotal-container-service', blurb: 'Pivotal/VMware - Pivotal Container Service (PKS)' }, + { + type: 3, + name: 'Alauda', + logo: 'alauda', + link: 'http://www.alauda.cn/product/detail/id/68.html', + blurb: 'Alauda - Alauda EE' + }, + { + type: 3, + name: 'EasyStack', + logo: 'easystack', + link: 'https://easystack.cn/eks/', + blurb: 'EasyStack - EasyStack Kubernetes Service (EKS)' + }, { type: 3, name: 'CoreOS', diff --git a/images/square-logos/alauda.png b/images/square-logos/alauda.png new file mode 100644 index 0000000000000000000000000000000000000000..e2a7ce35edeaf2d0fff68961472aed0af1b2f244 GIT binary patch literal 14326 zcmch;Wl*F~lP}u1!wl{)xVyW%yL$tTyE_96?(Xg`gX`e#HrU_}gZtsXXW!iud(V46 z+z+=Sx}T>qekoOz9g$U;8Lp%ti3E=e4*&p=q@~1EKA**(-xOHr&)=RwsnyR1j*GaK zi>kf3i@UKC5Fl)3ZvrHiwl%f@ssN46JRL`Yd;kChDM(GrMN3|e$JE}I!T28xgNLod zCpQ4VC+Oi|Y-$a3AvOV8fb955E<1Wih(TujB%18JBp$^SM=OJ0ds)ZPh5 z%+A0;Z_3QZM9j&}z|6tK#?DMf%)-RX$;iac$izX<#LUCQ#lyl({GT6^Pi;EhzR!^r6F?#|%O%3$wg!N|`_Mo?OCjFNL zF`%=l6Ue~@WN%0Ok3?e=dsi2Jl21$j_Y`a${!6T#^M5YW=YlbM7&|aBGcf%#rGEkC z<^SKIwzmI;c6Lz#{W2w09sD6(y#UH#P;?{WGTi4+eR89%(yg7h^k9ptKl2$)^Yg5Xg*&SyWhz zjgy;IjQMk|nZ-GUIXHy5nV2}lSjD(Fh1uEu#VclS>S_zLbNLsq*?;r0{afCDe8JY? zQ?nS*3FHPelW?-PCH{{&^ML-nEzJK`-hc9%{d-$j{w*)#r!kEG?Ck%s)BhrUy3aqa z|K+!zga7h;pxvjtJAL}K@uF@80Kf*4786$USUdA|&mtT2bi2F#m7PAxeYvqYgx~c$UXG1s20vi<+57$BlDdJ=H^#b5{5Hk*Px3_nm zYD~27DtYnV%(>XuTuoo?x;j1-Jb9b_ZKLS!>bj^pjdxOwE3Aw@6f*un!F)}z-7h>E zf&fE~g)GCM$3@lVpyagk4=FeS;op$(lk{5uLFMiB{|og$NT1Re{_muJ6#T>ZpF00R z{SVT=%=kZ0|04Yl%jP1u=TmoD8@BC*jn4L5z7ym|)U{UC4f)_944ZL$jcTN-(bqS# z0FyR%Q#Q(GRmRjrKWIv`a(FWrHpVM-Y%?bNQh6(}|0<<7)xS&;If_2n0NV(~;n>8p zK6f5FD!GKgd(RR`z~GifDk=~z|J?*J))a$*_4Hv7yT%k|NaRd4np=(yj&9l9L>m)L z)N|r{&)Yj7GYfm*uy`21rry=v-SG70$>~aa%7xw_mwMb*TTMb4J-?~SrmnpH`VO0H z{J6+jM;D$BHN1{0W_4Bjz^P4(3*UTTVBo~v#g;9CBWh5~)|Q@@n%X!}C?K21Ri+wZ zQ9Nb;^ewPg-L1pdd}FQoVW+!p)u!a8s;h9o2KBp^fdS#^@i}l(Uf#yRA#U}|O+!U* z;;MUM$AQj@)Qf}P!oG(Al0(39}?ziN;dZ&`oQldK#zBY?>xNmm^P9-l%VjPM$}b@z-#A!!#vF3M4zZ%6qu+{odDoZc ze!uEhF5*%MU99)`TN@f~K>$wlsSe*Bq` zz~+nggBmkeQD>f)wi*m!Q$5qvvz}-8*&cA%(a++wK$f8;Z2UD78*k9Uky=S+)$YN- zr%EYZMH-P|-v)*X>5KT+J}LP(2ngLirH}V~6yGBqKG8WGxI7t6%9o>~qiJt%Z$V(= zs=(sh++5)N3uq<)BYn_B8Kut*KI6J}(Ij2mGh!&g4R9xkZFxw<=W>L>w5JK!rc~vZ zOdw0n#sYu?<>cjU!AT9}b5rNg$7cy4eJTgX@ZDY%qx1Mk@4EEd$nGIv?LD1)F7bT3 zS7em=hx3N=RSqlY=pxVH@_rR4@mt~arP=VZd~M5LC)GcV9QoL9NbiQax~CsZSzYBm zIaFebi>IHRB`j;T?qwknpgl|=pDh;=6&;9vxj%n->h0}SSDL5YV9?~PPluP0mZ?F2 z7;zeskR*brtC7sUB3yj{`#l^*&{;O$?7usMOvS6CruDe|_&}MMn1}>8KvP#&r&Uh1 zr~C<#eCgJK)r8_ZB;)~Bg%5F5D9gOtAct!rqns2O5wSMCR-*UUJV04lPQBx~3*~M? zW?4$9-c0dCu8htLTB!^4b5*2IX#`1^K6f)rNO~)AQmU8u+d(i~Juc!C zT7Xj|)FD`nJvjE(;`pssmyM547C9?6YXIsQWomNrISn06`{PQzseQoRl5p}?*n_pW z=TC@7w9$#Q%*>9wtk>7q<%-Hm!xzKjBQw-86=+Jc^-BKtTz7AhyP^{5H;OvSBK+~2 zI9aAYCZ{seU~=MJQ$=f)6dX8F%Y5#0FXN#;x(ISX_QB};a%>k)ZQ69W(#oZt=2W3O zipWsBVR;K7`1l2WUdRAy$}^BKRNPby8!@0I69u2|(YNdc+(IKoO*1U1vh)l9FFK_#IU;==PAV&Y;Rr(TbKE8F_SZ!X!D^W{2 z-w6|3St|b|1S){SEhfJ&Mn1IX>GXbeEtYftcf=HOsW**l(em!M7g~K$ps>2%S7fmq z2iy}~slJ;?H9R3I@j@sgMqQRjRI2hsKmrQTQIe^=&uXY3Gxy*1bJXTR&wp?D&C`g zF4;O-fZQT`Kg(+idGhw}JDCI-N)-s%Ey&v6euvLN(|HC7O(UY3Mupn5`37uKWW`?4 z16;90g6}A*^YaQPXZvfiA{m_O3H>5!nw66+BX*==AuC8H?QqDG%|+eT)>b*R^t2s~ zd36qeJd;XXTx=Ut60DnRrEji?_xZcN) z$&;m}T!4{e1r06HtSI|u#4`N+@{(Tj7w#8sYvZ*ieVPS=Y}qLZ(|IYJ7(*$mlAg|U z<=?qEqClkBudoGFCszOQ=71B?!PFnoxuMwr zGZOG0djYm0Q`%`Keq1VZ2hx%T+(eA`LOQr5Jr?|(RcgHYAs7?$<-4=JDk_!cnb*sC zuu}Ev&{Vzy;;PfHI6O|f&T5qH!nA{kb{-B0=U}x;=~FSlO4Mnlq=W=VR8)-J<;g`i z)%HUz*}NFgy_0F-f(k#&0^#qCKYTCYY+te0E&4npmp;StPQjl)1HU?dEigwnFKEnV z)e5GVS)E4Z-AX2N3!z#P^0M4GOxrX~F~f{_{sam~QH`!ejE-fk(K~C0-c*%*`zfC# z#Jr;C6;t27(0_QP-B29vg#7Z0;C#B@wg7HInFF@(0FR1x5II#vh zpdVJuT8Zj8HTLI0`^KmZMG6)nAgZotv)=A%t(L$u>NuNC1>clNP})t}s~8*rkeMcC z6e!V$(S}-oC>&c2vsiUvtCi6GhFFlB#X)s*Uc$}$_etT>0y!F{wsd8;pAZXiudv+U zoais4=?wCq_8&3dob%NZpLJ)|oyU4wtE@s-ZVh$&??y0$I4Hcxir;Av2o56e5upSZ z50h(dWgDap0^^vYl03es!v(nUIZoVczv;>{G-^X?r>L??dnx5O$0iC%(ZPo8kp%RW zuf{j-?W1zR@f1vKq?v2BbrSRhsHxoH!APx;@ zc2_x5MvhHpgw4h(R_pO!+{0aAX=XJ^qj;l$r;;J{A+~~fvIuVejg6jwYs315v)DKj zDY~6vIKtRcoL)3qTG}m0YgajNHnvC+L<;aE(SZT?pV?g3Bs-6XM~ShUYz(sSB0W15e@!rdoS#uKPY)LrJoCcu2I?37Ste zdKmoCFKw&ZtJ8c(R*te2yLxsHYNV1d)@%t%o-i8l9b_F!H=l|)6ekqpAM`Fonbau)K%&>P3s9&x%thEmRc{L#~aaCZ)%%!;8 zb92!#J=2DCy1W%Ge2u^Iq$e*=YXK=^pG1|}ws~~7VaE&y%D2a-h8)STk@a@Ye_Jyt zZ8M$018U44bAM3_RYxzN{cH1Js6mg?Er|Xa8$hP}tH=p*(qKV!L?bOkpRoLT+v72m z)=DpS7}Fz#!<>dXu>Ct0Ls}F8h9$`A*^3x`EF`Rg4r2mbivlc<3Jk_ZJxjWHmNVq( z$+uf*TYPM9ww7F|B1Vpc?XPO(F{B8U@twbbG71_+0sdK@bL~4uXfI2 zL*C_#l(0t;iu%A3Nv7PTkm=P*njLiV(}Sp}D4w3(!#9_?E_9ozTU5`dC&WCp0lq>9 zv$Dp%D63XU(+!-?z6rJ!XAd*TU4^_S1q~gQ1|pmN++0sB^a_<%0mE~;6*McZh*Lp; z&@Si>7B@f(gJVD7qFyyCA&Xh%P~z%KV&dV&!^`;5By*n6+uIu}I%_c)l=_qk_BjY9 zxClgP0^C^QH@)=cLA9_=jE|kaLE1||HL6&)F&UGuZu<%GWq1Hkv`*9T)nBby-ZeIR z;n4{oQ{f{YAFMovcj1d}YBE2*@jlHvksf@e(b&6IN{Tft@u%9;?b=c<=b?9$Lc>-@ zG#FJEOs_^&U*Ekj-_O86nHim(i)7&ubJ974^Hl8cH=h8rvc7?aM*Zh$%)2~zG;t}o z-+BH=YwTZ`j`j|mUT3&Y8^IcWvE?t1cgOP2nVn{TL)j~FO645OmZp2tkJIpkt)y(< zSr<=db_N~@`8=+OelslpiXq@_`MOh&2!{vxg-abFi(Be(Vje`L)%CW4!^N$P05#_U>J?Mz1_5dyPevj*XP++&sT&0Byq@lNGPoMWNrj zhSBvE{{HvngigB-RY^)d1vIa5?7^y>jc&4YJdKQrP3c8z;YslXcVj@WQ@8} zc7v#-0X%UhY>Jvjway)!%U^5U-6?A_F8ZNfmN#Awj)QYg#|ztB8=^a;CPUO| zV1Zg$>aCMD^7+}Fp6t&0%=B4kl&`;xAbKNUcq6Kij5rYE>gh4G1^v3`U%En^k0Yyv z;Kh+1i>i&*{gDT6p;eS%_&5oTF@oU+hhV4w-{2ym{IZCEF>d=X=&;F}p{Et#=zT+1%8$021pQJ~kl z%GTF;9ANbr5P3{&D|9_Q+YGv?F=JDebw&0Sdq=}5!qR{2kkh}#jLiz39>k`^sRW<4 z3{4ym*LZ?$iQkbocy39#d#6Z;0A4847gu{H~2a ze{7{a1Heu|osf9yDY|I9?tRuP&GJ<=m7a1NN-cBkR^J*fluTOf>frX`H z`TdL$%*KV3oh!t;YzzANMG&0#bo$iFIu{i+AESBKQGRn|WW;yl^Ir_!nH02y4Bh_q z0iUy?Gs&h<2e%@F-|)jgx;%D~xFdrPp-$@s2AY8-=o`28_c4}8s|+2S4GTzeUkd0% ztc=g_9d|PSLHG&c>H=#m{+6zjb<;KmN?Mg{`WhlGS~3>j6MT&foPGgz>1;k%{vn5h zD(toX;1{t0eyfIR(I52ZufFTndLORZ%{MPV1=dLGd#(-4lmgiy$fNd9zDyqdG@t^R zdy(!lpatJ*q_Mlho9mGhP6?j+5OHKJ4RNTFfohzl)*+pLNGS zeRp3HjaMtQD+r#l=6JGDUK>Ihf0Ng8K}X9d$j!~(?CN28q;i4?ILqyYxAywHJ!x^j z+$8FQ=5I0?j4<`U!s7XR^7itub(o$G%2&{CGa0OG{oq&u`A%$e6{`kXYN7#Ys|7z^ ziGurJ9OcIZ`g?x_fds*s43M4sy*E7%-)J|#P0TS>BBOF?y)1gz%;|h<03~AcqL>Gc zCpjpEjzp#7Dd7?y+w*IooEKF14ba8&1jDRnQCuGT4yGR;2Q@_HWWq*+Z*;^wA*zapD$tRH^8)Mk#?9{HM~$u#oL#!N2Ip35@2RLb zd1tS#M(M4LId&djxc;TK$5wPL1m)!7BJkTqg6Eg_4`y!DB%^{MK{Us$c9S13Z7`zW(|;5y4yu@ife`8bvPHT(#f2<>CHL zUqLQ?YIb&fYJAcb=A<;r7T&^E*o)w8>+}X#D96iBE68a7LqyAwzAcReZ6G^aE;oe@ zbn|+vFhfXVi8Q5-EyoK6!-NuLAjO?83p55o0?A6aROLxkTr7HNtDm2C()EE1H;0)B zHnmFQp4&5V*=cFGW;W9fSG0^SPlN#wpv3$tJ@e}@Yj^_x#0r@OPwuOhWsG&|!t8MB zvSbCYZB+^x+5`;a@=iHLvWpm6migwN1%tGV)XbGg(gFB`mW;I2%1Az3JXR)osO<{dP-mV4EXOVHGCyCpX#Q&HC0q}1ULllHLpsRF9aR7IjiaEA69Hz zw&EkuuNC%yScRgak&B)8+>Fb?hsD^Qj(XO?1oy2*Gh9IhbXiO4sQK*hHUnluCElwQ z=Mg;0d%~t;aTacFs6h7Ke470IehUmfn1LT688MWHKpJ$~ki;9kb+f&kn+RJJH0B=m zZ3}~dc@lV}4_5q6qTZHpiV%_Dl0!w$%T=Y5M}5`qyDrNJYDp_qr??}gQZRB*WK#Yf zdOWwsV*wc@D(;bv*TI-gd@?W`E=<;1%9kfjsGuQqacukQM_pm}>gKE?QMp@L-prtG z%PUmp8QjJ;Wr;(3mU~h-5OrZo-zYBmY9tq0S3u3s@Iw)>1L?V!WK3^aFa9PlhD>s> zfM%757nBy4qKLi4%3VpYuk}Nk-IaE>%>_-R{XxEx^Ugg7uM?ZfuP)aw=HM5z(D;#k z$HoO1gqH$HA)atdnv=Y8nD;m@5SeM%sCF)k8)-zw%9P(ZobP=enjD+DVnk*Rf6NE% ztAj{_&5LjCC1DSlAT{;a+2#&$X2{t0gBrNOJvsutUp0H9v5&Sz;I*$gyPY594cUyO7V5*U&dh1^#Ns{GXXnXQ!Aqqip$PYh|oxk#x3sSLFu ztX<`8MbP4?b}YzI`Y>A}Es6f4eE`B-^hWCIOAhomi=$ zqD?ZINF~e{tIVXNl`&OnmuAqhs>eguTqv|u>~;C!QnLD#s9d4#=mXXKZ)&?4Ii7?Hkv*fkuofaL4gcL6X|yhf{tx5Rr-~h(O+3nlQUkv02Lhj zr$#5iwLqS!RZS`Ad|1xBQ4mq6Lw`4}?Sw0$qaw zS*9ss6roL{Z>C}z%48N&8o#z(Rq(jmg^cq_RB#fPFC+DiKCuKm)hb;V*I`-U-Pk_# zTML@W0FkU3Ed`{_$H%v%e$GS{^GTYItobp%w@!sAuK zxUJJteW0|ylK&+?^5asks;;&T)QOQw_+jyida{(u@T<@OD|+ci_@D*(<>l%P;qi^! z@eLpoaI5UZ9~Q%!ZqH%I8; z@C+C!9VuDL&1SGCCZ!tBKIm>Kzbd}D&#o&YSy-)awIM+Hb+RMuF1CP!gErorN#%R4 ziIv2=X*T6KqIRd0Vo;xY0a^~408_pN`WA!B) z0OoyZ7#bSNuslC|gwN+F$Tz8Jj3t0bu`V87hwhEm%x$e#yOxtgck0%5up*8kw%hIi zk{%Td>dFb!e^&qf0b;7dg5DVa4n34ZS^p;4J3yU zKL2)tgU=~ELr{TQJ6wr6fi6LS3I;NZUS$&vN}pN=Ll4_ipo;vVl3ciBE^M`gJW($4z5TI1`P;XYS2TzzuvhRBszTwxP%~HhX z89br0PC|Cd-3sliYpA&de>Ef|B+Ox+;>u>Gnk=YWwq>WT_c&;|G&RN@=JNJ}SaNX?VHC2zj;s;;SM|DHlW^V%wqDY`$) z+PoLyh?qn~_wy#1+MGlRhcky& zAaxS3FlZG8JBISHHqgX=N;0z2;h(r^qhvD)B?;hQPtD4^726<*e<2Gqx!VL47Ykwc z7+N?hmt-9Z`2icki9tfTko+58%xUS4W8}ERJ|7T%{P#+Lhzi=*5Z4zfz2vr8mzO#0 z4%P#ilgQ&k%*9>&eZ(pHWF|8m#x&xY9H3rgVeWD)u#5kq@L0s7@uWM&3o+@e-^ydz z)z#Jc1%e*x$G*Ug&95@oDcqzdj(B~wlsoGT2E9k8$Y3yZLT`UA57`!Vw*7T+cB}?S zxwhu9^p%+;dIQOtsTsgklD(%nZ4E{V9jzYQM}uu6++DUEuBu_5WD6lZ7Hp^p4Z@DY z9}mc3*(*1qyC)x#a+f#aupcX_bFVcTOXo&N%ldV~`b4``FMf zG)j0dyl<6_o=Vn=D#y1M7G|o*Pvj~C_5Xib22e1-E7vR-IV-wNed@ zC%MB<%XddhNHvNU10b2k4DxS=y6`}v0ot_>irf1d`SD>h*M=N!BI-c$`Gb6IE_CxI zYaQmX{47x!wI3jy^#z>gm~YR3vYE?bt^AZeQ8_80QZYEEDj8W>b#F&Re{br1F4WmR zTk)=%YY)Ds&y#PW=j>7J-L?xyfWmgMyqPQ7cXR8Jg*YWjtP_z&8W;X9>%XYF{Qe1A zslBpBr38N2Y-vn!RHFViK6m?*TDk>C_lMtjOBmE!z$6dAkpj8k?$m44X0Dc@=*RIx$*1ob@Y4 zTCqZ8yQ(fjnkxnVbXt5)1ZlE(CI;+ydm|@t!yOP=!=|w@=H9K@5f1+sA6rKG%_!;8 za)o7H(rlWaZQl}|tx=vkKD*0Xh5E^BOGV1vlhUg^P0CnFbUAF?FZ?F7(70bTK^%97 z3)tUYGY;vy)BXOqbECF22OZp$JvYK%kziKX}?_lf26>=sb~kYasw(^MAE{MXE{ zOs=8xre(KuxJI{pc<;qdur6#$Wiih=QcZqg(1ztH8_cH)M`84bX6mK4vUc7nb>y?{o1|_rP@i zOLV&Q)l&^b$FZm25_wImwO*-%Hu=IR!m>3_+{p6!4zs%?ORc^#lgf$;HT5(ZsFUoR zYG5HFZ~*6A7Wa!6bmA;r;q-Hct*NJo3cjjE&psEfmo^*IagO@k-AVrPs-@Ra?p*`i zk4#Q`^TTT0;jwFNDW@g{O_m@Q7$K6-;Ard~ui{gCP~4adMW%w%VX7hDe%Hr?Z=ku# zY7!|o`j7fl?^l}{ELDip@+^Y6dvsKtnB9US#ieCKM)1-GhYV%jA2(xq<{G&cV3ojo z_-1ttV_n>a z}zHC@E-h-SfgQ;pVUm@pF z_;P#PSd8BKHRc$+HNrR}-p!jf3`sZFVv$0iNq-a47|Le22M?EUlQ3E=vQxm&!ONRCK&?*C4b<(qrF7Jl}u@<*!$taH^AJ0W^6ncpvy0k2^B{V zUz&eCGF!Mc*ps^L31!r$z2b1$JK!&+Ph@u$H404@iWnw>sptPP8WW=^O0TIZ+pBy` z%gE>t??z)A!AMW}`kiGwEG+CY{WE7CWq}zR8x0jIDG^gsR_Xm^+RIeg1PKuJytwUa zx7p@=NKO?TbZx(Pu+JYjt!e=!Q!1_nfbjSe&%1=>cRwqt%G+UHfP@@LJ^GS;NC$rI zE!r2`AOEz!NZV*%K=*UM9B9nIO^U`5y^czC9CUzS9st=wf#Q~ku0Eio^S(E99}{!f z)!4WX$6ju5AhL@!fVQE}JDk6y3m(s6g7%CRt7_drp-pAN)3J_09&r5^$QK(an@%>)?cjj5-hWe zoQ&K+39+G~An5M?Ru2ODB?CHCNY?qLXK(Mo&Bfi_ADr;GIVU~+gx~xA^=yo`_Vo)k z>vx5e+j4r`L9Ki`xk&Z7Gb6zu=Fg4sz^SGNvo_=i~M+4OtjVLaw zK7k}7Ax!g8uwIHets5tQg01+EG)ac`qI$!{y9$kymRObyCwY>plkaOAU*tJh#;Y4Y zX=@}|FLHKofw6aG;G%BcuqrL*mQ`0LOOuNNi5_zww)~N;RPb>K-z#sHYyBfl>?VwK zhfJA^{T-A7#=4`0teUk@E+ZLLPPSe&3=IvXLhUMG z$*#DdE0s)hpQFg}V`8N`<5RC1jdV()F@df_nh`TUYRFpTbgmbnxaLm8t zvpyzKJvrHNjL6jtIGYfGfHtamO_k0?B^hwgmU=&1bR;Bdx=VUTtLYck(lccAsBCYz zH9T|B47g3T^qt4y<~jZzw3%#oT0h-%;MY25`_xrLZipR>8WGq9+l1Dqb-FvuSL^0o z;Gf9EoBBx3kfKu65hy@vM!$ z)*j-98Je+G^m8|3vC=D%@3)JDTsku%fCB&2+ zXN9V_i0qwQ=qQvHIw^a_c&pp@S&zjw)nq=(hnYsYM2$|qqX|yO3ah3u$avILBk%7* zl@n8hzJ5xE)Y_Lt0_H#0afE1MID<{?u}gaMdB~4%gAoVXa~Z_oP3>K|(0U64IE!l4 z?W{T^T~qZ&5CM=YSQBuS)-eEFaA!h%PNs^o^(Zcj{1q~J^e^KTJ%fo_c3GX1RZ__4 zZ&QT^L@SeCGFd;I{us&fUQDaFV=(JJ_r|ES@an#Og{*smJiBz%JM0f|H0})_3iMl& zONR_mQVqPr<7C^@Ysvrh9y(Rjz%rfoyjXBwiOkeWQkC?w`7w7IfV;L)#l73xrgSokRcafb>a#{Y|^0Fi` z7o>TFl0{5Z%qBQfO)<-C;3B0$Rx2+vsToPjJ5h!@4b{k2VVGuKMGq4jmsaiY7e#!* z?%;c&TwQgk(q~R2Pu$? z$Q-e05XS2dlT9BllO?2y3NGCY4QF0=ZP4{5HZI{iZwf3PHP6g~yr+ZRP~sysx(~-G zfjGh+ISZc2Rz0IRKYnqA8}DZB3xd0+mQzK!Q2Wcw~Q(Qqsk4@ zK1IS@M8jnr%MV-emVHXQ$|nLJP8a|<30MPkuZ?CR$9J~K6_wRQi9>0lV6b#?W5tAQ z8F14Vd6(yoLQ~V!e!Df~xXwVCZbZ{+WVdOH19Qf?Nvc43uwJgt8yI6$Jp_xsCim$a z$%=|fMiI#e@FPtKCafPi@5MRh8ag^_&=?Q@BxHIMHrKJTvuiK+pZxCs{?5*Rq`h zw17F{I`n*ZVvJ2z+Hx>AKFMFk1(OKq-*z+LWCU7d!sThymuxd(>*U2TlSe`EuY*{I zJ~tN|9sUqTHDOj=06J%3zI+X|adfJ95=>{%ycJus<-Cm$9*F# z)zv4svWs?{*h6nGpJYBCemSv9a_MG>@5_OMP<+GD(?p^0{t%a#znx~qIeT8h1oIdkc6?!e5m#G-Lb1pCi`yy`mR*=)d;!YBdX6N{>|+-RoX$e7Gy&_DK^nMfUSr z!=GO+nCqUAE6AP()^E3)gst%G#i~zB?16h+YqOkR6`X&U=@5~V_|tZY1Z5Wzf3N*> z>-Iv8>)rCRW=i_RSG*}bMD#RtP~944XaOH=ZbEh%E;9a`?BC$eLbh=v+bgK{{% z?hU%DD81`X=G02>)1~V5e4ZY};X_it+}eJt#-}_l_qMDl;z(Lgmegv1Hm> z=Z=k^BIjE_4mH4}cEtw=8Gp94ynkuQUQPoFc*Yl_qL}>kYxuyOQo4R$#iP>>HCev;OnE3;2t`EWH-t#jSkLhL6p{ zNeFwft|@)mX`J#J)*fFWBG{R+;WkR1suyap#m_9@N3PY<5Bdqigmj7o5&VM)3 m$oKw#>bH5?9s58t0;EjmLfdAFuKm-ACoQfZRwH5*^uGW+I13Q~ literal 0 HcmV?d00001 diff --git a/images/square-logos/easystack.png b/images/square-logos/easystack.png index 7849d532ec0995611ebceaaf01499b4d1b7613f5..d47f14d125dd54013e549d75785104c0b5551ea8 100644 GIT binary patch literal 17672 zcmaHSb983UvS{pNG85ajZQC}!*ybepV%wNtVtZoSwkEc%m*2Vf-1q)?=kB%kuI}BX z?yj}EYFF)WMR^HCIBYl&5D-KuNm1o5Son3Pz(9RHy9Ojzz5tesn5K)0y_t)}~0d{=uR5uyy#N1_9v}@Nh6P zu?Dyh8UxHN?f8f<+q#GeElv4|HQ3}B1zc~uiHYZES0VgY_aUJvds z2DShfBSH^b8#`xi4?g05@#X$%|MQxGnDAdHF4la+|D}|soFbu!y%T_tjh>y(go%}r zkb{e!iJg&^jfs|!nURTufsu`Yk)4i_iJOs=o0*C5zc1o1X-=kQ+{&Wj|1ImQ$46}8 z;^M%~z~JugPVde_Z|`Kzz{JJH#lXnSz|2hdg+b@+Y3E|(L1*Vo@^22J0A~{?O9vNA zdpp8^I2sw-ySnfZe`)$(Q?PaTAGUVR|Gi9K3&!AKT9*1~}WhI+=WJoEgbKq8zwIoB&2H_D-ty_BQ`sMMVpH7kg(5 zdj~=h5kg8iBNI!zfBIDaB9N2gma=npF|soONQv?hf3cvqv^3>rWo8x^7Gq}@WnvLy zViMyJVrLiPVq|0&WfA4%5MpEfH?63>iK{KZ&gI{%#gU`TaMo>3`OR?LX2od?~~5&(8ioJN@rhU*_{q^MCC2tMfmW z53u_(cc(AA#`jp62LTcCmJ$_G^;kXYfcD27Napxx_4abwT*<0;(=bX#5tbDG0hZ@K zl4g@o%Vj?9epvrG$saleij(Q$0QFro28<{VH@-nTc*2o=>SA(S9%8Hz8XscX#jDAPkfM)U}+ebv>59D28rP)(f%3#571xvJ7iJ> zW&ZyH#ZVQg{~7;Z;lK3w!u$Wif9v;*AoLvi`U!LGfqPSTOUS|p-rz-7^Yl#tvM~c% zDoN0OI#9kmu&Bul(*@B#LIrf{7DSVE$T4^6IH0P)SS@$4L}=o=yL=wKxY;{!Zp*P& z31B(SwAZ1Opy75U+UGbtJ_=ST4$h`xwRgM9vu3n*VH=lo08%~xwUE3py|o3+2hOLc zuM0Y)fEUQxCPLp;lZz>z!w+g!4?8w3n6tY~NZvB~mh} zU5OqM5wX{0Qi~ZC6Z5y@78yXij4$qSQyIG5avs|=KKiVv$BPofP5@D`iIB?Bfkb=_ zbBFlY-J{aBGwHeo7RrYAR~XkTw5`_G6PfILM4j~hW0J)Jw};~+IVLuie8>=^E}AL*T3KOT5^QW?FLo4@R(1w-KxdlLdsE5;$Oo5~dv{*is3~-vcJj4K0GpBim3{ z8urnX>@zfUPP$dr{d~gvtE^SIEvkI~8}ML&mSWz-FpN!%>5rvWTJWV-HIhh?nHp&r z*luZDn5WpZc#oL5zt=FEg6J=EnuOh@5patVuJ*72LA41@RO zI$tugz-`B#6Ma7K&O8~GS&yemF+1_`vi{5_!%-Na=J zx;2et$OjWbHtkL*D>Cuq`(`W(;hu=`BF|~mufSeF@JCm9DJ!BWhs|f|Bj;KvbC$AbYo*9-n^9h^JTR?W1jRp6J%I#a}j(@iD(>t%l`0=it z%l@D^xufKOb)sDwvDQQN`25o{m$W)nq>T|hTH`LFg9E_=${xl#@L5u`TYTD63K)!Q z0(Xtf65$9dE*~X)DMb+__A;Z75J;X4UTGK~YohuC21e6T6WmJ@+&dZ1CD_87nJFwd zPHUIe(H3Yc7Cz5Dkm@f|t&5D@&qQT}KkT|IG_;dzxNDPn**_c7N+QF8=(#n%h}Kog zVyRCvOuLe|(@0`!M|mRvk~DvO?cq}viPJJ^`=E=r_b#T4AoSe`07AYi5C`|*Y=vYy z$Yim#gd}7MvFrkR$Bi%aTPnm4`J5z`mAAw*`divlH3=3R#42nIJgsRG)(fp>y|Tduf&5lpNO} zaB&qVHg($lR-tdgi;qIwd$?FOI(~i#KdQ(ns-nZv=#Fx1hIHn6=h{&o`Bsz_4p~Iq$Pb< zLA8A7PpLyFECdnO$8fZ z4oW0@DJ$KIK~02?guwXu_9%*!Wh7HZX3ct8_Dj{AvL`8&<(wa4rE~EI{xP*si${!s zi$QKBoKUrHd?nm2-SXkXWp6fh*aVcCxrD*6l(aNA@6XTApc$#3tguuFG@&;{Kca^( zspbSxA%`bNp~zPDoxuw2$Dz^7E628HH}oxND~@83d`9}bQy^V?R+QBGabt=4#0p`9 z`i4(53ct+C63H}%t9#=Fax0ghLd=U1<8)d)N`%$l5Vg>8Z`jZja;1FI&{-b6bnMd( z?6h8(cQZT)8mbXJ3d&Tx5}TGC=gJPHUl#_Fgj)p52*NFayl^B0noBa?19{v>+t6|5 z-{F8=T;niHWI@xwkfo4Y$Q+%Vqa2iLbcxgm1X#$Uky#6=y>m8SWU3D|G_F7x+ zp9apVg%kPW;5m8oemuX6^OJI8yt8Ea+CwL)Aye^SN-rTo9#W@nr~s@-B10`$8)bI;k8iWg(K6%;rAT`ZUFHj!H7#?PQ_w(@BcRcRa;RegXpBGYa&fPrQad}U9nbG^Qah1jp}x64 zJPcTuQH!(Lop18GZf>&rtrCcbNYG=dw^TXa=7=R|PmfvgxeY!ePk%YwaEWI$s$CYR z@p$Qjrt=u5qrZk(&}?C@-~7Vs>p7gCvX+52mB z8+b^}yXAgCnC>7m7X;UPVpLSOBghnQ z8y`ik0LxQ!L{|WyrZRoXe0BdM#Ba*Sa!2^(CXP zlzSpAX=c`~SwTjk$&`bn=N~V=8n`DLzK4_uix8OAVwD;rwF)icqPTdXU?f1Ko+B;I z2Cv(Xm_O)VX5)q`{(PWJL4E2B+iy(zlQmPv&!SpaU$>nO|BUOtb zM+6sd!fJ-@4d>rezUH3X?lzRuZx!ly?J3#mixo3C-Nx+SN;&W65`KAN_o$zu@xep? z^-WEfQZlRbsGL^5ix4k%3@$JtB)|3G8;;UeEN_6}p4nVo`txzr-P7hpg6BN4xTl8Q zptSq@YDTK}6F!00q`wSvS_09|#V|)#)A2*ZEwX?=#s&uliaZ3Izf&WcLr#7)QNa#4 zcwhzt0cOaEX-Y_a0|`=iCOb-G>8~2{Ep{>z>bxf`S9$51(=Cp>#{q`sig(dIB+~p| zKRW=h?B49^@@Jt0*w|h)Ns4_c%$En<(2jqgItkuvu4*P;KY*~vT0So9)yUs>e6c>g zUD{SDu*gS2Ke*2rGaj;+QGBMNI=8oCe%*q&=y5RTY=z#z+hH|$ZMghxN76$1>~7be z5zT-!gcOR`@h_=ME=j?h6@W1!KOyXH0CfKkJg9?PY&`-nQG&cr-Z}WW7Y|Q&$D8l3 z8jp^Syec4UN_D@q85{8}Z++c|R};(tM$2&=G0-A)|Ilo#wmqN+G;nUs^^wYP@8v^r zO0|v#i%TP$Qd?G$4RRJX$_kzN85n|FwMWHb?YD|?)p%uvCK?>p9MZ1Jtf`$7)E~>c>K2CO;?ppFdRW|IoMCz2_xJH;qI0A1 zA_imbu7+$aXAwt)$G(3Tv~40P>Nsz?Kz+8qyZ~9Lz%B)RDrueu2T_XA2^)R3D_ z$|X^3-virrZjrO~5!FXw#kJp!d5mmD_XR{;wl-h9AYLGGV|i_fVrumFnWz_){yoM@ z5id0EPyqGF7}3yYQM*)#jUZUUu%PCAdS*w6Osl+9DynAT?sLj;C$aYt72XtX#E?mR z%%odM4l}^i=-QLx{_gR>A$|NrCD3&VQ6`YZ2e>2@j;VFhKIiE(l4v&g5rvGg_G8gh z7avBIPFqQe2D)ztS(I4G6Ddbn0T&n{h(6S+h%FD$0Q+%jjSgA=@&O@yBY8 zSyI#eqbplJc2VL>*^Tvw3PU=6EX$1Ndr#+zS*6yt@CjY5=5H2Z7SiEC-cnUsj*uMQ zeZw674Va7X46LlIg3dDV^YgO7Z*RO1<=8IVmAJ;Uf7_-mL(kXT1a%~MvYI`?$F1DNS?l2ubnJ1*jZwcU|O zh@Ya}9B%m?^(L&yH{tA==iLoJEa=(sV~2*1u<>YWG-x3|WGLv+J=y#oqEy~&i5w=# z{zj{41l~IM5%D{(j%}e^|Fhos`0rd%&e#Dmw9+h$X7vEwV49n)*&ND?SvHO zpl)P*kijg4NQXU5W9BTmx^G5ZjvFfX+PcTA%757><>L_HaW&K%@&s4v})Q%rR4q(dIp*lUm#lhlC>Ghje(m=Z~rd zip#KY|IIgAy6QMGdcF1t;j;eYKuZ!G6N9aa`}$)wBDU~{{Rk6r%#-tKGlreGcwbO$b;Yvr-k^Nor9-q5l6J;>g%Sdfw^WCFhgluduYN)pi;v<-Y-s>2pVf!^u z4g=OV8@mxtU-@b`6IH-)ED2Dpl=a+kC@kJQhO#TcZ2~zFOYF;wb&|%6R&>#K3H?T( zkAXCY>j^Y61lmdt#W|a3dyn*tMSnQb;m-yxg+f=ES9;=ltVCP_Co@e8P zi~YzDO;}cB)qLu$>e|vt(DVFhroBnmK{7dr;EjaY(E5jmGh+uEXEyCF1rta(D8^+| z%xS^qRbtPN@ZKk1gI?r|L^~o(`2%QliHvHBnirV1Y!!Mq55}m>8gaj5jhLWi4_myN z-k_tdO~1HCSWL!DU{WS`&*U<}Nymh;Ovj{*b!Rt|vIiLkNgOu-8I-)A&U1jC%*)-# zYwqlr!?ZX%bKgekvFP?3wIuc&Mdc`;nIf4a$tjaS%E$!wDhQUAv>+$-$41$fkOL04 z_{V}(cp*-)-Z(jUv`{EH2>-8N6b>PMMp(-mlXiFGjRr7+vk6kJj>L#~cY=%!kMLEx;T<@4A+u_I$C zj@@P%%tXkr-JLJCaliC#S{AZbYX(+8&{~oeb7F0%LK4f;;}c|zM3v8Pf}lH5Fvo6+ z1kX^$8+^wt2kRB7N7#h4&HbB;z%i~w(a|OCrx=(75;Dy^oE_#dqWeX|h`om(2GcVq z1r#&r-aEDym?!X9etMGH8H`!7IBDtkG0~RGV`h&(l_ZdtJk9e2ROaWu-P!xyp4uCO z_lM~zhZ^pd#NhEPI$m8FF=8V){h%M9rWvK_#DwAno4$PLiww=FnQ!iBj^I`)o{6r| z^I4!{FW66hyEE=v3pHr59_vZ{nU$&JB0W%k!Q(f0V`wA}%c-aL7fUBP;}@C}-io3Q zJ2Xi z9HM}D+!RN_zTM_wL3r7ln7+=iL7Rw=27~W7_e`wZ6Kx+`NY?b7I%Y+ntG~g|u;i1X zb9h)=YQN-1V4q%9o)OxZqa!nPZ;zpI2#n!u>RHG;31@Nrbsy^ssPOrgzInDdv=f zQHc`na}f(61exx&r%TLfaB`AYfs5J$w|w!+*wZfg;8XX}`F=q_e_%{%1h}ox46yqS z394qw=rEVj=BJXT#qCvg`&4z3fK|Cv@hAKk=VFJ=3XdX8c=qZ$nJKM)`Hb@CfF;oX zgw`H8fFt4(aDyp$p094%TEq8#LkiRm-N;4%qZy>;=o9tO%4>2d#hhsEVWlz{ad;qT z%!N;fdq<+;rr0(8E;r7?Sr12^H#3}7lR1l=bl6uq=_Nf(v@mI600$(+R>V=<^%6+j z<|2_w+>NQz0OD7p1~Qo-BE&@B^ldu0E}uFkr=lZF)56*2&2DZYqL*VKc+s(Yp^h)7 z|IXNLfJHCHuQ}N<>grNCbZk?D`NJ8=LA!m))Bs7b+2C@pX~|o{&C|9w1#8bc^K9y` z@QWYO%E~IYt&OLaR|AH#3muvEmuJ@6XfV%k z-zED=hx>Wj@j9ZRX~|y`kJfDxI!^ZLQtM~1!b5g?SFDNVQV?x@CyEZYJpX=BY(2@S z=|%~+mKt7_McRFA7DMg-7JMefq2DhF%T=<@RiUNp^2>ZYwy7_wU*)L**ahz<>xNoV z)EUP$-9?J--rzcm;ss=#A>i7ge)K4f&Qgo8LyYJd9*fyviYk2g62++gWWYCJJZh#x0 zv+b4ea(tZT=&YCY+fhKNXBw}TgXltRe%=k&G7#`-H;Wc1^(AZQUO%cG8ZZz3O8BVH z+ZFg32(Hnw-yP}h=~Iwlbh*vPaK4JF$z=}?0cLWwA+RC;P}J~x*Q8}4O$Ir;KrG)$kvnnXQ*2u~2=lts0U7+AJML7l$exN4fsFx2(V_;5z0OD(iwFGZq zy}Ubq^ry_Qd7ss5&&Nb%u41#ZldQV^#i~+VgoX@K zd1NOm%Ldof>b1PO(~T!NEA`hBi}~dGp{us7!&D9*&K0&AkZ`fMSO>gZqk6T)dnyNo zj;?ZU`lnuUdb(DKnFxFxKWk&dFuNux_Jr%hoo+}V4D#7MdZcIK)?p|Pee3R&t6ZoC zzTIlGcJV@A-XLG|QKL8w@RYrLg`d09g`M}~<$apx%rwGz^xI^PlfJ@~;-TlqbQ)5? z3H>Pj7EW}?-xkZ~4;PsOTgj+T>_{=K)f+6W6H(8Lqz+57Ax#+r=bx7jk2kw?p>~CC z!cE|JsE|3kkWS*95L1`G-Um|IyIz-fH4W&=VGS2DH?%B0U#075vU2>_mXCPVj^RBH zmF169`WW=KmX^F*Nvm&CA9Wu$U}?k4aHcA$v!GxMJsb~J1bke#>YHb%74Bw5a8h(% zlSlJQ?L&wI6zo;<^9Bk*dVG%VOnUj0n7}NMWvHW5EblE+U7lrSwGYYB|XIqH8e1Q0Wy<$kp$Sv*Iq-k@9&q{?rshkU7=!;7#*^?)jaym z4^P)GZ1cwKnH}CI^BLa7a+ysnzyD}nz4|g1T16NgR_VF3W!b%b#%oSuuO>uRczZaF?f!=U!Ywvtr?1>r_SRw>+a6j`Sbsv-hcT(+ zK5_g|@G;rbbf@QP|Bl045TRC@M_7KA$9Bu{fqcI40gN(cB!+=!mO;nm?08Kr*vu;| zjUm;UjTz@Tcs#J@y8G)_BN@$FsiVi}JM>bx^s}R|`Px*=4sBbI&{;+!OY4P!;c~@i z4)3(aQZqt+}( zJouebUCrk;YIi?rv6O5Z}T{vmW0e7%l83&d-eT6nwMlURey|)7G{^G;XyKP?N4me9@peP zKO)9hYCNQ8Sf6_2x&rp=8H&)dsUZ@0Zy<>#O^f%-sx;le5xk*N+z{PR6-m&|Qsy^0 zcGeybiZSlI-|d{TK(LU^6to<+X9rS0aq&nLsBJ{_U5wptRhenjw~15)rh zeBYa^#nAbra2^WM3B6~JgoBHcCtmhL$TX%h)p<{MX5S)e$29Z6Z>oz zb=V~l-mvj#kh)@a?)}05Z{e5;RYX671YaZ`I?0|m$Mk9e z7dM^R#0{cKPNsKByYM@$Z1xL4;J>XM!r$^an$BxptTyoTb5xqKK3%F#?05|bAYx39 zIzOWA_;^^XTyk@FWe`;~s4?6DrrM~}RQk8)S5{VroYeX}-xMnb^LS_RInk1kLI#)# zf#H94)1|KaM&HiF_~Asx_(GraPO`CU-kmK<{K`tusIMb!&Iiz*K^si-Sgt3^uLM@i zuR6bgWjG3@1mBwL{_%9%7j};=hi@0EeoG2R&_Vy5jvEJ<+GxFedYGf&j-j6|pp#-> zs@h%KnJ(4CDBCX<4O3KO-Hiu*6cm^MI*!<)mg-Uclk|^JfAU_<*?2Grul2CBj$fxm(1wYjw@4%X!xy~zg_DQmoSdgftP*G(^@>lf_ zk&=BP1BWvgTcR*EAV*=Yne|XbRrNsWOzULqJ;Z1Y{7W`DEU6Mgw)>jrf2bC+4*>=Z znke|p?+hkXexMd`cXyWvME=FfAR}y)J2*H9=E5Jv8iu?sQb;!NZn4(W8w|hKz}~h& zUtAfFiiXyxXo2``K^Y6eE5d&B@!k8=zsX|r;rwzFJ6yEU)pbaNgPpySo|e|bW`7j^ zvdQZfI+xb~i(kwfAhf_BQ4Ibg?4}=Fq_V{a&ZE4;Lxa`XY-f_Wu4} zh?g3ufEzIP?#fth%I@|OOiOhmX%xL`V zw6uo$3%n!zi%GRxZNW=fZN9_5ChX3wxDg^0a2eh>$DEWy%ynm67Bol!_*2;euHWlS z5gM%2oFY;Sh7!{@mp^+ID3_A`Qxnx4e7pwQy>D@!VFq2=J0aDcCDx`N2+A+_ii!^> zAEae(C6^7UrQ356h}8L%rhd`Qn@J>Ms#aTFtv3%2*{cPSr%0}*Dk^=$4;Lt)UZC?wY zY7;b~f6a{_3uLObTtT--e49p))-l*6Q}bK^EIg}N=DhjJr7y$hB>s>Qv?x#GR8UFj zx559UWPM~c%zXOJ2zpahixBY3!hD8WskN#dnh$U$LrfFrHDt2x@v#%q;ZWh(wQkU7 zLc$5d-F^BfNUfjl69u&SmEm$w%cXYsUf!3nP+{z8YNhae%k%5$qjRn;x3L*(+U=)7 z{<}-u5J<%UkBS!0W#9)Ht_lOu&;4RSI+PjpVJ|?zN=b*Wc$(le5I|L zlZK@}N7Hmn#~#!+$@O}`+Vs`&^W(iUhF-(TB_bkXecT8eg?vssB;SoP z-0Ch{a9!Q(&^2$^VBhxQgGdt-^tl9DP+w1}S9BgxuUJqdx-Tp@^y)DE8{ks$FeBz; z@pk6-OwL7Fwb%o9CAYQ4Urwau)ti}|<0Z|8DpGd?_+=N-*4B2Eu4 zg4KfZo?MO{!n1i7gr?N*%lpu_rK;l@&!;t!f1~vRZCN~%Gdyp%$DE5&r`94*Fx*HY zok|v|$ij_d8(xwgByNcQeB-zX^;C-_M0<&2lO;8rwRUAlb1mAfn)x_8syTlyK{&I?Yp&LKSquEuTVtKpOJ8ylcoQ{vRDuHq4ee`|_{>Mm z{3FI9BQvurB{OsEJIU|awWEk5O3UW1*9*K-+mb|3&~&~yJ*+oAZ&MeDm0B)+CH;@R zj>n&mW);>^P!p4SZN>bz<7Q8%Tlk`A`mvjCA2KkL@?~4_4DEL$rt{X}(O(Ya%SC1L zW}V-_D7;`zNJ$`;O9@;o`^D>o0>S6U!{8*!sS6CH6?hvHqHQBBLfqo#7lBn#^w=?(F^Yrsfqgvc9m;IR@1dr< zP8qo`c-n$;*TW$fD9r_4^u>5$%2w&XoEx4o?6~iTnTTc{uhTS6%MxU%$;eK<4uY#c zZ<4pVem;g={)}x<){QFNIQ`l6c2WDWff2**>_xEf_$Y&i&f7z(0Y+{o42pak>f~ok4@b+rr$ZE}9LQwO2$1Y0i;;fnl z?zGzhyS5TL8EVZR*C7k;A3;^$QSw*2I-gDjme}yL#jG2T?$b-{uYET;ST3fgS*!Jn z1OK2Foi7rSuPO$gif}y)>!{qaemZXIc9z!G+ux@pHFf$Xb!jqk$~NR3r;n2yh@i-* zFmNXcF3ikm1s2>;sk_Pc?n-sOe!B=QJE0N~R`9l0S3mf;of5eGR^9n9s4$Y~w;RpT z<#wjIA;z9riItn}{naP~hwP zUXL8a3)Il;v{}*Fn^B>ytEo}U5t$kt^?K=ej9CYA6q2V@lveR8>Zvs*pXoYn9%wKS zNf3p|kN3T1x>XJGG=v)OG;Hy`_fb@u4Rss^Ip$f^gxFZ#6cwk8ug@-SEs_%!T(9p< zk~T`mx}_%=p#1UP?bv#M4DGr$qeQQB`PQWH`t0ZXInf@K?>lUoSKQ2>u)sIZL=kh6 zim4?V{8Tds^gz_PKvgK>d&S}Fo9rS%x}A2+*k5ftR)e^sD(^YC4QYQ_dbFi~2z^Ha zyJJ}+c)hMm$7qSDllhd^*#*g3p@=XGL&`;znoF_9F!&I0X<&9+?DCaRh0*!>V(`fC zSWxbaxcEGrjIsGdRUb5I1TU+-ljcKNvSKF?Ulu474*YenN{ zs$F_oxy64RXDEHXUF1C!+KtrG7fF|+V{THST=T-Z`9SLuaj~V17ytePnJEc_ zyd1dk@~eQn5C>v7ikdhr^pUffKivKiimgNzIK`nUmrz^rpVoXY&1tb9-H7;|=Z_Cl0ueQ|Xa200PHMnw_H4U+vU6oXFtjy)hPEs>ou z_jD>ttF8G@$&sjv^PG+G*8W&3-;qQc5SLn7nkmh-EowYHygKpBs)Ui>-57Jo?C)@ zXCJ}UdRnH^6G)vcBy$cF^jn3}rK0hw20Nq&BM#lB1MAZ+j{4SzB49@Kh~OB|J5v+C z8goa+=N_=^I$2LZ-k#lP1F=8`MP@-B7&70FHaK-(Z z|6p{i9z#>|SM=8y+lhGP?;l4`@!y+m%12h%quRfpGJUX?60fXVyx9_W$EE}yQHVXFl8Vd_oc+4iUp67!x^q)wN+1X?r9Y>h%h7Ix;Qp5X^zu$@T?d@al6Z&#uueO`Mz#Sf?otEo=9w|3( z+4c$%0W@b{>%YoHzsjpVn@F3D?>tVGI6a)cl^OFR$4dDLHYN62+%?{@N~6XVog*Hq z(*yI*>Qc?r=s6b`w_GsF7T_h`FKF?qVF4?3TWx2+(@O$e=kpD(BQ~kAQ{1e6=j?Y| zlB9|?fs-VYxLOaJS2^noebp_uy_cMxhy8%CE@n*FV-IySXU*Acgz{DAiBX-;kGY|) zB~kD^=bFGXRXeNeHwv!}-{U+7N$;yYBo0uI?ghGfvJ@=Y=KXcE`E;Jumkib?j<(zr zAbf2bKOSWw%GgLK)vtk6Wnvo7w26RHlhBN+KQF5W_jhf)wi|(hD_iW|*qU_W7B-fl zXR@K~gCXpfXmNZ6U?}n&md#Vl{ac8^ZB9^nb`#x(T}jKL5%K5zKz(F9O!A(rp{w_0 zXgXWM%#dZO5O#d5m45l~KKCTGuk}-?0(9aLfdXiUMOh!_HZh2djs}tWHf*J)Z%W7heX5HR<+;tUNU66#{V?ma8r@8 z({j1bl38b^nPZ=pmS3D2&I1jIFF@PdR?>|(^E?79W=hOfV0Cp_e1vRqa4TqKW=C6< z&yef38wQ$xWyv5iM{=^_r79MBn29kMR-Wo@@2gF`A@?Unhdm?UW*i#`>%CH^w4AH0 zUy)tz8+%95n*GGt3rTyR_h0IWH?sC6M@zilsX?cntigRCC8&?)281yb2-FAcLO_|B^#|FJ8PBKo)W z+CR=Erb0fBK%0i6H3O|i&@?}6b^eH{+VWb`I^uPp`tazk+WJ1A*_lPHEuPP};UNU% z=pkn0AsIb8m{#>tE8Q|q8%6%q`s8#o@WPHFi>B{Q_eb=gDYn`w(al{eLcT!UH22kC$TEl&HSi0nFha*aW*~3z|4n*&S|iOYs9&b z%K_V?;j-unG+l|eWPj*GZuFhP{9Cwx5wx>SOE_rscK&79%p}@C?pAoPw+-S68iqMQnI=m{R>%P6r~PuPyzil2l26Ofz=IVj&;DhjHxV^2J%PR4m;b}Vfv zC*pZ2L;saILTHRHmE3IFA`tzi9vf94Us)G--nVAgfrbCHCUPWu7ke4xNKZ5^HXTJt zPoH0d0DzqFsUMf!!^1#D9Zr{ERS_{HAxs-5U%4RFNw84_lc60IJij|8%(qQX%%(H1 zF7D1kSRFh3quY1G7EV|4*7}vdCn@N24HgTAzG}sbX=q4nP?Lp2cIlXx$Ga{8nQ=gn z##0d_!S1$m@<)#E9>yV}3>i#Uk_5_pBiGdTgq?rHPdS$f5So(!1Q1Jbp{`2jmQ_IU z<{2?sSH=M*6MOo0hAI4u4)QFK(-+uF=(1_10N+|)Om!NV%b}!e@CR4S(lY%(H5=JI zF#w5+V3tL)N7yG2$t58@RYr>N+=|ZFPbV3dBI85;92by*BJcqoqWG)}o-ExZY~8Dn z8p3w+pqMU23gds*V}ITieBlhz}A(93nxJ@m&)EQc6@|1Y_b+#KPbA z3aj@VhT)?)J@qr)KK8llmN@xGwdvSoe|>lG=q35}V|LBaYaOhb zS@PyMU{73$D{nu*To0dRQe;=dl5LdgEK93yqy>_(A|@6HJvcf2CYfQ71_`Hhf!S4J z&`j_Z;xwy{L~!N)*2|E>nm`v{_VFzK$b+GsD%UN@Hfj-lg#wNv!M@|}B85O!SEM~H z8N;E)>>7*JAH(eXBKmIp4NZ;0IklLJzx>E#C(^-b4ypsvlk0oBwE<=<7USEDW?(3X zhT_k(!{QGUj0gVe%plrr$X5^nu_rU%>x5meU0|NTbCdnt_#~L@2}+~b}_liymUTq^a=yN()MFCME|6vuZV^D8H-ER%+4-`cS)X* z#EeXF?tVC+fO$B5?&MA?Q7|b$&iNE#IK0V8dSm1yQ)+nzhzgCzyx$Pj0#fj!q|)o@ zW^`?@@$}{$4z|+yJ|c5Z3qhKn%ku@IhI+%pvu-qb_!-W>+#RBh4)Vsmy#y2wbKf^z zasZ0>XNl;vCY^eT`w|5PaA0rC5`zaD6Bdo$U+>gk|0p#)bet-72$9t&PV)yH5MRw> z%R*ppHFCes(o5Nmx}`eOvFp=_`}zs=G{61H4`Yre1ep-PfrzDWX@z`2o@ zk`n(2yDT~O*qIDZo1VuG-0=8#kb9GDU`8q14ajn>33P>Si_?1frv$sY@IpQZz94&a z_p96YqN&mz^yfGPyH<5+-(nCRDhf5EX%v`(Ltc#x!?m1qhz@&C=^F!Mv%`0J%-XBu zLxb4v^N_w`HxYCDQ!d+0g>zpCV=yq)D6?g{wy2k*s*^L#rtT94{`DP$IgELR$DkhZ z6|(i;?W4}7B`hO!1~rZlUW^HgR_G7}b)hG|1;m)>xpiLHx?aan!($^sx05=&uu&)| z5dzln>9WY18l6eQO(_A^^(%&bFRqHp%CzO~##6Do+451mzqwyN7h>>Hu=u#bEY<2@ zw}vM1rwR5uhqGu#X#)*5J~%vfyCZX7V9syCMTGlvzI*Y<^gn1|6btmi1xPqK(>79Y z`)V}D1koSCTO3Mof)&H{!>%>R1{Je*nyDiV4SJ$^@e_1|xCEZk>%ku*t&uY3(CDYb zX-&%@l?)jlB3S?KW~>!aHhiHxOOd>oUcTbQ^V;^Ma^usG@LTS#)uiRp48igHHuK!y zUFwwuzh2rZ2Ql3e14zvLIdZz0$b(iq$)jN>G%7F7sC~uh?B&&pGJ!|Uis6St;%sRw zdvhk&KS@tBP`r0FeVxkiUe_-0eweAi6~ITr8Ft2Qtw#s%inc=Zb*$XRHnuR}L}{w` zb6JN7Muw^2l#^pHFrhpG6L;s+*YhyAmbYf!i&2B7G~kjuVu4Z=r%TxPX# zRjcQ&Sk5s7Eze9m){#psO&bs(`UZ~15pvHT*#S3%gf9Bk%?aF4egp%TZ7Q_ss-Iq_ zkr|{i+%rAc-E~~1(w-y!!#XmexwnTwUHz~y4LTZ(IZV7uyf4#C>RA;!*oF5mhsEQTig zZm$!B{ckw0KPHZT<5}9;CSQG+EuTM7>Vco`3_3$y;Uae0XpVz4Ng<^iS5{Yl+dedQ zL61C~%s%a(`ms2m5Mv@G1?#-s9k8PL2-8Rhyc1=viwnthk6Qsg{uW|f`ep5q5KAb5 zdiOF#khIGVQ)`Z3OAwEjqm=Uq)JAAW4u7@Q?d%42#_d4G8tQdlkvEExyi}xPrPnSy zLq`B`}EV}{k#pwz#~%xBaw;DZ6N$ftz+A@^TO3tO?h!~C=Mp( zAJEu$>dv2zTfUDI>orDw@n2Cr&(*7}&Ai^SRy}eO1Zg-n{?uU&O4)Ur+X*RcX2IY< z3~5<3N?J`t6sb;Qg?6JAeE|4Wu~3{CkJEM=l0mxW6hFi+YXcV~ZzuHFS9pvSKfG4l za@W+v&V}uNm`Y+eUvECePjpB@d}V=SOIzR6-u?ywR5?01$p~>>j_qdu%eCThPWSce zJI*yX!_FhiG?xk@64D^0?YGk{O%;{7Q1ETw#l?l~GQK7qKi(;e|1TEGc^6aT;rIyySE>s2h68}zqIh}d7zfJMLM{?G}# z*TVp(AKv1-4Px*E6Y^RvGb#&W4lQ`Ww)AKKgSW zlQF^rXwF{ZK#6LGp}se;L7GCWzRN6ZZ7JYir7c+9&yjR_-)7E*K0(JVuq)?JJnv2|7Z4qOQ<^ z5V96^5QQPtw1b#J{QF4!fkzrbtmePX7mv>!xGO$}U@Cr-H> zYOQ(7_J1s$7#*E$e^|AKY7hM_Hc(QNgAGOo%*>;`-y{F7`&D*EHBUZ2NpeRf#w?%1 zOJ(d`QfrIcrtRtf6C20ieu^;%QX8!Irl2IiT^%6BGdBC~=Zb_xcPI4Xnp0w%zG}5? z;;2OMTd}vLte-S({tzqq*M@Tyq{#BJ2uzXX^03-4^#n{Dzjj+-#gWK8KsYWZG}lHv z*ZQZKofhVan8(gu%)0OTgM@-dwZ;{(FS&V7 zbxIaA9SJAiO1!R z`-MHO3`~k;T56Nq`CPSM@Z+DqKemfWYTGDE9_^jGPkkn*s>*)uht(R9_s>14)@N*Q z=zIP>c&|Xmr{)#GWtP+Kwv@h(*^uC{~bG~N4hK#7nFNrt3PA1v mon3&9hP$t(=Ez(dLL@iIZ_bF2^-az+ zXF41UIYMsg7oxuY`2O4L^*qn#^?IJ?{rbF~|DO0n;F!2vg5{+PU;!xs0000sAreRj z8gY=yNB9nEV2{4_eK{o{?7nHT!nw0#1QH3wVAPNrXbc9a3PmB1D0Rd^V9p{naA*t; zrCGZ#2NblzK$Yyg{3!mng42~j(vE0^0TPQrAp%Cae}7JF_#^s8OS znMS&Gjd6RoBD_Y5*>`QRe$0sy{w>Y#bZglY_ZnF}?sn~^vf-JXLM929$N%xu(#a1B zpZVZ-Zu=#sck2Ep}H^CD0Q) zUGsURq8EPb{@yL?E>c`#FvI`hQ0fAYdp?RZ&tP^<=f5tBlVw4vu&MjRWs%kjB9E6a zz}yD_%HzzX)#I|w;C#t34lHZ$sHlA!Nv*)**_iEcmk-v8o8Ke5QCC71ogD1d&7fi$ z7rx29h|gMEZ7%chh07~L2c*_l^MC!C-sliI8hQjS*c72xu(%i^;U#@2y69IWX8$+7 zQJ@Q+|HZ=W$Gv&wi!oj~0MB(jd+nk@1O1Z=Q_^Dh%mF%im*V6`L4eA^`tg^vWH|Au zCq-y`Vn}bkb?Jep2KBHnNG!4sq?6OvmE}Xl=; zmE`N+f=)peZpXF{wWN65shX$t=LeYpg^xITPeArcN}CrAL$Vv8Qv|Ng>{0q%{ax2B z2*-70_?iCN=>Fc~6`e0wZ|ZMHC+Ap@aJ{CpgF{QpySI@vu{2h_Kjp^WUh}h>+wbSN z(~*WWhmxW9M06TZ+||y>Ddt74!}fEbt`^{kebX7X^JLZWd6@=dD=S)=+MM{|Q=Ye~ z_q1I`)@$yI~w|-(B*ueNG!l3`B%^u!{}4 z5|Xm*GQHlR@xha{+cUkY5e@J3x7VkI>+f3T|)m;B^aAjrOsBh_P^ND&4rtMz)hO;4@EuPLS>?QLmJWpYL^K`b^ zA#VDxw2#K3X^M7I1>$oKy1OCg#*?=^teQ`<#~5d`5<6+GYT_1V*xZ;W;E^N{iV1@$ zAY#wgi9U+UYCLUaueR2uVbhV8;F`EWgD5>xL0=GIX7$GOB>o^9hFz!T=H>oBY%7gi znmLeE_GKqRPUXUq73+H&-|}6Vt3fdo=o_0W(O15#G>F`}8vnfFSX74sV^auK&oDCf zJw9hf$g!nKZn=6jC1Cjcri?18SUhHTUfr6wB}l)VO~5;pTq{*M4=24C9OZXn9({Vw zxwW3I z$hU1P5R8HP;L{Oq43aGaqsTMlt~J?T>uJ+5`ItUKzB%ot73oo|1NfZJO5U_`|9+yJ z)M{i}d^QzqjwgtgWosNip;)eXY-RM!$(V)&B8{sy<9R=r%KyfCeDG8*1Gg$LE&6z| zi>8_Sbh`5*T|D%RxL}aPv~KsSw)KUPIWV?;<@iUu{LL0CV?;NBDo`hz#J~%UrZhxr z*{eJas>{~w+|1}yTS^$Ni=#({glAgwPhmh3f*_9S7v-z>Gc&P*U*&rnbD%y!#r~CG zw@hqtfMw-K(_=tmC8^!+{fENf+_0TM+Ip*?e;cgXQExFjg1fyl)9|ZfA~x^hX)GgRF20t=ZVp$kcmAH6vjre2hO5mV5ExNeNHeE@P#0VTw|;bV&sj zDaD?S3hWHZDq?xlhyi?X-Pf7Tj_;xvFS*QrPYRddNNQKF=CdS!xuWLMw+&`lvq8=8 z_t>}6~yLEOCcEfE-p{1!)CTw;*teW%u&#@v> z^XKt0{lLAE$zMNDI>*=-sGmULs%)>7Qfr}A2$9+KhX&V1sa(;rhBt3YHaG)|Kg#Uw zlOxL4n-ep-g{myby~|i@9bEUiLIH~wr$&<*tX3tzjM!d@At=h?tY%NYoV&T zs=Ipis;;UqWko4OI6OEI5D-KeY4Pu0u;A-Rgn|0{?;4O^{sOqp5?aox_U6uRMvi76 zBBu7nW+XCpMiyq@&5TSv97fFeK|sLCt< z%p_bqj4YhY>>MogB&^IVTujUyOw61N%q+aj+`OzTB>(=AeYNIjYR>yzT=L&-eO(EV zSvordd6}5p+}s%5*cj~{Etpt%czBqYS(#W_8NM(WoIC)|M(zv%C-VPr5I1u&akK(D zTiF9h{^4k3Z13VMK=vi+|53pX_&;m`PXF$vuMT5!Hv%%TFf#w6(ti*Y6#n0+c6R@R z?d1I3?ElL9zcO}G^8lJLeK&KmcX2fN8aQ+Ef0_dFiaDAYIoms`+1uOxrx%qi?VatN zEbW0LVqzpT3PvVYfPb!O|3#pnz$*iAay9~(n8}C>kbSXWw6ZegWoKoT6qVp)6=z|S zU}2Hq65-?&;bCUx6lW9X<`Usx{|~LWy@`vR8Nm5Jw5I=;mhHdN{$mSvz^|6Y%^a;< z%}ga7?d?eZr8BS9f0u>%zw-Mxt?7T4h2_7}GJOfd^v}rt|3>;hx4z8hpVR-b+pmlN zv3xVYm$^HB+4W6eCjtlvPpyo&h?@J#nLczn=HI`cn<kX|{kU|@2(uFD37DJ`12d3miE`uiPZ#m&xem8j)CGy6@_%%f^OoUxG>ASl-j)Rpn3{-A9L)bEhKB zbJr{aADLKr4$%~3Zey1Ptyt2Vt2xZ-k0dTodn(W39Q-45*{Jo`Zy(|{2b5r4ok ztSB7thzR!-jSeZj84TOmAKpzH=Rts+Ht0y^QVlaFl2| zq#SlKC?$mYkz>_7d^8gPXduh0{l$;L`b(X zrjd=o;lzJn*O5q3KJDAdLks$7V`{i=xEnPu}Nit?}nGCKY7_-kjhJ9kuK*SHsfFv za>lY7*-Pm`R)RIhEb12odoq5{H9c*TK>t zQ5bn*AbI~X?%d#D;j`&ql?c1`*SRQ)Xg!N^`cP|tu&J1n*Kx#3b z1y4La_FdcdPld-&7dR{}KsuCQZQIH&95bpocX=gBxudVgO-yEjv6-c|aS&Ee`Q~iq zvo08O;Q?;D8#S4f)1ui2t_&a^DN+KbJVzPy2Df9l3X?eq)dAH}4ehjD7w;gAf4Ap( z&_!CS{gXo@&YJ{?i7o*SQEXD&o`y_vCJt*(m3>Sm44oe5(JB>ev!Z`n#k~B%PR znfy(wZ|hLG)+1$!Ek;>W${?T;^ETnA{cU#;#h!U?jH(X7I%p*2s8S})R(b9!sd&I4 zVvDU%@5jL*-IHq0QW@0oxOUh?-kcVu(1C$-Uyya^5cv;+OWTzt_QeX-$=C@e!*Xq%_@t68m}&299d+#lq2yb zsgQpS{EyhNRQ4_Ad{3kI%2kr4%9LMR`ufvq+@%-b^bYlbOC@Ac+d;g+$XtNFBclL^ zk$uhV@_LLY2D@Uc0~syeOTu@RTg1H0X+Il3Ctc)we+a&2)IZ;I)0SDRHOEC!ee^uG zHnwbx_0?=GL#HCgj0#mK66w7CF%Bab6_#->DXhTX=po=t6XT!Y1MkB5 z$ItS1Bflg05wpWND7ES*R<9&Au#A^MVl@EEQA5ixi^3hc3@OPfMSdW$XpyaL>mBc~ z84^^7xR17(gYMqq3?BR;?NdfSoTZvXoclmvS^(87Kh!eR5Ba?nYi4G4baW)_>B)Q2 z&tV>ZN()nhB&m8WWi2ST>B$+49bB)Dw91LhZRQ3xr+^qo!{M!$a|`mP1w~Z8`tRCr zzaEK}Cr2ktB%UjfdKYmPmlHKTrwNYc<6!)&?f~SS+(x+ZvavyreLSQQj)D)@ecr7E zC~yXUFLM-Wj%cv;QKavAOKbMa?w-X@6f+(4qgOIzVIhqa%=}_QlpUhnInwBhgV$N+ z!O&%XNu?`40PFsBQ|bQiNc<>W@8|Z{<8@QH7E_r|w$E^PG~ck+65$mmF`JT0K-5%4 zvxAe?j84mR;CxviU1Tq&qCwpVXA=vKk5wxF()!Af)oEGa;3#eh7}2ls*kDEToLJsn z{FMWEUA{k>JXMkdSM8d1qcBge2NS{0RMQ#goql92wNT`fDzW{*p^Ah^8iWBEFdTW? zQe#SS=D8M21o`fv$XV++R&A?Ksc5(o+#+y0L%;Xb)&LfXcuzw+K4fp-jOEkp2_>3? z5{yI`-ZhmHV6Ryv8nqSwik%P7;U~v<;X7epMk#Z5 zWymRi$1GmAiU%owb31H}crRo=hO_8n+f{D_vr+H1``dMw(MG#wb!USnkt#tS683C&z%$>dA?UvQ}WkBsV7U&nMCY?-q!lfq|p6IKQyCn1On$ zx%|r0>7$vveO8}sKKI*UlNzO|(CT&<5c+sqTuOqg%8{RxLX`rrPrfWSD90-D_0 z_h8l^@OcA%&_&xaU6h5{r6L5s-v%0_q(mPY{=}V|%m_ZKXWz_$M!@k+1EhvI4cHG6 zyQPnhN1K~A_bslG(z}045z)F5jW5zp>_`ceoZu9;e0A@29fjXQPkP_0n^I|LfYUVK zA?)yE6joJb`}mkwrJ<)kyK&v!;Z_o4fkt(h7K?B;(sRJIo=?VOxG7rlpo`k(y`gN{ zD?A;A`!e4jf0p4|zxAY~{oFR&U-EUCo8teYs4dyiM}>5$?^`7Jf^pgTNfgcR{4?pW z_4y#J<}J-$Sx=8_ZWnJ={`dxWjT|2n5>-4Xp)Q9rJgVXRD0JXYMkP7g&Ciqx!ovA; zsK@c%4REI!av?jw1cZs9xm{wPX_r)h1B4qWvI&ve?cm!Y&HtBEk= z7ot$T&%NF54}6G^YhJ`iXoKSBG-rHMPE!IQ&_Oe*Dk`Mji5v`6u5?p_E^)6$St85B z+4(RI=_>~iom#8mkD8oD*DqAIl@YKF-Qu3&LmL5g%vPo>gE7NmB8|-TfsA;g^kS(q zk*zx_&E^-}{J$>knz#JnulmuIw%Tte`>wY8Sghx1HXBg#i9SvPEK5rUf?gl}7}b1> zbL4!iEI9nyc9xx{Pp{Bo6RvDXI@>m(EC2@$LMz4&^7=aaYm+kd{hrbfJ{pfCDNbcbRq~&HCn2^z9jaRCC!+a-ixb$_v*1&PrKj547R0?ab}{ zB*Vd4v$5Z4X%Uud7~OEY7bW1olW;}NT=>v}F{3E5hXU0*8%U`{ir~K-#4%wBE4-Jm zf|~W;>2tHx72Iw%_nM&`Rp?Nvq<897J6zbA@cO`Gp5E5NFb4$%1+8WvX*%~*?C5>- z%gr}bH0pLUAk@l$MX#C|=SGJ|?6R_+Sn!Qrx>R>hEBnZohbjI#=-Fy5t+Jn93iJ3D zPvmPwhzrdi+MjqrMYLWa%$q;Oe~v(}(<*-PI4j3QiWUa*8}z;cDjG*Su;axdPu4ev zJNsS`$aNd~p@6-!hSA!Ci(J)TIVaRt?t%X&D@RT&bTzI&naCd(Q^TiE$Mk-Qki(|4 z9}o~eW6_Pm&d&a$#~+gW{ci61t!`@cRErVhxy>*uV!)80PmElSg*70L6tqN+7p(^s zsIif6y;l6|yOOPwd(E5LG_7iY>Waglsat4V?tUO{2MddyVQx~7iFQSrNjE4D)JLZh zB;6vQds%g|SC#1lTrQDOB6BO2rH8W5h%n?_$M>Ol+hoCDvVdbaNZV+wrW(#J0`F>S zoS>avn8(MA9FA4AlXgo!!Z&Dky5`)5eGwoW6KQ_N;%NVjA9kJrjXb#MFW1$0MVRg~ zTjFlN9n$Qxx$&f46BebyTIb9aGwVUyez}(P(^fz20-lbU=M{|>eMSaWS(drkPqK1c zUaiTYb|z(rr(kTj8hQrJ&a~SW72I3T&#wuo+*hLmwu|SJtUp&}gmx8@#tS3gWV5Hm z(vqz`%+$I9{^IW<3A8&A<$hsE5DS^}T=O=bPQA1c<-5g-lkXh@#R60BQy-E9cPyhi zlq?1<18vWUl#=NCNrL;a??!Vr!O~I=P^j=5Qzke+!^l$3R3M`Cxh-!lh1AjM?vFDxtNRbIzH$7&=+AdCivl2YqS{VELZJ!5tZO1@A}_Ve&r!aT(@ z!TFvXOl9PfW)5b@qKd=pzz*M6r2l3IBSuNEGb}TwywZr<78PN9*Brp|Il!aU;mIL8 zHcD~_6^IBv;Q;@JclLUv{kIT*3{_?`wf@gfr(Aet%ykr z9J7|AC=kQQfJ((tgjT`)xE{wKr?mM8Gx^K@)^5T?vY-W`hDIZqb@5B;z04rWGyT|& z=+U1dqdi|Rgp0V4=T%OVHGr$(v>0>=eW!Ob|Oy$@mD}lr+4Nt`owdK%H#3XAcZ2>ke4CF={9Wg4b*kh=vqR zWNR=Ar`e(LACz^Mdm9y%%os~uHoR1wz-BDH$_K7vy-%Lo#x5 zF#^8m@pAejh2}w*ydZ1XfJ8Vw8ZcT+F9>^-$BEd$jX&FjK@EZYwKP&_w4w7@PLuVrj;f zhs}b5g0H0`={fpNX7ZtKk{2CcWAVqGL7&6W8DEXZEtQ(OorH@^!}xaoRBJ2mF<9=@ zirp&78CiXU6l%l(v;7AD-PemX9s_%)LDJ!uLrj|m%RHsLc#vQI^4ew_@gX2e5y`>O zxGHzWvh%FeSJgG9`@n#=OEqgqB~Re6xn}~J!|^>wb|w^CkJnB zV?+6+A^Pb0{OOyUKi8=DDW*J0!x>{D-+c>EwW*N?hBr%m*2Ku;y<$2A*Nw zu@tr3c^Q4DqDs~R%LJ=$FX5TP^2Act;;HJcRTg-CXA=aAYH;v8fUV|rxayw@7^hse zy??0FeF;*L9dyWEOz(aUyK$rSbsHmZr7R2MiBn-)#y<9@D*WzTJN8@sQt?4}MV7U6ug>q}WN_QomAp zC9w"rmESKWFkXajPf$0{E>Vf^#%1DgA>{T5}{yyzBkI z7FUwffmoF8(TMW-jrlQ!`s$;W>gUyb+!B)y?T7pNeJEVFprHwg*b5)WV#hAX%n0aJ zA(WG@qkG(OIZB23#H;ID$CtYdn*acn55XKbT_VVZP~?8_5_nzp(6_T+Rt?N4-=V*sm5HO05l}DKFVoyUGKn5qw4WMcphoHk zygSZRnwhw$f-ZR9u|^BpGVR6R_a{ZM@Hl-pakW%oIhc23D7`+!WmCL2oT5{L#LZ+i z8mugrmp05lG2qhY3T5LOh@aD!N!qLR)b^GKjz^-%-a>?)>^}W8ftNgsk60rBe?^)Y zddDX6m-zHVeI@1xtqUS*aomLx4^k|-NwT}YZ$9kwVzKKLHZ5XvR=%<0jyxFDxKpU= z4WrKV)wORUbm+VCK9TDG=4wbPNX+;_t=x9ySnRQ}a8|}6B5cl-pu#ohG8-G_6Ic(9{$fQLw zMx2E3=7?fYcw7Gc|P9w(ts=PqO9k_*nuOpYoH!f+W0X$#{wAn- z@6D!W>SJo_X(W!tG)bRcWnDSuZ`s0+kyuP=cKg0P7QXE@Sg&jn=+K6R9^1`8fyXs) zIfExIRyHV-4V{>UXdFqiW39E(YtM@24>ZJ`vh183rxX|;8Cx+XsfwZ{^sv_t^b~y zeQ{Y2vmN;)@8i$4=c2Ofo>hCXIhP(gp5TY!{z&qdtx%ObWdjsRU4FRHO=7tzDR+r0>b_3_qg{(FpBW;c56Vf>CArd={i?7#dN%?#2cc3veAr#ee-`yc=x5 zsT;x&XB(|4uOMg=d?sVh12-J#w=eXouQng*PT@KSUwi!S$yB7uBmQ>|?C^QY+)r*y zm)3DV-uMB#)9v8ElGW~P5ABCR9y714dq|-CrW$eI&Zx$j5IwP5do3z{qsom0!Kuwk zO$ldsV>0R7#1YJLeDk+zBJ3CakeuD}fYCpgM*b$LnH)AI;xVS#R=0Erb6mUiC5O8k ztCeEh3}gtTh`J{_)z(hv21Q=kJ5W2ko?+N|Ss)fNk_43G2P9&}FkP(x&=b5g6$(=? zdMt@nt;P8jKbauXGV>PaWPF(mrfjEerYd(K3wjwLWZ`ARo!8e*XCab=l6?QNMi}oK z;T)-pSkUtGtzlLZX$tlhF{{d8rUmw`i7M+r)P9PqP;!-CiD;0F1P7wnA=!R(>CkHi zhVkxBa3=^0%t57GaCxou@#8Ua?UXHiyi@ zW6XGkdRLnW=EBr{XXx9B5asXRNhCbYJ#kj8PnnIMfVOrK#*6Ow4C{MI)N`c=J?0M#MZx!>!R0~0vH8)R~UG`vs87kv5!n}FYm-1pDnp%Sn zEH9`Tc}3HgvW|f`6L6&Dxv=XhalX#ZY5_l4ph+e#n%;5;e;TZOUoJ@3ZZLKlvRed$%;dy*~{Etls zlN!J~RQe)01-u@QlS}zDooXpKpVM|mIq6W1;$r2haaS2H5h#sMt)h%f?Km!k;h&!h zCFx~tNKPR`-&y>vK?~XBa3u@b=5K$`gXaV?JR?`c4xRN@hz`w(;ttc`QPDrh%T1}j zu!?8|%fVdWi0F7i{gSRCqwZ8%6xS9@WlsHYKj%pPe0W{@7PlK{OxOUMhAs!NbVl9f z+(zap9WYca!uTPJslc)RKtx}{7sw^i8{zC;Fk@V}N1D7mbi!y9EGi`1;ur}(nxjYU zJo(}}x@U#mx;w;dJOM^+fQ4*l0~0{QR|RwLg1A)ui=j6sRR1dcbLv)k0fo|fymJ?c z-k=sjuImNN?J}0h24~nc=e)_*e&KH?2k6o$!@BCqD?&q)^>W=?o93s0pjFr%m{ zwtio@AFPWoPxh#kjB(De$vj5rJ|0eNg8J+JA_7i1A<5~IMk@p5y}iHjn#WMu8&Y>0 zQ@CVXnPDE-Sn5w#}NeMcc&**D9JWn){Q-Akk%2 zODFIDGUzYHHw3P6@qKj>?^FWxMFWTfuf4~>S%*~-fpvPa_|^h9a8nUMGoD2)1y5dp zz8r844H{QF=;BZr-N>2ly7{#Rnx>_fiQW6t-OLT3iTnaUDEZ9$(;iL;OVw4M%=KUQ zMe#!qZ)Y(xhj@x%CdovF0f0ZAEK&*1df%3SiUZu`6irGDOJ~r0&WOG&o)s5fn-f@Bpo%A|n#JI`C z9lQ`GDjfDKLIPa?3aWqEW5&?33k-@vrh5h&?FhQOEHR-Tl?=3Eg|aK64rBk}p5u=NEA|86o4!JBw(CyQRs zijORouFh>BJ{puKDNitPB)l%XAp%qWLJg#;p?$fy>q^JY7V6%PAEPMBq5#D%oe6-Q zDfpb}63%||idY}qwa4lU#8-?S=2#Tt^K^{&8rI4d1=tHF4H*Fp-0OJK)5c-paOnA=pz}UWkg@*hDU( z;2N&`Fk&~ntfxBTbvrYJNUXjAmza1BJ77-1*0PCA4Nnfh?aPSnk<&av&=jW{Gi!lU z;QKuV50%h|+L$urJEqykPEMvSMGG}oevfE(WeliA0xN$#s#aqSCcHgv*b}%R$?PFb zIgT-`L-0$K>|`Tf>QG+r{xd3skrFPn;1Mi@MY55tiZ6e8-JD~<&|6O zC>GuGp}#TJ+LYLv-kjc@kfAq}=e{4E^6>0$8FpsMs}crPXI~3;Rt&YFmhTwU9;`54 zvF#zN`b5P|Wqrs+sehH~>KeAr$y)WANtQ@*4Ss*qEZ@fWlY0t>^Q@x0*6{WfKFL^` z#c48Mc8UNaol9nb?uvh#!J02T63rlCmhE6p2oYUVnIgqi)#9eG0e$cv$^y$siSsr2 zv1ZZ;ZUvw`jN&jpo+-mvbNU&iX+Z(006C#q-lOPP*GHI4oKp9(YGL#5r&Dm`AEP{n zTW*URQ9l>_;9vIgIL)8Dqkt>v?#s#skR~*!gzndX8>7}2s@q7x{J@Mjvf$|1kX3Zu zO!Smju zGZu6UZ_7!c>Z<@ZhucszwIkSiJUxeZE$fgXF2{lO{eicR!yO7Ro664PJ^j?rIXOJv zn;~7^%Kc#sq#TzVd(x7+q?LYw7A7*Wvg+=-eyT^L>HVLl+DzplSs&oP8Osl-=DN?> z?0fjCy220}P4HzcU|!mo`JnBq^h1vQ(`MuKmIm^V)Pk#LonG$y3SX$|)$DqqnFOMR z4A@lD=fc-8u(5Yr4l{dFyl)*Oam8HZGb(>Hd;6v@{QAI?ZMDyMk$=mCD@sf4@-_q+ zz39$2z5*H+F;vA>4B&Fl?`alkkT=2k^x3=tf+$@;7wlNj(cydpZps@KLzI$3c|nV< zER@9ldMRzaum$htF}N(PtOO$rb(r9zT5U7arQu&MCn~_q&`VvYGwq*ONaJ^KZRoau zJ#TYwG<$<}dhdgh_D+dMD1%35u*+Ct9m6bV$LiF`gUDP^9LzH=CSZ>#uNka;RMIjP zVjqJ(x;-NbFK2W+uR41OR0&)cyilZ6fh3k{dJLRajN=8Uju{8Xq~c=P+Vw2ec;%J5 zF%kUS>Vc_x<}yfip`nVo2!jG`N49As)%8_ofIdo}G8C2tkq*63mc)9h*1wuJQ5w}r z0-rs(zAkg~{|d}~{Jy5Cq#0_idEJ_EiPD-MA8-+#6ui3#dmhCv?Z93iR8XviY@cjV z3=_5wO}N1Nau!vqoT+x%nvB}>R6PeO_-hW_!n7JflB=9E3$SP32$wlr!KKLJshp^g z`CM5$4LZT_(FUFlrB<1n?Xdr1yY(a58 zRQ9}54Xbso07lQ~eHu_l5dry3J^He-al3ytY3nhjvUeWbb9=Y7!rkc|D&Evg=Ufhg z+a@i|!TmD>IHe+$S5hM*X*ljmdf?=kodES3O1!(7V-2w(C+HL^rznCl6uM~_qi^=Cm~LtPU-pq47quQgU0nt; z!fkZKj!)It&pk>m-#BG+F1>ZUi8$aTr*k!Hp{}L9?we=$flVZE_9K#xUffHx7?d5d zsRosv!C%^dNGC=JNwe#X70~$rb$9d^{BOi&@7eAvNmn%&)mjY(j}FW=w^%~=6=Oa8t+%Ht(;;8E1rtW36inNno0d?T565=(57kJ%&_N5C6 z!EzV!Xpmwtd|x3)7syz+-1RV~X3ov25{vhZ0S;TWvTM|mw={2bmrKgDcFUbbFXP!J z2KHf;E~y0O?_bkBE^mB4Zt0$>pz)lWIt$92;!1lv6dS*$)*N*{o`CY$`m>n*i8$S) z`VX%eqM^mZ&|e+|=1TenG8U}Rae3wJk=R0Ok>Tm=dLFjOY8XK*`G=M6b|V_?Py1Bu zHw)Gj#TL1Prdesu3(+dxa1Q6s(AkC#yf?SLnFV-^zuXZMH5PKSDI!~G-t@I>WBiNI zU&in~4IrM>Fd8tjb#W3)*a-e!nCOghPpOLk)OD)eE_?Ywp+NpOM-lqU6TNfoQGW4Cr@^mf5rj*qk%-u5E*!T=nXJgDtL1Q)%-Zwn3UxKnl@9wr{Rd7Qgg`^0vd- zU^Xl#^l@+8iH*`aqX>s)+v-vVeW2MUqtq@zLAUDrVW}nD)mww>yyuSMeXTiYs*(Td zI;;Qo?4sE4IQ#XY?n=#dnmqrzD7k^od}vq4#P5uPyaLidf6;6atxE?iDc43nd57{a za$Ln$Khh>CzUVIQNH?LG>+w$Es%ol80`sCdp7Y#}a4bcl;=jtiGA_M_mLReiV-9{S zh64ywRsd|dEx(*wHdcA+nMEl4rYI;%vxzzEiF|g>hV0G?6NkBpiM<~i55{#2VBB4_ z&}d!`Mha3_U%NS6hV#L4j26vQs3JBBFmWHhyL~|!nvcq9N_BA4qzR?ms%@OY;b4c~!+nBiDpEEDmBW+uPp4mKDEU|&3{f=!D z;}DMrgOgXHs|0bcLvv{pk37ERcGq8Q-#ARfyubmbI{JJ~xhaoIX&}H!+9x_EZ_Vqk zZO>mTH2D&?eA1Rxe>kn7KgaQCYx6xd7Fbs|G{F-0-9nu3D*Q}=m<_zbK@6+D9Pe)}a3zdHztb?YBheR|Qv%j`6j432rkb$MtJz#O$b0Hl`Q5aH_Rfr(8@a7LuBD$+nq%)g>eHd#;t89r! z(tF$Mj{i2(AKV9pJ_J{(nV>A=A$pC8h9(~F?W@zB)+jSMK};E*XP4$b`T2SfCW zD{=)dTOT+T;%c&_k0Y62x8R3+=IRdEhM03%^D+`{;BU+g=dL8?IzVhYGdGagXw2T`hF&P&jwIsE(vKE|{uF zN}dr)@mqtrHfMyGZ8WdTf;zJAh2)Q9V_Yw&q*Pl}|1MdkEe=t2-iO}HxwD_|r9P^k z8y1+pj$XOEie?B>^v`-Eg}HgS;YeW=Ge-)XHt|+Z_&KVx!ZU>%%&?m(V3PZ!f zrVB@89}()x(C2(dcSc`<-C=kJQPiALCRNDjQH}&Pp2Cv~U=#%`P9nQ@lv_fF33vnx zcKN~`qJ?`bgDpVHvfYF)eOiX~`a}cFx}l-_<-$B879l7UCodGxib=dj(wrWx+bKb* zJ50M|pMs}oOnK(7#tA+D_ENm-6(oyRp z9n^@p)playOCGiqjdp6p#yUD@vj3@or|xq5bur1{sFWwJnLO65j$|3}qmUhRKM^uR zjlN$1S?)oj_>uelE2Vx|}9)1&R9EsbIbVh?et)%QDO1kWpenPGy(+3j2 zDl^aX(7YSnx9+x?fp(ASHlOr*T$DBVe3%t8J39*!zkV%jwLG(VMVL`spJR3Ll)(DE zNK~?$v<))8L|BJe4fLOSf^3lZFSzCx%Il_b2q|U-rR3Ap(BN{cL)MY->(y|6X^AGH zgeq?CSY)9_?T-5-Mr?5hB_mB|cZPT6!KbAq{q*HCSM$?YL}mUOUG4^Zw*-#)a8Vf7s3AmtraQ$O1RR z_n|=7gKLrQm%?UYyy^XzaEisKXDJ}B@G7#n^%FZC)&F(-W{hcwGD(kY(dTYPO3>S7 zARO~X=cx6F_s9!m^pjfr2T1^hfPlW^M2yhK(z`;aeoJ)okuNCt+WqcO%uq6m3A5?& z?<{9UR#yTtU$n>al9E4zv10v%$7>MotQVh7kXvsd`Q}iT=~& z^KxADwb@K7t`~;&S0MjGGM)7+^GmfzG2w;EZ=Uo7iPQN=88&>3u?@lJ<2I|HncDl$ zotRY8TaCEha?az1*OUNu2Sjvco9PHzNn57(!}5(@*3X-;n79wJlwl^qNYlOX6gFt4 z&ZpeBjg=L;o_t3Ru%(p-8y3rHlDo@IVoXd-t#TR|t7lY3ZMz zACFy+VRyu$&VZd?_MOj#^Vm(c%VeKayk9n{_dD*7*pBDZ)%KFtWd~`wPq|(TT0=tv zT03ZwywSJx^z}XP{GiBC)4bhP`>uo^l<>(QJismC7Gww7kilreh^Eb7_+L@;=(S*a z=h{}8a==Rcu@t^RJ{`SIJ&fCi2X&^`1<$cGwXaed=frxn8qBN{>>b6zaVyO4GR-Qa zem6RFzw^5}r6Fv?pQPB1YUm(pa?3U4$oyBrwBJYENy)IIWKARazbyRwRNM6+zKVeX zW7D&s#p|P>vjf2KTsitE09lYmL{Yfosu$k-r7BM-nn*zB7w@9P42NT)6lprui9osWcm%g&KtPjuKM=f{yshDtfh%R0ou-~c*y;t z?}ki)ad0AwB5Qvt$7*`5yt7pcxl3v+IiSv)y`+D}Ifx-SN^O#x1UM_8?dI?DXj}=t zp6&8($;pP(xOnwr0j?t6nR-M>FPO#<)MABu`54xu-@Dh*w*#0l#3HQ{5^Vlxk)C<#qQ zSmX)1(cLp#6vd0m^5LPY_kzi)XKKQ1;#4!=;`&>{#^RO=cc;fB7V8~$C1ICT@+2X5 zUX!HrEzpX{Rb&OFbT-^~5zksrE58#{{#I_%24nEs`KxJ|u!_$7WuBkICU@tnn!jdU zqd7i%poyg&KF8%csuqB_XbhK@{=swieVzlA{XjvnNA536);{(2pe&td9%`|ckVNj;>T z`yP6m={QRJeO@&fc_zgo^LTJ4uF9{O&WsTC4-7Rhb~8RSTIvMMPE5~fsoF@8{Hr7l z4i%S%f=Fgcwa16o0`n;Q47JVeM+$*vp1P3 zpi53b(!*u9BsZ-%Wt7UZ0WT?1gKe1LV@3r5UjStk5Z=_ z9*2Y_mr?j!lNKrH#g`4MPKgh|n27zw1;N?qq) zDXAB7;w?$_$oiV<>IwWv$4Nm!K^L8S%0g-8z zD|`0cSk|;*9cpBM_nfMnEU=_$SCoCW73Vxj!z?Qws@&^LLGKH(4V0N!<-H3nmdKQ=M-9Pf4?kgraz*=nwz@ E56biGGXMYp literal 0 HcmV?d00001 diff --git a/images/square-logos/kinvolk.png b/images/square-logos/kinvolk.png new file mode 100644 index 0000000000000000000000000000000000000000..25ff91bc757c9a2e0b5f915293cce672b0f0b371 GIT binary patch literal 10572 zcmbt)1yEegw(j7r2^KVi1{++406_+VI|SE3g1Zh*&;)l41W9mrcMt9!Ah^3da?bhx zdv3jRU)8NQRWp0{s`ah@x_j;3tEawDMR`dq^jGKr002wsy}0u8HTU_OfQtP5+uHqp z?)gIE1o_~kVr%N;YUlt3h?v+KL8+vy4b7m+P(u@U`+n$K004p7LiK~w2RT`=v8^?$ z;U6DXH*33RGyw2c*v-z+*b?eQWdt>|un`0vHMRn&EKCG}8r*Vha&}@+bBp&L4p0>j zc~xT%OJjZ$ps*0tTQ~4?0Bfj|A(fl8m5n3VO%V8xxZvmeKV}e+>K`snmV&^4lKLR0 zNF`?L0Hxw)q=VGJc2L^#$U0qpSIazHT%s}k?{QMv`4iEuv@{l8tUt^f9RbW(=?7vKLF*iqHp4hm9+I@&rr7(XwZDfOSO?7(6UP(vqM2US~J ztG{MZ(cIR_*3sP7j!I07ib2lM*uv&d`^`T9a&llP8%HNY8)K-HxFGO31gnLG37Ct6 zLqZh74H0MOgs`(ictv=4MEKd*c*Hry`FKURx&Fe6+ZsDtLv5V?!kYXSR^ore{>cSv zyXT(8p$--Iw`F$M}w>Y&1A^Z-#!Y7O{nL#Cto4d%8xuKkkhaSFrj-U6OPb|XoK}^&;>WS9 z$!th~ayW7>;U5zhL$&$;U=sNb`QwEp{r?4K`MZn1dmUY%9So9cVZWZU53*SnzU&`&AIh8(GZb2Gq?gC7GE=VY#f zkwdcjs02H;9z8`YEGt6u=IO>zaknV?3AuBpI`*yc*3yCEFn96{?vS==k?e{xX;lK% zkX4>`po?nSG1ldaWjG-q8&GkyF5yX4wiPjizkeIz?(&_=m*sJ}W8au?JBCBNFo|vK zyFSsF;tVc|3-jkg0u?0{y(JblX0~1vE*>K2%dn^dHbZNxgoxcL0m#C&3vg>!9!T|8 zkyuWm8D7hqpMjKd4`S~T&8F4VRo}dm&0Hw%L_Di`9dsj;**c0*6x4;tr$o_f+_7+}zwiDynyg$jFbKtEvVjr1v%)$>I=5kQFrthjL(W zFa{+h<>#0umdpwY1Ljd?ym%tUz@^>KetGR(C)lLXr z0rx)>bot2TNf>UBZ_$ItUWOZR&YoXcN9%VvDx3)}`^z>L4fKf6sGEg5N5NML# zD!#k7muqDA_Wsx1J}E)uhOMT8v2jj8NlC(k)l5k`11oC+VbDQkD@)KOpPu&*cZ1gN zt3^)^$6?^fZuTdtvTni4&oE`j;x0#4!R@p&DTrC-e3b?Dz`%fs;Op0~g?~J8s7xnJ zg>m?oudYMcV(MoBC~Z{T>SoPgi;WDVn;rMFu#X_r@OEI4eBtrg>5B&x9Qofu4ck3| zY65y-4JSIg#aSus2JD?0+tFQe1rtIO#AHl5``w}bOS6elX6qRqkFl&bVu_KVnPtFl z*5)^~)oiFzQAve8w-QPVI!t7&!DQ$0{%rCg@JdkV=4R-6SB=e*R>JFozKZttb|4qm zImd*#eD>KoP8SplBg4Z4W+Q2My^)ke?Ck7DJrN{E z6M1qK83jm(kF>i#_`7_|Y4A zHMMxvlEbA&na%aPFy;b2RrSlnD-{(LX!<^Vka}KL*1MYC$70<^bxaZt@u5^+1sWQf zzPmK0Wy^({gGhi)LlVNT`F&uvqov_72YM)iZyUoOe9di=km2bk1kfz&toTxQgWTBC0!Y8^^7|Eb@!Z|d3y^`VG=*q(aQ*tPY!s69Uhh6ZXh3khMPy=i3;jqDyBB;OVG@;WzxtPHO zSw6uCTaP)Xt+48%f}~B{UW6|iy^nbm=_?PDz8Xu*&~i3eb@D+4nO_^kU;z=ADBAiM z#=)xTd%(y8P4xYEMc6aET1;aRQz3=Tdd`e_HJRX#wo_!n+Z@6#ZF)dFFSW) z9@e@HqC`@8ZS_K=*j)Ce4=e%a3@G0|sOU=HO?7?uL?oe)3eO+-0a1p+Ih20;_U*2% zY^~slkJy#kZ+g6_LYR3}N+YZtZ42hDAyob`6F}GbW|fGLP&F5a^(9HZy9u3!M) z?MrB8hIE%lzt+d54C_-}RyN@|*C}2ooT~86cO7c~=!-&^siratM)(CNzc-`e4|g?R zWjgI)_B~Y_)J*pgtQ9CMO(21`jz2#QMTmq!ULu0NsmP6I;vbtxh+a_gobE zg;Kbyx8qtmKwbLkE({$ZkfyAYQ zNX~Y`3tK)`@M!(8iYLbOU9)-_JWb2;owew+ob!$T4ArZ`SAmrz^S`0TT-+|)c1}&A zaN(nTfZQpc(GL8Gj4TrsgG?~5+i9HWPf9h`HsM!0Or|F3PZ2@)8ZV)tvd6pLWU>IR zpnUWmHU}QkAz+*EPc037GybTCTE})>_tcU`*B<4kvbK&Kefm*(IYFM;-KtQ4Z|&S1 zO#~099C|Qw2IP?(Y5d_@OR(t<#iDm1*S2d|{}xhJh1c5PvYSz4oD3tC-VG>ZEEIQ^ zQnPZ)4~fMhxafd3{QBv^NDJNpPQ?M@$q;6Rn4}lSvY9r@!ar*KOX52Gn|zpPp98!T=oN?OhpAJFq!d(|sk>>ID7!|S@0P}eS)f%64ZNJ(Es_-O%3dL*kLOipQl{?fFK zX%^IXlbY`%z+@vD`8iiJw}W@`DXVtO6F-^zNPOhywY}g<7HH2(l;!}-#l||C#5YsM zW1_ap_nyaQ@!C#FNr?$iMbfgZV!$`^T_u0(wg2JbSFzwTgYihU^WlD^LKk@%nbcnJ z@x5`vnz;LQ__DtD&1NyB*Ks@dir1OkOTt`|Bd9_;_@Z#FGuU<`(BbvsK4XK+^ZUbU zmhEuCwly7Y>k#$$Rzpoqx9fqkyu6&LoY-C1YS%6rybzW*tz^z@NWBYypXQ2AiSVV|oxtV+Vxz!T9oUN#N5! z;RlQ{XY_ZmLQcPbIwF!*Vgt@q7b$(WtCJ>j0cqjrJ*Rew64{X(V=Lo@r7gGC@h-+b zichM(Zh*K=gM9h)8vIqS8lR`fh38U%2Nm|YhZr7LRvoSl$=tCs1dke@FVTkS`l0LF z(fhmhcuy{EGTl@%SF_nt-B_4py&lD*tcCZ-jLrLYS^mCn1dT^2Tf!sGDnGeq?voaD z8<%fw#I2>$`O0?+W*;tH#uVqMu<(=)wR?}rL~&x7YWej_scxiFGv z)@@K_)@!=4t4sz%~DD$lhD*&lZ^Ar|M+eXw^sWk2V>vl zVYjfEUugxEJ_n(&)PEzD+9Ndib)xzrTVaV)G)Cad594 zg;Gc2(#V_OUECYe2+)}{6i#o3+;#DUwr6A5`{AP02c{}0rpS}PiociD7zkFL5|I2t z7WzvtFEfegaJgAP?u%u+KT>H$b6niZvoga@?0Z$porLD|aTy1pIo1sX=j0;w#{5k} zZwZi6iY~{GWj)XS$!d%x=t=bli!GTEg7EeIb%s3ekNez4?~m|;QC7IT^o4xYRdiSe z6Vq5;F1Ifm&89_1S4q+IBpHGa4mfhZ!OlY74kU!)sG$d_Oy@ioCVi(95M%{dp=v54plg=$w4Kyu7f7-^?XG000e! ztT|s9Dh=896@RC;8`%1NegYt!b|eM+UEnX~@gfoyBo35!oZ~=Rd6dVpm`@Y|B+Z}6 z_)lMqwC_$8X2Qu}uQl^KZtcUB7Yz;$7E1b1vt2?IEBf*?y>H>-p2*Ik#0~U#R!WYj zf68Fka)dQaF8VoNg4_E9Tt3upOn)*}N>QR&@43X~mmFDHwVOj4Dn+$iVO%q^sV`gD z?`Vy0^;!|=lblT{VjJ_W`CXU9dDCBiLX&g7eXfBvj4@hwD}Sfzye4(VRO}o^M$9=y>%_3#Gr5crlQ&VnRofR zJsT44J!rxW12f`kh7`%-mV=5YH_}E=HFTZT2$m^7HKZ#7{Av(i{z`u>_G!}agr$t^ zOo=YKO~PmY1-*QlB<;J_UtUp54bFRXda#SBs|1j~HxcR+U0glUMkxue%_4RcC)#Q< zDqFKG1Zfrpw@*6DZ36|9xGcH^rOlP)NF>^kjn~5J>^U7b+;JZIMRbkTOLY2g@GH$m z331*Yw_WNrd(eulHLZHf^=Q%9FDA18CS9eT+$8!%FKY@CgLvN%9~w$t*AkYCZRl;U z=}K0LkuA8no!3{LyXog-X0^_meQdoT6s|nR!Ff4lFtDMY&-O7YyPt)^10*nH!$GBcXQ=e%$p9l42Ht1WDRWUE0KJ3-|a-g?_V_GeB#QossEnE8oSi# z#d+oSn!EJwrfR6<^%gF3*<7{l)Zv2laE*MoW>C%unJ{+S494|yv4#_a7%5fan*)VUnwrw-*Faiu@{$yj5 zS`NGVitdBN2VfzGaf`ZVAe}*gQ6We_W!6@fF*8pw*cN@C4`b1lro&(yfVyFOSb5U$ zbq3tD$61PHiIl1UGr%vhF%#LJfKFAS){bCu+A>{hIlZdY|Zu><_pc^)Ai1CF!`5bI_;cQysFzsz-LPMh2W}@X;N}+!%-+KB8uvsX z04zR{;-0Wo2E65=VW`3;GH_98`}CkxLmdzQ=;=ABj}n^>H!T-nONvGt9whowRM3Bf5Xw%`jxj${=hHN-J|GiyHHl@^_ZUFj4JO9GfUG?njOjb4natP z3r6c;8p*22w=|d?PUdHiNY%qrr*=K33kk&}4}11GFnE~CXSx73?IFFr%-i)jtV|d? z?RaDHDz?0;xs%HZ8p1U16t~27#t4O`vLdsf8HK&&CZ%EO#r>l8LKh@-ew{HH{S=)S z|;>ary~5r`4U&avP3ZFg9`xM@({^ZV1OX*H_S8ySajKbi}!Z8g`s1 zvG+XEq#+XN^=sUDv?!u1Z2A_;EM?sD*1M&nt&SNFJi0opj0^aMK==ZU*ThL!pDwg& ztmZP;A}_4hQfAeDuDQ_Cpssar9SadI_q%t(5ZbuIuPD5)*ED>d?p8n&zOVfP7}BHf zC!Tkt!|;##sW7ATvX?7(af;V)WztACPj*aqfF}>icl;FSTmVPiAu~J48sjh4RXW1X z$QOxP>=X4}=STYR44v7X`yp|I?p{UcbRO4zW16)sFxS$sw9~xBoNY+rSB=oIR`SHl zu4W*d4xgS<=`U{4Vz;-BuD=cLil52Uyu-V+^u{v7AN5 zdewx(erJeK) zK#nk%c8Y~>QaF#M9NAD5`8&MYC6`p+71e%EfQvA*C_rQgVwwe4V}WwEI1E!~3x~r+ zAYdNRTSl;qK;p9z*QA7xDuTRN%9A72Kc~f&rPfS*Bz!PHHr4UE)jXuu_H(l_6vxKp zNTIz85@R<}L|C0Jms6;LE5sJdG_rWzw@8LEzlXM!7|aWIE#_pMB`)vV(gPcbdsB>B zBV`wRU=I>a_B`(#dY?Isa6o=Io-6almmCF30fCT$oy_rjKOG4iHxaV7uTB+e;Fzr> z>1M^;#~^UD{-)`RFHzX`IiEw!G%O*3i`8)q$g2-i#y~!OoC}-)LSYqrHEVXkp43}w zbIv7u52ewWO*W`W`wiSCJj2=y)$UNBHE$$o)aViMp9f(wc>9=^@ zoH0saOuzA;n}_R#^*$H3tuxKN2k-&)iVAh$BtMr=g|1~u-GE(>I%E*l{9**8weM~p zB`JsUPJ&LniX8c=P@*{)Y>8)RW@N}YCQo-?gv@pm`&`vVy`kcGL4fiQi^mAlMU)9w z3Vva&p5=W*0f;Z;!E|f4c7I3C_o>iMV#&CzSeB>S(*n;uE=$jfFd31BwRP061&tH#l_deGEpY-uCcvn#T4hfMx+tngEPcF4a zK`@mAIso@2cp%vKeFg9RPnxUBx7Dn&eoOA#>5D_C9oOdQy0yz5drU`7XW0Flr?d(g zPk?X4O_cXTsmo0ld5cy1g;x~Iu=q~s3!ju5<&Kyt-uarNmGYWf(fIe8iEr}@zA9b= zsTv;h=Jb0b58NZ@c-;@$XCE4`mWRZehvkNeM&Y6)Kmqrm)~7!nYFp3pp{}(YwJ~FN z)T1nV)0Q7sK%|zhf_%zWayiqSu{sPmb$C?L-13wccPN7ApSssGp6j41M2WEa`g$RQ zzVu^134hon-1}BZr`dx}9N{z!%KYKyoLg}F!p_6PgX7mNcI+7?o8 zf}bLD>+OVOUb2HT;YA(OOz2JeJxG;U`gknUIX{IJ;AA_L%(*R>m-<$oI~qD@n9{k1 zBX88xO`WKH)hqmX@*0uGVmAT^xO?mS3qx@!)YUD8|Ho!I7+}ZkwXMUL3I-s=Hko#Z z5!9CJ)&aHa(%;j4L!;!gTb%(EL^R|-|3_Ru|Geqg9Vq56J*&aFZ?qPR)&xbi2YW_o2Qvl{fdJ%76mLzbn};u z%PW_%<<;-+FMB*A7aP_OcTV3S0XVM{@H!kSa~FE|mXCbABnOPeY)Q)Bx;W`5o$PdE z3=-boAkZxp?#CP5{+dI3k(pM}Hg7<1Y1(+azNUR$&bD1QDAVjlAfA!GDV<{ql9GcP)7N#D{O#Tq@^kaIf-UG^kTYij&`8v1To_kBU*npp@wgeHB;9yZ!DR-)~=5iip&jW4qnQ z`fz(8qtVK~E?W77$lx=Y?LEG_QwVo00@!ztut1YzjomoD`4--`ga_C}dBeSo@Y{0C z1-y54zk@I#<%Bh9Yd;zJ8}%di)qq1e=uky$h~b;#2)}oNQhwwjW^#UyCyA9?&sF~y zH&DQXBK?(M@^~ND&v;ge^>Y+YxueFdj9y9|E$dQ3*@9BlOrCK>52wt4M>h>3``l@hTX;)S7 zZn!~>700@djN+EY=e$GrwNQTMV9TSb@YF0SRf1vj51Y%%%_FzT^0(Zrj4b)yI|W-h z=}lz`Y zm;+JS*Xu@7?#J`_LhcO}W#e6$gX3EcPq$vu3B~K8?x_r!mq2>q!s00lYfHbm64%M_ zU=8L+IdQAKsxbfXMDPCJ=IxU`GOS&#jdtaIqOv64VIHhJ#AV5>h#y*#Sy6_06yDjV zM*BR;+?yc^r)qG#5=Y23mGP~u^SlU%9q36Uqy*Osznvsw>|ieL+KIKWAMQ=nqgmBC zB*R`aku>N!fYciY2*}Bs7c{H;+9zHlJ73VN*$e?(Po3g1dx;z~UNQgDotV zeE!}0zqkIWnwisG=RD`>?lV(8^-PG0k}TG9(&tD>NLU~_DYeIY!Q+|u4DIpS*(W#u zcq4I<)^<^MuyAoVb}~m2H*+vCrv`zIEzQ-;jmCgzsb_QEvBZJjjK)@H&qTHJ~NMTn%im9?CglexN= zl7^|5ttr15ji?B!i>$qwY_=Vu3Suyb&*K68Pmq|91t0|K;uMqGtYYzW*bzvxXJx^l{-VX#b>w2uM1a8@o6-X*f98 z{c{#otQ=e%oUI%n)RL0aZxoG9t?mD`nf?}_s3-ukcXlzhH#G-I3DZ16uvuH12>>O< zrMP(cB&2|ka}AW{73bj*=LZ0Iq&TJcc*VK7{uwLfVCo7sw|Dtxtl7U~CI2$^Pc48U zkC~;+ovhu=&19S$z|?;mvw-#gz=ey0LqWZ3_# z?0>BEKf4~w=a2cXx_xZ?tMbk5AIsh8v99lz-D{DMsB=M5;u;uQ4!isq0bbx(KNWPfXrbcfa7_Y3pCHw7Wd*GSb#g{|r9q@jKx(0ubYB z(_!GEpyJDV<_~!mS{4>L7q=d#m+oP5D~4nC~Vv7f5<$~a(3V*k^rErjXZsV zh3qc}qQ+&ykdjCFW2wD*_Grb#iv5@MHU8tFxcZT0KZciRmTf zyZTOeHza}#W8WR^X~zq=l^cW%+{I2L;X?eMp{2+b5O1UpNd~^_-N3YsLBGwB_~IBQ zeLqwU_=fgL6q28yQ$g4W?{XxJVoaVpG?MfOkWpgPdeHQZGT`kW{jQT^8D}Bn+@PAF zdZXa4RFECt)MR#udtjApJ(Ya< zhVwh-Vs@nAgOS+1b)bkXczU7u7nrN7x!(1%CZB~fZ2qZfvz-Mh~ltoXS+3>?O1U=jM?nfVhWBhBV7F=&Vg&zWt&oS7Q3U?LI zHi|k4H09;-Z=S4?sh7l$AtkCOnwwG+>k)=BC^-w3Pk0ND!y}xWihkZ+LWRg7z`BG2 z>_g%A_BKL8T)tE4i9eE-7!}KxN3aaPg+|kXj)Uy{RtTU6FA)#4^j>yhy(yq3fDuL6 zD^QC>9Z&kM=p?JWB<MX5H9Jp0wXmM31=*{zsBk>cSHSmvi-_$3s~Ps0L9M@)^?Oou zyxicniqrgf_s^ye43cvgBCtS_K%}TK%r_%0A{Gegpir}E809;Ildu>Y&+V@&Z0DF~ z0;cgJD%#UeNtpoJq`o&Tdg@r->;QKCAhvrZYRe1G*Ljt`Dsx{|M^Vm5j&BaLjy>~g-oc4}_YYUgm%5^K$Br^g3KzS3YtNM-4K zT*PxLSJ(0E0K;gL?rR4=^o4UwLk2?*fGkcY$z-iFQfak{{(0}0M3F6W7%qEstPmQ7 zjA)A8PuIppmpl9)Aup)v(w&!;N!%~1>zD8Fp9F-Fu^L;)MCE{pZcUKOaFYe|>|x72 zW3I#@tr^%`pGg{EBMQ%Fo{2#y`fPsK=9QO#vLVE=CN$xf{w^}K5snD1@w=Nlf*jIMVd)T8Kgm*I0b zy!WH9mc&&WjfD$ibM)FJLxtfNKzE)tG;oEYVvU_XG`>p5yZ1S)8hNP5PeChJ+|q7? znfI%TRe{ykdq*_E zZ`y6>7(m|o0V!b#Wg*BdY(n?RvSwUB}MQ+oNJ0ln+}e-ki`4W@NDDXhcTXpzOsyDBuZ%rDI0r>|2t!; zb_7CaM&vll!d4CUOz+W_ld-7w+ZL+6`tV~&fhes|Y31pH#)!^dJ_@K<7f45n4cK0u zgyn?+NwN0eExVNT&RL&XRYaNDT--l+o`$Bq5)-1r6nMpv@@}^RKP4oNPO^|~CRsbF zd~i>>p88bEB;2fP{|CRkU0EvG%yC~~@){=#FE24?*_Ck6p*B&X zb=+vm74)`-_2j15qSRF;7kFaFG`b^`lTkvfoO+dk?ktr{0;7IglQ zJ;uCc!oG=|TV73r9%~Tyojfg&W~#Zp%GYDOFb}@nU9Ek8 zR9(qqdBdrGkC6C?yJi`Yqw6uY(EjkVzOtkHc1>&$eY0U6JgZ`^qq;H5^!_*@iLgWc zmn-@SrN?Q{fMB9<1LAOtm7@JOM)T~B>y_lqF+0EGZ5iH37^&ze7Ccyz(*X7jKGRr< zD4|^|CL5TwZ;%ql<4q!jN6x%^cH|-mZZEwWZUF*bWiCuF>-|`m=S5#fcFnI|>4wbw zMl9zsi{F0kwk4LBx`sIBxHmyfLf1Sf$YysbjMBym zAc&c?DF9`%kq!3QFeWy9XtC&fQZ}J`XKSS;wBqA<*`#>vyFcEbyo^dZ{esQ=I+IG@ zXX#9RTO^{A4E{2V@qoR(W+T=TaXC(a6|6^i{Y0E`PdSq;!U++fzBAE$=byC3p z%B!gBJZg&SblKlNgijoh5LZel#6$BXqOAB|$*`oWcWxz;vE3N!zn_mW6h6CC&iZ(I zSQdox+SVeuh9cI*T+!Sb=3d43(An8xar4A_BrEZ?Tz2QTZ(E^llpbf6hfDVa%^UR7 zlo*JfzJqGrzRlFLCrMQz=l)?6dbhq1pYH*^Zp6pF*DY`ZFH^W@b+lQtmb~6^<9J7E z+R^oW*6);6BNr21L+`1>6~t}J)#{Os)&vq~ilVeFm8bFHc@43k}+i24Ai4HDFD7-6`V7PYj z18KCwaZX{}C&*k6PB4vXq^<%hk)=kKN1#%420AGbPlMZBJiey@Hg_Yd#|3+pVMvw{ zg%!8sJ{C*Of;U|V1_LExJFW3hu%T??LCPFt41>YQ5=-szL<7$n_UT+t>s>B2mz-8i zJLALE&TPvjJf1DRu9njG@HhGipNwOF7&yH=dcJ7T2S4$#BeNHLj@pD!BS&e~K|l7n zXnG<^i)Vkkz4s7cq(Or5r2=<#M%o1E!`>aOvzT4v$(0y8J%UkL)7iGaT3g1>52yTA zX(PcDxiVd3u>3J3*UC#Nf&b)t1uS2Hs=0vlLZ}5%5#~<8*Rkp^SlQ`rD+#bt}~-^KjexcGdW9O!!tI;Ntc!&q2=>>`e{QJS_&46y67$ZIqp0) zJ)K#eg4Xq~P@9m?5-%r~CC3pZY&P^M03@i*)k>R#@RvoINZhNKq9-sFL zCnElUA7ZB}6vJU6+GV3)JJ)`ar%p7!sA8ZyS$O2bY!gJStD`$(zZ&68G@4oKJ# zrJ+Sg_2nu~vZp(iRS+lh_x7xhC9-h~3f=wK#=e6Az;am7k|m|Cd#hf0Tw7>oYdq6G zBqZNX$}^^>%ZU1;fh_()0XE?*4j2}A%hgVuO>wW3MsFRRzj+q7W0(Biu&n^UpN23h zO;6y~qT_BBZmYZCUE0lDEja+Q^+lXGH;KAjU9nZ`hzQ_-?=~&e%!o@%YuK zR1{!Kz&EX#czM6ZIJIo0)`WN&UfojB42T8#psI#Kv&Dk_1)efP#`04`dt}D8NE?qt zKK3gkc4}6rYysLp%t4@Z^9<&`W< zdtxRy=smMVbDj5N-k+{6+NsIPiy7%(m%P|24V$>#YItbe!=8*nsPI|bZ#X-A+&Nki z@nO`K;nWqcw&8BO_dI*(lO#HoA`eWycJDk*fF-eJ))_-nUS#>5p#@Xx_S<_> zmv-FNI#V_uA_ja<2Y*z3BE$KF87#5=o2<#O_SfeUvaYwxD=lYtS?PSHLLqlSDC9VJz8K0RpXS=~YSbURR%?FF!@FTScHfR_ z-(S(@K>Qq|+6wAA5!%j8P43j$dctF|=2y6Nnjc+0haQ{gi&Tw>f~P;H0f4)yj|D9Iw!qWa79rs$)W`?eo=VqaU z0Yui^+Fvw5LwU8A4ZcUxDd0G}d3EYsiDtvGe{ibhPyd}-kzST2#)Pv_^YHpsdW7oD zMGN}tRg*6wM0LhNNDEJZ7I(IWI+tWsFp`;tVE&=yl8CVk&1c0YQpz8fM?qN5MbM+Q z#q4}#S@B+CF#UEyTs^d=24`ZLog%@K)#4HlT7Z!`&=F3%#ZO0Q{d!_R zgSB?2XlB@z*$!oj^oefiVfRpAv1{4f#&c|}sAk}TG98|#FSU_7KSf}=?E(`mjugYw z8>F0EbIfYCWUKhlp^F+IcTv$Rwi25~)d*=5BRE|=)Ml6|^Esy26-l|+RUyPh?wYS(fp!{8B1r_Vyb6Gs4$%(|vN~_Tw$C_9gcERNZ@c1EnFLJX> zMcrN*&Er-;XJxf|R!f^&o40Uj9amBEAslu^u8*Ya^;#QNYV>Bk&lv~M%fa&W!N0$; zh4`fS1sRIkOjp)E(`ymL-EL5fC5=_4rEpz88=M^tWQU2tuijr07sW9<&qaVeyR!T- z>x)rB09lye;q3M5iJaHgYWdg2rzgLbFk%Q^no2nxMJ!OHM)QJXs&Net?M%i|MzxpI zZ%@9_=xT?lj_vo=IRyceeo*3Oznn^C`tXAE1a+?OOql@UBRgE4>G@Q_^5#B^XR-Nc zp0{IZVP1Q)gJbf#IS(}kK*sk7zvBt^cAo;$FM&`gWylSx zrO<5xL6|R5L~m<%s{bj$HwPn+<-<;|b;lFZqo{PF82!~0`z~KZcecFzOz9hTgO5J2 zd6*lO!D_V*RFW@&9(9S=(ESt)#gpgh%RMbN(;&*cSSN$od)~D~%%w(5Gv;m$G{vV! zWf2XB5KMkA7ywqhs3EB(Ro&8)i@|F+nZn=V59BnEm3bMvGmLTH=Nztj#G%p;y4!J; z4qqmP?y2`LZNAEjH8vF`@&x*fQ%V_>t_9KzeMGLJ0K{kr&o9jxK$k={B5%|&^B+Hs zQahddZbZ*+KD6U*1-Nn7b&EYip=ug2i&a|>)I$2-Ld0tqnLPV)+f?0kd zJQ;nC-+tWeSz`e$*=M^Sw#I32{ax3AFm71U_xZH##_v_Tse*B)qbCpShZjufgr@7G zjXk#(Jr$>@>dF1dB2(Z^Z6>9~DAgf9{4RAcCHk8_F7PP7DZsJC@-p_QB1{)c1A8a{I4;fO7)7P16>P4SDG`mB|_w%xHG(fp= zEEJ1Y7zUv74;&y5ea)Ak{Ie*L(+i&s;$ZTUBI#k1cdbmO;9hOC({z`3qYdpP)!poR z47@zE0d&vi)1**hcT2a?G#bOgaAEBJ0eH^gnk02#3?yf6>9|@?GL#eoDlcenI=azX zhFb{5Toi-sL+Xa7B`lhBC?HXDfIq6U=`)N^hpyQpK5)?{A|%oQM7QEkfH@DXZl^73ZIZY1&+CQvc3 zaK2C&3JC>D3<#O4`nS2B-dQ_vi@-cfUM%uU^*6$N?~CA>KEIbn7!wH^{Mr<|y|E!B z+})7gFJ?VrfH`?nm9PAL-%;FQ(_c7wD6Q=u&?v9_{H!;;y^}f{DvbFJNFoMw{9zP& z9KN^vMJ(wxYvFx$yh7KE$G+H@Xfqjg8E{gf56c-Mqwgii)vaMeXMS+Itra>V4G<|Cg6B!{Dw87W%wL*oO>h1W5d z7jVPq5BQQjX4oi|7w|{twuGL<%N4R*YnSKlkO6lROB9Ny^6(Yun$y1vnT7VnGVRMo zuu|G|3DgLUzV43$*=Baka9c#-sn6he2)IiYrGmOpt!k60ejo zPDgmVaPi}kv?wJxcH*~|hP8J>5=4r<5oxb!g1iXxLo6qoP;2ZLExzoR6W`}~A5swq z4YtaFmwy|I9$U6ybFnV?WIMJt-rEccg^tv>yQrHw@6?n0eoxl*{HXc9aHP|BXQAlG zet(y_&!WlYGM>`mSVU0Ei#TFIMCcOFl_@-Lmy>?$X_}*K&3l0v%0x?D%-tU1a77)B ziH)^nD{HGh(CRPw=GSSY^6D&!(J4@t(}b}7>u*E!>swcm%vFb0+X$6(*rZM5{N9f~ zl)Dgk5z25yDT{U6-Z}x!Mk7(QTxpuN+l(Ct1Lkc&aaDzevo-Z6GH> zKGdbHK2&4oufB_sz5cgJ>N^$etY@wp^Wy3Gx2?m0#XTp{?1=KxH#TkC>jb`C0~7uS zYKOhGrXCfo1*LPrFyCuxIz*(u*x2Xkjk&x1dEc&Ltr+u-`qmJvla9$qZ|i=F38c|9 ze(QmTq{ltGLq&aa0{pR6PYR+rWgaXCR zyOouW)rKZF!*Aw0{t2uUJ`ISR7>N%MK6|vG>|{l??^}@1AMN4QP!sHlEN)M|vCpwq zT!|Xz5uqKNx?1|5Hr?HqAyXR@_IF2(?XpUgrEiv-PTPHw4n(J0v-1WFNkXMQ7&Xw@uRg!fYfM#Ctr{RW;R7R2w$U<* zb&6Wto^DV%hziB>c}rS)fDO6$=d;oI<(?5!11A>-NZq+=Gq)*S3D)W8yP^2ac4rhT z0*dcgoXMcV*@`g12fh&M^t-m#*GPkTm!%X#p7-_O_f~iLc2hQ zz@DTTvzprzUtNb(alAE3hXvv61{Ieks*qkNp6~}zwcwY`NbXg+>E z0);-lcFFk6?9E3kr5ES<^>J4izVG+rcb;o6o}%?t!~%8`;w5X|qm|jn;LwoJ zk;tW7;Gmlx>OaXDKFgJoE>ZUQ;HE!oPK6+ z#nM&d=XIK@rz`|a@+eiXZLU1c>+8o;tiE`=c?x|ufT87_=RO>>=$MA!k?PX19k*DYZ&G}e=guC4tU2Wn@|6RvHQ z9ObZL)ibU}ml7}uRzoKsC|e<}&ZknOX#}{P+Fz*jzDZ#1%ROQgl=8V7LV~5Jpa5RU zI^elChl^dH%LZ-itQj!1A`9j5IBIgUmoVcUqQeq;U{Ox=q#MN(&7Ypp%z*~tLT!?i z(m1D7T7T_5a2$HC6n<;E@g6>b_F0Uve^%a)k6Gz5GP>WJH3 zHMgo@29`9ofIn`7e%ux*mo(S^+`nUL&ia(l%#R$6h}I+zI1#@KU_Nqj1rZQnHD6nK zeT~l|exneZ%CjrjKJ#gA%QZ70OrAU{HA3xa1=IE$=8EaIFFZfez8LIOK(|nL@ZleP z{eBU%6y=Kahh9!w*V*xqVZlE`hcT(INm?;)JK}wHiABRCW~iSG>X-o!1e?A)LNTju zLfQjEn8VR1^)*e}!uBW5#ORvK>L-072CVOUR^_gP|3V7?qqqO3DE?pC`de`aVY#sfffoywz#_&cP|b_%L0qL%i>V< z_U7g$U%tHWBquYOIZvKs{y3TQWP)|>l&a)WjQQTm^2*A}%E|EZN%Qi`3Q7tHNP>BI z1Z4PRgajq|-_gDCb#_xx5teba@^ZFu@r1~T(f!MCS=(C+|39o8&ws=I$V1`z{{%As z?GoJ^4^K^-55m^}l|WYZzhQrHqe=lA{*(UCp3%8LWF)nH=MPOVld1X=9!17RKG^FK z!F0hOG`UR{0=G}qy!{waosgQhB2n;;RH1jGIA=obl)NY0lLX9_s zp#+L$RS=7feAVk^&(YHQ)H;pY)=R()QadHKG`$3LYFC=FX6{Hzmp}7z<4@0?X51p5235&ZWUN~nP`#6=AXQe!dSJJ`QvM~<7D!PI`zpGKX6{sJ-oNAtHa2~Ju z`L7MuR$}+bYXDgl^5a@Y)(Za4_if;fO&CJ~+6KjqbX*!vQ&wkzH+MZuJe7c2Q&VxX z#}f3CmfL(q7QS5MZB08i3t}vg0oi?_742;M6zGR_u5+`NxBSLPU*StA!`shO^Fp2% zAD-VqvmZ1Zro}`D8mRV-;_~AMLuX4eZ{)twFH z(+4T&vvv&_bTgQd(iS5_${BPkNaE3UG6t@FsHRa=)LpV*WtD$LsFr;t3nDDTI5D2? ze%=y14_tkUwscp0#|+2U}-IQ zy`!*}Q7hcp`3z#f2myZuqtpR!g2@;t5&f}L6csw8DJJk8$ zfo}Q?t0?q!{C0(MzyKAIIkDUNi7!0p%i@&X`5KMG%Au>K;^k66L^9qAl~~t9=ePNK zk-)sf9-*VwE`-=FzkVpIHMx^LdC05p4JtX_Z~Pb=A~)mfCuaMDqnQam~E1jf| zU1%Uu{^Hc9$&wcflFyubUVx-}>t;VLzDch{f4om8^L|Uz2?X%N){s5Iwf)>zXM{_l zbOlO3ok}8$k8_l@CJYO@anyp1XhPoZ4ac`yKDNIe3)$&<+$_0ROU~K(#-r}4eOlGP z8mSZLVGnafYukQ2iO0eIHro?p6ts9bqqhJeh%CyCM}YBeEVLigE!n`+H8`m z^0uLGz(3jq22@G^q=wY9=K3BOCV2mTM97?(m1PsRXNc|TzXU?P`ljDIX`Q5-g-OsB zGn>Cfa!+5cT1Z&*TzbKCrG1ARaYT;GQNmk^LG^qzpMAQG5xQ1v4>gasgeU3PXx1pnl*-+K(9KRFkqmRq`3Vq1kHH zu*Wnj^U5Q(;J?MOBQY1N^NO-JtY0j`E#u?WwC<$1@p~Lj8E>>+`QA!p++^;|M2(*t zB@S{IDGw0QZI%dj3-8}u4B#-VQD}%gQO14iM@(-nrtdTj>*M3?x#$UPx~xiRzY_5j zW77^X1f>4LYhbgD)5)DH!rwdtKYPy+g?aOpoX61OW@c@`!e)A%K1q1g_z5WvTaFZ^ z&*9M3Y;;L`)`mX#*?x-EBYQtc3*t$bNj}5T-}xvZYh#52k!U;{EM?;GqCz?>Gz_$; z(#b05@a_F%^0Ere)=89{)V9l1Y=hg^zGO}b1q$YCr{A8BO&%?K5Q{rzebyy2goHN1D?L@oqGuR5nw!0(PD<5Je_L63!bsGJ=P)*z!3jj-QMTCzN?TNWnR)A_#s@ zz6O?%iW0K_NZ!NXaX056JG8{L_hB3)7553QLd_O1$F(ezax2$1YHGzqIHh#?Eq`qk zh_KsV%U|9xs8dtSJ>#75+^uNj*Z9T_caCX8hvkNQOFd-uthzkB3G^2*5P0=oNSqFH zTMt(rVi1+T8I>~2cUZ%jotj0)#z8wq#M^GXI{5>*k=qQK*x^R^>Fen2iBIgM<11fr zB)(g;#x2eL#q-Wnzuz_2>TqG9p8vNq;Kg-egY0SEco}cv`+WY|S;p6%a@g?$wN3>S zH(d1E5wFB&wqD`00}uc7zTLpDH2C11=X=dA4Hm)C&$HFdMGoo2VM)01ny>P1P3dr- zNTnRAY=?u_+k3CCNfZ?Nfz7!`&D2=K=5LdYE0Kfadxf#}x(g&CUAO_)hSfsG06U%u zWBnlovhk>3d_}wP;m(_{Zn1(<(uuY1yOW~e^T;fANSCkH>(ri`yW93lz6ImEvecqF zyHrWd8OcA;?=|7qjqX2SIwgqPWFi)viWgUV{V2|T7L>2pX28P0E4E9I=X6)^9}8Hd_?1~7I6{<&xYmwY zB>Tp`Tjn!xxN0fr)PD9V)p=KXK^p0@FGpiEI{XymdjKErRm_~q54 zBJmMl!kGKL&9Asii7j#I7ws9$7nLUmG}U5{evsi`sJ5FQ8OO!d3a!A3e?6P>KA;vD zsT(a3&NQwos)3lp7}6l7fM?ovx;^*Hf%wLAP?6{lNn_~v7sB?WeWJRNpteLeVDTB0i%lY6Z9k{XnzxG zNjYSEWWBCgYD|8wb8BOje;jS*Yjyo-ixU6R^?N-0buKtWh|M~{;}rAH+-8g4k1;Ho z?J&^?Bt(^QB@#2Xxdt;sEa8b20{&#aOBJtlumniG@!${S-zg=of2^OBG5j*t~Xv%nBj$NcH4 z$IJ8GS659jiPd92wh`-fl5z$mOB2erKj2^VTSk}V>X)Myg|n-(-s5rz;>f+{cmoV8 zuB0bj0x!~F$M3O;NWT{58~U}uwc8PoRNWeb3k|=!fA5n$0ajsRU*9ctpWv}qW`ygi zjzgXO_T&5|u}i)V`nqX7dgLY)>#a##F(9>zav#Jl=U`zGg0C%@H_RfkzRBg4<(cRCfXW9 z8tiG^Rz)A-9YbLCYG?9NJ|i{l+>lxRg&mIKI9dYM#{4@(sWt!}(L@&@NE+gY z@)3(dYiUpjMpRZ0?Uyiyt**5{DA%& zS+*4cx8gMk>9`MF(+Vzz7_RFd7-IhLVS1*c9ja)pO}I~2q0Hu>+I`89o0XlInfxrn zthtdaB4w!>?Kr5bwyP-F@NpG}Xe8T^rc%wfzAKq1{a|AC+a=xiL@7J0Bciwp&PEr> z`0;&AKAhY#Dd)x*Lj1#7zUR8)Z@J5*Ow;HFK)9ETcA4?8%Xc)=BcgbH!}zfIyY6Yz zy18*!sgIA8kwQ;y+%-&gLosVB% z0)aCu2p7u3h8HaS2>Z{@Y?-P>tXoZf<$>Ocw{j$~^kO}H-n_Wio8;5Z_%GZOXY4sEvkf9`%XpGPSBW6=WTH*r(2ZF( zQ#&)7A^}k^$-RM=`RaQ=y(z()KYvb^0B3%09(dq3XvoJcO-iw=>P!Z2+kU51h6xS|LPD9dT`nd12#StQ^uN%p4cDahPG>ifTqd0wjE!@+U7|rTUe)gjwuKoU~(I{Pc^PAtggo4H(Eg+iRfXhN=lV9@^r~`H2*uw8stjyUSX`61cGWRsw3YY!kS*zS0X@J})o*78TU4W! z8B^#1oYVolL@^EOX2U6K46wCurW9Uw482=p%MKn<6@kFq^^z8eCmAX;nKOQ6;VMI$ zJwK2HXv?^&%Kfks^3lNg8fO>2GCO(F`|9wHM0>-BA#i1v#&#r3iVZLphyQDUf}eXL z(qwb24qWm(@N|Av83-U1dKDfwib$E@+VX9Z$E_tLb4Ur)JF1<0h`$r0<0qxdclY)j zQ>{i#I9vC-HJpONeZSj+>@$&m0*F8F6uMkYb{>TcJkWS9nI~Sk(&hR*e3YDT+eP&q z9X$BDj!M0sFUs&WH2`gHAYjT}d<6_O3DsNtJh_=fF$>dO2IQa0rYposN=7&^qZ4@O z`gir1R8|fYoK@}F-tP&?a2eswp`m?nD2`K>OAB(WXHs99iP*C_Zmc^g4&V@xbXbrc zoR}=!C@t1CwH1}XpYLT<_J9M@17$ae41SfkoqoT&Pw!Pe- z&>Lf-M_AG8ofb#{{&=nC#;S1KOc_^zm9y5;U@VHL+yj={}wcwQQ zKHFCba6Rr!7n+gCZ^N6@d%VT=Hl?t(kFLVT#4vbY*xz$GH$`YrO>tzbHhab+K$vD^ zv%x!iu`MLZHF~WynGG{3Vaq)7_NV68nf3H(GJ+ZCe%H>}PRKpIW;vR#VLM=yjQNDp8j`g_(slskKGOuC(V!TD2OiRH27vMJ&QsXgh?rYhQ4baHoG9Sq0<-a! zHN!5RH(Lb5;Y)}%OnORaG6u(OHvk9HPZl0JzWgF!iwNqpzO<3=(~~u8%Ca0Rq2xjT zh4)KpetP8lk`5RB$Zk1FA^N*=lq(|+(@!R2MNz4kBln_petZNe*Iq!KyaJUA=!e%+ zErI_9tB{ePRE9q0bqce21=U zvXO-Mg4_RTO7jx$s; z(W4>J-LwFO7n!}6><$3t<+@*5H(m#AyAk&Ka2!MWm-&4HDwa+z%prf6-`JEE7^hVb z$F&CYDfK4HO4xWKd;rVDBCqzRkfcIiNazNCZBpYFC0#E+OMbk7&A39z3!>={b7Os) z5(jInfZ|bV(5}D#j0GDvbt(VvO- zs3~aSB#o>aj=qgY{~zd@K0n^}P=U%EpJw#v>8G(TS)eJh^pMpFOZPWSPP@}5WQb+j~z1&0`=)en*5(?lqb%wmVA55`K|cLXWiS4)ZG|u&wE9hnM%$+)XR&sMbsW zMARk_=t_>8h(;)2J}DgY5A9(6KABP}cLdLP=83$;hln6$sjD;AkngW1^#tU7Jss`U z>cSapkP0anJDN-w**L#F5JhcOJ0`Dhc{O4^3fGZqff{Rv0w9 z3ul&lY^_91ZcXc@Z^N}ONF&5LgEjxaTuw|Vc!L`jFa0APS2a-N?Qa27$a;-9jReD> zut}_!?x*s$$LsgyH(hh85y@%O^~0cGlg|j41{A@i1s?*Ys~_ zLEq9F*SPrjR#d8y?dnaZbD#0Dv8`HBp~B}y?H!*MX(7XF%8GIoGOHWF zDjDaI#O{`QOvkg-Yc;oMagyV&MjHG9D0pn{r;^1lUs_S*bUyj)W_3i}OvT``YvK*) zIAOjph9YyQ{?ufdzkeNweUU=;OE>@p-WY565&qIoosMY)tG&ycna7qEfvK)!ip3wq z-X`esdA8X>f6;DlmjtgOtK(hIwK0PQpz>4_JrlWCkR*Gm zu=l#YXPrsua*2=UwO<9n0H+b=@jI9CP1)2o7iAbU^b=01M}Yv|%j(X%y)Gh6AXgs( zmc000^nJdynY+!9WA*}a&~G_hM3u-Qmv$zxrk1hAw$aBkn`))A<^m{1@j!;Q&WA%w zJtMOvoT_C}`!fY^sI#^Dr{Qmz3-h{c>tb!RC8uOvI84;3KIe0W9P&+ZxJ$8@ zdsRoR8ib`JHg14tZNvYK@k=UFXPHbR&&ODvB89}qE!NfxMXUGGZ?ve-;-K|aeqfCa zo>OWv^>%|~s^+dhGc16rUCVej2D>fnVML*BR3%bgvRz)TF&Z>ynO%?`4E2Xedxi+M5}>& z_spq>XDys2xf7Lz%07kiQaVcI$wAN7HOLE7)rqd4J@mCqYbWR`k=lCg>PAOYrIQ-) z(-quX>onAz^`O9)LHv#8>sYqqWF|FG-Z&UL_+&q2bRGEtl%U^kN{v9O1&=S;Qq}mY zapT^)H9FfDMF4sf>9Z8W#DLfjnhuS$9G5upEdysHV+{So8$L?2a? zSw1csq1?IimQGR(+1y#ayyd-cGfbE0&(kd_T&NldH8V0Jn{N%Wv|hQC^EI{9+y(Vq z#6}rnF=t@XpC_e^@!!4AYFE2HFnLq4r+YKyx?{1kKLD7$N-SZp!FY$0#=$vx^VHZI zvPgwM&V52lXADo5^Pe2|8WaPz*>c9nsj$r8qZK0j1Fp?z!yCb!Km_$KPb~#;G|N;o ze1)KfJ#hlS!-UTC_PFO0+EXFXsd|UHlm0LKD}pCH4^CmnXJ)%_RBV$j8=A_Y;G z!5f9v@s3S0x+aH|_;|mz1u23H3N?I%Q1s_{;*<^a9#SqmNJrynx9LP&LR`)&F@+KP z;PE*Jdkp!nOy)JwyAhn~>ysr_IxG%;rJCTylWMj;jO;9*0~UQpi1Iq=1(Cch?@1o z;0l||(H5bS!D1lrGN*K?B~n!wms zp(JQG`|8cskf@?(A=qaT^-_mzdbZ1IS{ZL**B=&b?cAsm9{rX{#BE+%W?q`JK7i0{ z0Xg&zS0F!BjkgqOo|Ox}YVS0%V>wb6jo+b~HgK9oMa`1fD>}eVBo%#@A|HYW;C*~l zuLLpg*b2~1okmN4`BGFm!FhC|Swu|U`ErXHr2rlU`{0}DAHKuJ+B#*r#W^*E6l7}q zoD*$HUqFpzvw8kvHeBC=;CF0ie+;NwP14OdJ1n>}>mP|9qxtyvQ8&|y6K}&+3UgXA@%Jw4cUEA0u}BN>#yAr{;wYiR=1vyC!y{tiDo`l4a*(`?>7uP_p8w%zK@_@~ZbYB`)7e`y$F3=`OGVfIPsP%3u5v-Z=TMjf>U# zHfx0`;zb;#@4D+JR=Ax!Jh%v~U=Ye%dzxXsZBIA7MbAo;eDJ6)Kld;eA0PzxJJ@dw zSRD3$FD~lY6KqY^%<%06+~8BNBWz!$cEL>8+j`Ql^fUquf%26`i_0Qg)^X*}t$w_V zUM8R!xx?@j@6N*Troy@mku2XTf;f)fuP{r?@+t3BA6Y+4v}`iR^>GZ>7p~#8y~qkO3Zz zVimhic?4^b>k8aG#eka0L-rEJHJ4oIlCs5!tas7(Ff|!4vIX;%W|zv$|5U>m{~MG& zUX812?SGewyHJpS$izyBbvZ(S??+uzIpP-M=E)^{^;ugI()=0W_DZ)0tN(W<+XZcU-um2wuF*A!%FeD|Ck^jt-!%YvW9M zeI)D4d-e;Tz`4wRMUs|(-*B0tBppE&eLSiq4T;4Nk~2&|NrbSnELd0&jbB@`?$4?h z*Rks0<6$j>4NX<)U4lArjoG!7#Kd!#LgJ(qX)NzUs=f*ZU(O=H%x{Si#A5Qk6Pzp`w|FAr z4tEt4a3$1Ixc}GY$A4V;_#erCA+OBI6AJFLl%by6a?_ruXa5W$t143=W&Zj90G)%@ A9smFU delta 10280 zcmZ{qbx<5(*X0Ly5AFna*8qciAb1!cxVuAu#x1y$;1UAC9fG?B2^O3XoP@yOzWsi+ zTeVxY@BGtM3|-yR{oH%c`JLxpEmW^g3DH=dPnchZUq)0`R9KLYPeDXfPDEZ#L`+Cf zKtxPbOjd@0&d=FRLqlBN)zaJ9+QmynUXlU)3%8ZMmH7WYSM0x?n^uCz`+qJV{NMhG zfzH!Q+uBCl>c3w=)uSWSMhoO=*6LOV2N06~RZ*`R``}6Z3F)b4r;qlOubCFcW<&r@+(F?&f3g z$@QfF6x=Dmqh@+PFd!h`^Te~@{wd$_TkUa&_eR%ymNez!Bl+f1`ebE9piG`nr7&F? z@xL4yFw+0$`~UZ-8_&yFBTlW%#KhEadV1Pt(%~gmQBra~I6HfGH<=?49{1scw{pSr z)4l8RJK*s$sR!O|8T@?p7q;k`v&8CY2J;%FZ`}MyV*u!-C3aBMymtQx>Afau3A}}~ zdG1e{e1BMUvh6n%()STBut{D;mqj#zwRL%~$hFRn@$u#PrIFI1eYMQ{ZNI zP>HjX(-SZeR7u2&0ZC0uJ2vU`o4r4nEuon%kgk<*+v>e=S??GML;f;z(e`y0MT-=s z#HUYwkH+>PC~MG{9Mk|)YQa?F|}pX_D*8&+I6GTTr$f)fdTD` zjh?=!{?n&bdz(#It4kgt)SK>calVKo18P#Jn*ltP{s|3IQBzA>UR_l>3r(e>p`n?r zsHk{7Nvcj%jEK z?R3D%I*6$2NRAeLa_{@6iEi+fnV4aBlB_(xzdjMd#lcw@u${_vn^8)@Cqt(C82o0; z`!viD-u%wg)FlEqQ}{7h)Eun3qBV07iri6L1w23TQHr==H`Ud#63<PQaJ_x9% z-32C?+RVRz5@e&Iq7qMJ@f38~PUnX(Ykb_n>>}Yh?s|Wn`016u$DbOLZ=H}Yst7t& zGUg5rcRyxkl8MrjXr+a-pcSaaL1ssY%q@5%R~rWh2T}*Tq@ItL$4ipX>G<2T5!w;b z7cW>jr-n@Dn(XIDA>;e6a)0O|mSqBQe#NUDZEaT6VjiV{va&K+LAT-@coR4VHOB2v zUu(Npf-erPY}r?iMa1aNLX_@p*b78eN5|tOMMcG3Sua&xjzPnlI2u|Z)@4Axv$9tu zlj#29kO)apy)`5xL=t@Pp8JUt7l(725m8Z7V^dR$Z>;(wZeR$>{2Ux#M_v^QE|uPE zATmXNP$8xp5~dJw$t5Kx7bE2SYlfe}6JZK_^QP#TXr|5m_mwGFQ~7QjdT)R0UH49F zwypTzT~x5WicS=sc1*y6>jCO-0*FMzkzs6#gw=F;n5hH4|oDW+V$Wta*I41Aq0;af8?QzTb1Xbk+@ z=-M+|rp*)cw6U|dx2LAx&V^(-!u#NvVxppMHOhMW`ip3Z4s@Z~SOBCl1~+00T(5o) zBeVcEtkLHC3n^dh@ZXC@T>+PPFBRiOX=rIT|A6nZb33;d0M|&TS_1kw9PS~9k!~a} zD2ict8xs5C#fv7A-rc$GpnElo6H-dbRV-2G?WsJ8XhcK5A+fBY@Y&Z8)z^9Op%0{Y zjI46}UJek$-L6|;Fa~~l+J;VdENR{!;cc;kDmfFdJsA7#mmz9E5qE*8t!J0nbMoBE z&!4aM&I*n~Z-mpKZwC~lsUuxnT%P>aJG|3cT-L=&IKBI%zKghS9Q;{nb|fK_VQFz* z-HUP_C)#)7LA#w=Tx`MaJxvU6TuO!B65vxy$Gnj>8yyt~ypOyPOA-fLP!`*-!KL|H zL0&$7d~7U*5;~db5aM;VJv83oecb))*Q8NbrH)cqZXg|@tO@=)A2~UB%TkTWxs=zz z%&CO$i5CY4hk$;mbK8`~a6I`c5g}n`CKrt4&(6*Tm4e`>@{lp1^YimfI@Uh7N|xG3 zr6iiSGk0~s=V2AZGSrY5B?pJf^~1UHAWI7ispv5m16|#DWxZ<&ztgRqswz&Nt=!)% z8XwaYwQbv>;5)s|bWM0#ZnPbS&qHE$91vzv(a13Py$E__jOn_UPi`0vC&vJ9iH3uogQjjM2H~2f7D` zhh01FScmrgF#1q!6eyz$t(R3vA7btdO2`a&TZaPpB^!(+XL4_hjn@o%`PL1pjV?8S zBpS&na|kM*A3FL+L3?;EUbyoJU{h={LW=ZfUXO{1$r$Y_2M1dP z*tYR_UlYlg+t^&SW@Ic7(Hw82SA710m`up307=1?A{T_@|LKp!!i5Y@_nMuBk2&M5 z4XCf?nlX$@X5(E_T-=Qo0{GlLUT?Da`T4C$dmZ4H7a;}BpuKtbxe^{u$hr$5c#PrY z6X)aO)A;b=!#y}a(HL1+d_z^{^n9i9y~r|7j*bGpPfQ#mJ~h|Zvk8ib@C-E>K$vS9 z=7-R|X3V(?3xvTM@r-=(4?}l>X=#~#b-IiLhtb{D-_`3NGJ#s)s%&lG|MSI*Z@VR@a2|$ zRP3F{$lW0A%LRF$If9;Qtt9p?fJ1sYqJ#G(u z2oI4M3Jt!Jor4Y{4bHsl%>cN-DoHco%&3O4`*Q~{j9oh|r9O{ILM8d0mU^C=5jl64 zDg*NYaL8cmM(H&0rBWcN3e$zz)ii;a8F_}0b-^L1gfL#DFVK1`rWp$hE3c%a z1g)2ktZG(xI$v@wEy&CPl%Fdn>))a!05P$3n;L;ea*L+Me2uYkfaR;Iv3&6L`ME^! z(L9^0V5Qp}#JT{>+dxC2>uZ-9It!YKsJpwni-l!S$bI0SeJFBTWCJqoZy_ zvpmO*&fClHpG1HG;)L&vGw-HfM$1Eg+)vLG#7=|I7EL9q2d&r5e7vAAJx_A zH?~|D-c%6Iz9fp)p16d>K9XB4aC3L3_&y-O#s~&`Ht=v``tsJuND2|j&I<~K&V%!y zD+5v%$q=mA0<}y?>+l*+PENi(nt8ssyyOVDKA|QeAra;g5?Y}CcR8mit${y>3SkzI zmfnnVV_nhye8~*w1lvL-5e<#h3;92$NJvO;Xb?C(FnibVf~XK6H6y@0Z0s>+==I5m zN2H+phT`9XK7W2z#~E!pnMP8WAN*Wiwywa80iA`W%)T0OArJD)3a+4n)KtRXHs3$4 z6Ru>&#*XPgJkeS(O3-KkrE*C!x^?%}S9-6|+$JLiqVa$@$4lgFWQf!KoN-sc!ots= zZR#oSacHFivyjIDn++g?O(3*4B|p5z$Nca|Szm93v0FIvXX~T_@V!aDR{!=@zxpGy zYlGdhy^l}JNescu%+Q(}{fu0iRis%egbuqP3+l$uR0xp>9)#eb_2>N-X1bx4$L%{u zWL6pb9&R5x_Ys~gRa?-6EmfGwH$};O`QBpwB8QiZj@s4LwGS|M+UgBOtIv(=9AgO2 z&B?J}|7uWc*L{VJgEKL^oQSH^6a1L?dr!5EnOlBvKnMd82s4UIZv8}h1^Z)I95+y< zIaI|4nCI}sB$j#ryYS^mf4=GOxN#O$8ClVr}-#XuXoMm#c5zkB*IU%Tkk$u{mF z3~p{dk2Y9O*pz{WXLm(52`l|w;Mov&QJSFV-ef_08=#mG?0^`eZvM?wQ}f>tsDShl zNS*syw0f)3RLE5l+bk@ttOmy=e+5?*el+B}ANH!7&JoyW;VYC+O!(y}OMO6#!g>aA zY*YZdF5Yk0MxjjjcE05M;Y3Oi?rdj^Wqr+TXerC%Z~|qbY`EYl6QpKQn}+r59<&$> zh{xhU>fZpcHOJrF+~hk2l^J+vFA7T9gO=-Xu~LsiKLd4m*9??9&i=*;ojVq7W#Qoi zdE46-9E1jR|L`$YTO>!CanmpET+Gdjyx+WeBNvE1$+!c9*{pJ=jYWReEO=_1!Jq)$ zaR4`WY>-jA$1YimW8Y74&2LHBLAyvyH~{A)?Z4R)r7$WaCw8Lr$^Cpj%VE``>3DTI zaDL?Dr8~`PsB5LR_hW0pdlth|Uoq-T)@#&sdfT-8jXa0LIYChZk5I=w%8iYU&1-LC zbh}`tGo`JMSxg5NUd~*KY+Oj{-bb?2Ux$bO`Tjg$D~LWdZt;@NA<%1sebfTfsJck$ zsBfcir=kJ87ES z82&EEJY+t9+ZmBbS;sy=qJRP#vf`fb*N-HoZpNK{VrIP|k`Q&Q=60g59IU(ULR*4S zT(FiGe_SvzF^z^uh*X$&L4AGY)Ug6QofoLU zk0r;{2rRq2sZQKWsT+-&Uq$GwIln`lfxE-<=hOP9yW`rloFYIlJ1sS}!{SeQ@_tfW z97Vr%5ZC~8@x^@p7{cndYCW21!JY^^7A`XIo+nU5aQ<0m9ya4hA?#%MXK&9ZBZpFc z1!>3xZE#LHjAj@}plq#Ymw0n1zUj1|R)~kc^lbhVg+c_OYCagJxrjmp5l>`x_)A{a zaL)q8%$>Gt02DNd{jTYfY?NN!N`bcxzN5#$yg^14Y`%<squ|^lmR;cil~no5qnsgRLL#C(aPBofTvp&GNZC1F+HPl>#)2yM2i|uSZt0m zJhp>^MIs*>=}hlMwLe|ZLq;~hsOv0PkE6<^;jUDFhZaX}{1!A-*%fxp4gLMHuob%^ zE_WwN&Qs3MxY^*HmSsOL9^TPQnYRj?O4_pR1A&}5@yzBS;HtLz51>TP1 zW_MR1rxM7EWYwFy0&g2+_NVe%W5^}qv&+?bW{RA=8a^$GO=k!(LZivYtz+S{pw6Mh z7aSH1m3>~{~)D@iHV862mEnOM2}m2 z;lhBwzrV2T9i+Fy^YTdVUd(e(J{0*z)o%0GP-g-kQaCD(IHRV*tkLTVI~+=?n6*96n>@;`sQpeTIz)0>+$3QdwjL$*Voc9ht0BC6w9Jau%Fb_*kN~8VC6oi;774B zOx|d8OoN08j^8mKw@oT{Iv7umT2g5G9Z2{2xRdUHRL0+oe-@xsg=EdHY>$JBYuZm7 zmYJHmJvmv>cTk)_DS~So7o;FFMxsDNOuU=4{E1)DL?URy zq~w6!>eATQ7-Xe&~y%8twIAQlD-+UxLuwzlSGNj?HbryjwIKL7SOQ37^=v#i=w&bV9 z&d_p320~uuZiJz`gq=Y30%E&UPOBrwNm9f{3~DMWmqrs;d;7P7poH`kDt61<-`~GYPe%6r_6WV~^XK5O*a!Fu*b#@mgWQ_y>3mxH zJtH&oM@tkTr9)VD_%eQiGx zcKIcdWj(zQkkod}aHT#)a)qWcd0*ZC>nY$e)3UTr(HT<69F52rSxuy~_?_ux)SJO! zuwuqVL+-1+^6j(6rwushA7^Xd_28IQ*CGtq1%ZW-G;rN%jlbILm=z2f4IeK|9)b4+ z(jZ0g1O)a2dit?2MkMP_5g6Fr|+7>GN)1x}Ji!~+^%Ic=6xuggGz`pn}x`w5^o&L%g zo+SN5#%jhTK|N?G*^$XWPDXZtPfuh8I6B^Mf&Tq_cCVG1P_>5#np>^@7~@6BvD$Pops zj0)k4xnrt2>gwwMzyb(P%J8V4r|&3LF2kA^;8R!xE1J@4Law(9=9UWhe(Kr0p-a^Qj*C^+@bTK@7It>_3w(V3Ul~Cq zE^BS(s-A>3#$I~@+b-r`razaJHEXJ>!Uv6xPPYXk|7k>YmOAMP6iP=G1YIq^wuUT& zi+B)3GZKWvp%wYcxv9}=7S_Bw-25lvziMUhylg#GTCRF|fg8n1WS_q)mt>F%1Q^wq zZLa5l<`??Qj!Qr((ehZAs9R>2)ZKKm-9?oaS&@aw^L2oDn0*DO!cV`lYz+r~fi zSx&X^1w<9lo_f21i5bLe$RxuCA16EekL9lSzM5ckM-5)#eF-+5`x0y|HA&z320F$ZCrzOR2i(X0 z6Lajrz73h7)LG%QucV;`tksmbZg#VztC#!j@9ugF3krIz!FMNMp$afcvD|F;-t)fX z%4UyU)hv*m0_$aJS;$TXD18$K?zQv*IjK15lSgjG1z)jPz2`GtF!E5Rm1f=D-O(f@ zCSLt^u)O-SJOKt{;qAh8=~=*0+;yMVG8lB`MRv31(M4Mjit0o)HlDv-b871Bd}#Ul z^;icqZCQm$-3TXlxB@J{?mG%Oj@R4V2jsz&jt^un0xw^dNQ5*BowS$4)uW^o;DcFE z|H?{7%nMXHwl>j|3tLVo)L_I+B05mN6#0Yrc*_@@ba*AJnRcKNVDu3yWS6kQtWVJ} z5l_UjpUSQq)0Qf{?0ksy-9tN=C-zkaOL6{=hAQ|HznX(JGz&l)agUn7h*pHqNLv%z z{O1OkPcWPPbr+vVshNo?z`$=NNOvIGG=ATLjEY*bO{57%0c%BZfdwGg=)h3VfLK37Gag$yxQAyaslr!q|!mw*AlQr#?LhdFMLxjt8<-Yv7XF#dSt~ zX(Og6FR#AaP{*Xjj-X0q+^up7ijKIxhCn^$2yDjXTlIqztA)RIKT5|Q!65T0t2G`* zBvUbqXmGOyCS2s>z8fIFX+iScs-C3t!l6-HN+1UWY(A+^C>t1D>lqsU4AZYRVscq+ z`OYdJa4s3+hJqd%bw_m+|D`;QLgA*z=;Dv8YVU*4@8J8Oe`$#$G_oL ztyY0k%Ntp)+*nzLiJmBAKV)U5NvHfZDHx7Bm2stod$ab1)gl*mA%<5rffXbM`Ub-) zKu~~=Zj0INS%Sy3v-e+th{L>c)SF8%C^T$NIA^LkiAr2yzikMmZlkTS{P!DicfLZ$ z;3ZxA8Z_==sITwW#?9I9rO4>$=_L}aVveuH#fSt^(aRM&xG=9;~5K(4xiY72)_ZLQ-SxX z9Gt<|%A7O~$gK7$K&Vh~CG-{*bx)WtYF>!d?_Jf&@ySWP&+}8zRDa2THc!|TLiet- z^D&F-XF)%l3yy+Waj@bRz+DZW5SI8r&fQG+Ezq8_?`G4m-a?@_1Odq!Ek9II{p{?ln?*DK;%NQb zwZ8|~s^nNdB#aaod5+zjnV)aM#;clAdl!xZCn6%!DB{t8Dm5#WVCv@BK#XkH+_4uZ zjHQ>nh)o*&`=ZyT6pqEpip@~nVG~PBBET=u%C5IfU0z)!CVlvD9F2l-!0;egUW!Cx zr`6!DzkRyLzK7S*A{B;|)`MSK*wX?H5(4=$?!>#7A&1qk}9WoiTnaaIwG=zftYQj0fkP(xp#P~fx88py7N;kv*yLzaM?^L14mL?c@_yDP+?q_HPfwrn6|8ODAERE@9IH8i|Ov?m3j z*%HYqS=Al*jaFFHCs9_`)|aCT3qs+jR^D{g$Ym6{!)&0_Oxlrf1?_@PZ}v>q2z4b9 zT_hy)HF?eJ(u_h~@9!^5$I@7MDpxd>xJ|kOn!oovKmKD244S#}Q^ZKeG@7bJZO_VD za^|)2f#-d5|2+&8K0E~KSj?aP?dOuwPq7r-*G&G(@a399BH}2iT%&fXD zMo}-zzN+p3v_hRmbTd@n4)pXNzQ(nA`~Wdxxs4TI)ua_Mp_bc-8metl{K>vhJy+D7 zTA(sog-j43^F~+Uhx%BfGGnZ(OvD;t);csk`aJI&SjfF|<(ltVw{eo8Y@ynMhEd?= ziCr*@%sXBKbFnTkmO(Q&izX{k;tyjyt4?Nev9Qo4AtWRmUMk<&v8ruo;Fq%&Ef^GP z241AoT5O}@PwhwVW)pYW~@F2F$;C%%a7HXUwosYqH5AFWEWBw854uh&rI}e_f5dj z_MDNG75%xq951S;1Khdr_T=OQre9-h+CDTode98+;hAn0EF@IfhB3r4YN;}YYXAR_ nDafk-^ZoyQbP#=%MnHwQ1+ikW;Yxx>kv#|dKd|J?y diff --git a/images/square-logos/tenxcloud.png b/images/square-logos/tenxcloud.png new file mode 100644 index 0000000000000000000000000000000000000000..d18d1e91f284f9ba68718d71459ce61f4c122d58 GIT binary patch literal 13359 zcmd6ObyQr-)@S1mA-KB+cWXSjOK@!(cXv%7xVuAe2<{#{xVr~;cNp&b-hK1Utnbd> z(`$8~Q+xfkRMkGGcGcb;s-z%^f{2d@002;=rNmXHzP+dK*Yq(7)&Z{V`K(a0UMckI1GUW001Zo3pGt=O?f#!kev;a(O(!QcN_b6 zZU8_)$lcxuWCeC6H3pkm*aFGVT06-}Elhyq8l3Vh^7dk2a|3lAAj_+w(CqySceBxv?|ZIhrxE^78UBv#>F3?;>#{NHIZJqu-Oz#86>~3Vw%*w>_SC{?<%FF-1 zp*A-EK|49Cfd99>|D#|hH4l3*vkKVB&czY*K5?cLf2p$P6LSO`Iomm^+1XkDJ&H=^ zcFuNA=63d^Vq&DU@AQv03t@Gc!Cja5(W%)Q{#~;; z*wMljY$D-kXG8k0KJ!`pvn}HPDDU6ACjV#)&*y*SWqvn?`LCJ%Z!`Tj>D_()y8Vye zzBm5k`C!|3cXxdEYailENdSN)Pg-0=&3)+hN5f(o4+Izb$sHuM8o z4yCBD^w+;gkTT@|L{j=l_7}=O4*ox=|C97C?fZxSne?vUFUEiC{1@u~B>ip1e?$FE z`bW!R-}uSjI=CNsqw+Qk(1w*2xP+;Scho|L$Mdxr^XV!wa{q8dHX?t-_C*rP#ZAj= z$rPj~_8snOUlaB}ymLs%M)^Z%>mbLwxSO%EvNw8A^Q5|BE&TE)qAo;ciUS-?Wc}2; zYlMNpae1p&QByMbgHKRU`Yuy?C?j!_qez_v6KA7XkXg2m)&vt%zPmF4nFRN9Rg|rP z|D~u-n-VKbkCKcz)T=^1{Ma;LSierlys5ddF?s61IbmQsm+<8!K{Pi<&60E0u2FS} zjxIrtI-ke9b^7236&Gq|V>m{4|&k^8<7vJB;TvvVr{e8-g%^7bIU=}4I@8D5W zq@+E2C4|t>1pUe)Z$Xk-wDJBLv6CRLbN+I)r114k_H#S$0mpMbU+lAiy-mB`hRr+8 z(@yex{&Kq+!4SS;HF}wf$*-p`-8s*!pUK3|r)Cyy$L|?AePq!x8V#l`uXbC#GjtWM z+QsPre~A5r;Z}zhR*okWTDfb7PYKi&nu{~#IqqWnS2(D(8eL3HN8mtPoKI@VCp3gt zcKr!L!K7<3v)U&eBX_?&U!8_iJC;XZI-pJDd8^VSg6}3UV~G0(&6!82eII-7^k0bq zwdCKmmX6QO{8Y`_&swpcE{7~w36gQ}^~WaY>6zFdLO&=;;8qq30-PoBGmzd~tFB6Z zqt4?}0i>wJ^klE3dfe2g$cTnJ9ms^k=YvY|K8^c7BJMY4H?C!CUilI!o`!xgdZ>Ek4SAG16E*^u@7K3PLP`fzk=% z)c$Qt=og@|7larMsR=`x4TAc8qu#FgR#9_@=jR_k`DUya`b+|nF#rHRdroX@9}Tn5 z>3ktM_71*rl35!E1fq-=I!%%w=rrWofhKO2Iv-0Tuk>pZN%hK^N z(jKB}=B>^(`dVxUX++n5fA?Aw3W(b18x%I~&zdiA7^L9Ou2K}}tVFD9W~!NsHG=uu_Y z0atY{m^}RX=Gu9fkB`q(XEcc;@{1KC9ph@n{L$#!a`!_%D;1-^YACpXJAtl}UlZq4%^Q10=1da%b^9D5V(G1tS9R+d_e; zk}PzIG97E>>*E6uSTb0;Zo1mF_uk%ZO8JxL;Opz_A2ti;uXdRVMQi39bGtix8bw7# zSHOw2Ij-KbyJ2HvkQHuf#1$Zi0*~vXxqJJ%?VjLD)#eZeje^|J@86alhX?E9VoJuq zi_};X(kO^mY%T2Jg15w|kJ|~ly*V2u#*0Y(EN`8GaT=SNtPp-r>4fZV*|mB_hWjFg zq>NSilujzTKP(F<@aafZ4S&bDF?pUthN(}ymfFtG*f8Ge*p9J3kJ1!dKT6inIc#Xo zkr*iJ>qA!kTAd=c)Y&kw2sc)z@_F>NOR*J+RxnVhc166)uLug$*-P zH?8GG=?09Htk;^|u@$d-B!RJ@rqe1z1Ox?hZLU*TbvF3X6j;3c{PaIR9B7?4A|Kg{ zfb^HB&4Wa#?}FXzC!m8`29c1EqIY(8GTSg!--_4V{0%M;&dd07L=)4?7~OaT%2BoA zI{f3w+L^v^WuO!g(p=1yY#d8)jzO{K<%(d9vn~_ZeA+eX_5M&~SgzpbuW=@XnFNmw z*uK7-ukF%&P`KiH1R#io%h2-&}$1O6OWwY$|wt>v9?X_{X zeK!j?RgSn{X#uYIHul1w6XmQ@=k5rALu}mR=|3c_=k{`AmD|P~+dkUfuBHmw{xPrb zb0c3lPf#PJTX)zJ=4XPg zg0-fL_yIH`0Ui`n-|a*Vy&Dk~W0j!#@ig!IiQK+KEG*D`$I}>6b8|B|R9c$R%*vA5 zOMsZD2Gt+(1{RYf=0U47a94!sDkzNU`mv23TKc8AWymry4aTbmZP8)(Sj(!r|G1)< zw)0R%FD~pxT1v{g!)PdOPtR7P965!nH-V$y5~{|>>uzmjWhMcKfWR!9 z&*qS(@cw=dKoAp7jVus-R`aP)VHqA^>QI8dOsg?CoXlkKT26u+Wwh^K3@#22U|YB| zq8LPw%ScN50%x;$=X1PB0+Y~$pPvBJ!-lwT6ui3-e=-sIl3@E zzdGi1nrG1Ic&0PKG#T3L2}cun8aWfHUp%=0SlTGMx%FFBzC2|9jEb^W%Ez6-`GiVA z6w}gA26M4kMDTW$A1(O2)8=tCkBvg)34pyOWLf;=v^VON-`?I{T$;D_JLCA+v2ERi zjgwioZlBj-l~2Y0BJAks@ba3~^C~Xg)>n`b*v_@&Q{MG^U)PBLnw52@)@+;(4L+AI zDz5~|?BfJZ^T%V5^Md&DJoCc35FhPDt_*-o;YlG`sIqMyxKln0RA$Nt3Nb3U*U;+g z5tk*UKIuVVQ1rU*(+1bWYfk>e?Dk@Pdi=G@o--Bn4dz5AUuG@9&*uxcxwU4P)7Cw2 zcYnco_4QiwGfEn^E@{hXNKlZzBL~QUx>UPh>I7O5Cl%{#{;y15uf{p?cM_B?x^Izl9clR8~>r-(X7-7&&4_7roC|4Cs%T- zv&Nkj<-?ps13Tjv_geT8fim-She?4>4lnT2I#yB6LO=hAim}p4(A0px^Iq_;(dG8k zdwj(iOOHjr;{I4}zK%_Ebh{Qqa5r|KFuy+w*P3Nf>#52iV+xMbpA--jYqZi=UU@_~ zXgQI=8-0M>90{$(!&4fm3C+NF=SCIqt&AD&cmy&In8bTVY(X%&eXE5#b2VrQHFzYW<6h2*gqem)@opEStJ^U(lEDsdES_y z)kyStVAV|s*_8pV5W;T!_s*p(q}>MqGeAFr%h|>4YA4L-CkaYIlfc5kby0Z*t58kF zq^nzYIwze+JuD_l-B+mA>bcAP8MT+BH{AI1!&lg+z$FC@I@1?qW2x8`Dh7N+#z|#Q z5omH8ASUGt%9wq<%5GEr;C;D%|H7K!(u-!%XmXwg+w)827sXvO>~W&y@talmQI;OQ z;-hd6iP?v$ElO*=$ixz)ABUlqYbVa+;SPAIshNfv3gXNj;uZ(C=Q($Vgvyv|RtyYYwoNN2>=~Et?O{axt^!(m>b%k=Djx4I(J=+3zVV%%z2sD{Q42;!#?QsB zXDvrR2V`Vq8v|YtzhFXLrJD-AFYWAbw`bYuv9XJuXFhj8WW%3OI@lODJmuRs2Hvmt z+y;I=s8Zsy3FHU5yyFC8Gcv^Tjzt|8rk6BKW||z{aEoBrt^O~GY)-ktShYo zKf-<L2pF+0|ttC{~#_f?^?ncpP!xGA`{i@=+)q6bu_BgNJ$e{O#9r)3|&#T?I zBcG&)qkHQ-ZN>U@hXy+ET+U_o$IH|0DE1XafXEBG*{E-FXEJ#5swk1Z0Iuz|h71O# z$i~OVI~6-TRTK_EC}?|YXmp%EF)q$?%(DJGQI!@8bE&Mm8tknk2p8W67$4hXB$IZ^ z3t(QVIq4I|*Tvj4@oXQnTwcJNCE^=B(MzqHq`Cl{IS7dH?I;&!(*E_PUJ zq`ih)g&~uimDlRM$tSv$$S_^>Qk7s_|(746Ts>rW>9q018vB^;0kcWT1t}%M#%o|d~cus`1P{Qt-R?9XMVk@ zSIyz^Is)z8UkCsxXurV)n-@?A`4D_$wiORWRifb zlGA;V9v@WNST_#YGCS|5Yl`j!pkhLm>Jya1Jpu_UpshDx9T?0M|eJZgf?y1PhA zA--6_>A2Ezmw`q?eBML2+LAcYw7m92p@FzRgv8|>>VD+v784tO zPzI?w>r{?M>Nr&`vc7~P4!1vteI&|t71e(Q@JybbG(4#oEG=IQ%wvPsWAMt%w*pHe z(a;}!f@(K09ltf!*Vk`UmKk_W?>HWHzs@XLbBTG2ibh{|eEs?ryXt9$=;Y)9JDdtH z;)RI==|_OY1reYds)T?LiZ*0D3DB9_wWy5niH2~&)EgWj0h07K7PWG6Qa$9idwYr2 zY4E=BSIKn-c>!%38%jz_G*P(97OfS0ZW4vsp~mZ{+W3F-lU%m6w6HET93LOkGgSWg zalPEu_N-^*`&A+c;)cO~<n@GiPUa3Nfg=Ik<`)q^<(=t>fVB1!i~W5LS2FZOK~nQ z-=k-94mPJ{Jq0)SS;F{{YAWMy!tLCgw+X+XFw;T=Y*01IaWN{ueyn+EshWuv~tewjz zxXQbr$0$zRuG;oDqqbmuSMcXPXJ=hNOoX`xH8pj^?j9O1g#QSy&m-nNUG2Pxo~DWH zsqv!VM)z=cVWRXe_NgcI>%U^Jz3*{xCxiZ8?~C9|VzPlRKQC3mL8tGiv+S>hu&JvHN*996-%x15hC9mGK^=WAA&hG$aZ#8E@mE5m)iEUQR4er)$C3K*GtS zr>E;cnTk+-`Wj&`rbBuEp%)kB19xet5vR8Y^uSr(a8q)Nk(TolZ^1jwB^W^$73-(c*L^73n0BprezKR5a37VG98{;7f7 z&L&{UdiEncdw?0Zgs_I_a-N}8U1*&s!L@JX@kV$PSa!ppG7*?m29T{qw_?3O8hQ{g z?KfWr&8^Ok@=Nb8Bt$T*e%s8(7>FK+Ige^haorNlt)`7okfaW-g4Y(}Fh}ZrQ_U$Q^L z;H&MWu_GD}|*4JRTY=8iC1_u=?M}M7Px!zOAXgW6#-Wu0~S|wO89<=Gy{>eOuj5bXyL>$4Mm4GS^9nM}J0q zG)K=6 zdQ!P>l)%gA_aR2mWHxQoQTZQcg^f!OOI7wc7Wf1!&_>ciUu6c`(1CsMRz_t z9{H7&@Um-_Gkb*sZ*XA1R-Me9>jVAl*Bd@;WTv68b5&}ChHl#`-3_qIK=6BjnI0x@ zMZLS<;IW8=Qh*y9#X_G?iMA;Mcfsdzbn?FB-FYo6G)B7uHyvwRCPbiPpZv*ZO`xwX zg2)$gP|?cl>K`0~L=NraFd=##wZ38EDmx2MfBri2^z3o9mck0!9q1AmdAwWmdYs4= z3opP3Y*q3@Zox*L->5}bOH52urEgvRIWjz6nd#V%?*aD)Nih1VVW=j1^lihE9bQHC2u)id_ zi6XfggL=&oJ}*&dX=Yp#^KBp zjh9B2rIUWZCT)oYDL6w!%Z`JHxHICrn9I$RijlF(m+0(9olZq)aYSm9Zox86Oz-)F z8=t#M-G{4hNH`s63UO`i`9K_XAtEpwyjuwe>pcvM){@4%GhbiIGXE5ED)iKpvo62e zEf~&{R!}H$Lm1AFo%URNez4PbxrtDGE+<)Z>>Kv;cJKkK@62{N(jUV)ORyk7Z>O4- zmKAAMd;yxyKy|t1hcML;b;KBXn8{0xB@Kgf<3)0q8XUF<{DS);LVK&$`3gNaoc>`;R;*iL(e708j0H`8iUEsYFuTf6KlL{K`(5y&k>_DK@T`F zwB1+2PZF2tZ;PN@S%(;i|s%MY{SxnMJ3btmtXE7?Sl#%S3-1CM>sL0Lp z0h32*cEvD$XK-$c<*1aPjEo zqSkazztt9XKktja`LS%F?9ABI#oLK--`n_9cC(JXU}^t>f%6ee2^xB((*PH6ED0QFqQ*jA(XME zb5rcj8~0}nTl=Gk?oixcS4SB~wTcunGpLrjl1V=1l?ZFDk$;vP?MG;3>St;0ZjSDz z6b*Z*o4Yiaj;mi^;pN*Lha-60n}y6tV51foU{izTUQocwAgEWF^E+ahX4eir^?TC1 z1L^s!sYL_?XONvjj>W@^PevvF><+15xd{E`YvRHB>PyDHA&MGC0?RmNxRD8`2HLMc zJlbD#*zWh~8#FOOAT~P0Sd+iFAd9ZgZ;#y3h-Jy1K2jg{PXqv>;-;o*l=CIeG6Y|K zqriOoCSc#<<=MOPxd3hfSs!0va9vy#^7rxk_8?Ixo5g6W5DM;=xumj^By<_?2U(`m z-WZCVr6qop`ta~DFflI46MMLq1-&qLXj9Nbe0_^o61Q_k)C<%-2mMsE&9 zDdc!R_^Zrp#2YPxY#tn>!U!Tn23GwHUDob9fr}MJ9^T09(eVCd?5|{4HmXx~TfS3G zBSH0YJ?0R~{Cc{a#K|yBXF}c+%2i$!$(8o%2<0>~%;9aXUUPcHTvj3LHn)^?ZkZmX ziPY)OIHDZKi0j<+A}#AnQj~PlUt)skd09uo+AR@DBeS4s4mlbqIg-bil$qFvR_Csy z?xc!=#sT|#=HPlO;EO)18?o=+fLFaIkVmq_I5V}hwDcgQ7XqN_`|z+Q)cLgLb!cZ$ zZH)Db4Ts;ow!93bAju+84ACGXFI~Y*hv&dYMOFWP8gOMOTpzJ3uB)5jH?mNzBN>5P zJ$rOT=fCQm7x|l+F*&od3?x}r@h-!P+GC_wsd| zM2Q|O$73+LSpsQv@T?pcLGi+n8i7E0gvAK&3RFXFe+CfP-fgB;O`0Qr<24bn-%R=- z2Z_4DmOEs!m5Hnr#Mi8A1U2{P+_&!FK0`8Ea(ZS$De#y^zFpRT9pMw{_4`{(sBWjM z^0cS39zXJ|tE1gXM?39}*Xs7T{ykD$|7aIxr$qY)Xue&-sZCEs^^KW^pJwlln?dW6 z955O^L~aiIoqiQD0yZZWsw@rgs=}}_6L}Xk2@GhMp zG}rg*7BMXWbgT8)YGeyt^kGLYs1_8?-2uq~E7TQ!rV9^er4d)VQo?|5B^zXALf*?2 zIg3!-nD_=`bM%J>E6W$wHp#6fq|`$wTV_mbwLrE93YjRHH2YA8u!d*o+0;P*AC~Tr za$Y-}>(t0h-3(t)_d;lTZ4`-613+M-Ni(P$6+Y)%w@6}A&F-q3KCE3PYf8jP6Gv#h zb4x~b<_Xb*ndO+={?XAiB{lVJA6_JI@P{$m@xgSFXL(pb{ow3~M0Ln;oP-&hh{h;aoTt zt$h%D<~k@1yD_b@IqS=6*^6px*>Qv|0sL2BXsTV%)<F z&7f-+Ff<1%w~PWf8OV%JNj$mmGSLuQ!H!>@^>T9hFB#MyN>=^OmbAxld2>E28MK6Vo+N7rc_~h4KI@Es9d5zgcJ0 z5^|Ubj8!zkg|T`_H6vpwBv0P6D+b<|CX0Wjixd_6uQ^GI-RkP!kGt0<^Cf(Alr$&G zVQxm4t0AuH8tRZMN=oRk=6m`c&ja?Fc$Rym<6RkboA&D`LH)-f^~|M{3n`jTj*gBL z#U^LKyOk$+f77!BIt_0&v(vT`$tXg7O=W$-TA1HI%gb@2OEJ{B*-{wHVW9)B*t)8$ zg;9~EwyzvU@qyq(?Gvc;WqYwjsbcn0i(CW9@XGev@vb&}dskD)m^k~r-3!nFwUak_ zn69@(@pSB@7MUdGD8L%WeM7-Hu3s_5zPzexU+G{lwspe;r=IRW_JnD9ZO-q+Ns>(N8n*vK9?)ZnS#Q<|4{BWOCc#h$TC2JsM>k!sQ5HT3a@o z<}0TRmAI4`6SIIw-z-m(e-_}m03qee>OkJaoeB0oi1UA8W7u8uc2_Vp$Yw;(va`Ql zj%<>R_k&%SGE8%?F*Uo0b+j*hAT4(HK9CEtRaSlLNSOB5r% zZaEx-vvqjsajz85QfaF1TNfRlKx_$ks(q;`Yi;}7=vO~;Hhyx=)~Q3NpL_Z8P42+3 z1vqX;2A#esrjd5J%G5j1^elLK*9(>Fc6>*}mV9a=FW58>;)`*dR0WE_W+SD%*YV*> zN+nca5p(~z=+QRIU{45|P)v5Vpa0oD;1ntTX)+dldZm{q%YFfno|NR? zjCKL%z}EB-VWxQvq zveAFCW#)LUZXQo=-Zj75hDeHMos7e4qCGkcnwx?9C6Xatag|G*IMQycyCo~l=b>>v z)3hP0DUNVD78LbuO(RH#7~&9dzUswT8ynf)d=UjNl0?^ilWSouix?3NWn&b;0kS{Q zlq%hr{b_F+L%TIOshLFN28p=cU^PD$qL`GpO4~~$7K-lfU8_kf2Wuk9?2qE60ekL+ zthh<(&_ek9RRkiP?P-{~(>=GSh(<^pI?kEBJUL|(V`X*l+b?aU2B@xuXy*Il;Es(R z85sbupA}D{Uopm4Qs}H=IB@Yg8BM0zs*uvkZH1-xJTAJ@#5svD;R+Z1I7&P!<$_4g zd?SG*t6pGk`-Wx>%{mpV!ubf9AzH;;MUg|~Y-ka1@J&3i?doKEHJVdP-~o}^dxwHy zJa!BAq@-DiEto@aKZvQly7#)jEwE`EE{;>ws+g>MH6Vqw)%T@kZ+tc@6W*US7awZ& zyNxklYfFt$Osz-(Yg^ID-KVZkFs)JQK{#ng_B`9@O~rRB3T6?5QSh_^#xS*!=lB58 zxz*Lo>DAT5$Px?4TDT2u)9l$a+J3CfG)N+B!(R-?3}jwX0Xod$IolrM_uj}ChCmT2 z8WAG)O)b6@-3MHlm|GOs(Q4G3Ik9-;b@Ul??y%i&DKNbTaC19Ar}{KSpPq3Zqh9uT z3Yt~0T}T)C>3eC(%I5WsZP{5X(k#zXG6%Q2A2JbMNa)r%@*iQuYT2AzzFM#2kovi7 zpk~JTpOgG;1Bl8;#grdoW=e28J587`N#C@pkK8gF#}{?Mdgy!}V)&pRaDhVCr0hZX z3Bu&+t4)@HWZBJP+kzhU##7UdX~qSigi{5qD|LGMzK@4uaHveSmga=7CymQzBje-z zoNjB+jsEf+Z_j%|B)!Pa-h!Ts;W!3Qhl{mlG^fk0Zqh0$D&fN?Q@MNLG*%J#oSsj+ zqv^z=tse=K8_|x}{lr$Aoj`W_E!SFxLrshZHomy*K3}`t^qfY2&89F!+@{Ns-NCTW zwAQd3NohhRSa2-864gzqf6g~O zy27ZNRW=Egb!)`(XSwDxc-ax!&cti`GUC(HzU0rEGqk#%q$MTAd7|Fcf=XAxd#b@~ zF*^}Qld+*fIy}AS+{`55Tff|}!m=1fKdWC%CQ%kV#14Au96k}#vbRz*eBx~9eNSwz zo}ig`b*SRihxKFi$c^*0L#*mZwq!duX|_k?_GDu53Frj1!rx8DX;RVD^&yd9V-d^? z0oh+5@+C||P4p$sgZspa5D^g@#yU;A505jB54CDd+XWqG_B$!eJ6;dVvbngpFnj7b zYfVS>rxzx8wvH+r1vYM*>eUmmrr&dQZVWoUNAW$uDC>78a}{nB3q=a)uhK3qH-Dmq zp3mn)P>GvRgGRgPe@2q{Jwvca>mlVYi~W(Ef-aBO)>T%D0j%Ap3mx0GBdaS_Mm6IG9g5KuR)^gTQ!FTgQ?Ox-j{1{sp+FUk|mwQ-PSQ@W6lm-@D zQTj|y&t?`=6n6=f0w42Z8$mTpKjDxh1)){ z?yiQ0%Ho{ExY|I{zAJ~Z5;vPDMV@|+HT7?Zz8WUxm8jesP2z36q(V5cu+(eOE^ZIG zdibdi0Yh|UUq;Zg+4{!K%EGeSN%g7ZE32=~9>SQah zG?YfO)*@k&HAY51{VO)f{2m&5frUcUf&>K1P#KtPK z=ehT0l}s1wtwt{>+=SgUA*aA{mIPs`V zC@Cj`Iez{TT!C`V>v0%OMrq);9gBS8C-x1~G)TZ}&CMGIUcSV)qg@Gpq!?8zf~(k& zVvqW@9n;N~qZjd8vnYwT2z=16&PTtQIE2@-io^HGRLL^!L#;T$)ZUG7JsuScLGZlh z3Tbe2p40A#58OKIqw@jgmQr1LV-U|>(Fa)y$XFr?|TpqJ-Z*MQU zf(pD$-a-E0p%i9FNJmlP^;ADvpgbu=M@T!{nziDC?kC1$P z;7u_#P=~b5pNW~rTeD++9A^CjZ|g43%ON^epRv|7U5(Qz1Yb~}m(F6gf@0fXEJ}4Y zR5+2{S*?IsechNEqXIjN&%<)}&-V0DNT{I)w+K+RLlC(zH%k%S2q56FBueVfY2HH4i(vbF;ZSmA3rn$%MjFUZDVb% zO8@{U=6w$ci0BhTWWbiCN7jdeovPLqXr4FZa1QJ-hI`MM4NEo*jf^qD`8($qAt{LS z!5)dc+(I82Nn2Q()56C4_XSDk3O@6S|GGg3a5=qa3^EC_kjm%6;;X7RpUq8#1VT}^ zix*&Nrz3aXkH$wO&WP2S{9si`g|m58ePB{x7U>HR2{V87T;yO)JOheM`Iz#zHud}Z zC~miEt9{^|Y3GCF5W%FXo+4ts8z!(A{Vzcx(q9Mtl4IVCX#YPclK;QW`0qvj|8uSW jzl;21hm+rEx&T-C8B-q-M8Ev?7ar-)3gSOS4FmrdJCT=m12ezdetFdx6Y!_q4s1`jBq4ODZo z1bUjdT7Zd|JDFOL$~c%x%WM^`6wPI%F<>h5&VPj@vWBl-7bn|uuns_lfx>5XFLEOU4 z%+m^G|4hNb`9HFbZvR@Qj|F4)GI3^RWn%ejO8<6LQ25_n z9UT7S?FLk}_`mu7S7A4GZ)Xc;RSP#KcUQBIjkBcqE0i;zn5%^e(8*QZ$;tlTtEg=4 z1axw-WtHF-;o=hEWntkGXBX$;7UAUhH&@)r%-zAl5%_Pe`Tyl|{3G|TT5xdwh%9d5 zYU5#HF6rvzK>GKb`E33<7uJ8&`xn>zpL1dRM=tY6GR%MN?EkaV{~r1%pT92uQ@0e$=(K*|h=~7#+QgxQM#f>X|<*P=B%GqIU+fMdh+vPSX?Pq8(y{BNUR1 zx*C7fn?QxqWnwee_{R|?jP}g1pce= z?mIFaxBoX$3uss;Cm6##ut5s2fH$xa@SxHkc;b?*^{Zf*(8kuN#y65!?eHvYhy{xw z@0EOSM`_4o3QA$H=%y~ZGL|Vp; zxV*jzm&1MVnrl*Db~DAfC3x-=s|y80$`*805nmQVf*^_Z9!T8y<%T0puD^#jxd|uS zyIyh+!g9BIgt%BkVfr}@D^CBI38ABFV6kTtGw{!Tm@KQRcXo_#Pq^{PRYV}@Sx4$b z#teqzPfpK-(lTuPWD9&41f9H2ZXb>xT7QJbHsOJ&xseB)ECoTH9f;uBX8Z z_4L@+6!@5X>U*x!l%DHt&B5{5x7zt|fYowkeGir|ntz`g=GHJZLo-xQ0|A^h;ry}4 z>;h7r28rw5Qf>^HG&FU0!eToJ^{E71EBU}aV(Q}tA)skd9?L1-Y+dq|U~A^=dXlPe z-gblyDM`wz&S_vt4MAzaKzm{u?el#sFJ(A#i8 z=scJC*;GStNJOjI%WpWagn}#@Vu&JSjUg+o`c}Xw19FpN$B|^hYqPG)*6Vx>@ee=Y zx2}Vc&mOptjx{Ivt?p?GKd51rUcx!`lAi5Z0gYAu=wI=QwErM2ox@3&OTTOh>7?2r z{w*FEXzFuK9trdRdwwQvRM(1D(@#v;v zf>q#(XPA&@Rq%VdrVA?CNR`b~>?i4@_)U?qRhKV;n$97C7KHokUvi=;%ZDBkQDwxF zLx>Dsl9Sc0ytGJW$bB2@@@U$CS8`3sD}yHeXK`iJjw5cI{XNPVxg&WZ{H*N{n1Mdl zPy^CMd}3OPrpXlIf$hHAA?*)3X8cBTn@DoL&n5;wY`(h1;k8i%N}$j}8 zC(cN?wN%YO%`BH1tm@Xc`s7hzo^2VRi{$IZff=5Rr&Pbf16?2b8M_+Aa4fJQpT1Re zrJo^KD#rF!aD*)ry7hCDVbPxfS5eQCorJ|!^@&YbAHaWAK=obS@t!O+1Z8P*-W zJ3a@zmCfl$43!n7K0o+aHGZt{;y5Ry{@(7Z&2`%b)-x@f_{Bs8cLY^-k26}4)%$}=hW}?zwwRmuN=0VZzpFnBlut4QR08fy=*4kv<2Rh4ygcOI>;c>i!^ z!$`<9*!dKZV*S`Ajw7=he-U7Pd4`smJkWTewaV`^ZN}kzY*R)h^-fLMcL_O>+%7kP z=69jgKq|S!JQ`jR4z3W*Npto+xxei`jY7m^7%N?`RlZmE=A0!ZToKc5Hs% zgQU&UnpGH*(RuhRX<#y#sd8k5)Ijfskr&|j*3<&;85V-XcjuLVMvvuOmz+w0yp(WC z8k?vJJ)7c=CxX{%S}tR+AVpuy!6V^7ZNNnt2jIZ!jB zQ)}eG{MQ~HQI50}%afOS%}-+q6Eiv#zsAOkZwuT9L3CTWgalDPV??(43aVI!Pu>Jl z^C*DG2Z40yf^4RF=0vPyF24oJkq)ib9K6;~>nD#d*LbyzeyVP+n!s zaa>cUqOQIR)5on=4}0jhdr>cNw}g(HyWXoh)YA2Hnd-GSWj5E-)d>pN3;NzEsL>5@ zQK0%4MGIk{po|_WSuwyWe70CJxkDh-gG`$950ZF7O8_IG%}**7$jY4(-0YC@ulSa> zMHO;%F&!r1`ZoP zG+He6GHG*loQ;Q1;5)3bj|-ep<#iYxJKOS9Znv}GYFKqr7$2L3w8pcK7_4j$w~E+T zB*g2SVj3?f7k3Zj&W^GqqqR9$H_mwI1UD#=0B1_Z;O_7khJyNxEuE#w^d#Xqd12|= zqAYybh%dk#<$Zls`yrBuNcjY>6|eWc*{aouUsjUC^g={f_`u-&gf@xt#YAWE znh`w1Q8RMURa0^?mx0;NpQquegoK1|NuXQ^cUrR63qE)g>tg+8;IGwaHKb1UY(__0 z$CI+up<|e2W%Xe8FbrW0E=8L0M_bQ;vwI4Huhf;@)mqCj6(Ds_8u?-tf{kK?IF~>p z5*Eb;!wW+8_?bIQE^DLr0y&F#!RJvqMc+nov?bf&JDvibO!0cRo2Eichvxp^LK%o@ z`DVCtxiLk#Ad2CyLetO0O7K1~yuB@PFNaT>4;s1xzK1#X7VZ*pKCnLP2+2ju{4x#o zg_TH5BEGkG8P2ruw`K$h={LTE5If?QY`*k!5G1(*!J7f$6nn74~qGo0gL*?qBfkBz-D%`6U8@e?fu{Dv?PR~5ArjGW%D>_Uc z{k|k1MNa1hZ^ma=|jZCT|DP0*q<5Cc_~8;;s@)t+)A&r{lNl*W$RFD`Mmo?PitvCJ-+vSlxh@AGXi zF!I7U%rF(gRZJp3<8G`hrpI!5(=ts4P&)W~SqnqQ?cHZ)bF})T?k>-4Zw8p*3v!^3 zS}d>47lY>xs=gS;MIi>;Y30Jcd;O-k{nSO>g|gCmV`(V@zgj3Ri!T<9&vRx2UCM;N zKPyB>H@dcgDJcRz@6;e-tb!E?Hu~fx%HeCKi`})nimV17{qO^F5S5Hg7{0&oWM=SQ|$gg!6xmmM7M1Wo4uZ9_HtBgeITs9F(ZwgUuM$gY^i-*t@ zBiiaQSWM4$_Ff{WlKjC9Wk1HHn?D|wjXK=d`lVFltJW>eU_zCY93^+dc`5({zr=nn zaJ4ABo1VUTDi_h4LQPsmKt87Rk3O>|D|_&(Ai&0d71Z%6+GWeJ!OAT9tmii^$J2M( zv+2FR_!h7y5WVQEVetl2XGAq5P8j_O0X?~H+j`|PW}@2Z{0vXJ^;8{ZSa%qo__)_; zrGuS#&?BJ9?mg-XW7r1Jh-BeV)0@|F+=G6ktJn!7J%xyJ4&5S#!0{V zdNii$m-+&iK{&EO3Co}J)jW~>dMC8PcgKk^C)iV5kWg>7_11B>cK&mYZQ8oH${)xdGsL0k? z`z=C9{Cr_$K50)g^R?xB=6hE)ieHkw0us@cUH1qvPg{lJA2$)n6FE^#Ur$S9U$EY4 zGNwtH3gUA~jze()roNy^K

E%vkx=?`SGbn^VX%QJ^$Wkk?uZ6KD7h!ATYU%}t zxYy1mD8I0xp^#H*60VZgf+J&X%L?)GlIWA?v6UD{772#;!v0E198N^*X5qk})6I?g zbBmbaBAm?zJ!O(^D}R5nQ*u6A{IzL`wTCv!yW>2?@p$CP*aR-e_XQpnTpH@U+NE}Q zFHWLdz+-mn*|^jBv5wc^B9393&jI?p+e~j{K->NDGW}{YU6ji9-X0uEov-gklGt#s z$4Y*v7>m^$@4K$gMXV>a0=r@czPQGrGxD$yzAyY-SXr`2HC{G8rBr@GCyk6aWiHIQ z5(@cVdl$vvr5}07_Sm{WtNjTkNbYvTZnA7{RRR985`&fjJ~n2XC!eK+{472q4f(cK zEE+wFegl<$V1BNGPl@NZgoa36TOu!!8hqL3k3`NloHB*Iylp|MK|%_Qh?aA8OL5` zDUg?!S5F){A$nBBRehMbB;*fAWkM^DPrWmZIbPBjnhc${+4^pTX)++`8k=PcFCW36=S@8P8Mx+=$x1G->;WEg_d0jynNT{Bz$jw z{z&icxR~MI3eg<~g~rG8%Y57#G+SRq1$8Y_o8vzh+Jz~1r_7k#{W0GF){dY}yW|Xp z&mUV7&lWBQV^i&sbOTmIs=sDe&MX+AiMkF+4FkkkBPEvuoYM^10H3s2a~;MN@5?U8XhQ+)bS<)>LY#R{EunBsk3V?p(IZN1<3*?<%AkI&x4kR0b% zF?E4&vDi~^sY8}PS8`L+fh~z=dgCF}@#Ax{aXZgavB8j-D+f+N*lw=PLrzEE;0%W5 zs4*M6%d@-3A8wa`D9fObSk%o5$vPsL*r?U*g9Dc#`v&R)OnrboAw15|klW_l)#)0} z^t3-e17HX0&SIlFUtoFu7nWjcs`AP{@2G@75&r%=lHgKjPwC#oH0VOW1&|!@YPGeI zmxXz!s;%wpZRgf07oNfr6@z@b^9fOP_k4gl-&=pBN|3(`sU{LF3S$>SKU!a4JjWu9p(9j026KJK1gdNogYfv zlkOU{4ESU6G4EByomwTUlDPq+Dd!i0-gm)@N+BGI4q|qQJ;Y69l_`70c}5NPAWiiS z1LC|V!?Sco0S;?V{HpI|t+lY8m%O0FG5sA`fYV#^(Hxo2`SSSucIeNIp7+Rvn2hDn zp9Eazx{J#58PxJTN zyZiv((WxbU;NaYD)$KVfyjCHClM>H%cir=F^qLB3*KFh=>Pr3(oC6{EZR_7h{2rK} z?>}9g!l7Jku=8;2))e>E_;&pg<5pK&a-EN;1AS|;Lz6&d*IRD{<=c z8iBGMm6JRK$?kbqMQv>eK|Rl-rydok${c_Y~S^ias5PD_b-h9GhL&=rM)NW`#{ zfP{E66ebONn*4mwn&uIpVo?2w%)2v&=dd1H!7`{j^5Ho+z?qyY84xp2mGHEG3TrBu z^NO(e7;1PO38NqW29w|5ay`DljVucA(Zr;=Wq(M8hI!!f@C1#ZJuaZ7zyKx)ffsTp z#C6(KFo^t^XlQ<`Gur@V9Ubnklr&YB`l$k$(qFQwRu3PiZ~R^myVX=pXGOVbPVN~` zEVOSeyNCK*-0fLenuk*QNI$5c={U~+Ev0Hz9Gt20Y^Y>;x16NQ z!a`ns8H~wezvA&sc4-~p{2iy&;v$&b-G7VJ{6N9P?&sce6AX#vgtWQRQAtxTXUia! zla-iiH_~+%aZ3>H*9e~tB;V)$Ea0HPf z7B~Y~nLRtEPQ(GR5Q(u+e)aDRyo1!SR>GHkq{Nb+;BN`?lD;--NQ=X!D5YvLGu2d0 z+1cCvz*I%g%|2@mJHN3s@1e~>Yvh)vZY?jsEtNmIEetRV!bQxf_}2VDRNp=vwXUEyFa3JIvKp&CO z!9XIqJaQP%q)po)_!!GB$xluHTJnX7{M0;yNd8vb#G!;Tg) z!(N@Ty@xF^KRW)W$TpJQOHR)}!||vIJo%e@>(GSsI|&P1e;AGwtnQP8vS?8XSsdpO z>hj9Z8TLuEmTvS?U8w99mX^na#}pOXtN=Xi@iJ6Y-rKZzV`yY_A7|UmbEN@uzO@yO zIh~izLW7V(6*@;_wX==lLA#lP0p%x7F|kGo<}h!}cR?A2Y@JvS#O<1mL>bsbVh zJ}c+;uV?Dyz8?kaF(DzreRk%B2lfmWHda;LU*tw!h|qz^!xjFpsSUO6vQzgl+D*_r z{Y2ZAY=VM;iNsurpzHi?Toiuxxf0_r!Jk?k4a#{BB3W9*rY2TU9WzARMr8Jvt}WC- zr;IN3P*@CU&#*m~jTYH8HN4OFzzFn?WAVovn)i+!R`@Hm?3_^@nTe=RC(;-&n3{it z93E6R5<+M{3&qsHaTJW&x1bPu@&GXDCcjwKm5dB_j>ElqgefC=<)yL%AEV$Vom5|w!b0i`m zB8DdvER>)wR2|&(Q5B9xdw1p@a=0aC)YZPbo~NBdv*$jK)9r)0$;dn;CB9^XU)Dp* zG$O?duQ#~95ytQRJX1f|SyuC^t)xH7);r3Kp2( z-*r30I1S#WhVy zc)0qp@o3~AWS;QW4ok+n*pVerHJ4pZK`vlDAR!&EAqvEu9Fti&g2yiguC=?r6H#Hc zuzp>PBadJCwF&t;BBJTsd`s-u#2WxU0Kr>%J(@O|4gYaA(SrdEi+mS&EPgQYDkY1Z zW@bdoAzA8kT;D&M?XlJ4KDv|g9G~XryYKaw?@TsIH6pblsX)n31^@se-kgs(J;TGG zIAY$4Y=UeJZT}jr-76bVGrfTe24`;nhNEtlAtAL;Q!eRQ4T?`P-C`nB ze|p#(6%Wf9;W|jMkw{*hk(XOWoU9pGuH)J|+pAKcpBTm7LDo zLi5ZzI|MNwkyIpjORTKz#;X<6_VIXCcFYf3Y|t%!QxYc3#7aIIx+~NS&h&);*8Gey z=FpHxb)A!<{>_z~QGS(!VbruH{%YXO`&&YS;9BcVB7p11`KumV;7PT)Q?0h^bkeuj zl49YnLOkPQBV?D)d0ww(_U|>8saZT}E5|!q@9TE?0-UA|5zVb0i~zs(hdNqTtAbP# zjI~0Z-RR**JE!l5MOK%+=Qx2-G*MR_}1>%5cPVto{9I43nFuc;%e;d ztn!-2tINXcJkWmvc;XM!YMUeK=B!uJP5Q5XPY=Ez#hLk@Kftpcwh|Tfz%f-+sni{N zV7{JE(@s3x+k¨8_6jETe00uK$c+ z;Igcu4D{C8>dUtF^$$IvFKB9eS9D&s!JO7M*<;Fv%Wa4q zDT~jIR%}3u&%lOyBtVu=ony`XEM04Z#9h~O9A))>y=f$TjeXMCQc7Xxrnh7jt!O72 zbwWm&wz=bpj57Gs!i{Uo`7WAqfy5{@{n7K?eLO#~(_=$xU~uTjEKt;gnDzyB-jpn!v00nIbwRwv^KA^R6qa(Ws1({RMf&(L8KsID*|;r= zGhQv|(5vsBg{d~Rl}^Fiq(blyq5+C0T+Ul*GA-#lWLVZpc~>G7xg~WI8j+{{Gs>md zU6z zrea&4K1Mk9`#<<{`BBx*VYW=#-PBvS%vlbGR@15VD)Mia@-RJU4o7#|RT&WJYRafO6 z$pd=b#Wz#6N3)&vd(}8+ts~#R@~xjM55Ex+(&7ulAIw%Gl?ESw3cZ*%ltqi~zaYXD zH600rxnQLcpz)O5h0Qg16|I7KdK4|_WiBxLlN13l#wA6Qq}_oB2U|oD(jnwyVUD~k zUfO1z5_!5pUkQ|`6oo}tbU!Z+Y~Km_QolXO6vD5?zIeK0^w{)q%(b_a{>}x31IhR$ zY*~72M((up9ki$=DISIiUr8g{1Uaua&he0~XnH?VxpG2xqjfWqvNfM)FY8{r z0gZ@$ILVoo_!@ z-Z`eEk=)!6V!@QZW(3AAuV-e`%%()X1&h$<@;BP6yoDU5O~-tHigoMseVzwaNWS`a zA($15wJA)=0>s^;F%27WNUD!J^hntRDz2hqaHe=Q=G(i@fMU@rri&#*Qk;9QimGth zs-pV<>$ZrW>~l6|H-FrsllO{-?&6ISnx^x=-Zb~t&G^zVoTi!SP46J?Ufn1PIn_}d z0|L42d?e{)SgIGfHdA2#RJo`)d^et(blBK<{b7f{cDUVvXP*1x^bJJV)_>;>BJg5rg;Mlv@uJs`_6`OwDL8CR1j|6WtZ!l2v5SzGGBj>kAw zwLT@8jpFMoR)S|d){W3o>(yy)GOAJcZ!#Gbdo|V10>X3PH!PFljK4Uzm2~{S=e?KJ z#xaXsYA8`fVWR&5g~i`ug2MX2hz`mhvo63hey2uX7z!rE(MO0vYG0>PwxfhElx5+w z=}&)iMnSp_C%yfpUhNUP%9c4fwJDf41#)OMTg0z<`!XwxR#58Z;tCu3ie!WkB?k>@ z=;NDIQ{hO$*i~8-Ei5#MJpV<)o{m&Q;b%!@joNbZINTih0|N)NRs!xE0nJ*XX^=U+ zG92C_xvC*fX$Bn`)9$=>_ERNRcc7~}Z7oeto3{S5?Z|~brs9IMpZ(C0K{urEefc(L zOL&0f?Do0$H)dmH0Sp;9lm6iCODohR5DId1z!8 z1BQ8tq~~YdDEYGXjQTiY;-@&iKf*P)nGhn&F!&gJkVLv7Px=CT&B%Xd}716kUs) z`>FG5c}&w>orbgFGav|)NtYw0opjp^cAUvuqoGRUbh&`lfxiHA)x4zS^ep@987Obc z1(hy$KZo?E&a+C&E-qZ>#eBvFTg z({J%eCbxODh0hqgIWv?YE8K&XDO-c*&YBhZix(23ceetgk}RtZyJG@zd14NQ9=zoG z$WoaxH-zEyX49pEGO~iT_-~UFZjq0u_=tM`U8zp&jifw$Io)4$2jpWW)Gq5gvDAwm zRyn~s45(gOu7sD<@~Z`~(7@fF5!x@WUEkRFLIZYbj7EmlB_z-=dcQRYQY8VtOl!xP zZl%(Yv3mc`8tiHFeirUDReFT5{Was8I!lTH*6OkSBkd0bnYZN5es&5 zH4pLAS@~w~@wn@4uM;Fh$i}bU^6~CdQ4b9=R=cP)mKytxR?^N{(|4ctjOs3ChNPO0 zhewq82+?eXWR=}fk++##N=iDazuSK`e}VrMpriU{JD`=8R+as`{a5oB_+Np4 j4gP=lOJLYLnladnz4K#3&4t=uuM*2hD2msL8i)KJ{j;x) literal 0 HcmV?d00001 From 79fccd8ea39b36fdf3a4774ce1d80cc80711cc5d Mon Sep 17 00:00:00 2001 From: Alex Contini Date: Mon, 4 Dec 2017 21:22:13 -0500 Subject: [PATCH 11/39] update Kublr blurb --- _includes/partner-script.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_includes/partner-script.js b/_includes/partner-script.js index 182734a4ac..d1d3a3963a 100644 --- a/_includes/partner-script.js +++ b/_includes/partner-script.js @@ -460,7 +460,7 @@ name: 'Kublr', logo: 'kublr', link: 'http://kublr.com', - blurb: 'Kublr - Kublr' + blurb: 'Kublr - Accelerate and control the deployment, scaling, monitoring and management of your containerized applications.' }, { type: 3, From ddf231b1add1a47e6acf91e6ab261a3690a7ec55 Mon Sep 17 00:00:00 2001 From: "Sahdev P. Zala" Date: Tue, 5 Dec 2017 14:56:35 -0500 Subject: [PATCH 12/39] Create glossary for node Add node into the glossary. --- _data/glossary/node.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 _data/glossary/node.yaml diff --git a/_data/glossary/node.yaml b/_data/glossary/node.yaml new file mode 100644 index 0000000000..215418266d --- /dev/null +++ b/_data/glossary/node.yaml @@ -0,0 +1,12 @@ +id: node +name: Node +full-link: /docs/concepts/architecture/node +tags: +- cluster +- deployment +- fundamental +- pod +short-description: > + A node is a worker machine in Kubernetes. +long-description: > + A node may be a VM or physical machine, depending on the cluster. From 70d9ec0b6885d3db32f895117be4c983853465f8 Mon Sep 17 00:00:00 2001 From: Brad Topol Date: Tue, 5 Dec 2017 12:18:10 -0800 Subject: [PATCH 13/39] Added glossary entry for Namespace. Signed-off-by: Brad Topol --- _data/glossary/namespace.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 _data/glossary/namespace.yaml diff --git a/_data/glossary/namespace.yaml b/_data/glossary/namespace.yaml new file mode 100644 index 0000000000..6661479620 --- /dev/null +++ b/_data/glossary/namespace.yaml @@ -0,0 +1,9 @@ +id: namespace +name: Namespace +full-link: /docs/concepts/overview/working-with-objects/namespaces +tags: +- fundamental +short-description: > + An abstraction used by Kubernetes to support virtual clusters on the same physical {% glossary_tooltip term_id="cluster" %}. +long-description: > + Namespaces are used to organize objects in a cluster and provide a way to divide cluster resources. Names of resources need to be unique within a namespace, but not across namespaces. From 74f80841af28d7184d5de3248820abf33e44c952 Mon Sep 17 00:00:00 2001 From: Chris Negus Date: Tue, 5 Dec 2017 14:24:36 -0600 Subject: [PATCH 14/39] Created glossary term for image. --- _data/glossary/image.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 _data/glossary/image.yaml diff --git a/_data/glossary/image.yaml b/_data/glossary/image.yaml new file mode 100644 index 0000000000..d6ed55e004 --- /dev/null +++ b/_data/glossary/image.yaml @@ -0,0 +1,9 @@ +id: image +name: Image +tags: +- fundamental +short-description: > + Stored instance of a container that holds a set of software needed to run an application. +long-description: > + A way of packaging software that allows it to be stored in a container registry, pulled to a local system, and run as an application. Meta data is included in the image that can indicate what executable to run, who built it, and other information. + From ae186fcace2f6124aa75392202862ba1e6fc71a4 Mon Sep 17 00:00:00 2001 From: "Sahdev P. Zala" Date: Tue, 5 Dec 2017 15:20:59 -0500 Subject: [PATCH 15/39] Create glossary for node Add node in the existing glossary. --- _data/glossary/node.yaml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/_data/glossary/node.yaml b/_data/glossary/node.yaml index 215418266d..3586dd5ca0 100644 --- a/_data/glossary/node.yaml +++ b/_data/glossary/node.yaml @@ -1,12 +1,13 @@ id: node name: Node full-link: /docs/concepts/architecture/node -tags: -- cluster +aka: +- Minion +related: - deployment +tags: - fundamental -- pod short-description: > A node is a worker machine in Kubernetes. long-description: > - A node may be a VM or physical machine, depending on the cluster. + A worker machine may be a VM or physical machine, depending on the cluster. It has the {% glossary_tooltip text="Services" term_id="service" %} necessary to run {% glossary_tooltip text="Pods" term_id="pod" %} and is managed by the master components. The {% glossary_tooltip text="Services" term_id="service" %} on a node include Docker, kubelet and kube-proxy. From 3af8a42f77323e93f8fa07c065a46cf382ffa417 Mon Sep 17 00:00:00 2001 From: radhikapc Date: Tue, 5 Dec 2017 14:36:54 -0600 Subject: [PATCH 16/39] add a glossary term for network policy --- _data/glossary/network-policy.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 _data/glossary/network-policy.yaml diff --git a/_data/glossary/network-policy.yaml b/_data/glossary/network-policy.yaml new file mode 100644 index 0000000000..08174a74a2 --- /dev/null +++ b/_data/glossary/network-policy.yaml @@ -0,0 +1,14 @@ +id: network-policy +name: Network Policy +full-link: /docs/concepts/services-networking/network-policies/ +aka: + - NetworkPolicy +tags: +- networking +- architecture +- extension +- resource +short-description: > + A specification of how groups of Pods are allowed to communicate with each other and with other network endpoints. +long-description: > + Network Policies help you declaratively configure which Pods are allowed to connect to each other, which namespaces are allowed to communicate, and more specifically which port numbers to enforce each policy on. `NetworkPolicy` resources use labels to select Pods and define rules which specify what traffic is allowed to the selected Pods. Network Policies are implemented by a supported network plugin provided by a network provider. Be aware that creating a network resource without a controller to implement it will have no effect. From aa2f96c10eb85c93fd7939fe784d47b6f40e7c6c Mon Sep 17 00:00:00 2001 From: Jared Date: Tue, 5 Dec 2017 14:37:16 -0600 Subject: [PATCH 17/39] Volume glossary entry https://github.com/kubernetes/website/issues/5993 It's my first stab at a glossary entry. --- _data/glossary/volume.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 _data/glossary/volume.yaml diff --git a/_data/glossary/volume.yaml b/_data/glossary/volume.yaml new file mode 100644 index 0000000000..8ce523282e --- /dev/null +++ b/_data/glossary/volume.yaml @@ -0,0 +1,18 @@ +id: volume +name: Volume +full-link: kubernetes.io/docs/concepts/storage/volumes/ +related: +- pod +- container +- secret +tags: +- core-object +- fundamental +short-description: > + A volume is a directory containing data, which is accessible to the containers in a {% glossary_tooltip text="pod" term_id="pod" %}. +long-description: > + A volume is a directory containing data, which is accessible to the containers in a {% glossary_tooltip text="pod" term_id="pod" %}. + A Kubernetes volume lives as long as the {% glossary_tooltip text="pod" term_id="pod" %} that encloses it. + Consequently, a volume outlives any {% glossary_tooltip text="containers" term_id="container" %} that run within the + {% glossary_tooltip text="pod" term_id="pod" %}, and data is preserved across + {% glossary_tooltip text="container" term_id="container" %} restarts. From 9d6890889f2e66655df30d9f20e4a7ffed7d10d1 Mon Sep 17 00:00:00 2001 From: Jared Date: Tue, 5 Dec 2017 14:41:38 -0600 Subject: [PATCH 18/39] Update volume.yaml --- _data/glossary/volume.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/_data/glossary/volume.yaml b/_data/glossary/volume.yaml index 8ce523282e..9a5cef7063 100644 --- a/_data/glossary/volume.yaml +++ b/_data/glossary/volume.yaml @@ -11,7 +11,6 @@ tags: short-description: > A volume is a directory containing data, which is accessible to the containers in a {% glossary_tooltip text="pod" term_id="pod" %}. long-description: > - A volume is a directory containing data, which is accessible to the containers in a {% glossary_tooltip text="pod" term_id="pod" %}. A Kubernetes volume lives as long as the {% glossary_tooltip text="pod" term_id="pod" %} that encloses it. Consequently, a volume outlives any {% glossary_tooltip text="containers" term_id="container" %} that run within the {% glossary_tooltip text="pod" term_id="pod" %}, and data is preserved across From d11c533bbd6366c595a461301189a2b3e1ac3fc2 Mon Sep 17 00:00:00 2001 From: Jared Date: Tue, 5 Dec 2017 14:48:26 -0600 Subject: [PATCH 19/39] Update volume.yaml --- _data/glossary/volume.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_data/glossary/volume.yaml b/_data/glossary/volume.yaml index 9a5cef7063..60d0fe231e 100644 --- a/_data/glossary/volume.yaml +++ b/_data/glossary/volume.yaml @@ -9,7 +9,7 @@ tags: - core-object - fundamental short-description: > - A volume is a directory containing data, which is accessible to the containers in a {% glossary_tooltip text="pod" term_id="pod" %}. + A directory containing data, accessible to the containers in a {% glossary_tooltip text="pod" term_id="pod" %}. long-description: > A Kubernetes volume lives as long as the {% glossary_tooltip text="pod" term_id="pod" %} that encloses it. Consequently, a volume outlives any {% glossary_tooltip text="containers" term_id="container" %} that run within the From a904f65fa96b4025cdfa5175979683fafc1b322b Mon Sep 17 00:00:00 2001 From: Keith Burdis Date: Tue, 5 Dec 2017 14:57:57 -0600 Subject: [PATCH 20/39] Security Context glossary term --- _data/glossary/security-context.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 _data/glossary/security-context.yaml diff --git a/_data/glossary/security-context.yaml b/_data/glossary/security-context.yaml new file mode 100644 index 0000000000..6311cb283f --- /dev/null +++ b/_data/glossary/security-context.yaml @@ -0,0 +1,9 @@ +id: security-context +name: Security Context +full-link: /docs/concepts/security/ +tags: +- security +short-description: > + The securityContext field defines privilege and access control settings for a Pod or Container, including the runtime uid and gid. +long-description: > + The securityContext field in a {% glossary_tooltip term_id="pod" %} (applying to all containers) or Container (just one) is used to set the user (runAsUser) and group (fsGroup), capabilities, privilege settings and security policies (SELinux/AppArmor/Seccomp) that container processes use. From e87df7ff495c5b06a9b1f5dee5e06afc7f394068 Mon Sep 17 00:00:00 2001 From: Keith Burdis Date: Tue, 5 Dec 2017 14:59:43 -0600 Subject: [PATCH 21/39] Security Context glossary term --- _data/glossary/security-context.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_data/glossary/security-context.yaml b/_data/glossary/security-context.yaml index 6311cb283f..ad36f04a01 100644 --- a/_data/glossary/security-context.yaml +++ b/_data/glossary/security-context.yaml @@ -6,4 +6,4 @@ tags: short-description: > The securityContext field defines privilege and access control settings for a Pod or Container, including the runtime uid and gid. long-description: > - The securityContext field in a {% glossary_tooltip term_id="pod" %} (applying to all containers) or Container (just one) is used to set the user (runAsUser) and group (fsGroup), capabilities, privilege settings and security policies (SELinux/AppArmor/Seccomp) that container processes use. + The securityContext field in a {% glossary_tooltip term_id="pod" %} (applying to all containers) or container (just one) is used to set the user (runAsUser) and group (fsGroup), capabilities, privilege settings and security policies (SELinux/AppArmor/Seccomp) that container processes use. From 029196095cfaf06f4efbfae4179b76495ab18bc2 Mon Sep 17 00:00:00 2001 From: radhikapc Date: Tue, 5 Dec 2017 15:03:34 -0600 Subject: [PATCH 22/39] add glossary term for pod security policy --- _data/glossary/pod-security-policy.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 _data/glossary/pod-security-policy.yaml diff --git a/_data/glossary/pod-security-policy.yaml b/_data/glossary/pod-security-policy.yaml new file mode 100644 index 0000000000..23b03543fc --- /dev/null +++ b/_data/glossary/pod-security-policy.yaml @@ -0,0 +1,16 @@ +id: pod-security-policy +name: Pod +full-link: /docs/concepts/policy/pod-security-policy/ +related: +- container +- sidecar +- deployment +- statefulset +- security +tags: +- core-object +- fundamental +short-description: > + Pod Security Policies enable fine-grained authorization of {% glossary_tooltip term_id="pod" %} creation and updates. +long-description: > + A Pod Security Policy is a cluster-level resource that controls security sensitive aspects of the Pod specification. The `PodSecurityPolicy` objects define a set of conditions that a Pod must run with in order to be accepted into the system, as well as defaults for the related fields. Pod Security Policy control is implemented as an optional admission controller. From 33bf8f8a0b317b4d5ac8ad1395da627e07b75dd3 Mon Sep 17 00:00:00 2001 From: Chris Negus Date: Tue, 5 Dec 2017 15:06:50 -0600 Subject: [PATCH 23/39] Added glossary definition: Replication Controller. --- _data/glossary/replication-controller.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 _data/glossary/replication-controller.yaml diff --git a/_data/glossary/replication-controller.yaml b/_data/glossary/replication-controller.yaml new file mode 100644 index 0000000000..6009b49c8b --- /dev/null +++ b/_data/glossary/replication-controller.yaml @@ -0,0 +1,9 @@ +id: replication-controller +name: Replication Controller +tags: +- fundamental +short-description: > + Kubernetes service that ensures a specific number of instances of a pod are always running. +long-description: > + Will automatically add or remove running instances of a pod, based on a set value for that pod. Allows the pod to return to the defined number of instances if pods are deleted or if too many are started by mistake. + From ab83e87bfd1abdfaa2b06111cd283d269d91c6d0 Mon Sep 17 00:00:00 2001 From: radhikapc Date: Tue, 5 Dec 2017 14:06:36 -0600 Subject: [PATCH 24/39] add a glossary term for Service Account --- _data/glossary/service-account.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 _data/glossary/service-account.yaml diff --git a/_data/glossary/service-account.yaml b/_data/glossary/service-account.yaml new file mode 100644 index 0000000000..ec2df2b38e --- /dev/null +++ b/_data/glossary/service-account.yaml @@ -0,0 +1,10 @@ +id: service-account +name: Service Account +full-link: /docs/tasks/configure-pod-container/configure-service-account/ +tags: +- fundamental +- core-object +short-description: > + A service account provides an identity for processes that run in a Pod {% glossary_tooltip text="Pods" term_id="pod" %}. +long-description: > + When processes inside Pods access the cluster, they are authenticated by the API server as a particular service account, for example, `default`. When you create a Pod, if you do not specify a service account, it is automatically assigned the default service account in the same namespace {% glossary_tooltip text="Namespace" term_id="namespace" %}. From 8c93c578080b37bc8c172fb2b3427a4dec38f083 Mon Sep 17 00:00:00 2001 From: Brad Topol Date: Tue, 5 Dec 2017 13:18:18 -0800 Subject: [PATCH 25/39] Added DaemonSet Entry to the glossary Signed-off-by: Brad Topol --- _data/glossary/daemonset.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 _data/glossary/daemonset.yaml diff --git a/_data/glossary/daemonset.yaml b/_data/glossary/daemonset.yaml new file mode 100644 index 0000000000..09142d4fd6 --- /dev/null +++ b/_data/glossary/daemonset.yaml @@ -0,0 +1,10 @@ +id: daemonset +name: DaemonSet +full-link: /docs/concepts/workloads/controllers/daemonset +tags: +- fundamental +- workload +short-description: > + Ensures a copy of a {% glossary_tooltip term_id="pod" %} is running across a set of nodes in a {% glossary_tooltip term_id="cluster" %}. +long-description: > + Used to deploy system daemons such as log collectors and monitoring agents that typically must run on every {% glossary_tooltip term_id="node" %}. From a18c302ae0c961d8cdd2156e3ed48647d6a31087 Mon Sep 17 00:00:00 2001 From: Ryan McGinnis Date: Tue, 5 Dec 2017 13:20:04 -0800 Subject: [PATCH 26/39] Edits out-of-resource.md - Per #5437, edits "Evicting end-user pods" section to clarify Pod ranks - Semi-comprehensive edit for style and clarity --- .../administer-cluster/out-of-resource.md | 241 +++++++++--------- 1 file changed, 116 insertions(+), 125 deletions(-) diff --git a/docs/tasks/administer-cluster/out-of-resource.md b/docs/tasks/administer-cluster/out-of-resource.md index 02098595df..87e88709ed 100644 --- a/docs/tasks/administer-cluster/out-of-resource.md +++ b/docs/tasks/administer-cluster/out-of-resource.md @@ -9,27 +9,25 @@ title: Configure Out Of Resource Handling * TOC {:toc} +This page explains how to configure out of resource handling with `kubelet`. + The `kubelet` needs to preserve node stability when available compute resources -are low. - -This is especially important when dealing with incompressible resources such as -memory or disk. - -If either resource is exhausted, the node would become unstable. +are low. This is especially important when dealing with incompressible +compute resources, such as memory or disk space. If such resources are exhausted, +nodes become unstable. ## Eviction Policy -The `kubelet` can pro-actively monitor for and prevent against total starvation -of a compute resource. In those cases, the `kubelet` can pro-actively fail one -or more pods in order to reclaim the starved resource. When the `kubelet` fails -a pod, it terminates all containers in the pod, and the `PodPhase` is -transitioned to `Failed`. +The `kubelet` can proactively monitor for and prevent total starvation of a +compute resource. In those cases, the `kubelet` can reclaim the starved +resource by proactively failing one or more Pods. When the `kubelet` fails +a Pod, it terminates all of its containers and transitions its `PodPhase` to `Failed`. ### Eviction Signals -The `kubelet` can support the ability to trigger eviction decisions on the -signals described in the table below. The value of each signal is described in -the description column based on the `kubelet` summary API. +The `kubelet` supports eviction decisions based on the signals described in the following +table. The value of each signal is described in the Description column, which is based on +the `kubelet` summary API. | Eviction Signal | Description | |----------------------------|-----------------------------------------------------------------------| @@ -47,7 +45,7 @@ The value for `memory.available` is derived from the cgroupfs instead of tools like `free -m`. This is important because `free -m` does not work in a container, and if users use the [node allocatable](/docs/tasks/administer-cluster/reserve-compute-resources/#node-allocatable) feature, out of resource decisions -are made local to the end user pod part of the cgroup hierarchy as well as the +are made local to the end user Pod part of the cgroup hierarchy as well as the root node. This [script](/docs/tasks/administer-cluster/out-of-resource/memory-available.sh) reproduces the same set of steps that the `kubelet` performs to calculate @@ -67,64 +65,64 @@ of configurations are not currently supported by the kubelet. For example, it is *not OK* to store volumes and logs in a dedicated `filesystem`. In future releases, the `kubelet` will deprecate the existing [garbage -collection](/docs/concepts/cluster-administration/kubelet-garbage-collection/) support in favor of eviction in -response to disk pressure. +collection](/docs/concepts/cluster-administration/kubelet-garbage-collection/) +support in favor of eviction in response to disk pressure. ### Eviction Thresholds The `kubelet` supports the ability to specify eviction thresholds that trigger the `kubelet` to reclaim resources. -Each threshold is of the following form: +Each threshold has the following form: -`` +`[eviction-signal][operator][quantity]` -* valid `eviction-signal` tokens as defined above. -* valid `operator` tokens are `<` -* valid `quantity` tokens must match the quantity representation used by Kubernetes -* an eviction threshold can be expressed as a percentage if ends with `%` token. +where: -For example, if a node has `10Gi` of memory, and the desire is to induce eviction -if available memory falls below `1Gi`, an eviction threshold can be specified as either -of the following (but not both). +* `eviction-signal` is a eviction signal token as defined in the previous table. +* `operator` is the desired relational operator, such as `<` (less than). +* `quantity` is the eviction threshhold quantity, such as `1Gi`. These tokens must +match the quantity representation used by Kubernetes. An eviction threshold can also +be expressed as a percentage using the `%` token. -* `memory.available<10%` -* `memory.available<1Gi` +For example, if a node has `10Gi` of total memory and you want trigger eviction if +the available memory falls below `1Gi`, you can define the eviction threshold as +either `memory.available<10%` or `memory.available<1Gi`. You cannot use both. #### Soft Eviction Thresholds A soft eviction threshold pairs an eviction threshold with a required -administrator specified grace period. No action is taken by the `kubelet` +administrator-specified grace period. No action is taken by the `kubelet` to reclaim resources associated with the eviction signal until that grace -period has been exceeded. If no grace period is provided, the `kubelet` will -error on startup. +period has been exceeded. If no grace period is provided, the `kubelet` +returns an error on startup. In addition, if a soft eviction threshold has been met, an operator can -specify a maximum allowed pod termination grace period to use when evicting -pods from the node. If specified, the `kubelet` will use the lesser value among +specify a maximum allowed Pod termination grace period to use when evicting +pods from the node. If specified, the `kubelet` uses the lesser value among the `pod.Spec.TerminationGracePeriodSeconds` and the max allowed grace period. -If not specified, the `kubelet` will kill pods immediately with no graceful +If not specified, the `kubelet` kills Pods immediately with no graceful termination. To configure soft eviction thresholds, the following flags are supported: * `eviction-soft` describes a set of eviction thresholds (e.g. `memory.available<1.5Gi`) that if met over a -corresponding grace period would trigger a pod eviction. +corresponding grace period would trigger a Pod eviction. * `eviction-soft-grace-period` describes a set of eviction grace periods (e.g. `memory.available=1m30s`) that -correspond to how long a soft eviction threshold must hold before triggering a pod eviction. +correspond to how long a soft eviction threshold must hold before triggering a Pod eviction. * `eviction-max-pod-grace-period` describes the maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. #### Hard Eviction Thresholds A hard eviction threshold has no grace period, and if observed, the `kubelet` -will take immediate action to reclaim the associated starved resource. If a -hard eviction threshold is met, the `kubelet` will kill the pod immediately +will take immediate action to reclaim the associated starved resource. If a +hard eviction threshold is met, the `kubelet` kills the Pod immediately with no graceful termination. To configure hard eviction thresholds, the following flag is supported: * `eviction-hard` describes a set of eviction thresholds (e.g. `memory.available<1Gi`) that if met -would trigger a pod eviction. +would trigger a Pod eviction. The `kubelet` has the following default hard eviction threshold: @@ -138,10 +136,10 @@ The `kubelet` evaluates eviction thresholds per its configured housekeeping inte ### Node Conditions -The `kubelet` will map one or more eviction signals to a corresponding node condition. +The `kubelet` maps one or more eviction signals to a corresponding node condition. If a hard eviction threshold has been met, or a soft eviction threshold has been met -independent of its associated grace period, the `kubelet` will report a condition that +independent of its associated grace period, the `kubelet` reports a condition that reflects the node is under pressure. The following node conditions are defined that correspond to the specified eviction signal. @@ -151,7 +149,7 @@ The following node conditions are defined that correspond to the specified evict | `MemoryPressure` | `memory.available` | Available memory on the node has satisfied an eviction threshold | | `DiskPressure` | `nodefs.available`, `nodefs.inodesFree`, `imagefs.available`, or `imagefs.inodesFree` | Available disk space and inodes on either the node's root filesytem or image filesystem has satisfied an eviction threshold | -The `kubelet` will continue to report node status updates at the frequency specified by +The `kubelet` continues to report node status updates at the frequency specified by `--node-status-update-frequency` which defaults to `10s`. ### Oscillation of node conditions @@ -174,85 +172,76 @@ condition back to `false`. ### Reclaiming node level resources If an eviction threshold has been met and the grace period has passed, -the `kubelet` will initiate the process of reclaiming the pressured resource +the `kubelet` initiates the process of reclaiming the pressured resource until it has observed the signal has gone below its defined threshold. -The `kubelet` attempts to reclaim node level resources prior to evicting end-user pods. If +The `kubelet` attempts to reclaim node level resources prior to evicting end-user Pods. If disk pressure is observed, the `kubelet` reclaims node level resources differently if the machine has a dedicated `imagefs` configured for the container runtime. -#### With Imagefs +#### With `imagefs` -If `nodefs` filesystem has met eviction thresholds, `kubelet` will free up disk space in the following order: +If `nodefs` filesystem has met eviction thresholds, `kubelet` frees up disk space by deleting the dead Pods and their containers. -1. Delete dead pods/containers +If `imagefs` filesystem has met eviction thresholds, `kubelet` frees up disk space by deleting all unused images. -If `imagefs` filesystem has met eviction thresholds, `kubelet` will free up disk space in the following order: +#### Without `imagefs` +If `nodefs` filesystem has met eviction thresholds, `kubelet` frees up disk space in the following order: + +1. Delete dead Pods and their containers 1. Delete all unused images -#### Without Imagefs +### Evicting end-user Pods -If `nodefs` filesystem has met eviction thresholds, `kubelet` will free up disk space in the following order: +If the `kubelet` is unable to reclaim sufficient resource on the node, `kubelet` begins evicting Pods. -1. Delete dead pods/containers -1. Delete all unused images +The `kubelet` ranks Pods for eviction first by their quality of service, and then by the consumption +of the starved compute resource relative to the Pods' scheduling requests. -### Evicting end-user pods +As a result, `kubectl` ranks and evicts Pods in the following order: -If the `kubelet` is unable to reclaim sufficient resource on the node, -it will begin evicting pods. - -The `kubelet` ranks pods for eviction as follows: - -* by their quality of service. -* by the consumption of the starved compute resource relative to the pods scheduling request. - -As a result, pod eviction occurs in the following order: - -* `BestEffort` pods that consume the most of the starved resource are failed -first. -* `Burstable` pods that consume the greatest amount of the starved resource -relative to their request for that resource are killed first. If no pod +* `BestEffort` Pods consume the most of the starved resource are failed first. +Local disk is a `BestEffort` resource. +* `Burstable` Pods consume the greatest amount of the starved resource +relative to their request for that resource are killed first. If no Pod has exceeded its request, the strategy targets the largest consumer of the starved resource. -* `Guaranteed` pods that consume the greatest amount of the starved resource -relative to their request are killed first. If no pod has exceeded its request, -the strategy targets the largest consumer of the starved resource. - -A `Guaranteed` pod is guaranteed to never be evicted because of another pod's -resource consumption. If a system daemon (i.e. `kubelet`, `docker`, `journald`, etc.) -is consuming more resources than were reserved via `system-reserved` or `kube-reserved` allocations, -and the node only has `Guaranteed` pod(s) remaining, then the node must choose to evict a -`Guaranteed` pod in order to preserve node stability, and to limit the impact -of the unexpected consumption to other `Guaranteed` pod(s). - -Local disk is a `BestEffort` resource. If necessary, `kubelet` will evict pods one at a time to reclaim -disk when `DiskPressure` is encountered. The `kubelet` will rank pods by quality of service. If the `kubelet` -is responding to `inode` starvation, it will reclaim `inodes` by evicting pods with the lowest quality of service -first. If the `kubelet` is responding to lack of available disk, it will rank pods within a quality of service +* `Guaranteed` Pods are guaranteed only when requests and limits are specified +for all the containers and they are equal A `Guaranteed` Pod is guaranteed to +never be evicted because of another Pod's resource consumption. If a system +daemon (such as `kubelet`, `docker`, and `journald`) is consuming more resources +than were reserved via `system-reserved` or `kube-reserved` allocations, and the +node only has `Guaranteed` Pods remaining, then the node must choose to evict a +`Guaranteed` Pod in order to preserve node stability and to limit the impact +of the unexpected consumption to other `Guaranteed` Pods. + +If necessary, `kubelet` evicts Pods one at a time to reclaim disk when `DiskPressure` +is encountered. If the `kubelet` is responding to `inode` starvation, it reclaims +`inodes` by evicting Pods with the lowest quality of service first. If the `kubelet` +is responding to lack of available disk, it ranks Pods within a quality of service that consumes the largest amount of disk and kill those first. -#### With Imagefs +#### With `imagefs` -If `nodefs` is triggering evictions, `kubelet` will sort pods based on the usage on `nodefs` +If `nodefs` is triggering evictions, `kubelet` sorts Pods based on the usage on `nodefs` - local volumes + logs of all its containers. -If `imagefs` is triggering evictions, `kubelet` will sort pods based on the writable layer usage of all its containers. +If `imagefs` is triggering evictions, `kubelet` sorts Pods based on the writable layer usage of all its containers. -#### Without Imagefs +#### Without `imagefs` -If `nodefs` is triggering evictions, `kubelet` will sort pods based on their total disk usage +If `nodefs` is triggering evictions, `kubelet` sorts Pods based on their total disk usage - local volumes + logs & writable layer of all its containers. ### Minimum eviction reclaim -In certain scenarios, eviction of pods could result in reclamation of small amount of resources. This can result in +In certain scenarios, eviction of Pods could result in reclamation of small amount of resources. This can result in `kubelet` hitting eviction thresholds in repeated successions. In addition to that, eviction of resources like `disk`, is time consuming. To mitigate these issues, `kubelet` can have a per-resource `minimum-reclaim`. Whenever `kubelet` observes -resource pressure, `kubelet` will attempt to reclaim at least `minimum-reclaim` amount of resource below +resource pressure, `kubelet` attempts to reclaim at least `minimum-reclaim` amount of resource below the configured eviction threshold. For example, with the following configuration: @@ -262,31 +251,31 @@ For example, with the following configuration: --eviction-minimum-reclaim="memory.available=0Mi,nodefs.available=500Mi,imagefs.available=2Gi"` ``` -If an eviction threshold is triggered for `memory.available`, the `kubelet` will work to ensure -that `memory.available` is at least `500Mi`. For `nodefs.available`, the `kubelet` will work -to ensure that `nodefs.available` is at least `1.5Gi`, and for `imagefs.available` it will -work to ensure that `imagefs.available` is at least `102Gi` before no longer reporting pressure +If an eviction threshold is triggered for `memory.available`, the `kubelet` works to ensure +that `memory.available` is at least `500Mi`. For `nodefs.available`, the `kubelet` works +to ensure that `nodefs.available` is at least `1.5Gi`, and for `imagefs.available` it +works to ensure that `imagefs.available` is at least `102Gi` before no longer reporting pressure on their associated resources. The default `eviction-minimum-reclaim` is `0` for all resources. ### Scheduler -The node will report a condition when a compute resource is under pressure. The +The node reports a condition when a compute resource is under pressure. The scheduler views that condition as a signal to dissuade placing additional pods on the node. | Node Condition | Scheduler Behavior | | ---------------- | ------------------------------------------------ | -| `MemoryPressure` | No new `BestEffort` pods are scheduled to the node. | -| `DiskPressure` | No new pods are scheduled to the node. | +| `MemoryPressure` | No new `BestEffort` Pods are scheduled to the node. | +| `DiskPressure` | No new Pods are scheduled to the node. | ## Node OOM Behavior If the node experiences a system OOM (out of memory) event prior to the `kubelet` is able to reclaim memory, the node depends on the [oom_killer](https://lwn.net/Articles/391222/) to respond. -The `kubelet` sets a `oom_score_adj` value for each container based on the quality of service for the pod. +The `kubelet` sets a `oom_score_adj` value for each container based on the quality of service for the Pod. | Quality of Service | oom_score_adj | |----------------------------|-----------------------------------------------------------------------| @@ -294,7 +283,7 @@ The `kubelet` sets a `oom_score_adj` value for each container based on the quali | `BestEffort` | 1000 | | `Burstable` | min(max(2, 1000 - (1000 * memoryRequestBytes) / machineMemoryCapacityBytes), 999) | -If the `kubelet` is unable to reclaim memory prior to a node experiencing system OOM, the `oom_killer` will calculate +If the `kubelet` is unable to reclaim memory prior to a node experiencing system OOM, the `oom_killer` calculates an `oom_score` based on the percentage of memory it's using on the node, and then add the `oom_score_adj` to get an effective `oom_score` for the container, and then kills the container with the highest score. @@ -302,17 +291,19 @@ The intended behavior should be that containers with the lowest quality of servi are consuming the largest amount of memory relative to the scheduling request should be killed first in order to reclaim memory. -Unlike pod eviction, if a pod container is OOM killed, it may be restarted by the `kubelet` based on its `RestartPolicy`. +Unlike Pod eviction, if a Pod container is OOM killed, it may be restarted by the `kubelet` based on its `RestartPolicy`. ## Best Practices +The following sections describe best practices for out of resource handling. + ### Schedulable resources and eviction policies -Let's imagine the following scenario: +Consider the following scenario: * Node memory capacity: `10Gi` * Operator wants to reserve 10% of memory capacity for system daemons (kernel, `kubelet`, etc.) -* Operator wants to evict pods at 95% memory utilization to reduce thrashing and incidence of system OOM. +* Operator wants to evict Pods at 95% memory utilization to reduce thrashing and incidence of system OOM. To facilitate this scenario, the `kubelet` would be launched as follows: @@ -324,31 +315,30 @@ To facilitate this scenario, the `kubelet` would be launched as follows: Implicit in this configuration is the understanding that "System reserved" should include the amount of memory covered by the eviction threshold. -To reach that capacity, either some pod is using more than its request, or the system is using more than `500Mi`. +To reach that capacity, either some Pod is using more than its request, or the system is using more than `500Mi`. -This configuration will ensure that the scheduler does not place pods on a node that immediately induce memory pressure -and trigger eviction assuming those pods use less than their configured request. +This configuration ensures that the scheduler does not place Pods on a node that immediately induce memory pressure +and trigger eviction assuming those Pods use less than their configured request. ### DaemonSet -It is never desired for a `kubelet` to evict a pod that was derived from -a `DaemonSet` since the pod will immediately be recreated and rescheduled -back to the same node. +It is never desired for a `kubelet` to evict a `DaemonSet` Pod, since the Pod is +immediately recreated and rescheduled back to the same node. -At the moment, the `kubelet` has no ability to distinguish a pod created -from `DaemonSet` versus any other object. If/when that information is -available, the `kubelet` could pro-actively filter those pods from the -candidate set of pods provided to the eviction strategy. +At the moment, the `kubelet` has no ability to distinguish a Pod created +from `DaemonSet` versus any other object. If/when that information is +available, the `kubelet` could pro-actively filter those Pods from the +candidate set of Pods provided to the eviction strategy. In general, it is strongly recommended that `DaemonSet` not -create `BestEffort` pods to avoid being identified as a candidate pod -for eviction. Instead `DaemonSet` should ideally launch `Guaranteed` pods. +create `BestEffort` Pods to avoid being identified as a candidate Pod +for eviction. Instead `DaemonSet` should ideally launch `Guaranteed` Pods. ## Deprecation of existing feature flags to reclaim disk `kubelet` has been freeing up disk space on demand to keep the node stable. -As disk based eviction matures, the following `kubelet` flags will be marked for deprecation +As disk based eviction matures, the following `kubelet` flags are marked for deprecation in favor of the simpler configuration supported around eviction. | Existing Flag | New Flag | @@ -363,26 +353,27 @@ in favor of the simpler configuration supported around eviction. ## Known issues +The following sections describe known issues related to out of resource handling. + ### kubelet may not observe memory pressure right away -The `kubelet` currently polls `cAdvisor` to collect memory usage stats at a regular interval. If memory usage +The `kubelet` currently polls `cAdvisor` to collect memory usage stats at a regular interval. If memory usage increases within that window rapidly, the `kubelet` may not observe `MemoryPressure` fast enough, and the `OOMKiller` -will still be invoked. We intend to integrate with the `memcg` notification API in a future release to reduce this +will still be invoked. We intend to integrate with the `memcg` notification API in a future release to reduce this latency, and instead have the kernel tell us when a threshold has been crossed immediately. If you are not trying to achieve extreme utilization, but a sensible measure of overcommit, a viable workaround for -this issue is to set eviction thresholds at approximately 75% capacity. This increases the ability of this feature +this issue is to set eviction thresholds at approximately 75% capacity. This increases the ability of this feature to prevent system OOMs, and promote eviction of workloads so cluster state can rebalance. -### kubelet may evict more pods than needed +### kubelet may evict more Pods than needed -The pod eviction may evict more pods than needed due to stats collection timing gap. This can be mitigated by adding +The Pod eviction may evict more Pods than needed due to stats collection timing gap. This can be mitigated by adding the ability to get root container stats on an on-demand basis [(https://github.com/google/cadvisor/issues/1247)](https://github.com/google/cadvisor/issues/1247) in the future. -### How kubelet ranks pods for eviction in response to inode exhaustion +### How kubelet ranks Pods for eviction in response to inode exhaustion -At this time, it is not possible to know how many inodes were consumed by a particular container. If the `kubelet` observes -inode exhaustion, it will evict pods by ranking them by quality of service. The following issue has been opened in cadvisor -to track per container inode consumption [(https://github.com/google/cadvisor/issues/1422)](https://github.com/google/cadvisor/issues/1422) which would allow us to rank pods -by inode consumption. For example, this would let us identify a container that created large numbers of 0 byte files, and evict -that pod over others. +At this time, it is not possible to know how many inodes were consumed by a particular container. If the `kubelet` observes +inode exhaustion, it evicts Pods by ranking them by quality of service. The following issue has been opened in cadvisor +to track per container inode consumption [(https://github.com/google/cadvisor/issues/1422)](https://github.com/google/cadvisor/issues/1422) which would allow us to rank Pods +by inode consumption. For example, this would let us identify a container that created large numbers of 0 byte files, and evict that Pod over others. From aa5cb3c2ad3239bf4bebb1c12caf8a337a07cba6 Mon Sep 17 00:00:00 2001 From: radhikapc Date: Tue, 5 Dec 2017 15:21:20 -0600 Subject: [PATCH 27/39] feedback --- _data/glossary/service-account.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_data/glossary/service-account.yaml b/_data/glossary/service-account.yaml index ec2df2b38e..2684bc5e93 100644 --- a/_data/glossary/service-account.yaml +++ b/_data/glossary/service-account.yaml @@ -5,6 +5,6 @@ tags: - fundamental - core-object short-description: > - A service account provides an identity for processes that run in a Pod {% glossary_tooltip text="Pods" term_id="pod" %}. + Provides an identity for processes that run in a Pod {% glossary_tooltip text="Pods" term_id="pod" %}. long-description: > When processes inside Pods access the cluster, they are authenticated by the API server as a particular service account, for example, `default`. When you create a Pod, if you do not specify a service account, it is automatically assigned the default service account in the same namespace {% glossary_tooltip text="Namespace" term_id="namespace" %}. From 2bbcb9e16ca8ae91e2c8526827033ccdc77d8d2b Mon Sep 17 00:00:00 2001 From: radhikapc Date: Tue, 5 Dec 2017 15:29:22 -0600 Subject: [PATCH 28/39] removed resource --- _data/glossary/network-policy.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/_data/glossary/network-policy.yaml b/_data/glossary/network-policy.yaml index 08174a74a2..302c78f289 100644 --- a/_data/glossary/network-policy.yaml +++ b/_data/glossary/network-policy.yaml @@ -7,7 +7,6 @@ tags: - networking - architecture - extension -- resource short-description: > A specification of how groups of Pods are allowed to communicate with each other and with other network endpoints. long-description: > From b025865c186631c33354052a3dcaf6ac6cf2e038 Mon Sep 17 00:00:00 2001 From: Keith Burdis Date: Tue, 5 Dec 2017 15:33:08 -0600 Subject: [PATCH 29/39] Updates. KubeCon 2017. --- _data/glossary/security-context.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/_data/glossary/security-context.yaml b/_data/glossary/security-context.yaml index ad36f04a01..7281a7e6cd 100644 --- a/_data/glossary/security-context.yaml +++ b/_data/glossary/security-context.yaml @@ -1,9 +1,9 @@ id: security-context name: Security Context -full-link: /docs/concepts/security/ +full-link: /docs/tasks/configure-pod-container/security-context/ tags: - security short-description: > - The securityContext field defines privilege and access control settings for a Pod or Container, including the runtime uid and gid. + The securityContext field defines privilege and access control settings for a Pod or Container, including the runtime UID and GID. long-description: > - The securityContext field in a {% glossary_tooltip term_id="pod" %} (applying to all containers) or container (just one) is used to set the user (runAsUser) and group (fsGroup), capabilities, privilege settings and security policies (SELinux/AppArmor/Seccomp) that container processes use. + The securityContext field in a {% glossary_tooltip term_id="pod" %} (applying to all containers) or container is used to set the user (runAsUser) and group (fsGroup), capabilities, privilege settings, and security policies (SELinux/AppArmor/Seccomp) that container processes use. From 52f0b5b540e5da93d830188ae52bf9dac40be454 Mon Sep 17 00:00:00 2001 From: radhikapc Date: Tue, 5 Dec 2017 15:41:23 -0600 Subject: [PATCH 30/39] incorporated the feedback --- _data/glossary/pod-security-policy.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/_data/glossary/pod-security-policy.yaml b/_data/glossary/pod-security-policy.yaml index 23b03543fc..1f23f878d7 100644 --- a/_data/glossary/pod-security-policy.yaml +++ b/_data/glossary/pod-security-policy.yaml @@ -11,6 +11,6 @@ tags: - core-object - fundamental short-description: > - Pod Security Policies enable fine-grained authorization of {% glossary_tooltip term_id="pod" %} creation and updates. + Enables fine-grained authorization of {% glossary_tooltip term_id="pod" %} creation and updates. long-description: > - A Pod Security Policy is a cluster-level resource that controls security sensitive aspects of the Pod specification. The `PodSecurityPolicy` objects define a set of conditions that a Pod must run with in order to be accepted into the system, as well as defaults for the related fields. Pod Security Policy control is implemented as an optional admission controller. + A cluster-level resource that controls security sensitive aspects of the Pod specification. The `PodSecurityPolicy` objects define a set of conditions that a Pod must run with in order to be accepted into the system, as well as defaults for the related fields. Pod Security Policy control is implemented as an optional admission controller. From d23235cb7955bd359bc24cdd8284e5ccd6dae032 Mon Sep 17 00:00:00 2001 From: Ryan McGinnis Date: Tue, 5 Dec 2017 13:47:21 -0800 Subject: [PATCH 31/39] KubeCon 2017: Adds Job glossary term --- _data/glossary/job.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 _data/glossary/job.yaml diff --git a/_data/glossary/job.yaml b/_data/glossary/job.yaml new file mode 100644 index 0000000000..d9629fbc72 --- /dev/null +++ b/_data/glossary/job.yaml @@ -0,0 +1,8 @@ +id: job +name: Job +tags: +- core-object +short-description: > + A finite or batch task that runs to completion. +long-description: > + Creates one or more {% glossary_tooltip term_id="pod" %} objects and ensures that a specified number of them successfully terminate. As Pods successfully complete, the Job tracks the successful completions. From b5345ddde044e93fd2f2546bfd72231aae2a4899 Mon Sep 17 00:00:00 2001 From: Zach Puckett Date: Tue, 5 Dec 2017 15:56:04 -0600 Subject: [PATCH 32/39] add configmap to glossary --- _data/glossary/configmap.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 _data/glossary/configmap.yaml diff --git a/_data/glossary/configmap.yaml b/_data/glossary/configmap.yaml new file mode 100644 index 0000000000..cba89b9062 --- /dev/null +++ b/_data/glossary/configmap.yaml @@ -0,0 +1,13 @@ +id: configmap +name: ConfigMap +full-link: /docs/tasks/configure-pod-container/configmap/ +related: +- pod +- secret +tags: +- core-object +short-description: > + used to store non confidential data in key-value pairs and consumed as environment variables, command-line arguments, or config files in a volume +long-description: > + Allows you to decouple configuration artifacts from image content to keep containerized applications portable. + When storing confidential data use a [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/). From 7c0318ac2510771fa22a5991683c91ed3ab2691d Mon Sep 17 00:00:00 2001 From: Zach Puckett Date: Tue, 5 Dec 2017 15:57:55 -0600 Subject: [PATCH 33/39] fix case --- _data/glossary/configmap.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_data/glossary/configmap.yaml b/_data/glossary/configmap.yaml index cba89b9062..c434a779e5 100644 --- a/_data/glossary/configmap.yaml +++ b/_data/glossary/configmap.yaml @@ -7,7 +7,7 @@ related: tags: - core-object short-description: > - used to store non confidential data in key-value pairs and consumed as environment variables, command-line arguments, or config files in a volume + Used to store non confidential data in key-value pairs and consumed as environment variables, command-line arguments, or config files in a volume long-description: > Allows you to decouple configuration artifacts from image content to keep containerized applications portable. When storing confidential data use a [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/). From 5800f941abe998ce14825eb555684ab472922e2b Mon Sep 17 00:00:00 2001 From: Zach Puckett Date: Tue, 5 Dec 2017 16:27:04 -0600 Subject: [PATCH 34/39] update short description, include volume link --- _data/glossary/configmap.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_data/glossary/configmap.yaml b/_data/glossary/configmap.yaml index c434a779e5..587338ab4e 100644 --- a/_data/glossary/configmap.yaml +++ b/_data/glossary/configmap.yaml @@ -7,7 +7,7 @@ related: tags: - core-object short-description: > - Used to store non confidential data in key-value pairs and consumed as environment variables, command-line arguments, or config files in a volume + Used to store non-confidential data in key-value pairs and consumed as environment variables, command-line arguments, or config files in a {% glossary_tooltip text="volume" term_id="volume" %}. long-description: > Allows you to decouple configuration artifacts from image content to keep containerized applications portable. When storing confidential data use a [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/). From 45527c7732d7b43a0e2cc6b138a7ff1ec7c95601 Mon Sep 17 00:00:00 2001 From: Zach Puckett Date: Tue, 5 Dec 2017 16:28:42 -0600 Subject: [PATCH 35/39] set to singular --- _data/glossary/configmap.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_data/glossary/configmap.yaml b/_data/glossary/configmap.yaml index 587338ab4e..ef308321b6 100644 --- a/_data/glossary/configmap.yaml +++ b/_data/glossary/configmap.yaml @@ -10,4 +10,4 @@ short-description: > Used to store non-confidential data in key-value pairs and consumed as environment variables, command-line arguments, or config files in a {% glossary_tooltip text="volume" term_id="volume" %}. long-description: > Allows you to decouple configuration artifacts from image content to keep containerized applications portable. - When storing confidential data use a [Secrets](https://kubernetes.io/docs/concepts/configuration/secret/). + When storing confidential data use a [Secret](https://kubernetes.io/docs/concepts/configuration/secret/). From 3f8d00a8330920905dea47b2a1eb6e240a67211b Mon Sep 17 00:00:00 2001 From: Zach Puckett Date: Tue, 5 Dec 2017 18:09:15 -0600 Subject: [PATCH 36/39] update description to include additional detail --- _data/glossary/configmap.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/_data/glossary/configmap.yaml b/_data/glossary/configmap.yaml index ef308321b6..b961b734b0 100644 --- a/_data/glossary/configmap.yaml +++ b/_data/glossary/configmap.yaml @@ -7,7 +7,7 @@ related: tags: - core-object short-description: > - Used to store non-confidential data in key-value pairs and consumed as environment variables, command-line arguments, or config files in a {% glossary_tooltip text="volume" term_id="volume" %}. + An API object used to store non-confidential data in key-value pairs. Can be consumed as environment variables, command-line arguments, or config files in a {% glossary_tooltip text="volume" term_id="volume" %}. long-description: > - Allows you to decouple configuration artifacts from image content to keep containerized applications portable. + Allows you to decouple environment-specific configuration from your {% glossary_tooltip text="container images" term_id="container" %}, so that your applications are easily portable. When storing confidential data use a [Secret](https://kubernetes.io/docs/concepts/configuration/secret/). From ee6180449dbebe6a68324c7b84ccd46d13a7409f Mon Sep 17 00:00:00 2001 From: Ryan McGinnis Date: Tue, 5 Dec 2017 18:06:05 -0800 Subject: [PATCH 37/39] Update job.yaml --- _data/glossary/job.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/_data/glossary/job.yaml b/_data/glossary/job.yaml index d9629fbc72..2c0f8c846b 100644 --- a/_data/glossary/job.yaml +++ b/_data/glossary/job.yaml @@ -1,5 +1,6 @@ id: job name: Job +full-link: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/ tags: - core-object short-description: > From 6ab210159bc2bc7161d836f8763ec700a29295ab Mon Sep 17 00:00:00 2001 From: Tony Li Date: Tue, 5 Dec 2017 20:26:21 -0600 Subject: [PATCH 38/39] update name of PSP glossary item (#6601) --- _data/glossary/pod-security-policy.yaml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/_data/glossary/pod-security-policy.yaml b/_data/glossary/pod-security-policy.yaml index 1f23f878d7..5c0b721b48 100644 --- a/_data/glossary/pod-security-policy.yaml +++ b/_data/glossary/pod-security-policy.yaml @@ -1,7 +1,8 @@ id: pod-security-policy -name: Pod +name: Pod Security Policy full-link: /docs/concepts/policy/pod-security-policy/ related: +- pod - container - sidecar - deployment @@ -13,4 +14,6 @@ tags: short-description: > Enables fine-grained authorization of {% glossary_tooltip term_id="pod" %} creation and updates. long-description: > - A cluster-level resource that controls security sensitive aspects of the Pod specification. The `PodSecurityPolicy` objects define a set of conditions that a Pod must run with in order to be accepted into the system, as well as defaults for the related fields. Pod Security Policy control is implemented as an optional admission controller. + A cluster-level resource that controls security sensitive aspects of the Pod specification. + The `PodSecurityPolicy` objects define a set of conditions that a Pod must run with in order to be accepted into the system, as well as defaults for the related fields. + Pod Security Policy control is implemented as an optional admission controller. From 0be58d8d7b69861f2d9835426b457d01448120af Mon Sep 17 00:00:00 2001 From: Ryan McGinnis Date: Wed, 6 Dec 2017 07:22:06 -0800 Subject: [PATCH 39/39] Update job.yaml --- _data/glossary/job.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_data/glossary/job.yaml b/_data/glossary/job.yaml index 2c0f8c846b..c868a68941 100644 --- a/_data/glossary/job.yaml +++ b/_data/glossary/job.yaml @@ -1,6 +1,6 @@ id: job name: Job -full-link: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/ +full-link: /docs/concepts/workloads/controllers/jobs-run-to-completion tags: - core-object short-description: >