From 2d63ee56d87b90cf546e88a88ef742ad1ccb46de Mon Sep 17 00:00:00 2001 From: Iva Koevska Date: Mon, 12 Aug 2019 17:37:13 +0300 Subject: [PATCH 01/74] Applied title case to page title (#15824) Page titles throughout the doc set typically use title case. This one uses sentence case. I've added capitalization to match the common style. --- .../en/docs/concepts/architecture/master-node-communication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/architecture/master-node-communication.md b/content/en/docs/concepts/architecture/master-node-communication.md index be327630fe..8a4493e49b 100644 --- a/content/en/docs/concepts/architecture/master-node-communication.md +++ b/content/en/docs/concepts/architecture/master-node-communication.md @@ -3,7 +3,7 @@ reviewers: - dchen1107 - roberthbailey - liggitt -title: Master-Node communication +title: Master-Node Communication content_template: templates/concept weight: 20 --- From 3bea36ba16244d3d85c07fb67525e56ec77940dc Mon Sep 17 00:00:00 2001 From: Alvaro Aleman Date: Mon, 12 Aug 2019 20:15:13 +0200 Subject: [PATCH 02/74] Api deprecation blogpost: Include minimum kube version for ingress from networking apigroup (#15740) --- .../blog/_posts/2019-07-18-some-apis-are-being-deprecated.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/blog/_posts/2019-07-18-some-apis-are-being-deprecated.md b/content/en/blog/_posts/2019-07-18-some-apis-are-being-deprecated.md index 549dfdb72f..bc9a3f3e15 100644 --- a/content/en/blog/_posts/2019-07-18-some-apis-are-being-deprecated.md +++ b/content/en/blog/_posts/2019-07-18-some-apis-are-being-deprecated.md @@ -34,8 +34,8 @@ from **extensions/v1beta1**, **apps/v1beta1**, or **apps/v1beta2** in **v1.16**. * Migrate to the apps/v1 API, available since v1.9. Existing persisted data can be retrieved/updated via the apps/v1 API. * Ingress: will no longer be served from **extensions/v1beta1** in **v1.18**. - * Migrate to the networking.k8s.io/v1beta1 API. Existing persisted data can be - retrieved/updated via the networking.k8s.io/v1beta1 API. + * Migrate to the networking.k8s.io/v1beta1 API, serving Ingress since v1.14. + Existing persisted data can be retrieved/updated via the networking.k8s.io/v1beta1 API. # What To Do From 11f8368834f71d01de0428c9944104a38d0a2a88 Mon Sep 17 00:00:00 2001 From: David Ricordel Date: Tue, 13 Aug 2019 10:59:41 +0200 Subject: [PATCH 03/74] =?UTF-8?q?Change=20the=20translationfor=20logging?= =?UTF-8?q?=20to=20journalistion=20des=20=C2=B4v=C3=A8nements=20(#15330)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../cluster-administration/cluster-administration-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/concepts/cluster-administration/cluster-administration-overview.md b/content/fr/docs/concepts/cluster-administration/cluster-administration-overview.md index 61cfc62f4f..f0ce6315e8 100644 --- a/content/fr/docs/concepts/cluster-administration/cluster-administration-overview.md +++ b/content/fr/docs/concepts/cluster-administration/cluster-administration-overview.md @@ -63,5 +63,5 @@ A noter: Toutes les distributions ne sont pas activement maintenues. Choisissez * [Integration DNS](/docs/concepts/services-networking/dns-pod-service/) décrit comment résoudre un nom DNS directement vers un service Kubernetes. -* [Journalisation et surveillance de l'activité du cluster](/docs/concepts/cluster-administration/logging/) explique le fonctionnement de la connexion à Kubernetes et son implémentation. +* [Journalisation des évènements et surveillance de l'activité du cluster](/docs/concepts/cluster-administration/logging/) explique le fonctionnement de la journalisation des évènements dans Kubernetes et son implémentation. {{% /capture %}} From cc5060da2238777afaf4654c77405c3f88583c3f Mon Sep 17 00:00:00 2001 From: Bill Mulligan Date: Tue, 13 Aug 2019 15:45:42 +0200 Subject: [PATCH 04/74] spelling and grammar corrections (#15837) --- content/en/docs/concepts/security/overview.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/security/overview.md b/content/en/docs/concepts/security/overview.md index fea67957d1..bcec8727f9 100644 --- a/content/en/docs/concepts/security/overview.md +++ b/content/en/docs/concepts/security/overview.md @@ -75,9 +75,9 @@ consult your documentation for security best practices. Area of Concern for Kubernetes Infrastructure | Recommendation | --------------------------------------------- | ------------ | Network access to API Server (Masters) | Ideally all access to the Kubernetes Masters is not allowed publicly on the internet and is controlled by network access control lists restricted to the set of IP addresses needed to administer the cluster.| -Network access to Nodes (Worker Servers) | Nodes should be configured to _only_ accept connections (via network access control lists) from the masters on the specified ports, and accept connections for services in Kubernetes of type NodePort and LoadBalancer. If possible, this nodes should not exposed on the public internet entirely. +Network access to Nodes (Worker Servers) | Nodes should be configured to _only_ accept connections (via network access control lists) from the masters on the specified ports, and accept connections for services in Kubernetes of type NodePort and LoadBalancer. If possible, these nodes should not be exposed on the public internet entirely. Kubernetes access to Cloud Provider API | Each cloud provider will need to grant a different set of permissions to the Kubernetes Masters and Nodes, so this recommendation will be more generic. It is best to provide the cluster with cloud provider access that follows the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege) for the resources it needs to administer. An example for Kops in AWS can be found here: https://github.com/kubernetes/kops/blob/master/docs/iam_roles.md#iam-roles -Access to etcd | Access to etcd (the datastore of Kubernetes) should be limited to the masters only. Depending on your configuration you should also attempt to use etcd over TLS. More info can be found here: https://github.com/etcd-io/etcd/tree/master/Documentation#security +Access to etcd | Access to etcd (the datastore of Kubernetes) should be limited to the masters only. Depending on your configuration, you should also attempt to use etcd over TLS. More info can be found here: https://github.com/etcd-io/etcd/tree/master/Documentation#security etcd Encryption | Wherever possible it's a good practice to encrypt all drives at rest, but since etcd holds the state of the entire cluster (including Secrets) its disk should especially be encrypted at rest. ## Cluster From 38312e0cc3ad1b5b78ffea85fce52a21a504d5a3 Mon Sep 17 00:00:00 2001 From: ponypaver Date: Tue, 13 Aug 2019 23:51:42 +0800 Subject: [PATCH 05/74] Update service.md (#15738) adjust grammer --- content/en/docs/concepts/services-networking/service.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/services-networking/service.md b/content/en/docs/concepts/services-networking/service.md index 4800af5628..2a8e23dc7d 100644 --- a/content/en/docs/concepts/services-networking/service.md +++ b/content/en/docs/concepts/services-networking/service.md @@ -356,7 +356,7 @@ that are configured for a specific IP address and difficult to re-configure. The IP address that you choose must be a valid IPv4 or IPv6 address from within the `service-cluster-ip-range` CIDR range that is configured for the API server. If you try to create a Service with an invalid clusterIP address value, the API -server will returns a 422 HTTP status code to indicate that there's a problem. +server will return a 422 HTTP status code to indicate that there's a problem. ## Discovering services From efed54c79a151af15517b3ef456e823bd747c044 Mon Sep 17 00:00:00 2001 From: Jared Date: Tue, 13 Aug 2019 09:18:43 -0700 Subject: [PATCH 06/74] Fixed broken link --- content/en/docs/contribute/advanced.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/contribute/advanced.md b/content/en/docs/contribute/advanced.md index 799dff3082..ca293b1a43 100644 --- a/content/en/docs/contribute/advanced.md +++ b/content/en/docs/contribute/advanced.md @@ -177,7 +177,7 @@ SIG Docs [approvers](/docs/contribute/participating/#approvers) can serve a term Approvers must meet the following requirements to be a co-chair: - Have been a SIG Docs approver for at least 6 months -- Have [led a Kubernetes docs release][coordinate-docs-for-a-kubernetes-release] or shadowed two releases +- Have [led a Kubernetes docs release][/docs/contribute/advanced/#coordinate-docs-for-a-kubernetes-release] or shadowed two releases - Understand SIG Docs workflows and tooling: git, Hugo, localization, blog subproject - Understand how other Kubernetes SIGs and repositories affect the SIG Docs workflow, including: [teams in k/org](https://github.com/kubernetes/org/blob/master/config/kubernetes/sig-docs/teams.yaml), [process in k/community](https://github.com/kubernetes/community/tree/master/sig-docs), plugins in [k/test-infra](https://github.com/kubernetes/test-infra/), and the role of [SIG Architecture](https://github.com/kubernetes/community/tree/master/sig-architecture). - Commit at least 5 hours per week (and often more) to the role for a minimum of 6 months From a02fea5330f5bd3a1b94bd49d05f306bee4ff885 Mon Sep 17 00:00:00 2001 From: Jared Date: Tue, 13 Aug 2019 09:20:16 -0700 Subject: [PATCH 07/74] Update link --- content/en/docs/contribute/advanced.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/contribute/advanced.md b/content/en/docs/contribute/advanced.md index ca293b1a43..bb06be99bf 100644 --- a/content/en/docs/contribute/advanced.md +++ b/content/en/docs/contribute/advanced.md @@ -177,7 +177,7 @@ SIG Docs [approvers](/docs/contribute/participating/#approvers) can serve a term Approvers must meet the following requirements to be a co-chair: - Have been a SIG Docs approver for at least 6 months -- Have [led a Kubernetes docs release][/docs/contribute/advanced/#coordinate-docs-for-a-kubernetes-release] or shadowed two releases +- Have [led a Kubernetes docs release](/docs/contribute/advanced/#coordinate-docs-for-a-kubernetes-release) or shadowed two releases - Understand SIG Docs workflows and tooling: git, Hugo, localization, blog subproject - Understand how other Kubernetes SIGs and repositories affect the SIG Docs workflow, including: [teams in k/org](https://github.com/kubernetes/org/blob/master/config/kubernetes/sig-docs/teams.yaml), [process in k/community](https://github.com/kubernetes/community/tree/master/sig-docs), plugins in [k/test-infra](https://github.com/kubernetes/test-infra/), and the role of [SIG Architecture](https://github.com/kubernetes/community/tree/master/sig-architecture). - Commit at least 5 hours per week (and often more) to the role for a minimum of 6 months From 4d14e98b08996a6f7fee99eb62eb3c9fc0ceb663 Mon Sep 17 00:00:00 2001 From: Oz N Tiram Date: Tue, 13 Aug 2019 22:53:41 +0200 Subject: [PATCH 08/74] Fix syntax broken highlighting (#15830) Hugo's highlighter does not understand a variable name with angle brackets, and breaks the coloring. --- content/en/examples/admin/cloud/ccm-example.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/examples/admin/cloud/ccm-example.yaml b/content/en/examples/admin/cloud/ccm-example.yaml index e49413e4cc..20aafb31e5 100644 --- a/content/en/examples/admin/cloud/ccm-example.yaml +++ b/content/en/examples/admin/cloud/ccm-example.yaml @@ -47,7 +47,7 @@ spec: image: k8s.gcr.io/cloud-controller-manager:v1.8.0 command: - /usr/local/bin/cloud-controller-manager - - --cloud-provider= # Add your own cloud provider here! + - --cloud-provider=[YOUR_CLOUD_PROVIDER] # Add your own cloud provider here! - --leader-elect=true - --use-service-account-credentials # these flags will vary for every cloud provider From 099ed49cea50450ceb414adfabf50ce4702a2b2d Mon Sep 17 00:00:00 2001 From: Roy Lenferink Date: Wed, 14 Aug 2019 00:54:24 +0300 Subject: [PATCH 09/74] Added mattiaperi as Italian reviewer/approver & sorted Italian teams (#15850) --- OWNERS_ALIASES | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index 3e8f3b1532..49c3cd26d3 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -114,11 +114,13 @@ aliases: - girikuncoro - irvifa sig-docs-it-owners: # Admins for Italian content - - rlenferink + - mattiaperi - micheleberardi + - rlenferink sig-docs-it-reviews: # PR reviews for Italian content - - rlenferink + - mattiaperi - micheleberardi + - rlenferink sig-docs-ja-owners: # Admins for Japanese content - cstoku - nasa9084 From ac7cd02a6f9681d2da22b6c04b12428c5d3aaaae Mon Sep 17 00:00:00 2001 From: Jane Xie <987489055@qq.com> Date: Wed, 14 Aug 2019 11:16:23 +0800 Subject: [PATCH 10/74] translate supported-doc-versions (#15838) * translate supported-doc-versions * fix problems --- .../zh/docs/home/supported-doc-versions.md | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 content/zh/docs/home/supported-doc-versions.md diff --git a/content/zh/docs/home/supported-doc-versions.md b/content/zh/docs/home/supported-doc-versions.md new file mode 100644 index 0000000000..eae8ac97b1 --- /dev/null +++ b/content/zh/docs/home/supported-doc-versions.md @@ -0,0 +1,29 @@ +--- +title: Kubernetes 文档支持的版本 +content_template: templates/concept +card: + name: about + weight: 10 + title: Kubernetes 文档支持的版本 +--- + +{{% capture overview %}} + +本网站包含了当前最新版本和之前四个版本的 Kubernetes。 + +{{% /capture %}} + +{{% capture body %}} + +## 当前最新版本 + +当前版本是 +[{{< param "version" >}}](/)。 + +## 往期版本 + +{{< versions-other >}} + +{{% /capture %}} + + From d1ce52703e1af2437ffaa5546c272d4475cb8d35 Mon Sep 17 00:00:00 2001 From: "Dr. Stefan Schimanski" Date: Wed, 14 Aug 2019 06:48:24 +0200 Subject: [PATCH 11/74] blog-structual-schema: fix oneOf in example spec (#15816) --- ...06-20-Future-of-CRDs-Structural-Schemas.md | 22 ++++++++++++------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/content/en/blog/_posts/2019-06-20-Future-of-CRDs-Structural-Schemas.md b/content/en/blog/_posts/2019-06-20-Future-of-CRDs-Structural-Schemas.md index 38f0e39a9e..b8eaecaf27 100644 --- a/content/en/blog/_posts/2019-06-20-Future-of-CRDs-Structural-Schemas.md +++ b/content/en/blog/_posts/2019-06-20-Future-of-CRDs-Structural-Schemas.md @@ -68,6 +68,8 @@ properties: properties command: type: string + shell: + type: string machines: type: array items: @@ -92,14 +94,14 @@ properties: shell: type: string minLength: 1 # value validation - oneOf: # value validation - - required: [“command”] # value validation - - required: [“shell”] # value validation machines: type: array items: type: string pattern: “^[a-z0-9]+(-[a-z0-9]+)*$” # value validation + oneOf: # value validation + - required: [“command”] # value validation + - required: [“shell”] # value validation required: [“spec”] # value validation ``` @@ -130,16 +132,20 @@ properties: shell: type: string minLength: 1 - oneOf: - - type: string - required: [“command”] - - type: string - required: [“shell”] machines: type: array items: type: string pattern: “^[a-z0-9]+(-[a-z0-9]+)*$” + oneOf: + - properties: + command: + type: string + required: [“command”] + - properties: + shell: + type: string + required: [“shell”] not: properties: privileged: {} From 93eb490719d4876a632a504c202fea8e1a066711 Mon Sep 17 00:00:00 2001 From: Ryan Zidago <46972947+ryanzidago@users.noreply.github.com> Date: Wed, 14 Aug 2019 10:52:26 +0200 Subject: [PATCH 12/74] docs-fr | reference | glossary | container-env-variables.md (#15243) * docs-fr | reference | glossary | container-env-variables.md * fixed typo in title --- .../glossary/container-env-variables.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100755 content/fr/docs/reference/glossary/container-env-variables.md diff --git a/content/fr/docs/reference/glossary/container-env-variables.md b/content/fr/docs/reference/glossary/container-env-variables.md new file mode 100755 index 0000000000..750e8ed3cb --- /dev/null +++ b/content/fr/docs/reference/glossary/container-env-variables.md @@ -0,0 +1,17 @@ +--- +title: Variables d'Environnement de Conteneur +id: container-env-variables +date: 2018-04-12 +full_link: /docs/concepts/containers/container-environment-variables/ +short_description: > + Les variables d'environnement de conteneur sont des paires nom=valeur qui fournissent des informations utiles aux conteneurs fonctionnant au sein d'un Pod. + +aka: +tags: +- fundamental +--- + Les variables d'environnement de conteneur sont des paires nom=valeur qui fournissent des informations utiles aux conteneurs fonctionnant au sein d'un Pod. + + + +Les variables d'environnement de conteneur fournissent les informations requises par les applications conteneurisées en cours d'exécution, ainsi que des informations sur les ressources importantes aux {{< glossary_tooltip text="Conteneurs" term_id="container" >}} comme les détails du système de fichiers, les informations sur le conteneur lui-même et d'autres ressources du cluster telles que les terminaux de services par exemple. From 5cd1b3b737911eaed6fc4232a399adf1a1cdd133 Mon Sep 17 00:00:00 2001 From: Ryan Zidago <46972947+ryanzidago@users.noreply.github.com> Date: Wed, 14 Aug 2019 10:58:25 +0200 Subject: [PATCH 13/74] docs-fr | reference | glossary | control-plane.md (#15266) --- content/fr/docs/reference/glossary/control-plane.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 content/fr/docs/reference/glossary/control-plane.md diff --git a/content/fr/docs/reference/glossary/control-plane.md b/content/fr/docs/reference/glossary/control-plane.md new file mode 100644 index 0000000000..bd9660f412 --- /dev/null +++ b/content/fr/docs/reference/glossary/control-plane.md @@ -0,0 +1,13 @@ +--- +title: Plan de Contrôle +id: control-plane +date: 2019-05-12 +full_link: +short_description: > + Couche d'orchestration des conteneurs exposant l'API et les interfaces pour définir, déployer et gérer le cycle de vie des conteneurs. + +aka: +tags: +- fundamental +--- + Couche d'orchestration des conteneurs exposant l'API et les interfaces pour définir, déployer et gérer le cycle de vie des conteneurs. From d09ab8c562736a9ed89d475c5c79639b412851a6 Mon Sep 17 00:00:00 2001 From: Ryan Zidago <46972947+ryanzidago@users.noreply.github.com> Date: Wed, 14 Aug 2019 11:00:26 +0200 Subject: [PATCH 14/74] docs-fr | reference | glossary | controller.md (#15269) * docs-fr | reference | glossary | controller.md * fixed typo --- .../fr/docs/reference/glossary/controller.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100755 content/fr/docs/reference/glossary/controller.md diff --git a/content/fr/docs/reference/glossary/controller.md b/content/fr/docs/reference/glossary/controller.md new file mode 100755 index 0000000000..19eaeb236f --- /dev/null +++ b/content/fr/docs/reference/glossary/controller.md @@ -0,0 +1,18 @@ +--- +title: Contrôleur +id: controller +date: 2018-04-12 +full_link: /docs/admin/kube-controller-manager/ +short_description: > + Boucle de contrôle surveillant l'état partagé du cluster à travers l'apiserver et effectuant des changements en essayant de déplacer l'état actuel vers l'état désiré. + +aka: +tags: +- architecture +- fundamental +--- + Boucle de contrôle surveillant l'état partagé du cluster à travers l'{{< glossary_tooltip text="apiserver" term_id="kube-apiserver" >}} et effectuant des changements en essayant de déplacer l'état actuel vers l'état désiré. + + + +Parmis les contrôleurs livrés aujourd'hui avec Kubernetes se trouvent le contrôleur de réplication, le contrôleur d'endpoints, de namespace et de serviceaccounts. From 1bcc5b659d9f0fcfd445e285d7722c4000970dd1 Mon Sep 17 00:00:00 2001 From: Ryan Zidago <46972947+ryanzidago@users.noreply.github.com> Date: Wed, 14 Aug 2019 11:06:27 +0200 Subject: [PATCH 15/74] docs-fr | reference | glossary | csi.md (#15322) * docs-fr | reference | glossary | csi.md * Update content/fr/docs/reference/glossary/csi.md --- content/fr/docs/reference/glossary/csi.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 content/fr/docs/reference/glossary/csi.md diff --git a/content/fr/docs/reference/glossary/csi.md b/content/fr/docs/reference/glossary/csi.md new file mode 100644 index 0000000000..58a1eb0956 --- /dev/null +++ b/content/fr/docs/reference/glossary/csi.md @@ -0,0 +1,21 @@ +--- +title: Interface de Stockage de Conteneurs (CSI) +id: csi +date: 2018-06-25 +full_link: /docs/concepts/storage/volumes/#csi +short_description: > + L'Interface de Stockage de Conteneurs (CSI, de l'anglais Container Storage Interface) définit une interface normalisée pour exposer les systèmes de stockage aux conteneurs. + + +aka: +tags: +- storage +--- + L'Interface de Stockage de Conteneurs, (CSI, de l'anglais Container Storage Interface) définit une interface normalisée pour exposer les systèmes de stockage aux conteneurs. + + + +L'Interface de Stockage de Conteneurs permet aux fournisseurs de créer des plugins de stockage personnalisés pour Kubernetes, sans les ajouter au référentiel Kubernetes (plugin hors arbre). Afin d'utiliser un pilote d'Interface de Stockage de Conteneurs d'un fournisseur de mémoire, vous devez d'abord [le déployer sur votre cluster](https://kubernetes-csi.github.io/docs/deploying.html). Vous pourrez alors créer une {{< glossary_tooltip text="Classe de Stockage" term_id="storage-class" >}} qui utilise le pilote de cette Interface de Stockage de Conteneurs. + +* [L'Interface de Stockage de Conteneurs dans la documentation de Kubernetes](/docs/concepts/storage/volumes/#csi) +* [Liste des pilotes d'Interface de Stockage de Conteneurs](https://kubernetes-csi.github.io/docs/drivers.html) From b0638cd82f9c63b81c23438d763487187c03356b Mon Sep 17 00:00:00 2001 From: Ryan Zidago <46972947+ryanzidago@users.noreply.github.com> Date: Wed, 14 Aug 2019 11:08:24 +0200 Subject: [PATCH 16/74] docs-fr | docs | reference | glossary | configmap.md (#15223) --- content/fr/docs/reference/glossary/configmap.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100755 content/fr/docs/reference/glossary/configmap.md diff --git a/content/fr/docs/reference/glossary/configmap.md b/content/fr/docs/reference/glossary/configmap.md new file mode 100755 index 0000000000..04ca564a8b --- /dev/null +++ b/content/fr/docs/reference/glossary/configmap.md @@ -0,0 +1,17 @@ +--- +title: ConfigMap +id: configmap +date: 2018-04-12 +full_link: /docs/tasks/configure-pod-container/configure-pod-configmap/ +short_description: > + Un objet API utilisé pour stocker des données non confidentielles dans des paires clé-valeur. Peut être utilisé comme variable d'environnement, argument de ligne de commande ou fichier de configuration dans un volume. + +aka: +tags: +- core-object +--- + Un objet API utilisé pour stocker des données non confidentielles dans des paires clé-valeur. Peut être utilisé comme variable d'environnement, argument de ligne de commande ou fichier de configuration dans un {{< glossary_tooltip text="volume" term_id="volume" >}}. + + + +Permet de dissocier la configuration spécifique à l'environnement de vos {{< glossary_tooltip text="images de conteneurs" term_id="container" >}}, de sorte que vos applications soient facilement portable. Lorsque vous stockez des données confidentielles, utilisez un [Secret](/docs/concepts/configuration/secret/). From 7011e3acea90d8ebf7c5f25b519a85ebc5e81766 Mon Sep 17 00:00:00 2001 From: Ryan Zidago <46972947+ryanzidago@users.noreply.github.com> Date: Wed, 14 Aug 2019 11:22:26 +0200 Subject: [PATCH 17/74] translated glossary/applications.md from en to fr (#15070) --- content/fr/docs/reference/glossary/applications.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 content/fr/docs/reference/glossary/applications.md diff --git a/content/fr/docs/reference/glossary/applications.md b/content/fr/docs/reference/glossary/applications.md new file mode 100644 index 0000000000..6f2124e855 --- /dev/null +++ b/content/fr/docs/reference/glossary/applications.md @@ -0,0 +1,13 @@ +--- +title: Applications +id: appplications +date: 2019-05-12 +full_link: +short_description: > + La couche où s'exécutent diverses applications conteneurisées. + +aka: +tags: +- fundamental +--- + La couche où s'exécutent diverses applications conteneurisées. From 24eee4265e09bbd102a846fe596e73cdf8798ffa Mon Sep 17 00:00:00 2001 From: Thibaut Tauveron Date: Wed, 14 Aug 2019 17:00:27 +0200 Subject: [PATCH 18/74] docs-fr | concepts | storage | volumes.md (#15826) --- content/fr/docs/concepts/storage/volumes.md | 1250 +++++++++++++++++++ 1 file changed, 1250 insertions(+) create mode 100644 content/fr/docs/concepts/storage/volumes.md diff --git a/content/fr/docs/concepts/storage/volumes.md b/content/fr/docs/concepts/storage/volumes.md new file mode 100644 index 0000000000..3a5e748090 --- /dev/null +++ b/content/fr/docs/concepts/storage/volumes.md @@ -0,0 +1,1250 @@ +--- +title: Volumes +content_template: templates/concept +weight: 10 +--- + +{{% capture overview %}} + +Les fichiers sur disque dans un conteneur sont éphémères, ce qui présente des problèmes pour +des applications non-triviales lorsqu'elles s'exécutent dans des conteneurs. Premièrement, lorsqu'un +conteneur plante, kubelet va le redémarrer mais les fichiers seront perdus - le conteneur démarre +avec un état propre. Deuxièmement, lorsque plusieurs conteneurs s'exécutent ensemble dans un `Pod`, +il est souvent nécessaire de partager des fichiers entre ces conteneurs. L'abstraction Kubernetes +`Volume` résout ces deux problèmes. + +Une connaissance des [Pods](/fr/docs/concepts/workloads/pods/pod) est suggérée. + +{{% /capture %}} + +{{% capture body %}} + +## Contexte + +Docker a également un concept de [volumes](https://docs.docker.com/engine/admin/volumes/), bien qu'il +soit, dans une certaine mesure, plus relâché et moins géré. +Avec Docker, un volume est simplement un dossier sur le disque ou dans un autre conteneur. +Les durées de vie ne sont pas gérées et, jusqu'à très récemment, seuls les volumes supportés par un disque local l'étaient. +Docker fournit maintenant des pilotes de volume, mais la fonctionnalité est très limitée pour le moment (par exemple, à partir de Docker 1.7, seulement un pilote de volume est autorisé par conteneur et il n'est pas possible de passer des paramètres aux volumes). + +Un volume Kubernetes, en revanche, a une durée de vie explicite - la même que le Pod qui l'inclut. +Par conséquent, un volume survit aux conteneurs qui s'exécutent à l'intérieur du Pod et les données sont préservées lorsque le conteneur redémarre. +Bien sûr, lorsqu'un Pod cesse d'exister, le volume va également cesser d'exister. +Peut-être plus important encore, Kubernetes supporte de nombreux types de volumes et un Pod peut en utiliser plusieurs simultanément. + +À la base, un volume est juste un dossier, contenant possiblement des données, qui est accessible aux conteneurs dans un Pod. La manière dont ce dossier est créé, le support qui le sauvegarde et son contenu sont déterminés par le type de volume utilisé. + +Pour utiliser un volume, un Pod spécifie les volumes à fournir au Pod (le champ `.spec.volumes`) +et où les monter dans les conteneurs (le champ `.spec.containers.volumeMounts`). + +Un processus dans un conteneur a une vue système de fichiers composée de son image et de ses volumes Docker. +L'[image Docker](https://docs.docker.com/userguide/dockerimages/) est à la racine de la hiérarchie du système de fichiers et tous les volumes sont montés sur les chemins spécifiés dans l'image. +Les volumes ne peuvent pas être montés sur d'autres volumes ou avoir des liens physiques vers d'autres volumes. +Chaque conteneur dans le Pod doit spécifier indépendamment où monter chaque volume. + +## Types de Volumes + +Kubernetes supporte plusieurs types de Volumes: + + * [awsElasticBlockStore](#awselasticblockstore) + * [azureDisk](#azuredisk) + * [azureFile](#azurefile) + * [cephfs](#cephfs) + * [cinder](#cinder) + * [configMap](#configmap) + * [csi](#csi) + * [downwardAPI](#downwardapi) + * [emptyDir](#emptydir) + * [fc (fibre channel)](#fc) + * [flexVolume](#flexVolume) + * [flocker](#flocker) + * [gcePersistentDisk](#gcepersistentdisk) + * [gitRepo (deprecated)](#gitrepo) + * [glusterfs](#glusterfs) + * [hostPath](#hostpath) + * [iscsi](#iscsi) + * [local](#local) + * [nfs](#nfs) + * [persistentVolumeClaim](#persistentvolumeclaim) + * [projected](#projected) + * [portworxVolume](#portworxvolume) + * [quobyte](#quobyte) + * [rbd](#rbd) + * [scaleIO](#scaleio) + * [secret](#secret) + * [storageos](#storageos) + * [vsphereVolume](#vspherevolume) + +Toute contribution supplémentaire est la bienvenue. + +### awsElasticBlockStore {#awselasticblockstore} + +Un type de volume `awsElasticBlockStore` monte un [Volume EBS](http://aws.amazon.com/ebs/) d'Amazon Web Services (AWS) dans un Pod. +À la différence de `emptyDir`, qui est écrasé lorsqu'un Pod est supprimé, le contenu d'un volume EBS +est préservé et le volume est seulement démonté. Cela signifie qu'un volume EBS peut être prérempli avec des données et que les données peuvent être transmises entre les Pods. + +{{< caution >}} +Vous devez créer un volume EBS avec la commande `aws ec2 create-volume` ou l'API AWS avant de pouvoir l'utiliser. +{{< /caution >}} + +Des restrictions existent lorsque l'on utilise un volume `awsElasticBlockStore` : + +* les nœuds dans lesquels les Pods s'exécutent doivent être des instances AWS EC2 +* ces instances doivent être dans la même région et la même zone de disponibilité que le volume EBS +* EBS supporte uniquement le montage d'un volume par une seule instance EC2 + +#### Création d'un volume EBS + +Avant que vous puissiez utiliser un volume EBS dans un Pod, vous devez le créer. + +```shell +aws ec2 create-volume --availability-zone=eu-west-1a --size=10 --volume-type=gp2 +``` + +Assurez-vous que la zone correspond à la zone de votre grappe de serveurs (cluster). +(Et vérifiez aussi que la taille et le type du volume EBS conviennent à votre utilisation!) + +#### Exemple de configuration AWS EBS + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-ebs +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-container + volumeMounts: + - mountPath: /test-ebs + name: test-volume + volumes: + - name: test-volume + # Ce volume AWS EBS doit déjà exister. + awsElasticBlockStore: + volumeID: + fsType: ext4 +``` + +#### Migration CSI + +{{< feature-state for_k8s_version="v1.14" state="alpha" >}} + +La fonctionnalité de migration CSI pour awsElasticBlockStore, lorsque activée, fixe toutes les opérations de plugin depuis le plugin "in-tree" vers le pilote de l'interface CSI (Container Storage Interface) `ebs.csi.aws.com`. +Afin d'utiliser cette fonctionnalité, le [Pilote AWS EBS CSI](https://github.com/kubernetes-sigs/aws-ebs-csi-driver) doit être installé dans le cluster et les fonctionnalités Alpha `CSIMigration` et `CSIMigrationAWS` doivent être activées. + +### azureDisk {#azuredisk} + +Un type de volume `azureDisk` est utilisé pour monter un disque de données ([Data Disk](https://azure.microsoft.com/en-us/documentation/articles/virtual-machines-linux-about-disks-vhds/)) dans un Pod. + +Plus de détails sont disponibles [ici](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/azure_disk/README.md). + +#### Migration CSI + +{{< feature-state for_k8s_version="v1.15" state="alpha" >}} + +La fonctionnalité de migration CSI pour azureDisk, lorsque activée, fixe toutes les opérations de plugin depuis le plugin "in-tree" vers le pilote de l'interface CSI (Container Storage Interface) `disk.csi.azure.com`. +Afin d'utiliser cette fonctionnalité, le [Pilote Azure Disk CSI](https://github.com/kubernetes-sigs/azuredisk-csi-driver) doit être installé dans le cluster et les fonctionnalités Alpha `CSIMigration` et `CSIMigrationAzureDisk` doivent être activées. + +### azureFile {#azurefile} + +Un type de volume `azureFile` est utilisé pour monter un volume de fichier Microsoft Azure (SMB 2.1 et 3.0) dans un Pod. + +Plus de détails sont disponibles [ici](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/azure_file/README.md). + +#### Migration CSI + +{{< feature-state for_k8s_version="v1.15" state="alpha" >}} + +La fonctionnalité de migration CSI pour azureFile, lorsque activée, fixe toutes les opérations de plugin depuis le plugin "in-tree" vers le pilote de l'interface CSI (Container Storage Interface) `file.csi.azure.com`. +Afin d'utiliser cette fonctionnalité, le [Pilote Azure File CSI](https://github.com/kubernetes-sigs/azurefile-csi-driver) doit être installé dans le cluster et les fonctionnalités Alpha `CSIMigration` et `CSIMigrationAzureFile` doivent être activées. + +### cephfs {#cephfs} + +Un volume `cephfs` permet de monter un volume CephFS existant dans un Pod. +Contrairement à `emptyDir`, qui est écrasé quand un Pod est supprimé, le contenu d'un volume `cephfs` est préservé et le volume est simplement démonté. +Cela signifie qu'un volume CephFS peut être prérempli avec des données et ces données peuvent être transmises entre les Pods. +CephFS peut être monté plusieurs fois en écriture simultanément. + +{{< caution >}} +Vous devez exécuter votre propre serveur Ceph avec le partage exporté avant de pouvoir l'utiliser. +{{< /caution >}} + +Voir [l'exemple CephFS](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/volumes/cephfs/) pour plus de détails. + +### cinder {#cinder} + +{{< note >}} +prérequis : Kubernetes avec le fournisseur infonuagique OpenStack (OpenStack Cloud Provider) configuré. +Pour la configuration cloudprovider, se référer à [cloud provider openstack](https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#openstack). +{{< /note >}} + +`cinder` est utilisé pour monter un volume Cinder OpenStack dans un Pod. + +#### Exemple de configuration d'un volume Cinder + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-cinder +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-cinder-container + volumeMounts: + - mountPath: /test-cinder + name: test-volume + volumes: + - name: test-volume + # Ce volume OpenStack doit déjà exister. + cinder: + volumeID: + fsType: ext4 +``` + +#### Migration CSI + +{{< feature-state for_k8s_version="v1.14" state="alpha" >}} + +La fonctionnalité de migration CSI pour Cinder, lorsque activée, fixe toutes les opérations de plugin depuis le plugin "in-tree" vers le pilote de l'interface CSI (Container Storage Interface) `cinder.csi.openstack.org`. +Afin d'utiliser cette fonctionnalité, le [Pilote Cinder CSI](https://github.com/kubernetes/cloud-provider-openstack/blob/master/docs/using-cinder-csi-plugin.md) doit être installé dans le cluster et les fonctionnalités Alpha `CSIMigration` et `CSIMigrationOpenStack` doivent être activées. + +### configMap {#configmap} + +La ressource [`configMap`](/docs/tasks/configure-pod-container/configure-pod-configmap/) fournit un moyen d'injecter des données de configuration dans les Pods. +Les données stockées dans un objet `ConfigMap` peuvent être référencées dans un volume de type `configMap` +et être ensuite consommées par des applications conteneurisées s'exécutant dans un Pod. + +Lorsque l'on référence un objet `configMap`, on peut simplement fournir son nom dans le volume +pour le référencer. On peut également personnaliser le chemin pour utiliser une entrée spécifique dans +la ConfigMap. Par exemple, pour monter la ConfigMap `log-config` sur un Pod appelé `configmap-pod`, +vous pourriez utiliser le YAML suivant : + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: configmap-pod +spec: + containers: + - name: test + image: busybox + volumeMounts: + - name: config-vol + mountPath: /etc/config + volumes: + - name: config-vol + configMap: + name: log-config + items: + - key: log_level + path: log_level +``` + +La ConfigMap `log-config` est montée comme un volume et tout le contenu stocké dans son entrée `log_level` +est monté dans le Pod au chemin "`/etc/config/log_level`". +À noter que ce chemin est dérivé du `mountPath` du volume et le `path` est étiqueté avec la clef `log_level`. + +{{< caution >}} +Vous devez créer une [ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap/) avant de pouvoir l'utiliser. +{{< /caution >}} + +{{< note >}} +Un conteneur utilisant une ConfigMap en tant que montage de volume [subPath](#using-subpath) ne recevra pas les mises à jour de la ConfigMap. +{{< /note >}} + +### downwardAPI {#downwardapi} + +Un volume `downwardAPI` est utilisé pour rendre disponibles aux applications les données de l'API Downward. +Il monte un dossier et écrit les données demandées dans des fichiers de texte brut. + +{{< note >}} +Un conteneur utilisant l'API Downward en tant que montage de volume [subPath](#using-subpath) ne recevra pas les mises à jour de l'API Downward. +{{< /note >}} + +Voir [l'exemple de volume `downwardAPI`](/docs/tasks/inject-data-application/downward-api-volume-expose-pod-information/) pour plus de détails. + +### emptyDir {#emptydir} + +Un volume `emptyDir` est d'abord créé lorsqu'un Pod est assigné à un nœud et existe aussi longtemps que le Pod s'exécute sur ce nœud. +Comme le nom l'indique, le volume est initialement vide. Les conteneurs dans le Pod peuvent tous lire et écrire les mêmes fichiers dans le volume `emptyDir`, bien que ce volume puisse être monté sur le même ou différents chemins dans chaque conteneur. +Lorsqu'un Pod est supprimé d'un nœud pour une raison quelconque, les données dans le `emptyDir` sont supprimées à jamais. + +{{< note >}} +Un conteneur qui plante ne retire *PAS* un Pod d'un nœud, ainsi, les données présentes dans un `emptyDir` sont protégées en cas de plantage du conteneur. +{{< /note >}} + +Des cas d'utilisation pour un `emptyDir` peuvent être : + +* un espace de travail, par exemple pour un tri fusion sur disque. +* l'établissement d'un point de reprise d'un long calcul à des fins de récupération des données après un crash. +* le stockage de fichiers qu'un conteneur de gestion de contenu va chercher pendant qu'un conteneur serveur web expose les données. + +Par défaut, les volumes `emptyDir` sont stockés sur tout médium supporté par le nœud - que ce soit un disque dur, un disque SSD ou un stockage réseau, dépendamment de l'environnement. +Cependant, vous pouvez définir le champ `emptyDir.medium` à `"Memory"` pour indiquer à Kubernetes de monter un tmpfs (système de fichiers supporté par la RAM) pour vous à la place. +Tandis que tmpfs est très rapide, soyez conscient qu'au contraire des disques, un tmpfs est effacé au redémarrage du nœud et tous les fichiers que vous écrivez seront comptabilisés dans la limite de mémoire de votre conteneur. + +#### Exemple de Pod + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-pd +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-container + volumeMounts: + - mountPath: /cache + name: cache-volume + volumes: + - name: cache-volume + emptyDir: {} +``` + +### fc (fibre channel) {#fc} + +Un volume `fc` permet à un volume Fibre Channel existant d'être monté dans un Pod. +Vous pouvez spécifier une ou plusieurs cibles World Wide Names en utilisant le paramètre +`targetWWNs` dans votre configuration de volume. +Si plusieurs WWNs sont spécifiés, targetWWNs s'attend à ce que ces WWNs proviennent de connexions multi-path. + +{{< caution >}} +Vous devez configurer un zonage FC SAN pour allouer et masquer au préalable ces LUNs (volumes) aux cibles WWNs afin que les hôtes Kubernetes puissent y accéder. +{{< /caution >}} + +Voir [l'exemple FC](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/fibre_channel) pour plus de détails. + +### flocker {#flocker} + +[Flocker](https://github.com/ClusterHQ/flocker) est un gestionnaire de volumes de données en cluster open-source. Il assure la gestion et l'orchestration de volumes de données supportés par divers serveurs de stockage. + +Un volume `flocker` permet de monter un ensemble de données Flocker dans un Pod. +Si l'ensemble de données n'existe pas déjà dans Flocker, il doit d'abord être créé avec la CLI Flocker ou en utilisant l'API Flocker. +Si l'ensemble de données existe déjà, il sera réattaché par Flocker au nœud sur lequel le Pod est planifié. +Cela signifie que les données peuvent être transmises entre les Pods selon les besoins. + +{{< caution >}} +Vous devez exécuter votre propre installation de Flocker avant de pouvoir l'utiliser. +{{< /caution >}} + +Voir [l'exemple Flocker](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/flocker) pour plus de détails. + +### gcePersistentDisk {#gcepersistentdisk} + +Un volume `gcePersistentDisk` monte un [Disque Persistant](http://cloud.google.com/compute/docs/disks) Google Compute Engine (GCE) dans un Pod. +À la différence d'un `emptyDir`, qui est écrasé lorsqu'un Pod est supprimé, le contenu d'un disque persistant est préservé et le volume est simplement démonté. Cela signifie qu'un disque persistant peut être prérempli avec des données et que ces données peuvent être transmises entre les Pods. + +{{< caution >}} +Vous devez créer un disque persistant en utilisant `gcloud`, l'API GCE ou l'interface utilisateur avant de pouvoir utiliser ce disque. +{{< /caution >}} + +Des restrictions existent lors de l'utilisation d'un `gcePersistentDisk`: + +* les nœuds sur lesquels les Pods s'exécutent doivent être des machines virtuelles (VMs) GCE. +* ces VMs doivent se trouver dans le même projet et la même zone GCE que le disque persistant + +Une fonctionnalité des disques persistants est qu'ils peuvent être montés en lecture seule par plusieurs consommateurs simultanément. +Cela signifie que vous pouvez préremplir un disque persistant avec votre jeu de données et l'exposer en parallèle à partir d'autant de Pods que nécessaire. +Malheureusement, les disques persistants peuvent seulement être montés par un seul consommateur en mode lecture-écriture - les écritures simultanées ne sont pas autorisées. + +Utiliser un disque persistant dans un Pod contrôlé par un ReplicationController échouera à moins que le disque persistant soit en lecture seule ou que le nombre de répliques soit de 0 ou 1. + +#### Création d'un disque persistant + +Avant de pouvoir utiliser un disque persistant GCE avec un Pod, vous devez le créer. + +```shell +gcloud compute disks create --size=500GB --zone=us-central1-a my-data-disk +``` + +#### Exemple de Pod + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-pd +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-container + volumeMounts: + - mountPath: /test-pd + name: test-volume + volumes: + - name: test-volume + # Ce disque persistant GCE doit déjà exister. + gcePersistentDisk: + pdName: my-data-disk + fsType: ext4 +``` + +#### Disques persistants régionaux +{{< feature-state for_k8s_version="v1.10" state="beta" >}} + +La fonctionnalité de disques persistants régionaux ([Regional Persistent Disks](https://cloud.google.com/compute/docs/disks/#repds)) permet la création de disques persistants disponibles dans deux zones à l'intérieur d'une même région. +Afin d'utiliser cette fonctionnalité, le volume doit être provisionné en tant que PersistentVolume; le référencement du volume directement depuis un Pod n'est pas supporté. + +#### Provisionnement manuel d'un disque persistant régional en tant que PersistentVolume + +Le provisionnement dynamique est possible en utilisant une [StorageClass pour un disque persistant GCE](/docs/concepts/storage/storage-classes/#gce). +Avant de créer un PersistentVolume, vous devez créer le disque persistant : +```shell +gcloud beta compute disks create --size=500GB my-data-disk + --region us-central1 + --replica-zones us-central1-a,us-central1-b +``` +Exemple de spec PersistentVolume : + +```yaml +apiVersion: v1 +kind: PersistentVolume +metadata: + name: test-volume + labels: + failure-domain.beta.kubernetes.io/zone: us-central1-a__us-central1-b +spec: + capacity: + storage: 400Gi + accessModes: + - ReadWriteOnce + gcePersistentDisk: + pdName: my-data-disk + fsType: ext4 +``` + +#### Migration CSI + +{{< feature-state for_k8s_version="v1.14" state="alpha" >}} + +La fonctionnalité de migration CSI pour un disque persistant GCE, lorsque activée, fixe toutes les opérations de plugin depuis le plugin "in-tree" vers le pilote de l'interface CSI (Container Storage Interface) `pd.csi.storage.gke.io`. +Afin d'utiliser cette fonctionnalité, le [Pilote CSI de disque persistant GCE](https://github.com/kubernetes/cloud-provider-openstack/blob/master/docs/using-cinder-csi-plugin.md) doit être installé dans le cluster et les fonctionnalités Alpha `CSIMigration` et `CSIMigrationGCE` doivent être activées. + +### gitRepo (obsolète) {#gitrepo} + +{{< warning >}} +Le type de volume gitRepo est obsolète. Pour provisionner un conteneur avec un dépôt git, il faut monter un [EmptyDir](#emptydir) dans un InitContainer qui clone le dépôt en utilisant git, ensuite, monter le [EmptyDir](#emptydir) dans le conteneur du Pod. +{{< /warning >}} + +Un volume `gitRepo` est un exemple de ce qui peut être réalisé en tant que plugin de volume. +Cela monte un dossier vide et clone un dépôt git à l'intérieur, à la disposition d'un Pod. +Dans le futur, de tels volumes pourraient être déplacé vers un modèle encore plus découplé plutôt qu'étendre l'API Kubernetes pour chaque cas d'utilisation. + +Voici un exemple d'un volume gitRepo : + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: server +spec: + containers: + - image: nginx + name: nginx + volumeMounts: + - mountPath: /mypath + name: git-volume + volumes: + - name: git-volume + gitRepo: + repository: "git@somewhere:me/my-git-repository.git" + revision: "22f1d8406d464b0c0874075539c1f2e96c253775" +``` + +### glusterfs {#glusterfs} + +Un volume `glusterfs` permet à un volume [Glusterfs](http://www.gluster.org) (un système de fichiers en réseau open +source) d'être monté dans un Pod. À la différence d'un `emptyDir`, qui est écrasé lorsqu'un Pod est supprimé. le contenu d'un volume `glusterfs` est préservé et le volume est simplement démonté. +Cela signifie qu'un volume glusterfs peut être prérempli avec des données et que ces données peuvent être transmises entre les Pods. +GlusterFS peut être monté plusieurs fois en écriture simultanément. + +{{< caution >}} +Vous devez exécuter votre propre installation de GlusterFS avant de pouvoir l'utiliser. +{{< /caution >}} + +Voir [l'exemple GlusterFS](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/volumes/glusterfs) pour plus de détails. + +### hostPath {#hostpath} + +Un volume `hostPath` monte un fichier ou un dossier depuis le système de fichiers du nœud hôte à l'intérieur d'un Pod. +Ce ne sera pas requis pour la plupart des Pods, mais cela offre une puissante solution de secours pour certaines applications. + +Par exemple, des utilisations du `hostPath` peuvent être : + +* exécuter un conteneur qui nécessite l'accès aux éléments internes de Docker; utiliser un `hostPath` de `/var/lib/docker` +* exécuter cAdvisor dans un conteneur; utiliser un `hostPath` de `/sys` +* autoriser un Pod à spécifier si un `hostPath` donné devrait exister avant la mise en exécution du Pod, s'il devrait être créé et en tant que quoi il devrait exister. + +En plus de la propriété requise `path`, un utilisateur peut optionnellement spécifier un `type` pour un volume `hostPath`. + +Les valeurs supportées pour le champ `type` sont les suivantes : + + +| Valeur | Comportement | +|:------|:---------| +| | Une chaîne de caractères vide (par défaut) sert à la rétrocompatibilité, ce qui signifie qu'aucune vérification ne sera effectuée avant de monter le volume hostPath. | +| `DirectoryOrCreate` | Si rien n'existe au chemin fourni, un dossier vide y sera créé au besoin avec les permissions définies à 0755, avec le même groupe et la même possession que Kubelet. | +| `Directory` | Un dossier doit exister au chemin fourni | +| `FileOrCreate` | Si rien n'existe au chemin fourni, un fichier vide y sera créé au besoin avec les permissions définies à 0644, avec le même groupe et la même possession que Kubelet. | +| `File` | Un fichier doit exister au chemin fourni | +| `Socket` | Un socket UNIX doit exister au chemin fourni | +| `CharDevice` | Un périphérique en mode caractère doit exister au chemin fourni | +| `BlockDevice` | Un périphérique en mode bloc doit exister au chemin fourni | + +Une attention particulière doit être portée lors de l'utilisation de ce type de volume car : + +* les Pods avec une configuration identique (tels que ceux créés depuis un podTemplate) peuvent se comporter différemment sur des nœuds différents à cause de fichiers différents sur les nœuds. +* lorsque Kubernetes ajoute une planification tenant compte des ressources, comme prévu, il ne pourra pas prendre en compte les ressources utilisées par un `hostPath`. +* les fichiers ou dossiers créés sur les hôtes sous-jacents ne sont accessibles en écriture que par root. Vous devez soit exécuter votre programme en tant que root dans un [conteneur privilégié](/docs/user-guide/security-context) ou modifier les permissions du fichier sur l'hôte pour pouvoir écrire dans un volume `hostPath`. + +#### Exemple de Pod + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-pd +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-container + volumeMounts: + - mountPath: /test-pd + name: test-volume + volumes: + - name: test-volume + hostPath: + # chemin du dossier sur l'hôte + path: /data + # ce champ est optionnel + type: Directory +``` + +### iscsi {#iscsi} + +Un volume `iscsi` permet à un volume existant iSCSI (SCSI over IP) d'être monté dans un Pod. +À la différence d'un `emptyDir`, qui est écrasé lorsqu'un Pod est supprimé, le contenu d'un volume `iscsi` est préservé et le volume est simplement démonté. +Cela signifie qu'un volume iscsi peut être prérempli avec des données que ces données peuvent être transmises entre les Pods. + +{{< caution >}} +Vous devez exécuter votre propre serveur iSCSI avec le volume créé avant de pouvoir l'utiliser. +{{< /caution >}} + +Une fonctionnalité de iSCSI est qu'il peut être monté en lecture seule par plusieurs consommateurs simultanément. +Cela signifie que vous pouvez préremplir un volume avec votre jeu de données et l'exposer en parallèle à partir d'autant de Pods que nécessaire. +Malheureusement, les volumes iSCSI peuvent seulement être montés par un seul consommateur en mode lecture-écriture - les écritures simultanées ne sont pas autorisées. + +Voir [l'exemple iSCSI](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/volumes/iscsi) pour plus de détails. + +### local {#local} + +{{< feature-state for_k8s_version="v1.14" state="stable" >}} + +Un volume `local` représente un périphérique de stockage local monté tels qu'un disque, une partition ou un dossier. + +Les volumes locaux peuvent seulement être utilisés comme un PersistentVolume créé statiquement. +Le provisionnement dynamique n'est pas encore supporté. + +Comparés aux volumes `hostPath`, les volumes locaux peuvent être utilisés de manière durable et portable sans planifier manuellement des Pods sur les nœuds, puisque le système est conscient des contraintes de nœud du volume en examinant l'affinité de nœud sur le PersistentVolume. + +Toutefois, les volumes locaux sont encore sujets à la disponibilité du nœud sous-jacent et ne conviennent pas à toutes les applications. Si un nœud devient "en mauvaise santé" (unhealthy), alors le volume local deviendra également inaccessible et un Pod qui l'utilise ne sera pas en mesure de s'exécuter. Les applications qui utilisent des volumes locaux doivent être en mesure de tolérer cette disponibilité réduite, ainsi que de potentielles pertes de données, dépendamment des caractéristiques de durabilité du disque sous-jacent. + +L'exemple suivant traite d'une spec d'un PersistentVolume utilisant un volume `local` et une `nodeAffinity`: + +```yaml +apiVersion: v1 +kind: PersistentVolume +metadata: + name: example-pv +spec: + capacity: + storage: 100Gi + # le champ volumeMode requiert l'activation de la "feature gate" Alpha BlockVolume + volumeMode: Filesystem + accessModes: + - ReadWriteOnce + persistentVolumeReclaimPolicy: Delete + storageClassName: local-storage + local: + path: /mnt/disks/ssd1 + nodeAffinity: + required: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/hostname + operator: In + values: + - example-node +``` + +La `nodeAffinity` d'un PersistentVolume est requise lors de l'utilisation de volumes locaux. +Cela permet au planificateur (scheduler) Kubernetes de planifier correctement des Pods utilisant des volumes locaux aux bons nœuds. + +Le `volumeMode` d'un PersistentVolume peut maintenant être configuré à "Block" (au lieu de la valeur par défaut "Filesystem") pour exposer le volume local en tant que périphérique bloc brut (raw block device). +Le champ `volumeMode` requiert l'activation de la "feature gate" Alpha `BlockVolume`. + +Lors de l'utilisation des volumes locaux, il est recommandé de créer une StorageClass avec `volumeBindingMode` configuré à `WaitForFirstConsumer`. Voir [l'exemple](/docs/concepts/storage/storage-classes/#local). Retarder la liaison (binding) du volume garantit que la décision de liaison du PersistentVolumeClaim sera également évaluée avec toutes les autres contraintes de nœud que le Pod peut avoir, tels que les exigences en ressources du nœud, les sélecteurs de nœud, leur affinité et leur anti-affinité. + +Un provisionneur statique externe peut être exécuté séparément pour une gestion améliorée du cycle de vie du volume local. +Noter que ce provisionneur ne supporte pas encore le provisionnement dynamique. Pour un exemple sur la façon d'exécuter un provisionneur externe local, voir le [guide utilisateur de provisionneur de volume local](https://github.com/kubernetes-sigs/sig-storage-local-static-provisioner). + +{{< note >}} +Le PersistentVolume local requiert un nettoyage manuel et une suppression par l'utilisateur si le provisionneur statique n'est pas utilisé pour gérer le cycle de vie du volume. +{{< /note >}} + +### nfs {#nfs} + +Un volume `nfs` permet à un partage NFS (Network File System) existant d'être monté dans un Pod. +À la différence d'un `emptyDir`, qui est écrasé lorsqu'un Pod est supprimé, le contenu d'un volume `nfs` est préservé et le volume est simplement démonté. +Cela signifie qu'un volume NFS peut être prérempli avec des données et que les données peuvent être transmises entre les Pods. NFS peut être monté plusieurs fois en écriture simultanément. + +{{< caution >}} +Vous devez exécuter votre propre serveur NFS avec le partage exporté avant de pouvoir l'utiliser. +{{< /caution >}} + +Voir [l'exemple NFS](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/nfs) pour plus de détails. + +### persistentVolumeClaim {#persistentvolumeclaim} + +Un volume `persistentVolumeClaim` est utilisé pour monter un [PersistentVolume](/docs/concepts/storage/persistent-volumes/) dans un Pod. Les PersistentVolumes sont une manière pour les utilisateurs de "revendiquer" un stockage durable (comme un PersistentDisk GCE ou un volume iSCSI) sans savoir les détails d'un environnement cloud particulier. + +Voir [l'exemple PersistentVolumes](/docs/concepts/storage/persistent-volumes/) pour plus de détails. + +### projected {#projected} + +Un volume `projected` mappe plusieurs sources de volume existantes dans le même dossier. + +Actuellement, les types de sources de volume suivantes peuvent être projetés : + +- [`secret`](#secret) +- [`downwardAPI`](#downwardapi) +- [`configMap`](#configmap) +- `serviceAccountToken` + +Toutes les sources doivent se trouver dans le même namespace que celui du Pod. Pour plus de détails, voir le [document de conception tout-en-un ](https://github.com/kubernetes/community/blob/{{< param "githubbranch" >}}/contributors/design-proposals/node/all-in-one-volume.md). + +La projection des jetons de compte de service (service account) est une fonctionnalité introduite dans Kubernetes 1.11 et promue en Beta dans la version 1.12. +Pour activer cette fonctionnalité dans la version 1.11, il faut configurer explicitement la ["feature gate" `TokenRequestProjection`](/docs/reference/command-line-tools-reference/feature-gates/) à "True". + +#### Exemple d'un Pod avec un secret, une API downward et une configmap. + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: volume-test +spec: + containers: + - name: container-test + image: busybox + volumeMounts: + - name: all-in-one + mountPath: "/projected-volume" + readOnly: true + volumes: + - name: all-in-one + projected: + sources: + - secret: + name: mysecret + items: + - key: username + path: my-group/my-username + - downwardAPI: + items: + - path: "labels" + fieldRef: + fieldPath: metadata.labels + - path: "cpu_limit" + resourceFieldRef: + containerName: container-test + resource: limits.cpu + - configMap: + name: myconfigmap + items: + - key: config + path: my-group/my-config +``` + +#### Exemple d'un Pod avec plusieurs secrets avec une configuration de mode de permission autre que celle par défaut. + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: volume-test +spec: + containers: + - name: container-test + image: busybox + volumeMounts: + - name: all-in-one + mountPath: "/projected-volume" + readOnly: true + volumes: + - name: all-in-one + projected: + sources: + - secret: + name: mysecret + items: + - key: username + path: my-group/my-username + - secret: + name: mysecret2 + items: + - key: password + path: my-group/my-password + mode: 511 +``` + +Chaque source de volume projeté est listée dans la spec, sous `sources`. Les paramètres sont à peu près les mêmes avec deux exceptions : + +* Pour les secrets, le champ `secretName` a été changé par `name` pour être consistant avec le nommage des ConfigMap. +* Le `defaultMode` peut seulement être spécifié au niveau projeté et non pour chaque source de volume. Cependant, tel qu'illustré au-dessus, il est possible de configurer explicitement le `mode` pour chaque projection individuelle. + +Lorsque la fonctionnalité `TokenRequestProjection` est activée, vous pouvez injecter le jeton pour le [service account](/docs/reference/access-authn-authz/authentication/#service-account-tokens) courant dans un Pod au chemin spécifié. Ci-dessous, un exemple : + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: sa-token-test +spec: + containers: + - name: container-test + image: busybox + volumeMounts: + - name: token-vol + mountPath: "/service-account" + readOnly: true + volumes: + - name: token-vol + projected: + sources: + - serviceAccountToken: + audience: api + expirationSeconds: 3600 + path: token +``` + +Le pod d'exemple possède un volume projeté contenant le jeton injecté du service account. +Ce jeton peut être utilisé par des conteneurs de Pod pour accéder au service d'API Kubernetes API, par exemple. +Le champ `audience` contient l'audience-cible du jeton. +Un destinataire du jeton doit s'identifier avec un identificateur spécifié dans l'audience du jeton, sinon il doit rejeter le jeton. Ce champ est facultatif et sa valeur par défaut est l'identifiant du serveur API. + +Le champ `expirationSeconds` est la durée de validité attendue du jeton de service account. +Sa valeur par défaut est de 1 heure et doit être au moins de 10 minutes (600 secondes). Un administrateur peut aussi limiter sa valeur maximum en spécifiant l'option `--service-account-max-token-expiration` pour le serveur API. +Le champ `path` spécifie un chemin relatif au point de montage du volume projeté. + +{{< note >}} +Un conteneur utilisant une source de volume projeté en tant que point de montage de volume [subPath](#using-subpath) ne recevra pas de mises à jour pour ces sources de volume. +{{< /note >}} + +### portworxVolume {#portworxvolume} + +Un `portworxVolume` est une couche de stockage bloc élastique qui s'exécute de manière hyperconvergée avec Kubernetes. +[Portworx](https://portworx.com/use-case/kubernetes-storage/) donne l'empreinte digitale d'un stockage dans un serveur, tiers basés sur les capacités et agrège la capacité sur plusieurs serveurs. Portworx s'exécute en invité sur des machines virtuelles ou sur des nœuds Linux bare metal. + +Un `portworxVolume` peut être créé dynamiquement à travers Kubernetes ou il peut également être pré-provisionné et référencé à l'intérieur d'un Pod Kubernetes. +Voici un exemple de Pod référençant un PortworxVolume pré-provisionné : + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-portworx-volume-pod +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-container + volumeMounts: + - mountPath: /mnt + name: pxvol + volumes: + - name: pxvol + # Ce volume Portworx doit déjà exister. + portworxVolume: + volumeID: "pxvol" + fsType: "" +``` + +{{< caution >}} +Il faut s'assurer d'avoir un PortworxVolume existant avec le nom `pxvol` avant de l'utiliser dans le Pod. +{{< /caution >}} + +Plus de détails et d'exemples peuvent être trouvé [ici](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/portworx/README.md). + +### quobyte {#quobyte} + +Un volume `quobyte` permet à un volume existant [Quobyte](http://www.quobyte.com) d'être monté dans un Pod. + +{{< caution >}} +Vous devez exécuter votre propre configuration Quobyte avec les volumes créés avant de pouvoir l'utiliser. +{{< /caution >}} + +Quobyte supporte le {{< glossary_tooltip text="Container Storage Interface" term_id="csi" >}}. +CSI est le plugin recommandé pour utiliser les volumes Quobyte volumes dans Kubernetes. Le projet GitHub Quobyte dispose [d'instructions](https://github.com/quobyte/quobyte-csi#quobyte-csi) pour déployer Quobyte en utilisant CSI, avec des exemples. + +### rbd {#rbd} + +Un volume `rbd` permet à un volume périphérique bloc Rados ([Rados Block +Device](http://ceph.com/docs/master/rbd/rbd/)) d'être monté dans un Pod. +À la différence d'un `emptyDir`, qui est écrasé lorsqu'un Pod est supprimé, le contenu d'un volume `rbd` est préservé et le volume est simplement démonté. +Cela signifie qu'un volume RBD peut être prérempli avec des données et que ces données peuvent être transmises entre les Pods. + +{{< caution >}} +Vous devez exécuter votre propre installation Ceph avant de pouvoir utiliser RBD. +{{< /caution >}} + +Une fonctionnalité de RBD est qu'il peut être monté en lecture seule par plusieurs consommateurs simultanément. +Cela signifie que vous pouvez préremplir un volume avec votre jeu de données et l'exposer en parallèle à partir d'autant de Pods que nécessaire. +Malheureusement, les volumes RBD peuvent seulement être montés par un seul consommateur en mode lecture-écriture - les écritures simultanées ne sont pas autorisées. + +Voir [l'exemple RBD](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/volumes/rbd) pour plus de détails. + +### scaleIO {#scaleio} + +ScaleIO est une plateforme de stockage logicielle qui peut utiliser du matériel physique existant pour créer des clusters de stockage bloc partagé en réseau évolutif. +Le plugin de volume `scaleIO` permet aux Pods déployés d'accéder à des volumes ScaleIO existants (ou il peut provisionner dynamiquement de nouveaux volumes pour des revendications de volumes persistants, voir [ScaleIO Persistent Volumes](/docs/concepts/storage/persistent-volumes/#scaleio)). + +{{< caution >}} +Vous devez exécuter un cluster ScaleIO déjà configuré avec les volumes créés avant de pouvoir les utiliser. +{{< /caution >}} + +L'exemple suivant montre une configuration de Pod avec ScaleIO : + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: pod-0 +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: pod-0 + volumeMounts: + - mountPath: /test-pd + name: vol-0 + volumes: + - name: vol-0 + scaleIO: + gateway: https://localhost:443/api + system: scaleio + protectionDomain: sd0 + storagePool: sp1 + volumeName: vol-0 + secretRef: + name: sio-secret + fsType: xfs +``` + +Pour plus de détails, consulter [les exemples ScaleIO](https://github.com/kubernetes/examples/tree/{{< param "githubbranch" >}}/staging/volumes/scaleio). + +### secret {#secret} + +Un volume `secret` est utilisé pour fournir des informations sensibles, comme des mots de passe, aux Pods. +Vous pouvez stocker des secrets dans l'API Kubernetes et les monter en tant que fichiers pour être utilisés par les Pods sans les coupler directement avec Kubernetes. Les volumes `secret` sont supportés par tmpfs (un système de fichiers en RAM) pour qu'ils ne soient jamais écrits sur du stockage non volatil. + +{{< caution >}} +Vous devez créer un secret dans l'API Kubernetes avant de pouvoir l'utiliser. +{{< /caution >}} + +{{< note >}} +Un conteneur utilisant un secret en tant que point de montage de volume [subPath](#using-subpath) ne recevra pas les mises à jour des secrets. +{{< /note >}} + +Les secrets sont décrits plus en détails [ici](/docs/user-guide/secrets). + +### storageOS {#storageos} + +Un volume `storageos` permet à un volume [StorageOS](https://www.storageos.com) existant d'être monté dans un Pod. + +StorageOS s'exécute en tant que conteneur dans l'environnement Kubernetes en rendant le stockage local ou attaché accessible depuis n'importe quel nœud dans le cluster Kubernetes. +Les données peuvent être répliquées pour se protéger des défaillances de nœuds. +Les techniques d'allocation fine et dynamique et de compression peuvent améliorer l'utilisation et réduire les coûts. + +À la base, StorageOS fournit un stockage bloc aux conteneurs accessible via un système de fichiers. + +Le conteneur StorageOS requiert Linux 64-bit et n'a pas besoin de dépendances supplémentaires. +Une licence développeur libre est disponible. + +{{< caution >}} +Vous devez exécuter le conteneur StorageOS sur chaque nœud qui souhaite accéder aux volumes StorageOS ou qui veut contribuer à la +capacité de stockage du pool. +Pour les instructions d'installation, consulter la [documentation StorageOS](https://docs.storageos.com). +{{< /caution >}} + +```yaml +apiVersion: v1 +kind: Pod +metadata: + labels: + name: redis + role: master + name: test-storageos-redis +spec: + containers: + - name: master + image: kubernetes/redis:v1 + env: + - name: MASTER + value: "true" + ports: + - containerPort: 6379 + volumeMounts: + - mountPath: /redis-master-data + name: redis-data + volumes: + - name: redis-data + storageos: + # Le volume `redis-vol01` doit déjà exister dans StorageOS, dans le namespace `default`. + volumeName: redis-vol01 + fsType: ext4 +``` + +Pour plus d'informations incluant le provisionnement dynamique (Dynamic Provisioning) et les réclamations de volume persistant (Persistent Volume Claims), consulter les [exemples StorageOS](https://github.com/kubernetes/examples/blob/master/volumes/storageos). + +### vsphereVolume {#vspherevolume} + +{{< note >}} +Prérequis : Kubernetes avec vSphere Cloud Provider configuré. Pour la configuration cloudprovider, +se référer au [guide de mise en marche vSphere](https://vmware.github.io/vsphere-storage-for-kubernetes/documentation/). +{{< /note >}} + +Un volume `vsphereVolume` est utilisé pour monter un volume vSphere VMDK dans un Pod. Le contenu d'un volume est préservé lorsqu'il est démonté. Il supporte les banques de données (datastore) VMFS and VSAN. + +{{< caution >}} +Vous devez créer VMDK en utilisant une des méthodes suivantes avant de l'utiliser avec un Pod. +{{< /caution >}} + +#### Création d'un volume VMDK + +Choisir une des méthodes suivantes pour créer un VMDK. + +{{< tabs name="tabs_volumes" >}} +{{% tab name="Création en utilisant vmkfstools" %}} +Premièrement, se connecter en ssh dans l'ESX, ensuite, utiliser la commande suivante pour créer un VMDK : + +```shell +vmkfstools -c 2G /vmfs/volumes/DatastoreName/volumes/myDisk.vmdk +``` +{{% /tab %}} +{{% tab name="Création en utilisant vmware-vdiskmanager" %}} +Utiliser la commande suivante pour créer un VMDK: + +```shell +vmware-vdiskmanager -c -t 0 -s 40GB -a lsilogic myDisk.vmdk +``` +{{% /tab %}} + +{{< /tabs >}} + + +#### Exemple de configuration vSphere VMDK + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: test-vmdk +spec: + containers: + - image: k8s.gcr.io/test-webserver + name: test-container + volumeMounts: + - mountPath: /test-vmdk + name: test-volume + volumes: + - name: test-volume + # Ce volume VMDK doit déjà exister. + vsphereVolume: + volumePath: "[DatastoreName] volumes/myDisk" + fsType: ext4 +``` + +Plus d'exemples sont disponibles [ici](https://github.com/kubernetes/examples/tree/master/staging/volumes/vsphere). + + +## Utilisation de subPath + +Parfois, il est utile de partager un volume pour plusieurs utilisations dans un même Pod. +La propriété `volumeMounts.subPath` peut être utilisée pour spécifier un sous-chemin à l'intérieur du volume référencé au lieu de sa racine. + +Voici un exemple d'un Pod avec une stack LAMP (Linux Apache Mysql PHP) utilisant un unique volume partagé. +Le contenu HTML est mappé à son dossier `html` et les bases de données seront stockées dans son dossier `mysql` : + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: my-lamp-site +spec: + containers: + - name: mysql + image: mysql + env: + - name: MYSQL_ROOT_PASSWORD + value: "rootpasswd" + volumeMounts: + - mountPath: /var/lib/mysql + name: site-data + subPath: mysql + - name: php + image: php:7.0-apache + volumeMounts: + - mountPath: /var/www/html + name: site-data + subPath: html + volumes: + - name: site-data + persistentVolumeClaim: + claimName: my-lamp-site-data +``` + +### Utilisation d'un subPath avec des variables d'environnement étendues + +{{< feature-state for_k8s_version="v1.15" state="beta" >}} + + +Utiliser le champ `subPathExpr` pour construire des noms de dossier `subPath` depuis les variables d'environnement de l'API Downward. +Avant d'utiliser cette fonctionnalité, vous devez activer la "feature gate" `VolumeSubpathEnvExpansion`. +Les propriétés `subPath` et `subPathExpr` sont mutuellement exclusives. + +Dans cet exemple, un Pod utilise `subPathExpr` pour créer un dossier `pod1` à l'intérieur du volume hostPath `/var/log/pods`, en utilisant le nom du pod depuis l'API Downward. +Le dossier hôte `/var/log/pods/pod1` est monté sur `/logs` dans le conteneur. + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: pod1 +spec: + containers: + - name: container1 + env: + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + image: busybox + command: [ "sh", "-c", "while [ true ]; do echo 'Hello'; sleep 10; done | tee -a /logs/hello.txt" ] + volumeMounts: + - name: workdir1 + mountPath: /logs + subPathExpr: $(POD_NAME) + restartPolicy: Never + volumes: + - name: workdir1 + hostPath: + path: /var/log/pods +``` + +## Ressources + +Le support de stockage (Disk, SSD, etc.) d'un volume `emptyDir` est déterminé par le support du système de fichiers +contenant le dossier racine de kubelet (typiquement `/var/lib/kubelet`). +Il n'y a pas de limite sur l'espace qu'un volume `emptyDir` ou `hostPath` peut consommer +et pas d'isolation entre les conteneurs ou entre les Pods. + +Dans le futur, il est prévu que les volumes `emptyDir` et `hostPath` soient en mesure de demander une certaine quantité d'espace en utilisant une spécification de [ressource](/docs/user-guide/compute-resources) et de sélectionner un type de support à utiliser, pour les clusters qui ont plusieurs types de support. + +## Plugins de volume Out-of-Tree +Les plugins de volume Out-of-tree incluent l'interface CSI (Container Storage Interface) et Flexvolume. +Ils permettent aux fournisseurs de stockage de créer des plugins de stockage personnalisés sans les ajouter au dépôt Kubernetes. + +Avant l'introduction de l'interface CSI et Flexvolume, tous les plugins de volume (tels que les types de volume listés plus haut) étaient "in-tree", ce qui signifie qu'ils étaient construits, liés, compilés et livrés avec les binaires de base Kubernetes et étendent l'API Kubernetes de base. +Cela signifiait que l'ajout d'un nouveau système de stockage à Kubernetes (un plugin de volume) requérait de vérifier le code dans le dépôt de base de Kubernetes. + +CSI et Flexvolume permettent à des plugins de volume d'être développés indépendamment de la base de code Kubernetes et déployés (installés) sur des clusters Kubernetes en tant qu'extensions. + +Pour les fournisseurs de stockage qui cherchent à créer un plugin de volume "out-of-tree", se référer à [cette FAQ](https://github.com/kubernetes/community/blob/master/sig-storage/volume-plugin-faq.md). + +### CSI + +L'interface [Container Storage Interface](https://github.com/container-storage-interface/spec/blob/master/spec.md) (CSI) définit une interface standard pour les systèmes d'orchestration de conteneurs (comme Kubernetes) pour exposer des systèmes de stockage arbitraires aux charges de travail de leurs conteneurs. + +Pour plus d'informations, lire la [proposition de conception CSI](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/storage/container-storage-interface.md). + +Le support CSI a été introduit en alpha à partir de Kubernetes v1.9, a évolué en beta dans Kubernetes v1.10 et est en disponibilité générale (GA) depuis Kubernetes v1.13. + +{{< note >}} +Le support des versions spec CSI 0.2 et 0.3 sont obsolètes dans Kubernetes v1.13 et seront retirés dans une version future. +{{< /note >}} + +{{< note >}} +Les pilotes CSI peuvent ne pas être compatibles avec toutes les versions de Kubernetes. +Vérifier la documentation des pilotes CSI spécifiques pour les étapes de déploiement supportées pour chaque version de Kubernetes et la matrice de compatibilité. +{{< /note >}} + +Une fois qu'un pilote de volume CSI compatible est déployé dans un cluster Kubernetes, les utilisateurs peuvent +utiliser le type de volume `csi` pour attacher, monter, etc.., les volumes exposés par le pilote CSI. + +Le type de volume `csi` ne supporte pas de référence directe depuis un Pod et ne peut être référencé seulement dans un Pod que par un objet `PersistentVolumeClaim`. + +Les champs suivants sont disponibles aux administrateurs de stockage pour configurer un volume persistant CSI : + +- `driver`: Une valeur texte qui spécifie le nom du pilote de volume à utiliser. + Cette valeur doit correspondre à la valeur retournée dans le `GetPluginInfoResponse` par le pilote CSI tel que défini dans la + [spec CSI](https://github.com/container-storage-interface/spec/blob/master/spec.md#getplugininfo). + Elle est utilisée par Kubernetes pour identifier le pilote CSI à appeler et par les composants du pilote CSI + pour identifier quels objets PV appartiennent au pilote CSI. +- `volumeHandle`: Une valeur texte qui identifie le volume de manière unique. Cette valeur doit correspondre à la valeur retournée dans le champ `volume.id` de `CreateVolumeResponse` par le pilote CSI tel que défini dans la [spec CSI](https://github.com/container-storage-interface/spec/blob/master/spec.md#createvolume). + La valeur est passée en tant que `volume_id` sur tous les appels au pilote de volume CSI lorsque le volume est référencé. +- `readOnly`: Une valeur booléenne optionnelle indiquant si le volume doit être + "ControllerPublished" (attaché) en lecture seule. La valeur par défaut est "false". Cette valeur est passées au pilote CSI + via le champ `readonly` dans le `ControllerPublishVolumeRequest`. +- `fsType`: Si le `VolumeMode` du PV est `Filesystem`, alors ce champ peut être utilisé pour spécifier le système de fichiers + qui devrait être utilisé pour monter le volume. Si le volume n'a pas été formaté et que le formatage est supporté, cette valeur sera + utilisée pour formater le volume. + Cette valeur est passée au pilote CSI driver via le champ `VolumeCapability` de + `ControllerPublishVolumeRequest`, `NodeStageVolumeRequest`, et + `NodePublishVolumeRequest`. +- `volumeAttributes`: Un tableau associatif (map) string vers string qui spécifie les propriétés statiques d'un volume. Ce tableau associatif doit correspondre à celui retourné dans le champ + `volume.attributes` du `CreateVolumeResponse` par le pilote CSI tel que défini dans + la [spec CSI](https://github.com/container-storage-interface/spec/blob/master/spec.md#createvolume). + Le tableau associatif est passé au pilote CSI via le champ `volume_attributes` dans la `ControllerPublishVolumeRequest`, `NodeStageV olumeRequest`, et `NodePublishVolumeRequest`. +- `controllerPublishSecretRef`: Une référence de l'objet de type secret contenant des informations sensibles à passer + au driver CSI pour compléter les appels CSI `ControllerPublishVolume` et `ControllerUnpublishVolume`. + Ce champ est optionnel et peut être vide si aucun secret n'est requis. + Si l'objet secret contient plus qu'un secret, tous les secrets sont passés. +- `nodeStageSecretRef`: Une référence à l'objet de type secret contenant des informations sensibles à passer au pilote CSI + pour compléter l'appel CSI `NodeStageVolume`. Ce champ est optionnel et peut être vide si aucun secret n'est requis. + Si l'objet secret contient plus qu'un secret, tous les secrets sont passés. +- `nodePublishSecretRef`: Une référence vers l'objet de type secret contenant des informations sensibles à passer au pilote CSI + pour compléter l'appel CSI `NodePublishVolume`. Ce champ est optionnel et peut être vide si aucun secret n'est requis. + Si l'objet secret contient plus qu'un secret, tous les secrets sont passés. + +#### Support de volume bloc brut CSI + +{{< feature-state for_k8s_version="v1.14" state="beta" >}} + +À partir de la version 1.11, CSI a introduit le support des volumes bloc bruts, qui s'appuient +sur la fonctionnalité de volume bloc brut introduite dans une version précédente de Kubernetes. +Cette fonctionnalité va permettre aux fournisseurs avec des pilotes CSI externes d'implémenter le support pour les volumes bloc bruts +dans les charges de travail Kubernetes. + +Le support volume bloc CSI est une "feature-gate", mais est activée par défaut. Les deux +"feature gates" qui doivent être activées pour cette fonctionnalité sont `BlockVolume` et `CSIBlockVolume`. + +Apprenez comment [configurer votre PV/PVC avec le support de volume bloc brut](/docs/concepts/storage/persistent-volumes/#raw-block-volume-support). + +#### Volumes CSI éphémères + +{{< feature-state for_k8s_version="v1.15" state="alpha" >}} + +Cette fonctionnalité permet aux volumes CSI d'être embarqués directement dans la spécification du Pod au lieu de celle d'un PersistentVolume. Les Volumes spécifiés de cette manière sont éphémères et ne persistent pas lorsque le Pod redémarre. + +Exemple : + +```yaml +kind: Pod +apiVersion: v1 +metadata: + name: my-csi-app +spec: + containers: + - name: my-frontend + image: busybox + volumeMounts: + - mountPath: "/data" + name: my-csi-inline-vol + command: [ "sleep", "1000000" ] + volumes: + - name: my-csi-inline-vol + csi: + driver: inline.storage.kubernetes.io + volumeAttributes: + foo: bar +``` + +Cette fonctionnalité requiert l'activation de la "feature gate" CSIInlineVolume : + +``` +--feature-gates=CSIInlineVolume=true +``` + +Les volumes éphémères CSI sont seulement supportés par un sous-ensemble des pilotes CSI. La liste des pilotes CSI est disponible [ici](https://kubernetes-csi.github.io/docs/drivers.html). + +# Ressources pour développeur +Pour plus d'informations sur la manière de développer un pilote CSI, se référer à la [documentation kubernetes-csi](https://kubernetes-csi.github.io/docs/) + +#### Migration de pilotes CSI depuis des plugins "in-tree" + +{{< feature-state for_k8s_version="v1.14" state="alpha" >}} + +La fonctionnalité de migration CSI, lorsque activée, dirige les opérations sur les plugins "in-tree" existants vers les plugins CSI correspondants (qui sont sensés être installés et configurés). +Cette fonctionnalité implémente la logique de translation nécessaire et les fixations nécessaires pour rerouter les opérations +de manière transparente. En conséquence, les opérateurs n'ont pas à effectuer de changements de configuration aux classes de stockage (Storage Classes) existantes, PV ou PVC (référençant aux plugins "in-tree") lors de la transition vers un pilote CSI qui remplace un plugin "in-tree". + +Dans l'état alpha, les opérations et fonctionnalités qui sont supportées incluent provisionnement/suppression, attachement/détachement, montage/démontage et le redimensionnement des volumes. + +Les plugins "in-tree" qui supportent la migration CSI et qui ont un pilote CSI correspondant implémenté sont listés dans la section "Types de volumes" au-dessus. + +### Flexvolume {#flexVolume} + +Flexvolume est une interface de plugin "out-of-tree" qui existe dans Kubernetes depuis la version 1.2 (avant CSI). +Elle utilise un modèle basé sur exec pour s'interfacer avec les pilotes. Les binaires de pilote Flexvolume doivent être installés dans un chemin de volume de plugin prédéfini sur chaque nœud (et dans certains cas le nœud maître). + +Les Pods interagissent avec les pilotes Flexvolume à travers le plugin "in-tree" `flexvolume` +Plus de détails sont disponibles [ici](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-storage/flexvolume.md). + +## Propagation de montage + +La propagation de montage permet à des volumes partagés montés par un conteneur à d'autres conteneurs dans un même Pod, ou même à d'autres Pods dans le même nœud. + +La propagation de montage d'un volume est contrôlée par le champ `mountPropagation` dans Container.volumeMounts. +Ses valeurs sont : + + * `None` - Ce montage de volume ne recevra aucun montage subséquent qui est monté à ce volume ou n'importe lequel de ses sous-dossiers par l'hôte. De la même manière, aucun montage créé par le conteneur ne sera visible sur l'hôte. C'est le mode par défaut. + + Ce mode équivaut à une propagation de montage `private` tel que décrit dans la [documentation du noyau Linux](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt) + + * `HostToContainer` - Ce montage de volume recevra les montages subséquents qui sont montés sur ce volume ou n'importe lequel de ses sous-dossiers. + + En d'autres termes, si l'hôte monte quoi que ce soit dans le montage de volume, le conteneur va le voir monté à cet endroit. + + De manière similaire, si un Pod avec la propagation de montage `Bidirectional` vers le même volume y monte quoi que ce soit, + le conteneur avec la propagation de montage `HostToContainer` le verra. + + Ce mode est équivalent à la propagation de montage `rslave` tel que décrit dans la + [documentation du noyau Linux](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt) + + * `Bidirectional` - Ce montage de volume se comporte de la même manière que le montage `HostToContainer`. + De plus, tous les montages de volume créés par le conteneur seront propagés à l'hôte et à tous les conteneurs des autres Pods qui utilisent le même volume. + + Un cas d'utilisation typique pour ce mode est un Pod avec un Flexvolume ou un pilote CSI, ou un Pod qui nécessite de monter quelque chose sur l'hôte en utilisant un volume `hostPath`. + + Ce mode est équivalent à une propagation de montage `rshared` tel que décrit dans la + [documentation du noyau Linux](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt) + +{{< caution >}} +La propagation de montage `Bidirectional` peut être dangereuse. Elle peut endommager le système d'exploitation hôte +et est donc autorisée seulement dans des conteneurs privilégiés. +Il est fortement recommandé d'être familier avec le comportement du noyau Linux. +De plus, tous les montages de volume créés par des conteneurs dans des Pods doivent être détruits (démontés) par les conteneurs lors de la terminaison. +{{< /caution >}} + +### Configuration +Avant que la propagation de montage puisse fonctionner correctement sur certains déploiements (CoreOS, +RedHat/Centos, Ubuntu) le partage de montage doit être correctement configuré dans Docker tel qu'illustré ci-dessous : + +Modifiez le fichier de service `systemd` de votre Docker. Configurez votre `MountFlags` comme suit : +```shell +MountFlags=shared +``` +Ou bien retirez `MountFlags=slave` si présent. Redémarrez ensuite le démon Docker : +```shell +sudo systemctl daemon-reload +sudo systemctl restart docker +``` + + + +{{% capture whatsnext %}} +* Suivez un exemple de [déploiement de WordPress et MySQL avec des volumes persistants](/docs/tutorials/stateful-application/mysql-wordpress-persistent-volume/). +{{% /capture %}} From ec9092d4edacc84a88e3b1be3224084f661581df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dami=C3=A1n=20Pumar?= Date: Thu, 15 Aug 2019 00:12:33 +0200 Subject: [PATCH 19/74] Glossary applications page translated (#15694) Update content/es/docs/reference/glossary/applications.md Co-Authored-By: Victor Morales Update content/es/docs/reference/glossary/applications.md --- content/es/docs/reference/glossary/applications.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 content/es/docs/reference/glossary/applications.md diff --git a/content/es/docs/reference/glossary/applications.md b/content/es/docs/reference/glossary/applications.md new file mode 100644 index 0000000000..eef13eeece --- /dev/null +++ b/content/es/docs/reference/glossary/applications.md @@ -0,0 +1,13 @@ +--- +title: Applications +id: applications +date: 2019-08-06 +full_link: +short_description: > + Es la capa donde se ejecutan varias aplicaciones en contenedores. + +aka: +tags: +- fundamental +--- + Es la capa donde se ejecutan varias aplicaciones en contenedores. From 4821582b89282907e42dcd38fdeeec057a67b64e Mon Sep 17 00:00:00 2001 From: Vincent Gramer Date: Thu, 15 Aug 2019 07:48:36 +0200 Subject: [PATCH 20/74] azure-file storage class: add missing parameter for multi tenancy #14762 (#14763) * initial commit * azure-file storage class: add missing parameter for multi tenancy #14762 * Update storage-classes.md --- .../en/docs/concepts/storage/storage-classes.md | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/storage/storage-classes.md b/content/en/docs/concepts/storage/storage-classes.md index 55a1392a25..2f130ce7ec 100644 --- a/content/en/docs/concepts/storage/storage-classes.md +++ b/content/en/docs/concepts/storage/storage-classes.md @@ -610,13 +610,25 @@ parameters: group are searched to find one that matches `skuName` and `location`. If a storage account is provided, it must reside in the same resource group as the cluster, and `skuName` and `location` are ignored. +* `secretNamespace`: the namespace of the secret that contains the Azure Storage + Account Name and Key. Default is the same as the Pod. +* `secretName`: the name of the secret that contains the Azure Storage Account Name and + Key. Default is `azure-storage-account--secret` +* `readOnly`: a flag indicating whether the storage will be mounted as read only. + Defaults to false which means a read/write mount. This setting will impact the + `ReadOnly` setting in VolumeMounts as well. -During provision, a secret is created for mounting credentials. If the cluster -has enabled both [RBAC](/docs/reference/access-authn-authz/rbac/) and +During storage provisioning, a secret named by `secretName` is created for the +mounting credentials. If the cluster has enabled both +[RBAC](/docs/reference/access-authn-authz/rbac/) and [Controller Roles](/docs/reference/access-authn-authz/rbac/#controller-roles), add the `create` permission of resource `secret` for clusterrole `system:controller:persistent-volume-binder`. +In a multi-tenancy context, it is strongly recommended to set the value for +`secretNamespace` explicitly, otherwise the storage account credentials may +be read by other users. + ### Portworx Volume ```yaml From b9cf29b7b3aa9b79059b61896f7fd3b003c8c21e Mon Sep 17 00:00:00 2001 From: mohamed chiheb ben jemaa Date: Thu, 15 Aug 2019 08:54:33 +0100 Subject: [PATCH 21/74] Issue with k8s.io/docs/setup/production-environment/container-runtimes/ (#15476) * update containerd prerequisites: * change shell --- .../docs/setup/production-environment/container-runtimes.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/content/en/docs/setup/production-environment/container-runtimes.md b/content/en/docs/setup/production-environment/container-runtimes.md index b63330438d..80c2cc639c 100644 --- a/content/en/docs/setup/production-environment/container-runtimes.md +++ b/content/en/docs/setup/production-environment/container-runtimes.md @@ -215,6 +215,11 @@ Use the following commands to install Containerd on your system: ### Prerequisites ```shell +cat > /etc/modules-load.d/containerd.conf < Date: Thu, 15 Aug 2019 17:18:35 +0200 Subject: [PATCH 22/74] translated term: pod (#15162) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * translated term: pod * [update] translation: pod, completed link address * [update] translation: pod Deployment instead of déploiment --- content/fr/docs/reference/glossary/pod.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 content/fr/docs/reference/glossary/pod.md diff --git a/content/fr/docs/reference/glossary/pod.md b/content/fr/docs/reference/glossary/pod.md new file mode 100644 index 0000000000..2d400c75a6 --- /dev/null +++ b/content/fr/docs/reference/glossary/pod.md @@ -0,0 +1,18 @@ +--- +title: Pod +id: pod +date: 2018-04-12 +full_link: fr/docs/concepts/workloads/pods/pod-overview/ +short_description: > + Le plus petit et le plus simple des objets Kubernetes. Un Pod est un ensemble de conteneurs fonctionnant sur votre cluster. + +aka: +tags: +- core-object +- fundamental +--- + Le plus petit et le plus simple des objets Kubernetes. Un Pod est un ensemble de {{< glossary_tooltip text="conteneurs" term_id="container" >}} fonctionnant sur votre cluster. + + + +Un Pod est généralement configuré pour faire fonctionner un seul conteneur primaire. Il peut également exécuter des conteneurs side-car optionnels qui ajoutent des fonctions supplémentaires comme le logging. Les Pods sont généralement gérés par un {{< glossary_tooltip="Deployment" term_id="deployment" >}}. From 559e25d941426d251f0095d7f8e466ffc1fd8798 Mon Sep 17 00:00:00 2001 From: Javi Sabalete Date: Thu, 15 Aug 2019 23:00:35 +0200 Subject: [PATCH 23/74] Add content/es/docs/reference/glossary/kubelet.md (#14556) --- content/es/docs/reference/glossary/kubelet.md | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100755 content/es/docs/reference/glossary/kubelet.md diff --git a/content/es/docs/reference/glossary/kubelet.md b/content/es/docs/reference/glossary/kubelet.md new file mode 100755 index 0000000000..6b479018f3 --- /dev/null +++ b/content/es/docs/reference/glossary/kubelet.md @@ -0,0 +1,20 @@ +--- +title: Kubelet +id: kubelet +date: 2018-04-12 +full_link: /docs/reference/generated/kubelet +short_description: > + Agente que se ejecuta en cada nodo de un clúster. Se asegura de que los contenedores estén corriendo en un pod. + +aka: +tags: +- fundamental +- core-object +--- + Agente que se ejecuta en cada nodo de un clúster. Se asegura de que los contenedores estén corriendo en un pod. + + + +El agente kubelet toma un conjunto de especificaciones de {{< glossary_tooltip text="Pod" term_id="pod" >}}, llamados + PodSpecs, que han sido creados por Kubernetes y garantiza que los contenedores descritos en ellos estén funcionando y + en buen estado. From 73ef2c557b4b888655516ee23af031768163788f Mon Sep 17 00:00:00 2001 From: mohamed chiheb ben jemaa Date: Fri, 16 Aug 2019 04:28:33 +0100 Subject: [PATCH 24/74] adjust and center Blog links (#15541) --- layouts/blog/baseof.html | 16 ++++++++-------- static/css/blog.css | 15 +++++++++++++-- 2 files changed, 21 insertions(+), 10 deletions(-) diff --git a/layouts/blog/baseof.html b/layouts/blog/baseof.html index 358cb7bd3c..85095f152c 100644 --- a/layouts/blog/baseof.html +++ b/layouts/blog/baseof.html @@ -20,15 +20,15 @@
{{ with site.Home.OutputFormats.Get "rss" -}} - RSS Feed +
RSS Feed
 {{ end -}} - Submit a Post - @Kubernetesio - View on GitHub - #kubernetes-users - Stack Overflow - Forum - Download Kubernetes +
Submit a Post
 +
@Kubernetesio
 +
on GitHub
+
#kubernetes-users
+
Overflow
 +
Forum
+
Kubernetes
{{ partialCached "blog/archive.html" . }} diff --git a/static/css/blog.css b/static/css/blog.css index 7098e241ea..c584ee4e53 100644 --- a/static/css/blog.css +++ b/static/css/blog.css @@ -271,7 +271,7 @@ h3.post-title{ box-sizing: border-box; padding: 0 0 0 15px; margin: 10px 0; - line-height: 40px; + line-height: 50px; white-space: nowrap; font-family: Roboto, sans-serif; } @@ -401,10 +401,21 @@ ul { /* Sidebar Icon Styles */ .widget-link svg { - font-size: 48px; + font-size: 40px; color:#326DE6; + vertical-align: middle; + width: 40px !important; } +.widget-link div { + display: flex; +} + +.widget-link .widget-link-text { + margin-left: 6px; +} + + /* SideNavigation Styles */ .heading-year-toggle-checkbox, .heading-month-toggle-checkbox{ From 7fc805038910a592c63d539a8d29bf87143c0219 Mon Sep 17 00:00:00 2001 From: Max Kaminskiy Date: Thu, 15 Aug 2019 20:30:33 -0700 Subject: [PATCH 25/74] Note to limit changes in PR to one language (#15773) * Updated Start Contributing docs asking to limit changes to one language in each PR. * Moved note about one language per PR to end of step 5. --- content/en/docs/contribute/start.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/en/docs/contribute/start.md b/content/en/docs/contribute/start.md index 67fbe8d38a..8d953ba57c 100644 --- a/content/en/docs/contribute/start.md +++ b/content/en/docs/contribute/start.md @@ -261,6 +261,10 @@ pull request if it detects that you pushed a new branch to your fork. link for the `deploy/netlify` test, near the bottom of the page. It opens in the same browser window by default. + {{< note >}} + Please limit pull requests to one language per PR. For example, if you need to make an identical change to the same code sample in multiple languages, open a separate PR for each language. + {{< /note >}} + 6. Wait for review. Generally, reviewers are suggested by the `k8s-ci-robot`. If a reviewer asks you to make changes, you can go to the **Files changed** tab and click the pencil icon on any files that have been changed by the From 7796f3cea6d9bec5a47ded2c32ec770480ba6baf Mon Sep 17 00:00:00 2001 From: Melony QIN Date: Fri, 16 Aug 2019 04:36:32 +0100 Subject: [PATCH 26/74] add rollout history and back to specific revision (#15818) add rollout history and back to specific revision --- content/en/docs/reference/kubectl/cheatsheet.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/content/en/docs/reference/kubectl/cheatsheet.md b/content/en/docs/reference/kubectl/cheatsheet.md index ea846c4254..ecec12f3be 100644 --- a/content/en/docs/reference/kubectl/cheatsheet.md +++ b/content/en/docs/reference/kubectl/cheatsheet.md @@ -205,9 +205,12 @@ As of version 1.11 `rolling-update` have been deprecated (see [CHANGELOG-1.11.md ```bash kubectl set image deployment/frontend www=image:v2 # Rolling update "www" containers of "frontend" deployment, updating the image +kubectl rollout history deployment/frontend # Check the history of deployments including the revision kubectl rollout undo deployment/frontend # Rollback to the previous deployment +kubectl rollout undo deployment/frontend --to-revision=2 # Rollback to a specific revision kubectl rollout status -w deployment/frontend # Watch rolling update status of "frontend" deployment until completion + # deprecated starting version 1.11 kubectl rolling-update frontend-v1 -f frontend-v2.json # (deprecated) Rolling update pods of frontend-v1 kubectl rolling-update frontend-v1 frontend-v2 --image=image:v2 # (deprecated) Change the name of the resource and update the image From 9bc1316049cf89db01dbecc68c46128688857a19 Mon Sep 17 00:00:00 2001 From: Arnaud M Date: Fri, 16 Aug 2019 08:42:34 +0200 Subject: [PATCH 27/74] Fix default value of the annotation. (#15851) --- content/en/docs/concepts/services-networking/service.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/services-networking/service.md b/content/en/docs/concepts/services-networking/service.md index 2a8e23dc7d..93baefd47a 100644 --- a/content/en/docs/concepts/services-networking/service.md +++ b/content/en/docs/concepts/services-networking/service.md @@ -598,7 +598,7 @@ For more information, see the [docs](https://cloud.google.com/kubernetes-engine/ metadata: name: my-service annotations: - service.beta.kubernetes.io/aws-load-balancer-internal: 0.0.0.0/0 + service.beta.kubernetes.io/aws-load-balancer-internal: "true" [...] ``` {{% /tab %}} From d0118a452b70683447c66ade66a83953c3063ad4 Mon Sep 17 00:00:00 2001 From: Soto Sugita Date: Fri, 16 Aug 2019 15:44:33 +0900 Subject: [PATCH 28/74] Fix incorrect command line (#15882) --- .../debug-pod-replication-controller.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md b/content/en/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md index 1f996b1042..f1740d9ae7 100644 --- a/content/en/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md +++ b/content/en/docs/tasks/debug-application-cluster/debug-pod-replication-controller.md @@ -63,7 +63,7 @@ case you can try several things: information: ```shell - kubectl get nodes -o yaml | egrep '\sname:\|cpu:\|memory:' + kubectl get nodes -o yaml | egrep '\sname:|cpu:|memory:' kubectl get nodes -o json | jq '.items[] | {name: .metadata.name, cap: .status.capacity}' ``` From 0e319bad69f5aade6173dfcba483d2839d4238bb Mon Sep 17 00:00:00 2001 From: yofri Date: Fri, 16 Aug 2019 16:26:33 +0700 Subject: [PATCH 29/74] Adding Bahasa Indonesia translation for certificates page (#15769) * Add Bahasa Indonesia translation for certificates page * Untranslated title * Updating translation --- .../cluster-administration/certificates.md | 250 ++++++++++++++++++ 1 file changed, 250 insertions(+) create mode 100644 content/id/docs/concepts/cluster-administration/certificates.md diff --git a/content/id/docs/concepts/cluster-administration/certificates.md b/content/id/docs/concepts/cluster-administration/certificates.md new file mode 100644 index 0000000000..8dc7ee5813 --- /dev/null +++ b/content/id/docs/concepts/cluster-administration/certificates.md @@ -0,0 +1,250 @@ +--- +title: Sertifikat +content_template: templates/concept +weight: 20 +--- + +{{% capture overview %}} + +Saat menggunakan autentikasi sertifikat klien, kamu dapat membuat sertifikat +secara manual melalui `easyrsa`, `openssl` atau `cfssl`. + +{{% /capture %}} + + +{{% capture body %}} + +### easyrsa + +**easyrsa** dapat digunakan untuk menghasilkan sertifikat kluster kamu secara manual. + +1. Unduh, buka paket, dan inisialisasi versi tambal easyrsa3. + + curl -LO https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz + tar xzf easy-rsa.tar.gz + cd easy-rsa-master/easyrsa3 + ./easyrsa init-pki +1. Hasilkan CA. (`--batch` untuk atur mode otomatis. `--req-cn` untuk menggunakan _default_ CN.) + + ./easyrsa --batch "--req-cn=${MASTER_IP}@`date +%s`" build-ca nopass +1. Hasilkan sertifikat dan kunci _server_. + Argumen `--subject-alt-name` digunakan untuk mengatur alamat IP dan nama DNS yang dapat diakses + oleh _server_ API. `MASTER_CLUSTER_IP` biasanya merupakan IP pertama dari CIDR _service cluster_ + yang diset dengan argumen` --service-cluster-ip-range` untuk _server_ API dan + komponen manajer pengontrol. Argumen `--days` digunakan untuk mengatur jumlah hari + masa berlaku sertifikat. + Sampel di bawah ini juga mengasumsikan bahwa kamu menggunakan `cluster.local` sebagai nama + _domain_ DNS _default_. + + ./easyrsa --subject-alt-name="IP:${MASTER_IP},"\ + "IP:${MASTER_CLUSTER_IP},"\ + "DNS:kubernetes,"\ + "DNS:kubernetes.default,"\ + "DNS:kubernetes.default.svc,"\ + "DNS:kubernetes.default.svc.cluster,"\ + "DNS:kubernetes.default.svc.cluster.local" \ + --days=10000 \ + build-server-full server nopass +1. Salin `pki/ca.crt`, `pki/issued/server.crt`, dan `pki/private/server.key` ke direktori kamu. +1. Isi dan tambahkan parameter berikut ke dalam parameter mulai _server_ API: + + --client-ca-file=/yourdirectory/ca.crt + --tls-cert-file=/yourdirectory/server.crt + --tls-private-key-file=/yourdirectory/server.key + +### openssl + +**openssl** secara manual dapat menghasilkan sertifikat untuk kluster kamu. + +1. Hasilkan ca.key dengan 2048bit: + + openssl genrsa -out ca.key 2048 +1. Hasilkan ca.crt berdasarkan ca.key (gunakan -days untuk mengatur waktu efektif sertifikat): + + openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt +1. Hasilkan server.key dengan 2048bit: + + openssl genrsa -out server.key 2048 +1. Buat _file_ konfigurasi untuk menghasilkan _Certificate Signing Request_ (CSR). + Pastikan untuk mengganti nilai yang ditandai dengan kurung sudut (mis. ``) + dengan nilai sebenarnya sebelum menyimpan ke _file_ (mis. `csr.conf`). + Perhatikan bahwa nilai `MASTER_CLUSTER_IP` adalah layanan IP kluster untuk + _server_ API seperti yang dijelaskan dalam subbagian sebelumnya. + Sampel di bawah ini juga mengasumsikan bahwa kamu menggunakan `cluster.local` + sebagai nama _domain_ DNS _default_. + + [ req ] + default_bits = 2048 + prompt = no + default_md = sha256 + req_extensions = req_ext + distinguished_name = dn + + [ dn ] + C = + ST = + L = + O = + OU = + CN = + + [ req_ext ] + subjectAltName = @alt_names + + [ alt_names ] + DNS.1 = kubernetes + DNS.2 = kubernetes.default + DNS.3 = kubernetes.default.svc + DNS.4 = kubernetes.default.svc.cluster + DNS.5 = kubernetes.default.svc.cluster.local + IP.1 = + IP.2 = + + [ v3_ext ] + authorityKeyIdentifier=keyid,issuer:always + basicConstraints=CA:FALSE + keyUsage=keyEncipherment,dataEncipherment + extendedKeyUsage=serverAuth,clientAuth + subjectAltName=@alt_names +1. Hasilkan permintaan penandatanganan sertifikat berdasarkan _file_ konfigurasi: + + openssl req -new -key server.key -out server.csr -config csr.conf +1. Hasilkan sertifikat _server_ menggunakan ca.key, ca.crt dan server.csr: + + openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \ + -CAcreateserial -out server.crt -days 10000 \ + -extensions v3_ext -extfile csr.conf +1. Lihat sertifikat: + + openssl x509 -noout -text -in ./server.crt + +Terakhir, tambahkan parameter yang sama ke dalam parameter mulai _server_ API. + +### cfssl + +**cfssl** adalah alat lain untuk pembuatan sertifikat. + +1. Unduh, buka paket dan siapkan _command line tools_ seperti yang ditunjukkan di bawah ini. + Perhatikan bahwa kamu mungkin perlu menyesuaikan contoh perintah berdasarkan arsitektur + perangkat keras dan versi cfssl yang kamu gunakan. + + curl -L https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -o cfssl + chmod +x cfssl + curl -L https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -o cfssljson + chmod +x cfssljson + curl -L https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -o cfssl-certinfo + chmod +x cfssl-certinfo +1. Buat direktori untuk menyimpan _artifacts_ dan inisialisasi cfssl: + + mkdir cert + cd cert + ../cfssl print-defaults config > config.json + ../cfssl print-defaults csr > csr.json +1. Buat _file_ konfigurasi JSON untuk menghasilkan _file_ CA, misalnya, `ca-config.json`: + + { + "signing": { + "default": { + "expiry": "8760h" + }, + "profiles": { + "kubernetes": { + "usages": [ + "signing", + "key encipherment", + "server auth", + "client auth" + ], + "expiry": "8760h" + } + } + } + } +1. Buat _file_ konfigurasi JSON untuk CA _certificate signing request_ (CSR), misalnya, + `ca-csr.json`. Pastikan untuk mengganti nilai yang ditandai dengan kurung sudut + dengan nilai sebenarnya yang ingin kamu gunakan. + + { + "CN": "kubernetes", + "key": { + "algo": "rsa", + "size": 2048 + }, + "names":[{ + "C": "", + "ST": "", + "L": "", + "O": "", + "OU": "" + }] + } +1. Hasilkan kunci CA (`ca-key.pem`) dan sertifikat (`ca.pem`): + + ../cfssl gencert -initca ca-csr.json | ../cfssljson -bare ca +1. Buat _file_ konfigurasi JSON untuk menghasilkan kunci dan sertifikat untuk API + _server_, misalnya, `server-csr.json`. Pastikan untuk mengganti nilai dalam kurung sudut + dengan nilai sebenarnya yang ingin kamu gunakan. `MASTER_CLUSTER_IP` adalah layanan + kluster IP untuk _server_ API seperti yang dijelaskan dalam subbagian sebelumnya. + Sampel di bawah ini juga mengasumsikan bahwa kamu menggunakan `cluster.local` sebagai + nama _domain_ DNS _default_. + + { + "CN": "kubernetes", + "hosts": [ + "127.0.0.1", + "", + "", + "kubernetes", + "kubernetes.default", + "kubernetes.default.svc", + "kubernetes.default.svc.cluster", + "kubernetes.default.svc.cluster.local" + ], + "key": { + "algo": "rsa", + "size": 2048 + }, + "names": [{ + "C": "", + "ST": "", + "L": "", + "O": "", + "OU": "" + }] + } +1. Buat kunci dan sertifikat untuk server API, yang mana awalnya di + simpan masing-masing ke dalam _file_ `server-key.pem` dan `server.pem`: + + ../cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \ + --config=ca-config.json -profile=kubernetes \ + server-csr.json | ../cfssljson -bare server + + +## Distribusi Sertifikat _Self-Signed_ CA + +_Node_ klien dapat menolak untuk mengakui sertifikat CA yang ditandatangani sendiri sebagai valid. +Untuk _deployment_ non-produksi, atau untuk _deployment_ yang berjalan di belakang _firewall_ perusahaan, +kamu dapat mendistribusikan sertifikat CA yang ditandatangani sendiri untuk semua klien dan _refresh_ +daftar lokal untuk sertifikat yang valid. + +Pada setiap klien, lakukan operasi berikut: + +```bash +sudo cp ca.crt /usr/local/share/ca-certificates/kubernetes.crt +sudo update-ca-certificates +``` + +``` +Updating certificates in /etc/ssl/certs... +1 added, 0 removed; done. +Running hooks in /etc/ca-certificates/update.d.... +done. +``` + +## Sertifikat API + +Kamu dapat menggunakan API `Certificate.k8s.io` untuk menyediakan +sertifikat x509 yang digunakan untuk autentikasi seperti yang didokumentasikan +[di sini](/docs/tasks/tls/managing-tls-in-a-cluster). + +{{% /capture %}} From ff2e762302ef7d07f7b8fa7a6effdbe3094136cf Mon Sep 17 00:00:00 2001 From: Ryan Zidago <46972947+ryanzidago@users.noreply.github.com> Date: Fri, 16 Aug 2019 16:34:31 +0200 Subject: [PATCH 30/74] docs-fr | docs | reference | glossary | code-contributor.md (#15210) * docs-fr | docs | reference | glossary | code-contributor.md * updated title --- .../reference/glossary/code-contributor.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100755 content/fr/docs/reference/glossary/code-contributor.md diff --git a/content/fr/docs/reference/glossary/code-contributor.md b/content/fr/docs/reference/glossary/code-contributor.md new file mode 100755 index 0000000000..b287422ad8 --- /dev/null +++ b/content/fr/docs/reference/glossary/code-contributor.md @@ -0,0 +1,18 @@ +--- +title: Contributeur de Code +id: code-contributor +date: 2018-04-12 +full_link: /docs/community/devel/ +short_description: > + Personne qui développe et contribue au code open source de Kubernetes. + +aka: +tags: +- community +- user-type +--- + Personne qui développe et contribue au code open source de Kubernetes. + + + +Cette personne est aussi un {{< glossary_tooltip text="membre actif de la communauté" term_id="member" >}} participant à un ou plusieurs {{< glossary_tooltip text="Groupes d'Intérêts Spéciaux (SIGs, de l'anglais Special Interest Groups)" term_id="sig" >}}. From 0b302456e795099f98f30c2c348904ca7abe4ea7 Mon Sep 17 00:00:00 2001 From: Ryan Zidago <46972947+ryanzidago@users.noreply.github.com> Date: Fri, 16 Aug 2019 16:36:31 +0200 Subject: [PATCH 31/74] docs-fr | docs | reference | glossary | approver.md (#15092) * docs-fr | docs | reference | glossary | approver.md * added missing translation --- content/fr/docs/reference/glossary/approver.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100755 content/fr/docs/reference/glossary/approver.md diff --git a/content/fr/docs/reference/glossary/approver.md b/content/fr/docs/reference/glossary/approver.md new file mode 100755 index 0000000000..b9dc84c1ce --- /dev/null +++ b/content/fr/docs/reference/glossary/approver.md @@ -0,0 +1,17 @@ +--- +title: Approbateur +id: approver +date: 2018-04-12 +full_link: +short_description: > + Personne pouvant passer en revue et approuver les contributions au code Kubernetes. + +aka: +tags: +- community +--- + Personne pouvant passer en revue et approuver les contributions au code Kubernetes. + + + +Alors que l'examen du code est axé sur la qualité et l'exactitude de ce dernier, l'approbation est, quant à elle, axée sur l'acceptation globale d'une contribution. L'acceptation globale inclut entre autres, la (rétro-)comptabilité, le respect des conventions concernant l'API et les drapeaux, les problèmes subtils de performance et d'exactitude, ainsi que les interactions avec d'autres parties du système. Le statut d'approbateur est limité à une partie de la base de code. Auparavant, les approbateurs étaient appelés mainteneurs. From 9916555d7677c5632b5846b6211e2ffc98ede4b7 Mon Sep 17 00:00:00 2001 From: Ryan Zidago <46972947+ryanzidago@users.noreply.github.com> Date: Fri, 16 Aug 2019 16:38:34 +0200 Subject: [PATCH 32/74] docs-fr | reference | glossary | cri-o.md (#15277) * docs-fr | reference | glossary | cri-o.md * added missing word in short description --- content/fr/docs/reference/glossary/cri-o.md | 22 +++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 content/fr/docs/reference/glossary/cri-o.md diff --git a/content/fr/docs/reference/glossary/cri-o.md b/content/fr/docs/reference/glossary/cri-o.md new file mode 100644 index 0000000000..2c39293a8a --- /dev/null +++ b/content/fr/docs/reference/glossary/cri-o.md @@ -0,0 +1,22 @@ +--- +title: CRI-O +id: cri-o +date: 2019-05-14 +full_link: https://cri-o.io/docs/ +short_description: > + Un runtime (environnement d'exécution) de conteneur, léger et spécifiquement conçu pour Kubernetes. + +aka: +tags: +- tool +--- +Un outil permettant d'utiliser les runtimes de conteneurs OCI avec Kubernetes CRI. + + + +CRI-O est une implémentation du {{< glossary_tooltip term_id="cri" >}} +permettant l'utilisation des runtimes de {{< glossary_tooltip text="conteneurs" term_id="container" >}} +compatibles avec l'Open Container Initiative (OCI) +[runtime spec](http://www.github.com/opencontainers/runtime-spec). + +Le déploiement de CRI-O permet à Kubernetes d'utiliser n'importe quel runtime conforme à l'OCI, en tant que runtime de conteneur, afin d'exécuter les {{< glossary_tooltip text="Pods" term_id="pod" >}}, et de récupérer les images de conteneurs OCI provenant de registres distants. From e3c12ea5dcdc3eb053ccffe6cd8f677f70e5e71f Mon Sep 17 00:00:00 2001 From: Kane York Date: Fri, 16 Aug 2019 12:32:09 -0700 Subject: [PATCH 33/74] Update broken KEP links (#15806) --- content/de/docs/concepts/architecture/nodes.md | 2 +- content/en/blog/_posts/2018-05-29-announcing-kustomize.md | 2 +- content/en/blog/_posts/2018-10-10-runtimeclass.md | 2 +- content/en/docs/concepts/architecture/nodes.md | 2 +- content/es/docs/concepts/architecture/nodes.md | 2 +- content/fr/docs/concepts/architecture/nodes.md | 2 +- content/id/docs/concepts/architecture/nodes.md | 2 +- content/it/docs/concepts/architecture/nodes.md | 2 +- content/ko/docs/concepts/architecture/nodes.md | 2 +- data/user-personas/contributors/code-contributor.yaml | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/content/de/docs/concepts/architecture/nodes.md b/content/de/docs/concepts/architecture/nodes.md index faf5e5decb..29c0c33e7c 100644 --- a/content/de/docs/concepts/architecture/nodes.md +++ b/content/de/docs/concepts/architecture/nodes.md @@ -152,7 +152,7 @@ Der Node Controller überprüft den Zustand jedes Nodes alle `--node-monitor-per In Versionen von Kubernetes vor 1.13 ist NodeStatus der Herzschlag des Nodes. -Ab Kubernetes 1.13 wird das Node-Lease-Feature als Alpha-Feature eingeführt (Feature-Gate `NodeLease`, [KEP-0009](https://github.com/kubernetes/community/blob/master/keps/sig-node/0009-node-heartbeat.md)). +Ab Kubernetes 1.13 wird das Node-Lease-Feature als Alpha-Feature eingeführt (Feature-Gate `NodeLease`, [KEP-0009](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/0009-node-heartbeat.md)). Wenn die Node Lease Funktion aktiviert ist, hat jeder Node ein zugeordnetes `Lease`-Objekt im `kube-node-lease`-Namespace, das vom Node regelmäßig erneuert wird. Sowohl NodeStatus als auch Node Lease werden als Herzschläge vom Node aus behandelt. diff --git a/content/en/blog/_posts/2018-05-29-announcing-kustomize.md b/content/en/blog/_posts/2018-05-29-announcing-kustomize.md index 908ce72363..fbd1192e95 100644 --- a/content/en/blog/_posts/2018-05-29-announcing-kustomize.md +++ b/content/en/blog/_posts/2018-05-29-announcing-kustomize.md @@ -11,7 +11,7 @@ date: 2018-05-29 [kustomization]: https://github.com/kubernetes-sigs/kustomize/blob/master/docs/glossary.md#kustomization [mailing list]: https://groups.google.com/forum/#!forum/kustomize [open an issue]: https://github.com/kubernetes-sigs/kustomize/issues/new -[subproject]: https://github.com/kubernetes/community/blob/master/keps/sig-cli/0008-kustomize.md +[subproject]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-cli/0008-kustomize.md [SIG-CLI]: https://github.com/kubernetes/community/tree/master/sig-cli [workflow]: https://github.com/kubernetes-sigs/kustomize/blob/master/docs/workflows.md diff --git a/content/en/blog/_posts/2018-10-10-runtimeclass.md b/content/en/blog/_posts/2018-10-10-runtimeclass.md index d47ad9c9cb..29ae6e3285 100644 --- a/content/en/blog/_posts/2018-10-10-runtimeclass.md +++ b/content/en/blog/_posts/2018-10-10-runtimeclass.md @@ -42,6 +42,6 @@ RuntimeClass will be under active development at least through 2019, and we’re ## Learn More - Take it for a spin! As an alpha feature, there are some additional setup steps to use RuntimeClass. Refer to the [RuntimeClass documentation](/docs/concepts/containers/runtime-class/#runtime-class) for how to get it running. -- Check out the [RuntimeClass Kubernetes Enhancement Proposal](https://github.com/kubernetes/community/blob/master/keps/sig-node/0014-runtime-class.md) for more nitty-gritty design details. +- Check out the [RuntimeClass Kubernetes Enhancement Proposal](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/0014-runtime-class.md) for more nitty-gritty design details. - The [Sandbox Isolation Level Decision](https://docs.google.com/document/d/1fe7lQUjYKR0cijRmSbH_y0_l3CYPkwtQa5ViywuNo8Q/preview) documents the thought process that initially went into making RuntimeClass a pod-level choice. - Join the discussions and help shape the future of RuntimeClass with the [SIG-Node community](https://github.com/kubernetes/community/tree/master/sig-node) diff --git a/content/en/docs/concepts/architecture/nodes.md b/content/en/docs/concepts/architecture/nodes.md index 58f9d014f1..5bb680aedd 100644 --- a/content/en/docs/concepts/architecture/nodes.md +++ b/content/en/docs/concepts/architecture/nodes.md @@ -176,7 +176,7 @@ checks the state of each node every `--node-monitor-period` seconds. In versions of Kubernetes prior to 1.13, NodeStatus is the heartbeat from the node. Starting from Kubernetes 1.13, node lease feature is introduced as an alpha feature (feature gate `NodeLease`, -[KEP-0009](https://github.com/kubernetes/community/blob/master/keps/sig-node/0009-node-heartbeat.md)). +[KEP-0009](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/0009-node-heartbeat.md)). When node lease feature is enabled, each node has an associated `Lease` object in `kube-node-lease` namespace that is renewed by the node periodically, and both NodeStatus and node lease are treated as heartbeats from the node. Node leases diff --git a/content/es/docs/concepts/architecture/nodes.md b/content/es/docs/concepts/architecture/nodes.md index 17cd61111b..44c3029ec1 100644 --- a/content/es/docs/concepts/architecture/nodes.md +++ b/content/es/docs/concepts/architecture/nodes.md @@ -114,7 +114,7 @@ El segundo es mantener actualizada la lista interna del controlador con la lista El tercero es el de monitorizar la salud de los nodos. El controlador de nodos es el responsable de actualizar la condición `NodeReady` del campo `NodeStatus` a `ConditionUnknown` cuando un nodo deja de estar accesible (por ejemplo, si deja de recibir señales de vida del nodo indicando que está disponible, conocidas como latidos o `hearbeats` en inglés) y, también es responsable de posteriormente desalojar todos los pods del nodo si este continúa estando inalcanzable. Por defecto, cuando un nodo deja de responder, el controlador sigue re-intentando contactar con el nodo durante 40 segundos antes de marcar el nodo con `ConditionUnknown` y, si el nodo no se recupera de ese estado pasados 5 minutos, empezará a drenar los pods del nodo para desplegarlos en otro nodo que esté disponible. El controlador comprueba el estado de cada nodo cada `--node-monitor-period` segundos. En versiones de Kubernetes previas a 1.13, `NodeStatus` es el `heartbeat` del nodo. Empezando con 1.13 la funcionalidad de `node lease` se introduce como alfa (`NodeLease`, -[KEP-0009](https://github.com/kubernetes/community/blob/master/keps/sig-node/0009-node-heartbeat.md)). Cuando la funcionalidad está habilitada, cada nodo tiene un objeto `Lease` asociado en el namespace `kube-node-lease` que se renueva periódicamente y ambos, el `NodeStatus` y el `Lease` son considerados como `hearbeats` del nodo. `Node leases` se renuevan con frecuencia, mientras que `NodeStatus` se transmite desde el nodo al máster únicamente si hay cambios o si ha pasado cierto tiempo (por defecto, 1 minuto, que es más que la cuenta atrás por defecto de 40 segundos que marca un nodo como inalcanzable). Al ser los `node lease` más ligeros que `NodeStatus`, los `hearbeats` resultan más económicos desde las perspectivas de escalabilidad y de rendimiento. +[KEP-0009](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/0009-node-heartbeat.md)). Cuando la funcionalidad está habilitada, cada nodo tiene un objeto `Lease` asociado en el namespace `kube-node-lease` que se renueva periódicamente y ambos, el `NodeStatus` y el `Lease` son considerados como `hearbeats` del nodo. `Node leases` se renuevan con frecuencia, mientras que `NodeStatus` se transmite desde el nodo al máster únicamente si hay cambios o si ha pasado cierto tiempo (por defecto, 1 minuto, que es más que la cuenta atrás por defecto de 40 segundos que marca un nodo como inalcanzable). Al ser los `node lease` más ligeros que `NodeStatus`, los `hearbeats` resultan más económicos desde las perspectivas de escalabilidad y de rendimiento. En Kubernetes 1.4, se actualizó la lógica del controlador de nodos para gestionar mejor los casos en los que un gran número de nodos tiene problemas alcanzando el nodo máster (Por ejemplo, cuando el nodo máster es el que tiene un problema de red). Desde 1.4, el controlador de nodos observa el estado de todos los nodos en el clúster cuando toma decisiones sobre desalojo de pods. diff --git a/content/fr/docs/concepts/architecture/nodes.md b/content/fr/docs/concepts/architecture/nodes.md index e95525ebc1..17d5c807d3 100644 --- a/content/fr/docs/concepts/architecture/nodes.md +++ b/content/fr/docs/concepts/architecture/nodes.md @@ -144,7 +144,7 @@ Le contrôleur de noeud est responsable de la mise à jour de la condition NodeR Le contrôleur de nœud vérifie l'état de chaque nœud toutes les `--node-monitor-period` secondes. Dans les versions de Kubernetes antérieures à 1.13, NodeStatus correspond au heartbeat du nœud. -À partir de Kubernetes 1.13, la fonctionnalité de bail de nœud (node lease en anglais) est introduite en tant que fonctionnalité alpha (feature gate `NodeLease`, [KEP-0009](https://github.com/kubernetes/community/blob/master/keps/sig-node/0009-node-heartbeat.md)). +À partir de Kubernetes 1.13, la fonctionnalité de bail de nœud (node lease en anglais) est introduite en tant que fonctionnalité alpha (feature gate `NodeLease`, [KEP-0009](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/0009-node-heartbeat.md)). Lorsque la fonction de node lease est activée, chaque noeud a un objet `Lease` associé dans le namespace `kube-node-lease` qui est renouvelé périodiquement par le noeud, et NodeStatus et le node lease sont traités comme des heartbeat du noeud. Les node leases sont renouvelés fréquemment lorsque NodeStatus est signalé de nœud à master uniquement lorsque des modifications ont été apportées ou que suffisamment de temps s'est écoulé (la valeur par défaut est 1 minute, ce qui est plus long que le délai par défaut de 40 secondes pour les nœuds inaccessibles). Étant donné qu'un node lease est beaucoup plus léger qu'un NodeStatus, cette fonctionnalité rends le heartbeat d'un nœud nettement moins coûteux, tant du point de vue de l'évolutivité que des performances. diff --git a/content/id/docs/concepts/architecture/nodes.md b/content/id/docs/concepts/architecture/nodes.md index fad8351cb8..ab5cb4d091 100644 --- a/content/id/docs/concepts/architecture/nodes.md +++ b/content/id/docs/concepts/architecture/nodes.md @@ -138,7 +138,7 @@ Kontroler node memeriksa state masing-masing node untuk durasi yang diten Pada versi Kubernetes sebelum 1.13, `NodeStatus` adalah heartbeat yang diberikan oleh node. Setelah versi 1.13, fitur node lease diperkenalkan sebagai fitur alpha (fitur gate `NodeLease`, -[KEP-0009](https://github.com/kubernetes/community/blob/master/keps/sig-node/0009-node-heartbeat.md)). +[KEP-0009](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/0009-node-heartbeat.md)). Ketika fitur node lease diaktifasi, setiap node terhubung dengan obyek `Lease` di dalam namespace `kube-node-lease` yang terus diperbarui secara berkala. Kemudian, `NodeStatus` dan node lease keduanya dijadikan sebagai heartbeat dari node. Semua node lease diperbarui sesering mungkin, sedangkan `NodeStatus` dilaporkan dari node untuk master hanya ketika ada perubahan atau telah melewati periode waktu tertentu (default-nya 1 menit, lebih lama daripada default timeout node-node yang terputus jaringannya). diff --git a/content/it/docs/concepts/architecture/nodes.md b/content/it/docs/concepts/architecture/nodes.md index bba9a7bf74..c7ca78917b 100644 --- a/content/it/docs/concepts/architecture/nodes.md +++ b/content/it/docs/concepts/architecture/nodes.md @@ -161,7 +161,7 @@ controlla lo stato di ogni nodo ogni `--node-monitor-period` secondi. Nelle versioni di Kubernetes precedenti alla 1.13, NodeStatus è l'heartbeat di nodo. A partire da Kubernetes 1.13, la funzionalità di lease del nodo viene introdotta come un funzione alfa (porta caratteristica `NodeLease`, -[KEP-0009](https://github.com/kubernetes/community/blob/master/keps/sig-node/0009-node-heartbeat.md)). +[KEP-0009](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/0009-node-heartbeat.md)). Quando la funzione di lease del nodo è abilitata, ogni nodo ha un oggetto `Lease` associato in spazio dei nomi `kube-node-lease` che viene rinnovato periodicamente dal nodo ed entrambi NodeStatus e lease del nodo vengono considerati heartbeat dal nodo. Locazioni di nodi diff --git a/content/ko/docs/concepts/architecture/nodes.md b/content/ko/docs/concepts/architecture/nodes.md index 3eb52d2199..cd639c39c7 100644 --- a/content/ko/docs/concepts/architecture/nodes.md +++ b/content/ko/docs/concepts/architecture/nodes.md @@ -126,7 +126,7 @@ ready 컨디션의 상태가 [kube-controller-manager](/docs/admin/kube-controll 세 번째는 노드의 동작 상태를 모니터링 하는 것이다. 노드 컨트롤러는 노드가 접근 불가할 경우 (즉 노드 컨트롤러가 어떠한 사유로 하트비트 수신을 중지하는 경우, 예를 들어 노드 다운과 같은 경우이다.) NodeStatus의 NodeReady 컨디션을 ConditionUnknown으로 업데이트 하는 책임을 지고, 노드가 계속 접근 불가할 경우 나중에 노드로부터 (정상적인 종료를 이용하여) 모든 파드를 축출시킨다. (ConditionUnknown을 알리기 시작하는 기본 타임아웃 값은 40초 이고, 파드를 축출하기 시작하는 값은 5분이다.) 노드 컨트롤러는 매 `--node-monitor-period` 초 마다 각 노드의 상태를 체크한다. 쿠버네티스 1.13 이전 버전에서, NodeStatus는 노드로부터의 하트비트가 된다. 쿠버네티스 1.13을 시작으로 node lease 기능이 알파 기능으로 (기능 게이트 `NodeLease`, -[KEP-0009](https://github.com/kubernetes/community/blob/master/keps/sig-node/0009-node-heartbeat.md)) 소개되었다. node lease 기능이 활성화 되면, 각 노드는 주기적으로 노드에 의해 갱신되는 `kube-node-lease` 네임스페이스 내 연관된 `Lease` 오브젝트를 가지고 NodeStatus와 node lease는 둘다 노드로부터의 하트비트로 취급된다. NodeStatus가 오직 일부 변경사항이 있거나 충분한 시간이 지난 경우에만 (기본 1분으로, 접근 불가한 노드에 대한 기본 타임아웃 40초 보다 길다.) 노드에서 마스터로 보고 되는 반면에, Node lease는 자주 갱신된다. 노드 리스가 NodeStatus 보다 더 경량이므로, 이 기능은 확장성과 성능 두 가지 측면에서 노드 하트비트를 상당히 경제적이도록 해준다. +[KEP-0009](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/0009-node-heartbeat.md)) 소개되었다. node lease 기능이 활성화 되면, 각 노드는 주기적으로 노드에 의해 갱신되는 `kube-node-lease` 네임스페이스 내 연관된 `Lease` 오브젝트를 가지고 NodeStatus와 node lease는 둘다 노드로부터의 하트비트로 취급된다. NodeStatus가 오직 일부 변경사항이 있거나 충분한 시간이 지난 경우에만 (기본 1분으로, 접근 불가한 노드에 대한 기본 타임아웃 40초 보다 길다.) 노드에서 마스터로 보고 되는 반면에, Node lease는 자주 갱신된다. 노드 리스가 NodeStatus 보다 더 경량이므로, 이 기능은 확장성과 성능 두 가지 측면에서 노드 하트비트를 상당히 경제적이도록 해준다. 쿠버네티스 1.4에서, 대량의 노드들이 마스터 접근에 문제를 지닐 경우 (예를 들어 마스터에 네트워크 문제가 발생했기 때문에) 더 개선된 문제 해결을 하도록 노드 컨트롤러의 로직을 업데이트 했다. 1.4를 시작으로, 노드 컨트롤러는 파드 축출에 대한 결정을 내릴 경우 클러스터 내 모든 노드를 살핀다. diff --git a/data/user-personas/contributors/code-contributor.yaml b/data/user-personas/contributors/code-contributor.yaml index 24f007faf8..7be4ca78b7 100644 --- a/data/user-personas/contributors/code-contributor.yaml +++ b/data/user-personas/contributors/code-contributor.yaml @@ -9,7 +9,7 @@ foundational: intermediate: - label: "Learn about the Kubernetes Enhancement Proposal (KEP) process" icon: fa-upload - url: "https://github.com/kubernetes/community/blob/master/keps/0001-kubernetes-enhancement-proposal-process.md" + url: "https://github.com/kubernetes/enhancements/blob/master/keps/0001-kubernetes-enhancement-proposal-process.md" - label: "Understand the API conventions" icon: fa-map-o url: "https://github.com/kubernetes/community/blob/master/contributors/devel/api-conventions.md" From 1d11d14f22612c9f968d5d4d182b554ca098a983 Mon Sep 17 00:00:00 2001 From: Naoki Oketani Date: Sun, 18 Aug 2019 22:46:04 +0900 Subject: [PATCH 34/74] trim redundant leading spaces (#15904) --- .../stateless-application/expose-external-ip-address.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/tutorials/stateless-application/expose-external-ip-address.md b/content/en/docs/tutorials/stateless-application/expose-external-ip-address.md index ff7917dccc..62f89d35bb 100644 --- a/content/en/docs/tutorials/stateless-application/expose-external-ip-address.md +++ b/content/en/docs/tutorials/stateless-application/expose-external-ip-address.md @@ -146,12 +146,12 @@ The preceding command creates a To delete the Service, enter this command: - kubectl delete services my-service + kubectl delete services my-service To delete the Deployment, the ReplicaSet, and the Pods that are running the Hello World application, enter this command: - kubectl delete deployment hello-world + kubectl delete deployment hello-world {{% /capture %}} From eba32c37e3bbf767e669a498fcc13e85849d29b1 Mon Sep 17 00:00:00 2001 From: boxboatjeremy <46754123+boxboatjeremy@users.noreply.github.com> Date: Sun, 18 Aug 2019 20:46:03 -0400 Subject: [PATCH 35/74] Fix "onwrds" to "onwards" (#15898) --- content/en/docs/concepts/services-networking/service.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/services-networking/service.md b/content/en/docs/concepts/services-networking/service.md index 93baefd47a..6f8c426fa5 100644 --- a/content/en/docs/concepts/services-networking/service.md +++ b/content/en/docs/concepts/services-networking/service.md @@ -685,7 +685,7 @@ In the above example, if the Service contained three ports, `80`, `443`, and `8443`, then `443` and `8443` would use the SSL certificate, but `80` would just be proxied HTTP. -From Kubernetes v1.9 onwrds you can use [predefined AWS SSL policies](http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html) with HTTPS or SSL listeners for your Services. +From Kubernetes v1.9 onwards you can use [predefined AWS SSL policies](http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html) with HTTPS or SSL listeners for your Services. To see which policies are available for use, you can use the `aws` command line tool: ```bash From 535e711f0e28d5cb11f3080521c6a2a76cb02e09 Mon Sep 17 00:00:00 2001 From: Burke Azbill Date: Sun, 18 Aug 2019 20:48:03 -0400 Subject: [PATCH 36/74] fix broken link (#15897) Link for Configure a Pod to Use a ConfigMap is missing "map" from the link url. --- content/en/docs/tasks/tls/managing-tls-in-a-cluster.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/tls/managing-tls-in-a-cluster.md b/content/en/docs/tasks/tls/managing-tls-in-a-cluster.md index 2e2794f47c..b0dd0f4ecf 100644 --- a/content/en/docs/tasks/tls/managing-tls-in-a-cluster.md +++ b/content/en/docs/tasks/tls/managing-tls-in-a-cluster.md @@ -44,7 +44,7 @@ chain and adding the parsed certificates to the `RootCAs` field in the [`tls.Config`](https://godoc.org/crypto/tls#Config) struct. You can distribute the CA certificate as a -[ConfigMap](/docs/tasks/configure-pod-container/configure-pod-config) that your +[ConfigMap](/docs/tasks/configure-pod-container/configure-pod-configmap) that your pods have access to use. ## Requesting a Certificate From d08611b759e13f9862e4062dfc5116c208da231b Mon Sep 17 00:00:00 2001 From: Jakub Warczarek Date: Mon, 19 Aug 2019 02:50:03 +0200 Subject: [PATCH 37/74] JSON to YAML for external LoadBalancer (#15891) * Yaml instead of json for LoadBalancer * Fixes from style guide * Improve style * Remove obsolete fragments --- .../create-external-load-balancer.md | 138 +++++++----------- 1 file changed, 49 insertions(+), 89 deletions(-) diff --git a/content/en/docs/tasks/access-application-cluster/create-external-load-balancer.md b/content/en/docs/tasks/access-application-cluster/create-external-load-balancer.md index b923b532b9..546e3e3098 100644 --- a/content/en/docs/tasks/access-application-cluster/create-external-load-balancer.md +++ b/content/en/docs/tasks/access-application-cluster/create-external-load-balancer.md @@ -9,6 +9,10 @@ weight: 80 This page shows how to create an External Load Balancer. +{{< note >}} +This feature is only available for cloud providers or environments which support external load balancers. +{{< /note >}} + When creating a service, you have the option of automatically creating a cloud network load balancer. This provides an externally-accessible IP address that sends traffic to the correct port on your cluster nodes @@ -35,30 +39,24 @@ documentation. To create an external load balancer, add the following line to your [service configuration file](/docs/concepts/services-networking/service/#loadbalancer): -```json - "type": "LoadBalancer" +```yaml + type: LoadBalancer ``` Your configuration file might look like: -```json - { - "kind": "Service", - "apiVersion": "v1", - "metadata": { - "name": "example-service" - }, - "spec": { - "ports": [{ - "port": 8765, - "targetPort": 9376 - }], - "selector": { - "app": "example" - }, - "type": "LoadBalancer" - } - } +```yaml +apiVersion: v1 +kind: Service +metadata: + name: example-service +spec: + selector: + app: example + ports: + - port: 8765 + targetPort: 9376 + type: LoadBalancer ``` ## Using kubectl @@ -118,82 +116,42 @@ minikube service example-service --url ## Preserving the client source IP Due to the implementation of this feature, the source IP seen in the target -container will *not be the original source IP* of the client. To enable +container is *not the original source IP* of the client. To enable preservation of the client IP, the following fields can be configured in the service spec (supported in GCE/Google Kubernetes Engine environments): * `service.spec.externalTrafficPolicy` - denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints. There are two available -options: "Cluster" (default) and "Local". "Cluster" obscures the client source +options: Cluster (default) and Local. Cluster obscures the client source IP and may cause a second hop to another node, but should have good overall -load-spreading. "Local" preserves the client source IP and avoids a second hop +load-spreading. Local preserves the client source IP and avoids a second hop for LoadBalancer and NodePort type services, but risks potentially imbalanced traffic spreading. -* `service.spec.healthCheckNodePort` - specifies the healthcheck nodePort -(numeric port number) for the service. If not specified, healthCheckNodePort is -created by the service API backend with the allocated nodePort. It will use the -user-specified nodePort value if specified by the client. It only has an -effect when type is set to "LoadBalancer" and externalTrafficPolicy is set -to "Local". +* `service.spec.healthCheckNodePort` - specifies the health check nodePort +(numeric port number) for the service. If not specified, `healthCheckNodePort` is +created by the service API backend with the allocated `nodePort`. It will use the +user-specified `nodePort` value if specified by the client. It only has an +effect when `type` is set to LoadBalancer and `externalTrafficPolicy` is set +to Local. -This feature can be activated by setting `externalTrafficPolicy` to "Local" in the -Service Configuration file. +Setting `externalTrafficPolicy` to Local in the Service configuration file +activates this feature. -```json - { - "kind": "Service", - "apiVersion": "v1", - "metadata": { - "name": "example-service" - }, - "spec": { - "ports": [{ - "port": 8765, - "targetPort": 9376 - }], - "selector": { - "app": "example" - }, - "type": "LoadBalancer", - "externalTrafficPolicy": "Local" - } - } +```yaml +apiVersion: v1 +kind: Service +metadata: + name: example-service +spec: + selector: + app: example + ports: + - port: 8765 + targetPort: 9376 + externalTrafficPolicy: Local + type: LoadBalancer ``` -### Feature availability - -| K8s version | Feature support | -| :---------: |:-----------:| -| 1.7+ | Supports the full API fields | -| 1.5 - 1.6 | Supports Beta Annotations | -| <1.5 | Unsupported | - -Below you could find the deprecated Beta annotations used to enable this feature -prior to its stable version. Newer Kubernetes versions may stop supporting these -after v1.7. Please update existing applications to use the fields directly. - -* `service.beta.kubernetes.io/external-traffic` annotation <-> `service.spec.externalTrafficPolicy` field -* `service.beta.kubernetes.io/healthcheck-nodeport` annotation <-> `service.spec.healthCheckNodePort` field - -`service.beta.kubernetes.io/external-traffic` annotation has a different set of values -compared to the `service.spec.externalTrafficPolicy` field. The values match as follows: - -* "OnlyLocal" for annotation <-> "Local" for field -* "Global" for annotation <-> "Cluster" for field - -{{< note >}} -This feature is not currently implemented for all cloudproviders/environments. -{{< /note >}} - -Known issues: - -* AWS: [kubernetes/kubernetes#35758](https://github.com/kubernetes/kubernetes/issues/35758) -* Weave-Net: [weaveworks/weave/#2924](https://github.com/weaveworks/weave/issues/2924) - -{{% /capture %}} - -{{% capture discussion %}} - ## Garbage Collecting Load Balancers In usual case, the correlating load balancer resources in cloud provider should @@ -203,7 +161,7 @@ associated Service is deleted. Finalizer Protection for Service LoadBalancers wa introduced to prevent this from happening. By using finalizers, a Service resource will never be deleted until the correlating load balancer resources are also deleted. -Specifically, if a Service has Type=LoadBalancer, the service controller will attach +Specifically, if a Service has `type` LoadBalancer, the service controller will attach a finalizer named `service.kubernetes.io/load-balancer-cleanup`. The finalizer will only be removed after the load balancer resource is cleaned up. This prevents dangling load balancer resources even in corner cases such as the @@ -217,14 +175,18 @@ enabling the [feature gate](/docs/reference/command-line-tools-reference/feature It is important to note that the datapath for this functionality is provided by a load balancer external to the Kubernetes cluster. -When the service type is set to `LoadBalancer`, Kubernetes provides functionality equivalent to `type=` to pods within the cluster and extends it by programming the (external to Kubernetes) load balancer with entries for the Kubernetes pods. The Kubernetes service controller automates the creation of the external load balancer, health checks (if needed), firewall rules (if needed) and retrieves the external IP allocated by the cloud provider and populates it in the service object. +When the Service `type` is set to LoadBalancer, Kubernetes provides functionality equivalent to `type` equals ClusterIP to pods +within the cluster and extends it by programming the (external to Kubernetes) load balancer with entries for the Kubernetes +pods. The Kubernetes service controller automates the creation of the external load balancer, health checks (if needed), +firewall rules (if needed) and retrieves the external IP allocated by the cloud provider and populates it in the service +object. ## Caveats and Limitations when preserving source IPs GCE/AWS load balancers do not provide weights for their target pools. This was not an issue with the old LB kube-proxy rules which would correctly balance across all endpoints. -With the new functionality, the external traffic will not be equally load balanced across pods, but rather +With the new functionality, the external traffic is not equally load balanced across pods, but rather equally balanced at the node level (because GCE/AWS and other external LB implementations do not have the ability for specifying the weight per node, they balance equally across all target nodes, disregarding the number of pods on each node). @@ -238,5 +200,3 @@ Once the external load balancers provide weights, this functionality can be adde Internal pod to pod traffic should behave similar to ClusterIP services, with equal probability across all pods. {{% /capture %}} - - From 58796bcff638b681428077cfa688cec5439c74b1 Mon Sep 17 00:00:00 2001 From: Angel Date: Sun, 18 Aug 2019 20:52:04 -0400 Subject: [PATCH 38/74] Reworked a sentence for clarity and tone. (#15887) --- content/en/docs/concepts/services-networking/ingress.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/services-networking/ingress.md b/content/en/docs/concepts/services-networking/ingress.md index c81be65379..1753428810 100644 --- a/content/en/docs/concepts/services-networking/ingress.md +++ b/content/en/docs/concepts/services-networking/ingress.md @@ -15,7 +15,7 @@ weight: 40 ## Terminology -For the sake of clarity, this guide defines the following terms: +For clarity, this guide defines the following terms: Node : A worker machine in Kubernetes, part of a cluster. From 2382c9ea4e9f76b547fc1e70b2b249df4b7c3d30 Mon Sep 17 00:00:00 2001 From: Quan Tian Date: Mon, 19 Aug 2019 08:54:03 +0800 Subject: [PATCH 39/74] Enable interpretation of backslash escapes in example (#15884) Interpretation of backslash escapes should be enabled when echoing newlines to a script, otherwise the example plugin is not runable. --- content/en/docs/tasks/extend-kubectl/kubectl-plugins.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/tasks/extend-kubectl/kubectl-plugins.md b/content/en/docs/tasks/extend-kubectl/kubectl-plugins.md index a78bab5360..edc1d812eb 100644 --- a/content/en/docs/tasks/extend-kubectl/kubectl-plugins.md +++ b/content/en/docs/tasks/extend-kubectl/kubectl-plugins.md @@ -150,7 +150,7 @@ Example: ```bash # create a plugin -echo '#!/bin/bash\n\necho "My first command-line argument was $1"' > kubectl-foo-bar-baz +echo -e '#!/bin/bash\n\necho "My first command-line argument was $1"' > kubectl-foo-bar-baz sudo chmod +x ./kubectl-foo-bar-baz # "install" our plugin by placing it on our PATH @@ -185,7 +185,7 @@ Example: ```bash # create a plugin containing an underscore in its filename -echo '#!/bin/bash\n\necho "I am a plugin with a dash in my name"' > ./kubectl-foo_bar +echo -e '#!/bin/bash\n\necho "I am a plugin with a dash in my name"' > ./kubectl-foo_bar sudo chmod +x ./kubectl-foo_bar # move the plugin into your PATH From 06ddf5210ce9b7255e265b93b0ce93b83dfcf092 Mon Sep 17 00:00:00 2001 From: Naoki Oketani Date: Mon, 19 Aug 2019 09:56:03 +0900 Subject: [PATCH 40/74] fixed a typo (#15918) --- .../tasks/configure-pod-container/configure-volume-storage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/configure-pod-container/configure-volume-storage.md b/content/en/docs/tasks/configure-pod-container/configure-volume-storage.md index 826cd20ae5..bec97a2975 100644 --- a/content/en/docs/tasks/configure-pod-container/configure-volume-storage.md +++ b/content/en/docs/tasks/configure-pod-container/configure-volume-storage.md @@ -113,7 +113,7 @@ of `Always`. kubectl exec -it redis -- /bin/bash ``` -1. In your shell, goto `/data/redis`, and verify that `test-file` is still there. +1. In your shell, go to `/data/redis`, and verify that `test-file` is still there. ```shell root@redis:/data/redis# cd /data/redis/ root@redis:/data/redis# ls From bfe83d284c526822e5f3e4337c5d1d38ca20546a Mon Sep 17 00:00:00 2001 From: Thibaut Tauveron Date: Mon, 19 Aug 2019 02:58:04 +0200 Subject: [PATCH 41/74] fix unexpected line breaks for localized glossary tooltips #15390 (#15920) --- layouts/partials/docs/glossary-terms.html | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/layouts/partials/docs/glossary-terms.html b/layouts/partials/docs/glossary-terms.html index b0153d49fb..b46949865c 100644 --- a/layouts/partials/docs/glossary-terms.html +++ b/layouts/partials/docs/glossary-terms.html @@ -3,9 +3,7 @@ {{ $pages := $glossaryBundle.Resources.ByType "page" }} {{- range site.Params.language_alternatives -}} {{- with (where $glossaryBundle.Translations ".Lang" . ) -}} - {{ $p := (index . 0) }} - {{ $pages = $pages | lang.Merge ($p.Resources.ByType "page") }} - {{ end }} + {{ $p := (index . 0) }}{{ $pages = $pages | lang.Merge ($p.Resources.ByType "page") }}{{ end }} {{ end }} {{- $.Scratch.Set "glossary_items" $pages -}} {{- else -}} From b999f0d3e8240c4b4340d25bdba48a4227cc32b0 Mon Sep 17 00:00:00 2001 From: Giri Kuncoro Date: Mon, 19 Aug 2019 13:00:06 +0700 Subject: [PATCH 42/74] Add Indonesian translation for volume-snapshot-classes (#15724) * Add Indonesian translation for volume-snapshot-classes * Fix page styling consistency and wordings --- .../storage/volume-snapshot-classes.md | 58 +++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 content/id/docs/concepts/storage/volume-snapshot-classes.md diff --git a/content/id/docs/concepts/storage/volume-snapshot-classes.md b/content/id/docs/concepts/storage/volume-snapshot-classes.md new file mode 100644 index 0000000000..5fd92fb42a --- /dev/null +++ b/content/id/docs/concepts/storage/volume-snapshot-classes.md @@ -0,0 +1,58 @@ +--- +title: VolumeSnapshotClass +content_template: templates/concept +weight: 30 +--- + +{{% capture overview %}} + +Laman ini menjelaskan tentang konsep VolumeSnapshotClass pada Kubernetes. Sebelum melanjutkan, +sangat disarankan untuk membaca [_snapshot_ volume](/docs/concepts/storage/volume-snapshots/) +dan [kelas penyimpanan (_storage class_)](/docs/concepts/storage/storage-classes) terlebih dahulu. + +{{% /capture %}} + + +{{% capture body %}} + +## Pengenalan + +Seperti halnya StorageClass yang menyediakan cara bagi admin untuk mendefinisikan +"kelas" penyimpanan yang mereka tawarkan saat proses penyediaan sebuah volume, VolumeSnapshotClass +menyediakan cara untuk mendefinisikan "kelas" penyimpanan saat menyediakan _snapshot_ volume. + +## Sumber Daya VolumeSnapshotClass + +Masing-masing VolumeSnapshotClass terdiri dari _field_ `snapshotter` dan `parameters`, +yang digunakan saat sebuah VolumeSnapshot yang dimiliki kelas tersebut perlu untuk +disediakan secara dinamis. + +Nama yang dimiliki suatu objek VolumeSnapshotClass sangatlah penting, karena digunakan +oleh pengguna saat meminta sebuah kelas tertentu. Admin dapat mengatur nama dan parameter +lainnya dari sebuah kelas saat pertama kali membuat objek VolumeSnapshotClass. Objek +tidak dapat diubah setelah dibuat. + +Admin dapat mengatur VolumeSnapshotClass _default_ untuk VolumeSnapshot yang tidak +memiliki spesifikasi kelas apapun. + +```yaml +apiVersion: snapshot.storage.k8s.io/v1alpha1 +kind: VolumeSnapshotClass +metadata: + name: csi-hostpath-snapclass +snapshotter: csi-hostpath +parameters: +``` + +### `snapshotter` + +VolumeSnapshotClass memiliki sebuah `snapshotter` yang menentukan plugin volume CSI +apa yang digunakan untuk penyediaan VolumeSnapshot. _Field_ ini wajib diatur. + +### `parameters` + +VolumeSnapshotClass memiliki parameter-parameter yang menggambarkan _snapshot_ volume +di dalam VolumeSnapshotClass. Parameter-parameter yang berbeda diperbolehkan tergantung +dari `shapshotter`. + +{{% /capture %}} From c7e4576e18d88e413e5e85259656bafcfcfeda18 Mon Sep 17 00:00:00 2001 From: Felipe Date: Mon, 19 Aug 2019 07:39:25 +0100 Subject: [PATCH 43/74] Adding certificates.md in PT (#15655) --- .../cluster-administration/certificates.md | 228 ++++++++++++++++++ 1 file changed, 228 insertions(+) create mode 100644 content/pt/docs/concepts/cluster-administration/certificates.md diff --git a/content/pt/docs/concepts/cluster-administration/certificates.md b/content/pt/docs/concepts/cluster-administration/certificates.md new file mode 100644 index 0000000000..36554c1b88 --- /dev/null +++ b/content/pt/docs/concepts/cluster-administration/certificates.md @@ -0,0 +1,228 @@ +--- +title: Certificates +content_template: templates/concept +weight: 20 +--- + + +{{% capture overview %}} + +Ao usar um client para autenticação de certificado, você pode gerar certificados +manualmente através `easyrsa`, `openssl` ou `cfssl`. + +{{% /capture %}} + + +{{% capture body %}} + +### easyrsa + +**easyrsa** pode gerar manualmente certificados para o seu cluster. + +1. Baixe, descompacte e inicialize a versão corrigida do easyrsa3. + + curl -LO https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz + tar xzf easy-rsa.tar.gz + cd easy-rsa-master/easyrsa3 + ./easyrsa init-pki +1. Gerar o CA. (`--batch` set automatic mode. `--req-cn` default CN to use.) + + ./easyrsa --batch "--req-cn=${MASTER_IP}@`date +%s`" build-ca nopass +1. Gere o certificado e a chave do servidor. + O argumento `--subject-alt-name` define os possíveis IPs e nomes (DNS) que o servidor de API usará para ser acessado. O `MASTER_CLUSTER_IP` é geralmente o primeiro IP do serviço CIDR que é especificado como argumento em `--service-cluster-ip-range` para o servidor de API e o componente gerenciador do controlador. O argumento `--days` é usado para definir o número de dias após o qual o certificado expira. + O exemplo abaixo também assume que você está usando `cluster.local` como DNS de domínio padrão + + ./easyrsa --subject-alt-name="IP:${MASTER_IP},"\ + "IP:${MASTER_CLUSTER_IP},"\ + "DNS:kubernetes,"\ + "DNS:kubernetes.default,"\ + "DNS:kubernetes.default.svc,"\ + "DNS:kubernetes.default.svc.cluster,"\ + "DNS:kubernetes.default.svc.cluster.local" \ + --days=10000 \ + build-server-full server nopass +1. Copie `pki/ca.crt`, `pki/issued/server.crt`, e `pki/private/server.key` para o seu diretório. +1. Preencha e adicione os seguintes parâmetros aos parâmetros de inicialização do servidor de API: + + --client-ca-file=/yourdirectory/ca.crt + --tls-cert-file=/yourdirectory/server.crt + --tls-private-key-file=/yourdirectory/server.key + +### openssl + +**openssl** pode gerar manualmente certificados para o seu cluster. + +1. Gere um ca.key com 2048bit: + + openssl genrsa -out ca.key 2048 +1. De acordo com o ca.key, gere um ca.crt (use -days para definir o tempo efetivo do certificado): + + openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt +1. Gere um server.key com 2048bit: + + openssl genrsa -out server.key 2048 +1. Crie um arquivo de configuração para gerar uma solicitação de assinatura de certificado (CSR - Certificate Signing Request). Certifique-se de substituir os valores marcados com colchetes angulares (por exemplo, ``) com valores reais antes de salvá-lo em um arquivo (por exemplo, `csr.conf`). Note que o valor para o `MASTER_CLUSTER_IP` é o IP do cluster de serviços para o Servidor de API, conforme descrito na subseção anterior. O exemplo abaixo também assume que você está usando `cluster.local` como DNS de domínio padrão + + [ req ] + default_bits = 2048 + prompt = no + default_md = sha256 + req_extensions = req_ext + distinguished_name = dn + + [ dn ] + C = + ST = + L = + O = + OU = + CN = + + [ req_ext ] + subjectAltName = @alt_names + + [ alt_names ] + DNS.1 = kubernetes + DNS.2 = kubernetes.default + DNS.3 = kubernetes.default.svc + DNS.4 = kubernetes.default.svc.cluster + DNS.5 = kubernetes.default.svc.cluster.local + IP.1 = + IP.2 = + + [ v3_ext ] + authorityKeyIdentifier=keyid,issuer:always + basicConstraints=CA:FALSE + keyUsage=keyEncipherment,dataEncipherment + extendedKeyUsage=serverAuth,clientAuth + subjectAltName=@alt_names +1. Gere a solicitação de assinatura de certificado com base no arquivo de configuração: + + openssl req -new -key server.key -out server.csr -config csr.conf +1. Gere o certificado do servidor usando o ca.key, ca.crt e server.csr: + + openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \ + -CAcreateserial -out server.crt -days 10000 \ + -extensions v3_ext -extfile csr.conf +1. Veja o certificado: + + openssl x509 -noout -text -in ./server.crt + +Por fim, adicione os mesmos parâmetros nos parâmetros iniciais do Servidor de API. + +### cfssl + +**cfssl** é outra ferramenta para geração de certificados. + +1. Baixe, descompacte e prepare as ferramentas de linha de comando, conforme mostrado abaixo. Observe que você pode precisar adaptar os comandos de exemplo abaixo com base na arquitetura do hardware e versão cfssl que você está usando. + + curl -L https://pkg.cfssl.org/R1.2/cfssl_linux-amd64 -o cfssl + chmod +x cfssl + curl -L https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64 -o cfssljson + chmod +x cfssljson + curl -L https://pkg.cfssl.org/R1.2/cfssl-certinfo_linux-amd64 -o cfssl-certinfo + chmod +x cfssl-certinfo +1. Crie um diretório para conter os artefatos e inicializar o cfssl: + + mkdir cert + cd cert + ../cfssl print-defaults config > config.json + ../cfssl print-defaults csr > csr.json +1. Crie um arquivo de configuração JSON para gerar o arquivo CA, por exemplo, `ca-config.json`: + + { + "signing": { + "default": { + "expiry": "8760h" + }, + "profiles": { + "kubernetes": { + "usages": [ + "signing", + "key encipherment", + "server auth", + "client auth" + ], + "expiry": "8760h" + } + } + } + } +1. Crie um arquivo de configuração JSON para o CA - solicitação de assinatura de certificado (CSR - Certificate Signing Request), por exemplo, `ca-csr.json`. Certifique-se de substituir os valores marcados com colchetes angulares por valores reais que você deseja usar. + + { + "CN": "kubernetes", + "key": { + "algo": "rsa", + "size": 2048 + }, + "names":[{ + "C": "", + "ST": "", + "L": "", + "O": "", + "OU": "" + }] + } +1. Gere a chave CA (`ca-key.pem`) e o certificado (` ca.pem`): + + ../cfssl gencert -initca ca-csr.json | ../cfssljson -bare ca +1. Crie um arquivo de configuração JSON para gerar chaves e certificados para o Servidor de API, por exemplo, `server-csr.json`. Certifique-se de substituir os valores entre colchetes angulares por valores reais que você deseja usar. O `MASTER_CLUSTER_IP` é o IP do serviço do cluster para o servidor da API, conforme descrito na subseção anterior. O exemplo abaixo também assume que você está usando `cluster.local` como DNS de domínio padrão + + { + "CN": "kubernetes", + "hosts": [ + "127.0.0.1", + "", + "", + "kubernetes", + "kubernetes.default", + "kubernetes.default.svc", + "kubernetes.default.svc.cluster", + "kubernetes.default.svc.cluster.local" + ], + "key": { + "algo": "rsa", + "size": 2048 + }, + "names": [{ + "C": "", + "ST": "", + "L": "", + "O": "", + "OU": "" + }] + } +1. Gere a chave e o certificado para o Servidor de API, que são, por padrão, salvos nos arquivos `server-key.pem` e` server.pem` respectivamente: + + ../cfssl gencert -ca=ca.pem -ca-key=ca-key.pem \ + --config=ca-config.json -profile=kubernetes \ + server-csr.json | ../cfssljson -bare server + + +## Distribuindo Certificado CA auto assinado + +Um nó cliente pode se recusar a reconhecer o certificado CA self-signed como válido. +Para uma implementação de não produção ou para uma instalação que roda atrás de um firewall, você pode distribuir certificados auto-assinados para todos os clientes e atualizar a lista de certificados válidos. + +Em cada cliente, execute as seguintes operações: + +```bash +sudo cp ca.crt /usr/local/share/ca-certificates/kubernetes.crt +sudo update-ca-certificates +``` + +``` +Updating certificates in /etc/ssl/certs... +1 added, 0 removed; done. +Running hooks in /etc/ca-certificates/update.d.... +done. +``` + +## API de certificados + +Você pode usar a API `certificates.k8s.io` para provisionar +certificados x509 a serem usados ​​para autenticação conforme documentado +[aqui](/docs/tasks/tls/managing-tls-in-a-cluster). + +{{% /capture %}} From 6bab81258c6a9ab2ba725143476e41f078b955c7 Mon Sep 17 00:00:00 2001 From: "Diego W. Antunes" Date: Mon, 19 Aug 2019 04:42:07 -0300 Subject: [PATCH 44/74] Added new owner for pt-BR (#15878) --- OWNERS_ALIASES | 2 ++ 1 file changed, 2 insertions(+) diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index 49c3cd26d3..7ebf9f47aa 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -183,6 +183,8 @@ aliases: sig-docs-pt-owners: # Admins for Portuguese content - femrtnz - jcjesus + - devlware sig-docs-pt-reviews: # PR reviews for Portugese content - femrtnz - jcjesus + - devlware From cd62dbf71f6a4f87cdb57c213dd0c23eb8b20f51 Mon Sep 17 00:00:00 2001 From: praveen-kg <33170646+praveen-kg@users.noreply.github.com> Date: Mon, 19 Aug 2019 12:01:30 +0200 Subject: [PATCH 45/74] Update update-api-object-kubectl-patch.md (#15923) --- .../tasks/run-application/update-api-object-kubectl-patch.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/run-application/update-api-object-kubectl-patch.md b/content/en/docs/tasks/run-application/update-api-object-kubectl-patch.md index 3c59c00e06..81007d63a4 100644 --- a/content/en/docs/tasks/run-application/update-api-object-kubectl-patch.md +++ b/content/en/docs/tasks/run-application/update-api-object-kubectl-patch.md @@ -311,7 +311,7 @@ The following commands are equivalent: ```shell -kubectl patch deployment patch-demo --patch "$(cat patch-file.yaml)" +kubectl patch deployment patch-demo --patch "$(cat patch-file.json)" kubectl patch deployment patch-demo --patch 'spec:\n template:\n spec:\n containers:\n - name: patch-demo-ctr-2\n image: redis' kubectl patch deployment patch-demo --patch "$(cat patch-file.json)" From fedc79ae988a25223026c69dfb0ea466d1e6779f Mon Sep 17 00:00:00 2001 From: Justin Biggs Date: Mon, 19 Aug 2019 08:43:30 -0500 Subject: [PATCH 46/74] '#15924 removed extra parenthesis' (#15929) --- content/en/docs/reference/glossary/qos-class.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/glossary/qos-class.md b/content/en/docs/reference/glossary/qos-class.md index 6ecd3e402a..692afd47fa 100755 --- a/content/en/docs/reference/glossary/qos-class.md +++ b/content/en/docs/reference/glossary/qos-class.md @@ -15,7 +15,7 @@ related: - pod --- - QoS Class (Quality of Service Class)) provides a way for Kubernetes to classify Pods within the cluster into several classes and make decisions about scheduling and eviction. + QoS Class (Quality of Service Class) provides a way for Kubernetes to classify Pods within the cluster into several classes and make decisions about scheduling and eviction. QoS Class of a Pod is set at creation time based on its compute resources requests and limits settings. QoS classes are used to make decisions about Pods scheduling and eviction. From 253ada3d6b05653b5275a5e46d6a1ab50ff751c5 Mon Sep 17 00:00:00 2001 From: Julie K Date: Mon, 19 Aug 2019 17:49:32 +0200 Subject: [PATCH 47/74] docs-fr | docs | reference | glossary | cncf (#15943) --- content/fr/docs/reference/glossary/cncf.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 content/fr/docs/reference/glossary/cncf.md diff --git a/content/fr/docs/reference/glossary/cncf.md b/content/fr/docs/reference/glossary/cncf.md new file mode 100644 index 0000000000..9f2315972e --- /dev/null +++ b/content/fr/docs/reference/glossary/cncf.md @@ -0,0 +1,22 @@ +--- +title: Cloud Native Computing Foundation (CNCF) +id: cncf +date: 2019-05-26 +full_link: https://cncf.io/ +short_description: > + Cloud Native Computing Foundation + +aka: +tags: +- community +--- +La Cloud Native Computing Foundation (CNCF) construit des écosystèmes durables et +favorise la création d'une communauté autour des [projets](https://www.cncf.io/projects/) qui +orchestrent les conteneurs dans le cadre d'une architecture de microservices. + +Kubernetes est un projet de la CNCF. + + + +La CNCF est une sous-fondation de [Linux Foundation](https://www.linuxfoundation.org/). +Sa mission est de rendre le "cloud native computing" omniprésent. From e238414f441496b11fa441f275fcfe5fdc010816 Mon Sep 17 00:00:00 2001 From: Julie K Date: Mon, 19 Aug 2019 18:07:30 +0200 Subject: [PATCH 48/74] docs-fr | docs | reference | glossary | cgroup (#15941) --- content/fr/docs/reference/glossary/cgroup.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 content/fr/docs/reference/glossary/cgroup.md diff --git a/content/fr/docs/reference/glossary/cgroup.md b/content/fr/docs/reference/glossary/cgroup.md new file mode 100644 index 0000000000..1a93047fe1 --- /dev/null +++ b/content/fr/docs/reference/glossary/cgroup.md @@ -0,0 +1,16 @@ +--- +title: cgroup (control group) +id: cgroup +date: 2019-06-25 +full_link: +short_description: > + Un groupe de processus Linux avec des options d'isolation, de suivi, et de limites des ressources. + +aka: +tags: +- fundamental +--- +Un groupe de processus Linux avec des options d'isolation, de suivi, et de limite de l'utilisation des ressources. + + +cgroup est une fonctionnalité du noyau Linux qui limite, suit et isole l'utilisation des ressources (CPU, mémoire, E/S disque, réseau) pour un ensemble de processus. From 7c524e28dd6f5ff18576e48952d489628c7331a5 Mon Sep 17 00:00:00 2001 From: Jim Angel Date: Mon, 19 Aug 2019 12:57:32 -0500 Subject: [PATCH 49/74] add 1.16 docs release lead as an approver (#15949) --- OWNERS_ALIASES | 1 + 1 file changed, 1 insertion(+) diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index 7ebf9f47aa..8597e9a59e 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -51,6 +51,7 @@ aliases: - rajakavitha1 - ryanmcginnis - shavidissa + - simplytunde - steveperry-53 - stewart-yu - tengqm From f4dd1ac666ad68c677023c8d2f7386c2f78be190 Mon Sep 17 00:00:00 2001 From: Oriol Soriano Date: Mon, 19 Aug 2019 20:27:30 +0200 Subject: [PATCH 50/74] Add spanish translation of glossary/replica-set (#14362) --- .../es/docs/reference/glossary/replica-set.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100755 content/es/docs/reference/glossary/replica-set.md diff --git a/content/es/docs/reference/glossary/replica-set.md b/content/es/docs/reference/glossary/replica-set.md new file mode 100755 index 0000000000..d52d5ee13f --- /dev/null +++ b/content/es/docs/reference/glossary/replica-set.md @@ -0,0 +1,19 @@ +--- +title: ReplicaSet +id: replica-set +date: 2018-05-16 +full_link: /docs/concepts/workloads/controllers/replicaset/ +short_description: > + El ReplicaSet es la nueva generación del ReplicationController. + +aka: +tags: +- fundamental +- core-object +- workload +--- + El ReplicaSet es la nueva generación del ReplicationController. + + + +Un ReplicaSet, análogamente a un {{< glossary_tooltip text="ReplicationController" term_id="replication-controller" >}}, garantiza que un número establecido de réplicas de un pod estén corriendo en un momento dado. El ReplicaSet tiene soporte para selectores del tipo set-based, lo que permite el filtrado de claves por grupos de valores como por ejemplo todos los pods cuya etiqueta `environment` no sea `production` ni `qa`. Por otro lado, el ReplicationController solo soporta selectores equality-based, es decir, que solo puedes filtrar por valores exactos como por ejemplo, los pods que tengan la etiqueta `tier` con valor `frontend`. From d10ac36f2f350d4d881b4fce804078cb0895bf00 Mon Sep 17 00:00:00 2001 From: Zach Corleissen Date: Mon, 19 Aug 2019 15:37:31 -0700 Subject: [PATCH 51/74] Remove inactive approver (#15954) --- OWNERS_ALIASES | 1 - 1 file changed, 1 deletion(-) diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index 8597e9a59e..a4881cbe17 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -57,7 +57,6 @@ aliases: - tengqm - tfogo - zacharysarah - - zhangxiaoyu-zidif - zparnold sig-docs-en-reviews: # PR reviews for English content - jimangel From 361cf02a175284b59c33dc65204b249e1b4c3e29 Mon Sep 17 00:00:00 2001 From: aimeeu Date: Tue, 20 Aug 2019 03:23:33 -0500 Subject: [PATCH 52/74] Add link to HorzPodAuto; add that there are other full pipelines (#15863) Add link to Horizontal Pod Autoscaler; add that there are other full metrics pipelines but those outside of CNCF are beyond the scope of the k8s docs --- .../resource-usage-monitoring.md | 114 +++++------------- static/images/docs/gcm.png | Bin 209311 -> 0 bytes 2 files changed, 27 insertions(+), 87 deletions(-) delete mode 100644 static/images/docs/gcm.png diff --git a/content/en/docs/tasks/debug-application-cluster/resource-usage-monitoring.md b/content/en/docs/tasks/debug-application-cluster/resource-usage-monitoring.md index faa067a6e5..de8c538118 100644 --- a/content/en/docs/tasks/debug-application-cluster/resource-usage-monitoring.md +++ b/content/en/docs/tasks/debug-application-cluster/resource-usage-monitoring.md @@ -20,99 +20,39 @@ where bottlenecks can be removed to improve overall performance. {{% capture body %}} -In Kubernetes, application monitoring does not depend on a single monitoring -solution. On new clusters, you can use two separate pipelines to collect -monitoring statistics by default: - -- The [**resource metrics pipeline**](#resource-metrics-pipeline) provides a limited set of metrics related - to cluster components such as the HorizontalPodAutoscaler controller, as well - as the `kubectl top` utility. These metrics are collected by - [metrics-server](https://github.com/kubernetes-incubator/metrics-server) - and are exposed via the `metrics.k8s.io` API. `metrics-server` discovers - all nodes on the cluster and queries each node's [Kubelet](/docs/admin/kubelet) - for CPU and memory usage. The Kubelet fetches the data from - [cAdvisor](https://github.com/google/cadvisor). `metrics-server` is a - lightweight short-term in-memory store. - -- A [**full metrics pipeline**](#full-metrics-pipelines), such as Prometheus, gives you access to richer - metrics. In addition, Kubernetes can respond to these metrics by automatically - scaling or adapting the cluster based on its current state, using mechanisms - such as the Horizontal Pod Autoscaler. The monitoring pipeline fetches - metrics from the Kubelet, and then exposes them to Kubernetes via an adapter - by implementing either the `custom.metrics.k8s.io` or - `external.metrics.k8s.io` API. +In Kubernetes, application monitoring does not depend on a single monitoring solution. On new clusters, you can use [resource metrics](#resource-metrics-pipeline) or [full metrics](#full-metrics-pipeline) pipelines to collect monitoring statistics. ## Resource metrics pipeline -### Kubelet +The resource metrics pipeline provides a limited set of metrics related to +cluster components such as the [Horizontal Pod Autoscaler](/docs/tasks/run-application/horizontal-pod-autoscale) controller, as well as the `kubectl top` utility. +These metrics are collected by the lightweight, short-term, in-memory +[metrics-server](https://github.com/kubernetes-incubator/metrics-server) and + are exposed via the `metrics.k8s.io` API. -The Kubelet acts as a bridge between the Kubernetes master and the nodes. It manages the pods and containers running on a machine. Kubelet translates each pod into its constituent containers and fetches individual container usage statistics from the container runtime, through the container runtime interface. For the legacy docker integration, it fetches this information from cAdvisor. It then exposes the aggregated pod resource usage statistics through the kubelet resource metrics api. This api is served at `/metrics/resource/v1alpha1` on the kubelet's authenticated and read-only ports. +metrics-server discovers all nodes on the cluster and +queries each node's +[kubelet](/docs/reference/command-line-tools-reference/kubelet) for CPU and +memory usage. The kubelet acts as a bridge between the Kubernetes master and +the nodes, managing the pods and containers running on a machine. The kubelet +translates each pod into its constituent containers and fetches individual +container usage statistics from the container runtime through the container +runtime interface. The kubelet fetches this information from the integrated +cAdvisor for the legacy Docker integration. It then exposes the aggregated pod +resource usage statistics through the metrics-server Resource Metrics API. +This API is served at `/metrics/resource/v1beta1` on the kubelet's authenticated and +read-only ports. -### cAdvisor +## Full metrics pipeline -cAdvisor is an open source container resource usage and performance analysis agent. It is purpose-built for containers and supports Docker containers natively. In Kubernetes, cAdvisor is integrated into the Kubelet binary. cAdvisor auto-discovers all containers in the machine and collects CPU, memory, filesystem, and network usage statistics. cAdvisor also provides the overall machine usage by analyzing the 'root' container on the machine. +A full metrics pipeline gives you access to richer metrics. Kubernetes can +respond to these metrics by automatically scaling or adapting the cluster +based on its current state, using mechanisms such as the Horizontal Pod +Autoscaler. The monitoring pipeline fetches metrics from the kubelet and +then exposes them to Kubernetes via an adapter by implementing either the +`custom.metrics.k8s.io` or `external.metrics.k8s.io` API. -Kubelet exposes a simple cAdvisor UI for containers on a machine, via the default port 4194. -The picture below is an example showing the overall machine usage. However, this feature has been marked -deprecated in v1.10 and completely removed in v1.12. - -![cAdvisor](/images/docs/cadvisor.png) - -Starting from v1.13, you can [deploy cAdvisor as a DaemonSet](https://github.com/google/cadvisor/tree/master/deploy/kubernetes) for an access to the cAdvisor UI. - -## Full metrics pipelines - -Many full metrics solutions exist for Kubernetes. - -### Prometheus - -[Prometheus](https://prometheus.io) can natively monitor kubernetes, nodes, and prometheus itself. -The [Prometheus Operator](https://coreos.com/operators/prometheus/docs/latest/) -simplifies Prometheus setup on Kubernetes, and allows you to serve the -custom metrics API using the -[Prometheus adapter](https://github.com/directxman12/k8s-prometheus-adapter). -Prometheus provides a robust query language and a built-in dashboard for -querying and visualizing your data. Prometheus is also a supported -data source for [Grafana](https://prometheus.io/docs/visualization/grafana/). - -### Sysdig -[Sysdig](http://sysdig.com) provides full spectrum container and platform intelligence, and is a -true container native solution. Sysdig pulls together data from system calls, Kubernetes events, -Prometheus metrics, statsD, JMX, and more into a single pane that gives you a comprehensive picture -of your environment. Sysdig also provides an API to query for providing robust and customizable -solutions. Sysdig is built on Open Source. [Sysdig and Sysdig Inspect](https://sysdig.com/opensource/inspect/) give you the -ability to freely perform troubleshooting, performance analyis and forensics. - -### Google Cloud Monitoring - -Google Cloud Monitoring is a hosted monitoring service you can use to -visualize and alert on important metrics in your application. You can collect -metrics from Kubernetes, and you can access them -using the [Cloud Monitoring Console](https://app.google.stackdriver.com/). -You can create and customize dashboards to visualize the data gathered -from your Kubernetes cluster. - -This video shows how to configure and run a Google Cloud Monitoring backed Heapster: - -[![how to setup and run a Google Cloud Monitoring backed Heapster](https://img.youtube.com/vi/xSMNR2fcoLs/0.jpg)](https://www.youtube.com/watch?v=xSMNR2fcoLs) - - -{{< figure src="/images/docs/gcm.png" alt="Google Cloud Monitoring dashboard example" title="Google Cloud Monitoring dashboard example" caption="This dashboard shows cluster-wide resource usage." >}} - -## CronJob monitoring - -### Kubernetes Job Monitor - -With the [Kubernetes Job Monitor](https://github.com/pietervogelaar/kubernetes-job-monitor) dashboard a Cluster Administrator can see which jobs are running and view the status of completed jobs. - -### New Relic Kubernetes monitoring integration - -[New Relic Kubernetes](https://docs.newrelic.com/docs/integrations/host-integrations/host-integrations-list/kubernetes-monitoring-integration) integration provides increased visibility into the performance of your Kubernetes environment. New Relic's Kubernetes integration instruments the container orchestration layer by reporting metrics from Kubernetes objects. The integration gives you insight into your Kubernetes nodes, namespaces, deployments, replica sets, pods, and containers. - -Marquee capabilities: -View your data in pre-built dashboards for immediate insight into your Kubernetes environment. -Create your own custom queries and charts in Insights from automatically reported data. -Create alert conditions on Kubernetes data. -Learn more on this [page](https://docs.newrelic.com/docs/integrations/host-integrations/host-integrations-list/kubernetes-monitoring-integration). +[Prometheus](https://prometheus.io), a CNCF project, can natively monitor Kubernetes, nodes, and Prometheus itself. +Full metrics pipeline projects that are not part of the CNCF are outside the scope of Kubernetes documentation. {{% /capture %}} diff --git a/static/images/docs/gcm.png b/static/images/docs/gcm.png deleted file mode 100644 index c2832c1d982672dbc70d40c31127e2558964cd48..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 209311 zcmV)vK$X9VP)@OAo000CeX+uL$Nkc;* zP;zf(X>4Tx05}naRo`#hR1`jmZ&IWdKOk5~hl<6oRa0BJ8yc;~21%2p?MfD<>DVeH z9(p*dx19w`~g7O0}n_%Aq@s%d)fBDv`JHkDym6Hd+5XuAtvnwRpGmK zVkc9?T=n|PIo~X-eVh__(Z?q}P9Z-Dj?gOW6|D%o20XmjW-qs4UjrD(li^iv8@eK9k+ZFm zVRFymFOPAzG5-%Pn|1W;U4vNroTa&AxDScmEA~{ri9gr1^c?U@uwSpaNnw8l_>cP1 zd;)kMQS_;jeRSUEM_*s96y65j1$)tOrwdK{YIQMt92l|D^(E_=$Rjw{b!QT@q!)ni zR`|5oW9X5n$Wv+HVc@|^eX5yXnsHX8PF3UX~a6)MwxDE0HaPjyrlI!;jX{6Kvuh*8ej?;85ekN$?5uuCiS zBTvvVG+XTxAO{m@bvM#Jr)z6J><&E22D|vq?Y?Vkbo_DijopiF$2PET#mZ8eu=y$(ArYkv7@Ex`GL?QCc!_*KFrd&;n1r7 zqW-CFs9&fT)ZaU5gc&=gBz-DaCw(vdOp0__x+47~U6sC(E(JNe@4cTT*n6*E zVH4eoU1-&7pEV~_PRe`a7v+@vy!^5}8?Y3)UmlaER002M$NklY-~xvd!+_U(rcKrb)! z_9D!uH$C>6OV7SAA1^+Hg`p=HG7dsmhu)1DlZ~dyc1o$U>0~Ie!Y`kCc-E3 zju)dSl$Y?3PNp9WkV^54bc#1NyodDh-@ZC9f}@x6YRbc4a%h&H@cR9JmsV0{yc}9o zW}?reMYvEI(2s(_xQ>&5kHIDKU3?7cA@PAgzyKM4=F7&=T~XvO{0=RWAB8Y|7r&E= zpS1TFE?8LcvZsffQ+fI+Q--&s*G*p>>?QrCjFk^M`3bMeC4}G5V1iBllzkI!-UM%` zF#tA>q16A)#Z!WTxKSh~eyU4HqgF0w4c!<~8(=n5c= zb=K$###LGODt}DFPhAvF_|DEQ##6fH$E2w|isHWVb<-t`aEU&{UzdK}Tnf?CEqvk~ zVGT}ZLS-uU8~RBrb$}uWzwmXFW`3rWQiIO zMU$SAzA~^XZ#tvDT$=UnK)bSR@=M+_T$i|Sc+6)fJ?4Q#`B=xpjm%LlSeJywd3X4$ zXGv?2VSeEWCtt-dIko|+$G!e=lE=E}hz6m>3{k_f*RwA2L1k^qOy$ul8I!JcaE1FL zNFTinyzWGy@->%eaq>(K(@&vJ*@@p`ru1@<70R%R0O1i4hzO5BH|bOTQ{Ek1f)Q2x zW4RhxvbarT!Kq%blt`NRBeGOx;+v9FyI^=}{3w&mn`oE6k9EvJM`WhbFtX|y!{x6e ztP{NSmt@P-a{@RlAPo!?y-MHcGe#1eA<=~s4Sv-P=C6l!T8Z?sOqHziW%Z0`GimcD zK%CO+3b(pR^cZ;hi9+SmxfD;&@)m#9&WZ1RI!x*MS^f$WtekL()}C(i#^N-*6u(*K z%yZD_rM`3()yM{kXNm@o@P+YR<>VHE6XuE^MZlDUDOZM=v=~RY%tbg;&Xif{3E?w! zSY;?WCHLa9(o>R#`MeWOZK7mbUOw_zymZQ(`DcEKkm<2~Wc<#qPE$^LHv9-zo$@oj zBfk;UO^Pd=7LRC=O#3N20pe2Kk_<>5Bo~Gl>P*KuX)9dqgQ;^8&Xb(#Cn;8ZHQ3@M z?*W#BoYAS$A(W8-E30S(Sp@)w-=Ej_J1kyD=G(hbBZ z9F9ygE%Ai)QspgwSHex&DnGSB;)&sRcen8uU0q#WMoy*I(L+8PdWhTb&D9HrPe4RO zq$yjgE5uv18K$jbJUNjiyyOtsVjLArVf%HqR;Tfm0R;pc@j^%iBs(FCV#}U zaHi#tpghV^BpjVVIP%hzH-Q6zZo@yP{Hbdw7fv2kLC6#4UwpB7G<{j*4KO*xnd@z?2AU+a863ZGq%M zZM|&|R8OVP3npDc|1Oica1jqwE0+Vn-+ti+l}*p$weKfla^6&Ml0BhPneh1}H(30^{5=Rno(0qW z1m_9xvPv*Eo_QwRVBrRi;V1El5y?J-$cxJolTzu*GANGd~Xht-sBu%23Y+6@QdhlW*P? z&H9^ouAe+D{}gWdW1r1karHoF!<`rNYw()14S?%Mc$>bt)7ybzgXji0{!)-~YAD@j zH<n`7HR5e7X+?mJwahljt-44&s67GijP+Ntp9u=yP%QA!Zo;1Y&TC9)Y`ldO0or zDGp(kX9t0U!{E|m=)nostHUNWmQEB0hC0*55k`+t`7%O?e+Gr#8&qCZu(!Rhu# z_{L6&`K7-bu2;o3&c$isDV+Wm&cN6>*5AD=u8Cvu$iw2|-O?vqqB%qtUk!dYo()%Y z6W=`W$KrM48*e_JM4tjIjQ4IL@W7dGyU!NR(C5ZckepLLoSLgR*53pg0K(8SRDT6PKm*HX8%K9TgB$KeWMB*c zVQhTf%_IE>q|ZbmN;lj^@1&s@MV4du!1OUsMC_so-EACmw>VrpA)F4{LFqGb-JkyS zc~Ke=OP^jm#F$3{d%Tz)=`{u7An((!0u&@2AJxe>Z%WJ}P>}Jo?Hk{1GzRp?EmR?A za0(TnT%1m8NC?wmb@aS~O#04GAAb2;IzqVQ+0TXYU@)B!=q79YyrCwF`p?AgL^qiv zoDyVjGlTml2S%!FzH7}XB*1>3CNy#B^sJK;kRix`2T@l zmx6yF=D#M&5Pkm~pNIH2#J_)z1OHs?A^98P-#^EJe=hcr{0;H%pX0zk7kfzl-Y@=X z#izOU2(ohW(ZdypP_Nn~(4Wut-QN3CA%8iyXYLGB952@|G$?U>Prf+=x0>o>NKQ^e zw^>bgpjsMh(bds;a+G)RiHT1@Y+MrBS{u>c+QgBBrSDxLy1|iA(MU*2wyGC1m81y7JM4z}a#6QV`BOQ)pI5H&P z5Pv+W8Br^gC2P#Dk&s*HM$I8UMcR z2ko!Wbo?N)M&xn=US@24x?jDCKIgpIUjxUi+y1HKp%2Jm_!7}v3#gnEZD99gS%wBB{9jJc4 zX3RhY%wP+7+E7=Cgyc-bC1;_cY%9jkxEkRa)UG$g%lk3kn z_gCj{rgZ8FXe|M7}76RI}Fv2q4r~_{WZ;l?RPkBg{c@r?T2YK9A5M_AbkJ-eE&)r)IJ4fRhyp2(cCC&+ydw3DMTr7=if6q?q`49IxweV3m1Z zmUhu<_6!+Zd?Sf|UnJra642h#f(Y&-3FE%GaHgyMEc{VqZJgC6DJ5<*R0Q_D^*xzf zgnkC{KOH{{WA8#Z*mEc`&x04Xe_RjP2{^5P|F{Fiw=nkJAI9r%@p|w5!~4Hm*n#{{ z$Irsp`w)GWqbJId_4V?}%PX({V9yqZ_wI%D;`71`=HEZ=KyVhu-uuIN{rjicA9kR3 z8)qOqr{iZ~?7e>)UVodG_ufCe|GR}9$p3WwER4Mm(Pue2R6qL5!a(nqTVDBjFMc+j zz4uSU>u>RT@BPF3zgyUW{7=Wv!r1!|eU_s`^`pNm4D@cf<&~fJ;%DR8d;c`N{uZzI z-aowmyM-Ode_%gZ1<5%#b+R>x2t)PJQnXZV!d;)f4a=6TKvZl5;$yqf*mxYfH@=Lp zKodLAy%=-G<%o$(!JdsT!PnCq@{5g6MbV~L(A(Vro#2?9JDJ-UXf8zyqb_c3IIw#o zs`jrlr$WV~6=1^5i_8jyXwkrc!xq!wx0~KYmt7Fhp&@-;T!(VS^LX~XX#k^(K4IqW zJa_S=tilm-xMbdJ(!(VbGwyIs5IlIO5=%B5HUkec99^257vKsFv1F+Hj5feCx!zRo-L=*i^Fi)pb4plCZdByz;xuH zA(07i=u?pEES$nk0?s;(4K{aKqdDP(W?Ig>^5EdsL5+QBoe{R7i(TfPkGXX%&!z5ZV><hFK3_JwCU=YtMks@yY-Xpm-C4RM;V(_46R-kobp7SDYdES)|5=~bp&pFY$Wb~ zY$=*)zU9ax(AnOG8y8MvxEs%nFC@aFq7q)-5E&JV>`_zjhsT!TBiEkCqvw0EdD~tT z9qGb|yir^o(aI0&KF1iL^y#Bxr)6d3jI>-AP z1gA69$3L%L_C5>3!TYb$&;Qry8*1OAeIyfBPTrgR4e@V?e-s`%tFN55|2h4l?yfr2 zx-=uNA+mYyY(NZ6jp|#2m{u?eyH`Dm@G1@`Hx7jLH;FR9jFU*1obhu3 zM6?DNeU2}Jk`HpPw`lycHIQxn!;7bAK2c*8+NF&igDB|Gx6) zVT8jgWp}XpVVFiWVl|K>n69s3C4cP7!4Uu6yZ$53JiN8C>l6&%SpP$QF7LfJZ&>Kr zKCoQvqv8zq?8Rq*toWZ0aN^5p;TkMW8~J~bKJ%?JW=8X>YM116Q_|*DdR1ZkbAp{` zdK!P{?()oyIMlwmJnE-oUG_MKl%mm5&I1;7}_U)-OIj4haeI zXlrXhOhOtv^4z~6-ENAAAA#gbKmGszlb#-bVGZi}QNl>#b_P~X+oGr@pDrGK>{00#ZQo$T zM?6vc?!@}{yBN`DY9-XlfJT5;9tGoZCXV~A-Ro^_P3UNCHjF(fijDwKDasA>EWiFv z@cm&ej5o|1*Xu7>8{Z2fe@ly=IZlJW}FXs*O#`XF;kjAbrnuQV@o5;d& z)^Kc>O`CRP1K8SJ&pk?7s-hc+R&N>()QL3McmsubI zZlJW}FXs*O#`XFO&ZgysvGEm5B@i2*%$bCkP$gBcapY}BM?2bD8qDS@>m9lel$H(j zhI!NW`V015=(FfTaNaoHXKxxd(m-hq6y}XPP#o)LYbNFh@ z&z74lA4`x8x9=8C?*l#ek1sgk=npG@Id7OZuGe31Hoh0e#@F3C3#a#ip8Lla+(2o` zU(OrGxcahjJo#$A9_~Px@^K&0+Qe@LbTpqB&j#u~5KUhHf0DjXQeL`Ggm{)J@KTb|^VpPl^#ejCH@;}^TF zw5qc&IPz6yOwtWO_PZv|x&Ze*@Cd%}xldu^#*N4tb}8!X8*r$y39&ITxcq`bOrCT# ze)aoD(9s>v)sg5E{kRH{o|cXUbMkQZ*=J$zfhW#$olwJt(GmRcd+x?)~!;%$%5uO~uDd|JHovober6L?1r{D^n{yNO>5d zm^1CIH-lUS(Djkzyo&}uiK(lpV1|R-oj=?hjWyU{#fkO){TkMuZek}+JHCHJoC4G7 z(5Fw=ALp6K?X4~Rn949o1o^IZF%0d^ja1q-$j;B>$TRvBDZS4@|A%>Ma(Wu{Nmje~ zk(;WchiI!9hxp`l!&}L$c-vB6g8)xd$mE&bk&#qB3iwyK)1cpw^1mRnCf#?TPYR^= zSOw4WZs2JZxs2kdZnBjf<2KYEKY|hY1&E?j{+GFTp*cjy|52WbKFO?Rj;eWXyH_9B zfkzWR*c6Kf+;GuEB*sOl?HO{X!2$7A61uJE2sZ92LdNhhobU-ZX2s%RkUX!c)cO56 zG!38*{#UzybJ=ZeX-3tN{X7=5fF|*g;R0uT{2RSH7K+eege;rr<&G{K(6m?Z& zT^*_p??YzJ*iiq=_7AEK??+nJFv|14khhk&e{&vpasub*p%SFf3@I`u*7SM9sVF+S zIGE$=gwMz0UR_B}O&@`liI?Kn_dkK`tYnmwSD~Rj9A{ttDLnDga%88)V$-&LC_LjD zv#Rmr-=9ZzdYthaGy8)$exw+Gd*W{xIdYWgUmrW(jNFMA;*lp_LhkspP}v@jCCk?# zJ}#D~QE_H6T74ANqAsph1OlC01JH2O8Gxv-;&VnFH1}d3ov@iBMw-hOkM4@0wnH%1 zDXtmJ$cvY0TR8BDOdNp~I~pvQxeFvZG6m73OWzC8e2qps28Ro&_#!1LDh?gN;W*UL zgN*E9X3&}OFvxCI4nSa=Ourw_~Z`y;w zT9`1S5AvuF)^p;anS-}DDt3O%mAW}1P>nBq@=Ap34E7=So;gsEHypXc_TjIu>_UFQ zI5Y6@g-37@U5>)Z)6o@?j5f|rzMpQe^0sN%a@YG{uwED&@BO+DmZrt;O?xodsLXT} zrlg`|*A8}&3r%N6RuJ`775oZx4q`J#qNUxL!8Le^NHeoWy9%lL8Ri;X2UvOrqrryj zZfPD2)`olIykF0QrRl|Q(;p1hhAU2DP9_pk(ow#*n7kcD-m(Ko-c}zuh*1+Kp*JQ2 zZJi#OWtjSCUf!C{<^MqYCHhV$4}yC?-C$|jG`##94A!6I!`NwQ*uQOy8PutL@1dSe zO3%m9gL~L!g`4AMElxitDze949QrU{Dg*T8@a(bYbK(L>Nzw7PJ!q<{!mzOyn7%Tr z1p692oS-Ym1+ym6FUZe(RgqO;pmXO!{5GR&}OeupE_&2RNFeh=?)OgxO=)-X}xIAM^Q ztS(Sr{UK`ev2=If5*6V?c`Z%D!krZ%jtG#N$O$kl#}G*vP08d!qlP%*OHVedBk~XD zxw*{^ZL01j5AyTrJ09I!-U*nDxJxQZn1Lcp+0)%o5biUHY-?@6h{7>wXz6CSpdDxW zZ%V;DIDU$&3UPXMAVj`JIq==>)byo1Fql48(i`+Bzk$J=j1Crdg8%zNpUPCc%gi5z ziUTF4qap4#)>k1bHy^DWbVzuOa4>yy=Z{!xoeg_;zMh)qFwFvLoy*1TNx~-e-tV4z z@$QjNO`nOcit2LX-RP4d(J2j?oP9rjv=WJ_S!M;Vxv3Uec?ArUvXM->jx!6f#}D&( zye@R5<)A9Og(LNL#Q9T@5Z+gTEcnTHhoX0*i!FzVIyfA=@SKGR%2ere+-dXpeWH(O zn%cUNGHfK8igvJdoZEYlS=GIUmQG~yB#uTvd+chp>WC$>?n3rb<&*4&J_|%TvN?_!WFw@^Na} zHL0A2Y^d$hhEJ=P9qLZ;ds?(9{`*5;CkJcc(aBudNHi;TQPFYKt27Pn?M7_sa5Qs5 z(#uyLKg8BlUujI+lqo+qrKV)?E6CBYArljuJ6peXvd(GItBCKaUoH02y#EvYG#_TO z6I(X9_ds782W*K68Po#@Xm;JfZ@xvDdt{U!{R@9s`56Jh)Y1-q~8ygHaXHRIh;p9E9I4@@NtbBV~G$)(|5y3B!``LDT`7&zc z?KFq$L^EZ5*21%C=EeFv5X}RmqLq%WAO}JEW`;?VCSd#kVQWVZ_UtJdhzdiOH+_p% z-w26_j%Sr44(?0YxueJoQf>IV--(rSl$zj25-mvf?A~MK${SBSF=<=o^dm&CNvYXp z@FP0(4H0s~VYEb#UJUG$hERMyQ1=?AkxnlajGs!Ux4loORS}xog4ne$g2!s9^W;Pd zr_fFr+l|Cn+Rk|y&ry#?KGv?y!QS^P#jEp_og=yW{PpA^(FEB1dZEI?gQ(oG5(%T` zaFnM3h&Qy~vu19Y!7%O*P$xX7kF@Z~$Bj2M_;cU;#W}@m|Fj08PyF%6q>|so&K?=^ zqM4hO3MNlOU9-bi@n3Pp=IsZZFIHMyqHxskUX0A-NVcySi~^RBYQ|J6SdJ2Bxt_Fo z!uI~?FFGv}SE8mW(_uj!NhyB>~^Nm;>@jS}f z)?s4&#rR<6XPwyquiTP5&KFG`Dx8o1oJzQyjGj^^DCfQ1b=bdU4|1lT11{RUtJ7W< z(=joPGr>)Lva{lt3v7Dr zFDTu=(@>F;oQQE}T!Je+wSc8OkZlnqA4VCc6XCi{(w&n7saXR!#pQdGI zp}w{m@f>)x(-bI;6Fl;l6F$jabZk6c{QXz3bM4DGT(-}IrEw~L%6Zq|ickKC;YsYj zxO+tvYWh{|4`^Uy^DRG`%@5p1;GpKf64d$5#K=+X^SSNK>Eyu>bBdo6Yr!c1LqV!* zLA2IZAu1`$-J8%?s_({Q(cDg%P0h-|{+;h|@*&9-PX|rjBlU&u1ojo&dLK&iln-hL zdvLtwI8C?X-3cQbLClRMz53`LlTn{iooK^2$%W%|lrS|vUuMh`;SBFR{KDa?tv>okq5N1B4pl_sP!&h&R6t9&a8s|88L2TBD`a=$VI11C2SGoV zlf+D2Vv1lG-ch$58e^x zqoH_oYG5qgVwwr3{;n&23A=V2GMx@zL>qSe?eo~Nvr?N{9J)lGrBQSaa#`H!m>K$% zuF0d~ICKg|JRHVZ&W74bbZ|BaZIgZoQ)uCy8h51f+W?EbE2?nec`$f-e|cc}vV64fLgwMA;Wud^&MYBb!7uuJ z?5Ku#DZHf1(jd8P?F!QVF$c}fb!g_^jtoA_&nvUOo(_zD<3S|Qbg<)`YtU3U1Lq`O zAx5I8YaI@>a%R6DjXr*bv-aRR4ia9&zO74ftfGno7&l*pRXK<9=$486#5YTy?uK6Z z>EcfyP>M}2y$mfr8u_HZ!|M~{8EAheDtE3zT|IlAN{?4p!$Fj7Uy9Q0%W!D#He==x zMg!Jn+F`e}s!=DLH!q^ib6MJaFv^`6VpZ0`oTs0uKy?eA2rDnkNN#w)k2=EMc-DrZ7Fj=#-@Vf#rk zOGt+E3$kxKfYO5vj$N#1bmN_zZQc0JW9_JKGh7J8=?%1EC2f+Ms1M{Swk^TpRZa&b1QdFx!+(F~ z``ECbn}YwxTq_>_`LD61%+nbR8gfUJ}poS)sZyP_phT>R$=r&YDRl= z1G>36$aI|9FocB#xNm}SxOc)wlLd96f;<7Dn_rLA03+Db#-q=eh=HZ@CXP1ZkeNth z*;y2 zTg(X{&Bx2p-b7`}bgdH)#Y@d@wzt$HA&n+09(!YfHnjr#4h4}ArBBcI_FYjrmaPXx zrG5C+DGGAteDlMj>W&suhS&)w9_s@9s%UId2KRNe5pSD$mY;Q^v%0Yt#|~DYmu45`7v9RR=d>X| zY7B-)O-7LNv#D_jmtUpM>4@9s>%yUx_h9MMf5I`^+twUd&W?UD1(q}PqLum9;Q&GQ zto3gA7VI=U>S%KsXQ5Jk339)Q!`~Ld69wx;I5)gI(ZWOFovz#}o^hXIa~L=j;(y}3b6B8vIK9x`WH0QWbgQP&Q{g8I;7C7EWqX80cY_gvn=Q1 zhw}p z+Igg)!cVOG^_~o2j5L0Ipq=PP}xzJP)7V5*j2o<6qS|7 zSTCDY%?+r^SF>ZirhKV0IdGNCcH7hElq1p_?5cBQQH;<+exYlE-)(bUFFav&I+5QR?a&nEJ=m9iIdtnYQTHK=Q_gOVPz za!^aZhUN~|-!AU`sY7jTEgH>0Hxv_XG;64>rLHhzjXFI0@N-C0klR3FX<Aid*?3mtRD-Lm=KG? zoHSHbl$n!l0xClWnoXCSaqFOHZRcuzMNJSNp1A|xUbqF{SojV;IerB`zW4^5|I+sm z)*)T!$a)wz>a|zCfu;A~h5dW?qOoE(_N`q?`|E&dzk-}Fkvw%$HjK`vTqtTtNAx)9 zI~B8w?G<%xOC#lpJSU)JTr-1aU&KkeSRj6MRBXh$Cm&H7a7C-!L(#XM}%UfRrS26?SA88NiKf^zE8d)#Ywm3SL?Ki)-pguuItMseG z;{e-f)1ROouy87C(=HLVixW^jUjz28cpde1H8dS}+PJWj`0Q!(I4NS3GxH^DjMl?% zVe<<=#pV^%x#XAdYXs9>zYk%_JY<8m@mjq!s|}jb6;EBhN*+2mAy##8yJ^2P=BO&& z&g^@bD{y}_XWpw|APn_I7oczMAA- zD_-gow6p#i{6rUIpFpNia=q--%VLH#!^pPr^!~WKWv2*-cCR)E9)+`m;K;0lL*Sw^ z!1gL3jr(Mn7ZSwP3Lf84U5N<4GDg_byflf~&6&ccc3N1ZXF2^F;vcO4Z2XxAN8h{s zY`xq5w)ffko$7u{c&FG^^yccH?qGQP!+F#2J`Wb(>)#*V%0GD&-b2P|nO;r`-BB8S zLSzEmpDs4m@yYS%V24J#ViZeXevIj@!kpHh;MsO*LLt{$t#oWYGz@g^loGdmnqt`QyB{D+UCJTMF~s6-%P9xnUj*CDMY!SCOL1(|y;%9$Ylu$FLdKlWVmOz}8uvbp z^=->B>e4TxeZ@oQp7iI;I~6zlkLnTYr_&TwdhGo30P z8N8)9$W9<|@9hc5ALi%&1L`*hw{fq+7w)gYuJT9}jPQZQVgy=I!`XRhWhZ0B;+JsN zCmuw8b`N+s$%Ed1onwC8KUfw%6%@ewmI>*A|Xz52%}tBK%VfO;fNxC7(H`BA*`bwuj4 ziG;Bzm^jwqkupjiNG?t7QRdiTpvJ@T1M5(-V+F=cpNBQi|ALD4Cy2{bJi;2sSUhz> zC$EW@z2R&S$ur~h&c8i}qS2CnBk}@^Q8(r+@}ipqjYyoCxCj+p`>?-ZC61()AS-eN z$4BhkSFFX#=QrcBpT367XevTAbZkvjVux4Ujg6a1cp?NFsH`h6|Jsiswxqa$8zR|Ve!My!q~ajBdX^-Y<%Ju zJawj?4I4Y)Y&6=cx9~)dI>gehH70EWP0?t^Aii2B+^ow@M|WWD^Gk8gwV%hD=YEZ8 z=U&b;#tYa8sAKB5=GFk0T!-Pn?j0C4btXHSPMG>IhDfnFA_4v+lPNb=-_2H&kiuo! z;c@J6A6tvpmi+~zuKEQgO)S9CH9x@W9fi2@(>J4L$HRE(^+??Q&6~+3t)l%GYTgd# z5r;lp{JDoPEU6QFU;YM)4|CwqUV_9~-@}}-{#;Wh(qiCfVQ&Hn0o1*Xy5i@6d!2g zv5B+;&b|sW&l!iJrH^xfH4@PYBat(15{!8;v)RL0^)OBh^vNtsmNR~JWz+|64WJL$ z(yA=90kDGugvgi(gmWM?W)$U4Y@@$AB>~FzuU>4WjP+0-B%Y)XKL7g~JiI)JMQ22y zkh;Q=CpNOk#=$p#kL$kpSN#6<<+!LY7Ek}+19+(E%UJsJ^RWEM+wl1{x1jjJd5G*O z#aF+0GagTEM^VH~y#B&pF)6+VzxmWvc)W@ymmJ)I1wVWNpPyNUi$^U$`em13%%$JJ zCx$P_g&%tg^DfE3>J?S^!kBne?j7?u}B_q25z`?Dp?>-@KUEhPYz@F z9)_a5MflmzeuiKC{Fk`@55LE>X;U$2%48>w>bjy4?ve|p;u}ByGmpyTK?v>acp1}L z)!+zB=)4zOnhTMWHy1PW8WFOWh-(}j zvH9t5p}Zjp(SdR_Cfl8n$6a^}>el}e>GQvaVX1LAw*3k8<}5;1 zQZH&N4k4aLVMf}vS^VN(praleU;HHpn02VDEaPP0QLY@1;YwtTEdX}9d$>2L5PP;h zhBN0~f>!RCkq%JtXjOXi8;==2PME!j?PMnRgm5Cyb?R&uOgaZUmOh1xZu&YhbBSA- zVh8!?=HKA0Ltv*n8uLH%D-7p}K?h&|I=1buLzM40d?Rkb{11MJI^tW{&!ar+I1x1Y z#``gCN*tDcXCaz1XCk7ljQe+Q!2IiPLwnJ$v2w{)4w90PGVwE*b1qFryUMV8$*&PR z;sTsK?@ScG_)YSerX>B_ynLQ0H~MCrcgZX%@tZfy~?jtXuK|=3aJoSB2c&UFL>jnVl24p$4F=xxQ)^V?UvHNoAxb&rzXXYzZFwcH{q?Vd5#`0 za`gBozkUmLJn<#GUB*q?u{_C>lgCM^`S1m*SZ23i-oo>7c;&CrlKUz4zmiZ@^a@(p zHykyJr%|aPq@46>pky7r!q_+H;mX7Aw;tsx8WGbS*}W2%-1c)?f2e~b&M}W%DM%!* zDoRT@pi47)Kqh_Nl=EJ$gqk+Y0aa1ItCO`)9Qj>+xZE6zK6oS{wFvDqbvqkQr&Mj2 zlC9_7@ly(asSw$H-jPHJg8! z;V{k`=;JM6-BiqPtizNK{RxXcb)QM2yR)74&7Z)$TYt#&i8-svSuG#0mWovk_`qEcV&Scy!Qq$gK~wK>yz|h|X&e}C;D#_wHF9;RyLmrK50Ajq^De{mxs$PT z=}PiLawD^kGF0!|irvfpiiXYvZr)5VvqU;&s)L<|u$Ww=<;~=G4Y;vZodYW~x)XzD z?kCT?1+&jzXk>QI1&c80+#A`c;;a?J?IlGU6_c9O231@r*$e ztQ2g1{S9^mR%7$F0H!VYBxYazQIv21Q_s#phi^9Kf9%(|_{z)B#TnG7oExz4j)!pJ zHD_bTs!ilt72a9$4ASS^i5Uw%fpl!d&h3@d8Jr=X{|(H$_R~m<+KEl84r1h-n=qdB zzqM>7k76xBb9WrF#?D9n_$jQTHvcp`mHe`SvHTJ%2Ga+Yx0>baC117TDRZ5R&Yk42 zEyPDopi~F&# zJ&ek_T2#b;3U9vlI`03%JRYxp9Or-dC;0md%kbB`3-I3$Z6&@UeEFw~anqN7h9BSa zJ;dyJ7Ei4?%$Bx*NeQ|VVE?I z8=rYdg1$Q=oh?3g_C#WS)ZO^<^m}m0Y zFm37>9NhR0=~MkF#924|1Xq6TaimuN9mRWTZd$b&{`|{u*7ZNcj57Y8+qKRaC zG&|6V=%&>~z@NlH$0)YD|tu&bX@a^@0#{Y?b!UAzeS0bY&kHxOGkHe zIyO6J1W!exWe7bL-?`WytFJb^O-j#Y8&8?`@KztLOH3QiNg=IpQy;1Q5v*HN zjtf6~4^m@Wu=ADQAbJMdDC$hpMr~pn#TBlwo}+l1@;>qk_RZL@nm7ME)-`Ux?x)8! zz+{!d_=~@X%WwY?k~w)j_JhB`{9C?D6OZL+rP-;EeA8;Sc)^haHLCM$^6xUjX+y++ z@{2$Im^55<$B$64XO+1=aQi*nPr!-46L`lXba`S_T2_|Xqo}Z`m<0AiDn0!u2WJSs z%6PDgX?L_$;`81%0AWP6r-v-OBB(xfwAb{eA>4#h{Hnk#XD*E#>0SYlyD% zjX*Rz3Rk7whx(3KvqUZwOtTd*16;VDSa|$mbTmyYIDl~A zgs<;OZ;GmA@}u1Bb+o($v(LQHqQZoNKat#J z93LZo^-#I@V$6te%qon)Ef++gp^dX)R0U1eDqDohe5qrYMVAg^~*#Gi>;^5H^ zn&S|bd^g{VBwdEx0yPo1+{$I!FkceVb662ut2rA}LIvK1%A&Qj8;-)v3ohi6ETIjL z`Z`ojp@i`q>jL!ZLz3+kJWiD#KRmt%hxV1QQMjJ8X{KIr$s?{B1e#0G?dw7PksUNw zYQpGQa}k$uE(%Ac;?S07aF88#Y8yjY=tqQlEP7WhU0Ic#VqJ>AWi` z3o28#M3!4G8*tfnn=pm*VjmXKTuEw;Ove_^r1;e8(Wy$L1Z!|dVm((#x{<(e8!^nE zfF8=UGa%)Wbakt-{HgmmAU}jaT0TuUcrKnloil*ZJi&#_)%C@Q8$FRrxa3jtNF>CR zp{2GCZEPS?*^!Z?sdEu>;xA1MTH22DR*u6(TM?0SDMpXXpzqc?6Erm*4Q#HK?!XX%piE<{pfJu3FCqe)APQy!s& z`9Pkq7NEB3D8FR7*~qN!HGDVq&gGlKL#7w4MwKV5G_$U<(Pgmd80v1E@^adabrd5o z<r4fU*}56M?Z}@!+By0W!cCSVOuJS z(GnTJ_AP6%YI7}azV$MmcYhiFV_qg+c;sF@VLp&WXeK9Nw)`-I3jU~cWnQ)TmBm=F zU;*~;+mDix65^MvD3ZfJ)t>~OO+S0)1b#Dx`?9FN%|wODinYGFYcgiW?m;9(5wk!cm{r4OClFLxVCE7&$QbFV|;Sc*>s zQbvqMu$AV!wbXl7NBBHCqING5$4o_}9G0D`f( zJcpn9xSMT`H3@Q3cMub~4u)B`Y%$|fSCOz?@2scE6$hwp;$njy+t~IGFBt3S0@3CA z>uwIgpkLjwGEM+-a)-1kj!cF0p|*zVBYdM%r3^VomNfAYn=l*!nm4Krwlik^k?lCN zzXD?};ACcG5tcphW$f7WCik4t#Ecuo%_=ncDAQG6cs9R>#V<_PRv>5YJt&OciN*JQ z3OnB3$ILN3lcw5HP1@``iO;spGxdW5yqe-wDBraTwLHns94aCqbe;5gYt3Gs_E(5# z>Y=FQNjwRN-#a_9$Ml^Hm@@8OJ(QgdY`4^YsU17O_DtqXhIfRqp!&Gnu>3-rF;Zu< zd_v)TFb81JS3LA{1GcwmXbwt2HHWa&j=sOj@C{iGz2xQO#_l_H0EY+o-}k zr;Y0EIF1(9iR4`BSLR2TIjDh?Uq*$*Fo!t#B}bV;e@JEQ6H#N z=J`BH?jLcYJ&qqI>}KCpW#@HH58EkI`Kt?TRFipepBc$^jh))fcOl}B7oW4*aFbGYUICRd zXY2_lT_;Dw5R^w;jjbKmVpjL_$Y^<-pH9CSdrPU@+2QiB!=18mJ@#GwNmNh12oc=R z(d$>^uf#}(lqfl_PKGm}(JT~|d3Zd+8rGnJ8`gZTJ-C76yb5ARVHgGV;KmimoSTc1 zwX2Yl|1BhBF+(Lk!=Z!oF(NzY97jfhPfVdX)_N+8`q3O^YetEq_{2#_3*3j&ch(?& zNl)7){o-e3fXUp_nP(N9t7GKw{Wz-b4wAj&bu868SH*HEJyB{*Ku~0 zwE8(iUcbVX4VIgn;=31$(~co{B~rY$d%Xe1wm}s6~w+WKRa~Y zi02vC3LhK)1`0b4t0VM6W#6olQ1RV&Wt@-G!DZH?6cA#E;_svqKD zYc~pVJF#z92Xd~-LsHi~G`#ULYNk@bl`KVV*ZC}mY^215qipj^WSx~wGlnLrJ*LYQ z6&3;yVW43QKf+TK;ELfnb2yd4nM^7)k_BI9DYk9ei`lpQ5~DJy)M=_1^QY^u_h1tam1>^d&>bP}J_;WGIpFMC)I67pvwp|u3nRi#{Fp30%PS7tQ;4M*{sCoygI z`51rR4cNQpS(Lr=DkjYTI6DbmSm&clNjznv?C>Fegl&ups?Vui=%_;A=rSW;eF16| zx$jDo>vSq%^QRTP0B4{kU5gp)7{2`b+juh0Lm0~$yRM_FIru%7v&ytB=2_^JZc`^a zxY@F;t`oagy@|BZKSX?H2V&dTB4fg3$V_8>=%E~jmvPMQ=oaz8NRv7Xde%P&WWDTw zWhJGfF?uZXJeezqZHUWGMpalhnvRvAX*lN`<7d!xYGbo9Q;sAl>9ECYk zP`>_Io;FiRlL3xqDG%CIrv&;~!jArc`d}6H!6MdO=~U^Opy`B68OZjx1XgBQ$Uv(OpJ|2an*_cIHPZ>EIpZU-fp3>Ecyu3IhH&>##XcsDm zjYQ1I3o)W`1E$Zv3bXQJxq=pfq$rv)&AI}gnqG-N|L#c~xp)SLrR1gtXxgNz4kK@B zg48K|`pKtJFscA|-E|k%tXYdEpL_~m{px?3j+{%L(RG@YzWk!Ocxu^WoSo#xP_Fu_ zZ42-1z#Cz|#)o{1FtYBa*cN#vR<7GcS=H)QE0Q0606}iv-FnTpIPiWqj5y0p^8mC_M8ld*fn%g9?e6-T!$MP&Ly>cQDas3STZ>UMEr%c<`H7Vd2N_#j6}i>~fku8?=qM5*O0ch} z9mB86r+E!H)BkPcjd>KW()?)j89zW&H}@IU971eZI$|=#=M}JgX78MB-diSp$+pbP z#$NetjFb4Wtuu92VyH0j!q0)p!GlPieje)qS9PcdB2!1xbhwVCsYx#l<{h5-IWRi1 zXF1Z?{+)B}cR8W4AM0LwjFX^wMn8ra$cG;4tGHx-^NW)r+1w9mU62EzakDN)+5Vll z?<*JK(vN-@6L?CP1|5g?zm2so-beGd6__%clZG_&5|v@vZ^)JUC=R+ZCwv%jt8Yct zrBCz3Q4U%oTG@l*%KUG)Hlw?2SZ9{3}!`owjnjVkUr zv5iu__s5PzR(v!{H!el`S>st{V@N;E{iw%}*PKT^&iy$?k5gX=yD4Xvk1T6Vh=@-z zf7C}PD>y;fN*x>EgpA}ukrvnM?pZto!o8|y@z#y3O@-|Vx! z{{!@ir_$NsJfO$_^_y?_zBa(EJleujfF_s zRBc_0xWWsNn(9O4t__^!Js-n!GHKws44dA1mCKjuNKb4;U0V)D(hMWWrSa5}BT=#b zeiUt9j+WT-aL(nI^GLKbb~;+H?e)K+gm#nNiQ`c)V=huT>(qMiS?pM|1l6?dPMx>_ zIrK}(NyNcb5Ak%O<)~{Pfr)dbp<>e?QM`2(BGS%;zlF0PDbv}p%HwD5j}hluZm4ZR z`oxQn5Ff)?l4IzJ$Ut|>R_u(HIu zn{oK!-=4ISdP>&JQ=CLEeLCx|sG-lmpTz;-1M_~Iz<{c#qwi2V`lOMkP+rI6-Ofb zevRUeqC%=YPII=jKHgG_W4R&s@G))@?Fi=z2v5OEV`I_Vgp1>Tfka;`di*z`JCgg7 zIPg&VzK9eIpFD%M+P}iycUDsA7js|5naGOjFLWG}Da2cJ3|6UGQ1Nw7i8aZ@!4igZvtD;rS>WGm3j{wqf5puknC^ zm1s}81amLBgsX!YNKdWB+e;os2~7mrdPg85Cmx4+BwXI?bJq*q zf|d>*E0_^L@!D6pLUa(mq)D9R=WMtpQ^=I6<9ZAqISuEHI);0GvjjJN<11)geJ_6c;4|2`u^dwt z-H5Bt$iblvFW|3>7vsfeUPRpd&*Sdf7a)U!``M}6aK~4Fj+bA22~8=JF)h0TiODJ$Kcva$M9t8wb*!Q7(Q~arHOJNg7FA*|;8CmOaZ3 z+gh$R3`fD4S0H!7Ow?|<7rQsUiH6{K%(?PLuD+#E9(z&j(Ge4=BVyA=!$)(@cUHZE zW995LMUBPuGw0A;_7JwO-Gwpdan(4nPZtMb3iy@aER(lD3kMrJUq*THdX(+n#Jy#g z;rxZyA&LX0xUBK)?D4cMc0Q}h%MhDA4zbbPcjc?&cPJIMT8U zP_*s^oO|_Wuy@NF7|+geB+dNZq*>+4mmV@{En=s6zAVZU@<3F=9At`9C-B)I7Sn) z(zoA2{Iri_>g?G#zWFCuxA-~g>=NY7y@RVb1vJ&&h3zY!rygj==s8y-BfgK%-ZpRC z+&N|trH-{a{I;#_@wk40zdal2RY{c1K0&6XxWqBY_`A3TweM~gC?;t^V6@mG$iQ@ zqWLZA*lQRsV2}4*uqLrLOC7H^_ zx_7*2Rx}vXhhKuMV=rR^=g6@XfKDv)Fk0T8a;_`n%T&XWcbWAL4|n=`N(M(y<*e;$ zj*QD$(=r9F3QFr%jse!Zcop9w=un=(Ap1GAQMF+{r433RRXhzu z>QVWFJ4(rr|hM9S=p&&jD*^0AcBZ&@xOPALvTz@nidtuzy*IaVnwMQ|6v_pBm+ zGb*^2IW~dElM*?ahT9cI-4%kN6^Jc^)`j6M@OE4#SB2|kmElpmufW4oOymQp`UWlo z;ml1a`vXy^Rd2{8A#&lVDzmgraa4lT`f$>8zWY)KLQ75xGxC!CS~BbI;j%mJXa6H7 zvWZ+xol+9Y>lP&2N)J&LS(D!2{s|fK6 zo*vQVED76u8J9*Fuavl z`X=L8&w?vQP#ae*ZJ6IGIc-n%wUl`kzim>_x?Nj+gnUV2~ zU%mMd&b)jgN9!NtEPRn_YEvw`oRB2AsvnWMQ+$kKI{0n20SS0+dO6gkQ%eKq_x zt8cYpLi$4X!P1VTKG;O$yCf%2sx}_v8zpFd-$=GIx!2A94py_o(vP#RQOm<*_Cn~Y z{JB?3WKJHvYGzT|u-5UE-bGsS9_f2?^lXV~Gqxa^e?!}>lsq*d0vWTvM_MbcW?|pD zuW&c=xr1Y~*i&s?2y-USm8Qt;KM zHT!6I+&4EnsNo^A9XmNH+jYQT9?{AvJJUJ&=xHAtj4Ydq_ik66fV{NTMY1uJo4vTa zM7l4#V++J}!^)_M4X@yN*_)8ouBY9(7}2obWt@4X*u?o?_ME6r*8sWCpb`jYhZ0s* zgq^wh?6})0IT}Fj3&pbaT;f3`u2(k?&TaAnnuTn@TJK0?R9(oW!2XK7!8_QeC@HxM z-$2IlHSFjjd0@i1IA-Wzr5GM8&0h*n`i8iODs0}cj>?9dB19vcOS(FFKSuA$Nn}fD z1Oe<(X=PV1H}VeTg$`u97o+I^qZ6Zp-(Zd)h#@1!U^e%JT{yBiMh)tsKFlH&QC_6W z)#{&kw6BZ@MyS0cRB+VD9D!oEW?%XQL6Dw8brQB{RS&E_j&?jj?2#~)nFGZST?f>! zBi`_&pTt#Z`&om#s?~BHXRl4 z{aAvOHd{`^^MMy9Bf4o{bqb9>lA6X3M_?kW_i~Lsk4z?AFGu=O#+C7$8S(NC3X`Xg z=pp*3xO(!IaLLh!Ty7hJs3v{T_k@d)pq6|dBJE!QJ%$&H=22IO=IKN-n5Y^q`H>Hj@#$M*nlbKx2rB@fIft$m^E-NiOY9Hpl_6oY3b1P@*^=9qELc1;^ z%#*iiVMqED#B{p^De=+=)&+cU@j@=1W0Bi8tl(@yA6u?MErQFavNkM5`t%QQ$`udN zNC@W)`&*oW?TAi1@lgiFTvxXQ)U5rEm0WJfZ&^I=q@l3Ocwo<-+%0Ngpl;0IDWM!d zP2=fg5ggDs>Lsc+;?Mtz;>2Ip`-4}`y9u)+8fxhBR%VEe}9JT|g9M{SdpGU4T(EH9NR zZFtl!1&1WK#ELUvvR|tX7mNodsFR<%V4W~d+{59oD^Ek)nRhT)HG;?KFWLJcGg5Mz zRqlp)xc~Z-(U>RP$$*W>ubMN7oan~Kqyfu!PKVX1B&L(F!c{x7 zxdvII(O{uRW*il?@~ad@SMsx+O0z;1hziMmBq1*Wfsu#sDe*cNJFNM)qSeEch5^Bp z{1hRfAw+dR&4}uPXk?v_T3 z+IEy#56<3FVGHA|M~IrWv}(+Lur?iiv7%egPq6xSg8Q`%88w&wNEJrf1NYEKc20!D z>^~s>>c~47f3kNWgv+*e{1G14!yfHFcat0$yVRGI0M8SsX<`gr!|g|khp z-x}s4ax~82HBpD{DND!IY$#{3oOzlI0`m@5mOvPTD^E#_ijdjm9lRivH=1*AlvB2{ z;a@iK>(vO9t;}k$y$0?jb#asn0GMvKp4T7)i7~2 z+*HpCYn!*>p&0CQ)PW-WCLgSmOJ_}=cCa)KJD%!a4m;Hb5agGRf|u`|4Dg8IarU|6 z*hbl4&89$skm>$C+*~LZxp+7wS}ds9f(O36FtgMK#pzkG`Q} z-~yiwO*e3d<7s#>v?MG}>er;1r%I?N-lPY63XME9670pQ#j|<*ahiGwR3;9Dz`Ptu ze%?Sh35zrBQit|m1_O6Ao=zT(U-Av)S>jCj0-uuRbdtW41mq;vb<5|eqcPQTJ}1yY z`s>PD;>9`ncE&mV8uIY|8oq*2HF=w~Kpq3bX3e-P8wvLm;F@!}ftGtaD%D3%hJL6u zi*aIo#W**j>qe|(ejueg7Me9Ql4a&X<hvhTgvlS%6>Tp0lc@qfz6Dh1G9OJv*8U5g zfRb;qub7~sn7KOBo@?>!ZxS;S+UodN0xQ0RNlu$7RK_VqodFSxoj1cA#`xg%2Aay7zIf;)Qvyz84T}m#yNR3 zena2zX2Ry_$jf>_YOCCP6WA3-S(VTKsZMH6qKne^y8Bxi>I0%CG{~$^R zS>w12JDGtaEx@x7gj4nwdF6V8rd0Fdm;?VXyEvc6}=RJgo>ZAc>32I6C ziB&pvv8I&MoxP;X2SS}dqSAFGs;PE?Qy&6_pnoiURewxVPZdX>d{u1v2AA>tILS9v zW>{o%s?bz?$$D_&Xd0Ryor#^h4$6mB@B*BsX(ENT(6!)%Z{fu}=~ej%xWtJwd>b5z zW18W|E{}W|nZKeeyx8zf_z~Vb3$7^^ChIfUiO@5TEDUV>N_M=ek+$};uXbU{)`^r~$8}XC1P!ztz3EzS3&n^@5 zRC3f$#epfOqg|^u&UoR&k4sf{$wZtl#coG-x*g-=OC#CxR@gRQ7ClEDD{$3znbQev zNk`V;O0HTu>Nl{B*pds7b$~n!=StQ}UONB%y^j``z5!|@J3C*+wJx*pX5y`PMpETw za*6l-vP{;y>X4d%*6HjvqIj1!V)r6e-b7V-3hfXyN{mw*%H`N+OM_O;KyO%=Y>2Ov zdO;^|qKvZ_mxoT(C9(4r=A~>_y6t5JDdnB%LP!2fO^ETJQ0Q02hYl!S#qg1!djD0v zLfbguizze&NW!9}iy$VGTFNB}k_Uh7ymXW*qfoM!e2IsEK52=Mz!u+PtSCPCD^8lD zpcr_G719E)@{=^mNy|&aNl8TpH(Yu$cINHj?cxF{POvS%uo zQ0Q8Pwz5zmldjr=DFp!xOM*pwQ!aVGlruC9z7?(d6@ez-rjHYui&MW=c}&>^#_*@1 zEJ6Wv4d?sovxP?Jh@oVfxvGX_m74T)oe)TUkM9Wl&jrF7_$3lCP=Csw)}zg z1hN2v8zU&zB_?)DRtPMY=jYy2}!g${=bGG_i({czdAHyfqJ!&IBbJljew1X%-?M3Wv!iPnBZBFhNozEKc}ll=ZoxNB!6F z7K|#Jpjl4ytOJ6Zy=yn7&ELum{M>M_a;5Ph)6%N#P|C%7^U<$s3eG!y2#pY#0=1~g zLvd;2*+~{1CeQ_g(<$|*8C-cfgkFoD#f~AVc_M<8E|@dX!Du?*)#g=4IH=dI7<~$g z{)`e*#XDLMqqL|@oKUloEx*J`y2Lx3BhE%Kapo!T4!;fOpyP-O#*6M4gobgN4+E>8 zl4c0$biaHJs{M5Eq~df~rlD49uYo2_(`p5h88bIH{Uu`%h zTGOrj=iBfmPiG#7(nfT-oRt0jCLca!2v>r3-X_f%N57Jr#5tTJ&eXdvRg_b{va&Ws zIRSP$Q$C5a2-V`nAKr#j@Fq?3+psobaIB}ze*iBk-kVe9l>E;umMygAVCm6UV3BCLD2gdpB{!a*{Tr9C5*T z@qZr$N%Lf2_0z;V@(Rkc$w6y)2P&`|LoOYH5mW53G$C8Jnk%j#O&H+K9oio{l!+$4i6TNMP9ld6Rrh9G`yg zBa`f~#gBQ|e3=MCL&C-{&-$DuqUT$K$vP0XR;G^n(Xd)ZfwDIINO6pU>!2-BM!51+ z0h7)|m97#P8HjJio6#&o$fgqvUJ-QAa?p?u35|<(ZPKu4`DQLBHv5gZ9MG^N&vITR z*`-}`8XY`!fJY64s*2j5z?~Fo`)i9=V1mc`W7h#A(SmO)MFChUsSaF!P=33)agb%* z%ZvSdQ~Lox2O9LXivz`U;SW>-uB;DKV*h{OP1`Wf|34-FeUz{2MFcN(@^lXl$sU^j75}KSy zYdPES5G7ocZ*`8eSUlnvATd51&S~FRwvC-?(zI1&8COj8r@#mWC@XZu$@HDSktWky zYI=v5fq7^Pln4QQ2_@s?cs8}p*hH`)%QT+QGI@#NBDaSwSh9#0jhW*d$%{!aw zD@*?5ga4Gg2`{-TXVs~$6CJOmsUa2b7T;=$(D)@cC2uEHQdD_s3F>r-(|qe`SLQ6` z7iY^_@)f>yoNybgji`1ectS6rjhMXbX=aO0yIzD}DYeQ&=kKTiEi(lpJm@_5tK_64 z$2dj7syj`=$EUysm9)S%%_(u6vl#kXG@Asy9L zG=wDuku^&%@Dk&!Gl^0>iAU!l4bAU;WW14uc^|brobnYvV^to$Hlk!M`3VJ;Cb`gw zocK_5<$V-fadsP_tO=u+C1^-P)jSmq(o~p2&uSxfK32IJ)G#w_C6}UHJqs%UmG!qd|LVV-g5G7(Nj=X`E5C= zFe!#mEPWKkrTQ(t zX{Mjlt&wfe(f;KPOg8DR%{{`XOo2;(Tpc1xcgU`^fw>FOmnLNXPB7 zEy+t;HcsS3zpgu}CoSP4)n`i|Q&CaD`_NjVW2X-4*lEe%$&zACG4#vp*}{g{7Uu91 zb!n^UnDP}_H>IXg5Qt8inCr59k6~)nj)xR{E~fv06-H|PyXnz`5gJs z^iD}m8hO`JSKXq}Xll%QE^D*E;BADoCA>q@|tfGYu40d7AyYvO(Q#$fTq1oQdf1<|wR}&j*XPUlcpY}(kx0?T!dV}^qX?L-iGJC%Ed*>aRZ;1XG!`l-1{svP9hCbCeha+*>V@et=t{tqfGYu40s#^b9bEL;U`}*h(E-&& zK~P=2HkMotNrFs}Khow*ja;T_4&JDZ;fpbPwuP!m_>#4cd<5#*0$3yZw*yvkSCc|= zo3bvROv7<|mJo3KF<^zssG?BAbEP8?6B9!`A*_#Q6kHom#W}(@4T1H=i(j~sGt|w^ z;5H2&m}vVIPGFeA+^)trx!!jY--%Hm!4@%se_UFO_%i?A>=Cn(1aiCjD9EquIiYePVPaTs|AU!R_i z#otW9w!P*1<)?fPZ>XQMx>h^eFXAr_;KkY{)3Ls=VZB>bNgif>zpz$0_ijkXqLsUk zOliuq@za7u*r&crMk(_&Ar}};^*=vO+!D8zj$9U75ph!yJoFo&POMJWVOBR;>IrUtUT>@(E^9ZrHE^bLY;57%tJ# z(b%(Rk1}c$a{)hjyJzFcg;QYm>+57MrY*S_?{3^-L6_l?Z*RqlLSB=7h;GTWbhK>R zR8y(Q$K07&=-fh%Df_j%O1$&n6WG!KMXh#8%J9HnZ^iQM2O_^J{P@y4ShcfmqbzsH zTX^7;g|)7+%iFXRKh0lTE50^gzd+0ps`IL{0%R^-qh9aKnO|XEX5DfNR_ekX8?j+W zzTJ-mgQ+{ti=U=uqFwXG3M6O4d^|Go3FO-dUM!jRF8*=At+ zdi*ebnZ=(oD33dI3(({e}FS8wD#Q2IK#u6tPWW-e8#*I!pN z3sqci;PLP)$9N5+XB7;*e(Frc&mw6!p>5$vt`aXh^mB4^ux{NtMDXG~1#i=};FYo9 z!;OrJ#9ME^i4Q;g5dFDN z11oLk6E4Ojr*y9+%LY*?&cKSuPUw=BgcaYviD&-(0k-D*X2#0a|Aa5*;U>+$CMOL5T+WAWFEj>VjJK0rS27g;v> zJ#0=o7Js|>I`-)+`gWWo{<$N(0sn*lJY$VQUM?^*YA0cQb9zKt^vIyz(H}fNLxM)Um@P)T} z2fiS6lIQe42YCXsm%DRh5a)8G_HGlD3CmqR7Sgn?_3=N@4judTqnoe3^WDOF31VB5*fE)`Y z2=dRN{D*Q~+2fBtj!z~{Lg&t%@t;@!gDzdVaz=s6uA*b8`E|HBTaRnIZY=tFJI<&>%I_F=E7U zZWQl}kt0VUH6;b@+qYNC!3;mnC1mOhWEL}+Vp`*=!JeFa4D5Fd1`HU0U0FHslm{Q# z4B@)DJ-ePlhZkBQJBv=L_$!M}D_1T8fy|zUb13 zz;x-;S76XF0})xi6}Oz;nj7WW3_|*0%G!M>+p!2IQsD`0nx-1)d3WkOmc4SD3MZ$^ z4V^vk!R&3CnE9>F$5Vehk!kTrri_!jUxqxU6=i;f6Wj6hFV1c?>Uj|s?UW@ZRao%$ z9g3dR#~I_^MXAv7?!-+ecR)yNGGZ8i%=r&+2~P~vt`r(-sLsVhe;&xGI`R9SU(;HCzuvF(ck1up|@mI9P;2XIgC>W$82D&Q_S@Tg15;h?_qq}~z z-<CyS>kSOG*S)fLU46XQfZJG@32xP1OmqxpVdyIpsmsolNx-Ytcu zQ%U0Q^n8$PxqJvkb-sacJvzu(&q}Sh)Zo9~DC4;8v6^kXA&9TPb1Y6k};^ATYAojOZD~iA*XYVKZODL#j%vO-Y`9Jtb!9 zw&S8fn+Gx{7q76L+Q{*L-65PKAP4vY&Gj?UJi%K%SndkEDr`%Qdcv7OymLtP3E0H- z!EQ(XxZPuRbxe_lW%K$u67p)ZgG?H1vDZu1_v zYPL+ZZ+lt+ck?|N;jlMux2SR@#_9aw zk@DK3o*8gZ-$_bUw>_k@8Q^{;;MUx)dA-(->a_+Wk@14tHGc2)yq7VZ@q%RCVncD= zW`xjW|wwed)B{ zq&B=ePdcXPwM+4RgQY#3=_IM!-j2pqm52pIs>;1ut#K%pB;OAB;j)Ll?(n7>;k|`0 z&FdnYy>D(d-O1`_=|HXJX2EHV>4kLVedUp$c)RXM2~8;fIQ)+dfUPXx2b)|@Zf-3| zn`*62HAuHGFAW)4-}}=AK1f(mY6=CkBx)Q-uwrkDVxbZn70meJ1|D-EyaEc**;I0f z#{Xdf^r|mGH?}Is0~D8@5qn>o+0msONK77}~3w2LV*PJhMYZ)sgKaS-|I9St%d5ebk(D;2Zf zKV5s?9BkV53U|6(u`TZRAO3h{kqRa&=o6TJ8l|SH?)@&m19SO;SA;!8!dY)LW7OT8 zt|pb~(DX)2H3)#h!Xo%2EFjXEEc`MuFfBIQ0WH>>bLWgmVnS~DF78+@qc(x04G4>>&I94xBWQ9@RpsRZ3KP1wPt3IWZWo(uSBIQ;vxX;hy<}RB zm!oNHb+pvO1YK|o*t5C3z@yC8{tchF_0x<{4>mt2cb=*TDX^k@Z!_6(-LL#w-a9B; zyZG^#)`oDC@KblL&3pwDee1pn=w zxsn*pDO<+{!>e^aX%bm!hGWLyhLqCqfCsvs>@QvHj%dne1zYESBBE|NlX`f+;J>R? zHlz5y%67%?0Gx4>5}Ln>zCKXbQW77QTi)<})aM%9C>PRytWVmVdEXe0WK-L(BPZS- z#%!O;rw4D&oQL|(a-t8O$o6HeQP$afs44k;5!JluF$$H!rANXv?)l2@H&)HBwRi%! zNOi!j#&~0-(s+#IFlT(dag%XfC|7ykQzfM?+vSuY4WIg}^1Nddb};h`cp+VTl48fE z-S@mOhiGm8P1RumXKXnx5OqVwV2&K+#Q~vM@diLYg$fTtNTGda8ad)%)nuW$lOYzx zb!f}xYUJ3%tNi+Ml{o(*%eptDGky0EDtkD6!(eZ?O5kP?)6ebOi#G2S+R&pDX*PqC zzY(}SEN%bA-J0($K%dj|gI+6|h4PCGPaF^?fQg$3}&*X$!y%~UW zB&rq3a<#YJ2&}xYPySC>+#bh(leA1ujmotCprX!m)<$VKgn%LjI)a9W8pWM50)E#E zP6n3?J@)59xJdbiKT`2KXsOM}$$A?{vD7E9#}_MT3tRoRE=sE`Jh^gxHP|Zvl?`F3 z>`O0;*Mu#j^*nY#wr4OyUm9-w7u=w;V_D>I*BywE)NSa=@)<>2V!WS`X)Cl?Mj_My z%lL6f*ak`y;hp6LSD^55Skg%&?DS32bw6M!#_RLv*<|>dFmn(9%M?1PV zd;V`b`*_=TPrVs7Zs0vNZ$5`T-F5pv1*F>SXj9#ss7R66QQ1VE%3#l{@$j;!%MeW4 zP8{ij!uZ~EPbqbzfKFUrh+p2+fMTt8NF&H6JR?fY06FVUAmWA{xP=;0go}+JKk#nj z5J?!VW~3|0RUdXNPe@Zn_iLKu+|t_xHORidC_KR8rky>cu4bb8*s*R;$kr00-EK7@e1|nh z&X)z`ho&10Ul2V0e-sCb_n z-ZW(zEH+E1zduGWx2kFwUl?RkB*1@`jfA$9@tLSe-`KTRuCY(q+mJn;ivWjw6JF}# zSh5r%MqP8K%Z=T@_|()0o4_LZjTQ~*@g7Mo>%c@rnM&s2C*|lz;R)m5(xcR3Bq9)W zrqP2>nxqaDL-xFA9$t6PwcX6dzSxc_XIP+e!ZJa0!-v>#o;c~0=r}i>+pUPm|F;!6MBlm>Q74V&xj2nBvkokC zgilY74i27V>Rhbr?r0!cXFe`vl+6J!+Gupz!^-yMFBp2i0CcZB%yj3`PAO_dPX^40dDGX%Hw-T z9hCcm2EuA+I(NyI<+1`dmD7arwf>Bls1Uza#t7ni5scd{|JceO>qFSKD^Q~Ofj_&% z{*e@cB@!%xj~~PsTHTRn|AawAh5PehKxG{~B~f*)p|w0mfYmrEhDDY~9`;kCdLG{*(^)5%X>&pTo%8Eb!DXinr* z3+5eHeu>M&DhuH!7O4*tREg&#z15v&vL_b9FSEB{2bJP1W9a-WM7IEOg~}K+ zoNwsSj~4@H7aj^ruQv8zOZgLQf%QSZ*u@s zR4%f8D;phUDiLf~f*kiBcDGng@X}l-s)F_2l^~%)c_B7}g^faO0iJtyzGS}gp^;L8 z@X6@}w#MYoaf(Z==0BE(9Q%Nxo$r^+&VB3Mb;iS7Ruhz>KJB5t#+STnwrkeWjjEWe zg{x<*c*H5xW#qK;3%P%N<2&*H^CaR^glMiPd_~i!(m$6+=9`$xqo#@>VVQqKyz8`2 z2gWL#(c_nieafT^WB>^^Y>-Ji>Ql+{K zPuR}zT?q=4MXTS_jZ013p5EnZgZQ0DK{1mK)Igl&ULR>>DfSrN0EX0z8fS?^paJ%5}Pm7|v0?L=f*&eHgScSZ7Is7pJoJ=Ky5YL{Ig*)mO$Ivpcu{zeU zb%>7k^~gxCcEGBMPB3Ec82?DH>$-$he}+2Q*?7Dm1>pe;RdzTD;ZH?U53}O+z!)dX zfiLZL_(8X>f8b4uA+Tmo!j{z#Q{nrNv5|hh%1m-_S)KqQa;<1$xeWmg33ASWmVvW! z1nDv-4YX7~gJwvf#nJcD&Cad7U2@w+VghRv%*gyKw zk?;z15kV4~7I2KxrvANrK{<9kuvsV)RsXAOcWm7`3D+-(-kw#9s+YT#% zKcMGEG8`lbC%-Vkk}0y9B;bIT$08$3To!E7rHH&=zq1R+%4`vnN?!D@>^_oI|7+zd zk9B8?UQpQP83crQP!t>Is<^gQ?|@<;5&{^bGDk@qCsk<>yD{%^bJ1REY^4TPism_;_j~T zhi`%Y>ok`Ca1D&fdIu{!dXT=z6tHLS6k!f#J0xp}7w^zAXNct$t%VnF_XhijPgD&u z>t%H3^(^vbuJUX8G(jM+rUDIlAx515eVty$#KYP0A+N0stbROtZ{JGLYEtHOnH)xW z+hb1+BPaeO3EtRD{iZygaXh$!(94+IlnDXQu5bWi`AbMeB*~r2;6P!n(3SR=3jK)V z7GMExE%O11gI z%3LG|VNb5{R1D4;?4`RkZOTo(A82#EnSk5iE~+e7ohb$10mh#N#-%0KAW=plWbgE9f1`0h(eZ_fq`KOWC#rd`)Z>Z z5e7**UmsEwe(9k4UMb%*7RPL}rkcb5{ApEZ5SR81QM3V5f5Ub0_Hj|RPS6Grvwys*CwxXUOi$kn($Q8J=XlR{*|Edy!*qtM(T z0YjXoyl7tNiV()}_E9spKyjF2>*bN7tE(GTU>9s~mT{+_Qy0l_RCPA5?M*J~ycIJw z+X?7+5xp?V^H}&P~Y? ztF;o>#=VC%MA)jY`)4DDwLw-m)V4>U*3*{nM}$@HMO9H=VNu|29qrA{tx(7AJlY-W}fZp3AHLUmg$(HUdb4(~b~_Dt3B^actCZm&n-u%1Jut|fCShYk4$ z7~E*h4^xBt*oQcm9Xcfxq=L;lv=}ANG~8&(gG-Gk@|vC}%dX+*1=ZX+5Yw11$^+b2 z%7I93H2VSNuX2C2yt8zcpY2gO%_!?1~HoZ!R z754U`{OTQqlKETW*$m(JawCt*!Fkg@`q$6mSUTz}EFr7R;AUd;wl-^~64l#b*5Kmi z0u$DC7h@MWr4yCt?pL}mP^Yk)fF+h}x(aES@0Yt&Hfu3PsUIhvkQ`@B>yqXyWyTu> zcD!tgNjX%Gqby&2EOmX;Awd8S*PCeB-EXi)&79b6$D!<`5Zct^gQfbct8yBVsg!ZG zx(dwbDP^^c#0YqCuOG^10>@>FqS@@=B;b#^pM@4G zDfSlYEx+SP6T=e)*qRPQHuUm-gI?D-f;_BE7!FA7ft{hv8!!Lx*6i5p?TEYKR7H3n z1y`%7^-#An*H=}QI^anbtG%5B+`GXIH!deh%gb@gfFBy|0GsMidGJ|Lp-7mjRP72J zD|4}KH1^0`ASRs*{=s*qr%~%2e-KOLjNsb-7v5P>&>5Ph3l22+UEdjFdF=V{kKkwF zR=&{;?=iJ56maQG{NPD=SCdISz)q73!j&Rx-zHjL1Y4hN2*HhEJxdpIkA_%Es*TVw z7V)subcT8kb3N-ZwQ2jX5-}OeC~nBeH6Le8hA!1i0P>a#t!u|gE!E&UFq#flM^pP=O!J%#U(hbIa4Y3?8xZmHqs`FF_R7|yNVG9!M z?8DCgDQtPQmgIxkhr`w|VLR&7e?Qg>bsSUBZLX4lf|chQf)}-xEjx&FgbJM`Xd@*m zAbvuD*&5Glj>?mFB}pr>-9HU|EMURc%*_ig0P$v(`GDD9EKS6Dc}G}yY`kbPGDm)0`Wv2yKX||Gx*q(Js(6>%QyBH4UsPZiX~tx^AO_8|$wg+T zucWKxdRbo>H?5eHLZu!hUnpY#CS4$*h>q3+EXt5n=Pr?TY?Ys&uf9tn8amFTFdBp1 zd}km*d`m#wnT7&D>2sUcKQ=QnlDcK|eJ@FSSe&Xmkj3uUrdmW^(|OI&WV1bC3bkIA z(KeMKHarooF=G7hrq3d#iI`->J|kjEwcer9%*lRS>HCBt>e{;jKv|ZSw=Y?2p%6_u?&Z>}ef2TAJww(l&T#;jS@wpvI%ZFi_+XQ|#-)cC89 zH}FAMryLq5R&DnaY*BEs{&-gNDX#;Q2h=yv%%yrXuIbF^%+~f=12v%PmIrwZwj(>o z9aCPd&y>&yBk94grtJR6l}X!Yts&iEqHG-rDUz@615nluJ&rU;R6n>lCcWdn#ZmpI z`%cU2gK??BTzPfeog&K2=LL0J*)O*B=S0+~YBOfd1&F>(k+4dq3*+hoC$ue~{q?mG zoeRARtaaysZRRvFfZyS|1t{GI_{R#RUqiK8mbet=7226bx z-fLqFp)hW1C;}6+2*eL817oonl)rP!a=Cj$TOgNSek)Ja4ZK%wq%)i`xTK05%`qsq!zLKE5=7Q#8m)+du$Z=kTGRlb53*u}^)_u$ zCh3TP(yBC1FpUE3#lJ~*N=1-o#ZRZ>#AcNB7Lqgv>=ix>=A;Bps}@u`-9X+lT}Y-d zR^#!}3>cR7rwh%+9>bLqk@Aae%p6U7W=`_N8!zVr^6oUq6u%VHO&czxJk)o4_Qi(B zlAx zn@W(UO!<17evj$RLU~jV5>86kx;Zzgi)h@vW_HbNZgFR)8yz ztN_bzw=54^qCuCh5PT|A;1jCN5P#EeVA4mM2#TFfdhhqyGMTH;-tQ}drl>zf*&|*VMaw-9h)$7waOFWA*wbUV|(J|hvpo(nD_<94xf{n+4I)LsuqVUpiJKLd( zsVA~ZcwzQs{^4vBnG>^T5dfWWNHnc zx|FJx_g#2cX@ISknGzusCNo%O>dasV^}3iDH=H0SOy3-UcD?&PR+UyOa{RQ1zS%Af z*+vUiBZ>)LEkXLtOS>7uv9Nu*O(Fx3YD4W`^K4H7YId0RP8Pj~5^OMAc7)ZhH#g;4 z?hqJJvzS`#Z2COljOMH8H10}z-*E?|ke0q%exSG!Vr66IdKb+|^A+sTrgHv~hU2x4 zQV?%Y7~xo#>C1I(MUyR2*Z)l!^|$9)ssuJ`5M%{}uGNks(+Y_q@8( zQ6OEVxtWlHoldK{8JlbKy}z*#mg~YZzu=J1O~d8*G6V{aLrdGE z#qYLgodJhpISgpMezO6t(Wddn_RAz_dXjHBPbchxJR~%~^2rKD6yN(zM1y2HzLOX` z@I7`@70Ma}RLsSLD`{QkjmiXeSU_;@{yMIs`B2DV=W4FNqr2^XZ>!yQ#0887VB_xhKc9=wyl`A#Ay`)PS*;#K z^71=1PG5}YqU@+c#1umd71}MI;k?4W{(R&5^qalRXHGY>CM~P~R<6R4`A8BKe^@}ZEj4|8QM+H4|pdj}sn4i9%{2FQ#rZ`ueVFR0#I zZ0%u2?-q_xoLKb-0jAOd@}NLU$RA}}nq4?$tr7>e2Y$#r`dAp`0)!Uq_=x@_7S<3C0Q|S;`Gtt$C=LfUGvUOS*&h&~65){%pmvn;v%tik*A=r8SkwqN|IvqsPqO z&}*@BQUt92DtMNgFgZq#bl>jscE5&aQareU=%PFPi}*%Lq(U1HWL2F#3~T@bjyk;9 zVQaB$T(tQ@C~TbIx^saVU248X!YHU3k*6uE}}el3CZrn;Na7X`S32( zU;K2nv0KNKDvJ{8SYBsRhK}j^CkZO~FBuwxt^7TqCM|rRE@>QyT%!<5)R@?S$Xv>n zx4WjDf0}Pw@ag;e(K!BNKaX*{g6sT}x4Voa&ZqVvGMy zz=Tu{kXS%~c3apl#>;>qDT>hxt&jIbX3?OMwC-4l_jU+7PDsNJd)$gNIWze5pIYtz z>d$|Ow_lyb^P(!<3Eb>kbFSdLwbOAj#tExTDY-ZDrB-WA6>n11;R<~nS@>j}p<|DF zAk-_2vNVW_Q#9Gh80AAhr~mSTnI>GJf`L?>fz{hCJwu3u`xBP?FrlHC>H|wZ@SBM_ zf1=)imQS8RfYZ5A>9KFK1aLm0QtMQ?H@%Vk2`+SRGJ~8&$?+w|G*IE_ceYW%k2W_} zQ*wGO+*4wS@I!$opJa;mH;&lf%Ar&kFHut2xrf8rU%$uX3XfxxRw&N!<3kWeo1a`$ z3W_+2Eg&`LP+4QJo2Ug)YyMkzudEYnfj?i%*3iH_q@?aGW$pzjd^gP$JiykhB(q@U z2BPFcF<)nj4>vQU#+DJ&JS7VZhHoCU*wFGvIZ7fFipuFL zE`-?kBX};IvFwbq;XbjsHVuGF^Hl`KrQ%M_nfO&?1w`0Cja(XNc8Fs$49`MfqI4s8 zIVDNgLGBojo^n^vnoz@LN=C@EVKto`CkT5uF*!Gon?S5UPd&IXpdxyqHbCQ2v@6;S zrfP~RXc>Z0KFg-|Mi2_TN6 zkrOmr9y~!zDUb@^Gy+1RDELOqIq$SpEpXjPnxpYo=tA`MmaHSuG?87kVcYCt~E2s za@B8Yv-eC?C*`UmAVv2}1bLjDOxb)K4cPJ+vkI&2x-K^j;9(S(}>V- zPk-Hk#*zF03vR?R$3!(CJp?}>+lZkqS0w`4Fc?~3Z*gQ1hrAF=GiAi_6L^WHP=W<` zxsKl#^A7^jjh)EKLB5I*kOL=L7D!w*Y>~<@+Uc|YLcE4_JXeG}A7t?s=n-;Ba68?J zj!ot>@OE{gK_!U9qF{QFwlXi?2M!vVDNTX8PXqp2eI-##Hi0)<5PEr{>_0-X{a+zp z5-(xB_VPgzUw#ArooxcZ>xYLmw4%nb5N5(_4D2`mv;NL!VXRI$fZLgKpKgSnHz6@A}yq{~#J^n=Ww#c?5 zR~_{qAw&OHNDe+B*XpBebQx~#%FbRIZcS_^V|3#RvXpLkntwNy@(d#pU-)$TTLUzy z3E_(<1cvBHnDjz6!b$Q{Gbms=1Mzu6kX+Sh^|k`bVx0-ATErAs z`P4y6%;-~sQMe_P8xFHzf)wIrWn8a?B0@naC4@svupCq`fnm+%k^C48lmuPi01EO= zZ-mCT_gaP@L~hOqX)}s30EjZqH5-)p`T}>9O-0@F<%&Q^t{hc_Z9=*OF*VaV@Z|mq_^V|;{xWLD-bOMm(l+32+OEbxJc&b9&#-U&6+&CA95`~_ z*Ju_(0u?5%z~h3{4*)M3n?2e5wfppk$qBK^{EMq3+*lRyipN;!&0Zn494C!yP_|}) z^*^I1)r*f|%kCr`7{&39c?J26<6R|Z_hHrPuP|fkq6JO^N z!(vtNn)D*CMMew3a;;i!3YmFndo|fM?#f0Rpz;#7PK!l&EL3JZsrpLEQDOw`ZsGpd zGSz2IBI|sV_B|C63vBmezrnxgS#Y>^vkG%1T^;*g3GervYPYcvB^@4jDA~;cGfr|HGEAnrkVhr<~<6(WDE21L7y7 z!$FBUtD@EwF^^PZ!;3UR^>5!e;9s^YNbJEA@4wZePTBw79{z_d;J=(sOVj{0IS0n0 zjti}8cm}>fp(1u~h%fAH*;;xB`}c&a?f=UO^*=?zN(2trZcN~A^7RD|*c30}b9{oShGyZD~|KmRG@DTPmDm$hEfbb6kle^D_i~9%@yVg`k zx-SHHh8oDKB*BrJhUmFGVQ*(HEw)@V$}HVphfd%BkJs#fj4&2G_!v|Wn>+hPe#7V?o%P*b3Vat!Hw5r7b67Z3+5jC$7&-9Zojmia7Y|*BDA;=w zIDc{v&LUsi|L>vq0Z8)whZ!E5t|8KH4gv1?NsPP(bUG>Wl+>S&MmoWRf`URoTpWC2 zV#2M`jg5ei5FQmZR3sYXj)(U~zed#BEQpW^5I;ZO2MXKDj|D2lx_qSdY&q=YJ0=c9 zjgetrK?k6VZaI+ECd>&sHW0Zd^56fQYGmMH^YR)R5!0EhmCnaCYB4c?h0>+P#rYde zrePWvJe*#Cy8jW}1fwCTtE;aynIlqAQYyz6?+l5h^4^V(jur}r!iY&rb6Y)$HBj9A zN(Un|2Aj4hxCoGb-ev}gRhY9R04AK=&#Oh(gK+wv)F4+@_4-3BpswK}AYQHqJd96B zI{xQuev<4vydxVfcYipMNUy-%kmklhfD=|p(r_&~vlDx`U4SbT+zD5%RKX`D6`i(2 z6C6A;GN~{^AtEFMvfgOoPo>dL>ethQc{Z1dw%cGU!uJh5DQFwA@CX5AWUP!Ei$17U z9I!jt6T`_?X4Td=c#e=TvU(zjNu-hWQt?;)Mv?Z?X~e0MsI;Mg7R#>_boa2+W-4Y# zBJA6rY5~alBH_1kkM~>@gDt|t=)HbtgVX5!TXnEIuR`Rd=Ma~81S8`j+TC@&UGLzW z^j7v@FT}X?q~E}n*U@xz7+QD$WBb8#%VHvN$fFJZ`IF)owKMTcI*s}MK^cdq?v5(K z6-T}Nn4EyF==?f=pT^sTRK}6i6K#l=;4yHT%4C(Db{K1*urKK`FeqzV`~_21mZk%& zHyB4|uwO1$uIkg15V~zyw~_rkp@T*Qetp()t^F>Ktfoo?_zfUk@Yvp*K?f0sg)f2Q zUEITJO)G(IYi3qc<^8LY6?Si@U`eccEk?aVz<6_ zhDeC-pn^Lt-6AS*&^$UMMV;4Iv-+{GcYC9BsF(5Aaz1Uwqr3uL?@@^){RMW~ad*>GrqiHr(_qu=@eezkyGLp^?!1GAJ?eh~+yN`ru%D zQ6VvCuFy6B4JfGevp96}_`=IOI>vzQ4rf83zpdJHcx#ehA}M;vNJwSq@c!G~o~;@U zYweDvn{xJbZhSiyKC^DYp;F>YjMVdg5|&EM=-lcYB$-py#!ukY$B?n;y#!2^bar|^+9yq3X-~qCD^0b4pUIruCItc%2K7^}yus5y*1u_e36Gds2vv$UtWe*X~4 z;&DRD$>>5--iJS$T`KKbY<7o%jTBm0WjzS+?T(dO>3sx;lY9U_9M~nT}0D6JxL~b z`D6401nZ{uX7gwfz{hvt)j5?c;OkOTwY6^%a`iz|%A2|h3|4C$_eV=WJ0_H9y#w&$ zrtbHmkC*adwP8ve5%Z-!<+c@%+ny%fVTd!mi0+>*L5jH)8Xq_dG2N)?=!$khaZvW31x7np3R(r&;|La(YJQ%D=X;_mD7ud`8S{4(EY9 z{=m4jw6N1tGa-9CZfa`j;qe_9dX*ziGT#POiD#+spFC{kAB>&C{$drUP(IPQ1)N!s_f9E>`{s81&j3#RYVp)c1p#1&WJAms?#ZnU0ZjMbfH8!Kr(JrnbVz#MEs)nzHXKtUDJ7b^w!dtH=R$BB24o9{+(b4Ok@f#J894*#C zSCgu8^7jNmlBWX&3G+RIm`XR(gB9AzXl^IXr)cXDg#-IzyG>Y{_Y!e&EAZMHrE=BB z9RrV2NufjehO5_NG1Vj2Rncp8hOh^U8+n?kOfd|gtro|@aFyJ1%F4>v4aqc2gKWZW zj^~(V7F=+=-Cx*TRS$7-c0;W;LWP0WJWW`Zsnr7V&QKgKHxXs`*=thiZd}Y{>urBv zckb~$qS1q9vSmiK$>VP?w?n8s*HK=O@Q6r|wSSLRjHHPhSd9rRZJ{xS<6Rsyi;5jo z%461(I?gpXqB`sVj}fV`FwkS(YNJF?#=>8}za`}*fG!&3TlJQ8Me?lYWvn(eC)RV! z9VEi5%xO9$eMd|fVyHvF5C>! zAHH8Et2p}DDTH;0c{pr;$>aI0n=4vX3OAWr;#jLi5OcN)9&Zm`wP{sUN-H2HK>2u) zHlZ#}+fuC)k+p!qWW9=frD$YS33VZ^YtpMxU)>r-Gui>YxeSV5;*8rAOVyX)tbUtx zd9<+X<`b0W+pl6&Gb`XGfaqlE8GgIM&FCm(j8ZkXHnKe^lmY zbVt2UIJw#Wm3L|mn}V340Fc7K)wQ#x-lf&DdK=r))z!6XyZUq^A{qiDV1fIo`yUKY znObE{?uF;)_|z8L-In95_eItPQS~P-;wPLw18B$Y;oWUAmirkyP1Ll5HI&UR7@wCx zf|1{N8Zm0a;#$@#kTBJ!UMlJKIY!2$enJ7Ij3!}Sj(RgbD;nI@qRt0O&bmbNxAZ72_xJQ*1QIJ?Bu6&$4w zxViut#er6Q=&xg`WA!+Zh2(<`31i}N+rmcyr5rTAVBbu1UxnVFqQmLyj!i9i7!(06 zwTxdy6nNr@W#}*!<5OV^EMMM&iam{wwH;~|hpc$~xIn++bu|uiy>BF7AXUNfhhz6> zWR6F}zl*1FuEW!Ni>D1b8YNelc$)Ftuii}r_1*lH=g5){px5a-oFAngZPAMif~D5) z>*AB%Wsw6d_bQUt#Y}$XfZirec__}MCyZs4fbA7MAm%mSF7d8x^$GS6bIabw znNdr76NeI8R8J(HsL6^68u;AZV0T|F>S`0C7BMRR_LTj=;A_6(!Axqm2Q}wAbgp<* zcnbFdW>=$7zSR&`>Y;8hi^e){MiD0US!*Egm{N{97Q20CrZfkiOBjT7ZBN^IMS9`DwhTOxKUc5Sz`NE6&_-^-4l&_V_Im&;d;%H1;Dapb~J(_ zxQ@!Er&)8LT3@*X<{!P+G0hUC-n-1^urxdtR#flzyQBt$%&tiO zGAgYO*3Qn3Zkbn{f+3v0b7pM*;lx>6j~>xyL1%uNQ|^SAKHv-ub|AgyVf^F?fK8`! z{}zL*T)~Ff5)KnOb2ZSJK5}HR%nK>UlC!mMMI zqzWz|=nSO(>*30IgL7c0i&Jn6)g5txIxdGJFhC$6MI;*gFW|@wW=jc`DBlV%va*)n zBk=s0JprW}6ccnVddpcYwGF^d(I)N^AU9h#vntbEXU^4AV#7&nG!w>&@war2z zFBEQJ!WSVYnl)s@TAJa4gPyQUI(TBlm%Lnc$4}-O_7&K&*hLcKcqb1aE)T2GHI}!y zoe6}3Y~P7z{`$xP4#+f{ zs`EB&83gox{r=#gPkgGv^f4?xpK9LINKDrWT#mrV$-9N=PeC)4tpXBbxCTkj(PMce zqhq$#{1$^64o-Ac_#11+jMUE`kb8SAF;Ar7!Ov(;Ex>?)Bfm|L!68D8O*r7F{HRMq zA+RaLqj1WZU5b>VkMK9Riew;Nn5`ASeen3;55~umksRV1Mg+14+1X@@&u8h+TtY1g z6D~hOf^-oX@;Dh{9lA6Jjo`eOy8WKfUl<%rylG-O`pA*7b7Q++FV>~{p2+Rkt$ORx z+&Tr)E<#fuMfQOAkd+}sY6#(j+hoilw>E>xVpKBD7K(scX^~)HnXvCgP;ZQ;5cM~U zw&n){4_eGl=`_U7ZY#>!U@h2hh#Kw_StJW1G(kKbS$t)(R+3rg35{ zBc6s#3+(Wo1(+?lZBW74uq(8heiS+^Zq3C6 z(C4)9z22}sxGT^b+neS-f(S0s88ExoNA~BJA)Cvr2lvFhRye=fjDJ;r%0@JgW-TDG z63l~FX0A<@D_GMNUx0+38Dy`|*}_-wfG#IfN6-^F*qW_2$r@xW$u!y+Z}-QN>2y!9 znKD2;+g-6X1|RU2Sehyrp|P9#t0R6hH7dOJxXY}PAanl@UZ18=})y?VqV zOOv4scl&Mmn4}BUEoQlL71ul6k&C6Wl7aqhJKi79$u;e_kDm`hclGumc1fA|-@xF@ zqhE1&ts-YsGfS+^r_46ABuz}iWgzNvc3<3&W7eSv=oE%a&lhB7hkt{a!p8M-#+<;qT0nC7t8ARBMEof;_~Ld$LPyHKVn#y6nAN8Q+~AQw@dU49~xR#3Lcb zSgJzkPoV9%aG_q)2cy5~IPeakxK?8HDw!An#<62| zCkah9mpZAkxzqAG?~f1Grj4>XaX2PcLQcEbIC+TQ&AXrz=e!y2(v?S|gfnMo30}^3 zRcz3Hgy<`wtPQvWU7#U8yLduWPRri~V7>&}MTHk17k_+tO^K086k#yuX4e&p3R8y# z!g_ok2tK-o_Q?#G|5Ja}jusukh0Y)lK}yV@#cy)8t%Y~Nr;xB)CUzoy6L9y3Jh=GD zU%K_<3=4gPpZL(FKS6MgPB}|fwUT$mj8I>Mf=)>~!ku6R<`f>5Esja%u^jp&4GON4JH|sbfUS8NQ z7*Q;BRPr(*zK6OBRHaP1k*uvNQ*DzH!sBm-eKkN2tIcjOJ!hUNN0vTso)Sg#9Bs=h z(gjl;w~LDy#vVlzPlFBx`*wLAo}+(I=c=QFr^$=xD=|HU2J4;JR+(~}?LQ!=RBtTC zX0;&MMoptu5%QV*;8#CKEREt!0Q&yXm)S#UvE0Uvk<%HofvG^uAw@;d1~Vw^z%fT5 zD8?`?)o$LO)~SB6^~Zj!(~xJ?>HiA6p+msg5QB$Ca5OVRt8}wi5>NkMA*`su1k1f==upw`z|7*!FfV`BE5E~q_+u^n1*d(**yfK!+ zR;=B|>&`kD4wOq+dkX8Ff#}yzh;FH5iljpFu4oQS8r9=UD*Qq`?arKW)Bz;$ml_m7K}Mbj7Qo{a>l>mN$+bz z!{jd_cO(n>PSmGncYzb#B{L<2=7j#HL=e5N77HztD0a)F=wJYeHRHK z&Bk?rTtzcS=yy$%kY77CRzi?hSYE{z)a#6S@TMoUpu$GTXk%OIOvc8>#pjl(aET3) z#@UMMoBRq?_`9n&>=WhlaJJ&nUxlQO*h8bgYBEO9A zO6DrGg(Up|%5&sWQcFD-OoXBmtrrWwc|0A%2Icr9E{}eBybSM+pj)sOZxj8+ zICA{u)GsAFJW!;6WZ=W+b(2Ng5i#iVM;@^uiMPaw>VfM#=8z}e9b-GCeh1gsv(O$C zD*rr}BfC11LuN7)DFoe5=EPnuFE0M5fwPHZ)iv2FYTe~^!1TK84RywmoU4V}eAZqa zOTkB}Re?tjAk)Zzq#hruvd*qLqgTXVJ%br479jr6N`8z!O)p@UNJZ7>s{4jbT_%(< zR}ab2l|t(NT~QS4KB}EZM)UQ*XH^=?CtqhMm^F6@x4lprU@Rsjbk8bw#b3F4@)fi zD4e}1@SC)hYpS{<=>f69Ea?6!PfWxJQB`&`l$x}+pgiouAT84M+XL~Fm=p;g;B<}4 z`5Zf_wzi+39j}fxvZqcSEwOu2a^f-tigwACXiZOB>|pZr6sjGAUc12i@q$XNVgZv@ z<2$(pIXO2A8Vo`84ik?`f3le1kqjTpn_Zv*_)qzM=1_w5& zw|ftToE_UMJz84KI*2*0v*`SIh6q^P-qj=*);ue5l<;?`8qIJTt(edHU{SVgR(#uE z4+A51kQwz`golm4lIn}eM?PcXLep4AzHS2v+<*(Yr6(!YK*#=Y;P}WY)_Mo;MQu)K zw$xA4?1&-hb9tH*9s;oKq(y)&vHK?st*nRA>aH`QSuqc*-(IBHE zQ8~r+;-Msn&>lF^y9buC2uMLoD+%z8!mC8s>AX4`c3UM0rTtvq0;rpw=K@rM{IGf5~>|}6c33yqt@YU{1Hljq>mFh^ApZyhU`*Qlmc0u!n zMU1pd4ixH4F3CIE+>x_uxtsGZQ}8Rg=d?xkHAG8RUth4uX5KNsFxKU5wS~Un~#y<9Ma#NaR?G>L|6Ssa2dM z-1pVtCg%VL(cXdj_@E}<8c!Zt3Get+DowaJx%j~hzKlIZl8#Q@71uJ${8-G6Y+0h# zvwl6`fP#qf9u0v{CtjcD>!Ov_aZfKo-@3UnvGTqK@f7KQH}33b7UTYO7EI|9EWjP}RVc=Z z6i&-JYB4KD{Sm6@Xy%m-n2kYG(7SCS1rO-E`ShHA))u-%+$@ZdwWObic8g~lzY*$D zna)6O`k#r5X_M`Urge^hf(VeearOr}2MkUHY_PzWAuLTAvw zW+7!J@=FyJ2MJBZg&iUo{Br7kjbnbs-->*JjWFZ63y8_#g*InB5>Do2090ha#S1BQTisYGyUIJ$@aKh@*b3nE-p>cRobG^s6 z7wy?`TDc3K>S~U;ACSP6TQpZ8pOI@gBsSk5jAX$Q60QB{^w&}S8|`4dp>W@ntG?j< zz!Y3IK-zgsi#7U|4Aw8so=lN0vzhkT^Mv8M$0v6EjpAw#85!353Bjh#AsJ&BD++Qg z)s*g6FgxHuk7f1tS>8laF)@3sKydU1dhG|sYLr|M?&KQW{0b2#HinFcc7e-tSfg+r zt2DiCQ01^&f&cQe1&O03B{+|itP}$o@G<5OT zl{^Y6E=zI3U~7tsM{q>8VheKs#zLO_ZV%<8i`D0>1o!CzGxw#qRv^687#CdBp=*$!Ha;g58jSa+l1Iz z&LNwPuAx$O^oFDjs!@;&%3#3Ng9-}=B{9Tk;v^$3QEH1xOQ9LVTLxvM95>G>qBpLW zV6hFDGS|!G$oP?A&9}~F2tiq&tcc#U6x$TxQcx$374SgQhDWKtg0y}pLlUBz3=B9b zAG$s#4%tZ(V7_~lli3Gtj#bodcHdJ|G)Iz$-%E*sRz$TFH_9#K8jAoLQ_7L`T`#Fn zWRO(oFtlhyWlJQI)pc;ySUU%)7zAaN~RllA2JE0WrTG~LZewiTN4 zN$O^_d-Tpn%91DllV}jFsXJeJ0QJ4)sp(t`(Eh8fhBCexq%n-C-k|7*`uq=D@j3Ql z@+PtFC1pwc`<=$eA6WJS83`om%z#XMRDGlo5p1=&QgbBxIyVslcQdWZvC`|liTwmB2C0Qn`souU9rg`RYaMI$N*Wz7*zEgK_9}QjLlp` zCM>Pve(Ccu-QEy9#nOO0o;=RdWrK;QlyMitHUrK7938VHXU)yZVVKAc@O!qxIQ&?eaw88bF)_v4IJg#R7qRSO7UTF1*iK&*fC>lMw zn~}>_-FF+kFb(;sc2?fs)yjD8XmF!fEt^8HPo_*HRx7ni5%Rk4BsH@*Jvob9m2z$g zt0ChU^c`0V8)EYU-^XsV`%CaemL&U(x8bId z$oSJ~E%64P85S%tGa|Ha3Nz6gV%eV{{3iL)qO&3d_ekBhIP4{Uf&$ zoaMU5Ybn~}3GN!I@=(k|eSk2}mYq0H&O)P4T^Hdol19mDg8p;RJMQ3bg?$Bz9&rB5 z0O&6W(J_M2k+une;GJYqsZ+~8kvhr@0+yQKrM0=|Vf`SFmDBog$TCAiSo+~D6dPb| zPA)hcDr2zU?RM`X=Z{$|8B^wmfePK@RI1%@QR(y{N(%YLPWcRV4+No>_ptq=R@A~2 zv$_eJluFLOgc=zxKthKd)(Hi0_r9$ZjYc3kkic~+9K<;=&1;oF+1~W8Q_nNqb-+N% zW(BP`Dvqz-D`oIoW0_({E1L?*bD?L1?D)qF2kZ?U`}+_({h9-1c?ln*oPVlEOo{QK zR+E3#_0_nLCMx>Lj6F8CP#Grs%@kgiIjq$5O0Ubp;%s?5s}R)63sTAp;OpPuYkZl_ zvb=Va{zqTh%VVH_V`-Z--mBII#32Ay+9i5V;JT12l( zv(Ymq>LudvW1sj`*b7Shr-N{?@{+0AQ~V3m_uQO}9!eC+J^FbqwoMcx0qX3J%3w14 z_$!RWg30EmkHwOmF{Z!|nm{B^UeWB(VKon`&_^}tq{p;F$~gt>Od9s$7_7PMsSpVs zv+gTN*dp>+6WE(9MJ8sgO=@uRRoYs@29?fMp30^y;h?)sU&olFj%*y*M-~)fj8Ulx ziG*2R>1yOSDNTS9=8MlgsB;CTDkia@pVlZE!&w26mM8plp!WP z@S&rltD=133yAB7YwP72DY?rxnipd@^e}23lB3Nh_)(%* zHNA6PI&4DS)^tkT=@($f1O)ZTCEJGu+Qe8`#m+Zda`4+qsuvf7s?s>=4UsAEmeR{3 zic?*RG~8;PJn>)#I6v3JbPVe}h;T+h28yEC4Mf5)flyre3k%+~lvc}l>5n!FVHx`y zpF)n}=J@(Ut{Y5j5zW$#JptEz}xT^^mavV4p_hVw;@lJa8go4-8zhoNPBK{EuE4fw}id%*u- zg8)sTKcT3wk~}k*g9L2x@hrR&t2dOB7B^u0MMEz0r|&=O z2VRN^n(O-B(obwvG6;yYzBuIO1FHp$aYI3g|G*uHP=UN8R5aS6t@JJB8M;jrT8zr0_%+eRmPxc(EZxk@ms!jqm}o2K9g0c@+=+rUSYtP=S{}0PZIY z%2IEf*0sSC5B17-$NQB0e|Gzi;iR`! zK7E4!i0PBWr&X8;2!j1PVOdKc6nAwo?dApL0z7x8*nGs&GCC|Y<=;h{(UXphERR4M ziV`vg1TOwi7Ow6hQ{hkl+crQb64JiVvnSllE7lMV22*%B82_(!{99FgY(cf>_(TO$ zfr*KVyvLZdga+BnN5lUSM8kj2NAQAX*2qamm!qFrvt+;fUyAy9B%v`e%_v8tGPFqNkon+H zGa@e>6)u(=*It8pmqlSo7XSk@W%*2kWOAj1sP|(e>dIF6RR2;x;psg z+u)uK$f3_)^{!`HR?q^6#iC%Qg8h!?mN9=11@jNIJ0Urd0th44>8RD-^~?uiN@?84 z$whJe@3~9gJ=U8O6L1PFA`LfAtapj~f-6cSWI*PZ8#bjmK|AB%ss;V|+S$!wWZi2d z5jO=S%}lCILt4KMFYJIBDsEmUQ>jk=OT7DYj)89Ifeoyl@ePEb8+#4Jqly1Z+0}=H zpnO(9pmcTNfy<(SZhN-37f`Tw&LfkeY~IoUmQ&5=4hGx$=*l!TS9EnU_GILj3=V`^4LJsrL?Uty;hvjW6BUrl5`WA0`3Emg(x@pmDB0`!mB^~hWE(V9 zhz=YtF@-4|?q;<5q3aV8#3FFsr>g9%hn)8d>|<2SQVom|*d=sduV-{-tc; z>9uzCsR^>F-paKRxBf2HNeu<5-qaLotQodq!6L%5y{5DS^l)YF+f&oC=>*m~)d5Wq=ur`y1#_g7&}_f0Eyo z{m49(j0BCAL9h62MEgDH<$J=&&L@6jth>SIGVp_Gp7Tu3t2}4?eqgo2px4X4Vl!Tj zM9*5T_Jhm(EX?mZZ!@?pd52>0W6#Un617#(X zepRYdCnnsL!WXE0Pe>?OO9K#wbMYALqu^p9sZ~&2Yu!Ip1+z;|U_vi1eq>*#^s4(u8uD){{ zu+MV6FSAVOcfm||F;z}eKWuTS%eY5q7g2!SX{hl{Aiv#VS*ck;UE0yswb?fTkRq}U ziSW7_p-^Z#sj7zh$B!JC1v!bZMi5Y%?Gb+J#*6nK(kD!x5@e-JM1v`~axqk&1pBy3 z^f$fPlkH>nPUW%BSPdCjnu~7p+2k=}ACaETR>+B%CXnw=jV2$@w~-68rizY#OLh1& zy=lSZm(9ScMx>1~7N_-CHPfN@^(kXr6k=Mt1I0^>gS{u z8h(!HO4DneYV*7Ql4vBwyyDX`hs9z63FwlW=mvo`@k>6(6FAL_>M-eekj3&(ZeG;K zf);PJb&RaYK!<5v@dka`gi0@y3Ka$$+=VZsKjA{9#mCdBxBcCqmhccnlGW*zM&2k+ z(HY{=7+u`=X0_y$TBexxtCqm&an!}PD-f@2xgb#H^xp9B#}7oCgCi~GyZBC1$0F=p zZ%q!lg#rMRl;-uew*GjYxtNou>ViwMJp(TgGqw}-3pPujB{@acM=uBoO88vN|8uE6 zQWOk)zn^Dzc)`HpJ{0v+Fvrto0WC7OPt9Y`*ZwM(B0#`N7kPwh-_PYQmEobg zqSr>HZ^Qp26&23&fPNw15g;@CxM$_S#)d<0hqo4N-AuUsP-LE;BH?x4G;soBJ3^}4 z>V}|T5K`toBCt{_K66gX<@1ERG?gD~mi@3ZlgR3Uf*&_|tG=z3f)hV|*&EaP8#zfF zw9C;4|BzureyD@2DuV@o?U8V3wkX_je?lze9j>p0!vk}Oer{CeqhL1QMSAXp+~cRm z*TN}%SvU3Xzz%-|9+$IWCm448FrLlb zR0|$2cigC3Mcbk40^y6@ByjrqgFaZ>2k)87e_};KEFsT8oS_kv0?_$F^t~AXHiNlzvWW zgcDsFs$^=`Ag40b#!9yd)?ytZ{VL{TnP&jfnTmfNZa-M1|6IJs%Bvf$JwFYGcDmOa zrljdxh8Scw6w0APJHt*{ zUrt(+RAi@~%e5ZqMq)#J#`^2s=_cHy6L#UMy%@^89eD~3b5_JvSv;AQe<>adIIj;m zzJ;*?&Nw2YaCVed@fJaEv(n+VQir4sWc%-Q$MIjd!M`2^lXu-L=E~^+rOC(?+%f}V z69Mf0)uQtxc6XhSdAj=X))J3jx*J2(t3?kBW9yCg*jl1O;p)ua>F;Rt<7&!r zoE~d5n;od=1}_pOu^J!Izv1(TZ_#>1&|gLRM^=>ayFw?)?+Emd zyPrP|2If?VH~}{^p@&K&^>9O}HUfWXB2VxZ9nB~WAUD12(X#4a3SJsH*p+&VY=v7b>+p#M=rGyowx#uut7+pU2kZNkP!zxEJ*T1%+ zWY>oEN}~sAqG3LnChfhPe`Ru|jeaQB%`96^8S&UY zsYt;;l+})OI``@&-)B-cs27d@Cbm^I{PE04{4svubgEz=c7j}u9yRD};p8g(A&kjX zWvg@JgBMLNhNfz<3k z2Lx38@SA@j|<7epkmLW+pQ;m$j&l;Am?ePueRHG{FWiYHr zEVGbnwgt39dSSQ^-M=*Db(T@PwU})5b7EV~h9Z_-W~}@+7S-55^AaBwuVy|frWyCB9;po?}r+x}sqm6z!#K0bj#VuleEuh>LDUGTBJ7V#{5s29vD9Pdy zQZh$)Yn}*<0}sOU?ASRq4nGn?3RF<$ZDgut0q4#-TBOD=M46@0e9Qs)tq+UE^G$(+ z)34lhno87*g-!lpW+hEHxWbcIHAcIMcIQ{4ZA+aue~^KWp>S;y;n@C$?-(|B)pFvT1|e9O#QL_Nh4&bw0_OA@!s zu;0bj?_rLe@4k-kRvKTt(`19U`rj1E2ZYE8KFG!ghA5OJ@6l{{(ZY$*pori45P4O; z4b)DKZ9llFyd`m>P1)o`P))aCX);4`Oyb4$H*Xjv13>1_nr5miaKE`f<3~=08%x@v ziz}>#4j=gLTvJOYEl^cJhvt@$xzfeJxrdrGYw}w0Kt$44^b8136CY4XLBjaFAXCQU zf2Iq69og`JmQI$m%$dcf=Sdw*9NcrfaRi)tmoh5CUQ$7a7PmJAzujQ<(R zr?v0YSXdm@mo6WfFI9-sig7qPkQp)H@4cmrzYZ#t4!RiZjSl&6L6ghC;FB#XeV{Zi zl8p(S7=X*=NgKQv#dnaH#Rr4Z7%pUXc4RH5i)t&W`p8N$Gu9*{5hmC>?lPI_xC(bY zh_g65i^7+nVxiK2zTovlj5lW-O?FQ=ojavIdY3d9z~z+`D#JcBAYYf(b-IA73wL=kyd7vrKkG zshpWY9v@OeMdb9zrR3hd((L9X8x#YM4LR^8LGyq>IbsaXIc@Bc!dOYE1Si$; znxR#m&?Ow1gvs@87LJQqN(j~K?V4{!#={c@J(e06l}l(B1$$FwUxu1mzEmb*kms#m zSmCfI!^n#e`;aP0-4)rtx+{6E zE%dwNjq?kt{;h7bICik&{5EBtN`Q9<;O8fBi34R{dz8pLTPipqO^{;28%)Kr0J2O5 zaU4|F+q{rHiLDU(yPcf-O{M zAh_2O^pftLo|ZSqsFVn#l~@0qTCgk39vwt)bxJ53=s}eK2CIxQpN^z92A;vA{@J2? za;CxCnRnd{?~uF05Yr#KeG0sAy%u2Wbi|P-5D~1v;n?ZdDC!JMN-A$wnsfcdXd7^> zh;2w}wij~pJ8iFAfwu9zf#d-K8x>5G)qP*5ANDReWu9_ z zhYdjMuHE8cXJJtI&cdvY9M$jinW#RvB#bRW+V{)jRD4Us`N6{Ci#p_6dAU&8YXDY}sywsE} zy8q|k?G@D+^rDY|*bL^qe4JRu+>n2v| zwYuI@@LYzEf7ep{JT)z<%X9W>&G@>~C+UrE)Hol5K@d={=z?eYBE%M|o@peU&$80& zMPE~auh{bkDz)s`SUO6=>kGeowt7oOLdIDUQNP4y+DhFvYLt6T967r1Y?lQJ8&GN? zxE)F4&E6A5^4h&2ep6_aWHdKXmsrY=cBZWXpGW<^cVln7em?~P(Y6AN*aazT8U8>U zGjz1Ukt%C3WtZ06NL`d&lmJVD6EC&;5mu2tq*4W4>}Nb1g-5k`i@qp6$kqd?lD88< zO1W|Lj;$qw^Z=hM4i}Cs2VZ|c)|7+$57E1vWKAw_gsf(pI0n{XL;1w1^501TVG#IN zFNgeh`UC;DoYQ@)vk2`+ZXznI2&V_r5zCkwDlnnjsX`Noo~)5w`7R&4>I?=l+72Wa zxw>*dp_SPE;;RboH$S^+;Q;pafo7WA2YTk=qo1BV}jH$U3u)iBtL;sx@k2bjt*ekF;rMRrx{HBFg?XGCW*M7Qdx7v}+xH4b83_;h)PIOn#~cyp{VfAHi_U_bHI6 z8=*KN9coe$QqrOH&Nd-1i(fxO{%z#>GpIK+xEXaG5T*orC40|E|AVLaNPrIA;T^9c zRHo4lx9HmsEKt5-^x2%=s#Cg0YzeQZeuqzJ_3*30Zv)k`Y7R~{>R<@T zey|qB;^gaBBU7;&@i3PJosw8f*Ubk#z}@b9Tg>=qM%N$K2HG|!T`?R6sg0ZOb&xYd zmvK`Z{%rBIz+=!G4b+6?rdAt;WO>DlX!-f&s~x&%HBYzkufA4~L(|ypW4cB~S#{ku znfc9R2nsV{P%&0XdLdM;pm`ot{x~tPPgldmP|`6n8b}4t6MeX2RXF(2I54;W?KIjd zGv07>A6rpO9B4D_$JE{(qYgDcYGcKsOL0=fJ(rXAP?@H_h-$RmhMJ>DnGaftN%#3Z zMB70W`oc#}X-=$8UgY+BoM{@?ot2z~z{SPeHHo2>@haZX-iV$J|@FkJ}$09F+X>5oTb`_Rk;>#Q@}5Hgq|s9 z+R@9zoJJH)jvq)I0+VqNtYJMo4umf;8KIO$QdbpMa6cfo29kN%ncAK4a}2l$;0#8T zHW?6qyXBHp3aU3=2!M8{jucKK`011y?fw9pOY+a;r8Qb;@k3^Ld=A}Xx&TsR#GQkg zw`DF8KQeV#TerAv1T&!9l-$-SicD~+ za%Y%v7qMR|+cH+#2_9+*Lvt}>6qjf*#+UL#*D2uIVlpDyx-yg2s`|FpzL_i(@=4C& z^wsy&W(WZJT>bQ5+gb=jhHFF>tKgq2*#et;m2%)72CJw$9gHl|CU|sEveSMlESm0t zGP}QFon66&q-G1(XHpzZ68`IY#D|79lA{BYS+XEiQ7PBo>f295 zE4Z@>Guo(>8Q<&fR=7vDrchuB@X>}5;ATKA7zl@cPmFc{U#hG0KchV zU(3=6WXYIXSf#1QTccHZk_Gpc2f6Gdy-_g{583MQ;DE3QZSWZNkKTclT|reCw%SmN zXxywGUe8?{&}zp@X13tW#Gnux?YZ=r)NdH-$V!sZV=6L0TX83BYTRokCgRYf({#aG zS%j0XwtoghA*WloMoom&hzEl^SlN1YeKb_?5$Gla9QZ8bV5un!2{0P50@6}qMU%v2 zkKfHJios!DIhL9pec6FscP9}n$SrCg37a$>3by4uW zzc~)~Kd`P33dnd2!N|K^@fGI5GdE?!+%AJ*SjR*HWPWl}5{tEf__=g5S7c{bzV%q+gyEbSoUPt^Z;QSBhl8ONK z`Ufnw-0lm{<@M8tHQ92+-(dN`O9jCyTp?#($?I)&vaXNCZJfV=jh_iPSRn5qh?%mo z3`hST&^HbISS+g8BZ5=DtjqO9CvDi1^`CL~f5YRSu1LpcVQgI#x60(oFFfk<|CHM*Mzcx;U0PGYXil?U$6@^{Yig9<+*f3O3zQ+eWZQV>i?QLM<_ zN*z7P{MD$G(UB7C`Oi*$L$BQasu-U=4dg-Xf5R%PF5*%ZbEbFKA9M=bU2A_<+q(Z% z_MgI2LG{ql@E|Rap7^auaRmqNKbF@U`|Ypn-%1e7@}SY9{xyB&;nVNsxb#>4eEl_`}(;& zyu5ov2?FJ0FbvlMqeqmBscZn$;WwCObaA#?LHFKMf@YV2HrNxJrl@}Cv~hev3ULz= zZ?DkbYJNqilueOtjzFyH*>3VaQ2r@_ZwzaVkfZwA0NBTe@v#Y#Ay?mND{Z?kvY zcit$>_Nh~D=_%@0ejHHcIM4CX z!wrpv$~bOcF+V|wl9Xx4XN+cU`9}+)GT>{+AK*TcF7!Zb+I`=foX7R9Gacm6^(7Yh zvu?+B!U7KWCnpYVIVfRc846<^Q@LGOm&&b5E6O&Up@&3=pG&Lj`AdwK3p}p<0I5M5 zyoZkkEr#7{Xfh>(P$D%h%U8|f!`o#4XwTztK6BEYRMw)n5Dpl>_9Np(b>^Y`o>)w) z{qa<6zpv(fjAXbS4X|!BIV)`-?k2L^JH{W$XtK6`Uehv`_I<22{2p-JQkw~t`Gzn1 z5L~V=WN-SQ5S>2+|Df@au{TC7uEKGGn3#v~cLlr*cHAeA`;)+a_dWdB&8A^M9$$JX z^2`pqGWhJcU=mOV<&KPs8-6b1Ml2CK~Er z!Tz#8O;F;_E(6W^1xb|4wtLSXDv{=;5V0@ef{)p24g2I+ZoG`7hnO%bjV?Cm`3Koi z58>_(OS3!oU7pho0+t_cSzm=D!rSJpyQyD2r0>#G??ESaUFKnE+&kA3R)z%k2j59%SdiwI#CaCdde&HHW2*qk2 z>J?n(?hl;6@`6guADpP~?aMt=0{+7XqT87twxZN~b;f^;Qta1ZrG~|gH#*Z-cw1=u z;2OmSWt*7|Z@yXlv1aNj;9Hij?nf6RcBwQCnhh=`iWASS2%=l%GGoCKlJQXGmr4mg)M9 zrHUIUoYyy~)LzUOy`}r--JU2k6ZcOJAGE|_%y4O$r(#MB9HX6He{LCUBR(HY zTs)`o+XGdKLvvq=%(7B@8Y2sa9pvhyjK@%x#2AFjy=6e_`wh^%871Pr0$#_9POsbL za~?ck?W-f6O+{lsdM2~wuN@COf=D`XM=myV=p{UIxtwIt?SWm82)eIWX3m||?>JOd zJNs!6X&6g&^_;zxEt*&v=^|e*HCDWNK^O@Q0*#jNm^hg|#(#X=26c8>qcVJZfV-UTDg%p1V67z{dh;ri zJVU63BV8NH`s&>bOdBwBlF;ZKE0}%+S}#q^VcE;~g6>E~GBs95vQRWTUL!i(CK3Kf zy9=z((R1*!u@_(zAv6#(v;Zs&xmj>~FgZ~-CYgOKwHlh<{TLpXL9RS+`gbn?+*y-T zM6wgsCoKVXR7@ikqxP}KQ!s5gJpEAe!odu3O|>I*NCqU)i?&!LigXbD@U9^HYK9dK zAWmuQ7EEhB%H5P%=F?4s^^_%pw(x|tD23T@q3>(r>n7-pUj|SqdZ><%3l#r>vUhfy z9keF5H}VVEU8Wy$untF0MytQ!M%sIXLh|(V3;WfXFk2pW(C!e5hsz}k1HWf#P~XZG z_n)&3nDbwaLw~NKG}oFy3r!lSwi?(O2(-gCa1{!_En-M2)2K{6XLb(=@Ws67ArW_{ zVlWaI3_E@tjc67SRA9ITw>IJ4m`=l%NFyM$hUZi?4No2PU(2*dmcRR;UGPV|WX`@* zuGPrK4E(m>hOFWVL3BG}Hn*peX19;(sKE&d6EBb+R$7^vgxD+13+Nj__L`j{inV#l z2fxjXjf#a9>(FDa;_1Ro{7ShyVXf0>uYnW@r(^U74mU%BPpBtUqy;kzdtUuaY?`9m zXr|mtv+;G#Jne3a_wBMNm}#dRWgU&w;d1H!k@bz?b#BeyjT$G7ZM(72*tTukY@9S{ z8ndx&+fEwW){gz|9{rzl-jDm*H`dIWHTcckGn}i$L>fuPpV``C-pYY7erck6sulQK zSq8y$wP?|N1*j{*TC@@5d9H6bK)z(DkS;m@zU`)L3a;OgqiceS0><4Whfx=d6)&xR zj`B2P8N%jiGVnQE1}Yp?%WvDb>&Iy4^PJiMpJ3$#$)`(VC`3K-uKqdfYB_>!6-6F& z1bqLqB;C#79~f2R$009#>xb)8m;84VU;-t_$2;#SOA|9*V&D)UBB1J3;K0U)mQf>SQPb+x1`OZ(kd4$(Sq(){ zSy|9P(B!ECL8%D|XI2y&7mlto-ZMN}d(ThLPity}c`-~6#=Y*>0A6?Lt4&%ir58@aMLqtFFGogB-tcC(U9E06UCe}l?-TM^J-ooP zED&hq%7fZHeE{(zxa9#jHV~J01>Bvb5*l5TSDT`4Zduv&#=*B%anhmKJm2&VziJxI zr0b~P-l95VEkYJ^H7R>Dl%>C-p5wo>IyPDdmr8imStEB9Y_R3tF1`1q-ABi7yr3?o zHi&V*+dT}@Ef^kk2##g7K^4NEt7wZFtsnXf$Rt1Piq~0YetqaeH=ib@3M1JR^Yz8x zxw->yw}%nd@(p#Y?iaIX^;x43^-l+hCCrkFhO5*du2b-OX$F8kJGX*T3BB8)_<3mK{9c$-a!G?VIp1X<_TujkKY+ zdJTrrW0_|W@)gZZ&mDZ;`xasb_w}mKsm0)}P^pT<;S+wF4fxZGEmVzfasa~u=zUBx z-kFPV*~3WvDYc;1yyA=9I@ilvYN)-b90OkpBLN;{R#=A)_fM+>1oM?E`*f}%{t$_( zi<@wi?@Okb=gsH1VFyCFa#s@L)4=v43f|m5WeRmU&KEQLrMHpOa&%%q%#$<)sp+es zTkdcoNW5IcDt|EaP3tJe&Pa=1d%0NNgm8Fyqx9AoEyx1PnQ&ye&M8ly9S~Ga>${M2 zw6H6vWKwhdver3HlZ}uTU+DOrO;K!duQ@(Co1Y@)Z?BxkE{R*r!M~=S_kFd1oj!?S z-x>MQsy}>_a#=?Zg;dDadoXK8)Hs^b^j=wL*j3zH<#?>6esCVlZHFJOcr_ae_v6?( z@8o;XrVcj-bBA1Sf*ViNM*V14-_hvj%U>wdwMt&j=aiM1uZ#~xZ@r5E7lw z%(fl&=GBD)F2}se6B3p)lD_Blq`{r7#ERpwh<)X za6-<@H4VE`lD3NG5%TJe=)kD4wRQJBI4?h2C%;q8Y`5lkX*pEZbN1PklRe>0!?%ax z#ne3#7!4PEIQOt;;VMl0OdsL{Wfu=k&tHvb{ib&SUgP9szwz#xBNO_@(NGAPr0ac0 z6!oRG06g9wSsqkU0Gbkn>?e4<04?;?)AiUW0q8ieUkCfn=c{k9n9qU-P%g1yWbSlY ze_i(1JuJGQIaWjO118rNZE9Lx75{$NahN}N`S6%|iTf`k-*VOe+=>lqs!G#3rl>!A zevha=ij|Kd_ngC3cFc!wFdRk$LxtioCxqZt!cju0MWXhKOf4?POKm>eyds`nx zC$MK_tnTnTmfZew4|h@L%S*nQ%~O$QXssB&ZyN>$5ZDd(<_{*VoFfvng8<+WC4M; zg0hEiOdObZTVb%&_}!mknKYb3|96M}BtsNxk?0FS>VNN-2W2GDpTGKfksxG)&lpq& zLGy2>ipmH$!>83dHV?S59BX~yuKYKZhEiShjQECk{@6T*qZ(3b|7KovivJ-Fc^Apg z2r;7$__~XKgyxSW5jKF6R%i!~YJ^(iSCf_J|M$((U9$Z`KmI>T2ou5k`X$j~)IsNK z{>#HppoUla-k}5Thim`c4xpSC^^+tz*IWO0r{F+Tcy2`hN2LE;-9EVTRT!sX`QL*6 z*LJZug8Ei|OkxLU3A6&4AwWX-2?~7k${qWQTz%wk0s{tQe)_(zLw+*bLB_8)zqdC% z?b>xC-|3rn+qM_G+<&l{XjNZ%Le*v|GTU>Dbc5ARZTd)3`9QKvs*>sR8i$o!Z4V#2 zh+nAZ%lXYBE2^hX1oM3h@v;Z8b23J?J!I>ho)cQ4Rc$jUSj&DrA0wMA=zNVc`DJ8~ z<7nS%ii&YUd4HLg;9UnfCXJp82|8{tsTx|zl)kH2?F}B!^1IOa1t&jV2lG3`BDr<^7ndw^{(y%ssrVS()l@2a>LO&0=NO)Lw0A)iPd=Asw!;HqSiG zB>4tZGOujPnITp@FeY?jPqqQ*CYp|^;ZD_i3B#AKPBmUGlj=Wnmik+t?|CIHN9Rf$zb5y;k z3TeJNO<>qe>~FR2g~l^}e;m?XfuC%vhLt103Ej=6*kMq6!-96)O@AAAm@t_%*g;z$ zV&znD{~GZcV z@24lF6oEpc-%4uq3ap$n&r{w3ZY)o-O&?iM48eYX!_ znVy$0#d^P04tzqFf*2k|2Ld@6Dd{F~wp}lX2pkqupLZsk%`(XI=(GKHI0Z2?GYTHJ zD=mYR^xeuSbd{S-e{$O3W)1{Hu2T)(aIr*{@A+(^T)&_0JMP=OkHg?=u7fb_Tf_cV zMkqnwy+`q3vmHumJr|q#*^qXS7``8t79h@H1%*Lhe&v!Ja{S1047>T6X2W1lBriLyswDU%$lgIZKq^z6R~Ox<88Osy`0>3*P2r zcinqO*kqE8$RLQ>W+u02PH^2uN(1=2`zidxGG4eW6(6p{8*fvU9!~@P+o#EPW{fvg zp{r9RcJLE8)jU6-8ZROPt>emanb&~S(Gq%Vk14q(rh$A7%^A^AN&y8nwejZh;;3le zrB81^r|VOiX_Qjxi?-aQ>Yd(ZsN6ixy)*hHv9`JKsSEh^$Y3l^XOGwg@3*%8NvU<$ zf$^jAl~5zYt*p!K@?OT{Qw8%C0y&sVD|boS3K7=+ocs&FfhpU7=b!w>M^ z`MvEA#8+Ppx!XKlAfqrnVLtNm!WQOL4ALd7f5VY&K`f;6L-MJ3LH)u1#?IF1h9kN< z4PL9)_R|u6diA$H#sS^%xyNI(UX;&%TsyhluA7w=ioxd{scQxHfJ3_1!UFam|FyD9 zCs-@B(R}gYJJu4#dYeD+tz~@+h*zTdsmsCUgQa0`PJoRx%*28_vP^c zv%T-K@=LZKd(_K9TGMMPiT!YK(sq>#&6L{?N4n2}VjI_%!s+879~`F#N`uckp=p#4 z$olm~kCU2SK+iDyb_*i1$khXmuFr{{IKS1Gd>8>iMHuqcWo&}Nwg`t@uI;DD3PHot zM-K7}6Y1A_)`6F6OKGo7>z55Fo6pw+^i8{`NQaO23ye9}rco_7zS_R4K^)`!_+W1j z2;|a!AV;&JJLzd@+oft^sUY>9UUKHW@m)mXguJ|XSw44IWB!7iuen+_t*&SG6PyRa zW7C^{7bJHjzhrUf@Lgh84W0SUPebkZwg$KKQ2Yk4pu+)#j)Yc^_lu`5U>$8cpi?W4 zdtx2^P4{NR2JeommoZ{j2eq;wvToZUR0KUKjX1S>%Ml7z^n+VEE1NB)E8AxfX_Baj zm5^*6`kW7aR2kdb3LMWe+P+6H952C(ZLBzMG0z0c?q- zjZjv4#Ys0kx|8n#`QzPj=)4~{WT)3XcNAYWn01EOR>5@$NW~qdXD=v^_eK37NkPO3 zB0+e@qs1a%&WqzhPj9PdrxolqYoP49qGycPEu#L(eARh}67F;wZlZJT>lpoee*?E% zSIjlwa*9-QNlKBhhZ)RqO{<>wWAn)ZG4HLn_se*p_~|NgxsTdTU6yV)N(@iPX-0~= zM>5JIjT*`5Gvv$l9g=yF_RA4qVKeMrf7)u+VgIagYu5;puy{|;VU)GDx?G>sbHPZb z?rVfCRe(^az-S_!!!TKr@`KjoIu|aI@yw?Xp{@H401b8L`+ynMSV9rthb3{S+BSFG z)zG5fR?&`a$i**b(wlmcjTFer_ErThb*X3cV#?KOtmkWM^MyQbRx8f% zHpyJQl9$u!b1u#R0y6Rq9x^z}C$mB@!C+iysIcB@T&7{uNFjkTiYUx}C5q8*OlirVyKn3Y>#mp%Ad2E=;h!tbH+dcTVw>?2QBOmRK|15W`V!mchrdU`qxfv9ii26)n7_a>%>pUoyURTSA8&#vNfqhIwhN5?fGq+s}R zY%cfndVw>ejm}$@Om8l8mRuTtDqVw_VL)?a9D1&UalD*gf4*HIm6mG7Wk9qD9L7g_ z-n-}G9gI#OXpczi%<%VrvEAT!Vd;Z#MSD;7;?;eelL^!rDP;C{4-Yq4g;krEWw}6w zQJ1p`$%{AMHEA8o{V`8nkjK_*KkBit*@3v;59l^TWAqC0dqA!3#wze!EOzRma^Usz z_2$%+^@C*AYeJv(wGM{PlIx4Pc!9UG>%>&j^?>0nIM@u#0;6=q=(4*AAw<6uTQ+kW zuAPqD@bx6Pw@!htocxCK#cVk$J2z(glMuw?>csF^z%@IRC|<+@VJWal5>6qYo_Cw%erFSh$4acEAV2w#Sd$ z=UX}`1rs}ckI;f%U^G*uxONw!S8c=LOu10?O!w@z=Y0^b4Q$7wXDPVXzQJt{B4gof z$|1fUz+dXrm3nz1GeX45RXkJB`}z!H5yOw`SjXkFKxk72(9HzG`559UJj(Ht(R(<`W)1YQIC&36}nGt5XI5A0C zz8^5MoItqxWzng~^KpRO>I?Z01cAjf0jcOw3H0w!C*@UI(0I(|X;U6@()*0Ylr*rp zoGIU44)_<2qg2UkVEFXEy+3z4_)a9L*NcFTi!@#M^h7_Ll~XNh?e?!HY#6O4Epgnh z{+MEKra~XrrYUT#ww<)aioeR$$f}(lUPp6#xfW^T^~JSK+yMCE^?pnxbrS%Pv0KEH z+MR{)>p2j-y$tO!;e=`7+kvQtqD&r#pbOFW`E7VYPVxahym>z9llDuk1dcP0o9Ld9 zBm@a~Q-AwzHWk-cKs0*Ro7k*pI9p+gxm?&REvG#rRox9sKJt``y;oytK;(QszH{3p8E?a>I>UNTF(y|VMd}?Vv|RfOxvtN--oq#sz+2I3 z5ai`H2)PIz6psGD&cmbgdj9QqfAE!bp`H7V)pIm%*twR{gvk?8t~>NW#dPkcEROqi z#Mn$VD6K-JtA}L%t+wv==@uX4RKz!&{g-BV#f*ES%N4T`4;27P8`o4YG~ebIv>;A$JYy%dvt z3}9S6<5=UeJywXiQKN5D7?XErgzWMt-k%R5!3xe~ES;#|?$0GS8sDc6rwYkjy*#%v ziU~#@)M4Hn9~m(nx&_)+tErf{GeQ_9&m;2a-8QGQ54Nk`Zv-bN(yFK(*cDq}2nITM zaVhF9z6AuehD8c|2m*D5YkSmSP-Us&%NFB0R-`!P=Abrhd?< z4{~eQ_c{P_45OS$ILs8Vr`~7%E`J!GSQ?tbl0jbC$My*~2)RhR$mh&AicJ13EYu0=WaTnCB7m7l|D(Thf>#SUd0Rp)`stb6*?kBq`K-rf0vMC2SFAFpV z0!|cyjYv1g6S_2>A8smS^patU{qV2-X3DsY8>h+G50lkt_7%JEO&!9n`?|$)clNLL}>w18P#cU(PhC$4Wt?@TOhrKje zz7a;kU+h;M5a?SDQKQbx#cYq4l6`v=fcP;PkK>5N;hV5p9e)lL48S+|>(oBtp6{5G8V^E(|2ELCR>X)$nWA>%jq}g}`8ZtlKBzX&x+wmgE(u6Vx3S=0> zJ({%l=>?O#o#I24pNuvrT`usOa_CFjH{2v10621+Z2HaObBVJulr$oBK!}9?W>>)B zN~2w{Z|94Htjr$iiiuJv0$$(ip|%sDcSF2EZ%B6p1Lei)<;*u8fOwf+CqA#|4b(>Y z3ahYw|AUxAZ|jl!MI?=t?vXx@4K(F46UzJjp%HQr@ofDDmq@}l>=sweDC8n&P&&=J zt}rAL>eq6_cRU6iJEO<;#>d&d?e7UB=rQA#SCl>&hi3l;?WoD*i~D!3Izx$Ze{CvI zNss@3cpodYxO#dZGh126f|8cjp9 zWPT@)4KxRT-|{Cy7_j(h>hRm5{hZ=|!AB?(!iZ3H9u}&9A*jE97>WyMm!IZ%7HyG) zMAe)Bo0h3VXv}DmpQVN(d&?&#c|Nm~-2N%AQw-OtpvV!>cqkeuzfuh2Xx}N%rf$#xc zp#;8RR+a7ODCE+g$9;e?fc@+3g3;~q+@(8@`^(j!LoYl#Asrn&5Sr^1LgZCmEpNT( zz=6e}r+q8?ZCwB0re&mnwg4PHNSY?EC2Z4t?(gm4zyy^oL{Tb`?*3J*3JZ-UGkKGl%@Aa{j`D&m z0y9hh+U}nb;6?U}NNWAHEUkay$UsMk8ne!tl$^Zh;yxE>dN_8Xm}BGPzn-tP8to2! zKU}V-X|P?300H|*$jOOi+lWJ>TGn+nNDwoT!A(LzF<5s4oSD@h!~bT^hltBjg|1nt z@~3_i4Fxml_!C6nK2R}Q?|t8dNVDy17vwuiAre{#Mi;U zgiGL+u*&<<@p29`PLl__S7n|Lmo>Sn;|!G|(>Pd)!4iU2DaV zr`!7UL zTwzPp;R7YLQc;KO`X9gzWDy6g(~g$~0>y)~a{SRYD-B!26j{Q9-|)r{#>S*?&Q=zh zwAb7=e1OdmSn1WD?=Qqo=F6j*1ey5~5L$K26dA@<`2WQE1)`uAK}+2GFssr3$SV{% zfJWVKj!M=AUYg_sLrl#y@~LzJ%uFM=6 zSz^)H!O=MEni?mQ+~cu)emnKX(wmq`h?2Z82N|LB{5Ao42xX<1+;K)!v852Q{a z`cH7n$PW~#R2i79jV7b$ZLfDL?pwhaT^92xFfcHm-Oja{Q=rfgsqx+)C;cu*Xeu|i zLJ8PL#Exo?UzndMDn*e+_0Su~ZG&|7QRe?ov*BWc^Q?ckGead}Sb!JP;5?r?G{(E_ zp|So_;Jw4WN9l3>XcGFuKDb*xL+UXezaB3{=44OEqrd*+2X6EXY^Wq8#oK1&Je=%@ z9@aF?dduJy+gAAdb+5|s*&ROem_efgbq1i*7tOvN_Ct;j3&@P5K31~ig(im`>5iv| z!f9&!+bcu!v_B{hB@TGpIE!Nyvn0=(BI=Qi+?Nm)FNUGXlHQ?=i)(wa7shl3xceYu zeCo9b5$OSVfGUQ<;y#p&?$QFn{Cn&5EGzKXzNBSc^q;qj9L`Wd$S9#~qU{G*(qr{v ztu>reej=jvugFk}ji&_*MvL!%auQiutS*I0YuxXqpvTLaSSCJM?o)fzEuN^q8h%wG z)Fx^8UOOZbqzMinMQTGq*^a{1OK`1nPtsN@R64&lKZc=6U&4y*^f8OQ2RTs6jry)wJ^x@b8*%T&- zNuKK{jn?o8saJ^}4YT?Z{v;u-oImuaGBnREfEr172eHK~{tIQ8qIijA%`P#?jTS)< z%+_0;u$XkPa)f+wF|o2}5q}vK<62%=0%V&^!Bi44VYYbztx+Mp?OFHgWYul-^f!cm-g?v`B zEq7Emws(K6QIMEtG8qbvu7!*pBFCi^OB%*@2>oS7E1Yi&tEJ6@%LLDUk)+F;7ILnG zQ&glhOhtL~)2op@`$XHLKmJNXb?{C`I0c$IvRsoi$EFoEFMn?*8rq8Sxzwg09Cg4b zLse(bUNnI5oN}1s<6BDlP!ld#RgstY@Ry*|)#*9j%C~m~^fUvIdE}x>qXFZz7fJ%!zSa)D zq!~W89vYV3@88=s!)7FvKDoQ+P5owfSth+&G@{bfSE-|?0tu0tu?*2ft zAsKkziv%TF7=>4cp2{~Cj1)|j@Agv7DZi9=iiVog>nR?RY~6C2Xc={XHXwUxDl0D| zQ+S&+@jS-(1=4Z0OdtG&^s}jN+4l4fh8TKvM7OM!3HsPj-lPzEIDOGE`pHUUcO!() z=gFUe2A+U#)f(Sz)nT6gTK2w73TWs2eSn|Ec#~P3OUPe%s%ZqBUhW^LB}&BnX@R=F zActKvjYH`}YD8t~_JZTm#U!05W_fp6H3ey|b|b~AM=gH4CD6V`$gd^QFhIJ3 z8YKuE06GwJ%--M+zGbfXhmQp;KM+481xS(LA4D*&m!QkBqx-F6Kh*dJwKST?WBJF}56E6=ci90cElx6JZ2Ok!n2J2KbM4CDhuf*Tl2VULzSwWI5b`}REp*Y}KLv~gQ)2rT9+G%C zN^8T5Ko_@?*7D>JeMPZa`K5zm*}VUA8!5G>BJpJY`2Xx+3!%PTU~Vr&jlYnq&aVm= zHYiZyHm4R17VSo7v6I?Ob60DP<(&A3Yrll0fu|&1RSd5e*pr-ju3{yf@?-E;)snxx zI(q0K)J&O};?a-hYmz_Dp~4a>*D3K_#Ij{A5tfq-Su%7pZp3MTS>k{B?myo?=_`jG z;t&lsaKV)o^NZJ!{rdtS@Du27j^~1k@DX^e^G!A3>YZ&=kn>G*hK!jEP;a* zIt-AF9wP)8u`K+D0mrWI7vdtg^e_@vi~O&< z-t{RqrTkR;X9lx2Ylm?V14HMPi;@sd2E`|wBO7~JscHgmBl>$U2;Qs2VP|T@Dj~E&}4y3i+8dFzP^dr94DP!C1yq36>R4?%ON8g?->;QefzT6nT zh-RmQ9$>O61jn|EB!(wYCXLOY=PUHk@Njo!=bL4GEHDBdY}nFl`HNuzP~gsc04RCv z;|dPQ*z{lWT9s!&stMCSBz$AFn#T<82KwbDqluVo)|hN|>u@oHL0Y!W5J8ZL1K;qt zKLhM`Xt!VBnDtzpwLvimz%MPNw;aO!NcX&!{b5L_oSrI05Hf9wcM4zd2J}? zpZkiy4Xo$jwJiVg`(Vk_fdU;^u}0gqCWAx{^D%~udb7df-Aiidt)<5 z*|QCf+c8164;mf<2lJt+PC9FAN}5im(DIyzGx@Mj_ZNNwCcyARH(;28ic{qTHW-p9a(KQi64c_In!i1ZP}xL?RvJ1WkN6`qp7vh@Qrz4P?I8kmp_u-9n!stuxQhHyyFtY6Pk#qi3Y zXh^@~D*D#bnr&L33D&-1V?We1$p`A}Ox)SwygKL?JQjF2&+#9djk_!#TX7~->^%d1BE6ocreq}JnCj`#`tVyWkBXU=+t zzxe}991shH;yTnT_LF?XuyIR7WcDlLkE@_eM&3aR`o7<{{}ic(2zNDUJ_<#Iwr{m$f9B)UHKi+&1w59V`>{N7vnSdWz3?~~ z{l=sIg;#ul25$?i?S)LUW@#ZMC-D2CkkH!B+#7=~L+zj)mmIj-)1t6XZK09yTuSjj zO9GM+5JW5h!a5;csKpKn_`=%pYk01KUb%N#dUcl2Q>0x6{@rq3t8V%8KatSydybK- z@IYse6rqQxF4Zu)iCpk+ivk5rkdAVek82w+i@RIo{)xBbK|?VEETbM5cmqbWX!`DM zTA*__Q!&qf2;A63S9{F&THWP-u zOo4gOKr^|hk17wbM*xKIzH2j1<#zXTp2K|yc_)=-;{S+2iP+D~ayEr_*ts-i(w_TxX~!C5DjrT%v_Z@|ldm4l1!pUV-LC{%75(u|+y+|tOGd>Vw(1)bMpDQa%pY_i1 zM&lUe#58Essf!1oq6vHv(bDPZk|8bUwfP!d`Q+Bz0DGFh$60d$;nTa zw#-V(`J9N3KnsbyooRhZ#j$`#%d()!PtTbqe&h6F z+q6>0W|QxO)cIjbuaa2lijCFe)b{jpXkXY=)tBx5dBjiMPf%eiqn&TJ3_uG73!Jer zc-FY_O^)vo{0D{HN2BoP+mleQi*^iz&|KZR#u?FHNeQFv$dvdB`W1DM-EebS@yj9p zg~z>{%3Ls3D?N%32(r+g3>lbU7iEPu^lPfGK%4mYi3u1GC5!{eD=U8m;uCmwZC4+E z7h$%w@wB}FM%{t7@e&vbkdToW3eVct<*p>8}8!A5dF3zs(R#8FzhHj8ih4rlwQ+pCchj z2*jE2lxbBfw4pmUVq`P8wsIornIiguRx=8c!21&(mvdJ-r&AR146vTg`*APnaH*DJ zxy}M5yU(+QhR{;1pJ?W`c1yRJvLiM2lm=;_bj8c>3%)fxEw%RstQ?8my|24fpp{Ga zk;ngRv$-+QrsMkDOk;97lG1m+IHtQUTZH_sJOkznLMSrbdniePrZbJrhH23A{@f-$ z;qm%_olvvki7~@gC45@mpkG7zb`=0{5~Y!gHfI)i<5eT(G&A#1QL*v!K!>9;Ir_-Z za9WL1#VWfHu4296VqmJboOHgLJ zAt2pMo~GJ$c0b@E+&q_jUY%r%H~U=8ZV}kl6PJtS@r7CNq=4*sB)3_n0PXzONWjBX zLa}(aX5B#K+ZrB6na?g?f|^+0tK%%iNW`hb-YQZvgs=Ba2IK)kBGnL!N~FM+9DnMy z;uC>R`SopHDp@S!t&x)ci4=Y5QlM28ODiv6C`e0G4~Vx#qsVfA;NCuMM>5!-ls9fK znPsu=KLQ<{&4-$VmJ!_Ub-(=^>B%({!*vjbZ%~f>E3yb864=Xi zHiR2Yv+D>4X1@(hcB=>Rg-lJ!z4@{fRO5d9kjhf6DSr1h1P#^=Th>qr<)4#BEsnl3CZ{rd6_W>~Xd z+Cff@hr@2$2SojV*?e^U{s^>w8K2+Yi{W&M3eD6QpY`HrT$f)8i?wDkkJ9-&eJFA) z2ZMuyMnkbg18(lUA@D#rH|E9m*OHu{1Htbi#ox{|HHAQ_*h+&<^lk6R_=fMfmANG3 zik_KV7Mw=0_tL=OS8rIB4SwC-ff_v@$g*c5Nj(S2QNT{pnE|(;7$pZq5_VZ*|q zCBd^JXc$IrcY`zkyme%S%=S06ieS>|1L5?}JY1O5X_zx>l9dr*R{z`hq^4yrk-<@J zhHYQyn!-YjFA9CRriHC}QhR14g6s zUgqZnDk3&E?P#zXxS(77Y&-ctq@Vi3P;0!>CsQ>2W(P<iRusiX;1rlfzycEoEv%GXA2b-* zcal?M;ln9^h$<3#E3fcKH;%~8`aztiKU_=-d4V$AH6u>YLdb(&n~Y4gErE`a%p!%% z$7G`hR+94db&i8DRbCy|r-;Ta{mIpuEA+tMl(XIdvZt<;vW z8MDK~yd@HU+1D;28G)~<5uwLMOJ0&sbJ91~Fa+I|ri^5T&=8$b^amIbuqr0|sGKzB zdr+AZ{-@YBQWB-qYt%52Hqet}k(%FI(RT!e{Wu66oHNw&W=4D9(5!qQ<8ew6E6TOH z)mVqTPIP-(=Lkfh1SX> zM5(mWBqvbr>_`mhJqbC8AyUfm$zxG7%)aB91FdJC$=~rxnDoyH ze79%gFQ{6A@13rdq`dc|WAy1u10`J8!NCECvq_#;drWf8rG*ru&Mj9= z85K0fDwJ^=c_UUoC~QKT?&6^UsNTJFlxQ9f3XN3MIZjjEg=a^6V{gMw0>IHyaSFD+ zL%)=#OG36N`W?0A$v@~RkS;sMtv(_vp^BKgDiol969J6Y73>bRI%P;pe)7$bTDZS7 zMg+vlpYy76`T0Dg^Ij`GI6CE8j&vkt_RC#N^Z?2gOvEbG?@j3{wH2;L+p)qlv#UEE zr|XH9wLvN&jl1s;6|I+%bkcAMe;NbR1fhzNTXlNPkt^Hp-E3pc-CmS_lxal6rhe zaB{4W-g{9%h5h!iZ!i`{mu1+jLX3s8G%@t{he+L7k>*kA-{FgZ5ShOA(q6Y7B*|hX zaU+srlI;yH z3X4iwGC_>tF0lHkE$+#Zz;=lJc*v0Ywm(Rm+QSm_H(>Q7De&=C$OursAvhY78Tr5} zRcCMthry?LD3~(_mPU-vGM{4stoArHWZES5afYP!jmNM9U(rQHPZMZ-pkm^B+J>V@ z9NPBBBL1ZK@GWWmjXLr~p`gL^$DUAUTflW;KjQmn7BBgy=fP+`jY^?1#+n(Ag7^a@ zqM>ve98Tm=hrP()PdX(W)1H@0OayPw!BXe}G;@pF+Ngkh#zb_IXDPWLoW%Mu)8(6MVo;65!JcPi-RdKWcxJ=tCu2E@?)i2T(P!g8pl$~w;>S0YWwAZTfs55MFJ7c<-W?`4I{gJkgYL)ztn-j_s zz@^MXTRdHMOjqL;H%6I~PDzfbfB+yn|Ah^|Z@Hu_t7?0-eVw0ah*9`iV@*5ft0J;j zO?)FWiGS-lef+dvX>%-X9c<(GbP zP0kD$a0~(3jIqqByK0mHMbr^Y-=f{sD#yiks1$dbqSyyOU}8v|6N#O|hig-l5doL4 zJ;YgxOQy>)(D7GAVJ?W%0D@n4eLLnh`5H8hn z!8y{`yvr&VgMLRnA=t`_JkNIq3x4=?Yr&5Eka^hw_E3BK@nHRWEj3ZZ83Wo0Iy>SA zb8~zHF(PT8!6JYa47^bD(O=$w2Y$yS0WiW@%N7-^k0@yV`JJBQFe|GV63X?VU#&aN zM(OfZ5=sB=1%UM`9e0aR5LVwu31Mhag*l{w6IrmLDdH?0GTWPlaK}7T{gXw9wCPzYf$QR{{(_Ug6l0!%ls$^$xFiWD? z)|?@Bwf8`)_(v2qJjS3te{ror*-0@Z94r$6)8b+Y$B0u&YV^2?x2#9_=p5;DAR|qk zrbGRs;}3NwjxB*3H6nGz23l*ZiB&2|Fui<~ovn>j5>;lb_Qo>L{OhlNrW=6Ka75s+ z#Iy3}7s{&mjTy+&t0e~JWKKUFrG4p^hAWj)34wSgE&Ro(BBq3Noo0?iwjZl9^8MG}n^_SkH$E2^5{)nI}lh)dxJluM$darnhmrq0}M4VnNo zEq%v<5>*PUg`|N%V<&ZIONa-jCXeI)VpF&^ zGhV|JlJr=sPVg8(K5f}MOl0n$CC5G}|160`Nkcc%^e&RC?C^_N(ydbXQRi_mkC^90 zf$YAjt^!y?A@22(mC#Vjh4r9Q>kC`z)RFl|jS$fF{Auv1NJxzaM)lDkw-2>ytQ565 z?}m=@;f93S#j^RF%8|Yt&e<&IbGL$*l==@L(Zg)o9*FxMG}!apDs$+7u~9XLI6?Qa zpIxC}SK~y6$22h%>cLU!B2mOScuA`BEJeh*11~g=E-gVdlcc<*$h!rqgK(!`A$YoF zP_=oV*`LMtdMB~ENzcabwlbkv*_B)G9}731Y~UM4PkWSTQo4r@XyY`30{uP4%TM&N zRgYt2OtH4D#cs}1ntw&(p;1enYE}8=M^IgVhmrhAd6+h7MUm9bfiFI05=a zb%}|s!^|6CEwpzAAGt$&l8ynX?=fD(D^H84*25uCTZ5R zbHWxBqsj24Mp-}w&vIEOsyK}ocQ2{76 z+ZYU>_(}K%_%KGL4Nv2g)nu*e2m1%DReJHPVHJ_r2BtkcJWX)##vG)G~d| zeD2RmS>QryeR^dYPI=sxA3a6c+?op(6*L`@qbfm0|M|WOgzYE<~r%# zYvw$O$7SS}lB{*w&B0QKu#T9vwsWLL+ljt&PUq3nQmu*o3dWuaKvOa zpW4m&k9uKHBKU6+|BtG7aHuqHzrC~V$+l~%J=yJS+nDT$lO}stJKK}(NmDycwvCCC zaeCf!p5Hm||8U>ecU@SYMa;jfF`QKQzT>NtO+SgqcaeI^>`PQN=x1J|D5PqZeB&D+ zOr1E3?piQDJ*>Bo<}9S@OO(n7OE#-BT1gRaeqS?ZNuup^qY%i^^F9%?YRoo>5%u|- zZ;OH9M95-MSI4OHP+G8IP*(kpTEW2}@`88r;h&Oed1rq*lz2nybX%avsA7cWRZf#{ z8mm0;vIz=MLfSBjzrVcOXjb3E^3pMcO1MFTINY;jxv~f2&Y}13DrYhMJT_xb{aIQ;(X&#Vww-!*Mdpq1S78{gVutxUOIUVD5cm0|wox%&V1 z`wr+7vc1*CG2rCQEl#MlUVOL+0Hi}d>U5qEOwB$7sY<=oO zy^LXc27@8OXcCj%BbfTT>`UpbTCopRW=;-_xw zXI=U!R0HinOH5^^aZ}q-nxL;{nVM#Rz?|rSj)%bP)?s9i;Lh zM=B(05&Ulw7y3SYDqAM%Bd!MT3Cy^wzWoSTeoxtj6gbc_nnp*#cNv z&ey5n3F%{Hj-1IFn!WAo%_ONp+=hPbw~~-!M*aIyugsdqrRHVOH`mHqT%8C8*?!KT z&|e)|`R&~@&q~i^wI}~sQ|$g=)j{1+c`pVVVb*GoIDiju2&O54kyjzfOa{S1H6 zN23C(L@PZl{d?NpPEypBz9B~d4~LnsLT7WplIBmH)Tr3H%2wpym^Y&s*Lvu|4(-S zodlF>D$lYsXDPN9ahli_rG-@$*e)G;lq38#PBn08y!?p+2X2>^l&T^uS~3|)z>n4i z6k?x?)-O1y5>=z{7QBu$O=`7 C1w5s1<1LbBB64oUN%H%#2AhilQ8 zRKNvibH5O{+Ce7wW3|Qit32LZ9MC{C@lzM+Uh0XTyClx4zfJhrQjC@L5gW_+^cZ6M z2%LOv7^9es)}%aDbAem1|BZ+$bnwl^aw&&l7MX@o@h1DlG*Z$hDWiQY)RS6{2R{7I z);4DV{Bwzt!5!QUTmr(o{%pPa(Sau?+P-Oh@8B;XDE*ptgD<(XSk6p*F z9xm6toVSjc%brl$SiYw+XCI%tU#Q{Y zGPNSl{z!oAqyqor{zl5P)ZgZFYNFmRv*F&ouDg@`C~;8E++%q#qt0-SeEK-Gp1G_Z zqiM6(-4J|3(L%r3KC!CFEEs!huLOvbypr#*;~EVPSjjV<_L+{W(U! zQ7G5|4X{5jwd} zw#^T3iYtm_h$5uZ%j$_!1CM$3ZmVX?}wZQ>Kf z0&W@!U8j~hh~yM@Od`eo&d{eEj?>!zx?scR9@9WAamcDyB(4^ph=O)ZOtu-=aWQ`E`2TLvif)Ap~4?F zNw0yf@F-~xWS9GU@>pC(r{zRXoCigPJNRddQRbJM969t}TQg;bOSEa3;k{3F3aN=R z^7yjPgf;)n=BnTme_iJXGdrdqWQc?zKHUWF3R{I+K9qEi1{%jQCauNl$kqYA_E| zABhllSw9xWaZ#8k8lzmO6FyHZuW#T{y*hK?XDr2hwL6XLx2u5*oh7qNThlQd6n<92)6WZV8+qD09YSAGIrtc4m)Jtlc=mhB{taEG$SW+`?G7cqN*9Dv z*zIpSEBQdM_G1ZHl}$}iP(*cq@!_w-JR0jo>las}^_g&dJ%4e61pUu_4~7xUwLiWY z?b#orP9w){Hr@~@qmo!D+IbBD^TKI`mtC)1hx)J`*u;WIF*ia zn&t~@I=Yj_!-oRc8a>Y4$|M(Iz$qph4v&_Iu`KKx#NI~7Y0G4*5$}{bYEgJ~g~k*> z1-0sl2mzHf?wyl=Xx!YyuQ6Vw?!k}`XyHUn%T(xZf zpAA#4YknWQsQ3WpWs32w=3-93(OS9@jGFQowpr?V{?-WoFMwaVUEUdLCr$+Js_Kep z4$XyjK$&o+k?70PaB(Om!1jZRJ$s8rg{Sj_PQC)7xbOH1DY{fJ1ook4^Xj^u-n zbjHAIeBftIYhPhfx431K8#3h2(Ja}s4Q8&Ur06%-JhfR$tijrabv^npXWqbRz^XWl zSOL=N-Y@MxC?ls*R%fj_ZYC%r!Z?PLEe)(`gG3-Dx1gEA!PhP(p9DI~bI=#N&)5zi z|EZR9d@He@O+jhbH_y&gI;(e^Xw=m~oIPAzy0NhozwoG4k6%09fHnIOH{2XwbJvuM z&OHmUM;ispQnq^K%M8#+;^CJeO=45A4u6iIjh*zVz$l%o%y58YYcjw}I#ZW)XlK~H zJew7}YU%X?AAIq7)v1IP;l44-__1I+oh^EB^HYMNe_yz`o(Q36cVjAD_|SB>)9IUO z-p`CG#^^=X|CUr@a%hpG{Q|}W>C$9G$4mFK_e>_667*YpF7CRfun@w~2_~d^X)vDY z(8^ZHCVmOpvfU{0LZ?D;fWs=igi1rT>N&pn7#&OkU1a!uL5p3#yCJe`%*SB}!1p?)4fU50RL(^1{yJ$0?KUOHEU`;?*c;>HAHWUwi6?hIDEN%yu3Akw`WS0gAEub5!cW#CuM07j zNF5B2NwhB61~w$trh^oqT0m~nM6?_zAr~AjW{uchKa2b^QC_+bEOV)}Ymccdx$9YX zPv}}<;2mv}s)ML|uJG25iKWJ%ZTiiz_yS%gV$EmbM`NU2afaerRl3$0G?oz(sY4C~ zkiV3=@xKZl*Uee!DP>IIgh;lARpbTv7!An2+CA3)C8+_72!tQUtPig4 zCB#v0t?bF%6LMyhwzch`FZ|X;V79By`zzj66aLq<@7-Drr!=O&S>Ku@i^b{dSrz`8 z(yfTzQ3AX2-Y`73j?>K!%V>HQ#}#u!!X`G$Rh3i>(gk7Fc~?Z&Fe%(tOf{h28Bfwq zC1TL~a;5%VC@4#VK5UU*?^9_bMQIPJCnK<@?;?{E0ffE*4ct zsAx!~Vp6Th%!q+WFibBQ*dBm%7-Az$3GTWiQXD!gVW7DXUu6FM!Piz~0lpBOs56Jj zqF&*t)?_*X-Oh);vT5M=Pzmy%j7n?ArA|MP5^+4u!{9AGB}yn7NV%9A_)~}BM`B6G zz*z8S=#qmz4eP5e-2i1e;$3?^vtc~ydVjr)%Z?!|3yC(%mGa`J6RH`qZb$WN`4mo% zN`*72z}02P8Ps1v6t=M{*ffc?%MJ!8ehq&JGdls_JJus^Yy zC|MJivl;O+|J-tVQ}E5`$2$M0UU@A+S`~G=HgB#LHE*ACvCM{@Ck-ei!NynTUT2v_ z_!xuG&HjB-`qUe_x@e=&wPR1?nD(jQ?Mgg}(HhZ9NQoZ4O*!NMoaU6I=4Q8ez5m$u z057U;^$}-QaK_AL+BEZrdC0D?o!QekcU+GC9s}Oe*t;hq;U1%PbgUYaW;GU=%wMzw z_IG>#i#4|Dr6%U35VXX

p3#^LG{E+)zxC> zb^kV6JzmOveP%DvykVu!o$2LfW3N}jwKFC?-yb2({o^k}$xZTe4L9Uzsp6bdMtR&l zgf!cdYwA}()ro2<>Jh*@Z){fo;L*P_WTA_3CbsFx6fjvU9LyZ}7cd-fz+Dr%S)0P- zdmqJ8=#OYOwC&5vK-5W6SJ2@rfhI<|$2h3(W&8fntZV#4 z`V^jUw(G1y;^os~=4zuR+)ZfjS2$VM>b2^=T)rVO~GXa@cG-{0GdvO4iGR zRScrA#(pNUXab|~)Yyo7w&Cubdfz!AJ@~nwMnd%Yb5QfGI39TWN*pz8o*$)56D2e9 zTEYRO8J9qZVB2|1<6{CBYyR7@6=``dm5GNv2^IHdmU!s8+H&25HS3Y-$T>CX(H}c? zvCQu(-3aGlU0oz5M3M@i0NMS#B?ZTt79uzngUj|bB5d-j_e!Vw+$BY=<9aZ;&;20k zagPO3;(ua_K9;Y+y@i@iq*IiWqSZg~^mWc!T#0k&5g;`c)BhuC9G->ON zm+xKR(Ou}N{VDIGE0*_FC+uys5V_pBm;H8`!f4XnF;vign{&D`xY}(yyB5z{KhvHC z`IoYDY&{%BpnQ^Li+7kOU7*LX=y-&!oK*HaQR>-&LlBH49xiPPr?GQ&Ib@5*Xi-q9v(M7|tRX-=?c>;kExE2i zv%M%&Q(SWo+(w+!5yFD>3%r?j1jJQI@#McOLvcLMQb||^X)q+R`l!;^E|I2$Oll*j za#qT+g^VQ9Zt(8FqI(aM|S;oafhxifM?N<1-GEG-+Qei=H{XXtOUc5LY}JN`q}m(_sZx?D*1w_9QG}}-Gth)ZVLgN+ z4YTHmJmX=3+j`((!OLDntPsIxmAmS^Lybqv2DLHwm_&v`viloS_kn0BVQ$v!9?O@JvF4k;;xG%ND@1to0U|#JjpV4@L~ghRR`f@6_xV! z@0o2-8dGJBQR7z{c{G*RXOuS>zVgdHSI}l0$1eAo^10q5SsZALQlv@p0d{r;Jf7>c$yf$J2j-_qSSyDw-##x=K)Bnb4?zmY#9fNU}a#`7x44=bX z5xYdaM#@F^P57cV*?N4~9>D=t!e_YndDQpk zwxoUfxo7_Q<8pMpMwMN5xkC4W5d`Gk zhtQu|mpRGsx=@`Q47&c&&?@Dp+vP!Zho@1tw zGn=4v9ZtaT49x4Rp)gXxOSxy>1x%Agjkkmo@D#Zy^kielgzshC={F;8eqy+~{VlCa z^Y^od4Fu%X7z^i|8=Jj4j#qadS*3!zoXd17qiSZkLfP}0ovUT3IuQIU@H8P69+rj2 z3DBoVba41Lpy33r`nBK3%5t?1u>IB}ZwuizNVPEY+JlB^+ zjU|hg7ViSHD38i!KXbNSdJ6ck-=cS>p$jt0oj(W>>HL=-(w?CWhz#+u`Ss)NX-+7&~pC#H7v68bCuKVc{z1tJJ6x^s1r&BIr z5c-Fd(Gc#P^t9{0IrAi!-UpsMzb=aS`CGFt!-b$v>dk-yCN~^vuYWe*y#;yhmqHQo zluTCY*}(Ho2K@`K&h@wp-|V2`1jHf}l9TU9uqVRFglS7iCf+hNsA? zyNTx1{_J2tfBN8n*Kky-iD1I)!9>aLmq1xQ71GMc-X>Y{BSj|-)1U~$(MziU-6%HG z-Mo%q>}NXUo~n6|%`rP`8{gUh5`N7wk2)6&U%Al4#0D8kY{UARAj0x{EWi;^&ztTH zI7Kc*-*g4b9rT1 zMiG4q4JI$qDfEt(DpF8h@?Bz)MR|VIiA#a6XVTu^5`g*1DGl(qi*=hUiSd(Xv6=s% zcojuq)ykG&n4kNih2|_c-zox+hLE05_~?jD-=54KSB~zttyxF=?Naa3+_q5$a|9VW zueG`I9OisMad*@~X+Z(i^H}eTfG&UW2gT-4bEXCH%+WA>gljUL!0bh5&tW z-h^Q9U32a7>;0xP#mg2V*v1yAv-AApe4Lkyc}TNZED1&$1&>L!xQ|5vnn4pU|3++` z#h^VqTsW%yJsBUvrPIGN{R`ndYY%D$aHiaXoTalAMGC$?sKfO(m`+?68>Q>$%;;|T zuD4zjYS7~sEiy}ZRX+f@k13yWy>l-N@C=3ew8)XDSuOUJ7H}{w?IHU~-HpPqaza^u z>XA!q_;H2u+sLR^ekJQZkaNhAslp$c8`|*udjB4*Uk<7T4xP)~)Olg!O2MW9m&)-# zg)UlFao38OFVuw@BBY>z&*U~`g%$n#$+ByPoG45)qorG~en718@NTNg_ie{0f9kQ{qn3{mOnl%jl)eBRSyPtoEw)?wMLA zB#Uqh%pQdHQOv4^W`=GzFZIA9oAb&^zx@(vmra_z&$Bx@O91VogLys&0LWJbO*((? zfWv6tdt$NikjXJJ5kM=lYCvB z(k8_fISs3m%rt+3Y2#44?BYvvv^oA(0(c)#f=YbOw0jDTc7$GXO+`-pofN{D7FR2y zEHQar{j@h1c|br0t6K1>L=XDk&bOmhNN)Sdd{tn%VJiW|Swy6<$KrVQLo8f`W+ zWx)7A@!xC46DdzzSiljg;trz43=d@NM1hZseikM*F`kSy6*Cn>)Gxp#&HK45+!PuH z*Li4gB(pVVm9g&jy+?gI>4W2W!hXYd=c_hTqVHWFsKD_Y!qBTI761N)8l$l%bV2&v zj??Dw&-2-bO}b9-Z`(kN}E;x_LTOYHSxTV8U~>hpqi8!nTd;5Cj-_7=QPy z3hm#nP>#*8sqRc*VM=Tmc*8o`RHiyw(~I6MCTn^?FdY=9yNpSfNg!BkUQg$h!oF8A z5^JWzkG3SD52GnqB^x=suSP6Ve(p+Q^ttlPb>rU+r%0iSi1{ zA`}GOVQv>RL#$9L$E3e8!QYx5Grjy&Oq)1Hec|wd0x}6u;-58g_{f->uT(z`K_%Md zQ3EUd5izv9MC?M_fnu#MV&<1VFxD%m;@iISvP@!l=FL$K*RHBF7#Ddxek+dV{Nux4 zzdr#94{imraO`)5n~e^b;y+?NA=q(n*Ta_d1KwP49#a$WM()WTfhV0O|4s?I=jhW7 zJO5--H4}(w2El#A-qOVVc%sK8Co{@0zgF1!x#zTBz6o%>& z77LQ9ST;x+hIGTq)6DuD=|kt|cy}0lontjC2t2$QYHOxq@YFN%wGeM@*YlWm9+J-; z=i#>ReB$FjP9>3y{?o&V|KL6Nhk(rhtLgXEA=aBFx%4)%6=XzK;!RpP6yZ;mJYH#^ z!WVux8WKZV9+AJH@r5PHFL`j4^Ey{AHEi}Yi=XLXo<-JQ-;PBl+X$KWR6WkDs5QZ-cgxk)uL7yJsdk z`|1yoTdLoNw|94wwxmOUGhrhzm@x=gx6BS z*NOfiNu8=ngsbmb+(iZ51m=Q51WZop0(*-4v}|y(pKmjXWA-}}Vd-e0bO_sq<{73R z3!|rW#NQ0@usG^SiVThSIg(~OJw)uI)e@x|u?+1(+bFl@s4@U0Pr=HZ^Z($tl7`|p zru;-YfP(oqFk!AEfp1(0sP$%Mj1;BHYBX+za!ZPl_Wd*hK->3>ObofTET$ zP5Dtf;l!i*6vf`~#z_n9Y2Zj5=#8b0#&1c%{y(`)!7DKi@ z^QcR#)3%t)TysV@59f%&@?w%ilC1zy;kVyi&(;=}vV$`9QFfP?tv2 zD9`!K+QM&@KtU_7GB2bTl>(+1%ip?-@SuiKOQ$Wpzo3JuqV#ArjK?^p$0_Rd1D@NO zZo`z};qX~&W2W|-y%c)IH|`?ad5_*E(3g0#8Uit%N|)I;p#>fZVrH$(?~ETjntB80 z?)kvu^uW=Uugg0S(CD13$TfE72R!S%G|Q>sgF68zm3SjF=lu`c?C{z3>DG>gg~fu5 z!STaxru@vs$7k*6=ok-h4aa}~kC6C3isDjURg6PKFJF$hl5m+N2WDw0br8PNcfgnu zITmuYLRF5sm$U|m!<4`iyob8GqYFmFq&M1%2s*V}!5W3U!E>VTCP7mb7hO8M%OpR> zN}2t`&R_-_71=4~&_Z&u#MrffQwt{P#psNR;RE!{Ph#qZ>R~Nu)XSg3GlsK^Z!|kk(J~mBX zg;9(j=$ob01LL&V=q1eCK6#~+wjE@ClxpYx-3;t&1$T{v3N5M}Ltlsj1rIIds;YNkyaIxPZj6>CRj^qc1k1rcWjqlNFS)DRujyG17-7qJG&v=!o*oxr? zGXoU-cgnZJ;eOpMht(xamd#DRP9(Rh6Lf#Co{rLYnlZH@2+6YBi(NN7?%{9Cs;#R- z-7uR(d4SU&b_+sD$A!a6^bY!jlZdj?dv^K%=n(A0+(8%iKTbK~$_G=q@%k%_m@$$M z3a%fR&fS&XkmG+RP(&=OzXh|0E&dcr!_yJ;68t}(A4HY%y~EFnnWcINdKYVQpJ1Z* z0JWCDpTi%OF#E38zV$lOZtw!i8=6@9Q}jrfgl!WR=_CIOoGisH(jLh4D0evf7oxAI zvMUVd^-Ur`lS=L`i@~nzsbJF_&cC`~b0vLHB{1-H!5geUia0>m!IFXtZ1-ft;3>L; zKx-QiFd|=$P_-p)(Pik_)j~lRaOSNdc&|)$kYtbDp?>zeKOH6#8wJ=`5xkuyWF7@m z&nMeD^vWsEBoyH(^6)f>dGJLVbO`Gp^n>MPSjaski3 zUD&&t=iaa0bRts_(8;s{HW8;CRE=>GZz0R!@vccuK&%zME)0V9-WY>p52Is3ki24T zpsfdk1l>3$7~`qEyXfga@#4D4^EDscc?qjQb_w<<_~p-3ie@ayz{}^~rseD+fc~2= zJSG0%w{sMi00~w z8>6FKih!O>Pu515()^b4mcI3;YZ1(qfSd2Rg9J$TE)*#iLYv7Ah!wTd)is&g-%gkb&8=tjuvQ|>LKFX7A-SbS^jVShxrWT@KA(@r!$7phfbp&aDVvg~}Cp-4E z*dcsPmW4!0qP_!)!9hKH{I!{{5`%`5O&3DoA>H;pO-1rXst8GptByq*&8D7tGI$@k z%RiXCxi@$QLR$ZQyFR*M4gvTsN;c8W94Nh`eb!#M?o@mUf~qudm>S}N){^~U?eArS z?S2>g1HOB@RB*q)e1UgRtW+ruwX_wom1gMspn^CY^mc<~o(}sx0O7O?CO|Rz zAp1G$;xo{Wi1uDOD>RkphYW**}p9Ef8Eyz}&6+H8RVfLAE~v0cOS1$vK8m(clTSmJV>X#ze|krTZkO$ zaF+EE<{U^79mrCIV;T#Io;As%vYMxOs^#{Sl=$rV2ws~O^Z z#!JqjQ6i(I7@kp}KWzDzl=*9IlZ$-}uY>FOCs6Ufax$B4eCxf==Lw3S3*^_p3a_f8 zN_j8N2_9Zlm96*NlYmbW4`4v_m8zd~R-&fZAu!&U zlT0BCAD?w|^JdSz?4|ORhM~lfRq~(iNUgLkX^CyVrZ*S<|5N=bzQd63;6AbV0DC?* z8?Fn!%=lO?^pa3&K*0cD5$$Wwp2h?Qb@)Gjp~y(uXZM+edu|$6cbvNRbvp##PwK+>ga!Mc_YfH7q z%xnha@o|`AO%`iK{fKmVW*w4JX;byvZanvLj}1w^UWMxwyea-ZL>uF%j6}g7_Q0iq zhc2w`*$sc`ISAAb80$csEq(5(+3`pqFi~f5NKtD?nuSlYlTY>v2uAt6PGocJ;0~L~ zVq5*pkKIgfQwxADTPpDlP31fz6+(+ z!O4Nu5=Ki-G!JedO();Av@91g^HBIFYnOusI{o+`W9$Cfc-&f- z>gV{9MT`!O28ElAxXXso`6bMTf>eB9p-ocYFKDA4MoS8Rnq4Wum&2(ub(0-J{Iq?r z-TY6L5Fl<5UqFJx&+ftVA%*`vlKTIYWETNrzEZ63a_^T~q3>wju?o;AAgN^lMLrVc zadobYpO`fmwxR@vkOwHbgxN0$9MKF9A2KY*!h1~CS*O2Lx24;^TN1#Wxr9z6U4xIF zrCPR#)T6AX!|?!VETMV3PEyPlb(5#QbnyffuMsJara+)zL#o$2#jRx_tfsq)Vr%P^ zo#}GP#Int1Mj{FE=7W_@K_eg5jG3rUiL?tzNy=kaZ3Muk4D>%T)>LEqA$RpAN&+_S zgzz!XbMGj_ihk^C-&_Z^TO!CF<|5p4TcdSc5d@3>v6(e#&cV9l?20@R*eVtZxc!h< zkL~uyD-#zdE_@%8K_cGcGj3@Gs`kMA$e zi^m?!c1$+f2MtC(J{GG*Dl1JE2EfIIy;wA@c!)m-Mw-nDR0+j(@?z~1qv9Wx>50Ci zY^b>#5*Ko=Ew}h`WmxdV-$r{|jdy>RgT*JSWCfTt?~{iX@x>%@z-@*%e{9akpKpvF z8?(zZzwDwH*32exleAvhPN41P`>%|Za6X>@(h*W&d5@J1?eA*r(a;T!x3iE2ohlB_ z)uER7H$x0EP=cb5(<^fC=GBnQ-ZKx3t#Xks4LH7}GjuL7z-x#fTo@{un~^p4j>U4C zpdfOY2ZAAGzBml##;jt4{KJ#Z183aPz5i!y^Pk7qCr&lkyEYWTT*UYoPa0yZv2*^2 zC7DGv+H%M0lSG@8-uMDNCl&sW)nD*5*Nxg@J}ypI5{`!!>W>dms7JE#C9}fTa%)yP zqsC+bj2;XfcLEi$vsuz#ZZPIg@4(EO==N$5XLgnbw&wP zTlvlcH~76&IFANS9V=uoyKkSox-J))+PHzGMczmqZe!v%adiX#sAj>RxR12?n#sw4 z@iV`d)3^FMxd59(xVw4hbG2#BeJ&6&$3F$x@9RiwapMP4qFl7%ZDl@C$RhXBlxdqH??XRLuK}IoJKHSzJUz9$n zEl7QVkp(o`c5%0zBttZ^LNs;7+qwGXZP%Y)|M5qT+vIshhMCo5Fg%r$YE{^Tpgs$+ zl-)~en?cGv_ZVK4ZH4z$!c1KTxEuGvEbatO^zk&R)TKv4k5D@D{~mQM9FI>ta!-0= zIpSBa>#6@Jdnosdx9y3kXB8(A$eOhM*h8jf2Vqqenlt}r`1gM#T`-Kv>xquhWn%B^ zYHtppit~77?6@`Pxz&hQ(x~k)*Y8aD!Z+dd!1=B813g5;;~TWmbIGUmZGY1TgHM3- z9frt7AfDh+Y{PFG77FUKM8k%2?a-SEbUE)LGxIVpsz(GvSU40B%x4Hk9Y;lJ@Xz8I zi7$c9!qc#naQOnNqgLNZUJ155bZJbEHLLr>(X`4Z5?`=9coqlq@$8lSXNhXQMfsbH zHKjBoh9$1eq}lTkruZfYN1mYlQ3a-z%&YkZ`f17`3A!v^3Qc<+Q0@JsTuJ1`Nrn>C zAf)0>&NK`ejqLjnvlwTcF&)Yx(8^$S5VcwQu^d{a9d0jUsZB>|C2?Y3mFUyo@gM<& zGFe9feW#L)fGF49RE3L9Hfx<)WL$Hd&y^;rKf;14JLc`b;(ey87l7K4U{!|ltA4IBx( zjeL0}d_jX)fTKy|oRkIm8x>-r3Do;+IrCrB&X=IZUPKnd3kk;?i%G z`DF`wO+seJ;u)5;K#aEM18ru58>MkK0Y<`?YDeQ}FPvWFX33i>tW{LNCUM2D2AB<4ez_b6N| zCQY{U-VBMV3H?u>+m*&ddHTJ*qO)`L_7S4fW3D3l+H}6$_}dDco!wNH`weowON(In zv1*OKdRSTPu?~7&401GiyG}nO_;>Q|bz!(sRjaMA!-?>1`^j`5XzB#M*5L~Zl$6U+ zJWN;4AlO|5>hfl6uf+FjB34I6H(WRol=_N}I29Xcq`aHTqZgL=MSC;Ag<6bq`hrvu z8jkxBXNf=#yODaUI2BpuC$$7G-J~=$sxA>groUO%$}ItcA6oFGd!1Y0*L_>@HYt9G z_M@;1&?q?YJN|o@Eq3UxnsGpJj@p|(-%$+Ag8VXn|GA??6Eo1FBnm4-&BXuw2ZX>j z_E+_2p2UItmN?>CS5Ku1c_S@nt;6I>OlicmoT3OJ4EPJhVIXt|@zLRMv=FzA!D=<5 zBsqGUC%qQTou(pwa6=7V96@D@3;ljyo-HfAIPct3G9SZ_-q)=^SOcDDabFqsDj$;W^MISpX!X z0Z`nn zs40_lOPbWh&~A+qeH$rWW7VqnED6cB%)!;RK%E-2iC`UQ_YXuzE~K^tF8{MhDsLK0 zT@#5qcVaxX?QD#K&d6_t}hUJ_Y5NGC^Q*`wUxy8R0w-$ z&r?mpAwxlC*Ipcc&B%mRUz1{-zl>hMLK$g<9!mLq z7|Y$FLQm!mIj_p$u4Qlh1ar)cvVkERL7DPbdz?H=jw zv5IbAF2qQ*T>4a&SX$V@5X_k#4^-dWW0CB=#n#}k9_OO5@5)2zad^trH z0<=9#D@^!u-P?!e;xlVVf3-(#|3_hFTtPO|XCM1n7Pa!yfsH)oe{XO;+VN04tXbEs zKIrFPn1QDMVd`5j&rJ*u%RKLjzFD*eX^=+kH&~4sUNrwY>)d>G>ij^kp8uz$TgYv^ zzuk9wUq<0FoWW8&KwV_zHMT}(N@n@MGautWLg;&C5Hsvzp(^@7*`R-r`IxRQ-Y_E} z!RHe+X9s9wF#9n%bTkt66Ha$Iv@dqHwG|AvbonABR8^`=H_UM(&VJPXE42gV74ZE5Spw`o)-4%-uPG70M=`iUN@6$}AIq}Cg)ol~uItTZa zt4wAq!fTYhS%yipNqR!Q9{)6;CKrIDS2f5>($rv3oql2xX_NQi^}4Q8Hh8K`k_roFy6fhN zNO_w)LtEvA)}7$bSMpMTL7GL^zJu6EzEhQPcp)3C5Q;9t|wCRL7=O8@=Q{@@zYZ^KR}FU;e>3=Mz;6i?8Li@_rd zT)sOUT@yT|qOeG?<}0c_%$=XDE7pTx)SE$z)KBC;z0@3lI+P&=b589?y5g%@xu@9g z#5lp?TIyNwhFUcjrq!Y~#WKbE@B(6&D&<$WwLZIAfXeJzReWRV5xsA0bHL>n%>aFpjzTDG^O}HO3^0>?QTd)Qix70=L1YtXM$QV43Qgij zq*+0nWw7{R_rQt$jp@J2#m7;d^1Vm>keP+$=g*%L9~ivqiVC~ZUUS;FJ(agXk+-V^ z1L|$yfX3EFYwzp1*GJwV<%1-rv6|WW`T5`6o*t3sEksdUSXfvdtCtsl*H}d7cd*VA z%OdZ_K1LW4FC=w1om2kHkzmqEXRs0c8|76Jy8~EgZ#pu#yssH5byibVmoK)6k>ic` zNb+8X+86K0mBRxnOe|zlFogjc?}QL45u6m9BVwNt96eqQr%$@I1&1I-pn$aIr#{zk zM)X0SW<}BjLYQ2t_FOZdu*TV_DWede&fcGXs%Ipu#ae&2?x?Gn|HYIQT<}L2Cb!an z%5L8J{1;V3aHHHsw=hqb8w9zwDs%9t+6i5so1|f=$d5DNljY2}STWu{`XAdF=&|`s zIE=7^C1OS}a+Q+FW@PYZ@P$z$yOAP3g_wft!Pt{>S0zN#rloxKEe^;?PIX1IJt4v}3ysV&Dum&zSJ;zh{Jbqo zWya+w54POU*}@s)cNHf9E?FyG;vL0MXImbxpGjb1gJ#9BMkMa+^}mcRfXgKO1pj&&t&GHYR>mT9KlS{u z248P{i`&NqVOhZUWx^wbpSGO`_QB;25Df&VG~=K^+qiQ`yOsHf z9r@NryR)U-&gP80I65M}ycANiV39;UwAKStp}&ql%bROO6mIg1xwUF@X;xf?M+5n~gSY526x%9r@G*eyUY@!tZuHA$^SD6Oic3uCTkv=z70z{-VNb%F{tGQX{ zkusPP@z~P>9g)@R;{!!KdNQK%9-(I!-(g|)Zx9;f-|V-oA1>@lk0-V3b!x{r2i&J*_Y>W4Wm2I?y*Rv zKfP#QQRH3ZeJ~tyb29;WT0UGjB;cMZ_F9YJ!oVBp;Rk@~YdG7`D&xoFf?)G+ybw=wUvy1AugC2QlB-usOw?=f~Z zdv1OnAT#W|GBt($b?K z&+IF7{%!`vFJjgh*#8A>K$5@CK}OS|Qs)y9#>WB30I)%8LitY82|$pPUcFY21>gjZ z9J8ZyoD_JG35NU-#N3pHQ%<^@Ev>O~d=_MHKLtSXpaN~@ekB1G-Cu#0Mj%VS1?VJM zolbiF6lmmj#{kKkN!kQ8LIAde4bmj#6wsA6K+@KxYG5#h)?zNMdZihNAbAz=a-fQO zQur9WZrA^|4cTM(ws0S9Z!S|5uCPsJ!w!r)07YJvQHR-<+Ms?qFbELRuG6}vd;&^( z&*-~wR){a^gJ>l>`bms|Oa3wcQ}_8Gi(*_7tyC8zap_}s#9f4|Qq_em*m(^5g(4hDl>36EuNUwNH$Y=8M`VnyCMh_G>I+m=tMzP$<~x`gzup z>;-rtE9ac9%fu_5^d7kK2@>Pt#+7Rc=;IOxML7~(B!PGR;DYMbX9}%SO!VWr61OsD zeE249i5N)LC5L0}C!*_0I_kWR8dm{mKRNniizH@e^J2`r7I;y{G#?$Kt$XILCaF zDH9uG%B-kxUZ~wlqD$d1KqhU@sPh_wcQa>7E2vW@e6&^V)-}y(%^4-l6U|+jTvdlB ztSUh(=!!n7Q}^g22KrZCAGRe6*qi79 z;gH7|S3wiy4#nc^fIrB z48PW2@FNeltlN$rvI$U-{G(HWil}<{>7(!Y9XfMK)(jt)bZ%}wfQgb{mVb10X#veG zZ%*BQe*fs#>k9n^|C2fANjv>xVRr;@QzyD+PG!ywdf%Z}rjK_ibjprS@R^-&=7yK~ zGE?5m|^Xg*Rh% zuAk>kex1y{nQ~n{9hTo?i{ex?h`LAPi9q;toq5R6{%0)=WG0i=xoyRS67COpy zpZ9{8iMgq~yxhL`z3(}OM2txUoGbIHdGqGkCqMZ~+p=Ygee7c&bDEGZe({TT<&{_3 zRaaeQ|L_n0!22r?Oy(B)YX0UW{i?Mp1mjVOnTUIdYr$!jkbGxb0n4aRsGuN7t~5Pt zalo6Tj>;-6Nsb++Lky;Ro%OV_&lVWt#!Vn0%xGW|I?`(Rfj)G*4uk7Z38Vg9(u4 z!hbgkKz@RQoz!rm9ZwIyXIJ_mymRM<~|O)6W5`AZJcK1cl)$X30Vy%qhXer4vB=mHV{8gw2n{O<#icTxeLn3K@K&njp3N&l zHrDGg76QMegj!YDRkhoJc^CTDwVa}5l9aW{NGU!f)2{7e(q<)oih*=sv>!Uv*74B5 z=Y~GYwqL0Mr*Sb^&OB^0;`JVu1m(x$L9ct+dNj^YP$_b-kA>@H`gfEX~ zXwQUWp2S#*Az?P#B$}CuQZJ;iN{}=6yn3`)-6=cThra@ia*})oE$!L_5QFPeo5VBS zvVn2BM}6lUKv#^3GsQyN(K}3m^j!?w*d*Xxa}zKo@Ls41x%0M!edD2N@_1U17#wr` z_+hJ_IAdAbsU(IjJ~?jh-#Bjje^^5FCyl>=J`Uml^w+P3!8j7PG=$O8TEu3GTQ-zf zCz6>Hi?6ldK({UG8L*RqE37s_C|j5Y?sjvm9>%kW@$gc9UTEMcUt{5R)}Tx=cj4)z zH4Y6DoPfE_29nh!H5~@vo!fuM9$)&Kw!h*E@~170;H{y=G4Mk%7!>^dGwQ3JvLy?@kwi{3E8h)9k#!?H)jJqYUv9joYQlJ`JAOKVlxzu zS8GReRt#%-VAQ568j#kF+Iw#a+n;umSGa;Aq!}5VU`!yAnwsWWk|QX9rnH#gN(B{w zN%rTT>&$E5kAOtxRF6fkTxqGJofcWwVrgE=;l=YT4QLA15Z`$+?~D&OoE;z_MRTpC zxkoA7)^Of@HqJ(!broJ&Yg$~{QI-At2@5T0(t^@rd!f7&)S1txHq2_vvSv#iJY&%f zZ4UT^8Y(Y%%mRD@jGJRr^jz#4vCzW07v-OoPaRF9HP&e693@3q`GD-q^>*Wl@g z_F44eMV2}O03IH*EORDB-!o?b<->%2AA-s3LWrySNde|lZiFW@U?)>*~*lxxpq`0tfl*>DiImcGQ7;uiSz*i_w^pFpLK2rN*2MRI;{M0~yvyrUPN4 z=D3^~^UT0`^D*aLewcARr`*F@1D5+l+yr@3i_K zLIq(8a?=S5>$j2!ruI$@S#kpKS|7CWQT$s1EON|Vrf5e60F(&0E(Itn0u=tUHz({% z_b2VI|8v5v*ZUu%Z0Z#t)@F?AWC|@)6^z1a_VCzu7?YM{Ii@CT0=PHaYCf(S|43JP~l;I?;vpz|&Ib-WxZssQt~| zX`2u5-+89Y8lya**%6&-=S;DJ-C4IsizunktYZGeXb8T_?8@yMfts%|Gh!ca|DOHv z{5zn5H%JZm7p#oNtTi%hK!3-0Eu0szbtiV%fx&5ea^Ys?{DjqG{x=Y)v|H9??OB<8 zvNVEeG#NB^3LyTz8^iX+Z+BQ{mKQ41L}oz&Xe@sgselsrL5c2qw%S>wW*LY<(tOk> z&VC;kPanp73RF%KV^fJqTB^OzMv1%-72rdI(>Q*@S~87x*}ROM0OaJP@*tJqf3c;0 z!g_Z7h4r;;vZk?pw&C3K_E_6xFv&1ov`O_#`Y)l3tCu>;;0l(amFX{Sw$_mWB3h+v ziacVL6*OOi4hET_HRGdwj6!-V!T%tG`TZl~>F zZyxQ2u4q}Jfu2JF9y}5@q)~(9$Ul*b+4Wn$Yme7&wpy6g9Q0$s*}ADic6H}r`-`@> zSa~pIBfL8cY+F!bCkEDxaK=TjSIwFS_W z+H=YQlnnDc4C9hUQu)HMk>A}GT2Kq{BuE3Q&@7T&aft#KVpzQV7sy9Hf=C4f^n&#j z4veU8q2`*|s?4%5 z6Uk=}1B3vDBZn=#zSV4AwI#P6_7)tVO2CL89_^uD5U0s3TBID{$W2r=5V|A*%z?Uc z$9SanQ)d~{W`Jny>a`X?b(y2A%qc+Lf*Q*lK!Q!38p8k&r0m3`g#d2?yXwDFg=*0f z-aIoj<^Z|RG^x6uHU)T*WsY`P+A}cCjGuZ z${_$tG0u9R1Tl{e!Ca>(F8~wn9*Ft-1l-fi1JN{(1mrD$S&Y|HF zFjmUI#PITE>}C4Je;8J`p7@bvtYw=jV4Z;x$ufrSA;>z&p7P3cM|DS9H8I5PfO+Ot zMn_VbxIJolB9=Q9!FzTZ;7!IhPrhGLYrovq(e~<_{(sBjC zS6Swi3CwFvGCzY7IxwFl9M=3(3c}#MC?5>G`W&og-Q+b+K}qU#p7m#x?aK4>K~Klj zz(9$S2y)c(DKwAy4?Q)8$tMna0tPWZ$|oj?wq@03%Csvpi%$~THh@@(OlQV=Emc}) z(di)oOr>4Zb%2OdfCVj5?oCI_tOn52g0r&btmbG2O+f(WpgDck666mh+blkQ8g_*R zfb>`(H##*6BrUhdV7o1y*Jy9uoUrda!%hKY$^aZPXftkDi`L{M8WkQS2#>5YsqnE# zYWZJ@Pe)?B$EL&UsT1J9#OIJ_JXkoa2br)`u_woZ$qs90eaF+%L}2~|h>s$5&j75Q zc?xYU?>&P=iU%SOZuvmu2GmNfPYl|!^by-#eG!t8)BFZ-rI^4-qqR?jv;p%=i0}mn zFM&}JFq4@}63P0S1OH@KUe-+iw`d)yc`lU$hNWGqggMF%A=yU@@W#X6ws|!lu-|=S z+qRow0Fh*~pHI?& zXlxTKHrJ zC0QFJn$ybZE?YaW+YX{#Af}g-(xeecW$_UjN3=bzy6f7^sgUwV|?V zn6)HhUB-E!it~l=+v*=TbUkZtc<1#nXE_)8cYF#;B&uyqBM(m3Uzjbl1qv(>6?2GI zpfNdQed(A*>SZS7F`|mJ)k-^8c5SozI1(b-BS5Q(bjQK_Z2MUN>Iqcgb+sF--!YBDynHI_T=&&IZ9JF*%nT;V zthVQ{H4YxN+jsw=CCyEgrq{noy3+pg50oo1TJ43DRQEgU{%p}l*U z7xgZzbrtPT0xWMB*<~B2tE?>5XQ`1g`ZsE~UV)#}R_61>FpLLUQ|z@A;Wopr>y63N zNYg@g!}^FdSJP_hPfYW|f{sJ&CoNI8oDqrHg3%sZy)kFk@ID_Mf*INRw5@&Q@2q<1 z^^R!{!ob3FT6}oWHlAs>p6Lp-I=tlg%**xJ)N>uS67W2Z8Ctffh4slmz*Stb|7nZU zt_+i1w3X#SfR}B}6w*CTM0nYXCwZ-;G@vwq)G;Y=he?QcWUd}z{j+#v#$hm$0vB2d zdH`h5diV=VW1n_qB6mKBx|Wk+YpvIRZYIGPpVbX)|po z%uk!LhnO6a@bBh+#wEG^xSP&NNtQ{;9VgriC5v=e4>%{e)N`H`puQg~AIy#l&2%F% z_a2fS_~d&UDY}@U9A)b0z>^pNwMBK4{5nKWfg5RPG=Ch3;khfb8G365ljk%&ysO;v zRi-a8rvZ#ffP&PI>wrnoRUEmb#xRB6H9bQ_GbW%^f_xPaS5K$z+hu8iKAy!gft`gvS@vB^jFehF>;}W^=dUq z^!X_g>n=y1q`?t`CZ^$nWon%YqyqM*pE<~U8FX{TfmOhvYcq5f_!MxTNz9e_rOTiR zrZtZrbijD#+WEfFXQzcbd=4hFn&)%|iGRXL{N4R};VIFc&^$CrXd#kMAJI=Yw%)}T z{wlW^4>49UGcv|DD>EzBMDpoFFJ$DK%d7gYTII}u^tzU&Dj-lTpsysxif4})Ehib_ zR50G)F@PL$$?T=nGetF8r{0+6B3559xwNNIE zhx^SO62m7AN<@x~tUEO}gA^ySY+gQp{yxBb@&KC1RrB4NaC5DjNTy4h9rG4{!+N)7 zL(9ODXQ_{RJtm1_rQw4i3(c>#44N&a&|=#0W8@33q&`yeDR9`bCi(_4C@k-2w?)=3 zL|D)GET6D__%N#~{v6lIdb|<``9tQW6Mb<8~>E}*3O|BT0NDH)m zl;_xggv1o#mHz6aAP>kz`*vE@x{GY}vBzy{JZQVBuC_XyIPYBDVZYnI(iW$BZ80WH zD6nkpxt-P(D6vu)hb7rw>o2Rah5h&nZ2zH6Br0rPnulr>30MTRJKSTM#XXJbRo&oT zTXFV?EnQxL{5WN0ox3ep-ei^SyDfl(?GJ9pFXaDp+vu@}y zw_asYoXSHyn9EAST*pLb5Z{Rt><7Vvx8lt6_RYV$+&wCP@6JA?o z{e9HH@3e`XyX{Z!dav2??^-4MQ?~-7564j#A{k!V{j8N9pu@}7*~s_qw{pgE=p!Gn zg-!3Z$%boP+2Ou%>-@*Rv+SELp^Vi4SIm!)PUdR$LW9xK!-mQOqb$m{W}80SZh{~u(|MM%)+Gn32KQF?v!9I)Cl~}wqVpqrZ+sY%1U!v67&?hPamvO4=A~$NK;5nn`ZMzI1NORu-zAFF_0~6nxfx7i+!!0QD*P?hEs59| z%*}WzYz;vC4|UuNwJ<}-zZB)5-9!l8Fy>ODII=Gv-*1ZV&SC;-c6IWU4W(Mq%%G7%z!1gj{?36X?HH2pPnBP9)i7%c zPlZy^D#s|BHcY_yN2%wIga}bSY9OhzE|I;?Q^dejT^dq)7y^b;Hfqh$Q zYsPlis`j*9GdbT%#z$>K>Y#=DOKqTXv3>IJ=k4@{dH7*O9mB2H@9N#pFb_IWJ|wJp z_oLSQ8`mJrD7X3ebsd1A8#{c+rlt`o6ambx z1Revt4~CYP^~V;6vazJF|V z()_>zKn*4pGEK?JG)XUh%8lN-(P=#*Yg$c`{m9ZL2LuDPWtbiT&eayROOng}F^gcn zqLkWs(t_lXS;kM4kFuNu7>!M24Pa*fX~0RFC7)#8(gq1fT)p{x(rO4`1uk9c%&we? z7~o#!SDG}EZbvsS;n@Oc1pEb1%?Ins97v5Un{P=>(ZWjscsy@p>Xm%{q{X+abl@t5 z)H*aDGdE1JqH9|%x$~IQphQ(Z05{ZD=YdPnO)7urAE`$JvvHBreArr~;*uKkj+E3m zEAt%2It)!+8_-^b7@sVrX<|a9sd0|OJRg4Q#7j(bB!1OO1WtOZy~F|{Zx|Xz-h3Hj zjD`!k=w%e(c`6N#Ycl{b#9RqVVlyX6a2Z*>aL(D6__?9Y(~yxRfSOmDqQpD4yyylw zVaufL-#f*xUF#UV0021XOzB>j&siAyFdB$-yR;twLo|tc&PEnBqP3!@n0{%^N=p)k z9)|f{sI4At3ns)HT0N67)-XMD^Hk-DZps&trVTBUcf{&~Ii>aK7!0%kS~D^k)F*|X zNO;M-g8bYkle8%q!AqAwaON{ir5!_xK8nnf&?J zbjtt!W8_oz_zmkk=3GBWv&y54=w-`XnJ*l@wj^%e2q7^~yo_~6zTh%%4n<`~$8RyV zA=#ZHJaOgntP*qcnosmG{Hk>lu6TU+bGCHVFWcqMeBKt^{C0Z^Fnh_?M=kuXU$^=z zzi12Cz-%Ee{wY9G6&j8nz)#6|r@i~oM{VMDcUZ+Zdmv+O(^XY%txw!-hvFM7R*jj( zSk$iQyvME@Scqv-&fa+9n`ka#vJ$oqI44!O1z2{4OE5}y0E18R`a@Ibrs#QoNF_#sPvJ89F`UTzJsNn6-= z#xAKFvu5o{(cgSaSV`rKKks$M?TX)C*T*(iH2jAQP?Bit^H_F1CikX`f4Znvpl zWA`aQf(-TO2)^l6JCotg*eZ^Hzq65IBPzA3x`{kPYZ+aw`ulMlh9;Fw;zyvg3! zi1XIJK4@!V*qT-W7AUj-s}Ep$B}NL9yU{Ky3v^Qb^)^vjZHs#Vjb}~)h+$U#@`skH zY_fOm`X5$;M(bZ%-fcl7<_j}pwrbD)s1e>~sZpYnRn=SXcfW1rQ@z&Q1GstawEfzt zP8-`R3Dz1I%^~&)k#9qZt(`h-n*t}T7sj{}TCM4M%$6s*Y=7=eXc00t52iB`#m@ld zrk=SyJ#gCASg$qk&^3U27=M^%)`5JPWXd*$=3}yBx0N40hIS)h6PO;R0_`xb0NQhv zc4jC0eIP-Xrfa&Z+u9!dXREn-jZN>~Z=ue1t64l~i-voxqA_CEq#MYCv=ZN{7~|Y< za;M!;-D^=8_1mw+rgqnETX;#GJ#-FrG2Eygfq^k3v!uj8A5P(E6ig#F5d}m764oDo z$Rf;zDx~x|{1(P=LYdgR7mZB2mFwogBbLD*Xu&x^5JCjm314^QS$p7A6l{V-nw?k6 zrv|L7{fy1eB&-HAs}0@%LWHojRy){j^+TAi5Og7hMq?BPxc&e63#-`wl!Ypq?Z!^D zDboXX&AtECDn9cq>rJ;?+1a>_K*oXRcG)Ed`)zWx-`=|TV(SM?EI#l(TU&asWp8*N zCRJlr`^dKdt^h1~mmfc3w-5dZNi*6DqQuRgIBl!XJz=}EE1}aVyY%5dCHfS$yM*eV zd~&zb`o#th<9t71m-g;L3bxo1sr-^#<5n_>Nn%gXR#=bKw;!>E<(OK8M=dzM z&)!m#wRgO=-lo1eVrOGG*)u0(UNC-walou?4AX?bu>+P^y81Q4bZGtv;73*>^+VDr zfLj4<*pC}*w5@R8zOmzlIyf(zH!IVjANY<09cTPSZV9BS$nTCki zr0C_#EsQCQz?{^W0%tNw@l$vbO)|_@kd1{L$Q3}!1E3tjj8Fr>mww8WErk7k2;dzQ zFd~HvP)f>SBBnOaN&TdW=iiF`9Wwb9m7FpnM6jEPfSNX>AO3peDa^tJ1XCw5Ya@= zTORr3|EByiN6o9IYFDZlAk9scr6jXM>9L#aLXj)U`=@!ptAHM#zVxS*K?1_sj84 z=Kto)o^{PXSD4X1=O6uRyccFA|N6@vSyL|g`TRoizeAW?&PsFh&ARv+`oVk)ee@6C z{%2EglMn8kwvzG&OhB`?X4TT4c`wg?>VMc&eA?=f{MPJ#0vqZjR*tRn#U~#{9sH!V zUVDSB#*8BV`~%1=(v})WB7uE>G&^JqN4sGp25kEDRvgN+HpHeXP2HVVy|C5lmb6)P z_g0G!4O?QO9n*|swiGG!)G!V{*ef<5v9CyVBITXNTnp(V((=2@Ywh+YzhGBa@gh3* zEE|xOSrQFPFJP$pse3Jz9JA_03oLki%z%AX3kX?|Ew^aI7DT#SfDRG_;Z+*&^E#`sSbJnJI zK8Mu2+`^|&4?;WH{U>q8PNQAOWk&2E(!OPY|3%{9`sB?ayH64zx}&8-1Sp8|PUCTtenF zD(kI1_;Pg;GI$iG6R?icS^3auOOE$iIX)UkG4gLce8figZbi_KQzg>V$YhU=v4La= ze~xiX^GdL#nI1Sr8~{%WVvK7HB60L<;Xt#Fferi0GCX6116JJ z4Z~PIatOMyL0zWCy7oO}nWv9h>Vac6^6Zb0x&Tr;*)yi6*N(ziHuM~^P=DCEaE$Mn zS7*OQe-<8ijQO+A4)WkG&z9NZf#+;J^LKuCkL6B0g@bsrJyLOrwd4-k!j5OG4?C$} z>*})Z*r+XrRs&D}tJO#AZF2II9go6TPmNf`558>aQM4VgMflcC*rAf+_J(tqIgNGL zH;0fw^&Cf|!#*g0=ooaFKYiL3-TMs~Rm{8^SJ(|`{Vax5e&<0;^z6f25vKO}r)}dS ze~s3l*1khqS9I;RjU6X!>MMU}-SeAlv=e8yZeDGszO$$Xq)S8n=!_($*b2jzs$uOcrJ+ z&@+}CG^~a(!!PTpeb(K-*XrJIy>*;9LmP80RH8STe{uiHv_vo3 z0H9iq%Rzuj2z%-fz6f$O4FdR`1Rv@51@q}1X%&=*dli;Uz+YfWz5~HB!Z~A7A;;Ll ze185}N0^D3{3;L0x7wuSndcN71-@YH12Tbtr$1`sIeoa$5_nZAV(<~fP~9AH!k zN(-tke*Jl-0AuLJZSH*b=M{{E&rFSQnT^el-fBR9;?&-zi~z!j0B@YMZ_F z_3OoWyaUE#3dSS#iZUKOpMdeGD#wgr5}=8sDOGRH2mZ+dQ$03{RCla@k5%p^W-%Z| z4w_-|q2RVA?PEdIAn*>rJ%tfgz>d`*$sQu&LP>=+l$O}UzO9xT1O#RJka(X)iYaw# zUbPR{j|0>rIGjo4Rs%|<47rMd)qxuT|NWJgpJ{k zF(H68m9WX-y*ALY2;1CFt2_iSMJp2+MO`?2#`<^(eg#!($-y1A>Dl|xN>tg%v8OCm zgOd_W)9CP!P4}K8CNq1K0Fpu@Lss2&(uQ(KMw3VZ&K$C!>~66;KOHHznyypetO&ju zs1~t>&dFAs1t=PLwxDPLhELc$_IwCDaJSvNZk3H7&8lrj+rcJfVSG?TGw1k<19J|L zJ_e`_J@%004j#937hnq@Sc8-}jf6Z5P@M+cVYy6R)Ttw9tRAgP4!@eox+)8FVeZg# z0xeXdC5SUUHP&wT*M@9ee>ah#U}C#=T5xc{cHofM43OLMw(BkWt-nRuTtXn4!#4iR z6PQt?Y!JVKUl-fOjeI6}6cu?O4cTjOw-a}u9EcGR|>MtXb(O-kQc z+h0>^U6>D5o<3z*!}AZPJULgxNTBHFiRP_p{hdHEvU~G&nBz^_nuE_-q|QkLvELqA(2BD(CI~F1 zr%GTdk`=ZVrm?;66rl*a>_layEk_g31k)RaNt>qZ?Bp4Xp`p9J>pq*FgxMK5fm!=F z%+|2&NS(7bK=Js{QQKLL&k=oTE6X}x3Palv5L1O_ZX`5qyGlmw`jdz3Oc@(J4xS(y z)iAzA5#}`;>cLbth6ZhN2nLaU4Tdl$p{|AaWK`f#o@PA_;X{<|BQl62PtjJ}7d&MR z4}2dd2JG7>Pgo_OIMRFA>Q}!T(+t4-f#aCBjoL_b(zc^ia*vQzE5M50~W*Y<3~#u+rvn^u0g{Wz`S8}*HNx% zZA0IIr%;`<9$23(z0cV3T!)R~d(?rM;|A7P2p=!E?zR5isPTu%KXvjrX4*)fWu_$? zEygkjU<#05&fBmOXb*T&z?`Ab(5RD#ta@4UY?xA%6?{p6j+|ufa9+;~{mlW+jAum< z4OJ{$X%n&0N++Lx)}F1xw1l-4nP6Rxqjf=(lE&09GTC5BG;H0^-G^D`LOaJMsB+G2WizQ? z^d!4^B?s088~{2Fbm%)E#CNKE>3km8@bk<9Ba|Jif^pE8<{5&SeEGUx^jrCLU;euL z@ml#)0Os7Y(0d%d(7Qa7;XfzEV9X@{UjLkq{<)b<#V0CP{{d^-@!+7cw26TE~Y zfJaFIam90t!xZO^S5(^C{sDWmu^BBz9H5JolNVY9ASS0$5bn(U@E@-s0Ef(35`g5E z{xdj-16^^PR{rEjI}%mQKwyXx*f0*`2k>xJjV;H2;4q9z6AZ#+8s{jqA3Zn>X9fY6 zFbOB%!bdT4%D^~P1Hf834&s-R=DvO#MUp>W6|*ygJ=P63KgOOCX8Zm+JgC3~K-(?}}EVPYzKkw&ADilTj~8^!JyKa?bZ zI*SAI6AiVtz8~#HC)%cSdkz0w3lb4%Ct93+)it)_*kS9y_&c1)F` zBdM=7FoID4<22@WOS;b@aXxDu)s=RxtQ?I+%IX!}h}jT=7E$^c#6N%mXKVo=`SX*^ zh3yx=9>?QxTeE*B!3gvs`!f}siteP9@~Guk_ax;M!j8qS=v z)~=&gg>(7S4fx!^gbkuyJIfp>W!*Gj8kNI@PyjrM9kF~66gVL~eipx!0c$U-X8hvT zQPX5gd(SZ+Qr3dD4kIJ9CPWs21m*0FGY!q=XO~+A=8dD7LpIU_v(a~wem-Xh>Kh1L zFlEgnIEONC+F{gMnL~Rj*l&lBfMsL!aiSYWfb|os2B?o(AK?kY^vozk&Nb<&KRH**R%?(C95aa}do;#tzih+rm!hS%&EiLX_Ix{nmpCPSd%A zmhCw1=1L1eAqMDkQ|~FBGt)NMwAM~jMq;er#?izjMldsc{2@En0G$^vwiW~<#Z;s~ zkpe{u6e;l9rNDm}#^d#`BIEJt$1wc?P}CvG{KPH4YG-Sk?ZARH*o|+uot&Q!fc^Zn zZ??a9-J5I~Qskuo`c9ct4G-HN|MG9yP5ZVvDQ^-pj!a{N4dF=sY}0%@SXXaX9N**Y zwFNq4^B)#q0Z0i*Ogm|2zyoS97ZZT9I!w(ZNfpy^t_-JafX2P+F0~DqI^DN+Gtqn| z?b*6ITYMIiqKddZ@uoYh3($4X(v^1Okv-P6;Bq?{9I_9;{R4KcqTC)?y2ei8*c}I; zG}7+J(4ZWzZ?wO;^Y?8B;cGe?7g}Pp&;I_pJ1~*L3~WIY%+fh~bkPdyEUyLxrR@io zy~X~jZXtH>!?yh75&M6C{SWN#S6^-GPVcb>fTe)XIAK=>n2uEv&4<1OVJ^OS*^SnZ zR$>Ha;}M*IZ{5Gk4%gS)-D@tk_IWL~@zhcK*NZN-`9lNtPn%wcRwQO+^uH9XOBAL@ zpzH58T?@m7LoEVEMZt)0{>haaY{!zd)_nS~eQWV*n<}fY!!U*0+Ll^3;H&$$ej91- zcKh;`HxdS7*dAVesS#Vm{_2;1-^NOsZNZTT?5kJZYV*(S!tZ0m{^)IgWIZd_+2X_7 z?QgHV$*PBX?5mewVX;FyYyl>5Q}k_+Xjb!KOf_y@Wu^AOqGk5y*T2o~p?wYAC-JSw z*h0o(3a~E5L(Ih4%4!(Kq#cDO6@a>4B4tejI(NSAMtnVzcJVWhvO{$QCN_-OQ_yxa z)Z_FWg$~s?_p_-F0ACE<08-dDAkNnE-*}bc;uqRsA*pJ%U(A3Sd1>MJOAEpT3 z*tpr=wH33trX_Zw9-ksY2p=phx0Ua>!{SdqZa-SJ4(WfF{o|(B6WyrY{_(Om*yhtm zZ5WfG7|dOYHh=iGU&oPq(!O;0E$rnmVWXv0whZ&P35Y*HjM(n_COZKm^YG%O_Td|U z)viAL9DR{3xyEhUj={i%>5u#^CSf+mV8Evs|KqHed)95Xk3q8>W^^Zz1b_0zJ8i|e z19lFxpUY5(j>A~}3-h=hGr2CDtt((&cFt?IN}{BFztYy8InMZ&+Bes2w7t#ERvV02A4;U^;T{_!lQC>XWa#*|sihv1^Y!Z`0|Y6cC@0*<^jSc01w~ae5K7lMJTw7uCSd8mRjQ@_t-PbmSLKN zEhEZUFsy56qF9(_tuNzU)$d^OQ@?%8maU43Ym-M{i8 zsFOy^khG88^iB&dUTg2X@hbZaQMsiA*CB&yjERm-9*I7Rae`y zfaDy}9xC7e`}V*mKW@LXajE_8Q5@uP0^46zMTDacdm8YwsjnNLCwD(Y&x=~^mjV7; zA9~OxkW>#=R1rloXWw7B(M~tE*l1OwUAOab`@x1Swu%To-?-wJ?2qsv{KAt@+8^MT zatc7V9x!@ipvC^^&0C0Ub;PcO5okg4bQIuw1h8~H0BY;XOYQ2lDI3Br{_fS6TX^MW zY=|o@^``%9mt&uJ{L)M9p}q;*x?~mLc+w89Ai7G!`|REY3+;9E>HixXva^^uT(qjq z_BDRg76bl2Uf+V5iP|R zUR(eGKmbWZK~&*Pk+OizKEjj^z+9BWWRwBI4`Sk0K^WKvHox93hbhdV)tNUiXw^7v zzIEl*_L0sJd+$Sc*(n&4B`~+>bnKayCD5wIe*KBFb`r*Ot@jG_?wukMK1H0`ACS6qx^Q`*6e8{$c z;-hG`{(tt)0zRr^ZR5{M+}+(EA%p-y5(vTF3lyl+QtBQT#6Qo z6%85^;t4V0zDd@;XLb`BC{QExqs;sWyLmpjOy6Ln#U|35MS=b9-Z(gP90R~h@j4agdXBB@%5t#EGXUEy9S}|n zNDHrz6%~7by71Mi4cHkNjeU{*QS3$Q3OL!oD!1jyR@HvJ0g!nkD&+3NA1G}+jz%UdJ z8$sWDT035R2(ApG&gqkgZ+oX;6n*vUsOUU5a5xp0aHJ)M!i!mX3f+Qm3s)H(!5Q4= zUBfVy0!o#O5n~v5{w5c@N@Onb^~}jUjzKA5S6zwyX@wXX9gLpo#dy!2Zc_BA_n~id z|K8p>(ij2X%37q%oP(VQ_QNM606k**U~6^>?u(7$3f@-uqNE(5J$m4oMNi^`s7Qo1 zWg_8*`FLQ*0r)Wh(01S;W@dT>TS8*#>ahZTgObs2`Y@Dl&BXUZ`oPxN5kGDG28aEl z5Kh1HS_ZKmpzu}3H9eeTx|^~@Bn*thGxZ8w&6VGmQ9%80_g?f03*}0g(I_Hs4Hxm- zqV~qM;}bFeU=AL>dLdf5hQ{PUv3P>B!ruNq=*KKR3zFmT(}`-P?BzA3Wx{e_CPIfN z;n_o3NQeo>^`7onwQe`!Moz^?m0TNvv*9;(3qXRmJ1VFYe9lZYeZm7!%YbtCtFOeW z)KvJy^}tqILaeAz46iew+pH=0GBpcMKA!kFIuW58mm|y8hWY0mP)cP_;iSaIp_9>j z??!06ec(lxl@Bc<@Bl3YuH>FX%fO2^UZ|Te1tr!F=)Q3?6k{jg#-813Fe#afi`|4ZN#P)$ZU2}Xn`)y>3=CQ#(T;p1Pz zcBmz`GxlTBz=0Tb(`<~QlJMFO|3h2ya6Hg^5T-G!NiY|b@@4R@Zpa7(aDAH;7f&=( zVfit9Fv8q?;L~d`15cf(cq%Z{!xx{1cw=);InwU7W)m*1V zk7BF0173OKRpiiOb-9Nv7Bh9}Xh%1?Lmk83fur#VGuriC@*twQkj59OhnRM^1kY_- z&H!^@@RFriOLxvND*j7`&NRg(jO4mJ+E70%$SA-q{LQ}_+aIqd#l!chuTXK%bo{%u z0yBmU!jlJb5FFSOQ~O0@b%Patu5&@Z$Y8iIvrJ-;FN5P7aZiLFKFT}}7fzlG)aVdG z%W4TNY6jE9&;`CZ%hO2$l7J*22}lB6MBs0;csxD07YKo|w71ZF!izWf5-&n&>)&;UHKlk06TxBIl4F2{7b*kq}epq}nNb4yw= zx<@ShxE6wY@+@Qq$070kmk{ksx0r8!fGYb0=24jWrl1GP=?_1Lf_G9>0M;{aeBb0` z+-Kp52PTccPA%XKMyDWDBz`qhY@!5F0Q zp-YlIDw1On!v$?@?JIE~{b#JAf>6x031$X*A)1cxN2uaWW3Kr$3aoK5wli_He3HD(ToH3hmhr7>WbGq86vM|uba>nD4Jpodo2^*!&eS!d2U-My-NrmOa@-et+$u^D!7EwZ|avw}s< z{hT^EymV#jb5dR;tPj7o^XHE(41>JDXz5zC6}AsUwpAS(MC@q(Ir@i?*Pe+q7C}c6 zq|Ilby3P0#>R??TG2-MDcG+LPfw&%(h)%eSJQYw_g;A@98#3>SO znV*F(6RbT(Nwr^Wljul1sImzeRMh6QQBNXQN`f(%2U%gzK6$?Uou@5M9()XPB$dqB^Ht|qDBS6N}q72@8s%U|rAZpv_%n#C->&6j9oXut%v%SPlX zFl8d@L#)8l%)#3n75`s>pPbx$&a?v#+9yqSs`U7rzSc5_w)i~gV6>erZk?+(!B4W@q!lZvDBuX=hkd(Kth4=_wFzx_#ZaOp)&7_*eB})isABcx1hjo8i&ST2`;kUT_izaz z8F>O85ft$I&!bRe`#L>Xl?Z*PBFci1pz5Ee)5|w9NDeY)@yy>M0nh8k#4_(^?VIWz z#JczE6M-m%(pmMrabcH?1^TBT>_|g-S$*eBhyXZ4K_y`{{CG$yYKg!y?cl%b!nT+2 zJ*#Ja5jopm3`eKRU)>FZdl1)B-E&ht(A@`MS;^N!fNKG^RbjtAn^LH7H;9ZKS7+(D zXiN2vhZ?bjgqw39pO`4l6J!0cW$-!v{+k0{HpJ*tJp*H<(WrVkY`CH5CPM{;57Zmq z9gnR1ENhIHDh}SEaPM6FYn&Kn4D@G+UqYBo@bE>X8nYR) zE}duoCiOLiyOe+ZBm65^-#l+ISTI)ihT&SM0k36;i61o~P}LAU%v(yi?Y?l>v`ncp zb0iWev3`AY>(+#CuftwsAtfIQ_2-?Ta5ftFB1MXKwC|_dA`hd;O-hW>^T|pdyY>*- zHviM8nid&Z;C1^&d(?iJM|>)^i3^fAH%@xfAbiBm$#c>H4e~J#Dm7x9n!R1?_ch3^ zdA7g`J#DSvQ<4<)A!%Ca*CFKyRO#>dee6+FvUe9dlBtrgG2!08WJO+{u1Kp$Bg8?P zGe9@uk9Vs>>%8rVb~q!}Rle2c?Iwc!b_{hGjXD0Xd`;BjL}-V4krxJ9!$Wmp zfg;3_zsrR0yCWb!rAtH9M&kOjBJSr(Pzw_r2FP18<&MZnX5x=8Ish%bGq7<6XV0|5 zyBF4G8$>F?cn5;R5S|Z*8bT>?RqJ*#BY!6Ua%m(-RK+-xm9Ku?J#i64{AfrW3_xCt zWcdDX5r}?B-#Ki{@?$!A<1syI2930W?b>)IaX_>sL{Uni5nCK>A4j^H?9(LV{`Q8;C@Dd`%8z5yc@@z=#rV+%3oKq2kylH-hJi7ngXoxaW zwQ5Uw+VGpU)|7osYO!f$2z=g~{um6?$^rs9LGD949Ow|YqMJGR*Jo`4YSug(VpHiX zu`WnIV!?vBI5%spyQzSR@CIbt8ia7>dWn|>Nvl-9odvkZ(z& zUH+ZF^sZKihr%d`XI_Vt`Zu1)@6@#KGhQsaFZH{hfrDkrUAJhMZXMXVX#49J^3y!{ z@oGR-MtGO+IQW;(xcTxYpz8Bs9z*WpZTvCknB0p;oJ$!$z@WL)1pmElJC>H`)etp4 zuX9;3>0{=_yms#5^>4%Q>i&gJECiR%2xuO?0=02ZXknyV5g3#Ow@3hAa zTT_z^b}X1-@F;v&CEk}Vu71)!&E&fo5B)pv7 z6SX*#$o3|QNV&$REwj(QTd>=^u6QycSS<$+!%HEQQI-rTPXk1l5|^a90jqVVdsXcL z08=Iu^3_dtspzXemRF(#O8WPsdhWs`b=)EjA|JlyDQ&bBm%;lfehb`_?T>~G`?gDc zTvJ%3GW6h2;ka*SQWp3}H79CYMh%sJBHN^@%HIpaiH#K3uX>brvmeHn2M3TLRmT%C ztRsPt{RtqNU*TY9pv7M-Uo^-PBK=xS??gkAevjqFc|YbalHU9(f?rqYyFa2~NO$Q~ zh&jafE^^7PBS@=^2rI6|JmedUH*%i@-n7as#bZP}rr&?=M@?X>`kzbg`Z6J4%b} zG+5hJr@E!&{kk(g(x%EL=cBt1{egL&iaM@i+s!xC?(TxiqluP4k;73zI}$lvohUJ_ z?%?NeavzelZTAQF?6e+JOH<|+1-n~nUIlFB&wbT7kvZHo-ed-Axhf#tGW?N^02)e} zV)dqpx}GYt@JGSeuvvdb3rSwY3BHD0Zih0Y-;#9`?9Pv3`z+u7{!qB7lcxRV$XhGp zA1PnJi^oe!CYQaD(TP<(;GaZeyWJ4yQU5N^6Gb2bGao;8QDA>~)D4_?5G%~I2U#nZ zxxRj=uYFh++vTgH?bgF-lQs23H_0psIKs<*hr2Eta%5lvmq}y#`M1OxsWfc}2re```4r$&KA&b+u*JrznO<{W7Hhdy3>p-@1 z2=54o|LmBX+n-}nQ!O-~C_aDQ**+2SDE09mi6*7qtq3p4HT-&WkNw-VuU z+9%*U7zs$`5yxs+TN`sqUfm2t6G^7CD#8Jd6>nEjI%0){;E8F1s&x z7e>#`biD0SF&Oy(4$D5jZ#g^CuyulkEHqy$+V7V2P7f!NvZtpNXYO)xC|jtX-p$FH zh5zMlZEjPLmn|hqW+!rmkEYodYuhZz{lfxkC{yPj!goeoP8N8`^`Oh-{XSe_G5C7471*N`y zz2eVY3AM}k+yDQoe?B1$;-h^>{`U<1%c=Z{aKLWQkonG)I9?0JEwC7fVUzeJSQROxo5u_Fp)A3C99F8vEkhH2R zYuc%-2#F<2`N7=971oay`*X8fdiN*d;AS3=VHbB}veJRd%A;?*ulZ;=5?7bYSB5Va zOQfEjJ12mri_r4LxOX_FI}Ocw#hHkwjVB6co(9%dOt<(aSuLJ+j-!~^59YE$s_^J- za-{*5ccT_!^Kl^5!$$ zUk)>8B^Q^I$gEHzc@A#f>*|t$zMSQ;;c+Df`K%%{i?Aqysfd7Y$48ozmQSPS?3%M2 zrp=OVq+?^6v-6F9HZo!>Ibu#aslTe`7F0HOU04nNxFsj(&Q8sGGctaQUM8Ghx?J+) z)>L=#@2E-Qey%3S6KR=K!z@VPQ|qILBF5*}KSn%B+>auNzf zI92tyo{^>|dVOwnWu47_Ugl?}AsDx-)^C=519GTFQsPLo)58kqL?MqZMgTCs|u29E@&C;ukR+$IcRS!HqTTP)ea zKP^ir^)IZHNK4Cfa?H1)e;d?5js%4kzHsLbZ> zqt$A@z%G}vhgEMJ)*jvucpWb>DPb6ujd@xj%>#@8>0wSUJtg(8q~rrapvOM-N~3h@ z<4wTKz44MA8cVc{v!X%dWt>-)i3+Lr;cp3>-BR+d)+qXa|B3t&TEM{fa-g(6wvM*Z zT@U1kF;u-vRB>1H`Wy8Xz;RNpY&u*lqFarl`)Ud=&}qfsygx7Wy2JuK{;PWitgYag zhYypmuiLCEj4>c$*0mK`{7|rrwg6Py%FP{b@@ard;Pb>*(*{Rl)wz34+Cwg>%)9E_ zp;>x3Fhw1e(Nq=Nz8cH%-5z-N=@A4AFn}&sonbKB>WglW2b8eNE?%a!X*qe+gW<9( zmA*uglnQIwu~i+?+?guV6hmgXGUHk#oQlTgb3`TL+m7V81}@gDq?qtIj^I9^T!_zC z!~O{35!sMOE7hICKUMUb6_@+#*@>fty>44nA{W)Z5zJ0@w~up@UsY2u&{KhH5i9=hR7D&3zfAI8#GZ9QB`gwu5HMCN0tlI(?EDP zK#QGNWM`|yBd}E7SNnbxq(-(H%7TV09ziGnCqCLk_gilu#5}jWS-1pV6L?-r5hDdV zicX2X>ZFv_wb)U<|HtOu<+$tJlvNe7eRr%f%9HkzfOl%@1-L=;2F1K@Ob(Btx)UV| zM{9E!!ujV&iSR-7S8i@K@KB}2X8AO^w>xB6qYY>pSxZ}R7HgwyNWzr~uw!g)cQ5Ky zec9P64>k>+w*Nxf#DHJ2QSS7KK%xYFZlduRn!$@UR^Y>xJWF6HvI#As1nEjk3@m6mrS6~nn!#96ZL*}}uIK4g^74KkDek@H z0XMF1$5^%tjY9n_Uf1}#$_f6nm^-(3z~1UyS3n`G^MGn#WK{p?I_lsEqr}7md7jnx zzJ55u z8}shifnwlY3~|0&Zv<_Xu?yKy(C#b$ro20ReTsb3N)r0uI}b(-ZnP}(j@G{&f@?YQ zuLGFp?H6nU4;p@qMIWx@*M`6oH{#if6o7M>gw5&T!dYrgc5Q6`;O5Yma^81SS=W@jS8w-2H z>j9Z-4+Gge$Z@0Xs*62qnz3T>)Y#g)oMhFgBwlLNd)a&8aSY91?s%Jg^M3Pj%jjk* z2$v1w$Uo)4BDK;<2a(U#9ktZ-G`{)q7sQSl#WSTWCZ5n=k#7T9E})4$T)QjkFq@z0 zHs`26X&hg(B=yW#arKc8ry#+{Np;2O(>FEaK_0p*t_rA>j}40ClRbMYk!f=cqqsA2 zdP*wLOj@X8@2xGO2_(2nH#4Hv!Y*zKx#Oswac;)0cxPS z8OHJ2gPkOx5BC1(g|&Q=<8GXzinOZCxuoR#2JcXD6kx2v-+*_7vEGXpUWwM*F$aUs zK}XuSMif2p3iDHHOqdGT0pz;txo{(VIrXH1ETuHTFF8Vw)?f}~EWct5_paM8^)CQR(8*G(4E{b(rx0BZ%?y&@oen&0+ zp)#5MIE{iIEkA{|!GE);yOY^h4mxtV-%`i`U%sF8%v9!W<>AR$G5l?CM&~IHOX!%h zIT5w$G>w3--Az(U{`dgFs>3E_56uvX8%uESDR>c3L}8EZ7{O=_ITB?gC>)4= z(V;#5!0L;gH#VDtPy#RIK_1-z4x;1O(QCPbivBRNBLlEWG{Lo@-I}ruw}a<~y#$&o z`y9EG7KC{Kl^qDBoq4npgSX~*>!Ug*(%uiFDRpW~J-x{EWFBO~qp*S=Li~VL{UJ_u z&0^snUxPT)7EQB$k9`@$x!&t1U)BJ2twSVnaN-Au;0$tWMmoW1vP2^ey%Y;y)K41p zws=CL+<<0>AU&g6i0;{L1y}8>Y0@N|WEfw*VB zhx-ruVYa=d3M0TSHWy`E?pc1G*#3z}17!X)i6b`0$fhYjiQXTj^jscU?nug#Q`1Jk z9~9KPM*6d`>T6gAngkLpYmZIepUjnmiEL8~Q3D_cV(8|;^)D6dvu ziEAth7io?qu7jOt=&*GVs*(*QZc)*=`UIt8dc)&T_;jmmv{r-s5J~h&MTa2@?|AFv z$9RItohn~_f;E$*E|u-GIA$?U9Yh!O+uA9rXmffj(+2E?9 zHAE_-7~$LDQR-xtV;2s1O`*Da+L(d0#!K>}pbGqNmHy=CIg2Zd?_D75)E_#>v)czj zyl0NQPFf&puP-%P=`2IHi2-RIuwaC@*A^OPeMx%QmnS4^1%p*5FXpp|jZhZzx1OJP zbXsI^X+KLL1}>JvPmPOA1f>}^`#G8om(=AS3p}t>qUTUA$37{2}~s(5w86 zl~O;MJe^J>atbcCYO!7Ks{Z1YCjO61vG$rYNndH6*B^4Pvfh9GMZv^CkHh(mlA(f+ zv^clZQJfC=yI}g?R{}~i#=Ek#;I`)^o+*KBp$y#u2Qq$LEd{V-o}R?ny*)9QR-v)i z9=YEA&eHA947yS<0FrMCX}S2^BL{sN6N%Qh1Al^}viiqR@{3_UN{tvT{+Tz&tf=)F z?zvKtsD5esVi+tzJ{3CrLj#HR;LSJ;#S|?C-TS;}L;L5xjI_#(gFbr7713nT)aFmz zwO?hHQ{tr}n&l`#Pt&`_H7MVU(|*;Pb_d"aCh)OUZP*8C+N4gceBE6iFm^4E74 z{x4<>zilas8f(UQ>=-F#<%_e3c)YIrovD8Kq&UqdrJeYn>j?x#3yk`zybCp5J)rvB zm_%Z1O_AcW&En}ch|@X{{!QdiNLt8BD0`Y3c5M0?ZOUa4K?shlXCfI$nbTNQn&_zZ zN{Mns(lq-!z*+VnKsKPOAWzKeKcPn4o6A&?TU3RpXI0LQ@JcDr+cn^lwt+3zRpMwF z*F8jW3WJ$?A%K^)JqgsH^Uztv7gQ zWpXb%2KiD{a4;d!XPDw4O&iQ7IF#FgD<)L%N;Fy*`c|;_uk1-Osa~#Q`>Nk?m8lIl zbe$u?LBn!%KuruLd)BBA^qZElAXQuz8GDb1`%UHpMg)WPr@{j*Dv49SYPFq1lVL>kgeoWSz{~Y=UnA zY%GJ^QxABLv5n+J8wY>cnPZbJWYLt5D<>v4esQj#3lO!Wp+7#tpPBL(6=R^`kBR(k zL01$)D{Uu;atNcII?x11i$)kg^7W>!3-B%jszJL(7np{FE4t{9W~QTdr#+{H4af6a z5R%K+h@jTwx3Xd`O5|Xb(o#rPiLy7RhJ6zce53WwWGEoRh|VTbHLHn3843y;1b^&qT~6AUL?W1g>A{n-1uIFRMQYc8lc z@SvPwDvtASeQT)yhGik&v(r&4j7RdYkMh%#Kp_Kb@x%TXhwCZJuPFB(%VP^Dp z_?qw<_iyr42)b^J5Iey>Y_11U*w3-F$U;0+Je1tVLJ3Lpz(qH&Uc9OGi)IN?jGo00 z{VXcW6@ZWh9g)0l?{{wxiwCzA#RqI0gL{9_SeSP+YvUdI#ETXWiGU`UeTX!5w zlJXB^Zmx~JqvFIxgH4;iOhJ4k60iBNY_;+CUoKnSPeC|Y~(C}d$pLaS+oz6bF0FEd9xF^3N3w&UXz z208QAuJw<0?11bv^wy#CYe{Z6+SZ-K7v)17@2iAGoru~7pVDd@U{TgR*wALI!(g2b z85#7L)*?5D+A*wVf>eo!nu_Y%OilvAA>D|hB`xTnDrKForBHmH^-J zCGHskZ+t1o{f|Bb6QsuU194HE)Bp}2Ek2*pVaT-}Vg<4Mh&E;o0P!72H2ZvW*KXBxM%?;Jyht7ie%Fk-2~P^OR2 z=kfqC(B-@{)maLW>oE6JBYU=j1q3ymR8+3HIv9ATj$a=Z#z3S3MENO?C~PzlvXSL3)JGM6oU3phoUX?atFN zYWk;6Z8x8(9lvf)U!4CU?hgAjnk%_?(Q+>Z#}cQoP~E7saAbcSSamh2aeg8f(Q z{?D8bTWI|6=LfbeT?6`tEr7H=T%WCFM~uv&Z7xM=y*?dY8=1yxF1Yl}M8xFZT~ozz z@wpE9FS4{G>3(T<>x0~^4%n&iRDb>_hveU>B>$ia7|FYo^==&50QLv|N5A9$W7~fv zyZ!Sj##f#%usWas?LVB(|0NC%Xdw$0y>r!tf8ze{aQ~ilG`;bhFiq{&zC77 zC9~}h^80hcFNV#({F}Y_-w$;8l-07pZM&#={V%ltkLKUlA&!U&@X=tdQNwpsYyO!> z{6GB3Kd)>B5R#Bd7|P`l^F@pQ>_uH8sLg-*SHkiCc`zNm=&wnCukqzUoleL9&hGyV zWYZI!`H+yderZk;)-??+uLkwM2E$DRp=8^v4FX%b?l}L~-G>oq9{-VD9#S8I{IdVc z)cmW9aq+IK!cv@iG~mxdy8mH^{?7n)goTFi(PAegjc4NjpOZ*IUZd&stG`C^zq*cr z=7Be@SG+vXr_lQ^3uhg}Pi|)eJ_N3L1Ijf1#b5lN;W4^Fo>r)`4ub!XAz=QW74c8g zPU1lSprp&qUYnErT7QJtS0npheWOF)@X(SXnv+a#QosfN7sKTU1Ceb}gl!TY3^~0s zg%j~R{l8Y95TtfzZ=G+J0wXyMDB!(lucubcCf9z`a052(FB) zFDBr~C!n#i7jAnu6R?*w*H>2W;o?KgaNgU?+?mmg%mpD% zm8f;CQ{iL0$x?Sd<=PyLI4G3aiQkhi2)Z8(y^dV7$t&ji^-Pmav0zkfa?S0+&=`{4 zh%715Y#k8zGV7_;&F)Z?t|L^R?$2;a5;V;>*va{y;2IoN`gXHSz&e0Y$ zOh07pzR28jULZvW2A3b*vmZu0W0Ua1hiB2aE+uD*0ag#`iHOX@6y%kovq;yrCW|BI zU^KWZ>P0P^Y&@8EHE0id#)6&%LY@6Jn+>`Q7>2FRr&|2+%#Qojj_GHujz-Iwl8gB6U>%EtA zTv8ZImu2%f;NsT3&D(Os&%ke0&VcU%@0Xtj#F6aYqZ8}uD>sKus?~4Lr+i-YN$o5j zF_AOhG2J77_EkG=7>>>yUk>|Ys9&$ICAH?^tI0%)c%6BdF*ptklg;vW~sTX|BATp2Z!<_H79+oJ3U!Y&Ap_*Nef&ekB*Ensh zxugrI*!)=e*wH$3WKvrDxrWD>+;7dGnC6nsi%t^|(oZ*?=v+EIf8JxW!L@+uOSNr) z5lh>f;l0-z3$PfARkSb|nQD4Y#xp%&{QspqapsT&_+gOoThmT-&eW|u>7 zOgS7|Sb2;j21g^M3vyl0Waqs~3%4v@Nh;EkC#R(ZEM|dOb0}?}b#7 zgCkcIvlVy@X7ey?nd|iTm#ro>>awPJ5Vs;Vs>ove^#NM5*ylY_ie$)yPW+@N77cB6 z^E;cMOjMy!Hp2N`_9mOj}c~;AMBN% z*26wjmFb~Wam}Tht^^-8PQ05ZxYUm^^g?Ru2v60BH@D{k@q?Jla7>t%wU>(+=Qeez+{cHQY>yaKF6C4L0aEJ{lXdzqm8xO>Vb893bE zlV9-n((8)U+jPd#~ws2COV}W&9BU- zWx7{U?qC#7i}BqZn~y=6Mp`G-v+&2~;O6Azyey8v{=39@|9-Y!gmDw3h-}=IdCP%N z+%6_(bl4vuZ^w4FBbvr)ruwItewV%ODM!V0JRxJPwFXfnUD%j0ul5yaqxw zQ*RQ?kp*n~%L=4Q!wtQE_LBk&B^;#K z-q@_Mt-YQ^jWZ@GogVr4nkd(l7g`E&H^X&++;wjoO;@|=tEv%NOqr2tYUcw9m81i8 z1mWHLklvnd0tJlPL3QbLEH-EHiz-ev-v-B|B}(nsgMu6_k$ToeQ)AJO;M=?51N=x# znZz~k7*qfYF}!!Y&!w10^Y(n5rkJ`qcKF2>y4}8)(OI%95xWyieMaZjqIPc>tKaP? zz3Fo;g6_!0siQy=r7oK*`S*r9C#|sq4FD^5jM}~RXwgGK@ZFLcc!WP6AejI1kB!lT>|k9$?A`hYNU!NCJF%T0V*6 z9ctGbv{i58k|mqn>p)d8Fy8ZZUfFlW+6_J#CBfC^h}knyCu*Q~#O@KN(P*UGvdwLu zd(_8^=)Sb4-N9t5xza`dTH?LuVS}o2=!JZ(`UuCBv57EB z6AFixRy~tH>>H9^&$^eO;rc=GqJmN1<*pQq@lK?Ay%nB-=aV}!5etl*cSAC6_C7P9 z;qiN1^|p6J(k(nI;`GIXj6;?2qk)hEBojS;bSmjPy2LeY)iw~p)lMt2SWNDV+`u|` z?>;@{p|sI(*!<&oHMk;Cb!#)~oW)8XQE}yg_+i^ld&C_{%Kmb=$IR7BiGMOB$Ra4B zr}fy`aBKxF=RL_IR&OfEf6PXIzU{eahonmq{q3^y)``6)kjNYJ5{-=CN+4 zK`-pdQtf`(&o_ko=UV3qFw#2Z9Od|?O?rX6dw0i_Z_o!P3QKY#8oc?)MHl0^Vko`l zo%pRoc*EpJrpEgKQOf>BrkO(1>LMAMz{97r7Rvlwx~g*lSTe5{N>Vpd)RTR7@Uqr< z*R|YQRL=QXPs!kl-OKGt)A_CZ;#w3h06B}HpKRpq{tG6}1K|65v>KTvgf@y&;FmDmyf77 zonNMAGfcclmM#5d*xX4_ZlX^Oyi4o)s;$lqhuB&tl|A9#z24#17hgC}t`?k6o`@>L zW;)bFHq^t{h)@k@SM;{V|N0nhbJ0x=Tt~DYF`DwTth-@mH+l!*RYv>oJz=On{r-ly;2mi7 z^rn8lUwkc3{zUHUCP;32iVqlX@{-vyU-Zg#-ra1&fXm zwu!o|^q-dx_#5ldXKX^Xj;s&(_i4#QpQydxe+yC!cvyNu<+~Z+60(O+a2xyKUU@OY zcz9?ukv4v{pDuyHa$vysaPe8&X^D2$p@PY_FVa=A8P{!2=HSdMI-Tgwz;TUwk@rB4 z`)xp{tP%TIAOkkPA!DLPi)D9?kT2=Pw;iKC>3P*;^wo0QY(IhQi=R}0FAxYkTz6+| z)MTl)Z}4c(x{+($ct08rcOw|kSGwFxy~Fp{J9VVstc%Ycmqmc%!Xa$VF|a@?$1x)7 zMyb5-%}E4aSdV=@QqWTXb}y_3V5qH!PM4uHc|UpLpUiKb6=xTynja18&p1%7>j+{n zCE{(xuN3IN83{M_w_x1zt`7tvV4p;4_Vu%(YpsYtp`pC8ANDR|V*DC{chL*6NqFu> zUqyP=*gdlnfBMbVRoy}uh00&-7_uE@Vbh8E!ako5P@mGCLKkdBigmLDg ze)%04VjIrc3?(FCfuO<+41;)g6SsU>;CP5V(_J30cfEh*b#nfX766um;Xg2rE)agwu2L@h!cj%X_>J{}r4MMG(`*@FmkgB|n+WD_> zS$`S}a!T~*kL(-*!S*(EIKf6=VI|;ZVCjQ&aZrz{Sxrs2d{bZO{nh#di~vDg_@Lc= zing~5r>Peacn`I^uvMeC8sQ`u=mO=zJ)+lU!BCOJ*S!O)nw>>tP7-~=qLpG==qC;c zNS?9jiAdA~DF`UtIPB%v(45Z(iPz0?jfMssGQ6HmJO{@DqYaJ*6ZPQ0*d;=<9iSEl)42J@^ zy1qN{t7;r6h#kv|xX8^oVNeESuX3 zk%~-r9n#ol^rTk9p08&{Oe1JrW)7`i9CG5;f-^zU-_2GR%3M!$U%AhoE4Z9JSfEHKK*FuyuU?OW@Hf_Ac}xjlnB_55OA>xJ!6sA$z+ifjh&Hw$C<{Xq5>6&DG`8DG|DIz zvVc9^$RaL*?pW}NMC=be9hy~BV|Vxue|-?Tn(6n zeu}#BK%xG0tLRFwGO1k&%x%>;WF{N^PQT8^4=WdVtYgG%po>%SoQF?ZqIMW0mOnj( zs*0@Fb_cAqlZk;KltH3TN5KfvfB7P(CVDN(v$tMFocr8rbSs$=9Q|wJtYYy>*UY0`GfiIw zx2-@H0x_c1;adj&b}t|Z7dAhwjFM1;Q2~;JgTv>0(@Ump=R1GmyT4Q-EI&Zs7W(=S zF`u`EKns!Y;&G4T!q7rX%X}(}bz+bEHYuo4uL%`uACRlE>uYi5O2Ec=?B{J01$5~( zII%+NZIt?&aRQF1b}>3=OzdWQV?#z$0k=k)xn8EW<1>%KsWm zvN;qF&ni}89@G&kFIa5ymYs*QMt?5QA%%6P9RHF`mPI7D73s(t2BJs8JBCaww zf?0pFhVgvm&UN2*3q)HD?Cx$JluHZNrI<=`o0n8vMC=p_*9jW&U=TfX@c#gJ_TYV3;Xs?G!R~Ya6e!P6%J;cS- zO(p0V9&Jvf-yd2ek%$87>q767BlZs?DcwqH!gpA1R}mXA5xi%qNc-bUacQ)r=>g9h z#$WZA5B)>74aZBVAV(kMI(xF@+Y$aA?9t+2pC77fO;HveN}P(XbXS5CtQfOnRl|}6 z#0~wb$#B;6`rUKr`Dt+$fxG(BBf{02O#~D*kjM1ZV0P2&Ct^i^M~SUx?HL1fqa31{ znQ-M+EhKzb4&5uufvgWbVS&go1j6ATg^1a zpxmZ@)51B>!IfIrOLNM_p_*IV4=d+wM}>*c-2t%YYbYP?Y8~kej+4P6q#de=yJET4 ztF3muWf?uTE;-xr2|EyTE%x9u?1eQn7L>5mjt@xm&b!T&!)^T#k&!6SpA`a>jT}c+ zVzzBD^I}Y~8C||+$^W%l_S=LJ-Q>M8(|#4A$x-wc390ytrOwE#`JHWG$3i+IEl?x3 zFxT~-_NMinx2?=T6H21>1pm zKBrsmkv!MWZ7o)N3Vc4K-#ZByM9;3NeoZm2IEx^s1 zxFPU& zyE+lp6-(NnTw$XYA6SVWJws(wX_oFJ_Y+Lz{(ch}YVYvS&8cg1N0K$MTACBLacSsS zM6gauEKzClltB|vzn`ag26T2fmhH-^9s1lar$j&6B3cNl*>RwOd;HB&<#;1@AH~7F z{9yTuNeJmYb-jCS>-cKq#2cy{Q%q%kbpgss=J!t~MGD5@fQd*}O|zSj$Sbz=Mw)AQ zTEb=h-R%)T99N1Il6;AaNRnVC%Pr0zgN=x-D>J<#%HTMizsFA(ZU^(K8k&Gpv!M1; zrj|?Y1I?ta&v6MM8C5oF-VGfNIHdF$QJJI}o_{8WxJLcs+!`c$HXN>!3N;85z|j*RqeiI&pfAX zMXQW$TyuU~WxL5n)g$NXJw%D1{Rg`5^T_m$g0T+gOaG86qLx=wg#7>5`pT#}mt|X=g}b{G+}$C# z2X}|y8r` zk2MO`w>6}z{YV>M#x$LjcF=Q51KUQjFz3U zb)?$mA!eA2xk+~*TpleW_rI0fx@_NkCmiTQ-<=szz4HR0?pcRp5Z#P|0uhKO4)rDp;$H!*Ggk5 zT`uEBK3pa9ACY;wvfU-QJ2Ua}&5=_S<*EPKFMpXhziG|~b7j7Mn$Z7~vVMa}>*F~x zE%Xy{c`Hw4|F7^pKXQY~d|Em}8nb!TVHb$~xPQ~_|03r7tH=!M+=d|`+7N60i`H$~ zgGn>ubLOFTev-)!hWKAB^FQpXu9%Q{Zh5ls3hz%qb%ol0vBE1b)CeB@QBYs6+8=LzbKkZo~D21?v2f#$oBFmm(KaO#la=&PueQrO!QuvIb2!RgzId_v783pAdQC2>I z(qDfIp&ao;Am&_pR_NHmAq@$-c-?I{&!%Af_2o~2KR^C`_@EEmYqY6E2V6&2|MBso zQY;jE_SW#wuzIZOd^uXM2tU$X0QJ9rx(%cKBKMtD|1|eMmHug54x;y5n$H7G-$wg? zwfA@Hetz`u{oqP!9MKK4kN>;EzpL*E^Mh%eZ5;DNF|^V8kHTDQDBbz{-*+8a6u=0& z{=eS%kxs7yxYBht)~ILCPR?b%KL1B|{YdRwNc|wkg!$q=%7f+Zs{K7t|I>5-IAUbN zgz}@$|2ZOk23&rg{QFc2= z+7m+Oq4TYe=#5zLX(rZWe>7QHQIYsdk!*ZL1)bB?D{zx>QP)-X8O;r z?t;KKaDV%SMrB_KPUQJ7AIqLQgkoW7opKdcLultp%q}?_pO{ECGBPqdKTq!9;K1Vj zZt+)><7Wxetfk53{I-h9m_*hN< zi3WUg{$XGW(?3%K0oDkpj*vrE-?7)ol!g{d_57JgPLRQA$MNVvj{HILa14^`9X@Zq zcRqF&Ge=}!T2*(b#qgX^e-YbzI;~FSy=W2D^Sb`L3yCA()zUxI=QOVmxjXOp^Y#9~ zqU(>00Q^8kp!o4p;-VCdWVxl8$@^D|tN+N|ojwGz!(6vwxkc>&Rrr|FhHu+SBtKbc z8lQXJM;?Qvy}KDd6DhYAZPnt?4Bu3JpVpB}GGRl9cpO%<;h!$2vdMjLjO{hPo_v`M z$g#gaf2pWFDgPrb-T@%ATAx23r+&%ttHx6OONfb80Br1}dF{&NU=iQAdadw;MP6WH zLcycr|s>Katinty0Qksmt?-{EVBH2fd8%Hzbv`#@hS7R5amV zj+4RqJHlp-Z7<8-CVm4871o26Qtta6&oYJzQ71%G z_uH~*oh#$uI#IAj!TUCZ#vhgJ{}v>q>s=uBS>nE!;j8{X8pQ(_6tlO+TDIn_4c2Mk z@g~rS_gJJBfd~=`#D<+tB-2iSp~-j(lDhs(|jhoOPdIiWoPxzNc*$x-7=sZGFuy&dMd!^AJjz$dFQKYc}5DRzq zHu_Xm{CER{_GD!xiZ8kYpLbU7O0PwhQnC(y`)u(os^Pc!W-Lwp)X6M=r=7?Ul0GYm zgA73ZHW#=vy23bF{2p*y6m~v)+V6geVAOT;9)4beaggwGI68&=X%cHSlVWG319VXo ztsXP-)|Sp5^Y9G z0aGGrDq=r^vH~ChS=0lz5|WrmNTRPl49O_0CubhumHUh@e15fiAoX#W)dAj#n}Ubh zT;q`)_{nKTXx1e_t}<4`wJllHcpNXC-z`@H{xqs9>X&V!J62$oc0BWEBH;lLWux1r z4>~&cjU`5^pw(b{pNOG;NBRV{M>XyBcGL&Hb4`VffLCyb#I1y4H*^-vQ zT=aa$T>X?9X0;3bk%2a(g~Q8WA+e^iWyv}bu!qlP7#*%v!HI%H^;^b=bn^Z(a<8yp z2SqKsiY|bCu|OhNBI11QGMt`9E7SL;fjMp;f%03vUk8R ztZg(T%jF|$D5i$CqC($A{qam~&SP5DG76h#Z4BD@sa|e?1ZzR98`hL`pTZ~uqTE|H zKyz8ssMZ!l-OmhXzO;T|AdZ9q1h~?tQF3lc_wXB`VYzD{8Csz~JvGwit?nBEg7!Dd zHk+oePM;YDo)AI%IlMcE-8XHT7YE~LWI_yQcw;qw1QOZ6#Xy33;BIRGMj~X;KS6GX z$3XtB)zDysgIkdsuv{Anp2JcG*z% z88=|U0c!(PSfyt;e(kha)DpPHv_YC)ASf;_55s1>HScIdojtlib2$$r(kL5w)hqiioxj6EhG+f0Ngrm`%HW8WJL&(Dr?cnSFG4XLUT(klQk7m zk@)U`Tx>(o4XST7?TLamL_&D1hIN|EtzexGk&oy7z%I`5{5Xo-}etn@(-KT zJ*m2ZKaco`6)OrKW>Vnabdhrodha zFWq@02k+d|9Mhb1_;E>0tN1gb%*Wmmd6|Yd11rcQ5S%(cGi~Z>s~4cE8X%>d|7;uI z&fG~^lK%^?K*~qR3ZF>_)>M3NmcnG7SMYDE^$7*+sd7Hn zcF^D)w&G#(@Ey^yM%H8y%)$GC6rGXUN`e4-?8ZmKZ<~PYjn1LtxqTH3p0>UmF$jEH zIzaGn^&R@d9WG@X)V>og(vB`^nOdVFv6*=Mh%G)JtblGMgj5AwYGBY4q;TM zdl@0qG~!gT-hK9C0Z3T)@hm;J!^XQ6u+hqD4c3P>tb2AY@8u_kwz^(OOQ+i^zA^7_ z>!8yue)XK9Ze!A2v#@9qM!XFyEEM8PbgkumU0@@+}a7W7% zC+P^W2O0|M;H~goCSxV~>cdx3*^8n&xtsXNQ^K`SrgFRO6#&^Ol~D$dgmu?bo0M%T zAc%&*vuJh9?-{FU&m@S>@Ek7e{OAk$xRb&-l;FE{J!X0(IRQFa_P)#1gt%=^=;I|y zh-V`j-O(b-v4!i4!E(1b-mPjOG%|72i_%a%G%MuB?%yDT|672c-LRwYaq92gX=MA( z*M>ANe_ZHZCz@P9juoz>H_RB<&H{xo5&F=!c&T%xC-f+JJ9tq{=i& z_yur7O)u&tP}3%fy1M?g(}jdccy!Dl?_JRZfo@3YN|BCN>TL5Vy#?_M^YO^E))%;V z!3Ur{%xhX9aE-mfRL4#7pmA)-WDNyVb02)byX@Xu9>ld9Esz%gyUgo%>vvfh;A(=A zYJ!=Kvd8UGp7@ouNU8#(b}%UJ;C){^Y@q|U=pf9@*$Q=~+)^@)7FlFgOXS2u_pEwx zmGUU#j}_MAUr9QYeE~%6=yW)dH2^<-OoQ2Zxtue4@2M=xtT?Tt>c3~kK$_y`JEbw+ zcJ1`aS&FA6PP8Y)vNf*b5c#Qdx`DZx%o*SZ|JeeIj{t*W)(bd=LV8b7OQJvUcud>v z7`8Mi%B$Z=YuME}HBM#a#SjFtJP5{XH>HfmM-5LTk}cDP9*0P_QSRU=DIw$QE!ccE z&B-4iq(aVT{xGS0j05p7yxRtgBf>wI-Sp>{FQh=+{SvdXVkQ-4r#kPEuWM6)gkr#Q zB7@Xp1ww&j$Tz9o1x$+>r*@Z0i*9x^@|Hn=H|f`N~+U`;8x6dXKET%m$Ac(~w;>?!l|u=DcYIKfwe5 z-2vLPJ5|%v)V^XiF46w%b-PU6rsl|$=*@4G!7=4wB^i6)b3=1g4`il)?nu(b8?EJd zKUh^PinTKZQ%M3XrLuVsM0wp;+(@;Bi5J@4=`wMspvdUU5HlB7ZD;r!U<@yOYcCy>{)Py{UhzE zvcI`zOCYgT$o+j9%R!Wg#(R~(6GF&h;870FMvM{NvUZ*mu3a&gAm5>(1kDb&)|?br zm(u$H!oVu_d_su6t!XMkb#`uvHgjP~%=S7%ampQT!%mU^$_4om+6f|T| zznj=v&da-b_zYK$?#8Mt-P4HVp7?``YVeYs2eMvV=)mLJCi0kX@Y2+q{OL&Y@S?#I zRtJ+e^*1^W^KkaV^Fw!=wuhk*3(cW4byOHT_{yveQ$eYXu;{-mM|@PUrZkH^jBVbX zxXFb?FBB%OUOy2u*s!5(=+i-Z$OMlX>8h6nczx@;`o9cKX0R9W07J3QC`T+{P3~h# z9aN&do!f}3wR5cYJwU_z(Bc8@5O`5Hw07uMoeGF;pAEV5Y*MBNWF~H5wJ1g8zFRud z^rj&t%I8kyyB z8U0QYF+zCM;>=zFBf^QFWUl!4PbUd7If?n;`};!rtNY~6(zs$qL;7r%ULD&TUE~~Z zi8x02eRUX^XKbl-y3R_z(U1e!@_7{GY|v7Wu4)xS_f9nu6 z)Xvx2R@5=qAedX^GuWXtuIWaC$0GF)MYK2&fx+~IodiK(;YTGj(4V0o(PL23ndGdC z^{9WFmT;tAvkwnr*809C0$EyO@wa!L{Unb%HKI{LoZ55D(2$K;o=B#Nafk84P<}{e5 z4Yl@#pVqx$M~xO$z8hgXuB8t{3)jM?G@0R}z>2%2PMdwTx^%ItxL%UyT72c$g|nK= z^$l)E`v;BgMgkKEW|ZWK zQgm&C<+5Og7VLgp4VpdF`8D_QxVnkd#0*c>1p-HYA5b%%Fa0hgbU*&)K-7Ts=N|n> zDSYfmSTF|OFzC9mXD3*5ORZqO`{?Hsd=UGU_4WdC?G3Q*UH-gBhi;a&9i1&s{7trlz0w>UQI?e0YHYck?HZ$65z{nS?%$aPd0a`ci{(I z`}VuJYoy)%cJHF?GNronNqUkWsKf1cmCJnx?0WCuyXpq-EIu~>bM^mg(PL5U!`BI8 zzN_hAb`r@v=jgp>75X<+!0(R-%&Y2HD%~TQ5Lw?B=)1IG$x)AK>8LE8fBQKHQmmnC zGnH6&arc!tQzm$|q7Z$ro)39&{+9qMctX_Ln$F1hc+yAq)HyL{=Y}c`{A|mP|W$s{+-+3-SPK{0O?rzV8n}D?K*h-&3uOxA}RfoXG7dk)ds&dKYg9AyS1zRody zAYz+M#{g(6wnfcNahFYefQW00bj=}zla5_nnL*X+x-l-wPFkY+`nuWE#3Q`xX|xCi zUNibITs7g*wZqE!H^Zg*531Mpt;ufFwn}&>J}r%!bHlAb$6)~DFNlu&Fw=>gj7(I| z_tmAoGEaDs`s5lfAK?%5F&zoG;@!+?e}8*+JV-b1tu@4{{`>5dHG_Jrv|#;-ReLOdO=edpp9by79>{|31calx_XH*bQ#KiuhD)o z^Aa|kk%8`bQY%xryXuXU&lu~7@T#e*Bpxy&+%cd6U!kMvu`KB5_WKTPao@0$;PJRR zN+6uSULWeR-2~}vh*|ca&WK*N1^nU;$ydowH!(3$XEK7?dNWG9@45M$o$0cmc>tSP z(7gUFBh&ZoF~pu}DA2^@W^d$XS`;bW>EzV2Q;?sJ&qn@lMyNXwSX(Q?8GHH628&*Ey;Q=GNHbD*;^T*y4$Xlw1#A(UNhb+v@VihQFj{HQmL498-w z$9G>|@#c)nUr^t3AHLfc>vc#!58~m*>BL~1c|LtY6xI0Z;&Qby_nZH=D_CzK%orXN-Y6NUrJ6cxu}TJ{kSl7@8@Y1Yf4q2Oe(IUNC1mrF9i2?5So|5+|)mc1svIb zx!znx2OpE+ZpKDR>_OZ9>9~08gA|I|KHiCBJ2n4uZLasg7_@UjF}TY+Md)FvFq~aV&?d9j5zEpRy%UAQ zx|j3*Qq1>z$+*sOUs|)%t5wJ2xRCPYx<+x$_&QzgnOT;3G_K1i{$m7&$`QJW-6CC>c(26R=EPV0;!=!!AEqW=fO}S`TYvZ~I;f zF*{K^$r>w+IJ^ZCZVswuyKo6eqviA8F&9DxNonn`yYK0=1rh@d+$H&_PTSMpt>~G;WJ-uS2%J#Hi*9ixMTZAOZOpwdNk1+`s6f6 z5%RBinPd|ccB!)m!G;&|>Ey*q7*@E{{M4wAl_(;F&A;Rbn0RQ`N@6&VxWR_FG@y*) z@*v^J^gftQLnf+FTt1b_6Tys9{Ob9hIL;AzfHhBQUF;3s=@4ln&(n{DD8YZBiFP1$ zMaQOb({Y>gSkjT$(Zei&nU2R+e(G3&Hsw_MQwJoUfcyAzgEF<4T%RX&Hp-(nJkcn z8qgXnbBJ~oqZl+OV!iWr=9ZSqYGw&AsJ((kOW}7yvx54l!Gy_Mt~^wX0+Vyzx*CO3 zNec7T_kV2)NdZ%gjFI3{svuWas|XhTPPBR?4IL`I{KcH@zQX#s*zF0~`yiKA<*H(s zENOo>?XX_jgORu)%*_Fkr+~}hrkPx#(46$oGCnd*nV!}zaIbss>$q-mGO*1j^DbQ{ zKW2%>W;L_TjO};y+-C1mfZkBh_#m=p;0wEn9Y5|Yxyk+8oZGS&1Gzw?F@N*%c*eok z(=~|+EevZurtq06)qzN@v0*i##I^&+sIIHqT68TD#ZHIF)5g9DY&va6?~urO`x*Gd zQ-;Kf_2e6og(`xX&bd6i5qRQRhwbNXRttoWkhu+IB-*;JR<%f-jBHAxaX2Hy*iWUW z>*0tS%{1)<_(8hlr~OOXh-PY|x9?Kd8zvixKb(V2nyrZY@oRAB5-f^R!f2svyE zP%jilk$Lujns=`DajRiACg|qr6K?o~kLr%G6XutmN`b9wU-~K2%ma1}CDo+dueN=K zMT$Z{{fl6DB?3i{sckF4a4B8n^RLA~0|3-=O61=tNPJaSEw0`fYx=d6$^z+o37vMtM8$&k}gxZns)UJ5C!Goz3kX%^T169sl07 zEhv5h{K!zlOx~1g+9JXILut0(n61NKa;a{aOKJpe7-_CGVnH9tdL)@K^WoICP2k&r zOJJ&MWmR8UFhY6*Bn_Aekr){x>~f@dA{0BqZhC!xj|r;TroQxkm&fqX>il>?h>0_o zkPzDLS^~3GaEZg+8b`#`@rFmCrr0Ok1%?7Xk7v16^=5GOn2$e~$(3@+$NsI><9oBB z(miF|LZ=%0;>v7u^{JB5vHsLK!V*kE3{7Y!aZ7Y5P&Q`~jspfwXKWk=r-9s^XX|NNfv6KIU(^7z#!!ABtd^8}tw#&%Zn zRY2)KmjP<9P%<#^05`>%TZTw!T8heK|91IZ$m)WDzU6%(`#l%i+{9I$57$7~_6}JIb8JFiOmI?64J|3CLtbVFsi<6bE_ZjH2!^vpf5!Q&hS24fiq^$0D>|i6}QvCl7s%_;!-LIWlFD5p@1Fj z#Z4ggU<<3su$yvP8%hv5Ni7e6V7fuh`OiCEPWWuH$`0}JOix+CGZEo-z|p? zgMQ%54JC!`PZAu7x`spN+}B0$RLtVWIQ}%evIbLkGr;wBv|Mqa97Z7TA8*TJ>aQ-y z*!7GB*A4I?@c}ZK{~#*`&yMOgSu)dCFFq~F`Kj=?t^0w|&_k3git;gDAibUn{uJL| z%OF<7$-g1;BRV@`s*f$7 z{Sw}w^}754F~eVWo0|i5y76Z!tu%YZLW&q(^%q7=o!Dn}(*ydC4zonNbe7 zi3#zoOjS==cP{yi@S?5+G&a73Btg=A-?t~eUfT@B-Xc9XvBe%od6NVjlJLjte&y`m zcm4}W`XjMSTgY3N#44BB6*H;HP`Q zGKu1~L%c8wE=^@a9Vf&xw59sOPZ++%HU)BJBHwJApSwb+cFwZ)rg z6y=jN0++&QXWq6~U=yk}*MoY0kpf3|t51PG0EANpH&5t~(Q~V2H+634Z{(R9tq*#M z(kvY`5exu;Rzx?yqW0)fw*Y)Y?M#Pt8NFKFl>Si|YSE z2n_5={B*1#WZdZd-c%wxi5Td!$AvA>EdBL7J%uXtcnk|&w9$B{?JEOkppuPzNyryS zyx6x<{LI*roW^j^IyQm)&q5SGE9h$S=RIO%P=zck`3aHGQUaaa1%jndyY!`)FS&g} zvL9e8`#MJ%Fb0jN`^py&o(OFPZauj5q&L%M94H$K8xrk*u(&ZxmPzXHB(fj_uqsY} zW#22596|l0g%>n@gRcCo0>zsEMICfkWbf7Kj=6F8YwM>AU<_A)4k|kdx8TYJeRSZ_ zWZTw0H)P45EAPBshq14`to$_Z2dht)cZ*zs13?Skj*-g-%+cBIg6@D#RUPIi_u;dT z!FBg;+sawJfPL2YAN`W){8lAD3_%5F13I3^z&!Y7>&v2UCadh_gGrhg;?(2ZKY*l* zfoCoOIJ5-LNmje5z+~{=*?}bQqriIbsXkh}AJQpQf`@%mbu0TP6+5x%}gQQn3jt93*z+4^E}+(@&<=I{4eh~zFg zsR35Bm+q7e$m*I*7<%5eO4GQ|3g240U}>;4GOSd~;@~9`3iHf|}F3Z2?o3FcXO^>4vpLIHZ9T%-2;@Wjg7CzB6dgczMlSVR6~n^vJ^NijmGy z&U^`up_r>qO+zC~sURzq@5Wwn*bOc=8}0n8SD(prhj041_Y4tuD#pfESSd5Lk9MYk@R}1@r!LBr1u<}R4AK!##kf?&JVLusI%C|*9u&}W{Qi&-_GpOT4wv_C@EN(8c4>i^{ zhE07)LE)e1SouxTBn`qgK3t(|*hb0LUDl&WRAV-&H|QQk5e%nHlw>KFzFbU)z0mq=zM~b|3c#(CCOT(Va$HxuE_tS>u51(B)|9qgbp+(bH zDyhYIZjv|XxQ81h;p<8!TZpL_A!M|#9AxZOcqM>>MSC~Uo0J{RuiuueV#Sa^9j{S{ zUved5J8?g)AM$JZRw$s)3#SR^kP5#VGbqF<6_~QGU0K7^)R!4&!>c`F$SkP{1;B`9 zZbbm?y_e3lK+{ebpmSrLWhsj)uI^`z^it(x_WJ1zme}3Ev|z503nr zpz`^1NXG6F$%k56S&K{p-wzpff)+hb0Ji14dIfD1diGwV8RVRf=(8X^yzI8n(5w;i zdTfWlhqJ(J@OfMN%Gu<2JY+XP@NIg-<)3O&}h zW9jJoiS4ed9@n{R=e56hM6^E(7s=+ZK#))*1F9X=Df2sfr&DC9RW5xKmRUfutv-@G%|wj}ACV0=_X09u_{jWnH1r#a;Sl8aCNyA!t!ji7cPfp@&mVD}M(m+@u>1 zo5JfHwL?R7Ca%x#=!gr63%+E+vM)1PT0gdaJ0$HclNGRd;hv zkEK>H6iA|a+3t$GU_s;CfW2xe3C72!myPKpJk>=*Emlj++@F|o6;GCL`m)5O5_Qr& z9_y42K@O4D=C}ocNgd^MPRT{k&c45Kfga84|^6{b~4I&6u#P z)iYaxBp42pQd&31IJwZ#B5?0LQPNJ;6HqTQqK#FCQZomgOqtQrb%KV;#Sbk2oKS8} zl|3fu2XZ&Th#AU(<|`4yTJRska+D?bvAIA*a_YE#KUu|XDj0j(&5L`UQ6-yEX^X?w z_F^f~f{C=7nx@gT8D_IAj0@w<$8k*&uqj2h1jYomrU^^MlnT8Jb94uqQ}R80ZU^I% z6XlKDf8_$$0IZ4bpv1Jt+GJ0&8RaDJ|9133s784fFYUe^LT(f4wmC%THvlo&>_-WM;L7rdZQ^8RG$N~Yy&F|;q11_4eByi|4Lw3fb z3CXL%Gie5n2ue}Qn;R>W^}zs4im0Hi5%YDp;@Z0sDUnds`Vn&q5iQzFPd6$N1LYIGTIsPDu#{^)eA={Wq>qlt(kgE=IG)72*tEUvYuH1Eda< zWx2q^P&;OV71S3Z#c8&MUH>P)K`C)zaV8UJ%C%)dl9snI z7;guAyKfSWn|DaBvfx**%)OnrgmFS{yOy5#XHHvN-NG#FgI&!uE|MPVw>uj7Y`d)ZSclD z-^g$xg0KRmxodN`{m#+aRC7!U*6i}GkFND7{JpN9{eyBK5(v4g_JtFGI4kQ&;3Dp= z87;Nv^MQ!t;Kl7ghm=yc!QC*Nft&pANJ1G-Wc2l5aMFbRjpu{LeLh#*?mNdOqH6AR zU1;ufm%^C6E!o~*yVh>EzKLe8*)+b|@ktZTiu5v@&LZ#5kSQ6>^7DIGN9x5$@_RA`PgHJ(io(c!C(6(ec5B!hxc%|218OqWPj1>A_hSurFv#xCv& z^^~RNgu+&5x5*WyNZ_>;T zLX|Tegp@l(M6QU+lnxINNyt$Dq`;qHT~VqseWaPjYSmKvouwiK)|>%7nL;8uK;-1@ zrMrMvIAkXp+E4nDeKU)S$T!7s2dKdJEowZCM=VB<4Yl^5@donAVeDLg6gtObIJ!%l zwyWiv|9F~!iU7#9L1Uq0kShg3bkZyI=-w|^#I(mNlCU208WF+Um&Kc-FKxmrzlBQ0 zG!28o`vVo3+7GI_?BZXE&CqFN5Qx2GO?)0oO~ONNB=+NzGsCVI2vly)2WfJ``j6f_ zGt3qcTX(B7WKE0X$&5`WGq=t7;0;ORAEq)s6@3JrehDy>)s|BHSu88f_G5$wbiA|c z#iOiZNCPhKW!4C(1Ytv`h8}d=Zd@w&>R!-}fbDib`2rzz00z-O&`h=hCY6@j*;D^0 z>jC!Epu)?#7^XF^IR=)z&zLL4Or!1iD=s_DUPV%OM^ltmN5L=I?NqB!4JNhYTdN=U`L?0HbN_n|17_wNz(FSkc%5) zKqe8l?~hUyaYk&IE4b>SG!AagbCm56rn;4kxnN6;D`gFc%lr4D^je2)0a(%GFpO{r z_3UOQa^_DW8(=V3wABRNtgat!!iFM{-1?>MPL0>nd=g%mg8HeUPU~*<>#$KS@CUR~ zLu1uMOnG{DJPFiq=Wq0NN5k>N=%#K(aB*BjHUK()H7~-0E#6$fwhB3Tj?s3%r@Afc zuMLg$sDSM}7VRj$*GrS#`wS)$y$!u&v)?u=$_Cl{uGbwsOyZ7#(HS>P3Uw3pr-V5Z z4LOO2^7B*BwH`a^{D4QtP|s_^i#6S#OSs}|6;p#X-=|efR(X%zhnJb@E7XKT?%#XW zk^2wEgGLv{!>>q}eiAHji}_d~VoMBC#81mt$PWG!fq+C~4T5Xk4hFnUaL>J_HjaR_ zL)?5*sJ!=ojBs>+{}?}sJf^M+m3$F;*OzalFZY)jD06xgaJg(s;pUt^4;`(F2XR;7 zNK|x0RJ8!jG!|w(Jx^LyN(JczMgxMP9mxb#91IdFd|tH$V)F2ETdW=}0YtUi{2iV+ zKd=HtLExwWx66Q-b$JSfV!xnB3DO622BDcp6#&adAMN`(WY)T~T9174g`|0-UB&kG z77B-lZ9!unhodLAq2ve<=O>cR$~qF%T;U(k?4g@ddq>FZRKnfd;st?TOuby+EcUG@ z|FNEEl9e!UyN@*5eCIB45GMbv5SN5Xf*zk@JLlp;T&^oBBiK$y@IdG>_C1 zUw$L$_o6A$%oUN3au+Kk;n_+Jxs>_&!;P*0G#y^BqbNRCJuJYxKRtRo4p6YdE3E>8 zt+?oh%8?_~{FWZ|b(_#e<85@7w=&{wd}0R=h=ucu-2D#mW_? zVxf@|#~ogB&4;>XVxnX+NFaset2+z&)%BIN&1yPh^Se9Qg$*_z>#r;7pmgM9(zx(= z;-HBMj_?3rKz}%e|6&2`{4te+UvG|)h`~|v6E=_wD}rEzUJ4aM4Yj-44@PR>naDIi z$Vd*=%~dia0j10d#E=7i*JwmN1j&21VFYmcDVX#)!37T%-d(bX`7VXYBnrd_){z%~ zC_zQVXgw}+Dhu{=9oP>?IP`NK?vvqdvq}_?&uRjlb3sby^52FpFV`%RCU=>-jz_|x z5y0K$f^Td^vE?gp)KygY4n#_?BapW_H~9f9JpFsg6;I>}^4tz!hMWxGs6S*Tb4WSY zn+W%K)Klnjj1!V`eBHbH2SUg4Aq#TTBr?pSg8~+S-z}R}v$D%WvzO>2v7&n&$YiOf z<8MPqX1eAHFhkr?p>`TjHY7tTt~DRwp}-HA@PnO>5UhiCCIrMql!}dVqS|Ra#E%S( z+zsTfz33FVZLR5s;S>5sYN}qbHSw`vDu)f;i;yQw`t|=~UZcNfKWKum$+kVtOBn6l4OL zi$}>Tu#BH;3~SBkxFx^qhh36{wBgJKUxpN!0egcV-F&#Fa8{(w9$tlKAFSdY(k)`W z9Dk$qnXEtQj7TIrG?c>BnOpBsh(1bx4D)^lrgTn?!d<+*Xra;(y0WRH`%&t0j#g!lJ#s3Y>iKrFmV{3vucnsroE)L6!t!RgjBlVd2q9`&S%H;Tb7U zE_k=H!_fRN&Fk&(dZ}M2gF+$(%rpj5@%eGprcfWZ-^Y`eiOF3zn{|DD7m(#GE#OrT zByWC)WMR|8>@Kf|PWFlk0dw7MotsIO)TlGwJE1+qE_7K-b90lhzS#&pzDcw?7_l(; z{rFRdx{Lj$I+WPQ=-%L5v2}$NI5)jR+QvZ zk7BgB|M|4mgih>kEDjY?e$?qimrhifhNDV``I zjvJbZC;};TcAbf4Nwv&J?;=4WpM%@>Jk=+I9e;({=V}?3W+NhDIw6!45jI;_C?UQd zMl27aIsG!N7pB~$KvFxjChv&#BlUP~lo&0yD;ibsW!ltu26oE~l*v*N2~N6YmjG-f zFiJ)g#nnY|DC1W{1=8(_;8VnomI@2<)_#2?r%8hfP$FgQ(eiy;PDJp3?QuOEzO6pv z)I$xKk3X~7NMJNK)XQ>y(Qw24jeY7yB1wDAySo=&(_|M4wn2=x6)Yoh^oz|cCBNXT z4r}Bn6Z%8de!|M+hlF(xg7@bPN*RXfQ_6-bB|k{xeiFP{K!Pgu*wP-||XMJEaE)TFTh zWObt`QDn_A#F~6YHL=y#O1^I3f1cHgi%|+O;D6PrQ`$-2>ey*Cy;7y%mgT#Mu-#9ZI)OHxF#>7L~qH&WrVVXL+#tv~$gH@Pk z8`s4ZmlQg>Hpm_fXeC1ySBy^b=D}Uq*_x}H5>l>gWZJM@Y+qP}nwylkAXJb3r*w$ua+u7JQ zHrUww=h6Fp@ALiV%sDf2=AQemuI{exuBz**;>atlDfZ$Jm-7u)WffEyQF4tqpl#lw9-aF&3kC&339^GTQ#Rc@lz=;U*iF0Vc`gC^5 zzAo2vfz)};G9RH^jU1p+=W0|xE%F4$LeOV!VD{@03zXKLL>0eq^YQ61JPj9ro36lwg6i8Wu8AP{|$k8Igi~Gs=pUuoKqnW z8AWb}irr}FM3qcj?nW(9Sy&*?Se3AFoKM8(jgjp_`XL#?51gqAG6d9p(mjORfMD2D zxnvqG){8#%0%sUGSDAP_Kjgzr23Ncsr14OQKReIBk`-^V3>iciq&k%k0KRiWo;f^k zFg_NzcmQ341I>pzLdZum3^JIWKi~)8GLCZ#+%6AoVb1xJ1 z{f&3?4I-@k$16-5gu#NHY?MOWrE_CU-9?zO95Uo%@ImAGp6hU4`>os-jC>aL(5O7< z%lVvRNwB-<#tdKskkn=0u`EztCF3HJXNmmL!VpV|pVN(v?v9kW!m+x=r-8aiIw8Is z-H~CzY)CJ$=Ht2K>egeK3c~N3aV?us^*(O<6%wCLu#-T?MK_Ig1#laD+ztyM)vI}- z8*7pskSZl*E}Kk2cd5dWn{b~%I)0oHK{PN4W{eCnkxsE{l$(sLXZ*M`yv@0vtpG<=|8Opy~>j!@X$X2s?MG$IQ=d zSy2f_yd4&s6{9*-`-U=wzWhtMojIKu~@3DXM>DK{iG8J{T$-n&X=p4E>90pd~0WB znBWSO$=G2XClfs-PK@=S;d!_0kF_6^5EwJX_pw%w zFae?8V>2G3G2ashZNV}`fqA6d2gz2wyEXXn~f(2>4njnb?1S1JmK_V?6=Y9lTQfLn&dD+hWTx7zk z(6uSF0Z$bhZm%rKqf>aH^G0>-HjKT=V#HRhhhar zt(6i_4Az#KYJtjkqpy-bV>MI+oxQ@)KrM3Ing)u@cQn{=eHRgJ1h`H~1>Q)<^np67 z%R+Wt$_9KScD?qIrw-`T^q3YsTl#;@x7XSpxAgF=HBO(gz(p=SR$Li4X5&esb#hHG znxxj)h7iwYvEgvj-IZT&IlX5Xr)S*}Y((OvE`Rzc<$4{c75RSdQNqf99~q2v3QN}_ zOMidKqdgkuIFc30Grt(-woqWtt*;~E($fql5YeEF4y3%}q1tY{@^{kH*j|Mg$hiA?aSJKh`4V+?6=EyQD{MShmNXyYc_2EOZOUWhj~|K^Kp z_DPHunC}rutOcp8d|7Hp$6_Fk;uwaj<4nNUxYh5kL}xPg2=FAzqw{wPTJKt#CTPL! zd9!s|HaNZyUHwv0=)I@I7N8T^6B0@B(2Dr=7lT7o?^lVh?rhbE=znZwNfs)J4+=Cs zdW-gYnE>?!X!KAEq*&q1VMJ8Qp;!`=iN)j^IU>7q!vH0;QKK->Noe>!2CG}`5Q9}X zF`^J@&Y2R{C4F0zm5|i-@x!KND^p&j!g4jVFJKv9LHm=v#9xdn-Y!TbD;OP6ovOVQfEYwb>!b8 z9SnU_Wo4mnJ?tH9dDZ6nx@U0wpUE$rRJ3)El=(X56e*kuyO@6LO*H#5-`H)}Q@q+! ze(UyR`1)8$y8B)Vk_9gNI5%Xkh;_?b&C>TVb!ZZMiyStOzx&+B7pkV9T@ynr$xlw^ z=cH6m4R={IGvLV551J=J0O6t;m%d9u_N}EC@8EgF%MseyG6+4Xj|wT26v^P27Oo2B z@y7e*0`YDYP3~&#q&Cl>V^TMOfchdIGin=|Ogvjx@X4Sme4r)PNKn_s6E5iuyWRa9 zuZ(A{2S@a>|fh><^JN@50}GYhfjN zZeM)62lHu<3C8R0{J}{lhK!9tVQ5X<$bQC2xYgUU1RA{#`MVyj#J$-4J{vXduQZ=9 zJ+&g9B>}!p6(W$@-uHgJ)xIj!4r%UqTP`TpF$_{R%3Fo`_j@9E0JzT4G~c3XGw0KM5Kj_$(QAWNagpGo@@wf|2U380 zmo3B^3~uf=mG6zGpD_A05RfqR?~7Yh^m+(_;DTo2To$XYH(1@3xJ*Y zgSUyrbQq3oZ2fQu)6n+hTAp*0>^RrwJKx*Yfb&i-aNF$^@8O8xN8O*85qMmVQ2>n% zb(+3=#v1?+W5+GI{rCDE0udM!1Gn1hRCK;l2dXYwWj3A5ujTT6Rxf+F?C$Pv#qC^Qz6C;hzxUSo^WQaeH zkB=+u@k7cYO<*P=k6-#f^0qx6W%+zZ?OH|2!DIOD8^%(nQL(huncH0R*YH5%1G$q+ zAi4?>)zuzzaT&Xh+HEy~yntyfL0Mw?28~n8obj&n%$RTK>1{b4j$@nLQ305{# zf-Rok-E6(d5R53FucWkQhd9HpSgzCZB02kEfWqLZciZ5Sqaq@hFj%}5xBOr2=-{+T zT#hD~G1!u@y_tW(6OXm+1i{K_X$T7kUX5IY3%(UVZ)bAYWy)o;LDLRFYNAiI)cWMg zCqq?-7yTVonTh%eJGL~?#<1M)xIbjXfZy{f8Bbsr0SP@?6fZ#Y2UVEi=gV@v|GRhF zufk|KExIwto`&0-8y#Fcpv(TvXtG9~9tfelrszMB19%uvS_BY=ieQid_W*XWtRGbX6vi>&g!=jZXo@`I`3C|g^fHY>-`bhm zz~?vn^NC^r4Xee}pHPEb?^EhOXn?2zGqaeOsJ8PaikQ7~sbCZvk&ZWI{toX?BZ2@6 z*8N1X95VLe&3JQrdpJg!mm>K2JiX`06{Ac|O+6OUzvZ#*=RAV%k$!mw44gDVO~^3m z?!=wy2^W!7nxpo|^z9Aqy*d1;`{St((cfq*&wUNR2q60%z~FUOV)!na?tJFwTN*I@y@7*uf$+eOuNvWw{V&oPV7bytii8Vn* z_)ZR>nu1kY zCL&Wa%m^N@u4DQ7$Lhj9v!i|HgW5ll;=lRhusordrYgyWop#&|eX9R4kN>lS2L?t$ z#B2>8)`1VnD)IZX&3|(6{hdxj1LCfNP(`*cgdg(oe<|}`I6)}d2544SdO9k*{$uX` zCkhbtb@RkkhV^4m^~gFOp}6Jc{rZ&7>%efVYq7I=T^0&0Z9zuI`wL^!_sItgkl^QT z_@lb}CEpqMznOd>ph0r05%#aKEZJ)a{H^0tQkFsw6xcZ1-oE2(=wc!su6WzP1+Kv# zt~6gzB_Rq-BP^hAZh?al!0g^)oW7R2)Wf0*BmT+7^+%)HgTFRtpHobXLwJk;jWd2) z+axY<_R6AyR8%=6t+hWyx8E(5h;lb?;fUtD1Kvx`(-zb@Ax@+0FF`=oJuqZVRV{N{ zl(snmSjTiI@AChwnfPFtIYb1OM)`-HDQU~$bi~~S1>9!KdtGpcEA6Zv2!|U=aW&oF zr86O%nmEvkU^5mL*djN5RqsB?Mg6v26&^nL7is^~Cm0~0^_A-KcB-Q)Dmb`VB@`jw zZk6IDGr_VS)t8`HAf0bzAnwES}2C^vcOef~drkoi4CMlH$#h&cwEznwVQO!`FcIMr<8 z7Z!w0V34U{pI3IcD`AyCWXeZ0qU%=e3TU$uQV$buqGr(eMki~&WoFI*oPW*4TwX0FX>O^Nb1 z1A@3eQ9lvnD|VFPCwDEAAVPFQW!x|6QPFImA`gx9 zi19}LXMaHi1-8S{t4u_2w4!8Q2{GFihv3A8Q&IqY{YngFLrk|QRqYl^Q3)%f`D<7r zCOWFJ1R*z2Ns4M@_*ElRscINWU4Yb|*F80YRcu;W*qHrD=2wJd`Che%-=B>ca;aJV z4})WnXfHm$aYT59wKxe2P;n`TnE4l@*_cWxiUk_6)(~e~JQW24`O(625daqI0{16T z_?${!XDyvrgBTeiLA>{Yeu#+m>CW{pirXDcSwEzUe5LJ{J^@NmX2Cn0zd>42LXJ>E zxL-qOe_ulx!+AL7!1}6@qx>u?>@V=V?=IO2Mc*tcBrQgcJZ~JvSmqoLE8LPj1q>&x z8d~};8Z-0`z_UHj^>Hh8LWk9d#-&292--xHx?8Z%l8Z~#i8;$2j|KDk$7PV>?Mpou zIM{yClbFF9Egs-!N8;MvjC&L_F+qMHf$Td-(?1E7Tz( z!`!y<3R)eAVmPXKje~y%KmKU>5?~Fk(c%$WJclFgsBHCXsjfnT`s4xyajyq>T0xZ( zwV8YHaWXTR_?ZFvdd1sk%H}`3n?lP-j+o&f*F=v{u{S51eVnW?gHBLqbZX0NQogog zQr_nwEZ77XM;e_-tNk)M_ws$(nYd0DJ@d}H^w0{oHDXlb;Z}e!00T>ToqWKn?5d&m zZ+NS;tu$lg;X2d8L?nEiTA)i^6TJ{y`m>Fj&62<;?iKKfv5G#-KD>9lnSm^X;%~BY zuIWr_zm&+T+7+yWp~Owr@5@CnaD9F)pIU!b?oOUS?_HxuKuW7hqMW`it$K_tAFAJ2 z`AbXcBX}E@k6^ft+zI_>D2qX{CA-Z)StXT;PVi?p{aEXVSy3+lci(8$q8@m`;U}hj zG#@p6ZFu7lr*+3m;WHUTpTI4^(^vr0RIdWg|M0iST;PDjjLw6-oQ8dM`7#&sls|lA z-TTy$c%Pf3L9I$jDV0tbKk~TrJBbn2hod;=(QfVu?3t*kmvM=|Em3+4`g-?DL%R3i znN?tw#443tSic!(i=4nPIDt4I>6-yVG-h0agd%#)<@e21@;3oShUE6ro!ro1>{J#z zlnY%X+Q^>V491@I=4r#Ubvsjp;jO3#v2W29nRtMbkzhT6sdUY0YJIN@%*?Py-QWT0 zpOQxl%hKAx>$+1c>@KW8}Z!1G2`chL0}W+vWdR3jt&jmXPke+(sCs z7cxKn%ZI?l*U>}vvXeFGF9Xu4E7+S#quI+@*y*U-M`$n(d96zrzLI|? z+(p6%S-EjL{n)N|Ow#j1Auc^PqLcJ-F-f+nm`CbuW$W9Vj4^>2Q&R43LdJYJj-n2w zcV~(S^i=uPw!^kfiRR*%be=7sv^bB~V{pv3%_e@wo|WmFIhZ=PIpfRMrMW-?UsW|F z+HF72;LgdQp%!YPCFqqT{g0uu=%^Dd#*BtIh%!kwo)9RrepN$Sv}^nR#-k|0|KvQd6V zMrJ@kHs(C^sWPI5ch%oMt1DCiO`4qqiS6cn_qB(3b}9g~otx=3y%m_$K0!h$Fgl36 z^VQ0xUBk;vh5h-QB9@%B1N((K<-C+=xmPP$lkV*{^>;_qA!oqGO8qME&^Oa6vDD)4 zQcQ~pD_dLdCG|b!G6JA|B97Uw-QsJ=9|r-sY$RrJ1T{t>2X&?0i%I&x4!SqpDlXRC zB1Bdh(W@J1Gv0+(TnBupC4Ve4&fns_)mn zKI^FC;$1uT?+df&Dru1t`p%sKyK^+8D<1(i9L5yrzDLmk6} z5>!g@IiT1FmoagvSSrBX7%Jq7$~1%8D6aph{}~=tSVZX`dtaH!X*%y|Q(Xqz9q_WA z8JJyAh_i@{bper8EZgmSu79R`z9w?MIKen`z|pJ3OkjW5R2Sr=Qbg2G8#7h+f(>qu zOvf+#W67v>-C+T;2jSe}H`)djosKt!9Q!69S7=nWiHXK`&8pn6Wa#C;P~$tnB-#6` zm53{_&cc;6Yr-&)m#xZS(UG!2L*1ZgOrMh%g3;^E{c?Rjc^gWgXqDINXncH4%zEpz z?Xb|%IBS9Irkgn2uXHpuDJKQQ3PE6QW2_>Hu#|$7i0N1go8s?@Lgj^Zc5pkETVY77n^Laa+?8HmmS!@nVln3{#6`0642()MqPEhs7Ff$K6 zdud4HBMxyB)jDo;HjUx28R}I8oU3u(@9Kv`kS)VtIznD&%dDmZjPDoIhKRb1#UpH?TS!%`fvGP!T1Ih5{MMp$*QGdkiJ___}bf{d~5=+ zd?QJepIw^Y0hn!W>)FwzI%5TnJ)dGQmoIk48F)DeB(ll#eu-XTU|UGdK4+S9hLRZ|q&ulOXW5+0t?D6v6> zIMv*N;Jf)?KU`0gin3ecB`ri_pRQ{w?Fl)gPAX#1P}8( z2*e8!{j7`*b6=PCg#G!VGC;jYdk_u(TyHeR6ddjGy7Y=e)xSujrKX0PD60heB?$~> zQ>fTyzb`4k~SQaW;dO(DA?g>tW3x$nCpyDZ6u zUCvnA(BVzLq?PkpOSp`!$cT)rm2yqBfD!|$`G~BWS@z&?2x-7jf=y2vH0T62)VA(X z)3S%{(s#U#ER3bVST`lSlgJ{x2_WQj=D`Dy)KnmgCkQ16IwJogvgsa8Cd%4wvu|8K zmC&m|3pEiGVW3Z~DC5&6qHw68i-Mw^`*J*`VVoQ)kuM}GH6yq)La%tvx&fy4ax#0* zPtsCDTDvMOBz0*|*xpwZ;*9tD!)`-`tiggpW-mc%ER3>OfJ{S$Mt8mG`!u%+GU9D# z;z9lh?c)~+c|Ol=gU?Ihw%!0{!P8aA2srVW$Ic1QKPBkpl72)?eEHGA9%yF^D>Sie_&OC3W57oGY62de;fF-1r^_rTu6frsr~chfu2(G*^H; zgQEXKO{14q30B4&AXXmy7mwZuJHIN=x1^*9l1c9wSd>wFPq81QkAJ2K8rd-m^` zgt!dKS4ocY5iDAAq=iO_?5Q;%sPWa=GG04%_$Xcytp}nfh-5K&(~_33B}ngagZLG3 zt}o$S*+otoWleXiW^DUs$qk3BdsbvR~4aN{2?wFC+1BeBfH z^wQGyXH3aI>4)Nv(Mi#wDplOS>U}%UrqO5{8tXNyK2qw1< zCghr{KntROx?}Sh3Kf$COz z<7yi7|692i+6cSf6*SjZ4v?c6gtc@oU!uPr*x<>36oCHV&W}P zoC#pyk1yuxV{5g}C9P(;F<5ck-XY?^8bwn5Z3OY!(%M~2C^WU>_(!X&9?*>Xpw7p= zw*;uGr^t7Yo$B+fXSe$O-2H7LPVtlclv#mx;-WcZ#~lOre4F?SjI2{upPOvukk!F| zdIIucq0V3Xk0qO7j}fXxYrw($nxc?mNJ=*-GDgW)n!Eh`zdjyfbLIh&pRMc;e6i3j z2_fDhhgdp?H$0RM&0{Ba&i|z;GVAWCouG;|$Ktk!B&}fI(ayI2S!FbPr=Rhhx~yXM zIz^I9hX-HSN4CJYbSwjEGF^m}q-GZp?!ma;z1>u%W@0?cs90f53~3kd7(l}i2sxxW zSq?@PVxy=Q^v-f#LQ1`FJy*x9f-qD$H49c!DlDMAFIdrpXOPH~5ba0KezR1`RuN8e zQeK^`JWw=2E(IlExa@5Yo>DeiE=7%i6xK-FhUSH8a-j=)B#({8@bRqSOG7op*pL9k zI4$(Sv5m`H?$3i;K0=k&b=Ky|^{BP%0Y`2{Kj4Ngpe^)YHxk&45?V7%NV`lE@ZPoV zU(|)X;-Dk)7MYF@Las&0NJ~^~wUAgrpV0%&&f-uih5*J-nF5xAOa@1^(9zK%wI;%a zbwkIkH-Pg<;4C=NMY5qh`c0!JO$hysPA~gOq>?yl{7JHhyG;L6dG0t#`)G- zC@TBr+Ty}Xe0n2s099CEJ+2OBno)F%OOxvEyV$N*v{>G6Xy%(ZO6ZN(_Kz)x6$3J> zfy^(kSC1GdWy?r~((#C)xkXUE0cu39HA|i(wn;#UusyPGHHUqdnL0`4wU3o@cuST`M!A(Vumn1I$>H+^NX1tXy&c;W#g>Ed1yjkhGROj@Iwhzj;tg_mjZw(u;!#M$gK^O_#L=Tp7-^XZHkhUHaCe#0 zKp1QeGM&@>89yzpxw++gDa+EK`J_#s@q;)+#zf@`g|Ww!?M;w5v3u*5Q^2e7N+TNcC;zCQ&|k`iIYh|8=!_2 z;SZvGDlOl}VwkV%vB%%SQcyBD0SHarf(YS)w_`tEGSd03Zi!UXRDTp<>mBL>TM70; zG^z~kT(Wh3taS$mEjq@Y91=GuKbx?^m5?5YEZL+kG-{pCaJbmO)DGc?R83K8n-tfO zv>3sil*Vb;L!e;^T}NyEnm5eH_sMf#7yb_)Zhpn77uRGpa!r}VH>_11RcdUlFF7J- z@3>y#^~|!1k&!BJd@hNc2@xTdG{cDeowCjiRfi2p&bvC)^dNTLisGr) zYmU0yN0U09L-uXPiJiAwecuM2N?R+Cea9$f-CNSa%vOv&#wDr2=b%E9z66C2i~sxp z{c^K2{+oqIKtrbD5HexoNaESjCC>M3!>ZnO*D>Q%DgiXs9ua1G?Zh(Y)0PC%pj0&; zm-ex%PH{??#Q*{15oYHlOSebN()jgRSZ~?5Q=AB4_Ik7`5aQ!7&ZO-cGx|V3ukKo) zdYnFq1nH`H7dpw{Afb+Q|DdgFRjMDtsjsbEkP=a_PSRkgb3^5VVIv{%m?9`yZr*ZMsiHeED zuCEyS_xna@5N;pv6Sm|g-hBu+qRcL3SSf3Mmh1_r?Q1(+@dbA}Tvkt~K##;G9JJF& zhqpwl#Bx8&XauGVtfPa2$QWa3f_gsK9~_+9m8Z(Y%w{IX^ViF6ZDvoO| z{|=PF-u8d}?YyY232pdK#T5tvkl^>%kIx1Vf-7aUb;8fdb9-;ZlVT(tn66+o<;+GU zu)!!J@u4kT0od~CEup+UQRTdMMk8T5C>W?YALx*T5VC~!Rokr3wuV)}XWLPVRkGt7 z=nh_9m*cI=iLJKdT#DSdBoSEG(rE#e8(5gD9bnS65V9hRPU!iv7^^GVmE+;m8F@Id zl{J*}I40xb0Hp4PY~d(&q^crkGz<|D3EZQWh;(>VS_3NSnNLP;4mgzr+} za&ZMG7ZR>#OAznTU5OaxeTP_jT#eCW1XJ|NHyrdP`WafPkP7}Rzmbql^Q@35P7 zi#Z-+&-F6@MWD4^#E{HrMpI$kEBim$P%I|?yFv#+4I7?4x1(KMvoQ&BqK)y0$ zmZOTMIX=iSloMB_*k3F$GCW<~2CnD5T@~kv+8n6ZxSJ!hL#q|s!?K*Nj0E03n2CHX zkq{D2l72MFq~k@#QVA`@7rQ|(6Z0raOcXn2^At$Z+|zT4^^03+fPfD#$TT>ZtzhW1KL7!hXvlYdP5!Bmx_lw$3rIr8P3OpugHxX|081mY$I zD4Q#MX8=_YgI0L87PNj+&<~$itAkK!DW*1KDKn~@eyjer4=iX?ijW)-2?d*YcFBgB z_f`n$1Fr7l87p?^0+Da_X>l>aMgq?~=d{C>_>{A&>$tD&<5$ylmB=0S9!L9Z`teU9 z@DFzh$QCn&no>m0jiME6kC*wdaB23h1!s(I>VDm#t{bJJ3-Z@T=4*d4%9bRW8#_1&kI~axWKf}l zD_^U<_fhQY%E64Qnde(O_*9wS1 z*%r4(c994#ZuWn=En^c?fDe9t6}iJB2qQYp66>iVq$XK4Zy{-fzZTxXh93SM3gze_ z8rFh77A)%cR%Uynlthh_fn8q~Ga+T9^oVr6o*T}Zi1Ix$A|#b!)us_mB%MvZ-g3kp z)Y||*wn%b{=qVwnpNo?$Yojiwkc(XMX&`ea5J(2qbWJm)2l1dVHVgNrqs@3ZkhQf~ z7mVdsJGl*i-KiRa%!}8~+DvmZ9*?n(=kGGd9%q8W&P`?&=)uo9R;JCp_^&BUbp8(x za`>VI>Ln-&k~UY<-&9v>W-bfuh!hCuC1yTU78~bchm-tCNfYly5t=DzBVJ0do{d@L zTn!({gntmml7|P$KfUFlCP=xsjET=m&2^Z<>$e0An2o1Z4`8FbQD8z8x?FOsBmijo z(dvGt7z@qyD#bX$ik;+=RIlYK1XqV-cVGNc$`_@3FLiN8-)k*Ja}wvt#yJl)E8;Db zns=qpW4P1>dyb#9!i|ez~XVG%AkTVWQ$soz*!azM=+i(6xV8ZrM7Q7#Ml7X zLn$dK%PZzA#a^&{=X z^QRLxx-M%HvfEDqjT;#0s};?)@}QA5dTgdfx8OjE_HpH?cCi=Gf=Nfz*b;OJ*40{@ zF);D6DSvF%hr{HaB+8Ze#WE?c*C@b=g6peb9^)VGN$yOE;ywh&INcHARhm8Qt-tQ4_$!;mY#oN$+hp$O>g?cnn-U+9`IWe{g z&c|pd+z9)IFvi)Evz8&@AK;3N+pcRs0uWtdKv4FVFoxWh=GaCM z*JLSI7c9$u2G2SCuPUcmh|kxpvu#8C)E9qWbpd9j4bRlbgXW) z6tQ`!cxRg=R6qIT%^3->qvc;j4iY(}aCa4si+z%^)A`3@=qe=Q~LJ5^Jt!&&JKo|u;rf3t9~wsfbCl5)H+v_oN@kKBfX zJ|D(!-p+#Dqzp~M)5MrscrZ|*;#R#=>v~s1=NHR=(f)7t>mVf*1GHNLP zWUx}3MfM%nsyZYf`Km|-<<}PZM-ia3du@)kwE^-ehLz#yUG(=V$O@xD{tR9BO*yg% zk28#*!71SA%}%{Hk_b_R(t#6#o}Ec2ox>;+c8B6$sXL(thfsc#&-K} zSWy%$O+sBu&Z}B`vgZCIds57?(7CR8k!KWmFZ*F(yOvJO#qw->GY(l1eZj*>@T-^T ziA$oTJ~RG`QAn$Mxo9}tul(3(`=C9n7<1_f89A1!soh_a%_)NXv!L<6ygd#aqV4pr zb9|MQAR#9Q$K|vi#5D8`9E!%=pOqvW`ZZg`?0IDr7zqn75prLl*+fCGv9X_i6~$-1 zdm3i#)a8K1dq`gq4FJ6y3xyC{7>-2y%%gNu8TSb}tgq{Q5-K(K_?1n4aaapoZQ;6G z^UHh}TI28jCQ5Uz(XDCw%saBxSh9(CqPw^@KE?0mJW{#6@Y1HTZN1hYle!tMLFiOf zI`FeaRc)cQ)p~E?+ojS#7FPRK;lgfvsEunndsjQGN!9qt=ZI1)rt@afPaPD^79Z#F z1B5uYg7Y=~J<-Hfk)MSPi|De10r~N!WmWFAPwn@15TVIkGc4AQt~m%@Y}|NA0dDj; z;|LLMoeq9MzqV?1Z)sX8@%15e^tcR>*Wi4R`-`di4lci?NhS%V0y3ZO8(soGP5;mb zQ=qvt5ebRNqQN@ucG8HC&Rh|BOFd*}*TCEOUv^bqu{XBSM_o1?0UwEg;QNcGn7BAG zb6u&YrF#6q^dGkXrr4{ncOpv|WcCSQn&EBlaur^nd@5E+mRVR3KVUj-)o9 z#(7ZDYX5Jkb+~~M%GSpnfG!07TbY(hAP0K(O)$sKRUojGNVZB#dH|w;|1Gg)6Ie(^ zssgBX(oly+bRh54zn=|?iqr-weU)!UU`-MaA%Ls-f26A-75b*ZL~UmMrAbFu|F~`7 zpBDYO%mco#kpPR6^bMGVg2U+QvXgiSp#Mt-c`!Dd`ue03!N?D2bSTV!H!uBb1GLuS z#373K0{Jc|N;JU~#Kb-Ge+|RHB`G1UgCzE6&K=c}l8>&@aSDk#IT z_^?G|YEGDz^kxnvKf)!+sonzryOWuKN1!d)aEgnIQwa05CW^0rXw+9GeL!>e``b3o=~(YK|X{!+@F^|3?c#;2`yY`v}))-IWW4ZvT5)?684gKqnX% z90bz2alzAQ4*t6*(Lu-@lt2(s_(BeZttQ(3QOW-dhirKvuFRk2;u6%{0Y6rDZ9DY{ z|GT4%K!U!K{7i@?^TevjZp(In{rY`-7zjGCXn}nN5fldM*tV-nypHH^ukSgeI03aoy*elJ3e_7b$rG^y3@rO2%%ShvsM48S3q?PU+V7Ms!m? zJ9%F!60~;Co`GcQcU#;k-{=J5>D``fhu-w&#<7%muN;tBzeDT^#hco0!_HKIp2|?Q zdi?nj2>75f>YJ9-LYN!@tlgvx3>Vq@arnGp02c^+R3Q-?8ybMaUHwtJ%bQ&xho^+X z6o$PJd$Hr-a78`V3(>E!bzw~N` z5-RJ1l7*uSBw%y(H|E`UN7gWkN6FdZmb#NB++hBOo{RiC z2cCv?$!uG&(+D*hMZpqPMUc8f4!AE};9h07`IZ|C{_cPz(53nm~>x!*Kl=@rA?0sZCUlXVB~MOEPb z0s+x0e^UGdp3n*xUiv>!bL^mk-!rN~SNxP_Yefl;w zIgx8BmQ1Q-tcHIaEF`IiO|q%klmt&Q!JfXI^w3dFOowA%TrDWyeaWHhnv0KGIXpxM z;b8=OTDq2Ya3Jkr3Dgi0lDp|}Jt>5NVt3Qzi|OpFG#o?%iLR|>l!(LAKDml!XqS2i z-^L@SNzQwU zm})!u6Tq3%`o0J6Xgq8%lrk?AUI(ck#~WRaBi`0*3k1FjdJJssLn4>Z4&U%nm~Nrw z?W~KlT8StEtKLlaT7KJ=+|Q3Y<($>BYgEB6C7DqL2maXlk<=XU+s5VEeq;XWdP_Th zgovN==7ifgY-tkrqnqF=55C=-|<$Fjjanuz2FbO}I2jP>d;X+}0LO>~!Ml3J? z^k9F6h=>6)8(Q5K)vU`v%lX>eD~IxyR*NtD9LA(5FC%k=?vK;WRBQI!FZ-+jaO`p! zmU2F)uxV5Nf>~(1;Qd(Ph!sxlrX}3teZ8!hx%c;@0h#@tcWtv7%=w1MFk4mX*kzqx z8@{{ZLUiWdALv=T#|}N0Y)}x3HUU3Iad;4S^fj8=ih-W*b{5;cD)hvHr@c5TyYg+c zg%Vk)In&Epc&i6D9^N>Lh-$y)lJ9X_2Xv?4_cF@mgCjw~!3{1{sM_G4iF2}N-bAi) zciBVlzjNnQHU|cbkcrQNN2O5+2e)lYk{;%^0B5ZeS{Oulch9S+u(IlyDm4wYj&GY zlY-BT_X;N2J^LN~a~g9nVfFuhdL0Y7&ANRwmaM zVQ`Jb;)4t`-?EcKzOB^r*}I3RK|&dT_#JBjHQ9W6sGK3^>YyxO-Y6?vvi-i-JL#)C zLpS`^7AUjVnx`w&-N@#pt!9Ru0SBQpf0$8!f_=K{Ht)>*l7|KO04EJZaG5|nE1B<# z48qpCC9Zw9y#SB+%d8OoSFh>Muh>poRODp=v01!9AZ}MT_o8XL`^Y|fKsPa^GVcsk zqXn3e1XAN;hD?o;ki~L&Vd?Jt*Ut>r`eW{L=gZ*Knug)BFAx2wKR=bvUO&d9uWZ&4 zlZRtPJsbr2J`ORw6^?e=aKnmThp4euN_cZWt`kI$k8;w5Y{(psCa|*sg@2cN?f`ir zDKmQ#?BZabOc`=lx3{XF=N&78(U*e)$F%so?t@>_^uqx5`}X(g!lkV9XP?`9GPC=s z7#U^EfCFT_@v5$aF=A|>Y_2!7)hdLootP$=u6dfoxX$Cxb;jNLvI{Yh1VL!?#8#_aS*a6TnR!p6`#tPm8y;|_dPxz)F55!L zyU(YoURSZ*SjiNMlFnZdFW$`{A8K^t5SPmKdeapuAJPG@nKr@COEBZGfX zz*9{=p>$DnK{XKLBThq!ZInx=GdYog__ptNu<4WsLVsp*U4_`^$rAVCwzVfKnTp}FE^g27rZdK)XfYjB!26f)AsjdW{-FI` z%o%vp+D>TLi=40&pB_}ozL(D_;c%=^FD(#ZL*Jc6-&*81e8YEI8jM3%A#BM7>Z0P)SvO=+<3B!6kQ@k2q*H zSrCaLWD~ktyH3n)*hwk*lD7Cq_WPVFt`62%9G};UHd$AKAVT*wu`}cP`)D{G&zG;We2p@ZcupUgG zK29$y3u+nr?D!O$&tb}NPGiSTWS5S(VNO!SB6f=>>s~-bx&F|XZrY2aHxvv+WG&raY35CAx;J&bd}rLK^;NRxP})NF9{_Amtsrg} z!e^i5YC?pFLLw_m0Edor|5Kn&&0=jzvz z+{Okg7%hhT0IbPsx5(I&q_B!s#&BS>tQ}*2rxlx|;wQ*{Zo}SABK$9;{J#C*M$eaH zWGp$;Wp&gW+QRGhXyHT=1iEUl97(E}rg+-lLBYPcJ zed_^6Gx!EGPi^xgITHH6dtRC!ulpB}=-Mt(=ssD{0fpL!AdjN2mzOM%eV`jO2y;`%cl8-dli9R&uHmL>E?uS;0uf_(xNCkzp?*{ znsYMU#_AMg#5W+|(YyZz`E*rBOtpFg46*r&9A^T;(RmAf;e9mLU{|$^Pc7i+dKlnX zIqmjjy1GxL^^PF0-h^BFy|1-?uE7cWJK;8X?Urw?_ojWx*~4`|u;;M*m{>zlmZ zO8u-^>POBPnKsCtZDttJv6VnrR7+~GK@ue$oi#7{nz#3N8@5=xi~aZK?XvEh@l+i%2 zFmM!Mtb6I{kaVU8sJNREPDcA}U>!!n2~a+^nvj{xRFLHto8fDD=Guix)Emd79!%Av z5@29m;!F=U^GFu-!yo1e2IBWA`Ujka^syVVtRn}^kTa?aYw((6W7Ra46lM*KP3#M^ z=_5G>zqalUFqvH`Vg)=md0Gpj(8t&fbi{8X#tS6RF0;Z@*fGJxzk~1pFtB7iUnp-Z z3BQDn#mLar*n6t@-g*+oKa(dQ&95KN_R^ixj`=wPIG>4wNJ~p21z_rg=yY=|c4n=w zj(OM}ue3N20-$M$nVD-5LE*r<{*w~s6XC79y&f|bw!MMBPR`6%8mPyjnZvU%)lJ; z)x?^L!$kqvy)#JQ{>V9_GvVKgJ4tu+Us`@s>9{r^<~Yx~^IczMVeuJ5I3~Rrn?xHG zIIS3`5jgOzY(4=S!(h>1&9 zx%wIIa>WV%|JZuVusE8nT{uW!fS`jUxHG}sWpH;58VK$oxVr{-g1fs1cL?t8?(XtU zp1t=u@7eG7bFS&G?y9a@darw>{?gU-S*R!%e*GcF>_Xpr8(yTc7E*IVz^LRQIvxmH zoG(BAo|KpxgUKp@@i0(=NMJiQMDz4kHJECosZz&Vo*WL%Z;iuPKT75WrMhmR=8lux z(A_)D>(!rvs&C`hwsRdr{TnEUkq!N}|rjc5 zr}6g(gSM*nbcOI2I;<((v^Fe+`f32O2~i1>z6yY{uW8)gY5f%U@J{`&-G+8-W!vky&Y2d~Id(e+7F$~+&-uzag>{w#~r5g-`L4pk#LF&uxkFYW823b@Q z#m6LQn;T@5dulh~vLCn~PRQ$v@9{`hV_@e|kV?l@I%W4fw z3^qQTilZ^?9-|8UJm1%7xr-R54dJ7~W~KNwam2V4C>EC3 zdv$)y+e25qh$6k5AzoUlrCt0;)<(P`d*;)&h)9X)sXuOfqz}pra^SoX{U)|({J#4o zoYR#RmEko#K;z7v_s5LrM=w1_-LOYMV5d{G+77n{M|+S>`tm!gue?9a+P#+zdajTu zs~50drrtM*??EX`ve+X?Ny|E4vY}#g_ZY2r!4{J!=+p);`Hb`wjVOe=3Z%N#vSPR-R6?tN3vw~8v~^9!0x7OnHj?SQ00=#TqaPY=|p zg0J5x2)}DM*P#-+x#BxM>G;v{VVtAPl+-knaE=oYP|s35k@Th2K5Z}Q^KkHq_jJXK z(Eqt@$sRl1NVC2C_487Bhj2b5c%n^#Jw#v2V`#!DOT$(Vv%JX;vw8R)Ev=hc2w6y+ z8T}7Syh9Yd!p8UaIugG#9CBeJy*%Dky*@ZQp(K~ApnEq2dW5v^FEloE)hOm%2y&tj zm#FxS+OLpXpr>gG8=LV5%Y5{9BXWan+t#`q-_rDN_?DIPY;f@lTd?EP=+1~+i_<#u zWK>R8NWGd&zzFLBj+%P7BF5ubXJJ8kSIL{S5b9day&*xR<$+Ex0%9l6T1&_Y3t?|A zSHs5cl8xWl39!<2Lg)PVjTQvp$=&j@4(!fc$2hy13G%PyRgXYMdz23NMn{Z3gQp9D)aJ`IY<^LEoxl5stS1SL5aM#plS z**ySHR{W7wmlmFt(|wVHW(yQPf*{vbyLW=+^e;)Zo)0o2>7S-Cp&K> z>p1UUsq51{z`5FeAa8ey2|j+BDv`%G9%)3pGSLmlcFFl}eDqey)r@mWfac{$)r5Nb zTgC7FRk`4*Y@+@h1JOpt1nRm#*6aM$g%{(=?A`gZ&er$KpIFhY9_T!UG_!5z^yyaW z-Ya@7{@uI$jQ4uJPrmtE5j+`PJ1dwiHx{`0D`s7yIlJAF_Y7KC-ocx6_m5wB+%FCt zOvXmeAfagx7364L9v@pizuc`APZ_x6VXZ#j%<1hzO#JX-x2JNb+?A8rGOe;j;8WYE zdz$TAe3J9spM4?^j!O=Yuxpg5^XuW;Z9}?^6|Xm6-5+k7qX#_S$xeQVdc8+oxq=L~ zBQ4`eju5$eL;C9QO}*uMSn6X%OMz02*qA4RwDEG-(sBd@|3R|q_Nu(xY!A5oK#Bqs#AYj__;#*YdLQqB| z?8aIc<+xpxpw4{pwCN?72|(pkOyx4^j(-H^M`hsmQD9gsFMwb!k7G@T>2=+^7ao;_ z&nKaY5Dg7fmZarzT}MCef63-|_)1Ne$1NSrcy9dD!*vAo-YhoScjrt9Ly z>!3*t7v1fE_uAE&=;5PZ!3gG&B$gE3vWGn0vddLj^~QoG;iHhu5l)!V}r zuXMYQB4zv9ELjYA;E6%{jB?8=8w(nXIMr^9It{ChN6ky$_jV98E}!K)N`ugtzT=Z- zB!@SwzCk7SZEwDL{^{zL#?I2|-O~(6IM<>a$4B7oZfb$}S$n^&4T^+KmDsl6THb`+6#0@)uz_Q{$najge*%%(6P zAMO?XWS}&gMNIw|itMfKG3iNH$3+cOwFSUXp7}_M(7Ta27McfqmnkxwI*w=dbVsID z(d&Su*AbVV+ec+aM$AjN5)0h;@?AeP?w$a?AhST6GQxPLi!PTc-F^4FJ?5=0mQ(}N z)Oaryk(*Kt8k)dQ!d0iJ1o&WFMjyhc{;D?(I8r#BFmaoY(2<3&*I>p?k@8Pu`SRjx z);bee!WjA5EHKtC2jj{g=^9#pp>f-B2ci;2TnKMf{y1XCG+#70m1RK_Gd9Jc$Ew4m^ zI8=4ij|xW-1Pf{8medMVXH>r`fKq{y6 zyZ77TjJFYc-(M0nyY_Biy<0)yGl-lH?{NOo<}Tqd?b3t0;tqUDH+40wT)m z)X1XuVPR(?Hx&BDQtJ4tO-NtF1hhR*kb^H0(ebC@Jm4JzD#Qa8*!WCZUb4qkc}+-# z#@FN4Hj+e1^^ONPG=Ov39cd5WKd`VsZvIM4XequdmRB*6}3>-AEy}wGMz2DHt=#wCv8HWuO zK_uY0TBUpMJKuj%+-h^W}T`vuelSF+GRy)ue4fpl=N2(bv#(u__Z`FxFlVZ3iZLzM8^w zHn^3Mcx!vo$t&bUEAQ*rs|1JeL@83`Nkzeq%l2!H4g6`(OE1PN)EboIhfr=%$oq z;&~mC5p$jY>!J==a|+@(d`&u|Hiw!prsPl7SzsexHWda9=cf2W%H2^|Ci znTnO|3dms^Kh&9GzI}%Kz_1{hKD+remNT2rLC5 z{`;l9OVBj#)ZzZm6#l+x6OedHKZZ?)lCO3(eYKLB)aUE>A7@w%8IT!c3lZPhn;{(_ zIQjjbip`-`-8+2LJJBGk{dRK>NIS7NzcStMYEl5hq`M9coI!I=&T<81o zJkw2P5TPpof-2RcX|ZVh^UrtNmCkIw(7oOr&l29BDN%p;_!o5w$xRbDZ-!7+dcAo< zKpr(MQ+LZhP}3oNOqXNjSACQw63m}@hPgXvr{EI!wD%rurIWxkR02G>udbiIfv)#yVG2S=n|b*u_HjzG(n#sanZl@GRnQ-BqJxwLpJ_83@77SN2~s z@FTgBvD0S(E~@VCE#|ruYTZ4K7u5cdkiSXE{0Of82wvhr-YNwiO8Il#))R@t{wnX{ zQIFaz`>K2rqaeYWC^4w&BZW+vhzo?@%l2kQoeYB7dwae@B_$)9X!r7B``ifpwcAq+ z3N8O&s;Z7EDU4M!)E#2qL=74CP}qA`C^XcHAL*tjpNojbKTOaMuE-1P>HFojB&}Bc z2UPxh;#y5Qe_0z_TSf?vupfk#>x*i8``xM=7V5^`KX{Hrs!YRN=mI(DGKKR(vz7)u z){Sl|>}?DnQ1xnYB1in&U<^g^TF|(we?Y(ng#D|hD*)*N;!rK2{>V~~VcKt^m((;3 zF#hwERoKp?EC@-5#2OK3Is@BdYKX2Gsixc0U1*M8qM4PI)%f~&#AMI|_<+YQgT+rN zpI*w1hsgF@q4!^)9abvnA%P=e(OL^RSx0lN61=k$s^EwSHJlVURKlMQN3;5;%S}lF zUi{hF*(!99#^o5ie0($S3mY3bpY+Rbq%H#u;xp;klJ@oU;FonuJeF}GOQgvGrHfef z@Q9Qp{Jij|tYNjd&0{-Sd|G|Oec&HqFpdu>Oo@mM@;UK>nrJaqT4DReW})_AoOM#J z!R>fl=y^O>k@1)k6{T=tk?6`W+-n$GC|!)IZ{GV~uo+fTpOs(w9vg%p9u6pGmv^>i zO|T%-(9(&`^kWt)OaiZm4cKK)cqsO><<|8T4?C9+%QC`&?|{^#$^56`9bs4 z617Q(Q%Zs`aW=zC5lds%+0BG z^2z)6$p6stbHp8OedXT?aLchY2S0pKByhPm;J`O7PyRpR?XO7GgjQpMhhT%wX>b-% z>FMIUp<@;0aZ$stjFBkN3~K_hU9+0B{s-j9RuMWNz&lca92FHL78}MM^K0h=G&4d% z^(Sl$-g_Y)7|D3)Fblof1`gSPrrGFDfq_b6tYeND*C*fb`v)xAp$Y)V(*8#W zzK4~PB7S(Ua7u~3Amv}bIcb0pMNn5-%&l^x7Is4E^z$!pRovU5a^y7TyWc;UPaKJk zghd~e-K;lg1op^o6=fR993Qa~GeWxEe}hl|ZIspWLU%0>4PkTAopq(3L|aZdn|{?V z39M1M|3}CE18Ds#SIN+c*@76WE>YnS?eGp#-Ba>OiSfe4;wJy2ssCdyj2FUw=#6R_ zs7lTG#7=#i&z(HGw1kH%NseY%C$6jm%g^w4h5tRSCIu9b0{Qwp*9=k-7(y%LQDS-JK$<$2+c0&|GEe13N1@-`QfZDbaosVjXn*L}i*Zt#B#h-Q#W!h&5eId%# z?nrm6Jby^5+g)+REdl@Yxp1k@@7dRAy?@rQTo^1e;c%DDODI}CMQI&!g%IWa`6w(@ zK_yB)zGi#Fy-S-6G8Y`F4#UlT${7T`l%AfxFNMv5 z(cw^q_j+8I)BT=t)p-jU0s_ETSXgj|pt`EO-d>Sf@&9G2WNrZFr?}6lox7PFqf?BO zi=aXQdVO|5VcHnhaFD0@dUq1Lk7?SV3yGVXQ?pww`a@7&Um=Q_`e#%W8ZU$}a$syM zNUcOvMJ29z#gLhVi|dnXE8(1;7vJ*A%J&hrxkAkdh(S-w$`k4~3acIE zohI2jbKYL1RXriQzxLiJ;mVGl8}f5ED9vPOoc8!@(5#^LJQ>VkI@Kjg$EL2Ns; zPr5wz``!@XQK1r6Q&UqCpBww%@|U={xG3X+OmorA&CT=Unz7C5KlFa%p#Z_&xj7tb zYwLlbA)&X|7uEJisrU={zk`95F$y_vFn85RGvE`krNNT}xffBGpzDA9MaTu(Vcux` z#n=IAfV1W!dewC_Pkff0rm8)R@dJBuX8>EG-D&s9@`}rU(BN!7kgxak`Tin4g=Dx;1YHx^ zt?Jj;1%WG?zXzma2N2vFF9r3%Opdy%NWH37>Gc(Bay;b5yv@#%A$ME@)ITYWUZQQ)7xuIcApr1CFshRM-Q}Fu>YEel6=pshcb7b%89URcp8wo1ZCnb>&50Kz=suaw# zF9~Wg;Aku(`rQQjP?aBM_FQbethd9-ov4A8Q#L!UL^Q#%| zBC+zof2j=ZbZ-qPoQGev%|Cv*?qbH30>QVE8ttyAc0;_GoJ6xTM1q%8;i8F93hb|d zygf8fiGYs*EBKHPU&@#|&Rty zEUn;^!2Q4+RID*zg8ZpJ%e@uzvJN#$fk}p~HAZN_z8ExiyWl5uXn<3*dKXI)%k5jNXSc2 zhw@+=a;}F_D{Wjt1L(7A5k!pi!JI?5{B{!`S73-vP_;MKo~)&H@r zro-Mnm;l}o>j0t+<1)2Y@JFHQ5-d#bl={mR22e%PZR1nUgb#U^>una^CVM}VGxi7} zqWIa*N$;$EhObxDX^Zl86}%cQ*jdV(@439&v4IvQp2z?x(V9t%kSNp5%;m;x{XU_2 zg($ZuVk*U4(Xt4G7A=aQEyZw_vG-~#v?xn$G&od~VYUnV^Trdp*5p7_E7vkL?GfbWOjiH@&WQaJ%)WHkxM664aN;R+Fo9xw#JX zjniKSgiLbR-jezU(`nVmSKWoTd}Wo1nOl z&lw9B?NAVsd|nhve@mrfX|&z8-Vsfbyg6GVf|Q2R%~`65kg}2pA=yEE@SHf(iMHp< zKl}4lWVLZPIZ4&ccc&|OL>|}Z*bKTKHr_TuMKu}*s^K)hw_;sh*rLBB_Zjs9SNe8z zmKHQN6!8cksJ4HdZtx!xaKyGbEINlg&IxcN^z*gFw-lcR4_?+=|4^&}NJR$NRM3A` z_<1CS4T+zh|NQ*iyS=^LTz3Xy1&D}?Zw=8@l-lN6v|?2U&PqYbj20YBJRaVQ85$l& zkALnsxE`h)1+Lo{YLoocfd4iT&B?((@d z`lcU4A*G<8@ZeN_ABaD!qcs=pSPjtgbeeuRE?j!Vh%n!AuY_1?w$M;>I!NDz_8JlY zE+d$Rk~l`q&6y4OuAEQYniB2Lug`=h)dukr=k_ZFEtP?jO{yQRwO3ys+rO_^&$Zi( zl)=4PaWv4(em$wvzyzqWyz%0FU{W9ct4vL~p($KDrV0*5$4sm-pzBSzcP<#?&cANH8A!nHOe|qjJYS*lm*$isZ+DwPD}(=>|&B-YtsySqs4tDRz8Jy62}|@MZoF*22wzjrCo@)z0L@6o zvW*vgcr$Z;@TkSO*<|7og-;Ov@fS37g};90_y>ewe^%8g{> zA{!aSBnDs5zlwYYfjS`c*B7HaXN5~BMEs@JYgONZ9;q=TA)&CMe?^Q^(4hjb<(x`w z#E{!M@)KepBaiiq)gl3uwD5zw4gB?*D&9ylv>)Q-bWxmk^d zdkO33(e5Ai@m3WIOlNLFzYf+KpECN@9m!?dj4|Fn?&I_KMHA@U7wkw}xnxk165~U{ z33`zpPq#(Tfqb!LfOt^#lqcknqHO?UV`8R{>kRZrY=g;F{(7dSuFykO9#N!QqW-Br zaC44VWT;&baoUW{Hvaq3-HV#q0aNl|YNnuNh2}pB7$n z`V&Q~OpOiiWWCdGaIRP8lirxCpa&$DHD70elkT$nDK{^Vgr8qmma@)p5JUTWFV_9_ zlziF*Y`GsoEj@IBeDoB{4tQKeBYbR(WC`ujl1-Q?PKb2M{=R`L5s9EAY2PgxjbZ$@ z^>PN|>nt>=~YhwDBovn3L_tb6~Q@4WSsd>|tpQeR8T3M?k_k7Za{ zFiZK?!)ni$x(vG%f|sk*|EQADTKxlAi^Q z5pxihAYH0fPov40($UUNo^c_T$^368hJ3lS(7)CCoxbnqYfMl>Lqi$Or$MSbn|pgf zU0p(Z?12`Ln5(zeZht*j#q`Nj(+wIZ)(b8m!}8L*`)_nm_M11^~u zr5DO%O2*IV+TEL?{^>W@y-}~U_ESu{<~k>4kYu$xr)wyqJFR>z0=v2lQ;@+Q%az?G!fEt0AMB2%j|k>db71yXE8Ge31en%&ON6?jEWS%K2nxp zfpDm-_vMb8LbEpPk;$3DG=*13A}h`#2FL^jd^kyz@+-rCr|L+>N95t&0YrtOScduf zR9%w!<+;ff?x??_tNE5@@~87V-Pg+3J-w*>Wx&o`f?%^LZ>}{AiD<1KrY!Cx%8EC8 zR-DWj-sQc;*N0sgZaqa=IxDUvSyo*{er-)Gs0-ddfBxj{RiVE`^4s3ivo=hTybFe~?fq;#5j4g1&lmmox%`RX6tSf?7gVLY&ZxzhC^Yl} zM>(len4?V|iPcIWT)BxYcVCjortFrj$qs3s7p<)4E1qo^R3WKjYXdOy&`J)ac3seM0?u86N*qYKBPj6%G-p1O1tlQTFi6Ptz<+|x%pjntweID*xGV? z%)nu8g4A8d-?(F`lZShFA(%GK$=MB>P@gqu z{H;9Hy=eR+Vp{qsE`gi1AGHIyX+wP9L~PNxD%cdw zd|ga)ZffhbiYIV445(u2Vv3WmuV&baLiB|7UF|_auVh$d?SNUnz|5O>3=PuNXY}YH9nPPLMvIjFcB;0S zvowakKfjOWN`Mg!wbW}%#3XdP_28KFpAQSZR@o&oSeu^IjenlXr9d>LT(L7`UXW?t zM1*8I67T{PDFcFJCX{eH&L4QwXzAG}x|+V>)D>%x4+{*>aD7oO@OKH%xs~XWTa1=4 zBPBm7vh0_29G$w6(!&F7WPJ;O6HHm&RsgJGtEbv*Fm(oQ~~6{qIJg_E8F@-r2F>$pd5+2e#4S)%@vNmr8TX&aV7wlYxniEO~D>U7(_U zfq`D7vQhBW-=gfix&}oF-{a+4hcuY|J&o>@Q<2mb`jrJ?aLr8XNV{X43^tI zc2m-LMcA{0H#$ZlKWgc|M3kzs!r}WU@;P>6W!W?&6L&%KnZEvPG!Gw$%n>-f=UL;B zefjoC-Q;#G`9OW9+ArVJhpzXLFIftE!p51is_*(gTmVxE$K2`OP9~68dM5x79yD$` ztv2umy_h1CTJj0sqNJq$Y#%?g(iaWkR=WlCsc7#$2SkM$o8yT)J@>Md8T?^qyCxfd z0h!_i?It+E1?2?VcVN1h3lrJw_b_tJ{xW{^*)e;lUTDIla#6mTu@ve2d|qQNAx5jI zheNwVN-C01--4*A81B%lj?7|@RABx0Bfe0tw&Ng}w4tU{F!g)MsuAKp&eizut zKu#NE2PsnXJhZ^nkDS$k$}?6qA(ZO|(SvE_EM|e2c72JIV}1@-W8m-nqC3qfvp8oy z+c**~@}`-2gI{W)Pqa8Zh*mw+&@O2O1O==512~i(g8n7o>>D$y+kQ#5X~noEx#Tv%;YlkZiXN?Gc^m~~Ni6=>2%AZ16emo>M|%L0>TaKK2&2gHe-NlQwnNo#UPpVK{&=lZ9c zL-R$q`%ISE2PkH`yusRx8g#HfRT6D6muXN6XsSS z0K7^*(j4w#qaP`$v@?4`=1V9;omS=|3=~J4QOz0YbJr@l50NpklB0KPieVso+l(-h z*p95y$B$BP6AH6l@}Bf0acCFvc1ccT`eZ=T>q>VZ0{+;lm~Y=)6xB-Rs@~9I#SAZ{ zl3hF8F@gHY5UdE8W=LC(LkT%HG|;joCzf{tj_DId{Q|e0J(g%`@T}n~$*paz^$kbf ztn=#|J`Rd$3nkC#I6EN<*A}8xXs}A&Rgq-4TfJ3wYsBrzv7+o1eOPt%TMK=TlG<$` zKwV4u?5BNXu!S0qZUo{w>6ZIU+st%?aYJjqTPb%`PlJTNpSAZz_a{#r)rGLN$SNsD z_$>62a*Iukw1^%|_-Fr~iwMBBL8nM7l?Au{4BV9owo)cqWIQ89@}7%B-%l zf=wx<^d@cQDaCP96gTR}n3_wFn|6 zt~1^%eT9|Xj}#6)kP#wAfFj?QB;{#7mmC}maM;3K2PHEWrI<8h3l;8<6DZ9=Dby5% z4P+JBJAODhMe@j6+j$oW(np$D}i2ciw zzo70pZ|T@@5Qg-LH{9&ln%aA;A}s+8y`1q*dxrHMMesHVJ)oXOk3N9+Li1*|nqCL+ zu&O>?ao;{G2?mL%?%9P{mnJCn+^esHtv^KPXv)Ci55m%`jT{+NUp-s!3?M8s{XneB zEPZ^Jx(5vs>Xj5N-Q+MrcPIEPltbaJM2#&TS>`+((B@Q`9A7-Ae9bBzk@KEd%6e~I z%8TX63?bZm-Bzw@#dFWHoUM78%Z;aAkT$SzSKa_)ds~SuN!S75vFCGdk+c;4oD8P& z=HylUq|${O+OCD1+E(gW&odtoG$G6-L^H3+p^?aoTzdv>w8cP;v!kv#ILe!ah(PKT zQ2fC7kz}n(LuW*7QkmrDqnP89ILTNG!F&V3&_-I6E3!Hpo>IRxrd#6l`lA=B19WCElp2^c3=iGHcxamF~~G#Xc})O%dLUpW;5w)Rju#1}x2J zLp19Pul2z$2kt)xi6~WzFia-gyjyh09V4$)hz^qXeV*q5g8^w?QIERj8HJwxZ*@x0 z*S0fCB)`A)6IGUb7uOGFB`tHORLTMf^H>o$Gmx8-Qm1>TrRE2aOwO;co>Hf+M@Vnm zPkfM_E1U5tuG3&t)6e2=UimYQr!2N?1bi4LiVkszS$R}tb$VWrnOv|YMy4HSJGEN! zB@0{SP4tXr81{}$H0`t3VLp9vCATkqeh1`-jW{pXP*-llk(=y-f}qJ7Y!M#5A?Stu zKy;7+jO?{fjd4}aB2!+ne0M5PWnV0zd<)a0u|1d8PxzwsGTLrkJ1=;*W2SEhffTS} zLuH+4ToqXvHQy;{`sfM)B_}oTmywPVYYpgPwkU4$2CbOP*tokNr?rD~UCx0h9kq*c zG%J&t5aC*lVk)eOUIGR2`&6y&^hv2q5vgbtIW?QUBATJJ%t#huq69DY_`N4%+Tm@e}^r5!@*!Z&AelSZt zCD%V|AE(ukUVBQ@I#OxwbIJpI-f>_k%oh6Qp%KO-3n(y)g!YMcz58JQ;=jdfB#o28 z@X$FovmLC2Z^r7+o>wZ7_B%$IGkH@nx}v$j(qac^WQxWT55$4+JR~#M@&XCdYqF9j z^;C~5CTku&kxO$!O6`vJq4Zpg7H1TLvAPds@Q!cSQ6foLYtT|q#Y4Ltl#C2E$z=-h zKX)0*RB$g&MP`I1RnGB#va<{|x$@y^2k%Hc6`yV~2AMlz0$UHa-!V-%)Sr{U4!L8z z3t*NvP5vC^`$IZjI@&QCO|ODKLj08SX%8_^#Z(OccP};mOs&nyoW#9Au!J6|jhurh zpsV0&KkLLkB*|NGWiy=-t$inhpu<7kp8pJ5(7~#7te!ftkzX~QsARlxeSKWP^FzBn z^bJWS{*t`pfu}$3+b2Xk>DYE@rRl?5K{Bh`hi*zlEP717vS%daqOiV+AvQC*LQ_J| zCF5-2e2EmQ)q;2n3});WuqRRNJ1ij~36cl#`zi7%ze57{FMMJz4B2VL?-lExT^)bX zv?&u!T}wN4rsHBaP zw8`(wF3d^d3BfeS&96AhEIBimaD#6m^071#M{KIh%y*WsCz7O5hcXpR({qn3y#R&c z6JDL@Xeo5!p_m!&rxy|U`=L+H&at+$(8?cKNh~(nC3S(@1G!T5$QMZta%Unj!d2D9 zKxzqUq5VSo;d}tw(J?|PXGWniXA%#$k3%D}&<+V@9@aQgR$j9~cC3Yiy*Etkyn~m~ zS0Yh|W*0dn2UXQY$8%eLuI*nFbPG)zCnD+b#U#NN=B`C(64Z6YuS7jBB(RM7DG4r8 zkw7Y>iS`EB7p=F&0~hHwD6BAzLHYq3D4GTPu;d|GpMhDea0TVobrM(<)egtY-kQNu z_V9Slm-@6(qy?>0T6vr?c3qX0P?I&Jlf?AwvXG2Ivb-+&#=aFShC z$=VICX!xbN76pZUkoy*pts%;td;5q`g-lw~Lu@{x$aW+iXlQ4|KyDj{^SeIV-S0$J zcCLBI+Nh0u&(bO#&wu^m?L-IOTV-a3-^RH9F7LQn`itwCssim-s7_qBW4=c%gK%7} zY)Yo8zWE%*9MElf6)~i}UTb1rL!Q+c%azxf$5q0DzOj>!4wzGXA=%}u?dkMs)q`d4 zcY#k-2`eGAqO}HZf_EVC<4I$#>fI@ObGXxXl5PKPqrDUZaTe}!r>>@}0 zzoD40U9|p?!nFsbN74)C3ASx-0I(uIgGzJggU4p#XNV7wYYb$aoszf9 z>0=UK&AgZb4y+^DFPf=^LyJWxn{Z{O9lw!J2PCulh~gYT-?ZDz%}DcF1~lkXAvpYj z#%{7lGFQ)o5kGS{Euw@)GT!Z`QoUjc7Bw zir7~;*y2lLQtZl6c|O}L?bm3LY(&_IC$J0|;te{xb?`g#Q3ub+S+<~5l{HaO_(ta0 zD2rM44fOTmiwL^J zF;)i^`{Ke4Vbh05<_bm{YpVm(&9H8ckjzM86V*#!am!<2B=xuI>I(>G7W?t0+XEpP z{}5=rVqR#g3IE#&LXn)g;Z(RmS7eCIR>^5Vfmy#of{{*BS$gP?wEYPC(mLn{PWxS*s~gWL`i1vz$2_QwEM{ml5vuZ z@NCosC1~DltT#CNBT1h;KN~^CO7GJ^xIq>obFZEfNR0;c@IXwq-|cY)bUgN7Sc3Jc zL^JBsmYbxhvuNTi_wxD_f>h$vC7I&XG`aV=F^O>0#Vy>_ z`E=k2Y?4)#nqj$==H?g7O{DjNb@Zf}jMYx9qcVldUteF#i|nrIJjiK)0>$V(@Oee_ zqICC+eejq;hL2g3bro%g60aZBI7zU+H4n{DATyHB;LCmZXh=l+VF*RMRKnR&+z0uz z=JV=L2WgT+B($YJs{1}SbBr17@_fR2U}V4 z3=NLwtm3^7JgUSz5LV`&+cPO$ksD5PZV|S~_m)5CH<=W;(9pfxf4{x#^+slDy#;FL zls+JV>A{501KWlx!7AC2%Lee5#)e_NwFL)XHlI+J^{N+1dOz=CS95(Kh@Lp`Itxwx zo_sHmL0rz_Nu`F9Ti&|Q{#3kiy4`BrqLKDHXSEXmdqVGxv0OZec7bEvTL;@DBgzf* z`-!JqxoEA_SbeUoLeTze{!H&Tw3PvPzgXO|2>>Hfl2f0^3f4HC)t!Adcnty>H3P&h$4Tkcl zCNXYXq^{uMoa(0Mv7g@`KEU~Oj2NnI>CA6W1z6ml@4V!4vTR(F3fi)U4E@|7rCtO# zrepGIUj|FnwDTfb76tRFc4d%Ngz9bjQKez(kf_N%WIB*5(IJ#S_K9%NV)9QT4;=6; zm*DA1;R_?Ec^%E1I0|=O3tberY5V2Et;5w>E0CpJ?Nj!HJ>bAN*qi+o=thYqaP$5( zh>Yk$Fa;yl;nrPle~fyf)Fvr;m=!;qju&-}G@(Zjzi$XYpO!$U4Qd%}-hF?^VO+_2 zWEs~Lx``%g(7%^cl@BNj`)MX6w34b6J578)BayJkP?1=6cNB9j?M;ZJ7Eh4hQ%q_+CyLoIOvB^r z#D2i0>skA|>X@0fBG-!FdNPh{TJnNbkqGY5^YYaW*F^?KwQT*5i42%) zGyvD{BlKbJhFwR(bbc(JqxXH8uF!ZkySLGZMyEmfQ$FTkS(Ii`iMTD%%jbj#7T%{{&PdHGOx#khM62ne1Ltl0T2vNFLj1U%*y>p>RscSf6d zSVq4){VkMh!a3-V3BkKh1prkNJtkHL575R}4Ya^1jF190_*)v%s78bfv9@>)l$T?oXIH^5-=V z%^$g5B+Tq-?oAqL@F~=Dajk9_9^d-NE6Kclza z*7}a#J%KEshKiCM&N@m%k@el#k|688rGh1A{ko9X^F}#J&G1nC#Qeudm5;scf~|8) z!BWq&Rz@8IzFk5>itP&e-{XEgYECVFRVs(W6;pEj32kwz_`(r7FH)WA9}z@ON5m*uS7_jX;TAd1GwVavJ- zf1jb@*%<|rtX^suTSp)Nsy@W9`(xLt&a2r4X>G^tGpS-z(G7n1-N1;va>oyoqd@_o zKYC&E0#4;>Q<>;VN%*Ucs>}KP?iS`?@rmt$KgyXJk=IyaS5E=$5r5Y8%;^@=-?Sy!^#;hMPRfSSC)c_8EV{Q`7`L7 z9yNKs=^-%;{tIVPR(*ru=4_P4vPd+9tR|ynO`JN1MpaeWWhU10@1oyNHUq=xnGMd_ zF?b8u^o#zovT@at=pN0$HxPphZgXJ70u6t{?`2de+E!H!=fVtLokdT3!xvdn+@fBQ zkJok}2Usoa51hS3PQhbz@uZoIz3X*l7t2?`8NS8JN^RY;#xwO8+0&NINo$xpl4;Am zDzjCmlz7-tfDJ=s=zfBnFH{6+boe*;JJWWGOa(iz^<|UMY&>!*;BDMVT*@D^V($>4 z>-YM{Qdhn&Q^lO-R9e5uKT`J?(eZS9ilea z0P-?RJNogO_1Bj_L3Zl!WIscJH*Ft;_J7f8S=SjV^@&4Bv#@|+dw|je>dM5MHHDh- z?djZX(4K?suOBaG`<$Kig_8g28pFkecp#UX@$ea#>cIwIcq>ESDDKBaP=)~hQe=hI zaRUOIISiu~>azWyQQ4O`QI^4;m(6km5BZR^V*EdQSe~e~uxKoMuT8QSsJxKvX!t396J32Ikdj3FRPOVoN0S5~lGs5|(Ts#}h^NT}uN7}3CQsLu0E z(c3a<1sz2x!d~R-N=*W9#NYr5ln^iPBJH$N`*gwqzwmYYWjPsqjqVI54Q{^q zR|QSv248JQ*!IFCsh0btJ-@5e9rBuSZQBm%B+J*lD4l-{kd8TG37zj%!&r^t(Re0w zcV)?*SBS~VMI~YXw4GKCp?@D7`HfKuB*e41N|k;a&u#;Cv3 zG4`&s)Ae@0>SUU_X4{N}%OY|xnMqM3y?O-!(qJEK$YaRmJ9~Sz`-7Y7@h&O6nweb& znVy~vzw#biISJpg0KvpHifG9>jk(m;gR`mb35{vF0Wry6%|k8DN)$lWqcikDtu>OF zm3E;!ifl0eX^lcm)vZl}^#JkVuB88AcZFOOxX2MIM*k`uT=Y{;nFL*NKhe zED614GP6gKE#9U}9-~yj{q@z`;Ry}v_ z2(Fu+LMk)@M_XNKh?VlHMmuK!cF39-dd^FUW>a2Q@8<)hHGB4g8wL1z)ygD24)HMX zM0lQx*ZoIG3sD|C)vetFjRZZxL_Qb*hv=rbMqo>{B}hpYJJgAQbzKEHxIaj?e~NA4 zDKB?Bx|x?j&nzG`HwYHi?723|Bc#Vi+o#pMbq^J!@vCtQ)x5udx1XwU$Vz|t6MELs z#75fJ}@N+LQgJwz=KZWggb2~tMccoBIM`7lo?4xdN`y^SNrM0%MEs7 zTO2UfE&mN>_+3K}??2!$P>SKbY3;@tWYKBEkf9Kll+>n!Q=ctK>}wnAcG$0aWGg9u zxPOlkYF8Ybq7cLYQHZ1`EAh#KaGM(90w7cmsHluMk-nx=?Kemu%bwkFjVGoOyj5$g zX~~ElRBBS~9qZLk{d+s$g4Y)>;nTn|MA(Wu>nN1km>GFgzzza!=)Lrn;xnooTZD*9 zRx49GM73OVYSL$2zxi(PZLfMOw`x1ISH(G1UFvR_8p%#cJ3y{W<|Fo`L|FJIjrlq|<6)V2tLU%BD?c0fzrSs-yLK1fe zkyJRZggg=>3z4b>vgj%0m-jpR!H>7}Ud-w~8j2!ph<#Ck%aTx_)(cJGZ?RZ(brQ&j z@y*OMax9Q8EKf07VA#t3fLs(#cNt8D3c%9DSyv@dFb#uC_>?TEO>ur?R5Y zK=H@Ipouuw%?No)%eZl#b))VV)2_%L<(0 zpSGVpffA5yg-80{U$vf?id_)TrEp5F`CzfD5VsE;F1@;+{6osix=gM-5+Zr~I&3#? z-iIahlV;h7!FHQnnxX2r6GLAzQUU?Olyg7a7JB;ZFU z=!d{bOdMH4?s}OQ@fKG{DE+Mn-uyQcQv(>*Epa7!k85 zkjLi$gRUEX)D5$8d9sxvPtKLYIUSG#&#Lvwp?g0 zb1W;_w)i|wWhlJ(c@2#Hc4Rvs{if^KmUQ{Awuse!+Q1xfn=8^`f?B>jR08kLgI|vW zraZcI=6 zak1OI@UFGPsbUUYoarQUGY26DxdG-8DdvR~pL9p__=KR5x5OYuFkbijT~SG<@Y-8v zvj!g&5_*9ql<$od-{ioKWk7}8!v@-VdU~)TEYwqESu(;ZB(yU1tiH1iaV4NSma z?RV#|JM8SDZL+8V3r7|aC-m50Y)pTUR$U02+_g$uz!}WyS(;BFif_54J*H1Jv1^j) zYt-r-_R%FJS#h-u=P*)wF0$^1WS`DI3@gTbDR!rR)xHoSiqBI3X-3{NgQrREfZ0i7 zvHP69PoE0m3BFC1Q*!>248ulwFW^p7dD^ZZXFui`^@Be%|GqvPkZrEhT`$9?clv5- z?hvZ;Si}F>=IG@@$52M6EWO%5oq>qI7#9jisS+9wFGpzbU5q&v3U!^(LZskEq%F`` zpjlGRRZcPm7l4&rc^{7Q6O%;YL7_$O$0f(3b~@CL1Fy!0f(ZW5SzWA}6_VR;cl3Ch zV%kI_&lrszi~8*fLne|!PV$j%)&xRny@b7WVvk~B@o7nBt@$Op8==V}uC6t_-|k?0 zomK?8sjKY%uu>++d=#FbN5b0yRlJKO3w58T7L|I|`cEwrM?+m9FYr=5Nw6V%!00VR*|!Wb4sg0;^W#JD;fiDYsI@78*{Z^$@HUChCujfi~k>6{0h zS<}FZser$NTeUx6MYapF!~gOxsT8%b)XuysuS&F*n0<(ArBdkRZcnbty^FUmON zh}8GyehBIOsYpO+2@?ROKqHjO7L6mv1dW4il!eO1PYpg8HGiwTj+i0%J33);2O9ih ze+j?#DSDv*AJn=|Phiw&mitgW_K`z5<}6fXzjnJN6np$WJ%XjYQ5zY!MpleS9XWJ) zEujP@F||7bTZpJ`aWraJ=uk9}-yM#TgR;!M%9ejb9ZXqrro92*vEJ7-j`x``@>kAN zGXb8gnu|+}{f3(D+F*`Qf0v^)b!CpnSiPekKykD1j3>TqknhlJ68Z=Cp+X4c$OnhH z>t0;}$^B0TNsYOq=3%?7W|e5^AlZ|XeqWI_Bo;VoEugH+_679AqF)EMD))>PRMl?cB1_Nhhl7@UhgZHzTL-Xx@wUfG#}yV zX}3-^sP!aVmB*~8Vl+%6d4JJ1-ybwb@Bldrqi!^lr4V%+q@U6(5!(iu6(fR^~Ow-%?(ZW$Jn8b@Ie@5Wq}KKIQN z=!BIX@OEOHl$mM6K)E{-pN_!XsRF`Te~C~yGrC`=u^XkWQ>f)S2k<8#zG5hIq?{0% zpnodK+s1vUsHX1Z&Qv-+-we=5b$rp zn0+8|_b_fj-WaHkyZUh6aWM`$8&3Am`CN2q&-cxh$SbNPW+A~W6Ig*#%07j_$A|c* z+=mqShMNJQBbXQI{P%_UH@jwEUYl4@Y*bUPIU>19C&)u<&)YyZQ+d&eHjU(m(+1We zOOL6>1Q#Q(@kA3Ab4gwX787G~9+w z)tB=mY<&udA$P&@{B06fq;sRe&aDDSt@=)TN%H7hjr~h2<-k$~Wh&mT~DnlYBqY6k|+a7Jp?&5(W-&tS#Y zgILZtUpFJsNNRy9p)TF;Z!>B}31^KrHw)DHWh5ISuLULpHIMLx)JInpaz96N^+?Tv ze#BoE(% zb|BKgtD8rAal69;2~+|UD46j*?N4ah;+;(9BtYE@g}2*e`;e}6jTZqi2WQg$Ac3Lz z&FcEAZlguGZi0yzT#^^!P^;c7`knwy-`nEDdnkrd0*DB5{`4T*iK|B201!q-#LLUu z57eTh0F@%8s1`}d<_r1RvKcHac_yE>)Q;ED;Iwyy$U1yW@wY>3d?(+LWx^OUj3U9G ztnm;Wd^^-03KMgw#+Z_{A4S7OiBPucSQiv8YHraZ6)GycLXnXx0A=98U!cJdGS6N| zU)yUalavM|$fOAYp?mxLW5)}X`yi%(^n;(-6YHLv4#1TkxgPlb^k*Df0gnSDd;96e z8`|O%y&QaRqbDgiza7Qw`eP!tZ8H&X$)cH$v>flO%ria{hU# zG`hNx*4hzRF8o$O+~L*i1l;MPxB1+Q_;7w_4kg3XoRkEZbR0beJ9qW_P}jY}{;aG7 z+y0Q5<$t>3UANCQtm6>9(XKOtWRx7ssMf zx$JVoPPn@7drb#Q)x0lBgtKq6G{$K@YSD`6rdxAWjsW6`efVCr)zk<$+g}4GQb?92 zR!M*?mB*9c2MY&>B{C;mzga?~K8lC2K`kZ2AczxUszt$=M_~RrHW^*;MaSMzj+U&g z{fXqMRJEdH86%gs%Qn#LCY^P8?&6JMV~NLLfaUyPs$X57Y~iq?r4M*J=x}$L5S;gF zO$0|>P&!Kn$A;8{Ii;s;ZnLw6na610NdSZXK0-b!&{(z;KhF(Ug`8qWJ4xxO0N)D$ z8tGfFl}%2u1X#z?2A70fp--X?rFzqy_Kj1c>^5EH%YHKPjBAYnzP;Y6%fT*ho`u<#sK{N zJ6_qBoj;9hn?RhEs2MNAr0+!EUMYKtX7f%24wsT0uBU_^1)T4?F<;Jt13yv7SWW&m z!vvURMzo@>eli&`q3R8mvD`r0xOsw=IAl%XtVOO@n)oUp&M#80!%dAka89UpGww6l z%M zh=W=w$N<*`%|r6AY4^pVR*Y5b@7O>u>Q?`$5FM#ZSJaqj25cz6FPrg$$ z^e-tw&c&1ZdNu}=ulvA;sibtHuW&t8`}H>S)Rc(*I}>1Zzg~jqI1yi0Nx;v7D@%=i zn||lyGQrn$*XfvThX<@L_!Ypim#sNzdA2w*rb4MSem0ohJ7%ncJ6TK@kwv79SMkv6 zhL)zDxvc>RH{ddybg! z9$zZZ^6(qZmLa-G_7v1A=zXCXzs>aK91lRmTyZ}!(S&zdDkNC_Uh;I!$RKiq;~35s zv5fheq5jzo)1Mvpz3MdvU(*4ac=Kh8!_|S3u~Ud{T)BsZq>dSC_-C{nN2>iI z`=~YC5Egs|1*L&{;UyY{v^AA=DxMQ8o^0Xn??Hd!mqUAzLdw$oUEQYgz$!i;!sB`-TC zP0jU0q{{lJv>QcsS%BHXiM;t540Z7bX81$qUD*sNZj!z5E2b(@0m2rpFNl<)3gwe$ z3R=BhpOhvvP*K`Hf5XsYmSF}#@)0Y{|cjMY9IXn1yqdCS1`UTlYR$OHu921JBk+&J0a>0Le}X9Me_k6Nzs#d>a00r?g~h8WfFJ77rjS{UJ#1Gek%EM5333`Q3x7fpA^h z$@IJh(wf0s?N?=}2FeI87U)p;`ecXbDB1!pIZyT&k}0}x7Jyga4^uNElc7ShX$9-% zuhuZFG-Bn95NUA4RW{{7}n)*L_@L%EJEfUjOz+KzG72+habHUK6CB z3*l+}VN}0gZjW`xm{gPXk;f!fd?y$^>K4ahJTmXtf$kQe`wo5g3!tbiphnTa>HxXQ z;wtDx>N<5qERoc_gly0Y3Y}mwL~}?{*cmbSkkrWm8ix^dY@H?wyJMrJyv^w;A>BY` zW#M-gxL7LfL}w?7WMw2G6khMARec0^W9!L$>kTzKhjBFUB|H~}G9*g0TCoUdfIC%Z zo=mPboI_(lktaJR2&wt3N-APtK{`u`H!@>!opN`*{y<=Q)L<^Q90#D6ja2pOMoSOj z9re#ZqR(+=pw~VaSO@sTYKA`ifV>Ic3x9}!d~2xD+Wv}q8I$X#Ymk`j1au=rsnWbC zZ119Q8`cI6=?yBSejQJf|MgG;MPInVf0aWc z;ak`;8anquQB#;+W@IRY_ItQhm1JW@_ti^bv@|)c>lt}%L%9+%lE753SoTEQmlxs{ z;opdTyLTds7Z!x6{Gnglf6N-?W-A9oBwB;V%9xLJ@g9#PvRK|yu<(&(-z$cddzfdQ zWR)8pG2RnnolcJqSY4onB_s%VEvLN<_nmt=UNgrJqGYd96Mu+xK)j&CPwsu~99!)0Sp z=krwH45~1AEA7x#-V(7J@>J=(*O^C2Ik=j0HR)6QyDmgUDL#S7wVmI~9e4miYY%z(h z`=bJINpY{{;lCr&c?jY(JunM<+vw@FL^LPwri8q&XVV^%MOER%@9TG4Da48v-O;%0 za8pV&k9RcO&39r$6n)wSsR_`km9;01xpL+d)9LtUHbB9XhcwV{?KEs`gz3vaaJ0Lt zM!I9#pc|Tv*72`eYi>2oW+lL*|7sJjun!bdwtT1@BbcnXlm9RznCuT3%1nThR~epGdc{cpW3oJ&W)kja`$`Kg>JpZ!kaMSpNv0z7esM%ClHmQ zD-l#9NGA_tkHkM@+aF3lBpC99TDv#OuEmu7Z8q``T?kr|BA<8~c$tI0lZ(1ENbox7)4QVh&8peB+n1M;R>9_1?+p?9K`NJz7JFpf22<}fAGI%sG zmXyI3K^SdG_U;+~`LOtW7iQ&{EWu!;MOs-~FjJ%KI#@b1p399AbkvD^WlftEenKY2 zcr{rqK8at&>sGnz37-#ON=dLV1iZC83h97(s@xrNbDJo?lWKRu>D4^wybv#~DiF|u z|AoXFgiR2UK&QqiTrj`h8yikNo(_0#SObg@l?tgJPUR}XyJJWG93N+cq*fDt@!`KC ziw_GFeqUX3+2wrO|E=H6F1#TQ-NZ&;ui-IFxQZQRLx`yzpYxJE#YQ4$M)>-Xd1rkY zi1Hx#m!O+OaxSF%)<5*!omzwteq`v-J=IAxSSBySGAc@P^^~&6jV&7E5RVa} zjUK+(>EeJ?eiiZPc$rN18?r4}NdPCci z=kt-uV!MYDMpBepYnbXE`EGyl$hzCtyKd9cslJH9Ui`Td^{gBLE*SF`ER|B0w;uYJ z(ZL7pKwqrBb`AKs24V~WVmUijOt19F7T$-LsnY3Km2r89sLwCEbga7^)c&wy5ewUn zhI0xcLWZ8L%5Fjax1Z;U`?Qg96g*}=#sKc2V!ubQ5-&Va&%Xj%QJT%Ccz-fGt zwK6r2g}UZq`~5G(*)2?Zu*K9^5ysGD41}M2v8p+tgG`~8n}=EcukHs5-Cc(u6$!$ku3A511M-sGGNT@n;j-E~BWoyfzk* zsq5cBD~|l^`f)RiJ}H^d7*tiPt^^+Z!y#Q_N6Zc?tn&sbA>K3thXSPmqL<%YhRrdi zaYI#RREKgF`40|;J}1@#4F-H;QL}2#;j#^@>FdyqjF-p+v|)qH^$~a`Bo6b)@7W(; zT<0ISodqe+F{i?sNWXjV8D^u-i*Z?qxau}~5#$~D?y?PE-RSN-4E0k%@gVQPNW`ub zYE?6_Is7pjei{yRY$vE5?80YnM;a9YKj$|rw3aN?9BaO|7flFoiizBddq|^9l*k+m zmk51GC?1i}GvyxTn6aJ;`ONQ8tM2hN^^l zHp>UG{V{H-n(I|(ft86-wTlTV>!!I>&ei>QI>S_niT zN`bSqgxQfw8#gA&rJ^C;M6N6$h~*!RGC)P8rMs=9&diL`)Yg;3ysLH9uis7qBUzpkGkj;`YG}? zsj${blC?&GR)W=Kc#LSDvNg%jLluQq>};>KsNS?mCiDeCi;wyA^I`t_&jjFku6l`a z&4E-$X((hmF)inHI>V-o4H%rfp75{vz`ljm$dif>I7O>%s-#`4}rJ<+wn zgmyA81gf${h$Km5X9Wzbk6CkQ^iv_voauWC%OA$ zPrBl@GI(IxU{9I27TNXs|2z*f*kNM(?{!k#JD4y&Jw|hWtIdZAmLVU%9azC* z9S**sUVFne?t7YC@POAo!rScqo@$52JoJoD`G|mhnB6?M5POnw`^J~NKnD@UpC4_! z)!aI)g9g4y^d~MYsfn~5DAEHvO|)L0!D7mqVvRmN5N-w1E%biP*j2se8x^`L)>m6n zDtB3d5=4YEP3SIi!BF2AQA-$fO3c`vobMRzeb2Ny$Hd-Vd9y<5CPDw1^ZhQ;QNwN3 z96gfCbl;iq(fSqV`MQpbS6ler@0=`@mrK+`D!jdCtKhBQKe4)q$MgNwLJ->-F= zf&Sl!i>(Ga3>mONjxmVfKT?0Vj&SJ0EsZEXPAXVTqz&A`CueGDF!>sQPn?KM_B;rW z53O07M#$0-ihus*9+{R@$#iCEdtSV~Q6+(nH2mfqM2_ZYmLn}4EHIbkxq9~&gJ8-O z0V|sjMP2}ken$1ai}k+eS~oVNlLOF>4~Z)Jc`Utb3!=9CN1>*$_9SS#G_Hr^$NDO^ zT*L)V=`i`7;8Inqi%FnM!svg86cYB_pIY-iUoH;w^@IBs#oI<#EKS4^Kp0x2iOm+G zcpKBc!|51qww5mgONnDi?weH7{%k5+CRU~ztRF@_lu@jXVh*OOn3mLLEK#>=yB(#N zY4Nw^7F#WL3V0&`FmFE_2V*TSEjO-IjmB~zzOZ@%#sN4 zAVis04E83?gRMSY?A4v^u@G{5naK0{YY-G!5c;?g6j^&hKYd5%z}CX0Ga_0Ak*1Yt zxQEwou!j4sn!C@%61#h)sg@Gmx;P`Z=g0CF<~Ecsp3FK=x9_c0H#O(FO5qe0%sz|l zx6`EDQb=2kMVMw@Pnt{P$s=j|$jaf`p~r4L1PJgFtW>1o_k5*G@%ze|TnM2*`eC@C z&cs`jO=hGqno;)|4qjkvBg1@EboO2@pZI63nK9V@tVgcd*3A}J=3J3JyLeKo+-tTv z|2V+~Lo$xBzI}D(I7i`R#KulkSF8M@9YylVFxb+Teb`4LmSb3fo1)+2quZ2M08$SojA&Lf zoiw})R-FhQjE6RuJj3Dj&gW9V~+I{ z>^`XDrk1pChTBE-bC-RLR78Cvz8AE48hW&Tg?pl&ER{!ZTj%v){=1C|GlJ!Q9hkuG z!->@NI}RI(_&`fD`V>?;dxp!qv2?p)X3WkjbH4FR96zv18G?D5^>Y7j**}dhNF2dO z%FAZM!tq*&-zK)fNCNl+Q&-D?F7A0zLo7N9M!BdnaaU{w%vA_*DjsSDIV(|6%3}Ko zl-4Sn2g9jhdN*`DLl=1LOc-XTKbc8oWh>{oR*fqwGjM~)239c#rCVSVPs#L z`59&UUS!|J!WOe&F7Tj-1f--$avd<;tg^|^<5X;ZAjmt>n#T0$Ks^*P0DrL?g*duY z72eKY$BxLm`745SjELVc!YIJrKN4x^#+gf0vt@EBZiJ|1e)j|1vSmn)xT) z{QLLEt3&!&atHX&X2Ox!jC#iXX6{oqxv@LX>nX7==b5=CHnberwM8gSP^ZaT?>pRD z1j8MTfpc{39Uq1)G-07+9gM+p(pK82YfKnH5k(_xS}^LS_k>An zP*uWof?wof2b=va{HqlzTKkcE5LIyhm$PbpnDHOAWtUkU!3hm!tqm%@%*k##w^IV{ zq`+vmAbJ+udHfL_l*JuWl68|pSrBZfZ{bbE@vNOmVOl{xW>x3qQLfO=fS7@`aWBW) z_Dj*){C+uq^=G2J!yQ*XdHCx5YR}!cY1X&o-Z>=a{y{40m0p=vnmEB~BA}LJ#G5XC zKr5gi1_terb!m%#`{{$>8|N1Y*p$`5w44AB?WePSLq8@}}|M};gj9A*Vqz3i-2l9C*V<>w}Xsk7c9Nf-82jEKadUZQ=6$`ve20cJI)UxP|%m z3r+|xZ4ptyms>}b+M@mE%CFg2mU$HXt45Mm-zch0l2{C47JLp4osi`rQ)lg%FEs6V z+!_is!^C=gr^xiQ9J{(}R=7S@X7H;#GU@ywA1H8qH_yjRLXpN55b{^hZ}>Xx@FjN* zY+Px8B($5s>@xJkUAqFgDvZBTySffBqqP54ZjI53y%9{T+Us$7g*bss}SAkM_EV3KE%}(Ys z!SYEq2v~i%9?^%!i^+Q)L9-Hahf;mQV^T%55{3pa$L08|Nw*pfnOpKtXl+68%RuAO z&o$Y(4q}=<5skBH|70&1oztX)(p;7mB7WR8d0JQ86c@ekRhyZGWK7O!v`f|zr_FJ7 z4{xH#s0Hv>A;cwUuwVy@Q7yN9P}au_u&lMd^E%jcjf0~V`QRT$iObX%V0xk?KoE1E zKj!WQkKCWEg75vL=1?*Q?gHL*4MigKvk;A9Lbh)t5hRo;Jy`J85)5NRmkB>?QQ6u9 z6GxdRKL?r-!H6ZB)ONDKj^wwp>eK(V#W5sz@!4xI6SorA z3@EczpGew|Hd1lqTS^6jv8zCWkeDU`WPukZf4GpaKBkig@x9fm4nWnFk{)RSS8tCc ztsl2hk2sTNO1@XAIJklX?z2QY0f%^3EyoBhb481FFuO1~YXqo=GCOqvOc%JV&yXLD zd7nHfq@RATqs0nVH^KRr$jeY;P6WK#WE=(i|FWWDbtZ=%Y!2NSYz-IcDrgklCOay~ z2{G}IE>mb0qca|dbG|4@faDSLqtPhmL!+;Z6O(DdEY&Yb+5?8pGg7d!UQ>F+xle6( z&UH=d?$Z=ThMDy+QxYD*3Ncp^0=YhZeWr+|SGpiRnnRGITu=LhEqxT?5HG~Brc+s_ zGneFc@cHbD7rI&mLZQh)kCG4%-1Bo3JBk$H;iGOJV!%TXf&^4w$5>`>p zL#Wzx@4X2?>+L95S`C*DB9QavmtRjAthTRkXO`FT*_6C8S8q4#;=0+Bw1o;^CPcQk z?3|wwsfecTWoil^gm1m*>Wxy`XbKAvFvIW)a7oZ)pUtrZkt8T|ct|ouClkGj2TSbM zN4KkD^f9Y&+=7bbv3E;cep8KVrr)yu#QPypiNFX=S!PpixX(JM;v4UMc?l7o%~f72 zX7JG=lmy3yLD$&Jf}1BxoYeUk}Q1kaZX^c!JS9$rZef@ZxQRDF-*XMejo$@ zpF$E+%+x$z(xX)1&N-LT;l8277$-TH|;%UndTtUi!2LA7)~A^0~1@lZmgC z-_#70{mAMq(jEhPD-m=b>s@9J-&w&=pYsA#kQC5)Dc2oH6sc2SDJA<07z*34!d##|=F zILP?O%wZkMxW17WF&X^#uNO0VKg{TMWOgigq8sy9b$@(gg`)JEgdFc?LxN eUyc?FIeVoXQ|4>qhv)=x07_ zKE&q%A>6}88a8{>UErw>_Tl3|;ucv>Xgi@*iyWIoh(k?VJvW0em$&VYo_ z@7Y(<38Dti^1s8l1+at}usXRfQFfEwJK2}Y0QYkmwt%ch`NVaWt}q?*X{->X<&DVy0=U;tA&7mzKX_hpamG4#3I=vhkV8cnvW<{wAE;wvP@vkwekR zz1Jwq$%B0OoLg-G1O74L2UVVPHH09*8u&I5{#%83Q6p1q74f!=O7tWL#SDwumKkaHe zcFykymcIi75imp6vc>+W;dU0xU>?p0{oAVm2W#Ec8yJb;#L$XAGVX&RIl9$9ApHcW z)aeo>y}lXBf2nO{>O{hhwHxYj7X%XNXWnQT{4k;h)j!&;aU1M1W8=N(i!;4uFa8dR z5*0XES&CR_YZ<-&y@BV$dJOTbf{;f^T;r9P$Msrq2`2c=5>oVi1y8i*PPTSJqqv!p z+OQwePTH2FJ$ErB#IW`H3{vjmsHy%kJDcj~gIF*lgU@U%Z%XCwLaop3SPQ9(DV)MN z_7XlI%}juASvKx2E^cL?7mSs^3!CKvXLE={_q;>x=aO<*MfEt{7p=dZ8e1w7z4*SN zkJLg?o|UR*O*YK_luN8hiByZ9R;x%V^LO&O;I0UtF7F&|U=m=y#8_fWzDLJlA%qUY z3Uv${oArFW`@Gy0d_;o>`$MM<+yZJNFznk~mIg?zMkKABUgmZwC{Qc*q#fHn?tire zPZwN-sAdS#Bj7a<;#7oO;Zqo@{}6dTmU(&b@bPoCb$VIa{paT6!+_cSsoNPArU)B7 zX#JY#ZD)BHk>l0<_TJhs^t%z-ag!7$;-i-Do@4b+*#UBm#htX3u=3}7mp-6+{jBdw zcAXSC?xjq-?huwkTB^QhO`Si_V%le(;-B_0gN%8>-Fj?O&5b3%gD0-y&F=c0s6NUi zq&^W-IhI?=Fny?l;F4gH1zg}jLkxTp&5kgCwZA_2E4_)#2np<_K(0b?1XhMol@-^D z7%-d<{SEs4I~wz^;~r>ZRe=GogZbg(PNcm?+mTVxgNfIZ;DC)C-!+D@LOU?4^iO;L z_if8WB5*^Ksa@~NGGOtF2e)s*?mxZ$`&&V|uo6X(;09F*O4^219^b!T{C(vSi}doB zy7E|sW~FWH?bQfL`UG>2fz{8fu&5JB7m&K##DcalV^~<2nw}mVj)8N~n%8b@*@Bvp z>)MZee>xmPx5Q46ZkW}ozEc+!j*(ZP@AVkX!HwU;I?Z8zK=jDk%EXo2ejihnVjl+Wdfb@28i|52g`f0-37_=x7|~G?1R` z!~lvgL(j|l#ops?d^$*HTFK1Ze1GLjzGPLUZ`;dxhb2g|;Cjt;B^sF{5ogycLoz zblak$)S{#xH1T1cw-^k$?d=Cq zG6H<=$CTye<%k>X*inVz;c`}1r3xS=xr&O4$@j*_MtnPHlqrzh4b~lPL%dcjvEbJX zp|&@W=mGm8ietf0=w8@cwgoEfszv<+g0~M2 z4dJ1Sdg|yg5ds*<`YJ6N6+qC%OlnFx`|0r;EG(>H7qJ~tQ?|rEf2?ov0$TIM&^RJ^ zeg=gL$znu6DiGvGf{|cw(EGWb8;Kao0;)znXPg+TqH}B>r#gl5*sHm2bF$QF@mEBY zq%kW6oFyRjq@~D|blm?QiZ4X^mwyyGEDo;>fN%+mp`?3#4F-ICC znh@JWNliVB8ZYGcoT19)w6Uhc|3~Q#gs9HmavP3f(5)XFbe@Sl{;L#le0vXV$9}b05jhg8?aht(uJP}F2=QS_TLq{-OIFa)r+5(Jdm7ZJ{k4SAA#pplM?uPj zRvT7dz94+?_M2Rpz)_=!e?v?JsRiLKRf0i4|Kgxn*%Ferb}yf}-f5iI{(JRnD|Jf@3-Z(^ZVOiQDX~r?A(l#rrwcN!@`2W3O{cGm|^=&eZD)NL} z{FOU(Leke~F`T&MuZ8zt?Fho^U`N0Ji3^D21djXUJn8@Y8=&EQn%XWeqm>3LM<4WJ z*%SZAeE!d-=m|Eo5up`3%V|@Q(BUTIyB-tinB8l?uot69F{${D@r;JYijQOBY zEhb^|Nk5?)Yc9k8ZEi4OA2XEF_a~nIeGdJ9tfy2Y@LiMG!@j($==0^mzx}Fzj0@QW zQf~ZhXDK11){~YDn~EEMg=(CdICjludGs0{R>!pLvVKRV=Yic(NJ)L#j;`oX-bFGdjT-vO|I^iV za5bSVU8M?9dhadLL+@4T1nEUWmyYxrqzHJWml(RBAOw)!2~ng;5u$(~ML~)rAP5+0 z05N>I-uu1v);m98_L`Y}=A7AE?_Nc)b-5F{X1kd~4IV5%M_8Nfu-g7UDSx|+Sz2HB z^>0gG=a3#9x@|SZ-~utJZQs?>&f5-=Dh2Z#8xNwg!;vd88K5O3Of19O?%($HpGrZ) zOqS`KrFE6C=BTJtb2F9eD_YVhMBqnMYHZ(>c)ksdTQEdF-jkOHldTbiaBzOMqhP@> zy8xZIhC~3F~`h` zBwFzSFiP&70fLl$ZY`&yy|?|Z6|)>gS_8=2yg}qlXvzRYeF>H~S^nU!K6m zNJ-MU|MZ%`;atwFrFGKr!!WKd_pV}#*psPwmXwcL?kxTVk$>Cvq)s{1zS+o(6h zvaa82Ts(l`tt(ET>%g4CvdBkQqU$h}<` zNP-DBZ5jKA<;a@R|E<-1ieyR5{=ecBinKF4z@bWK*tc7=46LMuqOep($_GL~XAkg; zcTtD+*rc}_mX@Gt**ue8YRF##2$zx1?Q8>1(7taSr?1E5ulDdxzEl+YYZQ-eMMS9~do(&B zu^xO1Nv%mS@?9o^K|4Vt)AW@a3WI8{^ZZOv=289e z!JrIegUvYunao9=)3Lvj8vs2WZ6vn3oTmS2b-}KJ{pH&UGK1_Q`45Qt+zc=}@lXm0 z3e6!km=NM^Xt2K)8T9P~bLx6>BkhpKF6nN^d~RteHi(WTVIZHFH7=XbyjHO~hg&?w}4=e1#l zQ)#alf3Ji@Eq)l;&oAqE7SNPc)>WUiJdF`^TI>I?guj72%@^n=iGE?M=&oSO%OdGA zS)V+;m%F46V4-;upvT8%2s~z%;Igj;)n1_rE`~s-&PA28h4`p<1gJxp_GKhYzvDQ5 zsi*SEe12K9o1Vy2l^>i)a_e+;(~q&8o)%ww%7*lp>X@8)g#sU>Pc;pCCrw8&Er#%M zg~^lLG?a$ZD-DLtoKK_j!Osa547N;2OhSS`C;?m93HD0xm};}UOOZr+@AxFgX1cx+ zaJkgx@o1h-AY0_Fzhfj2I1s==SeC`AsXOytyz*0vROq1%sQn+Nav?^4&720JL9&#n zX_9|!f#B=g$+a@+{!RMj(PfZrC)41o;Bz+~)W)gLnAGu@Qdj`|)=&Owbk^hHB-`ZK z=y(+FrO!~}sYy$BBE|kEe^zetVVAo7<*vjXk&{8mad`cdH+h4wT!BqV`AKeyK6-Za zb=5VNoT!>;PmTuW8k+rg)v;0%LXqXFjpCK`Gatof1+7-AZJe=%H`HRQo9|^7&yKP- zHs9t-0XJ!az8np+(Pk&w=HhE?UIa8?5;079%8KmH87P4ss#SN8>(9$>S3>J~ILB&p z6DU`P)mivs+Ow*MDPk(?9gHWvQM#bDGo_TYP`= zcOmFn>GAyT^y|3Tg+c7~-lj;Brq=JYPG89!<(iUIihUHyJ%@}k(34p64g11Jqtnv^ z=Uj$dz}B1jxpBp&oLy05`V3*$&uB>}P?J=~-n{QkhY6WKSWcp4D7-oZEZiKt-c$it zFI&4PC&zk4{6_;ilBdK5f4FLyRHDmBYgi0%P$(B((#3_}%qc(9#PPI+($dKZNUL?0 z+&x2q#`9`QIIv6%v3+c>e{y)VH?V-{=`f6Kf~E;OH5gED#0%mz&L3awSM?b~%op2w zR6;KU9>RxR9}y7C2N*COTyp*zuzgjj`jsQ~z`3QR50Y9ie-S&70m`i;oVl<+=Xr6b z=j`oe$ANkR*I?f%KnYmcrN zkzYQh?kV?6<4k`eNHgHtkSw~iwsY-4#22yvS&x3YlJczT@2*qcgiP37HmXd1Q09Tb zH%2iphpCfQ#kCQ}2eIyPH#hqgy6=-XbJVYY{W&T%>7oSLh>QV0??XAgNinct8Gk<( zMy4B7!z58qKf)tyvDw3ie>P>y(i@#|orhRXe&OPM>E%TudFTjVlgXP6f5d}vI+r=P z8x^^pJF`lLkzA$QCy<^t|G7y^1-eL7g1?iBUNz8hEp`bTah75?-k&o9-hVg&ADVE- zjze?c*-qxuH;BPY)b{hMO~<;{6FC~awB!LJs%LkG`TSa`OgA_?h$ArL}3 z#tYS&Muyr?nNtrTE-_#KnO3|=xROP3fxMqL`Xcx^!bLE2nZsi{urnq`@?tq!OiUaG z?tUNM7nAbS_kQ#HcsxG}N65jsmq^TO{q71c4l7hY`)n!tEc}Uj*ie0_O_?kTdx6G| z_86xHsyGskmt3l1##zn|&%DPL#q~mQzg}xJu}kVJ$a;@E9JK$mEDoE2T9qOue@~)g zgb6y4{>^afV!?UG*hdm#O>oS~Iwq~=Qe-!51-7rGE-1O!1w&~`J?Y&f=sj0aGY#y< zQXSb#%&RZi?OpceVvZN3a+SP;3fmg1LVt+!j@gTd9IkLa6khLrCMj9g4Q@Jft@jXW zgxQ0svDMz1PtZB<^N!`53-1TU7%Q?^zmu8Q0MR-r-*$dom(kPR_IO7`Y62l}GQ zaRDoiTF<39u*n7os>GD$MQ!tEcsIbhd%fSGp3RN-X%X}y?>@s6+m+?61*~H?k-P;C zmxS!Ra|Ue1>oR!#NJNBbeKV2IO_5zA`kJwO_JO_)Bw2=ptTomwjk@bJG7+Z5tb7_OGgsbpK^z zYsW_`9Y7hg(bxG}XW`Y3pvwM{8K&~s#rOg~kHN_W7BT|}Vs>|mg)>yu`R#550GpQ| z6usXK&F#VOh(zyZhlFBRv@3Y?R4cA z7spDKdqv%)4Y{KQY7)Uvv1Q}?Cx*|q>i**RD0VfP_93STi6I%0zylbZif zn6mfAc$wh#_~NhtfVj8l@wp&6z2|J8_}kNC*wLFqes-08p3kkZFZjZqLNfp!^rbkS zi_v<^gXJ7MtyWIl|rLs?*#iCq$e(&Yso3!j9BeVGR zoKm#sFgyr2wrBZqutvN!0FajwdcVE%f|OU!jF? zyudU3hXC4FR_C_#%HecHDq+$4PRAJ|qC**sm6%ENn zeH!?UnZ5#eg^zFhj;B537$!8hCLxx*cLjK`3)Vt+0!;G@K2%`wlcxFiGmz-YJ~ey& z-ys>{_w#QyCi4P|Cnf3?oOSE?a9;D`xPk^aQfo(uafL(j!;^}gbn(4BGf=$!oQtw; zsOnK(ZqA;BJyvg8U{Q(_p!Y>C$KEsVgGhETxl3I@aIQqYy=fLKtPW`enu(+;O( zy6PmC3cXeBDoCd%9XkAN*5>||^PsPLLbgfTuD96NXtYi5;INH+np#I~yPJMmQ+!ra z8CMv{ax0n)$Fr5SKmQYNO!OL?ZrAJ3%~5qakGg2SkhSu#mVK|mvlx(c1*TNQC*%Q9 zjx@0wOCp7oC5po1Cu-qe1)L}{IVGDPw(Awd$ykYLI91&{wl21^1}-0v%Th5*s^M#M z$Ywd3h}yeMiC?u{hf?VWAI6A<52Ry~hc(;V+c`fS=ZRV&T3V*=8csl9l8SZ z#Sr^%&R3d^kf$QWWkr6|k1X;hc9!)k=%{j*uAF-FFWM#vDgBVti?_a?cuL=y`@Gmz zJg~-wIGNo3J^N{xln*<`eTlDdJpE-w)CvQ5aBJ5k5_Lg;)mQ1+!gckA4cm`&b;7SE zAZn0I90C$i4dFXp;wKIdp~eIURTIs#ZP1v=11D8ynHe&Us;*rTnf~{=Friu-P?)Kd zBLae`O68Q{BYsRY^!=##8M2+fhSwAjqzs3#2YG^f#PirtRh}7M@YUO|5)+1ogp4Ao z>&!-mjM}Zq#!7bc;jq%|1`?=p1tU;=IQwR3Wq>X9?_NnGv>)ZRUTwhw!r!Q6NAv3* zbj&b=-pn$+!z2Pc#zOb9P8qe=MTr%`KyCjBHR!mW9e5622~k?A5};y@Cr-XWAD$}Z zeDY{UM*WzxDF8W%ajRi=B3!;C{=tC~Kw>e4KIn48Dq3r(-30{)HIZsL#3MFk6Axk* zXi2|0nNs2=YV}n?^>-FQgt~M~l^<|5U_0>{E<6D40}yw=dK^bP$-FOZ7T#0adw0yy zmFYU7uFbgO-ulq4xIquq0iUptafGi-YMLCQL|R$~tDQ}8UhCZqVaPXafpKHwfNu$b z>K3gGoV$e#)^4piZL3P$S-lo8Aiw^2#<=-ohA#5328VI<8-|QeWLQJFEz-wn1}#vV z=rpL)$9D}__`SUH4)xY*5>NYR@@^yf^wDlaL&NQgbw&jB`k}#SQbPH*yFKvBh#{Al zR)Jtp=f4xV=OW?P8IrqCmG^D(1%br*S>;F27h0}W`4KV~ zPs3}wq`R2Yp48#mF6o;&tjtp4!_3UWR6Mq$WS{%TeLRimQ<+=R&4y6M!5~bbehFKL z6y@7Yh3FE}&C#v8dNC7E(=gtn9AdoXRY?LjBxpZaux&_a5??KFzdu=j)AwWXnmhRR zt44Hk#(I4|{!a_?p(bOvCn!a&FnkuD6<5IDRj$vy@&SP3qs46``55^uTlGGLmNh&* zeskA8K=nM%93G|`p1;4jLQ4V@0H!*%JWYk}Y!r2({-FHd^NouybP1hWR6J@WbMNz{ hoFAGS0}ip5S0iI*`LaGbKD|ObMtY{YO}AZ>{tqXDI#>Vz From 21e91644854bcd68218e9eb2bf7f7d9e5f1b66aa Mon Sep 17 00:00:00 2001 From: Leo Di Donato Date: Tue, 20 Aug 2019 11:13:32 +0200 Subject: [PATCH 53/74] Explain auditing with Falco (#14332) Co-authored-by: Lorenzo Fontana Signed-off-by: Leonardo Di Donato Co-Authored-By: Tim Bannister Co-Authored-By: Radhika Puthiyetath --- .../tasks/debug-application-cluster/audit.md | 97 +++++++++++++++++++ 1 file changed, 97 insertions(+) diff --git a/content/en/docs/tasks/debug-application-cluster/audit.md b/content/en/docs/tasks/debug-application-cluster/audit.md index 03ceecc477..83ca7c02bb 100644 --- a/content/en/docs/tasks/debug-application-cluster/audit.md +++ b/content/en/docs/tasks/debug-application-cluster/audit.md @@ -489,6 +489,98 @@ Note that in addition to file output plugin, logstash has a variety of outputs t let users route data where they want. For example, users can emit audit events to elasticsearch plugin which supports full-text search and analytics. +## Webhook Collector Examples + +### Use Falco to collect audit events + +[Falco](falco_website) is an open source project for intrusion and abnormality detection for Cloud Native platforms. +This section describes how to set up Falco, how to send audit events to the Kubernetes Audit endpoint exposed by Falco, and how Falco applies a set of rules to automatically detect suspicious behavior. + +#### Install Falco + +Install Falco by using one of the following methods: + +- [Standalone Falco](falco_installation) +- [Kubernetes DaemonSet](falco_installation) +- [Falco Helm Chart](falco_helm_chart) + +Once Falco is installed make sure it is configured to expose the Audit webhook. To do so, use the following configuration: + +```yaml +webserver: + enabled: true + listen_port: 8765 + k8s_audit_endpoint: /k8s_audit + ssl_enabled: false + ssl_certificate: /etc/falco/falco.pem +``` + +This configuration is typically found in the `/etc/falco/falco.yaml` file. If Falco is installed as a Kubernetes DaemonSet, edit the `falco-config` ConfigMap and add this configuration. + +#### Configure Kubernetes Audit + +1. Create a [kubeconfig file](/docs/concepts/configuration/organize-cluster-access-kubeconfig/) for the [kube-apiserver][kube-apiserver] webhook audit backend. + + ```shell + cat < /etc/kubernetes/audit-webhook-kubeconfig + apiVersion: v1 + kind: Config + clusters: + - cluster: + server: http://:8765/k8s_audit + name: falco + contexts: + - context: + cluster: falco + user: "" + name: default-context + current-context: default-context + preferences: {} + users: [] + EOF + ``` + +2. Start [kube-apiserver][kube-apiserver] with the following options: + + ```shell + --audit-policy-file=/etc/kubernetes/audit-policy.yaml --audit-webhook-config-file=/etc/kubernetes/audit-webhook-kubeconfig + ``` + +#### Audit Rules + +Rules devoted to Kubernetes Audit Events can be found in [k8s_audit_rules.yaml][falco_k8s_audit_rules]. If Audit Rules is installed as a native package or using the official Docker images, Falco copies the rules file to `/etc/falco/`, so they are available for use. + +There are three classes of rules. + +The first class of rules looks for suspicious or exceptional activities, such as: + +- Any activity by an unauthorized or anonymous user. +- Creating a pod with an unknown or disallowed image. +- Creating a privileged pod, a pod mounting a sensitive filesystem from the host, or a pod using host networking. +- Creating a NodePort service. +- Creating a ConfigMap containing private credentials, such as passwords and cloud provider secrets. +- Attaching to or executing a command on a running pod. +- Creating a namespace external to a set of allowed namespaces. +- Creating a pod or service account in the kube-system or kube-public namespaces. +- Trying to modify or delete a system ClusterRole. +- Creating a ClusterRoleBinding to the cluster-admin role. +- Creating a ClusterRole with wildcarded verbs or resources. For example, overly permissive. +- Creating a ClusterRole with write permissions or a ClusterRole that can execute commands on pods. + +A second class of rules tracks resources being created or destroyed, including: + +- Deployments +- Services +- ConfigMaps +- Namespaces +- Service accounts +- Role/ClusterRoles +- Role/ClusterRoleBindings + +The final class of rules simply displays any Audit Event received by Falco. This rule is disabled by default, as it can be quite noisy. + +For further details refer to the this [Falco documentation page](falco_ka_docs). + [kube-apiserver]: /docs/admin/kube-apiserver [auditing-proposal]: https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/auditing.md [auditing-api]: https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/staging/src/k8s.io/apiserver/pkg/apis/audit/v1/types.go @@ -500,5 +592,10 @@ plugin which supports full-text search and analytics. [logstash]: https://www.elastic.co/products/logstash [logstash_install_doc]: https://www.elastic.co/guide/en/logstash/current/installing-logstash.html [kube-aggregator]: /docs/concepts/api-extension/apiserver-aggregation +[falco_website]: https://www.falco.org +[falco_k8s_audit_rules]: https://github.com/falcosecurity/falco/blob/master/rules/k8s_audit_rules.yaml +[falco_ka_docs]: https://falco.org/docs/event-sources/kubernetes-audit +[falco_installation]: https://falco.org/docs/installation +[falco_helm_chart]: https://github.com/helm/charts/tree/master/stable/falco {{% /capture %}} From b9b95165ecdca93e9062d893ce9c4c490bd2e412 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9my=20L=C3=A9one?= Date: Tue, 20 Aug 2019 12:03:35 +0200 Subject: [PATCH 54/74] Translate CCM page in French (#14960) * Translate CCM page in French * Update content/fr/docs/tasks/administer-cluster/running-cloud-controller.md Co-Authored-By: Tim Bannister --- .../running-cloud-controller.md | 110 ++++++++++++++++++ .../fr/examples/admin/cloud/ccm-example.yaml | 67 +++++++++++ 2 files changed, 177 insertions(+) create mode 100644 content/fr/docs/tasks/administer-cluster/running-cloud-controller.md create mode 100644 content/fr/examples/admin/cloud/ccm-example.yaml diff --git a/content/fr/docs/tasks/administer-cluster/running-cloud-controller.md b/content/fr/docs/tasks/administer-cluster/running-cloud-controller.md new file mode 100644 index 0000000000..a6b6a5b820 --- /dev/null +++ b/content/fr/docs/tasks/administer-cluster/running-cloud-controller.md @@ -0,0 +1,110 @@ +--- +title: Kubernetes cloud-controller-manager +content_template: templates/concept +--- + +{{% capture overview %}} + +{{< feature-state state="beta" >}} + +Kubernetes v1.6 a introduit un nouveau binaire appelé `cloud-controller-manager`. +`cloud-controller-manager` est un démon qui intègre des boucles de contrôle spécifiques au cloud. +Ces boucles de contrôle spécifiques au cloud étaient à l’origine dans le binaire `kube-controller-manager`. +Étant donné que les fournisseurs de cloud développent et publient à un rythme différent de celui du projet Kubernetes, fournir une abstraction du code du `cloud-controller-manager` permet aux fournisseurs de cloud d’évoluer indépendamment du code Kubernetes principal. + +Le `cloud-controller-manager` peut être lié à tout fournisseur de cloud satisfaisant l'interface [cloudprovider.Interface](https://github.com/kubernetes/cloud-provider/blob/master/cloud.go). +Pour des raisons de retro-compatibilité, le [cloud-controller-manager](https://github.com/kubernetes/kubernetes/tree/master/cmd/cloud-controller-manager) fourni dans le projet de base Kubernetes utilise les mêmes bibliothèques ​​que `kube-controller-manager`. +Les fournisseurs de cloud déjà pris en charge nativement par Kubernetes devraient utiliser le cloud-controller-manager ​disponible ​dans le code de Kubernetes pour effectuer une transition visant à faire sortir cette prise en charge du code de Kubernetes. +Dans les futures versions de Kubernetes, tous les cloud-controller-manager seront développés en dehors du projet de base de Kubernetes géré par des sig leads ou des fournisseurs de cloud. + +{{% /capture %}} + +{{% capture body %}} + +## Administration + +### Pré-requis + +Chaque cloud a ses propres exigences pour l'exécution de sa propre intégration, ces exigences sont similaires à celles requises pour l'exécution de `kube-controller-manager`. +En règle générale, vous aurez besoin de: + +* cloud authentification/autorisation: votre cloud peut nécessiter un jeton ou des règles IAM pour permettre l'accès à leurs API +* kubernetes authentification/autorisation: cloud-controller-manager peut avoir besoin de règles RBAC définies pour parler à l'apiserver kubernetes +* la haute disponibilité: Comme pour kube-controller-manager, vous pouvez souhaiter une configuration hautement disponible pour le cloud controller mananger en utilisant l'élection de leader (activée par défaut). + +### Lancer cloud-controller-manager + +L'exécution réussie de cloud-controller-manager nécessite certaines modifications de la configuration de votre cluster. + +* `kube-apiserver` et `kube-controller-manager` NE DOIVENT PAS spécifier l'option `--cloud-provider`. +Cela garantit qu'il n'exécutera aucune boucle spécifique au cloud qui serait exécutée par le cloud-controller-manager. +À l'avenir, cet indicateur sera rendu obsolète et supprimé. +* `kubelet` doit s'exécuter avec `--cloud-provider=external`. +C’est pour nous assurer que le kubelet est conscient qu'il doit être initialisé par le cloud-controller-manager avant qu'il ne commence à travailler. + +N'oubliez pas que la configuration de votre cluster pour utiliser le cloud-controller-manager changera le comportement de votre cluster de plusieurs façons: + +* Les kubelets lancés avec `--cloud-provider=external` auront un marquage `node.cloudprovider.kubernetes.io/uninitialized` avec un effet `NoSchedule` pendant l'initialisation. +Cela indique que le nœud nécessite une seconde initialisation à partir d'un contrôleur externe avant de pouvoir planifier un travail. +Notez que si le cloud-controller-manager n'est pas disponible, les nouveaux nœuds du cluster ne seront pas valides. +Le marquage est important car le planificateur peut nécessiter des informations spécifiques au cloud à propos des nœuds, telles que leur région ou leur type (CPU performant, gpu, mémoire importante, instance ponctuelle, etc.). +* Les informations relatives aux nœuds s'exécutant dans le cloud ne seront plus récupérées à l'aide de métadonnées locales, mais tous les appels d'API pour récupérer les informations de ces nœuds passeront par le cloud-controller-manager. +Cela peut signifier que vous pouvez restreindre l'accès à votre API de cloud sur les kubelets pour une sécurité accrue. +Pour les clusters de plus grande taille, vous voudrez peut-être déterminer si le cloud-controller-manager atteindra les limites de requêtes sur les API de votre fournisseur de cloud puisqu'il est désormais responsable de la quasi-totalité des appels d'API vers votre cloud depuis le cluster. + +À partir de la version 1.8, le cloud-controller-manager peut implémenter: + +* contrôleur de nœud - responsable de la mise à jour des nœud kubernetes à l’aide des API de cloud et de la suppression des nœud kubernetes supprimés sur votre cloud. +* contrôleur de service - responsable des loadbalancers sur votre cloud vers des services de type LoadBalancer. +* contrôleur de route - responsable de la configuration des routes réseau sur votre cloud +* toute autre fonctionnalité que vous voudriez implémenter si vous exécutez en dehors de l'arborescence de Kubernetes. + +## Exemples + +Si vous utilisez un cloud actuellement pris en charge nativement dans Kubernetes et souhaitez adopter le cloud-controller-manager, reportez-vous à la section [cloud-controller-manager dans kubernetes core](https://github.com/kubernetes/kubernetes/tree/master/cmd/cloud-controller-manager). + +Pour les cloud-controller-manager ne faisant pas partie de Kubernetes, vous pouvez trouver les projets respectifs dans des dépôts maintenus par des fournisseurs de cloud ou des sig leads. + +* [DigitalOcean](https://github.com/digitalocean/digitalocean-cloud-controller-manager) +* [keepalived](https://github.com/munnerz/keepalived-cloud-provider) +* [Oracle Cloud Infrastructure](https://github.com/oracle/oci-cloud-controller-manager) +* [Rancher](https://github.com/rancher/rancher-cloud-controller-manager) + +Pour les fournisseurs qui se trouvent déjà dans Kubernetes, vous pouvez exécuter le cloud-controller-manager dans l'arborescence en tant que Daemonset dans votre cluster. +Utilisez ce qui suit comme guide: + +{{< codenew file="admin/cloud/ccm-example.yaml" >}} + +## Limitations + +L'exécution du cloud-controller-manager est soumise à quelques limitations. +Bien que ces limitations soient levées dans les prochaines versions, il est important que vous connaissiez ces limitations pour les charges de travail de production. + +### Prise en charge des volumes + +Le cloud-controller-manager n'implémente aucun des contrôleurs de volume trouvés dans `kube-controller-manager` car les intégrations de volume nécessitent également une coordination avec les kubelets. +Au fur et à mesure de l'évolution de CSI (interface de stockage de conteneur) et de la prise en charge renforcée des plug-ins de volume flexible, le cloud-controller-manager prendra en charge le support nécessaire afin que les clouds puissent pleinement s'intégrer aux volumes. +Pour en savoir plus sur les plug-ins de volume CSI en dehors des sources de Kubernetes consultez [ceci](https://github.com/kubernetes/features/issues/178). + +### Charge sur les APIs cloud + +Dans l'architecture précédente pour les fournisseurs de cloud, nous utilisions des kubelets utilisant un service de métadonnées local pour extraire des informations sur les nœuds. +Avec cette nouvelle architecture, nous comptons désormais entièrement sur les cloud-controller-manager pour extraire les informations de tous les nœuds. +Pour les très grand clusters, vous devez envisager les goulots d'étranglement tels que les besoins en ressources et la limitation de la vitesse des APIs de votre fournisseur cloud. + +### Problème de l'oeuf et de la poule + +L'objectif du projet des cloud-controller-manager est de dissocier le développement des fonctionnalités de cloud computing du projet de base Kubernetes. +Malheureusement, de nombreux aspects du projet Kubernetes supposent que les fonctionnalités de fournisseur de cloud soient étroitement intégrées au projet. +Par conséquent, l'adoption de cette nouvelle architecture peut créer plusieurs situations dans lesquelles une demande d'informations auprès d'un fournisseur de cloud est demandée, mais le cloud-controller-manager peut ne pas être en mesure de renvoyer ces informations sans que la demande d'origine soit complète. + +La fonctionnalité d’amorçage TLS dans Kubelet en est un bon exemple. +Actuellement, l’amorçage TLS suppose que Kubelet aie la possibilité de demander au fournisseur de cloud (ou à un service de métadonnées local) tous ses types d’adresses (privé, public, etc.), mais le cloud-controller-manager ne peut pas définir les types d’adresse d’un nœud sans être initialisé dans le système. Ce qui nécessite que le kubelet possède des certificats TLS pour communiquer avec l’apiserver. + +À mesure que cette initiative évoluera, des modifications seront apportées pour résoudre ces problèmes dans les prochaines versions. + +## Développer votre propre cloud-controller-manager + +Pour créer et développer votre propre cloud-controller-manager, lisez la documentation [Développer un cloud-controller-manager](/docs/tasks/administer-cluster/developing-cloud-controller-manager.md). + +{{% /capture %}} diff --git a/content/fr/examples/admin/cloud/ccm-example.yaml b/content/fr/examples/admin/cloud/ccm-example.yaml new file mode 100644 index 0000000000..e3bc52e53c --- /dev/null +++ b/content/fr/examples/admin/cloud/ccm-example.yaml @@ -0,0 +1,67 @@ +# Voici un exemple de configuration de cloud-controller-manager en tant que Daemonset dans votre cluster. +# Il suppose que vos masters peuvent executer des pods et ont le role node-role.kubernetes.io/master +# Notez que ce Daemonset ne fonctionnera pas directement pour votre cloud, c’est juste un exemple. + +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: cloud-controller-manager + namespace: kube-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: system:cloud-controller-manager +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: cloud-controller-manager + namespace: kube-system +--- +apiVersion: apps/v1 +kind: DaemonSet +metadata: + labels: + k8s-app: cloud-controller-manager + name: cloud-controller-manager + namespace: kube-system +spec: + selector: + matchLabels: + k8s-app: cloud-controller-manager + template: + metadata: + labels: + k8s-app: cloud-controller-manager + spec: + serviceAccountName: cloud-controller-manager + containers: + - name: cloud-controller-manager + # pour les fournisseurs in-tree, nous utilisons k8s.gcr.io/cloud-controller-manager + # cela peut être remplacé par n'importe quelle autre image pour les fournisseurs out-of-tree + image: k8s.gcr.io/cloud-controller-manager:v1.8.0 + command: + - /usr/local/bin/cloud-controller-manager + - --cloud-provider= # Ajoutez votre propre fournisseur de cloud ici! + - --leader-elect=true + - --use-service-account-credentials + # ces drapeaux varient pour chaque fournisseur de cloud + - --allocate-node-cidrs=true + - --configure-cloud-routes=true + - --cluster-cidr=172.17.0.0/16 + tolerations: + # cela est nécessaire pour que CCM puisse s'initialiser + - key: node.cloudprovider.kubernetes.io/uninitialized + value: "true" + effect: NoSchedule + # le daemonset doit pouvoir être exécuté sur les nœuds master. Le marquage peut varier en fonction de la configuration de votre cluster. + - key: node-role.kubernetes.io/master + effect: NoSchedule + # ceci limite le fonctionnement du CCM sur des nœuds master + # le sélecteur de nœud peut varier en fonction de la configuration de votre cluster + nodeSelector: + node-role.kubernetes.io/master: "" From d6cb8259a2b49f58797ea60ae540a5fdb7e802c9 Mon Sep 17 00:00:00 2001 From: Thibaut Tauveron Date: Tue, 20 Aug 2019 12:05:32 +0200 Subject: [PATCH 55/74] docs-fr | concepts | overview | components.md (#15939) * docs-fr | concepts | overview | components.md * Update content/fr/docs/concepts/overview/components.md Co-Authored-By: Tim Bannister * Update content/fr/docs/concepts/overview/components.md Co-Authored-By: Tim Bannister * Fix translation --- .../fr/docs/concepts/overview/components.md | 128 ++++++++++++++++++ content/fr/docs/reference/glossary/etcd.md | 22 +++ .../docs/reference/glossary/kube-apiserver.md | 19 +++ .../glossary/kube-controller-manager.md | 19 +++ .../fr/docs/reference/glossary/kube-proxy.md | 24 ++++ .../docs/reference/glossary/kube-scheduler.md | 18 +++ 6 files changed, 230 insertions(+) create mode 100644 content/fr/docs/concepts/overview/components.md create mode 100755 content/fr/docs/reference/glossary/etcd.md create mode 100755 content/fr/docs/reference/glossary/kube-apiserver.md create mode 100755 content/fr/docs/reference/glossary/kube-controller-manager.md create mode 100755 content/fr/docs/reference/glossary/kube-proxy.md create mode 100755 content/fr/docs/reference/glossary/kube-scheduler.md diff --git a/content/fr/docs/concepts/overview/components.md b/content/fr/docs/concepts/overview/components.md new file mode 100644 index 0000000000..4a2376d307 --- /dev/null +++ b/content/fr/docs/concepts/overview/components.md @@ -0,0 +1,128 @@ +--- +title: Composants de Kubernetes +content_template: templates/concept +weight: 20 +card: + name: concepts + weight: 20 +--- + +{{% capture overview %}} +Ce document résume les divers composants binaires requis pour livrer +un cluster Kubernetes fonctionnel. +{{% /capture %}} + +{{% capture body %}} +## Composants Master + +Les composants Master fournissent le plan de contrôle (control plane) du cluster. +Les composants Master prennent des décisions globales à propos du cluster (par exemple, la planification (scheduling)). +Ils détectent et répondent aux événements du cluster (par exemple, démarrer un nouveau {{< glossary_tooltip text="Pod" term_id="pod">}} lorsque le champ `replicas` d'un déploiement n'est pas satisfait). + +Les composants Master peuvent être exécutés sur n'importe quelle machine du cluster. Toutefois, +par soucis de simplicité, les scripts de mise en route démarrent typiquement tous les composants master sur la +même machine et n'exécutent pas de conteneurs utilisateur sur cette machine. +Voir [Construire des Clusters en Haute Disponibilité](/docs/admin/high-availability/) pour une configuration d'exemple en multi-master-VM. + +### kube-apiserver + +{{< glossary_definition term_id="kube-apiserver" length="all" >}} + +### etcd + +{{< glossary_definition term_id="etcd" length="all" >}} + +### kube-scheduler + +{{< glossary_definition term_id="kube-scheduler" length="all" >}} + +### kube-controller-manager + +{{< glossary_definition term_id="kube-controller-manager" length="all" >}} + +Ces contrôleurs incluent : + + * Node Controller : Responsable de détecter et apporter une réponse lorsqu'un nœud tombe en panne. + * Replication Controller : Responsable de maintenir le bon nombre de pods pour chaque objet + ReplicationController dans le système. + * Endpoints Controller : Remplit les objets Endpoints (c'est-à-dire joint les Services et Pods). + * Service Account & Token Controllers : Créent des comptes par défaut et des jetons d'accès à l'API + pour les nouveaux namespaces. + +### cloud-controller-manager + +Le [cloud-controller-manager](/docs/tasks/administer-cluster/running-cloud-controller/) exécute les contrôleurs +qui interagissent avec les fournisseurs cloud sous-jacents. Le binaire du cloud-controller-manager est une +fonctionnalité alpha introduite dans la version 1.6 de Kubernetes. + +Le cloud-controller-manager exécute seulement les boucles spécifiques des fournisseurs cloud. +Vous devez désactiver ces boucles de contrôleurs dans le kube-controller-manager. +Vous pouvez désactiver les boucles de contrôleurs en définissant la valeur du flag `--cloud-provider` à `external` lors du démarrage du kube-controller-manager. + +Le cloud-controller-manager permet au code du fournisseur cloud et au code de Kubernetes d'évoluer indépendamment l'un de l'autre. +Dans des versions antérieures, le code de base de Kubernetes dépendait du code spécifique du fournisseur cloud pour la fonctionnalité. Dans des versions ultérieures, le code spécifique des fournisseurs cloud devrait être maintenu par les fournisseurs cloud eux-mêmes et lié au cloud-controller-manager lors de l'exécution de Kubernetes. + +Les contrôleurs suivants ont des dépendances vers des fournisseurs cloud : + + * Node Controller : Pour vérifier le fournisseur de cloud afin de déterminer si un nœud a été supprimé dans le cloud après avoir cessé de répondre + * Route Controller : Pour mettre en place des routes dans l'infrastructure cloud sous-jacente + * Service Controller : Pour créer, mettre à jour et supprimer les load balancers des fournisseurs cloud + * Volume Controller : Pour créer, attacher et monter des Volumes, et interagir avec le fournisseur cloud pour orchestrer les volumes. + +## Composants de nœud + +Les composants de nœud (Node components) s'exécutent sur chaque nœud, en maintenant les pods en exécution +et en fournissant l'environnement d'exécution Kubernetes. + +### kubelet + +{{< glossary_definition term_id="kubelet" length="all" >}} + +### kube-proxy + +{{< glossary_definition term_id="kube-proxy" length="all" >}} + +### Container Runtime + +{{< glossary_definition term_id="container-runtime" length="all" >}} + +## Addons + +Les addons utilisent les ressources Kubernetes ({{< glossary_tooltip term_id="daemonset" >}}, {{< glossary_tooltip term_id="deployment" >}}, etc) +pour implémenter des fonctionnalités cluster. Comme ces derniers fournissent des fonctionnalités au niveau +du cluster, les ressources dans des namespaces pour les addons appartiennent au namespace `kube-system`. + +Les addons sélectionnés sont décrits ci-dessous. Pour une liste étendue des addons disponibles, voir la page +[Addons](/docs/concepts/cluster-administration/addons/). + +### DNS + +Tandis que les autres addons ne sont pas strictement requis, tous les clusters Kubernetes devraient avoir un +[DNS cluster](/fr/docs/concepts/services-networking/dns-pod-service/) car de nombreux exemples en dépendent. + +Le DNS Cluster est un serveur DNS, en plus des autres serveurs DNS dans votre environnement, qui sert +les enregistrements DNS pour les services Kubernetes. + +Les conteneurs démarrés par Kubernetes incluent automatiquement ce serveur DNS dans leurs recherches DNS. + +### Interface utilisateur Web (Dashboard) + +Le [Dashboard](/docs/tasks/access-application-cluster/web-ui-dashboard/) est une interface utilisateur web à but général pour les clusters Kubernetes. Il permet aux utilisateurs de gérer et de dépanner aussi bien des +applications s'exécutant dans le cluster que le cluster lui-même. + +### La surveillance des ressources de conteneur + +[La surveillance des ressources de conteneur](/docs/tasks/debug-application-cluster/resource-usage-monitoring/) enregistre des métriques chronologiques génériques à propos des conteneurs dans une base de données centrale et +fournit une interface utilisateur pour parcourir ces données. + +### Le logging au niveau cluster + +Un mécanisme de [logging au niveau cluster](/docs/concepts/cluster-administration/logging/) est chargé +de sauvegarder les logs des conteneurs dans un magasin de logs central avec une interface de recherche/navigation. + +{{% /capture %}} +{{% capture whatsnext %}} +* En savoir plus sur les [Nœuds](/fr/docs/concepts/architecture/nodes/) +* En savoir plus sur [kube-scheduler](/docs/concepts/scheduling/kube-scheduler/) +* Lire la [documentation officielle d'etcd](https://etcd.io/docs/) +{{% /capture %}} diff --git a/content/fr/docs/reference/glossary/etcd.md b/content/fr/docs/reference/glossary/etcd.md new file mode 100755 index 0000000000..4a86d40bd9 --- /dev/null +++ b/content/fr/docs/reference/glossary/etcd.md @@ -0,0 +1,22 @@ +--- +title: etcd +id: etcd +date: 2018-04-12 +full_link: /docs/tasks/administer-cluster/configure-upgrade-etcd/ +short_description: > + Base de données clé-valeur consistante et hautement disponible utilisée comme mémoire de sauvegarde pour toutes les données du cluster. + +aka: +tags: +- architecture +- storage +--- + Base de données clé-valeur consistante et hautement disponible utilisée comme mémoire de sauvegarde pour toutes les données du cluster. + + + +Si votre cluster Kubernetes utilise etcd comme mémoire de sauvegarde, assurez-vous d'avoir un plan de +[back up](/docs/tasks/administer-cluster/configure-upgrade-etcd/#backing-up-an-etcd-cluster) pour ces données. + +Vous pouvez trouver plus d'informations à propos d'etcd dans la [documentation](https://etcd.io/docs/) officielle. + diff --git a/content/fr/docs/reference/glossary/kube-apiserver.md b/content/fr/docs/reference/glossary/kube-apiserver.md new file mode 100755 index 0000000000..491b1b65ce --- /dev/null +++ b/content/fr/docs/reference/glossary/kube-apiserver.md @@ -0,0 +1,19 @@ +--- +title: kube-apiserver +id: kube-apiserver +date: 2018-04-12 +full_link: /docs/reference/generated/kube-apiserver/ +short_description: > + Composant sur le master qui expose l'API Kubernetes. Il s'agit du front-end pour le plan de contrôle Kubernetes. + +aka: +tags: +- architecture +- fundamental +--- + Composant sur le master qui expose l'API Kubernetes. Il s'agit du front-end pour le plan de contrôle Kubernetes. + + + +Il est conçu pour une mise à l'échelle horizontale, ce qui veut dire qu'il met à l'échelle en déployant des instances supplémentaires. Voir [Construire des Clusters en Haute Disponibilité](/docs/admin/high-availability/). + diff --git a/content/fr/docs/reference/glossary/kube-controller-manager.md b/content/fr/docs/reference/glossary/kube-controller-manager.md new file mode 100755 index 0000000000..5342b8b116 --- /dev/null +++ b/content/fr/docs/reference/glossary/kube-controller-manager.md @@ -0,0 +1,19 @@ +--- +title: kube-controller-manager +id: kube-controller-manager +date: 2018-04-12 +full_link: /docs/reference/generated/kube-controller-manager/ +short_description: > + Composant du master qui exécute les contrôleurs. + +aka: +tags: +- architecture +- fundamental +--- + Composant du master qui exécute les {{< glossary_tooltip text="contrôleurs" term_id="controller" >}}. + + + +Logiquement, chaque {{< glossary_tooltip text="contrôleur" term_id="controller" >}} est un processus à part mais, +pour réduire la compléxité, les contrôleurs sont tous compilés dans un seul binaire et s'exécutent dans un seul processus. diff --git a/content/fr/docs/reference/glossary/kube-proxy.md b/content/fr/docs/reference/glossary/kube-proxy.md new file mode 100755 index 0000000000..db9097cd1b --- /dev/null +++ b/content/fr/docs/reference/glossary/kube-proxy.md @@ -0,0 +1,24 @@ +--- +title: kube-proxy +id: kube-proxy +date: 2018-04-12 +full_link: /docs/reference/command-line-tools-reference/kube-proxy/ +short_description: > + `kube-proxy` est un proxy réseau qui s'exécute sur chaque nœud du cluster. + +aka: +tags: +- fundamental +- networking +--- + [kube-proxy](/docs/reference/command-line-tools-reference/kube-proxy/) est un +proxy réseau qui s'exécute sur chaque nœud du cluster et implémente une partie du +concept Kubernetes de {{< glossary_tooltip term_id="service">}}. + + + +kube-proxy maintient les règles réseau sur les nœuds. Ces règles réseau permettent +une communication réseau vers les Pods depuis des sessions réseau à l'intérieur ou à l'extérieur +du cluster. + +kube-proxy utilise la couche de filtrage de paquets du système d'exploitation s'il y en a une et qu'elle est disponible. Sinon, kube-proxy transmet le trafic lui-même. diff --git a/content/fr/docs/reference/glossary/kube-scheduler.md b/content/fr/docs/reference/glossary/kube-scheduler.md new file mode 100755 index 0000000000..8c72711795 --- /dev/null +++ b/content/fr/docs/reference/glossary/kube-scheduler.md @@ -0,0 +1,18 @@ +--- +title: kube-scheduler +id: kube-scheduler +date: 2018-04-12 +full_link: /docs/reference/generated/kube-scheduler/ +short_description: > + Composant sur le master qui surveille les pods nouvellement créés qui ne sont pas assignés à un nœud et sélectionne un nœud sur lequel ils vont s'exécuter. + +aka: +tags: +- architecture +--- + Composant sur le master qui surveille les pods nouvellement créés qui ne sont pas assignés à un nœud et sélectionne un nœud sur lequel ils vont s'exécuter. + + + +Les facteurs pris en compte pour les décisions de planification (scheduling) comprennent les exigences individuelles et collectives en ressources, les contraintes matérielles/logicielles/politiques, les spécifications d'affinité et d'anti-affinité, la localité des données, les interférences entre charges de travail et les dates limites. + From 3f82ddf4d6c3b5328738d44537cd72cc1525b9bc Mon Sep 17 00:00:00 2001 From: Julie K Date: Tue, 20 Aug 2019 13:09:32 +0200 Subject: [PATCH 56/74] Toleration (#15163) * translated term: toleration * update translation: toleration * Update translation: toleration translated terme "taint" as "marquage" in French and "schedule" as "ordonnancer" in French * Update translation: toleration typo fixup --- .../fr/docs/reference/glossary/toleration.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 content/fr/docs/reference/glossary/toleration.md diff --git a/content/fr/docs/reference/glossary/toleration.md b/content/fr/docs/reference/glossary/toleration.md new file mode 100644 index 0000000000..82547ecfc9 --- /dev/null +++ b/content/fr/docs/reference/glossary/toleration.md @@ -0,0 +1,18 @@ +--- +title: Toleration +id: toleration +date: 2019-01-11 +full_link: /docs/concepts/configuration/taint-and-toleration/ +short_description: > + Un objet de base composé de trois caractéristiques requises : clé, valeur et effet. Les tolérances permettent d'ordonnancer les pods sur les nœuds ou les groupes de nœuds qui ont un marquage compatible. + +aka: +tags: +- core-object +- fundamental +--- + Un objet de base composé de trois caractéristiques requises : clé, valeur et effet. Les tolérances permettent d'ordonnancer les pods sur les nœuds ou les groupes de nœuds qui ont des {{< glossary_tooltip text="marquages" term_id="taint" >}} compatibles. + + + +Tolérances et {{< glossary_tooltip text="marquages" term_id="taint" >}} fonctionnent ensemble pour s'assurer que les pods ne sont pas ordonnancés sur des nœuds inappropriés. Une ou plusieurs tolérances sont appliquées à un {{< glossary_tooltip text="pod" term_id="pod" >}}. Une tolérance indique que le {{< glossary_tooltip text="pod" term_id="pod" >}} est autorisé à (mais non obligé de) être ordonnancé sur les nœuds ou groupes de nœuds avec un {{< glossary_tooltip text="marquage" term_id="taint" >}} compatible. From 09eb5a75eb032b113c59908cfa5412a2444db7e6 Mon Sep 17 00:00:00 2001 From: Anthony Dahanne Date: Tue, 20 Aug 2019 08:29:33 -0400 Subject: [PATCH 57/74] initial french translation (#14863) --- .../kubeadm/generated/kubeadm_init.md | 84 +++++ .../setup-tools/kubeadm/kubeadm-init.md | 303 ++++++++++++++++++ 2 files changed, 387 insertions(+) create mode 100644 content/fr/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md create mode 100644 content/fr/docs/reference/setup-tools/kubeadm/kubeadm-init.md diff --git a/content/fr/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md b/content/fr/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md new file mode 100644 index 0000000000..338b54cdaa --- /dev/null +++ b/content/fr/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md @@ -0,0 +1,84 @@ + +Utilisez cette commande afin de configurer le control plane Kubernetes + +### Synopsis + +Utilisez cette commande afin de configurer le control plane Kubernetes + +La commande "init" exécute les phases suivantes : +``` +preflight Exécute les vérifications en amont +kubelet-start Sauvegarde les réglages kubelet et (re)démarre kubelet +certs Génération de certificats + /etcd-ca Génère le certificat CA auto signé pour fournir les identités à etcd + /apiserver-etcd-client Génère le certificat que l'apiserver utilisera pour communiquer avec etcd + /etcd-healthcheck-client Génère le certificat pour les sondes de vivacité (liveness) qui contrôlent etcd + /etcd-server Génère le certificat pour l'accès à etcd + /etcd-peer Génère le certificat pour que les noeuds etcd puissent communiquer ensemble + /ca Génère le certificat CA auto signé de Kubernetes pour fournir les identités aux autres composants Kubernetes + /apiserver Génère le certificat pour l'accès à l'API Kubernetes + /apiserver-kubelet-client Génère le certificat pour permettre à l'API server de se connecter à kubelet + /front-proxy-ca Génère le certificat CA auto signé pour fournir les identités au proxy frontal (front proxy) + /front-proxy-client Génère le certificat pour le client du proxy frontal + /sa Génère une clef privée pour signer les jetons ainsi que la clef publique du compte service +kubeconfig Génère tous les fichiers kubeconfig nécessaires pour la création du control plane et du fichier kubeconfig admin + /admin Génère un fichier kubeconfig pour utilisation par l'administrateur et kubeadm + /kubelet Génère un fichier kubeconfig pour utilisation par kubelet seulement à des fins d'installation initiale + /controller-manager Génère un fichier fichier kubeconfig for the controller manager to use + /scheduler Génère un fichier kubeconfig pour utilisation par le scheduler +control-plane Génère tous les manifests de Pod statiques nécessaires à la création du control plane + /apiserver Génère le manifest de Pod statique de l'apiserver + /controller-manager Génère le manifest de Pod statique du kube-controller-manager + /scheduler Génère le manifest de Pod statique du kube-schedule +etcd Génère le manifest de Pod statique pour l'etcd local + /local Génère le manifest de Pod statique pour une instance etcd locale, à un seul noeud +upload-config Téléverse les configurations kubeadm et kubelet vers une ConfigMap + /kubeadm Téléverse la ClusterConfiguration de kubeadm vers une ConfigMap + /kubelet Téléverse la configuration kubelet vers une ConfigMap +upload-certs Téléverse les certificats vers kubeadm-certs +mark-control-plane Marque un noeud en tant que control-plane +bootstrap-token Génère les jetons d'installation utilisés pour faire joindre un noeud à un cluster +addon Installe les extensions requises pour l'exécution des tests de Conformance + /coredns Installe l'extension CoreDNS à un cluster Kubernetes + /kube-proxy Installe l'extension kube-proxy à un cluster Kubernetes +``` + + +``` +kubeadm init [flags] +``` + +### Options + +``` + --apiserver-advertise-address string L'adresse IP que l'API Server utilisera pour s'annoncer. Si non spécifiée, l'interface réseau par défaut sera utilisée. + --apiserver-bind-port int32 Port d'écoute de l'API Server. (par default 6443) + --apiserver-cert-extra-sans strings Noms alternatifs (Subject Alternative Names ou encore SANs) optionnels, utilisés dans les certificats servis par l'API Server. Peuvent êtres des adresses IPs ou des noms DNS. + --cert-dir string Le répertoire où sauvegarder les certificats. (par défaut "/etc/kubernetes/pki") + --certificate-key string Clef utilisée pour chiffrer les certificats control-plane dans le Secret the kubeadm-certs. + --config string Chemin vers un fichier de configuration kubeadm. + --cri-socket string Chemin vers la socket CRI à laquelle la connexion doit s'effectuer. S'il n'est pas spécifié, kubeadm essaiera de le détecter; utiliser cette option seulement si vous avez plus d'un CRI installé ou si vous utilisez des sockets CRI non standard. + --dry-run N'effectue aucun changement; affiche seulement la sortie standard de ce qui serait effectué. + --feature-gates string Un ensemble de paires clef=valeur qui décrivent l'entrée de configuration pour des fonctionnalités diverses. Il n'y en a aucune dans cette version. + -h, --help aide pour l'initialisation (init) + --ignore-preflight-errors strings Une liste de contrôles dont les erreurs seront catégorisées comme "warnings" (avertissements). Par exemple : 'IsPrivilegedUser,Swap'. La valeur 'all' ignore les erreurs de tous les contrôles. + --image-repository string Choisis un container registry d'où télécharger les images du control plane. (par défaut "k8s.gcr.io") + --kubernetes-version string Choisis une version Kubernetes spécifique pour le control plane. (par défaut "stable-1") + --node-name string Spécifie le nom du noeud. + --pod-network-cidr string Spécifie l'intervalle des adresses IP pour le réseau des pods. Si fournie, le control plane allouera automatiquement les CIDRs pour chacun des noeuds. + --service-cidr string Utilise un intervalle différent pour les adresses IP des services prioritaires (VIPs). (par défaut "10.96.0.0/12") + --service-dns-domain string Utilise un domaine alternatif pour les services, par exemple : "myorg.internal". (par défaut "cluster.local") + --skip-certificate-key-print N'affiche pas la clef utilisée pour chiffrer les certificats du control-plane. + --skip-phases strings List des des phases à sauter + --skip-token-print N'affiche pas le jeton par défaut de l'installation qui a été généré lors de 'kubeadm init'. + --token string Le jeton à utiliser pour établir la confiance mutuelle entre les noeuds et les noeuds du control-plane. Le format correspond à la regexp : [a-z0-9]{6}\.[a-z0-9]{16} - par exemple : abcdef.0123456789abcdef + --token-ttl duration La durée au bout de laquelle le jeton sera automatiquement détruit (par exemple : 1s, 2m, 3h). Si réglée à '0', le jeton n'expirera jamais (par défaut 24h0m0s) + --upload-certs Téléverse les certificats du control-plane vers le Secret kubeadm-certs. +``` + +### Options héritées depuis la commande parent + +``` + --rootfs string [EXPERIMENTALE] Le chemin vers la "vraie" racine du système de fichiers de l'hôte. +``` + diff --git a/content/fr/docs/reference/setup-tools/kubeadm/kubeadm-init.md b/content/fr/docs/reference/setup-tools/kubeadm/kubeadm-init.md new file mode 100644 index 0000000000..1564aed617 --- /dev/null +++ b/content/fr/docs/reference/setup-tools/kubeadm/kubeadm-init.md @@ -0,0 +1,303 @@ +--- +title: kubeadm init +content_template: templates/concept +weight: 20 +--- +{{% capture overview %}} +Cette commande initialise un noeud Kubernetes control-plane. +{{% /capture %}} + +{{% capture body %}} + +{{< include "generated/kubeadm_init.md" >}} + +### Séquence d'initialisation {#init-workflow} +`kubeadm init` assemble un noeud Kubernetes control-plane en effectuant les étapes suivantes : + +1. Exécute une série de contrôles pour valider l'état du système avant d'y apporter des changements. + Certaines validations peuvent émettre seulement des avertissements (warnings), + d'autres peuvent générer des erreurs qui forceront l'interruption de kubeadm + jusqu'à ce que le problème soit résolu + ou jusqu'à ce que l'utilisateur spécifie `--ignore-preflight-errors=`. + +1. Génère une autorité de certification (CA) auto signée (ou utilise une existante si spécifiée) pour + installer les identités de chaque composant du cluster. Si l'utilisateur a fourni son propre certificat + et/ou clef de CA en le (la) copiant dans le répertoire des certificats, configuré avec `--cert-dir` + (`/etc/kubernetes/pki` par défaut) cette étape est sautée comme expliqué dans le document + [utiliser ses propres certificats](#custom-certificates). + Les certificats de l'API Server auront des entrées SAN additionnelles pour chaque argument `--apiserver-cert-extra-sans`. + +1. Ecrit les fichiers kubeconfig dans `/etc/kubernetes/` pour + kubelet, le controller-manager et l'ordonnanceur (scheduler) + qui seront utlisés pour les connexions à l'API server, chacun avec sa propre identité, + ainsi qu'un fichier kubeconfig supplémentaire pour l'administration, nommé `admin.conf`. + +1. Génère des manifestes statiques de Pod pour l'API server, + le controller manager et l'ordonnanceur. Au cas où aucun etcd externe n'est fourni, + un manifeste statique de Pod pour etcd est généré. + + Les manifestes statiques de Pod sont écrits dans `/etc/kubernetes/manifestes`; + kubelet surveille ce répertoire afin que les Pods soient créés au démarrage. + + Dès lors que les pods de control-plane sont démarrés, la séquence de `kubeadm init` peut alors continuer. + +1. Applique les étiquettes (labels) et marques (taints) au noeud control-plane afin qu'aucune charge de travail additionnelle ne s'y exécute. + +1. Génère le jeton que les noeuds additionnels peuvent utiliser pour s'enregistrer avec un control-plane. Il est possible que l'utilisateur fournisse un jeton en utilisant `--token`, + comme décrit dans la documentation [à propos du jeton kubeadm](/docs/reference/setup-tools/kubeadm/kubeadm-token/). + +1. Produit tous les fichiers de configuration requis pour autoriser les noeuds à rejoindre le cluster avec les + [jetons d'assemblage](/docs/reference/access-authn-authz/bootstrap-tokens/) et le mécanisme + [d'assemblage TLS](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) : + + - Ecrit une ConfigMap pour produire toute la configuration nécessaire + pour rejoindre le cluster et installer les règles d'accès RBAC sous jacentes. + + - Permet aux jetons d'assemblage d'accéder à l'API CSR (Certificate Signing Request, requête de signature de certificat). + + - Configure l'acceptation automatique des nouvelles requêtes CSR. + + Voir [kubeadm join](/docs/reference/setup-tools/kubeadm/kubeadm-join/) pour de l'information complémentaire. + +1. Installe un serveur DNS (CoreDNS) et les modules de l'extension kube-proxy en utilisant l'API Server. + Dans la version 1.11 (et au delà) de Kubernetes, CoreDNS est le serveur DNS par défaut. + Pour installer kube-dns au lieu de CoreDNS, l'extension DNS doit être configurée dans la `ClusterConfiguration` de kubeadm. + Pour plus d'information, se référer à la section ci-dessous intitulée : + `Utiliser kubeadm init avec un fichier de configuration`. + Vous remarquerez que bien que le serveur DNS soit déployé, il ne sera pas programmé pour exécution avant que le CNI soit installé. + +### Utiliser les phases d'initialisation avec kubeadm {#init-phases} + +Kubeadm vous permet de créer un noeud de type control-plane en plusieurs phases. Dans 1.13 la commande `kubeadm init phase` a été promue GA (disponibilité générale) alors que précédemment ce n'était qu'une commande alpha : `kubeadm alpha phase`. + +Pour voir la liste des phases et sous phases dans l'ordre, vous pouvez utiliser `kubeadm init --help`. La liste sera affichée en haut de l'écran d'aide et chaque phase aura une description associée. +Bon à savoir : en appelant `kubeadm init` toutes les phases et sous phases seront executées dans cet ordre. + +Certaines phases ont des options uniques, si vous désirez consulter la liste de ces options, ajoutez `--help`, par exemple : + +```shell +sudo kubeadm init phase control-plane controller-manager --help +``` + +Vous pouvez aussi utiliser `--help` pour voir la liste des sous-phases pour une phase parent : + +```shell +sudo kubeadm init phase control-plane --help +``` + +`kubeadm init` a aussi une option nommée `--skip-phases` qui peut être utilisée pour passer outre. Cette option accepte une liste de noms de phases, qui peuvent être retrouvées à partir de la liste ordonée précédente. + +Par exemple : + +```shell +sudo kubeadm init phase control-plane all --config=configfile.yaml +sudo kubeadm init phase etcd local --config=configfile.yaml +# vous pouvez modifier les fichiers manifestes du control-plane et d'etcd +sudo kubeadm init --skip-phases=control-plane,etcd --config=configfile.yaml +``` + +Cet exemple écrirait les fichiers manifestes pour le control plane et etcd dans `/etc/kubernetes/manifestes` à partir de la configuration dans `configfile.yaml`. Cela permet de modifier les fichiers et d'ensuite sauter ces phases en utilisant `--skip-phases`. En invoquant la dernière commande, vous créerez un noeud de type control plane avec les les fichiers manifestes personnalisés. + +### Utiliser kubeadm init avec un fichier de configuration {#config-file} + +{{< caution >}} +L'utilisation d'un fichier de configuration est toujours considérée beta et le format du fichier pourrait changer dans les prochaines versions. +{{< /caution >}} + +C'est possible de configurer `kubeadm init` avec un fichier de configuration plutôt qu'avec des options en ligne de commande, et certaines fonctionnalités avancées sont d'ailleurs uniquement disponibles en tant qu'options du fichier de configuration. Ce fichier est passé à kubeadm avec l'option `--config`. + +Dans Kubernetes 1.11 et au delà, la configuration par défaut peut être affichée en utilisant la commande +[kubeadm config print](/docs/reference/setup-tools/kubeadm/kubeadm-config/). + +Il est **recommandé** que vous migriez votre configuration `v1alpha3` vers `v1beta1` en utilisant +la commande [kubeadm config migrate](/docs/reference/setup-tools/kubeadm/kubeadm-config/), +car le support de `v1alpha3` sera supprimé dans Kubernetes 1.15. + +Pour plus de détails à propos de chaque option de la configuration `v1beta1` vous pouvez consulter la +[référence de l'API](https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta1). + +### Ajouter des paramètres kube-proxy {#kube-proxy} + +Pour de l'information à propos des paramètres kube-proxy dans la configuration kubeadm, se référer à : +[kube-proxy](https://godoc.org/k8s.io/kubernetes/pkg/proxy/apis/config#KubeProxyConfiguration) + +Pour de l'information sur comment activer le mode IPVS avec kubeadm, se référer à : +[IPVS](https://github.com/kubernetes/kubernetes/blob/master/pkg/proxy/ipvs/README.md) + +### Passer des options personnalisées aux composants du control plane {#control-plane-flags} + +Pour de l'information sur comment passer des options aux composants du control plane, se référer à : +[control-plane-flags](/docs/setup/production-environment/tools/kubeadm/control-plane-flags/) + +### Utiliser des images personnalisées {#custom-images} + +Par défaut, kubeadm télécharge les images depuis `k8s.gcr.io`, à moins que la version demandée de Kubernetes soit une version Intégration Continue (CI). Dans ce cas, `gcr.io/kubernetes-ci-images` est utilisé. + +Vous pouvez outrepasser ce comportement en utilisant [kubeadm avec un fichier de configuration](#config-file). +Les personnalisations permises sont : + +* fournir un `imageRepository` à utiliser à la place de `k8s.gcr.io`. +* régler `useHyperKubeImage` à `true` pour utiliser l'image HyperKube. +* fournir un `imageRepository` et un `imageTag` pour etcd et l'extension (add-on) DNS. + +Notez que le champ de configurtation `kubernetesVersion` ou l'option ligne de commande `--kubernetes-version` affectent la version des images. + +### Utiliser des certificats personnalisés {#custom-certificates} + +Par défaut, kubeadm génère tous les certificats requis pour que votre cluster fonctionne. +Vous pouvez outrepasser ce comportement en fournissant vos propres certificats. + +Pour ce faire, vous devez les placer dans le répertoire spécifié via l'option `--cert-dir` ou spécifié via la propriété `CertificatesDir` de votre fichier de configuration. +Par défaut, le répertoire est `/etc/kubernetes/pki`. + +S'il existe un certificat et une clef privée dans ce répertoire, alors kubeadm sautera l'étape de génération et les fichiers fournis seront utilisés. +Cela signifie que vous pouvez, par exemple, copier un CA (Certificate Authority) existant vers `/etc/kubernetes/pki/ca.crt` +et `/etc/kubernetes/pki/ca.key`, et kubeadm utilisera ce CA pour signer le reste des certificats. + +#### Mode CA externe {#external-ca-mode} + +Il est aussi possible de fournir seulement le fichier `ca.crt` sans le fichier +`ca.key` (seulement dans le cas d'un fichier CA racine, pas pour d'autres paires de certificats). +Si tous les certificats et fichiers kubeconfig sont en place, kubeadm activera le mode "CA externe". +Kubeadm continuera sans clef CA locale. + +Ou alors, vous pouvez utiliser l'outil controller-manager avec `--controllers=csrsigner` en fournissant les emplacements du certificat CA et la clef. + +### Gérer le fichier kubeadm ad-hoc pour kubelet {#kubelet-drop-in} + +Le paquet kubeadm vient avec de la configuration concernant comment kubelet doit se comporter. +Vous remarquerez que la commande CLI `kubeadm` ne modifiera jamais ce fichier. +Ce fichier ad-hoc appartient au paquet deb/rpm de kubeadm. + +Pour en savoir plus sur comment kubeadm gère kubelet, vous pouvez consulter +[cette page](/docs/setup/independent/kubelet-integration). + +### Utilisation de kubeadm avec des runtimes CRI + +Depuis la version v1.6.0, Kubernetes a rendu possible par défaut l'utilisation de CRI, Container Runtime Interface. +Le runtime utilisé par défaut est Docker, activé à travers l'adaptateur fourni `dockershim`, une implémentation CRI, à l'intérieur de `kubelet`. + +Parmi les autres runtimes CRI, on retrouvera : + +- [cri-containerd](https://github.com/containerd/cri-containerd) +- [cri-o](https://github.com/kubernetes-incubator/cri-o) +- [frakti](https://github.com/kubernetes/frakti) +- [rkt](https://github.com/kubernetes-incubator/rktlet) + +Se référer aux [instructions d'installation CRI](/docs/setup/cri) pour plus d'information. + +Après avoir installé `kubeadm` et `kubelet`, exécuter ces étapes additionnelles : + +1. Installer l'adaptateur runtime sur chaque noeud, en suivant les instructions d'installation du projet mentionné ci-dessus. + +1. Configurer kubelet pour utiliser le runtime CRI distant. Ne pas oublier de modifier + `RUNTIME_ENDPOINT` en utilisant la valeur adéquate `/var/run/{your_runtime}.sock`: + +```shell +cat > /etc/systemd/system/kubelet.service.d/20-cri.conf <.<16 + caractères>`. Plus simplement, il doit correspondre à la regexp suivante : + `[a-z0-9]{6}\.[a-z0-9]{16}`. + + kubeadm peut générer un jeton pour vous : + + ```shell + kubeadm token generate + ``` + +1. Démarrer en parallèle le noeud control plane et les noeuds worker nodes avec ce jeton. + Lors de leurs démarrages, ils devraient pouvoir se trouver les uns les autres et former le cluster. + L'option `--token` peut être utilisée aussi bien pour `kubeadm init` que pour `kubeadm join`. + +Une fois que le cluster est correctement démarré, vous pouvez obtenir les identifiants admin depuis le noeud control plane depuis le fichier `/etc/kubernetes/admin.conf` +et les utiliser pour communiquer avec le cluster. + +Vous remarquerez que ce type d'installation présente un niveau de sécurité inférieur puisqu'il ne permet pas la validation du hash du certificat racine avec `--discovery-token-ca-cert-hash` +(puisqu'il n'est pas généré quand les noeuds sont provisionnés). Pour plus d'information, se référer à [kubeadm join](/docs/reference/setup-tools/kubeadm/kubeadm-join/). + +{{% /capture %}} + +{{% capture whatsnext %}} +* [kubeadm init phase](/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/) pour mieux comprendre les phases `kubeadm init` +* [kubeadm join](/docs/reference/setup-tools/kubeadm/kubeadm-join/) pour amorcer un noeud Kubernetes worker node Kubernetes et le faire joindre le cluster +* [kubeadm upgrade](/docs/reference/setup-tools/kubeadm/kubeadm-upgrade/) pour mettre à jour un cluster Kubernetes vers une version plus récente +* [kubeadm reset](/docs/reference/setup-tools/kubeadm/kubeadm-reset/) pour annuler les changements appliqués avec `kubeadm init` ou `kubeadm join` à un noeud +{{% /capture %}} From 63b2dbc77b1d37cba6d12624aed95078039076dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9my=20L=C3=A9one?= Date: Tue, 20 Aug 2019 19:18:57 +0200 Subject: [PATCH 58/74] Translate to French Developing Cloud Controller Mananger (#14961) --- .../developing-cloud-controller-manager.md | 42 +++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 content/fr/docs/tasks/administer-cluster/developing-cloud-controller-manager.md diff --git a/content/fr/docs/tasks/administer-cluster/developing-cloud-controller-manager.md b/content/fr/docs/tasks/administer-cluster/developing-cloud-controller-manager.md new file mode 100644 index 0000000000..4e76fe2e26 --- /dev/null +++ b/content/fr/docs/tasks/administer-cluster/developing-cloud-controller-manager.md @@ -0,0 +1,42 @@ +--- +title: Développer un Cloud Controller Manager +content_template: templates/concept +--- + +{{% capture overview %}} + +{{< feature-state for_k8s_version="v1.11" state="beta" >}} +Dans les prochaines versions, Cloud Controller Manager sera le moyen privilégié d’intégrer Kubernetes à n’importe quel cloud. +Cela garantira que les fournisseurs de cloud peuvent développer leurs fonctionnalités indépendamment des cycles de publication de Kubernetes. + +{{< feature-state for_k8s_version="1.8" state="alpha" >}} + +Avant d’expliquer comment créer votre propre gestionnaire de contrôleur de cloud, il est utile d’avoir quelques informations sur son fonctionnement interne. +Le cloud controller manager est un code de `kube-controller-manager` utilisant des interfaces Go pour permettre la mise en œuvre d'implémentations depuis n'importe quel cloud. +La plupart des implémentations de contrôleurs génériques seront au cœur du projet, mais elles seront toujours exécutées sur les interfaces de cloud fournies, à condition que l'[interface du fournisseur de cloud](https://github.com/kubernetes/cloud-provider/blob/master/cloud.go#L42-L62) soit satisfaite. + +Pour approfondir un peu les détails de la mise en œuvre, tous les gestionnaires de contrôleurs de nuage vont importer des packages à partir de Kubernetes core, la seule différence étant que chaque projet enregistre son propre fournisseur de nuage en appelant [cloudprovider.RegisterCloudProvider](https://github.com/kubernetes/cloud-provider/blob/master/plugins.go#L56-L66) où une variable globale des fournisseurs de cloud disponibles est mise à jour. + +{{% /capture %}} + +{{% capture body %}} + +## Développement + +### Out of Tree + +Pour construire un out-of-tree cloud-controller-manager pour votre cloud, suivez ces étapes: + +1. Créez un package Go avec une implémentation satisfaisant[cloudprovider.Interface](https://github.com/kubernetes/cloud-provider/blob/master/cloud.go). +2. Utilisez [main.go dans cloud-controller-manager](https://github.com/kubernetes/kubernetes/blob/master/cmd/cloud-controller-manager/controller-manager.go) de Kubernetes core en tant que modèle pour votre main.go. Comme mentionné ci-dessus, la seule différence devrait être le package cloud qui sera importé. +3. Importez votre paquet cloud dans `main.go`, assurez-vous que votre paquet a un bloc `init` à exécuter [cloudprovider.RegisterCloudProvider](https://github.com/kubernetes/cloud-provider/blob/master/plugins.go). + +Utiliser des exemples de fournisseurs de cloud out-of-tree peut être utile. +Vous pouvez trouver la liste [ici](/docs/tasks/administer-cluster/running-cloud-controller.md#examples). + +### In Tree + +Pour les cloud in-tree, vous pouvez exécuter le in-tree cloud controller manager comme un [Daemonset](/examples/admin/cloud/ccm-example.yaml) dans votre cluster. +Voir la [documentation sur l'exécution d'un cloud controller manager](/docs/tasks/administer-cluster/running-cloud-controller.md) pour plus de détails. + +{{% /capture %}} From 847aee29686efe4d47021161ab91e1e2c57ad639 Mon Sep 17 00:00:00 2001 From: Thibaut Tauveron Date: Tue, 20 Aug 2019 23:17:18 +0200 Subject: [PATCH 59/74] docs-fr | concepts | workloads | pods | init-containers.md (#15915) --- .../workloads/pods/init-containers.md | 329 ++++++++++++++++++ 1 file changed, 329 insertions(+) create mode 100644 content/fr/docs/concepts/workloads/pods/init-containers.md diff --git a/content/fr/docs/concepts/workloads/pods/init-containers.md b/content/fr/docs/concepts/workloads/pods/init-containers.md new file mode 100644 index 0000000000..e33b9abcce --- /dev/null +++ b/content/fr/docs/concepts/workloads/pods/init-containers.md @@ -0,0 +1,329 @@ +--- +title: Init Containers +content_template: templates/concept +weight: 40 +--- + +{{% capture overview %}} +Cette page fournit une vue d'ensemble des _conteneurs d'initialisation_ (init containers) : des conteneurs spécialisés qui s'exécutent avant les conteneurs d'application dans un {{< glossary_tooltip text="Pod" term_id="pod" >}}. +Les init containers peuvent contenir des utilitaires ou des scripts d'installation qui ne sont pas présents dans une image d'application. + +Vous pouvez spécifier des init containers dans la spécification du Pod à côté du tableau `containers` (qui décrit les conteneurs d'application) +{{% /capture %}} + +{{% capture body %}} + +## Comprendre les init containers + +Un {{< glossary_tooltip text="Pod" term_id="pod" >}} peut avoir plusieurs conteneurs exécutant des applications mais peut aussi avoir un ou plusieurs init containers, qui sont exécutés avant que les conteneurs d'application ne démarrent. + +Les init containers se comportent comme les conteneurs réguliers, avec quelques différences : + +* Les init containers s'exécutent toujours jusqu'à la complétion. +* Chaque init container doit se terminer avec succès avant que le prochain ne démarre. + +Si le init container d'un Pod échoue, Kubernetes redémarre le Pod à répétition jusqu'à ce que le init container se termine avec succès. +Cependant, si le Pod a une `restartPolicy` à "Never", Kubernetes ne redémarre pas le Pod. + +Afin de spécifier un init container pour un Pod, il faut ajouter le champ `initContainers` dans la spécification du Pod, comme un +tableau d'objets de type [Container](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#container-v1-core), au même niveau que le tableau d'applications `containers`. +Le statut des init containers est retourné dans le champ `.status.initContainerStatuses` +comme un tableau des statuts du conteneur (comparable au champ `.status.containerStatuses`). + +### Différences avec les conteneurs réguliers + +Les init containers supportent tous les champs et fonctionnalités des conteneurs d'application +incluant les limites de ressources, les volumes et les paramètres de sécurité. +Cependant, les demandes de ressources pour un init container sont gérées différemment des +limites de ressources, tel que documenté dans [Ressources](#ressources). + +De plus, les init containers ne supportent pas les readiness probes parce que ces conteneurs +s'exécutent jusqu'au bout avant que le Pod soit prêt. + +Si l'on spécifie plusieurs init containers pour un Pod, Kubelet exécute chaque +init container de manière séquentielle. +Chaque init container doit se terminer avec succès avant que le prochain ne puisse s'exécuter. +Lorsque tous les init containers se sont exécutés jusqu'au bout, Kubelet initialise +les conteneurs d'application pour le Pod et les exécute comme d'habitude. + +## Utiliser les init containers + +Puisque les init containers ont des images séparées des conteneurs d'application, +ils apportent certains avantages pour du code de mise en route : + +* Les init containers peuvent contenir des utilitaires ou du code de configuration personnalisé +qui ne sont pas présents dans une image d'application. +Par exemple, il n'y a pas besoin de faire hériter une image d'une autre (`FROM`) seulement pour utiliser +un outil comme `sed`, `awk`, `python`, ou `dig` pendant l'installation. +* Les init containers peuvent exécuter en toute sécurité des utilitaires qui rendraient moins sécurisée une image de conteneur d'application. +* Les rôles "builder" et "deployer" d'une image d'application peuvent travailler indépendamment sans qu'il n'y ait besoin +de créer conjointement une seule image d'application. +* Les init containers peuvent s'exécuter avec une vue du système de fichiers différente de celle des conteneurs d'application dans le même Pod. Par conséquent, on peut leur donner accès aux {{< glossary_tooltip text="Secrets" term_id="secret" >}}, auxquels les conteneurs d'application n'ont pas accès. +* Puisque les init containers s'exécutent jusqu'à la complétion avant qu'un conteneur d'application ne démarre, les init containers +offrent un mécanisme pour bloquer ou retarder le démarrage d'un conteneur d'application tant qu'un ensemble de préconditions n'est pas respecté. Une fois que les préconditions sont respectées, tous les conteneurs d'application dans un Pod peuvent démarrer en parallèle. + +### Exemples + +Voici plusieurs idées pour utiliser les init containers : + +* Attendre qu'un {{< glossary_tooltip text="Service" term_id="service">}} soit créé, + en utilisant une commande shell d'une ligne telle que : + ```shell + for i in {1..100}; do sleep 1; if dig myservice; then exit 0; fi; done; exit 1 + ``` + +* Enregistrer ce Pod à un serveur distant depuis l'API downward avec une commande telle que : + ```shell + curl -X POST http://$MANAGEMENT_SERVICE_HOST:$MANAGEMENT_SERVICE_PORT/register -d 'instance=$()&ip=$()' + ``` + +* Attendre un certain temps avant de démarrer le conteneur d'application avec une commande telle que : + ```shell + sleep 60 + ``` + +* Cloner un dépôt Git dans un {{< glossary_tooltip text="Volume" term_id="volume" >}} + +* Placer des valeurs dans un fichier de configuration et exécuter un outil de templating pour générer +dynamiquement un fichier de configuration pour le conteneur d'application principal. +Par exemple, placer la valeur `POD_IP` dans une configuration et générer le fichier de configuration de l'application principale +en utilisant Jinja. + +#### Les init containers en utilisation + +Cet exemple définit un simple Pod possédant deux init containers. +Le premier attend `myservice` et le second attend `mydb`. Une fois que les deux +init containers terminent leur exécution, le Pod exécute le conteneur d'application décrit dans sa section `spec`. + + +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: myapp-pod + labels: + app: myapp +spec: + containers: + - name: myapp-container + image: busybox:1.28 + command: ['sh', '-c', 'echo "L''app s''exécute!" && sleep 3600'] + initContainers: + - name: init-myservice + image: busybox:1.28 + command: ['sh', '-c', 'until nslookup myservice; do echo "En attente de myservice"; sleep 2; done;'] + - name: init-mydb + image: busybox:1.28 + command: ['sh', '-c', 'until nslookup mydb; do echo "En attente de mydb"; sleep 2; done;'] +``` + +Les fichiers YAML suivants résument les services `mydb` et `myservice` : + +```yaml +apiVersion: v1 +kind: Service +metadata: + name: myservice +spec: + ports: + - protocol: TCP + port: 80 + targetPort: 9376 +--- +apiVersion: v1 +kind: Service +metadata: + name: mydb +spec: + ports: + - protocol: TCP + port: 80 + targetPort: 9377 +``` + +Vous pouvez démarrer ce Pod en exécutant : + +```shell +kubectl apply -f myapp.yaml +``` +``` +pod/myapp-pod created +``` + +Et vérifier son statut avec : +```shell +kubectl get -f myapp.yaml +``` +``` +NAME READY STATUS RESTARTS AGE +myapp-pod 0/1 Init:0/2 0 6m +``` + +ou pour plus de détails : +```shell +kubectl describe -f myapp.yaml +``` +``` +Name: myapp-pod +Namespace: default +[...] +Labels: app=myapp +Status: Pending +[...] +Init Containers: + init-myservice: +[...] + State: Running +[...] + init-mydb: +[...] + State: Waiting + Reason: PodInitializing + Ready: False +[...] +Containers: + myapp-container: +[...] + State: Waiting + Reason: PodInitializing + Ready: False +[...] +Events: + FirstSeen LastSeen Count From SubObjectPath Type Reason Message + --------- -------- ----- ---- ------------- -------- ------ ------- + 16s 16s 1 {default-scheduler } Normal Scheduled Successfully assigned myapp-pod to 172.17.4.201 + 16s 16s 1 {kubelet 172.17.4.201} spec.initContainers{init-myservice} Normal Pulling pulling image "busybox" + 13s 13s 1 {kubelet 172.17.4.201} spec.initContainers{init-myservice} Normal Pulled Successfully pulled image "busybox" + 13s 13s 1 {kubelet 172.17.4.201} spec.initContainers{init-myservice} Normal Created Created container with docker id 5ced34a04634; Security:[seccomp=unconfined] + 13s 13s 1 {kubelet 172.17.4.201} spec.initContainers{init-myservice} Normal Started Started container with docker id 5ced34a04634 +``` + +Pour voir les logs des init containers dans ce Pod, exécuter : +```shell +kubectl logs myapp-pod -c init-myservice # Inspecter le premier init container +kubectl logs myapp-pod -c init-mydb # Inspecter le second init container +``` + +À ce stade, ces init containers attendent de découvrir les services nommés +`mydb` et `myservice`. + +Voici une configuration que vous pouvez utiliser pour faire apparaître ces Services : + +```yaml +--- +apiVersion: v1 +kind: Service +metadata: + name: myservice +spec: + ports: + - protocol: TCP + port: 80 + targetPort: 9376 +--- +apiVersion: v1 +kind: Service +metadata: + name: mydb +spec: + ports: + - protocol: TCP + port: 80 + targetPort: 9377 +``` + +Pour créer les services `mydb` et `myservice` : + +```shell +kubectl apply -f services.yaml +``` +``` +service/myservice created +service/mydb created +``` + +Vous verrez ensuite que ces init containers se terminent et que le Pod `myapp-pod` évolue vers l'état "Running" (en exécution) : + +```shell +kubectl get -f myapp.yaml +``` +``` +NAME READY STATUS RESTARTS AGE +myapp-pod 1/1 Running 0 9m +``` + +Cet exemple simple devrait suffire à vous inspirer pour créer vos propres init containers. +[A suivre](#a-suivre) contient un lien vers un exemple plus détaillé. + +## Comportement détaillé + +Pendant le démarrage d'un Pod, chaque init container démarre en ordre, après que le réseau +et les volumes ont été initialisés. Chaque conteneur doit se terminer avec succès avant que le prochain +ne démarre. Si un conteneur n'arrive pas à démarrer à cause d'un problème d'exécution ou +se termine avec un échec, il est redémarré selon la `restartPolicy` du Pod. +Toutefois, si la `restartPolicy` du Pod est configurée à "Always", les init containers utilisent la `restartPolicy` "OnFailure". + +Un Pod ne peut pas être `Ready` tant que tous les init containers ne se sont pas exécutés avec succès. +Les ports d'un init container ne sont pas agrégés sous un Service. Un Pod qui s'initialise +est dans l'état `Pending` mais devrait avoir une condition `Initializing` configurée à "true". + +Si le Pod [redémarre](#raisons-du-redémarrage-d-un-pod) ou est redémarré, tous les init containers +doivent s'exécuter à nouveau. + +Les changements aux spec d'un init containers sont limités au champ image du conteneur. +Changer le champ image d'un init container équivaut à redémarrer le Pod. + +Puisque les init containers peuvent être redémarrés, réessayés ou ré-exécutés, +leur code doit être idempotent. En particulier, le code qui écrit dans des fichiers sur `EmptyDirs` +devrait être préparé à la possibilité qu'un fichier de sortie existe déjà. + +Les init containers ont tous les champs d'un conteneur d'application. +Cependant, Kubernetes interdit l'utilisation de `readinessProbe` parce que les init containers +ne peuvent pas définir une "readiness" distincte de la complétion. Ceci est appliqué lors de la validation. + +L'utilisation de `activeDeadlineSeconds` sur le Pod et `livenessProbe` sur le conteneur +permet d'empêcher les init containers d'échouer tout le temps. +La deadline active inclut les init containers. + +Le nom de chaque application et init container dans un Pod doit être unique; une erreur de validation +est générée pour tout conteneur partageant un nom avec un autre. + +### Ressources + +Étant donné l'ordonnancement et l'exécution des init containers, les règles suivantes s'appliquent pour l'utilisation des ressources : + +* La plus haute requête ou limite particulière de ressource définie pour tous les init containers +est la *limite/requête d'initialisation effective* +* La *limite/requête effective* d'un Pod pour une ressource est la plus haute parmis : + * la somme de toutes les requêtes/limites des conteneurs d'application pour une ressource + * la limite/requête d'initialisation effective pour une ressource +* Le Scheduling est effectué sur la base des requêtes/limites effectives, ce qui signifie +que les init containers peuvent réserver des ressources pour l'initialisation qui ne sont pas utilisées durant le +cycle de vie du Pod. +* La QoS (qualité de service) tierce de la *QoS tierce effective* d'un Pod est la QoS tierce aussi bien pour les init containers +que pour les conteneurs d'application. + +Les quotas et limites sont appliqués sur la base de la requête/limite effective d'un Pod. + +Les groupes de contrôle au niveau du Pod ({{< glossary_tooltip text="cgroups" term_id="cgroup" >}}) sont basés sur la requête/limite effective de Pod, la même que +celle du scheduler. + +### Raisons du redémarrage d'un Pod + +Un Pod peut redémarrer, ce qui cause la ré-exécution des init containers, pour les raisons suivantes : + +* Un utilisateur met à jour les spécifications du Pod, ce qui cause le changement de l'image de l'init container. +Tout changement à l'image du init container redémarre le Pod. Les changements au conteneur d'application entraînent seulement le +redémarrage du conteneur d'application. +* Le conteneur d'infrastructure Pod est redémarré. Ceci est peu commun et serait effectué par une personne ayant un accès root aux nœuds. +* Tous les conteneurs dans un Pod sont terminés tandis que `restartPolicy` est configurée à "Always", ce qui force le redémarrage, et l'enregistrement de complétion du init container a été perdu à cause d'une opération de garbage collection (récupération de mémoire). + +{{% /capture %}} + + +{{% capture whatsnext %}} + +* Lire à propos de la [création d'un Pod ayant un init container](/docs/tasks/configure-pod-container/configure-pod-initialization/#creating-a-pod-that-has-an-init-container) +* Apprendre à [debugger les init containers](/docs/tasks/debug-application-cluster/debug-init-containers/) + +{{% /capture %}} From 6e2a3cc5e951d8cf32f2e94b8e37344edcb06034 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kevin=20Wiesm=C3=BCller?= Date: Tue, 20 Aug 2019 23:19:16 +0200 Subject: [PATCH 60/74] add documentation on how to strip managedFields (#15700) --- .../docs/reference/using-api/api-concepts.md | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/content/en/docs/reference/using-api/api-concepts.md b/content/en/docs/reference/using-api/api-concepts.md index 0b042071b8..b49fd6aef1 100644 --- a/content/en/docs/reference/using-api/api-concepts.md +++ b/content/en/docs/reference/using-api/api-concepts.md @@ -447,3 +447,26 @@ Another difference is that an applier using Client Side Apply is unable to chang ### Custom Resources Server Side Apply currently treats all custom resources as unstructured data. All keys are treated the same as struct fields, and all lists are considered atomic. In the future, it will use the validation field in Custom Resource Definitions to allow Custom Resource authors to define how to how to merge their own objects. + +### Clearing ManagedFields + +It is possible to strip all managedFields from an object by overwriting them using `MergePatch`, `StrategicMergePatch`, `JSONPatch` or `Update`, so every non-apply operation. +This can be done by overwriting the managedFields field with an empty entry. Two examples are: + +```json +PATCH /api/v1/namespaces/default/configmaps/example-cm +Content-Type: application/merge-patch+json +Accept: application/json +Data: {"metadata":{"managedFields": [{}]}} +``` + +```json +PATCH /api/v1/namespaces/default/configmaps/example-cm +Content-Type: application/json-patch+json +Accept: application/json +Data: [{"op": "replace", "path": "/metadata/managedFields", "value": [{}]}] +``` + +This will overwrite the managedFields with a list containing a single empty entry that then results in the managedFields being stripped entirely from the object. Note that just setting the managedFields to an empty list will not reset the field. This is on purpose, so managedFields never get stripped by clients not aware of the field. + +In cases where the reset operation is combined with changes to other fields than the managedFields, this will result in the managedFields being reset first and the other changes being processed afterwards. As a result the applier takes ownership of any fields updated in the same request. From 7494d882cafaea84cfc0049d2ecb56475ce3d369 Mon Sep 17 00:00:00 2001 From: aimeeu Date: Tue, 20 Aug 2019 16:21:16 -0500 Subject: [PATCH 61/74] Remove references to rkt (#15967) rkt has been archived and is no longer supported as a container runtime by Minikube. Signed-off-by: Aimee Ukasick --- .../en/docs/setup/learning-environment/minikube.md | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/content/en/docs/setup/learning-environment/minikube.md b/content/en/docs/setup/learning-environment/minikube.md index 0d3325b99d..baf0c86ecb 100644 --- a/content/en/docs/setup/learning-environment/minikube.md +++ b/content/en/docs/setup/learning-environment/minikube.md @@ -23,7 +23,7 @@ Minikube supports the following Kubernetes features: * NodePorts * ConfigMaps and Secrets * Dashboards -* Container Runtime: Docker, [rkt](https://github.com/rkt/rkt), [CRI-O](https://github.com/kubernetes-incubator/cri-o), and [containerd](https://github.com/containerd/containerd) +* Container Runtime: Docker, [CRI-O](https://github.com/kubernetes-incubator/cri-o), and [containerd](https://github.com/containerd/containerd) * Enabling CNI (Container Network Interface) * Ingress @@ -252,16 +252,6 @@ minikube start \ --bootstrapper=kubeadm ``` {{% /tab %}} -{{% tab name="rkt container engine" %}} -To use [rkt](https://github.com/rkt/rkt) as the container runtime run: -```shell -minikube start \ - --network-plugin=cni \ - --enable-default-cni \ - --container-runtime=rkt -``` -This will use an alternative minikube ISO image containing both rkt, and Docker, and enable CNI networking. -{{% /tab %}} {{< /tabs >}} #### Use local images by re-using the Docker daemon From 8c4a2bf73ccf4924bc57d8cc54c359cf9cf42400 Mon Sep 17 00:00:00 2001 From: sNathan13 Date: Tue, 20 Aug 2019 22:27:17 -0400 Subject: [PATCH 62/74] Adding PR review request etiquette (#15972) --- content/en/docs/contribute/start.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/content/en/docs/contribute/start.md b/content/en/docs/contribute/start.md index 8d953ba57c..c736e0914a 100644 --- a/content/en/docs/contribute/start.md +++ b/content/en/docs/contribute/start.md @@ -269,7 +269,10 @@ pull request if it detects that you pushed a new branch to your fork. If a reviewer asks you to make changes, you can go to the **Files changed** tab and click the pencil icon on any files that have been changed by the pull request. When you save the changed file, a new commit is created in - the branch being monitored by the pull request. + the branch being monitored by the pull request. If you are waiting on a + reviewer to review the changes, proactively reach out to the reviewer + once every 7 days. You can also drop into #sig-docs Slack channel, + which is a good place to ask for help regarding PR reviews. 7. If your change is accepted, a reviewer merges your pull request, and the change is live on the Kubernetes website a few minutes later. From db29a0f91e8736b8b264e306607cf7528284fed8 Mon Sep 17 00:00:00 2001 From: Anders Eknert Date: Wed, 21 Aug 2019 04:41:16 +0200 Subject: [PATCH 63/74] Clarify "no opinion" vs. immediate, short-circuiting deny response. (#15849) --- .../reference/access-authn-authz/webhook.md | 25 ++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/content/en/docs/reference/access-authn-authz/webhook.md b/content/en/docs/reference/access-authn-authz/webhook.md index e4945b1685..3f667fa5ef 100644 --- a/content/en/docs/reference/access-authn-authz/webhook.md +++ b/content/en/docs/reference/access-authn-authz/webhook.md @@ -108,7 +108,13 @@ the request and respond to either allow or disallow access. The response body's } ``` -To disallow access, the remote service would return: +For disallowing access there are two methods. + +The first method is preferred in most cases, and indicates the authorization +webhook does not allow, or has "no opinion" about the request, but if other +authorizers are configured, they are given a chance to allow the request. +If there are no other authorizers, or none of them allow the request, the +request is forbidden. The webhook would return: ```json { @@ -121,6 +127,23 @@ To disallow access, the remote service would return: } ``` +The second method denies immediately, short-circuiting evaluation by other +configured authorizers. This should only be used by webhooks that have +detailed knowledge of the full authorizer configuration of the cluster. +The webhook would return: + +```json +{ + "apiVersion": "authorization.k8s.io/v1beta1", + "kind": "SubjectAccessReview", + "status": { + "allowed": false, + "denied": true, + "reason": "user does not have read access to the namespace" + } +} +``` + Access to non-resource paths are sent as: ```json From 71b5465ae39a98532762342bbd81d00e383b30bd Mon Sep 17 00:00:00 2001 From: Yoon Date: Wed, 21 Aug 2019 11:43:18 +0900 Subject: [PATCH 64/74] Refactor user-guide-windows-nodes (#15857) --- .../flannel-master-kubeclt-get-pods.png | Bin 111844 -> 0 bytes .../windows/flannel-master-kubectl-get-ds.png | Bin 25610 -> 0 bytes .../windows/user-guide-windows-nodes.md | 60 +++++++++++++++--- .../windows/windows-docker-error.png | Bin 81774 -> 0 bytes 4 files changed, 51 insertions(+), 9 deletions(-) delete mode 100644 content/en/docs/setup/production-environment/windows/flannel-master-kubeclt-get-pods.png delete mode 100644 content/en/docs/setup/production-environment/windows/flannel-master-kubectl-get-ds.png delete mode 100644 content/en/docs/setup/production-environment/windows/windows-docker-error.png diff --git a/content/en/docs/setup/production-environment/windows/flannel-master-kubeclt-get-pods.png b/content/en/docs/setup/production-environment/windows/flannel-master-kubeclt-get-pods.png deleted file mode 100644 index 73da333fcfcaae65b0ec6c81d1e43ac69d02d5b0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 111844 zcmZ_0bC4#_wk|wv+qP|E+UB&aY1?+cZQHhObK15&ZR2fxzkScy`<@eVzj&f*WmZ=H zv9c;FmY#}GQjkP|#fAOx;|GGYl$gqoA7C^8wEsXu{&RM*!CCxAfHf!@>T=5Frl&3Bu@NSa99aZm zlo(nBSy>oC5CWW!m>(h-mj5Y`pMn$I2ZTr*g*_QvibVKN=@sQB*QR&Yc8=f;@FqFO z)`$xNwVNs0q$`VzU2Xox`#V-3)?2i1&>bW(pw^{&%US z#r6vF-2cKWI59FV-0|Rz(Pt*Ri;XV?pMf9D?63E=&yY~5OfN#ej#lWdn;tkdSKHUk zd4C<{Jv8PuZ7e|<@MM3k0iO5jhXkG%P@m&$?hs1vxo%e|+MTUPtjR1EsiT&P!yRfx_c|b^qVECCy(9_#`{Fs3!GDo=)1<_;d`z-9u3hb_YOE84uCrm~EVr8>N>=O;Dbz${K5;~a6 z9=>q=Sa~3Od3mUc-8FBl10-B28ulH$F<`g9HoU%bppxk?EKnhV#xww)!!M#hr|Zi=y+3rwn?sbV3X-i}`XAN%slWr{6dfqp3etV36TffQ#(w?+ z--Q0twup{>U8rR7=yXZg1-i;agGcz-FS_r5O{D0j#ijOhyzPx(f=;kt{uA?N{U>4R zAlSAUY&4d4zF4DAho4m7Q=g{#D)$vPnu0Tla9`qQs-HAIG$XRdGhO{>(C59RDnHsg zi#lGYemgd)$uSC{8YYAwjP(3~A^XrCVaRqxu;ly@HZEw6?+?y0^99gK8dk*9+Bb|^ zi%zV%K5uX)-#Nb^>hpYR98Ir7_jo+6fN=!({e)>k_}p@SKl~aMa5`t~XgfSdN0T{0 zP84$bcl_VenW6UdF@PO(#KVMBN5gNyt&Z#M!}6!4T~g4D0aJA#hlRU>*Oa0!T%2++ z4eFl`Ylm+P`L(A}h3=09sK2d#W9^60J;iM4@m>?FcTaF^%JJy1J^FyT&kKiB`_}yS z%&Nwp6XoJ04H{QN&{7ZLyG`yY$+uf;E&s|JRF z`V!&!q1W4EQ@%rb6%|t}{RR!wp=MK7a{J{KYN{tVs~kV7h~AE*5_>>6m53htX5x7@ z_Hn0ivO8+EYkq-T=ky=Vs z^*cgJ`Et>=IPLedV;fZMfudMlJB2oglhBi^PwBpX^*1qQ>#)}ABY}a)y-;7Ix!YsG zvz-1o&xELHtirIT`v*v#l_&Dk6N1NM%R7s;h1Ua2v)zITu#@>n{{`7j5yxK5ZfaBL zKFOG*{&f_%?DzR1^hbHcr?k$=_XydK9HSFIxZL-PaO<-$D7?9XTGtioS{57FL&3+H z{Bf7nevSi?LDv_or8WP$KxM}GB{jD~JO7{U&i#q}x(06kr>&BwMdarS8Re)6IZBXg znu?*!@yIGQbBYQz`p>M1tK0sLDD5*XbiX9eD~20SrG63I*#v3FtKYrasX~}UR)?N` z!?jAwhVOPlMSUTFhbLL~*W3mSCv#J*3Y%YJza(p#bgGdBNhVA=$>;>o3a)rFUG9f^ zL(^@~ZuSoP$MTm2YK)G3kWq01m6AYCkWq)ZC(MX`A)pSEyY*iSUU9S+I&wA|7*Ps5 zR_fhw6D%tDcSAcku87OV|D37$(@$K(IEtCMEU`d3XnAo82ovHgvl6(!5W;Ih577lvd4km z2~7`En_=|qDD(w8%Q^$YQxx^aC_ScaA>29aSse2ztr)@uT08 zpuPJloRcoHd`J2m(u&i_2D@|2Xa{fkzb3zS5z~0ld*#r8_rTCnaZ(az*lEEbra z+WGG|RBvPb^9TT2r4hN6hOqgca+E5@LkXx1A$#&OUx=FCo67U7Wh$(Nv}VvConY5_EhG0YSwcP6j1UVH*OyU1svgG+autz1qsumDD0T%VBi z%X*~8qNZBRntT58U}6*8u;LH?;RL~9*Hu1VUyB-xV*7TroSCC)@?aiN7E1`?b1z@_ zkzZNC#_Z$dMA;%J8R-G(!ydy>JzNq8=ssg(p7^*)LF2FJEe1Pon)}T!MGeIYzA@kl z&tpqdB=2l09$cC{cO@kihn0uq9Q&v7XbmY}Ukn)XR(<@+72(Wy2}Jv1T`VB;5{weg z->bc&5-mPSfl+Ep&EBW*3VFpi{`e3DAi;A{)pHwTnMk5W@NkmGZjfhx2|UI;w-}$a zEHB*#WM0sPJ~LjsCw;2PDJniyxSKYh=*iBO;rjS>8ulgN<#Bw^EU$$%oZB|)`ib98 z**I6qIaj<#c9dhjes0!xxT4#3T{-CRDXXnVf?#3oE$IMuz)(<(ZUM^ivSoC(-rm)p z%m4j-;>Ll-e$==V*AmM!*#G(V`_|_8;xC1jn>h8cy&iQ-@9KjYXA08b8m$&-eD+dDwznpCo53DZnu`!R9f9gf~KG5{3GOk2&>6U0o+IEn_&#y?O3gh z5=FNpt~U?u{a{)p?E1l!xU>m@6j~~f5@Lp^p&jgUm3USauk@RrN!f6*XZB+Cey#t3 z{}CB%bvEOM+0pjca{@>-wK{X?Wv`#(KyErJ;Jed3LpH1yVpWm%Ij<+VwXimVZ*ajd zT#;;YOP6YW+#&56d8|MV)8x$QJAl>Tu>i=5R*|A@Ve~gDg4OKzX^oO=c=)MrE|e{~ z4h_3jnepn<%CWmjZG3E`L-5iBZ(OnfheNK14it0t7A18|ynCd0*!5 z7Sv$TfFP1Ic%*9RZhz{0ixrzT7o8dA;|o_-VnQKLeBE=Qg>PvlOzxi=;g?04Pv4HR z+iNMPVmz)J*0>Pl9pAP9E&f3%&GejgExyxARsY=|=qR5k)Xm$PLF=Wu_N%)46PTV< zN^DjSYtQe2^rf8@W;t0q$dkq>{FiR^a9^I#1))(4CB#Rts>fCGZhS*S`Kn54K6C(| z1Fovq6AP0(gmmU8U}!$<3TZdydviAwG768ez*ZIe#P{SPoyUZiarUVe9f!Vaep@#x zZ})*7aei!(QLMi^c^KL68teAFB(&Ym57nmE@rrIcAXBgI;QG`$-e(}K!O94cF$+`N zmS1}60isy>Z&v4E+S{!xw{Z6L*8>z0;)LUgQZlktSHz+1?$}ne#Zg9yoj?PJsALj` zw>#L5@BMH7*5zPAywHO)@ND6MX3N%~;pC?to7Kp3*TQ%kS^6kQkl-#nDK6EOqLBAKG2y>W1B{FizRQl`D`M z&j>tj;}5XbB*r+B!xu%A@hHoaIm%v2iPD}wBTGr@p;Sh&0068vEEgTbVfBuRvWESdd?I5voT)C4>5`g=S2>3(qTgfwDD zHi)+1IFOll=v*8qmBFMJ41K;`D!5sKuA9}KPAzRgT(U>63;fh+AWwX(WBlWQ*s3M9 zVK73}8bJr^3lxQGxaUJ6@qXzugmwI><=P=rCqahgS&0NOUsY#-Ul+RS3ng1dSwO8; z6G^Tas5jdaTl3u|O~BLwfu8A#5&_+}XZ^bWS7cZmyMPh#K6QnQP)zzbzH3agxrUo} z-@+RUY4;QU+5Krq1UH@=j@JYv)nECfO&8s9U?5LHa^ty89{6uZm750|TZHRJ!Y_0X8i(;EPm9wx8^M>~KUpMkcPxX6Dn)c(R-HX9 z7dLfrxN&GA{yWSp)H_tUEd}(1tXrV~vyi7dHz*N&1eH?l`q=W&{|?FjUP$PYEL06e zSD^A}Gzm?5f<88I_;JZ&GjG2q2qwe*81Hfsp<8|0`CA^|$4olQ6+JVjdQ)w}`m)Lp z*-0>Now{N-4;_Wyob|@P@tcEx(u80(RCmNV?ye1bX6bLFy*+fO=KQS=&4=`Y^!E8M z@PhsUM!(5xHZQUd77N}XA?r}BCYigx1MNqILg;dE2g(j zQCGt0!y3~9;7}5u%jnW0t}*e7>WX{KkIRxcei&Tk*vBLH@xUX-W4HnSz|i7^;+>n% z*Q`nZho#-(aOZLb1sa9I__u|mS0z;vLLbTpfF;ePHtl7@_6y59f zQM-C}P`}j*p$Df>5TDx-nXMI};8P4;!0vXGzc!Qbub-TDeKeqWz4zR$FOT`#$6&_g zQD}lHXO~1MX;Ich?LQNUA!H1~Iw|M2m2 zTz-L3_&G+wk}D`T1g}Rln6nH0XBE+)%!Tu7+TN=hLx#n`vtTyItDqdG#kERO|lSJYy|V$l=Fk-f)VBtC8}upU=&?9*F;X$kw{12+=9VLw!u~4)s6jy z>V8b?v*9>lGziu4cLc+|ext*+cvBY2cp0U+RI{4@buwqjqNf;y2L}gfJDNwz z@7>y?XHTCRX3^oWMq}?OPbe_e@^p~d98sm|?YaiiX{HzQfl)KG?m*h->e+p6#e@Qe z{NRIcW#77ueJ_Q<`|fhn=Z*yiK~7PnzWD%V>%Bcre~HefNj`|EQV7()v|1ZNbrS?# z$WfqI&P%@iax-0-S*-5(laqVsFy47vQTf*!*`-GhT3o$+;>`ESO})#r*{g~lIxUYr z2R@zTH7faZ7j)mZ6>jV22jgY=IX9;5*zZ|GrD5Q0&*oppUDX{3 zdIE#t_0`$|r)|Qu-8VXQp{tzT;;F@i)}EZ@FDqz^|ATCLaQIpc8ule+?y~~oMd69q zOriO&2nT9y2|d`p-Q%)sqNutJTEZyewvab!X4(7jJvoxaPt>?K)`!!l%M(X zR+$kw{H=a(Y4paXHD<7ndi`TU^rvcTKkCPJPdDRQ_?%Y1NsmkBcSm8}sr@XbAGI!| z1FeZ5jWwpDnSNS;W90%dgjDOYG_Ek=rf|Wpsg~nx(r!RB(_KQtV{$xAp&a?9A;gCE z?C$=@(fy&~f}3&Cd(onT_Bj=%2}0~#*cMxV+;}{`^_><{GQ+Bm^iu@YOyy|0$=)p4 z>&4NFliwn(h(nQM(F2$2*9RM~#dnGdr`XG2iyB?nF#+?U6!yAWrT5i%PGh?1X}u8hDA%WwpZ_GSljI zLJ*Scb_s}_blh*$#AaJCjX~uQ^k4UTpOoq2XOAE#rfC^Ll~Wtr9a;hV7Czq*SkpQf zX))5EAuSy)^5q<(R)`Cma|xj!C!;C=!}!*Ti^a67GIdni{44h9O<|Fd8!&$4ay0T+ zc{eGhIa+CW^s(svO7!gFs_2^=?+P|>aCFkk++hJvo_Tn*-!xWK+h3?sJRWAo0hiz< zxi>}yiKD?+^igAXA)-EvGhJmJ={@H{q3BsV^N*6d3*1iCg(%jrh> z&(YBK*hukpFkZu?Hj<=LAMIZq6cozpo`4d1rw=Uyv_? zFSNWnDFFVb4L#Y?g$XhiQQV^o6fGyAn7um^{U_quI6VHAD&&Rud3a2nc&$oFY?}-i zdl_d5`P{-tB=Yp(Hr)#D%*)Tfcx~FU~uh(dotK9$s_KRBU zB%Xdg=8~4_bWEd>U)ndXWmm6j+@@t^j(5&-5yf!+pk!r@As%?)+()&fOcAA#i6~@nC`&60?k^pSSRN? zS^x1VmGd9)4RO#BF{~)X!RVvl2=}wZ4T%!?(F5)XAKLD8YE^$EiNmY|v_Co^R(`}u z7pxC)R)Kb8r}@T8fH2#jAAIpj0r#1@3!_y<_}#@dRcnkwHTGw=Qp6g!SqO9`rOETq{tfUH2taQ zr`b2yX=Wrmk`=u%X9$DgS{c-|MQ6%Givw$@07Ne|*NuSILrS*G)cCs_W}ABh3^Y1Yw}}LS$Vw9N;tR*I?Mu$)OaxeqJ)#) z1bKV&ENkshOa@kCCp}vrr@lFBE-wS%!~5xW@q}HR@!Z@k_n7vLi?OW64&YB%$@$}L z89NQgyB<9IYa`*`hg?1D}I43Md*{D)cU{i{WN*IGK5Rom205*-@ zUX+M35n)Sv!y|)>g%qQjlIhkL;0w%b=o!@!UHu}nm_N>^`HOE#Ik&r=3&Q3bzZk=@ zro0s7TIKDlP3){;Ed?)o9CJFyTNq8bhtI>7W;fm9Cmxh1+m_)$FvC0bXO;Yi;H zMj?}R9<{SF6bcJ@bDwiVyAG?vJv}X|Dpl8;L<0K`d=>eiPRyO(T*$wDda8{stvAHRtlSeP?z!tX>MXKT8MY0*)x9AKCfq$Aj$L<&ItDb?R&=Atq zbLG}N9yHV!Iv85N=>%Kb{VfT(OXumr9~&!840DPCq%Nk=RvHp#L@5>Jei=dz?0v`8 zL|sJ2z>5N1aO1$EXE$^m&ZlBTa)zmn33BH8EZcU2+weA(?bv5ua&rK~m5sV{OKGze z094HnLR9?dY1GO=@868t9UfSdvOC1Wz-GD-=CWygC%@6+z=;J<0A*A|}^3P~jB@T~^^!z}@Y zNQG6YY_2j!;hPS4ZGxw`1?p85W75lnEK54vts2)(8tv_EA@uM8)m6kX3lCUH%Gh96 z?qAd2U1baWZ)51FzJ8lKv=xCiWtR4vG&TViP7xWjXgeIRYAwb{5X=-=08%spYaWAX zfk(-LzAES=iRY*;C@98o>8`^l*4EzQ^GC{a5Xkb#-IheQn`%bNhcDgsv6^ z2-bWOqprYfPCP!yAd8r?SaedJpyIZW20^7O;Y#pjv{hjL)blk3uk z%=KPSbEIbzD=Z!vJ@NpWFcEZ_wRt{ulQ|t*s){o+D}B(X<;1I7AZ-D--8Hi^1*xnE zI48RF-8XTsOXY$sMJ+ZzDtL-jGvFW+dDQrD0y1p2DN%L4OqT|O^*&pD|+A1f);

?hmWu|brK@QlAxTn-C@fl#g22{hOAF^6 z0KgAOwKX*Y{fHlG_5yQhZVL@a^e4MMZ9f@-^Mx$w6+J6|j7=Ntpx~v&jBr$7x8oZX zi4!B6MA=XnN$%#+{8%h$r!ALa;#v&R)+TJe&)FCJ^8+xu8)LBPH@+8gy03FlH@HgS zKk;Bu%j5LXEKsd*1^DlzXa9L*KscTW70Pht>&70Q#vo|f!Rpki z_l4s(#-ag5@YO5ng$JNwa7j>f!I@nOB$$JHJzbnA5A4j6(c(ZPaiO zbSv(SNi4Krk)J;&5`QCkwYpu z&w=*=9`_NmKP(U%6OD{r_DyR&u4^2JRu)0LP02SBRpSRbYQt)7X^*+zoJJT0Yl#x} z_40KQUbt;JupcXVst5X0>QSWStlSAap{nvwoY!oodOdJ3>ANy|FZ-_)uhYBT?BcHx z0AC?p_Fi^2G0tG*x;yS7mFCf5^3=MiJ#R-pAkSUAxUcx z$YZIQtU>crI*J8#U+Q(XwMHZFOS9wci79T{vfR=B0)7 zy%-v^ZblvSoKO@39JiL|o=azw?TFUZTxrN|@@Tw}SxV|^VKsf;B3G-o=1KE?-d&dS z%u98nTz)an3=-YnI!p+9jVBM|*^RHSmVD*Y8wLN_Q&Ih|K~2zD=+(nEIyCu8L+)Ww zl#^C}_B(h!ZZiQNiMaUDH{=slSp)X_UFA6m#o3dJyh!aHb(w)cZ03|P6lZhTt;kR! zR=c4fw+6vGGqvSh(j%#iYEh00ilLfJp{RNV68rQb8vooSv6isTxJSYj3OE?_HMQ@H z3LDw>mlx?8rgmmpRsQJotJ0ee#)Pq9GGuf*?%g|lI3yAiN;nWII>%`8`!?QZW8eP9 zoaW8d*T}$AN)GW zD?NCGplJ<{_KP9RBPt1kD^8hy>WZM3&W(8aaTF$IWB`x8)?hkM{ zAcH+oz8|d&NbsWOoqo0A+BqK{l;NnS1(6FP6(DAEsOA`5wUBn&|LFPTuqcQ#6Ovbq z3%PqVnE76 zvzU_56%hizI=}?f?Pd?{saj@7j^)oTUt&|nlw*HJ5lUt;jwZ7kJLJPm*RUqUOx*`jF-H-LzE@(LYRuol8#Zi6&IEJuu&uPUCJVP(>r5c}Pdt|z{ z&6%$Z^s7J~(d$QVG1H0sW6BnZw;t?cs`o4!ah4gqZ)v`FxDRFUBBAI$wp%IC5B2~x z5v-G&{O?ax)EJV~27vVocm4w`yJe%$9+vm}-e>Vkh8 zUqa+SC!~&zgCgedy0ZSvZ*5JS@?&|j87pg2)A5lyo^#XCV8q=lHI(^H-f4lb_><`LpLo~3`HgL` z`}oM-%C`aWNi3gKuvd52H>&Mn6;xm zX(FmLR`1F9$IAM&)c2JFeO?pt8&k`zz@pIO);rx%)W{)s^yrE#b{H8xPKA-h?z9K| zL7#v0QL!brbhL9HGo?DdW#fRIAjpQGgx&_lf7f#bExOF zXjU7@27DFYH&kmZm$UWxb$ZI6LtQR8`XXEc7oP3AGK;+U`-?Zu9q`N2i2RT>A!g3*k!07C?Y3A^mq4%o% zPaENYVf@~u)q7Mm7+(yuuH}7^XAo=sS*dtS3UMMoeg}!?d(;O1tAl#33tdOAyF>K#X**mQE4rQ z%=^^(Fx@~IzF(5)v7Pdl&1U%h^Ugk~pl=Ww4YX8GZZ>>~?g zUjVI=I6V~9UzR!4;QLMsdOdy!9G8P;RROy_H)HX%sh@-W3XdyG`HkD+QTH;8;b$nB z86jGyisDvKn>?R3!)y!h9XOQf@5gWPl& zl`qx3+iB zBT)_xZGQKi7)`ib-_2;E)I$2J>77|v3%k0a;a5d6^SLs89s+W8R)w)H+zY&gH?%`L zD+Nc}4r^}BQ{kiqn{9<-aQ?h&Ocj7;zlZJa4;i-onAET($)tqycAe+`e zXvI!oU%y4R(~b676;<@(j`=1Hiya5ARjg~iJ;iVsL|pxl~q zFd6gtwr_mxU0Ey9P+iSU+s5)MqE+FQ^Yn_O=uG7oX0TuBTsx{J)Q!J>(GBF(NJ}l+?Sa#% z(+f5b=m?7wA@Jh0s=wY@br`v-ym+ao72wjk{_7Tlea1$2EMmkE)V6VcBAQ zafn2Ey>nxH?WwWfQRU-#Jh>u@wdh(&WXQ%9L%7qL<8lV9Bq(xKfR~sJ!lgg9QnEwbNIt?zaWZ zrP-V)@!fZtuW?7Ujkf%vBEpwiXQL~OMhg;YIgN+gb>QkjcDKh=_R0@y`;az@%s{GwNBp;F1>DWgU&-vaK$ z)z3!~-Bbcx_EN6Hufi0v+s2bzB};4~RHY{a}LD%J2U}zC-}}RM&^!J}8p_Z(dnHZpol_WY)h4a)=OOVO8~e zE3|Cq{{0&c;mCX#N&sLJ^w;2%_xf!G^Oug;8KUZZicn}?FOuwQHMqWGuen*cKF)e) z8*W@RAKt|(e`F|Ey3{5s@3e>QwztJhBPlC|QZ}w{SGyP2_422Tubn-#mCb|o%YmUM zf!}>w(O(4bJfJ|^PG%H#?0S--udl^am;gY1p?`_RB0zk+NvZFGz3_?zznSdcc0&>% z02PG2_&tf*x?PDbAxDyOUhbcK`!0rO-F&h1RQs4rW!SGj&ku!z{tslC z>YwuH4rV_!Ln;VtO2gldsFua#E4$g$rt8zpUvkr&(iNAToYe%ld7HVwzFFf84)M89 zg^<}b+q7%(FJ6uG3J26uXg*YU5aIelNidD#?gPkMm=X=x^A{944ALn(^0a@&-NFds zFTF!Zo~X_~C|wav{(69I)sL00g>PAnOUlMyUukG=PgG1K(tzDWQ}}6{wr66+XPH|o zQIfhlEPVyIof1L1Y%?r0#@JGT?XhBIjicTz-aTw_t!8=Jsrgd7K=Zm|D_US0(E0mJ zb#L5grWH_n)NM#%i@sbpm%Mdz6SeeK&_0f!Z(ABzT5W_sUOVH*jeV!y>8u;!y@wm2 z3g1?cNZmw&(g0n6J9KpUQ=`x3jw~iuSH)#%*uh|#*&Hjw97-Osr-n@_3+*?nl8(f# zwjCYCA7!p!tTWN6pYuLAcd4L025D$U=pI{3GS7~EW>`Rizl#Tu)^QfWgvDkLZLZK% z^Y4h0LUMwFd_7LB0Vx+KFSF%R{f5E27y`2v}* z9X2E_ttD-*@BpRv1A)i45?-qYu)b7c?%J^VxOcDfJSe|Nf}JFB!-&yG#`(x-A5*-C zy{C=uOg%sMkVv8uaoS(;1_Y^#L zSk9p8qr~55*9VcTJw`cXLdbGnBdzv_g0c89pVwP<7xvc{$4hE9lAFCz)lXiB!3MeRNoA zM(-f0h_aI)zVs=3)5XiGnMdF6J@HNHBu$f(Gd|}9ewAC6B+N)1^eYiCi*sn5O)?8w zWHre*V9>U~eiip`SDOkp(8MbHQ=p`4E@aVky7W`zv>cWie`04|a}X)RV;d3D+v+q* zR&JK`jW2~sXx)IPfB8)Y*+>sfL;(Ms%aY)XhUu5*uh-Y=%xy?WQAB?q)Lu15I=JG984pRlTX&l%lAavRUbH~SD~ zpLxdvB8?_z??BSQAc!eWFg05N-o?E-}EYh1Go7dw(*I@0yEA`{=_2*5Oiax z(GX1rAl{E?xiKGbu4GpNxEfp3f znO~S^9cak5@oV{u^jX9h?|^joTVk9@Xnri|_rrD#8a4y3EAQ+6b4SsF1DD+m_S@>D zgqh&B!YvQ_@oD<3o&yynf2jgwfOBD*a89zP$jAkDGm{9Pd>jCwfWBMvJaQkaR?_(T zraC5yCfh~(qtDWbzG6LXmjcLMwORM3aC=WVxzDx9+9osuG;F+K2yvlN} zhPjK~S73Vt&eh5N6g>q%WJGTz>}r_eYhcORau!f1YF@+z{V$l)gQB5k3#INvIOvRI zGLbpsjwzCa9v6K~zfhVy31^HbPMCt{#g$-bm;7sjIWH)r0e7Q zce&dN`S7XaeEgwOD}2poeP{DkLIAU^chVs+*lLwdDKuL_ezicxzQ5s`i_?DQCOQfF zo@W=S68}#Hy`czn_E*qDNN0iB|37Ppn*;iF$Tl}~p+)6?vNQho3e7lxvk$z%6A9P6 z{coNAZ?6pVA99gk%d1t1^?%oj{M(}bx6Iy$1{YsO3>`=hrC5~3!E7n!cX|)jYZsOLl(Q_mft+kwQhcSiIJX)6Sfr& zl5D#b@Yy{zedln_B80Wbc^4HL@3kH#A2&W`5S$>{Bxt- zNXQGy=GL7rURg1{G0ku!`&Y487Fd~NE62Z>WQmDE&d!6No*z({2TtW-?d-7)FqJ}! z86O0w5%I6*nvQqB#N1Qzb4=QexQ6noXuw!#V5mE}(R%D{`}Yx{-c5;JhBvkL}DnjgRIQ$^k0&}&_D%WX`Z=oHGhmJ-fAKLim*< z*oaDBvFRCD3zED4DtDpnpe(W(a7L=5ld_s33vBKVfY`NMyGRb9W0u@^tBzwqC9P&m zSj!0Y@cU4Dz8YO-H4)9AbQjDZ50dBvQb5dy6Fn27W_=+({<0Z^1U+_$v|$!RSlf8T zUwO+FRU;hlkEW3(E;b>D)0PJF(^s8Fo_g7cD+Ku5Ji8+Xi<0x5vc?#+P2ms>yagZA z@9<>m+c-ENdH3O)Ifo`d9*mU)uFUKZ^T^mvjR8-GPTKZXLPz`4dyrS@d^(n|5IgMH2 z9G*@wNh)6iY}8xxy9#0S5N}+?^TO-bJT)B;W282G(Ch46^1F@V7lS}5%nfEHh(Tlz zH|vddFRU_Z$Hj_sAGEd{q`@I;I29iCQIil|uWf{-BSOJ;CJnqo#(tC41YBu%z&42z zFuxwzfRt`4Mf-AWqi5r|>PYuzW2_n*b;A5(aXxDH+=hfaD?8K%H};_C)NG%*c7Ta! zN&Q_<_ne{kar2DasN2XfD>wNyOK8wn3?7PNC0dw-qTvF=*h38l0rMM!sbi%pFG-)K zzN`@H(?>OOkKgrK&d1V`TH70PA7&$`blL+MGwK+PfjdiOcAyfEQSxMdRk_uksP(E! z!x4lPC5;yWYsUdG6VX;ev`)i89bEwaJgVW6HCB{Tvg^tBmmNcB2_UEmiI1Wf8R8-B z@V*LGT1WEsIzd0)bUay%?6AAaaoQ>0Y*N;v?wA?E9O>Ysy8i&;yxm6zdgDW^zX4Z) zDRYnhvFbk|!U$4f%C+Rkw<^1SiV4JFYBv|S2eA|GDZQZHXRoC`gFroW6+Js7mr)0D z`fl7+eN@Dx!BCy5qbEvPE$G;5TWm^hI#YU4)|sK>DohfJ1>Sex@s|=*A)?c|PGmM` zW8{tXQ?y$6Ii1ZwFEBTCx1tgb(0Rv>bkBKnM+5`cV^@Nsb4WnpR}-PhFV>T~ZWIk% zgMM{8rCo>g4_)S=1N$?aPkCMHwc%ogu|$l#!Aop`!bed#t$; zlrn1Q7zL5?tmu--SOwRv5YA*gppnh(Jq~D;AT1mV1Qz(~0Ym5XQB;M}JsVRgcnIa} z@EaYY80iB5JDOQ?lyqu6G#3O4pAjVl*N}QATpOqro|PFj>m!KzM@UduN7!K{p^YJb z&j)8=kXPB=15d`wg*kyKR^d;-=TX#Y2#>UZ=qE3mr~G+Y8bFAT4P7+`OmK@QELZT1 z-g~~e4U&lcrF^iykc-ssi?+Ix8H9%gmN!`BZj-NaE}t*F4N=*l6yAv*w>}xqap}w# zF{RwcbT%DerrVx)$0|uR2#)ut;IFfxB(ZL6kBmTlBs%1rwjW7{MKUoGni349{BVu( z$jw9eHy+=6rksgR{31~M^15{pEkWFC0%k6XhaFVHIbDWHB$#pG&~R1x%&jMO!H$tV zgo;GaPC`? z!+wSscRX$p;qXOI*U)0|YA|)dj&`H_ICrWq4DSKs|wi#(%hN?0iP?!NZECFI`OO`ne0|U$*1ncw1 z8(GdFWBjAoOP;K&dmppO%z!Yy{ROu5ZiDe&VT+$b{RvcAyvBOF_ku;TzgHkvW$cB4 z6Lb|=sYZgR^#||D>@Ys`{%MLaEmqwE1D54(NC)I#xX^MS!NHLHEC~$J4XDTik`TVL z-|ie*-;EupU@%Q2xE|vw{GN2sv%|@)xtG`VjXB$G05R}0WuyOg1NK8hGMq&l2tyKQ zx7(;YHXzkR!GlbaGrNa|mMs5x@R0X3 zp086qyW&RsHr1bYJ?}e~*RTt>gt~E9t(OC;c$0BjRRg9Xga%e&1WW~FygrvN1==D! zxU#qn`?b49Y@Rq}iJ|QGdaGOBe7PTpQq&5-IX$mse2n&M(fhN@1@#*CoOuXx6U{;@-wf108^^@Pv zclN;wNtC*t{`=ZlbN_vd5h5W@YQDpM#wie$!!|3bc!r*x1D34jIBgbE&bpF~2kmpaVh5#(I_WV;?Yr*ilZ z+L->1RlQUXd=oU3-&;yqQ0GnFkWMazK#v5ye1eJKS`Tzzang-3nN8}Q+0Td_~?uUlfB#)2^#GaJ53<1SMI!2cKLBT`! z3P*tQQ#KSLa}lvu;>;|oJ-03@r^9;wWs2jq=eoA}Xm)bb^8pAUN-(NCAK0gg@CXY@ zy{oRZ20ZHQj8Gajni61Q;gqEDAdjZ!Pjs0tCno(ZwOB4(zz%baef8K*U)|WlGGR0o z{`=(n%WLYLB7{W)>{q3c0fC#rWkX!8xrtyq8VL zv{vkPjCgv+Z;{{nl#dgO@tr`7PU>1O7j{zA7lLDA+axhrj^AWw7Ax zKDY)A?i$?P-Q8V-YaqA=x8UwBgWKTtxboipdAGXieD%*c)u(%RuU>11cGF07%l-Rf zNl0(ief}d;x3ri%%e06#i={l%*pTzkfrT4ZK=;CL_}SjQ2dF@vc|t?|e$FsAFxH=( zEj1Qx6VUkLQT3cgl<|+TheE#%<8iJiG=4j`(;U5~Beinkw?J$f7^B&azH{J`c4A7O zh8bTuJ{c_W-3i6IDSsgP>uCZ4V}=SP?9G7utA_U#q8j`09cdRgb|lPVJVjsG zso4W!Tq(9dCx^SAA3=5mjTBc_f;?}oJ8vU98c|AANd4~gLK{lE1-{;@^&483x)zAt zjIin~jFAJYl~-Uesdw<)ikFPc$o^oe8|Hv32VLge<>3@|L?cxt!0+V&_)_friJ@y~ z!J=^|X9(C=QYcwBRQf_lkfrRWW=5yw-!Lp?60M2@|JC7fSPEZE!Wp?j23~1#2|11C z^9WC?)Rw?b#+DqJqE>lzV~^aY>(Xx|0bQT(R@A;UX>U)7lSSHn%~{l0_nT$u5=W>M z_XiqdeSc2fGtK@gU`#|VbwQ}QwSbjuDE zF+L{oLn5^8x|EZR7g)l5H@_Bs+-U;_JHm`L6r)T)Wd_{e_w;(47z2k!gd8JpX1Gc_ zpkBv)>?bm!_$^b02>--0gLj=0($+#5XH;A~1o2m&6XLVNf)$^b09F)o%{gkxYRmDt zctO!L5#b}@gF+TWRk4cTaUGoqpli^b=>Kc(wlK*_vPH1}%orsk*^1dI6SdI{%dYUo zcSVw3Wl+mniYcf3oO`}p`puQ;fO?nTe9dgh;2CnVtsvj*|1S@A@uF0s~dIxrL_ zHK5H7iSE!C3%}?NV88;C-CU38LhJ(97lKpo&^}lM*iofah32vn_uNw7IB~8b2DiOg z@*hv*+69q9p6Q|xkw>V5BwXvNb zXyOCNQ($Ec4b6rfj%5m+S&GRaM^ZP}ww20?oV#Q!$_HdwSj?qPp=#Swk7>dVGk3-4 zJvp_AY^xyDDMLA_-A-BUczH+^s{sY?|^yTo9AQ4s$|ic#4k^*5234Z=v* zn96Ro(^2@uP^uuB+6vXUoC=B& zzfvMipchC4_rnyJZ@Hfs&k5Ol97E-0W4l}-TI;kZ50h4#|5K5ZgoVsvLwRTuE^xW3 z7qJaI+o13eF;zC13jHdGb}TRrvSSj$!=(-Mp2nUMXDtJQi2ZO;1^%&?9*`_*1mrZz z&n<%mi69{B?dMualai~%J|wPJ;uEi4#bnH|qB&}~+&}r1?f_bb`fYjHfnOeV51(!l za>tg~g2FEEb%|AKT+Dhs;!06pQ>9d*a9QK(e_!prZ-Mx2pbSbOTbaDsD5>f7Hsi(I!gLm_418`Fi(IakLJitw9B z$?}nIX?`x8C`gSu%WZorlMXG_7WIL8NqNU`k1B(dTO!K0FH-zfJ#?f>?Gd2SO9ORY(Ek?!J>h*sRWBj4Js;ZfijdExGSi4Sq5^nUY@=Z!&>4F#Zu5{NVdX`TbG-Z?|B%rP`PF{|mAW zn&Bo#jeRMEAJtM$_ka;ntVkcuS^8VM2`=pu_P6{0CaLYRA0o zstq8YuOT=y_8Zl5utbVYcSJA2(G5PVxk=r0YQSw@Tn~ij^kR-&XL?~TVPe^Co&3@$ zKK_2H>)xN{_YH-f3Z<-yw9fOm5ddPp>sB1;iwlPP^K~tJvl&X8=Hc!_AW$O?H4GP~ znL4e`GZtpxc)Qwo9Ixlk#N~|Oi~8*yj$)_TE}k&-*Nn{yZHYTg9m~m~+k3wN(4=O1 zjfA#UZ>s)FFsl*G+xDaazSN$YOwUVKb!kRi@9psmKB29V3Chs(s^aY_UD>+?k}Ntq z&ytkavyikXsEh#~b=!R1_cn5<9y&&@m6|Ru44Iney|HV-ig$ZYMv|PPCAJzO{qQAP zE~KU9NSxh15ox25RIx*ld+Fw)ph!Nj*(*tXm#{&WytKX5vSHh-<);?{q>aoZmjgEM z{T#o_iyPX{^E8jT5)6ZtYAM6eh97dM6Z&Y?@mI7BZ@cF1K3jG}M4hT{#mflo;D&;B z^BR>I%;>Ci){seV2c^cVg`& zh~ccv^9qH1gNyhotE~eH&SzaI**V;9I56XiyX7Z=oP5Xbg}tr#RaaIWJ0CoasV%zF z5kU|r)91ue@n|`+v$~Q+y%~U5-Hzvt%I!rT{*7DX#CPp&FSc9t_h4%t{$V%G+5d>G z7|b9zpT9tl(tf{OZEml9u=+bV+Tf9HQKURmQs5?^uZW0x_eN@qB`z1qVgDeeZZxk6l>_-0z+ zaD9T&aJ}52Q4#Z{b$bVz8V!3s{7+k(Dpi4Yh?v~R2H|jtDU_$HO<0Ub6TnFzT&0Ur zYzq<&{qR7R9Q*VweCtoVj}Q+DQW@#wo4Zp|^;wD_!Jj(0MoZ!rgKjLIPbxYCRGvQ6 zD7gDt;Uz+Ma(LjpEeO`aGvR+lqnSM0{b%vaPbO_&D~i(h=%c!Oil_mJZrKg?!zc9d znl|XfkBHXb2+|=y2X=?d3E~N$jw^#nx>Te?A zJfF0~vFti@{k11@0;~2I?41?u4%P*Tyqjp}oF zptly^|E1+mp>Zq0^!qKXtcI49xSqakp-t$zVq+NZIw)^xGH)B`9jhQqW+0^ev#AE=9^k!PoCvbjP1!4 zPUgyt-_VJTolu*5=VKs=x->tNC|x-O;fjjZ8txKSfvB(?c(C_oLuzwhc7u&3WxTVw zBjSuDOkb>1_kn3lKoTy(Z(K0~wp5O(=Vohp2sV2;nAg<;DnoBKSSE0 zN`au@Mo_}B!hGi+m$LO8AHBPCngIhf_KBS4FNZk3{zO>vPw4RTW7Tt~ue!T}+HX~T z<|M)HXT93mrrUu$l(xcZ2%#n-OAprY10^gb$uSnWa~wSXrwm7ulf2Ixx`uPprM3+u1)(Imj|~4wiBRP0czfjJPGtX zGAyh|)U3ckvWa4b)4!QG0jrLTqUmmXT#T9j-~=_a0~@==@$HokEK_xJK)*~b-AAXE zaz53AfH$SU{J(#Gn?B)zjT{s3wnZGbf8Z`{Sw(s;f`=;IPZ8K=i02!i1w7%_e+f1S zx~O1@g2KG1;Nam~;__h*eyP;R2D83W#JpkWh18&OHQ7}3o28A5csC$ID~%m~&GtIE zD>!)-+%1>WGjvx$+;(98W=h7_8vs5^BelRc@7VjkwyAiCiB3;ULkdwcHxK3jA>QWR z#PbLcDvhu4t;nx>=;J^nk}P|xlU^U>tF+&+y#u>i(~2wc=ZRW1lGOszafcKygVNd4 zca`I@ib*^VXm!}x%2tbtr!Lu@Pi&+NnVWr|1i*p6s4EU=gqNS6xPh*WmSvDq6cIG` z|5+xd5$hfhGEg0Oo^~9O5i2p-{gYvOYE|2VeY*Bwcst}IxRp+AGRT}edRkfM=sJbc zb#JJz&X;)mJoO!R9^BtTTOt+wbI)nIl^`sOZ)$3aV3?9Wsqd&;34hUr&0SNSYd0)A zAahtKOdf22hU$gaWWyi$)2ZxJWVECwyYWS|iffE|SZtt^5om@S6K+1|vy;plnm+xr zwG+?gB#zrr6>fT2P%$-p`eNZ!+N@Nrx?0|E`p%I&TTw(X5uVi!JJDi^LoUMLwO-96MrR zty9fmLB5Phpe}a^9A&Qv+_aFTH6a;!&7j%AV-^YYfrz^l2&2!9G}hZX={@m+&wXO} zAM0-K5#?!3eV=2m{8gVtH`=lQ&kAsQBI(X4@J9RBkLc@TTIZHY($|t-@wW9Bj(%3h zIboVrxecy4Lc$eTE?0aPy_rctDL9j&`NAG&zlDdKTVQJEleQf1+lJ9v}VAA?2(b)un}g9_i&dCi-ulN=n}OMQNM`h5gK zbZBYry#M`Sq|;B_<%1g#JIf>oGps@ z_;jJqsN+yy7!88j9hyxv6X(4&=XK94)wRyvv)WZ1lcL)%9;ocH_}mWK%}ghFoRB;) zdd#FL3-z82RrqiED1VEF9D4VzXNs_(N?WwH+(+<8G5UV}oeXwp*~Wy2Kd-FW;F8Hy zrPNOfd)UyTCis4-iZyvG->3gYNG9Eca)_+r4EfZY})ivUN5KQLQc>0N(fyxf~cP z$U%qH6|6t~sQLN((La69aCchsVZyr&pHK_g$!Zs|7rY!z>L7v&Yf2Y*a#L3y2v;kL zo;eWHVV+-^k2?8s{xt&b8^(2vVJsx;YD`%cIgJp3AVmcwD1}weDwKr{9~s97*+P35 z{+{=7s~#`<2Hy_f{C6cT(8e$3Irna+pvDfdllr$qRdFkihepS>;oQbESrfrnjnnk( z#(~HiHR6QNZ3q}i<=3|Zt!Q<8ioE^&PkyqvIT1BGX-d;G!9Sid+UUPwE;yE9`VQN5 z0*`nQ!3`moCW;O#zES!E5%ukkd zyx}s!Zc4OOinqiAR)6)QI`_xTzh>gQ^_^Q%`6Quz4LL=pF&}@2DL%6)dI$#LD^(1oDi@dOjyycs9XRVB1A-kE;L?(}EQR?@|TW@DFfU(fxu zaEtF;{^hB4;4;>lIx)}Bp$twtil0)2>TC-OQXFo*I20a-<$K>P$PX+ux1a@WgmD+|e)5_C59+@yz>rL6Bj`#i_7oI;;7M+))#d*d zLk#r@cj{(y`$eyw*#Y(1*3m)HS-)~E) zNjw_}c!7;Dl3~F%E4e$dX=cbGxQq^yRgON`sIW6q?ZQ2n&cayPVu*SWSy2<78?Xm) zUV9zqrx_@V5?7%s4L<+m&OT@^IJodZ2tS z%HroaBa)WWlV#-PL?!XIxu$?+*BxR>`%%<=s8eNOD;^(cHHZM184p2k(udX?(<3Vwmv>N*I#dtZi$^+H=*oEht0Z#eyqg@^+5jyYUNH_ z@q`7FXJDO3A9>mQpiwiOgJVCLT~PsNX?yC*il?20Q^-41e>x@B&qt(YFKKKhWVA#vQ`6pFBES%Mm0akMp^- zk3@w6qBg$C6-#C$7NEZdaqw?&E|5ipmlYF{sOBowGl@40}vHHO3C zchQH^v<_^{$TM>RvcQ_xKLByhwjOqlP|Y0*y4d`d zafDgKOq8oH0Z5=eW0w(JX+djr?1SJgq@Sbys2(6G$byI`UCqzC^z*NS`{f=qU0;n# zgTn3`7rIMFg4%=N1!aBnmNjJqH}AK8=wP8F;V6Kz6Qnzg#9?DoQ8V2pB;amR&zm~U z^IIbhrq78VN;XA6EwSGA=+xZ8n@&$0g}DHpzu&&XUH1e5I>wWKcI;DLtY#l~a-lRh zE6Ve#4j@0iDlT%lrfwjjS(Q^uURTERCtAD~6(@yRHL0oWr{$~lrm*L`j_v*yg*HPD zA|oLY`jMP%1AXnn`uTq|b=J?NN!SP=q@;}dR)yNMI{bGO~u<3tunL>+)JuKM%wwQ<> z|NpfX8Fc$ShqslWMWNy=QD;wDZ%7E3omKdjB0=cX3LtB{B_kwM9Yp<XP$meGZ&K zutG~wC0JQ-M3z7OL?*yN2(lL1Q^9P#sj9}J#%hIsCELQmh?uj#qWi8uRkeObUB#p8 z=pZ@&{n1ZXj5WOt6|p8eVtt$$KZe>Sp4C-i+?G6Ql@4CGKEx(WLb?0k`1EIOcN>ampPGyYQVYkrTpMJ%0mej znNH}?P-FWpZiMM?uKBCyy?+XeoiAJgt-+IXvST?%)T3u`e^z+0h70r@;1bezBgo{c z>D{%W4Tz?Z%BzE+JCu|*o}Ih+D3ga8Pn%hjYm?twB>MO4$f&5`|Ct3l>AYRi=mouy zhg~Io%pH3>fm(}mD#6srNFS+MDyWY#reIy7hT<38lcQOkC<9-9!kqA7;v6raV zAUUqyYoaQkbniuFT(i}v%L>3{`Vt!)X46q=NaRVvsBO@Ii7+uv(e}9-bY_R8pu1q9 zFv(K+DW|p}d5~*vORO*#;jttIW+cp5%d^s63~JBbIg0zv`z!RoATT|2rT?d%Lit_5 z$`Cw=(M!Wi@O}@ZG1fVw(=rz3mg4q4s$kr8XvEh z`_5Phkq``Y6gh?q;B0 z@)z!VOI#uty{@%qa&7M)E|UE%LT@bfGBxXp(b**=kLP_Qz~y>heW;0Y_|wp>Q;%1f z`+^heb|Z95xT#=!E<$R*UuE}a%RAO$upk80KTnOqB4*OzMqSNGrQ6CG>hf&9yUL*) zhiRJh8s?M3RXD1(@VBa^$6|D%GgoK8pS(Z!n$welq@IYvZTB-j%uiKM6bijI@|4J|Nk^Wl911-fGASOHqQYiC^3Q>bdKm#oWJ5^`* zP4S9kREzZ2Ew2aTxl}CUxB)9CsdWEKrKGy+K^PTqd%o4VWVbods*2RPP_EjZo2aA^ zVzCT#OdQ-opI^_3zFMJ-0@Ml@`ptPeR+Qbe@mQV6%UxlisNHqPB4%l2xpokMuZ z$_28rO>VTZpr2~;)j!_=yuz3G{bsD+HEY3e{bb)*fQuU-V!*m`(EH=oCmECb+JAA_ zHMO_nG~BZdOH7{E0ti5%gn7+;L`3PAeEN z32M}*??NT)b(V=+NR)HqN|W);jgg2YwS>Xwa}Jl5mlUbR=xTC~9@`1U|LNe|s~9(^ z293|hPxA1=?qjBha|n=Ed1{+po!#$F)?fA!-P$D%tP-NrYGhAPEk~<5KGZlij0^YI zI)wiF1_ZDBxHLH>=m#3jQur-V`I<|d|^bj zO!yf??O(#k#cwxFhEW{-c~;>`O)i#L-WFhL^A9oonauq2Ghw>JG7TS3x^s~&jJVDHvX@Ax3i_5Pdr?O4L7bADK_sdH{7G!qP1}kff`tbP%e zXIk|a_{Vn#xHm?rUXX8fyYZ~E*wU9h?n?L3u`pu`U;0BU=NBxB_B&_)aS{Vi=% zbqoldhA8qf8EH`z@zH&GO|Ds;9G(mB4LuEr?q04u_6`?!ZeqXC`$9Coo%?<+85MoF z7>_lk6enve+%?^XeToJ>4rftY6pWpCd(-Brn2e8!dM;RxVK~N@ApgvJB?uFIM6)C0 z;PdvUWmnO=md>v~&|!qF@x!QX>SmGXdLk z9{^PX8!?no#LmJz8rR@SW{w|0%rVf=N`JwxRN=~?4gN8fF)swbxU`r=1F=swjlu0^ z6g-u^vdaha690Y89qs+)kF1VN!6LvS3CDP+!)`k(Besin{3p1AFZwXo{j22Bq#>48 z=GwBmp(8Q~F$+rn{gZ5oqVH+U-yT*w(B~cU1Y4{Al9aeD{h{cx_F;Ku#=L!pX8zz) z7EO)hpu3iPLlWKpl zBNY3=y!?KK%GJsYQ1l~~j>iy0+S~y&rR@|#SO3rrI0>iWGU)B#TWguYivgsKez6Vj zW1uD0mp0rkyb9=z>*6ZXElw1{hW`2JB&zICkMTKUevW*)>BIrB52CeAHk8(EIrsY8 zO;lK}xMi(E-EMe7H>iF84&c1m6Smte5BhBkq`Y_!b^!-@?V{kym3e!&O{?ko+c3Ss z`OzI0CQ?P#!C@3@KqH>K!|j)$E5;Br&8u3VP_JKtP`x`+U2-521w16Iz(s+}>|oXW za5K|FqkOA&u^+f17W(_eJBqb=wae}cD&RYz41 z(TwK)^W@vnl+)Y931z|cj!9?Hhl48x3vD50{7wqYlJXY+i9BFGp(z|Br{YTU(4Jpi zzUljUmbH(Caa6eSbLHe)CrY08LkhduKrvao)>CzyQOE(4hSgv6<64z9K^6qg6zp~V zS9I7%$;&nP;zW*Kd$4!|1J1_~Bp@op9~)opOHH2nz?)!Kh(srbc>Vd%x@da8j0@7| zz#-$SMz!SX-;$!8lH;X{V&vr0fYy;1_Z##~(@Ebi85spFM@A?&kzK#Be0)&2)m9?U zt+nuB;YigAL^ue22g(g8VLsMXC++Hj=yAFBg{VtF{`&EY>&*^aAoq8)(S+bf!6z&X zn&_}Op!mg%owQe#+B|er0jfUeHN9cTRa2nOuiv){=~{4q!=}JggWzB}>2n!G4e!K2 z0797x`U@*j&bHIz?wy~MXhgDtbsu*J5c`4!W0Z$;zxiV>SU_$2xi7OxJaCzR4#(F6V2vx~V!WR>XpiL%Oray^Jxj-4FD`iZZP(!f^dQ-z>++)Lh; zmz`K{&DVB44RPO#CGldYMv;V2kALbUT;s$^-`~UG^ZOJri739UZ^r&&xWRa zxAeK67Fg+v^DEL@KfB5P>)9FlrS#m1LqSYJq+ny}eJ|*ccSpp3Q+dX%wJu*WN6bd- z3){?SF|>D0{t&l#kNSKN(Yz64mAD$Oefd}8DXjYZBm`jjcOG@r+9ce{pcuozuMcBy zuQ8+`GO`A+L52DdoSPyTw~RV($5o%^_%!>zS{#d&;D{78$# zPY@DQ!J)8qb&nY?H9p|{#LZL`cSGFalYOLa{Iix>J>#i6DxE+x4uXAmn-<#@o9+RB zZOS-UAGfg69%zV@Vj&TU$VGO10T7A9?MQfLKkxEF@A5n&N`@ROI;;vHd^a#CL|W(^ z4y^xY_BgR+1EzgJ_)hG`-zUB4fv<@eReNnH&~+bnX8-u_{0TYlG4iibjl-=Fu^Fw> z6OWRPcmgYm((b_y)BTX)vs0V_JXdEB|5XZ-PgJ!}ZrkTY9`xJc%U-O4Xas>*+m5Dg z<;nTG3_asR1~>SDof;T@;>-ypG_T9*@)q^B7F1n1$+{;Hyp7i>;=~+le2WPMMgtLU zs}CN~eF7DEgq)ox%V{@F>cc}B8E z2`&1^@8|#?}(aq#QR;W zm#yt;^Mbx6M()JPJ=K@34PF&BwVZi={+r<(jt=v7YOv=i@fE|`>(=k6q~Img`s**E2f6y>q@=(od~tuSCt`fffHV8) ze98?LGg!vO8h4cYao;$wj+8XJ#Tqp=^v z@QWA16q?Om1z=_fc-VQ(Vaubc{LilUK%djCsBg;0NPt@%A-$Z0p(m5d7r>_gJ|!LD z|3{#OI6f}+#4*ck_#Wn7-av5ceB*%C-U$~bSUog7nXJ;FZ`o6!)7kMu&tl+^4VsHd z%Kv(JsEm;&{w}(nXDco%Jz|fLgOk7R3zK8q?MN&7(O0wGtJU9qtAD8gdsuK{r$Yy$ zzm(6{u}u${xjgQQ`Um33sAzESvqQTZ0({d+&e8;jO7|j=sF}ip|P}TpoDi z#q)USMN45pYhr}fCsVw?egP7ADe=1kbcc^jpF1|br`od{*&V))UTv5SG4oI%U;SJU zS9X@}!ZfZoLNB!ynSRRw7sS&kDo$~#4J1*@nexu0v>TeVOD>;x_l{3k8mX9P+GUNQ z)qHnFnm1MEy5P{rELIa|0WS0KL($RobuqMSgbCFp6EcX#9V6Jb+3^orcm#^yY=I;W zC7w~OSJz|J8i}nFl5^oR-iI&E1o@fv(Z{4HE>kFQe zg31`VkAaH;IbjAP^1TfNgGRqRxlnP((Vkobj1-9L3Nu`ZVexTLgW5CD2*OzKEWpdR za0^6M62%+QUw64Y>>E>3P`j}}l++K3aDt6J_dLsHueolu_ux`@%R*vIhZ~1QBBk)_ zi=GKpJHDeRpVAS%*AeqG6BJLMMaX~^SP}AT&`8LOYM2eqlGW;@5NRUU_(C!&@*T#mpOx znSDh7NN;}#ezF(3ji2b|`Gu4%Lxqoz45|#cMo<<#Gb5G#vJwP&I}ybaR*OliIo zwf=;Fe)h?Z4sNvl0X@4K5MM_lo=6y8}GzMTqQ4L1EynIoW}E3WU+(QgQX zhq1cyt%G7%GfwdYemdgIACVX0AOGXkGTG*iT1U*KvXJd~QM1KO&%fnxCQWJS#;}$o zukIZJZ23Sm z*}XQ!JVK;Ioy26j{guSDf>Yp21x&i+WBjtuVD(pok z+Y?|NL3(OG4m^5Z+6>XKTtRhU`6WvKVve1ajrMtjSNV9!Ku}TAE@ZH#P5{*p;jA zM$Tx%PVvtC)bfM1|*AhvHMP{ z-PnX7{^o2$`x*~e5Ym`m{-s;@b-w&WIBmgD(S1jr@*nb_@55+Byisul0bOHy=VQ6Z z>n)j6X6HhktE8LCKfC!HtgE6#9F1^qC|HZbpNDKAiV4#yDkz%I46$yBEo*Y@7+RTFqJ%jr1+E^se%ka zMV`J>M@)Y5t*_>nV|}w1+du^QAgjE_q3!nZl^;%e4eNL&L2Y5?uABwsSs+FeGFY3F z7W44M4Im?i46<{%2X0dTW)aFeUXNz~(Kr0Vg?c&*2|JG8T8&7Io3leB%T zos78YR?m`BlVK0`-IiIM8q_k^9eG@2ixLMGD+82uX^wNOx?;TQGQ3#17%T*_`9n^o zG*5@l_M*c6xB(jBUwt~kRoMLKx*5SU;^W;pdw??)cPsFXcV^#l!Nv~R9I}{wG-`w~ zn0Ml}VR5a$g2q|%+;?D?ChmRW#R*qKucdj~LF`tB zx4RJS8>6X`!WZkow?HyNfgg-Hfr?j03yC>tvEoXXUjUK~oIvAq9}H(2Lg&9~4Go-* z*YP|xJNo@5-&p-l71AdCr&zeSQJCZC_itHB79rB{>1*pdf!pg6_QLjUxFXpPo2+snMEp-Euwuf zN%EthfD_K3qI8Pw6FmUo^J2ewa3$Z=(lUxq&>rCVgTKDTot5;zl=PjH`v`o*WuR97Br|eG(e4M~T%_n0(rCoNI zZ@_jqimd24KwbLAe(QGJ{K(FJQdF8ju(o$ZFb8h2ro^&Ynr~jPk2-s3dpR5^fUF?E z^1XMo4z(6BQ|#H*^-^qoR%iB(Yf6gfxRA!Pnm|MxuK&N{5GSZjyZY&u6p<*j3Ifh; z_Z!m}_to!ufdDsPu9_yUgMDp?bh|oGcO=dDN<>!Mo@v8(>;M%a$^nOiiPQ;uZxl$2 zzFQL0?JDcvwuhB|;z27WvFJrpHyu2?-&bYCu2-!O*L4f=GkA1+QB-$^i31D~Yt#RT zu2}B>gjJnqC)_tgY$z9UFMsULB%Ag;a~kb@F0zl|S8O`0H;_;DdQ1I$5>+a zr$A+Hyt!h_ohQzP2l(~XVlxj;ozIOw;3R)FyNTzjkU3={haYbiI~E?~`x(&w51l1mCwU$+}XpxW)onttt5wq*z#EDc(CU%uN(A~ zL}X4RwQ3}KQP1t2%A_Fojz=7%BP<~#u|?(m`*9PuP;j>R6&*${MqU!j1=VMa* z)2K(m7wO-3CS#`*JWphWpVp1+AJYtuD@{d94`9=y|K6d;S;JAfAXm_o2hmB+=V6DB zn~bYM za}N{VF4fPi#uw=GJot{*?6DuGIpC95B-o+z{%lCXRKyCD&=qtZpJn>)??=*pielrH4iW2( zVNA5$G|~u~d9|@<|E5K4Axf0^rmrICSH_@^FfF8!^0Y?EQnDz1A_xg z^GK&@G<+qoMUsQK(r;ELoo3s@pIK2e@aD}yEr@n6Z~jzpk^o)Y_SKQNyzaByENwtD zR*6xgdRH9Lkg1`FB0ekSgb*ZDPDO2X8wWT_Pcw_I-h_3LoTOj}QPTq4OE~)A1^kZl z$G5?vW}r=#)ub9Dj5%H7pMxBT&RU9nQ~(0Y%mB!@rwq%Z`jyET1DGG=pV4HU%#h>M z;F9bObg&cUScZ*rMU}249)!#+g!diNn55u+q_UJ;8i23-urkD=euD^1JsCXS;_+oO zh7>7Zty{>O_0WP~9=%5X^y-t9{T?{d-eX9FBI3XrbHj8-v<*Wg(fStPCcBUi}z?hhd;2y>#Q7&&uIhmq}aJe zf$mS#zF@I_)}kD=!_KlD9k=8&7b%cB2U(hqC-9Hs^Yjq|camO=Y@O-~$>}kX2RZcT zbkIMAuohgwaKb$qq*o8)jG=4m*Viz9+8H6Ppuom^5;B=RtrCSa3V*1c^hG5K{^sW# zP6Q*OOGrw2#=1BGcF5(M=^&H2ljNxDtGRiZcoyIWE|w@lY1tTkZaPN(!eeQO-BV3~ z7FD$%PNpDT$#U|<8S;C`D{o8_F^C7%MLmw+lbiOj7=pYU4>V22xPKNco6<81-F3A#@3>VUU7@V z<#)k@d!)MDAHUFC5eo&6oyMw|7|zp8b-5bH#yze4!*^#9aH--YCp=2tdnj}*V1U_eOKxN)5D01Q##k%^u=!naD!dt8xu}bxxOQGi zegoBGdg@C9XJWM5SuELYc4URg zOUtZ)#OSbvEl^1zE3cFD{k@jb{fJ<#PeYj?l%PiAltWKG|Hsz4wo<=$#N>%@Op4$O z&4Gu7M8^#`vR|&;g>~q8iL{jdC0cIo$U!F8j|aLT;*Im}QGzk{_fncB_2$sG)P}yV z$3O`=E;jw$k?4V9Zx?0T{%8th7Jcr$?;#UU!;bvMO!&2{Zrf)7N>VCv#L0~&Bsx3v zl%q}k)xdQ-zt~!WmN+S&VtoJ?R^^D4zGoYi`zp_@+doQhpO`1fx(r(aJGptUZ2dNr zm!aJUBuFda?6Sv;?N+(|7dl6ET*}>*0_f>{^(iE2*f3lF$AE_v-B)pXO1~RY5cyMB z>;8a6cesVS=jX*>^2)0Rt3Gx=Y|8bG2082JezSv0%-yqHol`>d?vom-{`Ul$jWZ_B`}(Lw%5M`~T4OjzO9P z?Y8zzPixw?ZQHhOPusR_+cu{4v~AnAJ>5_9^t&TY#NOZjPUMfO9~GGqbyr1JR<3I; zR~MqV#gTk1x^6a39^{1x;OCXV-gVdM#dP21QR}XQ?daru44oEHtzPp_srz=^E+4t5 zpVuR%$JnM)Os3P1$%60eyB{ykUhF8*jgClq3!&P##RhPj-VOC~O^h033sjk^O0^a< za0716)R(3VGEs}_r83HRz1Kd{4esxa5jXrjc(7NoEHSx# zI@xYW`rZq&ryVXo@ia&=IM5>8-XX5FyB4OnxqRcldUOyl=3oC!_!&X~RhZAxD&$CV zQ={o+-mP0WUWED}vR<_1Z`K^{PN3*T1qA$!w;3rCR#BR;LT6778|P*g=0}imEM zunz8iU71TmD3yO8ZN zXZJ`Y+=C`!ndIw^R^rH)Wiz-r+NT6v4fvcbJWGm|-4&p15^o&w7avre>J`<4IJ8cC zHq%YuZ^=ui3Rzw+(?92*dCQ25oRN_H85^j`pXQ1mdZDiD&(vt+dW1v)*QrAFI_Lfz zTH5FeB~Iq}%a#5pxL0GBJHMMbu8}&db`j=GlZC+ zMQs06tW$Ms+T2Kl@eO5ehMT(lXD%qg6j*8azBaYIaR>}I!o4z&vU*U^35bvLQ0M&; z;B{PlM%g_fQ)H?sG_X6E)2qj+mcql5KA7nle6oDL|5Brj%tvAOvJtv3fu+x*{4kI> z8Ps+!kiclBSzaZSt$_wk-&Zi1D}eoA&xIXle}Y=a6@e0o;PklE+& zb+#vlFYcni%8Cl4CL5!_#@ufeBow~3S1G@MdfRDfk}RZCBS~{fr$zbvrHKx^EVmVs z51SELULW_lVYZ&6a7Ho4`J6Mz#v3~NgIEWp>ML4QQwxUsM6Xo;wSOy(^b^rsNi<+J zOlJ5;x9E9|hC0SbfLG8|ZfO2#!^;?UYtg~kNPS~@gog`+6G1LvWV7tm0E^2nG_;kQ zX#lnffhcs4I=wnA(1ihn?$d@L?r?pgt!x%*%G9M4;g2Z-DG*Kn7|OZcYm*u9rA7OJ zRJS2+*c9j0D0|6h6nB(KuQRwAp$f?Jc(7vQqiC>e`*+}bEm*eIAwOglX$ZR;h5ObJ z2uktK!@T07<8e=E{`B0B4KSE~2@WBT-c zk^_6+GKe(1Nxp{K2wn`Bf&Edcn@yBl$K!-2XE5YQAvwyx07qO0v<4x2#nV#PnWrU8 zJzXF|h~#-2<-W=^OLeJ`BN=f7<4uxR)ZG#zRDV|xIvmrbkU~Mwlfnoo7eiA+#1HfR z8y4E6Idqsd@*0{qa>p6Z7)OB5L;E977wY<|a#nGU`vT$e$+W@2Dkl8(W60w=^{1Rt zROE4;qK?y^vnDhW8)OVsfiA*;#O1gt2>#06mk?&=Nb~S#7=*vm-pq+_}qU@Be>?v z9X|9PZV^jv<}d<4qju+ZKYVC60~MfrXIIiS2S}<6W&rkxJH*$Skee0fGA|Hvo5HwW78tBviiR0LNNm6KdwQFEy5GKeWRyi< z-)=O14E2BaMP~!L_-S}+)`Ge7Gr%+Wi|xR%skI=hv>{E*J6jrCyv>aXgbuWpt8b0f z{=X($f$s_Te>VdP$ZVF-0|mO|i~l?W|Nl(~7IHN3Vd*ych;jV?aY;5S$O%bhix6U{ ze?7})`@N!wPYXy#T#JEt2u|T^b>8?N&w|Xk@iN|9h{;P|Y+TlmZ(?R^1usGekpoRESR%U~9_?%EUD-!JsOgKi_CcMrYE&x~iWN8~{u-KXvDHi6jLQPh72WO~=f zMIej0nBz=;|+HH&_p%H>$peB*JFjSI1Y;y|N!Y z!1wn@3OvbZefKpffiSN2p!RLGq?O7Ddx$jh0*}`G{FX+05ZcRun)xT?L{$AEHb&T= z0lm+hfDU$A)7B3K%H#R*ied8&v>4aS>Wl6{p+bQ2pur;q^F2^lUHF5=o%^94eR&!5-rv7y+TEE7Un31UEPK^i;r`@S z{Kbli5fc+R6E+)@yF7;%)6_r^azZz>&8G)(J~7wq+%>a^cSjL0mE9)X*v;6(~M?QAsvb&Cd`IH`IbrO%8NJK`D~T^M;!)-SQ?4h(jh^ z`-u0wWJveiITb!)`t3fs6lXU^S04|U7|&l^^3RiUYp=jp!OM5cmk<#G5~kp@B9Q#O zb|2P^(9p6YLONo2WTPC6XGS|ubxJ;MeSbA8`okZ)CsF^V-8$5#UtK+%!cX2f^F-ge z2{&a~H&G#q)_?nleh!9P+4X2FSR7$PQp&`N2#f3cIH z?|u;fp+F0Ku&6~3gU$@LVx+1@W3^f0@Gjm`)~*SX!VWIaXNk`9!dBW>Nyl;q-NL^T zO`_rOvd3EHreY^zW;|-~s;4N&-7)k>kE?~hE9{MX~bz?PRySoZ3#t`wX zL>CC9z4Hxv%#*RVxvBGj@Ybh8)gRy87*3(`FGF((=+h=sDuyc_8$S#FiiFqg^_pn? z52yiPLL~TA{w+kJzL65khFfhoV2EdEDyVGMDwfUq@idLDsHhZ~vrV2;v4F^GLAdQn z0C%yh`b(@*o*b@5w{7_h5dn=u7F&If{RZtogEt>~bTH@ZfyP#MJ;Ev$w_jdw%jFfE z?zB#&c!RqBu7te)E^zyK9*|*g4B#t4%~Aqu58x$qm8A`@}O9KW+H3qo0SUN7HYKi}$8ChW|u6UKfJ= zQc^?#C3KubdEa|AeNX*FKPonMkUFN29MyG4p2y4m)xO%$lz;f(!U1sj#aDixeGGUv zw41sU&mNtaR%SnK-EBta7c{g$KJR2l6(2Br-#LQk_PEnI>B3FZfTeZT)ggT9Szt%s zBPKIED&iddx}v%?K7nuL91-;!eN1S0>1#z!`07x7X<7^}#iPexbk_&y5Q+k8kDihkuoFZR{hk>=)-vSd#)<_)?rxxBK+bH8D0q+a1Wl01 zQ$mwACWL^&(}*6L@egP6iY+?VF9cF%{QIFceJNJ`SGNBJnpC>YTR3REB z|2(~^Ib+5?ZiN{oMZR}w9m;8IT5k=jPd0YrR@3YE{@dmbx9kdc$xRh;~*Ve-Q}*Mpc?^brM{;+J%u+z z61?hP8W;JP&fRQ1d@TRZVBnQF@v8~I#^Oe(G%Pp3>z?y<-B+C8ke-A{;43t7yi*AH z`;*>hdH)f4T8t%A;r1l0#KRg@N?(`deIDKLNZv`|VTQk;sU8LU0_Ty>ca1(iB_#x# zx%k+>Wy{>I`hJ$J#}&9A`G#(YBIR8s_;M6!L<7WGf}rQc??tvpWx2gZyL7iJ%K|T4 z5KnBmA+qU#Jpy5rKZqyH!8~nvV{K@G%67lrd;B8}Ge_wCMP_iOWD?&7XW|RoR-U{- zHs5g1wi*uj36T1cJMpFS;3&ghNDR`z?+Eq$JO4f@&X8etGub(Js!gLAh>WvZzuh&R zH>=LlJF67js@6$mc*Jp{D9sW6f-%NeP*!|(%gLX3diJI~u!nsKzw`NKZecgHA)O=Q zm)J%uM?d(0bYYcmZ`hgvW+<(Z(u}psb%Xq1@7e31WRSoDuhYH9=G4IgAB=CAg(8h+)8Ir+&A(<;JTdQ zFxqCIY9e>!#JDH!@sU8LYkZE6e}KKHwG~Gn*S2@Dn&7mbIKEP$0827mx@Uhd9`D8O zX?@$si*?sHX2BOUmP0D4+6Lmo;w)Yk3LrGJ+hjv$laAC15Ww46VU$ zJCKUxdq>OeQ0sU3Z0Pd6koA9hnLCrv?*!pL+CQ%@Ve=6PElBWWy^Qq{ZGR7ZIgiE@af9g8@!{i{SJH@m-k=0 z2Spr@hpi{qqZ&nwh{59I+UTf6uLjOYS{AgT)>eR6(a19sNiPK7Vr_d==%?f7V^27X zaFvoh;w|KK1M=}ePX{XO(nW(Wzn=tV6d)Z&hj~Y!)C+wJ+^Du#Ovf{-cH038XR$dv;|jCRPzMJVHT;nq*RX zY#$P6s( z3N2(Kl{jLc)&3(X1NOgyw&_sED7C_xP0j_wf0Wi;|gqxP-)F2PQ+nlf6ALa9OC4 zK35IzRPc2Dc(F2jgme|@p`yD{l*|k!lO4=k@r7Nqa|WB-Qm#Z@yb##1f)ElL5f)s! zS$-Y@z)?%I1}@ButkW^~LP4s(A_p&NQm4fhnZdK9`HSYjB$`}wovCS>Q8oNl3vy&J zCw48*Oegb}N#{}lIweoU2l3&En9}w^im=cjnY>vP3bXKb;HbtCeX1C42E0%(HT9N- z`K4cW$Ked+mSc}k&%y^MVd01w7>KJAyQCkd#T)gJrA=er;LJ#Gh?^7LwQi5BhL05H zL4~|cvW=Wzm}rJXIf>sfEv~Hl(YUK4qQaZ}oIGd^$YqA}EmRRd>%-f;LW%4X?M)O? zZsQeRg5$)3$q2Vk5-=UH&e&p%e02LbSd_^T~=GY*OK?#e8ztk}lbg|D)PcGUzX^^|(R5#=~m%-RLW(Tehr5jnJ~h(tys zLgLd=2TwbozCkrc^DHD>A~L>8na=!y;SEJq-0G-Z~ zP!Az$G@RUq(Rx9<*o?9Jt&K}~-%$v!vJ4wV z3@1lmz7#hEHVNj*nO)}1F^@Q{-G~6yFYY+ue}jn2iRAO5AwSIDD(aF}o5#@?aaZO^SR+-J6}=m#B)xD`#B3kOV%nMGp;XxUkK)E{!|0vN z(S#0?7`>#J0zVEAQICU;5nQ8r;&kZHK|=xEIiWM*g)*8xw+!p0GNShBaESj=y$UL3 zVDMWpF&QUAQfLLWZaZ7Fj;e6O<%K>u_lqAF-c+%kuHWIQJ)p=iUX1{(1YvC3e9`{u z?L@Te(Z2U5F}QBqjN15N_UN=C15p;2I@g+x9&WcBG)=m#U)aISpl^7RWyhBKW;e$q zV&{pwUEp(dJ}OAWbM1NAySJC6aBOb-vKKXi@5+^ZbY4;_5tDL*%N3|mN+9edg3t>6f*SA(=KvjSM-{2-xcmtV5Fx8swL<=VX^D4eGIWouryS) z++8qu-`Jv`XvK5}#NHjB(Vn!v%3L`;Y!=|8Xp8~$h{CQ9U7B);~v>5@VgOPGdir$?Z@(Lqg zP`E~FDR8hz9A-pPKka~^u&jn6!r&&LbZo zY1+cY^0gI~e@|eST$_Qsw9$^%;{%nP$no?23y;K4<~PknAERZ7KXltC@GabA`^yKD zq{E=*1y%uPJTW}}x#!02UaXkx+h2oavfn=KkcV{L*loD<2Lp9*`*|Bw#fEZkbNY<@ zWXO$X7k6YSOmw(WN=3rE;${Iv72?JC|m?bb9+$Qy71#Md7_u>IOJwVc0RC+ zi%Z)rv|qB?BEP~b!dcLS)SIw-JbY+xdQjN6b7Mpo$c>c-H&8S#F(P+iO0fEf%M2^S z6LI&TLx$l62Wn=7Y9mJMtb#jF#jBMs(_l8;j&NAnIvidS(cv9!N8l5$gE0vEgj#*>3dzYF z0uXb9?{z_0YXY&jluC(YWQS?9FHpS@SoX0%|J{UqjCxw&Bk)S(xS$VDP4q=>kQr^Y z5IJXf{FRHbei_un__O2ReqO0O?`k%e2ID@w(9Zia9oLN+1g7Kkz#Fn^1uCY%4e=r$ zjkuIX#8QfA*b(pjrpL7~0!m5Oo~2aO-lvNVyC&5Z=Q|c76Jk9aCAfs#i0Y)zZd-q1 zAy%fGsnl@XsWBeA3oSscNF;3AEpbQR2GZVEGt2&VfNZ39;8d8K1ac8lCQ^74fEZ5W z0}YlvBTF`OZqwRYRIBjLiG_?pljaou0~0OhUDh_c};dl z2b%lzv%La`j9X3psa-p^N32Kl%?G;e&0i#2ncUrIF$~b z7tZ13qy-CpIzAy-BLs0c*Y_G$Fg*G$gv*0UN%?@`D-$F46oQCBA;v%7$;+y(`5~&e zex)_(7V|R(eDVFlxap5h7=Ym3r~r=d;QinGVolY}>jyKS)&uq&9=HE_CZH~i;qB$# zfS8ZkL2ghNXg=BrJ~C=DRHmq|#s@1XNQsf88a5?wEn1a3qC(@tgSh%{Pi)eg2GMX` zW>Up^2#wBsz!b#zz&+A*2xrLC`uK@Fm$qeK)(6MV*ZoJ7-L#-m1>#sF+gO^BkSh(* ztChX`2ivNSxO<_KkUMTx*qxvk#!?$<$LjSOdVyf}0fXe4x<75+wIjQ#!zD-io7?_B zGcu#UuF!Cftn8~4eC)LYWgD{QOB#FF>JtOq^7R!Oai+RRw(3-f$XOsYE$LS&MHo#(C%+D`^@>KfvoKzK*;G3!7oJRD5Sf(73 zHHr`>J$MMIQN;PZAw)Y{rt!e}pPEOpzcaM!t_6n(;f)}AHe=TBJ=txnB&t$sx0|iM zWogzU5H~j|lZ_}#vJ6e+3k;h(s>Tv^A8O20%RI54Xd4Qz19Eo{1$j_dlh;bQ{GZrwj_yy$?sj!Q6Qxs!W5+|mAERN5_Z8A1s5S$F zVV+7>J3fEEH>O{tXx!4Esj#sY_&LISP`H?@zc~6h&bBzrW-4lG1lndjXBvu)t!U+e z!+tB9Hf&EfsOnv*S9%7?G*CJWS(f&u9Czuon8+8n#LeRXcei%!gPj@j;l%~xnJ%N?Bkl4z85Qi`7iQ9Sf>1NHp89c_!XNie2~)vNWxP&p<)JChD9n24}ZH0b_cCAZB!}f>cj3B7v0I? z*_NxA4Mb=E7-<6*hM@h(R7oc{IS4UBdnhkQtRX#m*;lXf56dgb_}A7JvpG&0-7EPL z{qL3Py$T7C6w0-S*ibJ5d30n@0t~@U@^p|PhWqe>zlY~u$~k%4mYkcNKcSaQ3)RV0 zncN@C5*91TRXvD{&!=lj(;OtEPCo2JX?RGG(;o}#;SUizdY3!T`z?!#ZJcpiAD})zy-HFb|KJ;nbuW4_aH4)z1%Ezr@3l7^_`(a zya>6wGwN)D8~bju`S<_}{38#7ibqA7{2DjZ-`%=M0F9Au%sQS< z>_}hiSNC=5b@SCGWZx;u(LAIm4kl1lhc!rtygP%Hag@88k;YUe-3RhdGd7amZm8BehP-AlK!% zhB5_}1yZz*`ckBkw@yO!~TGfNs;&O9XfAy<%DF-NY!-MYGM z!-V$PKjevcuUVR|y7yu1$|Xb`X->E>=V$Gs{f=pM#9zX;W0y;y@=u708I(iH=msZLSjt?lMeo=ZcxqSs zIJOx;uD-eV_w0GRpDi$b+Y%F-ocZnk+q6OiY|%IqDU4xn&qIV|gU5ODbo~C@ii=1ysaNotj$a zDwUojmo_$F;V!9J>+TTd@Kcg3($s5SSY%pZ8#q#@*B>W-&1}2<&`{O2@^iDz;_hNM zEf+R3FrQaUpwcJ`6f+*-QA9?LNa^g%CsX`NH}@7RqQ{aQL}H|ZD$jRT;DTB3%H!_Z zGMNb;$-j`B*Zs-TgC*x*q{o z<^fR^bbfed7`0K0fg#Md_|2=q9E}t73})TbPE=NsF`8Ts5X8X&DP$j}X0kBYF^|bS ze)j=cfHcA^*?732xC z#@X76&9nx`b{xn?}{>jm=W@{rdHZ~cD)lD z1M^Y=6|(498dp_TwnM>Ivp89;rfsHJmq)((OJn{3W+QH}c!~&Vq>!OaXG36v-q$Zn z;-w5Nz80DKOIuNG16*JJC!%vD-deV{DV!X&OPZZ~yA0w5k0x>vTYkgvirT<>>VUEV zDwJiZ;jRHGoCR^d>EZclB#+5#Pn&9d4MK0R&7AMr-PYsEgWoaUdMyG}uJGHRx5t~p znI`EtwCPu|*Gw$jVG1RB!}$RX7nlw9Oj14p5ls>Oi3HV^K&-Qej8}36~E1 z>Fd(!-RRi5ik5|;1i^9v>?G1L5?`xroW=#LlGnAe=0atIxw~7&bNL zOq8<#FJp4P`@^m^O$rB~TDYgApOXHjjmDhqfhiI&{abP=2NBRG97d?5`kVQeBx+)f z*3e_(#G0@_c4Z42_`!axM?wnrPMD*^Q730Q$3Ey{3;3fc(DfhJ7CP;3p~haZK{>$+hhc;3GbkVek@j}~rrc#8G zeOmTslZmv+YpZ=}nPp?)lQ)m-x#{V>{0TltWor-R;MXP#sxU;Uf!wu2GESv%S4B=) zFNp~^`XUdUT1E5hY_uFr`A}?E_%#k`2qiDj|JQ&pV!4vQRKAYTPW{S?0wS!asul6N zYxM{@jGoFo4cekE3Rlb0ZCnPZr^@;%1<7adMmAXX3_8$X%@^62 zBeO0ACM4Op$n${!tr#cN3oq2RJM5ne1j4k1<$t{*ce*U9OFFdTnwyCnKh!m$UXu+} z4Yi-QrF%W60E(+I41cmE&&O4%YJIJT^UE{aKxL*UDT3QOj4Mz6coh{7L1stgcN0be zK?G}95)Brf*fJ?vi$?2v*99EsfU5sis*H4jxXY2)-;h!NM!#}G zpgjKyg6JR%<&1n4J-8+d_Ac3nEWAYk?rUWypv;VZRR$Qlx__7~+zQFRBCS$ifVU(- zJ&}23PU{tl*(`-N-JW5?aP^DD#YA0IrL*?qrr!d{y8!xZ=?muZBi{QpCb4UTgJVqF z1TCAGYoz#4VIl%)O`BHKi$a@Xe!&p91oy4}ZC^fI>^l3FDo5Yn>`c4=z~yoW?@^$@ zpwv$bK6@BuN}1%hH!y=+zNs^dlEac9hhAsTT9vLZ-sRU$wUZUmyG4tjHGUB1qelOADHf24@^LNHnP84`uuJVy0Miat&+6 zV>7lOA}coxuJH2pD4m7vcR`CKjwuOkgN;?=?^Y6UtrD+j6pIu_>|`vw&fta0Fh=U> z9->zoqCRZ{)v!J+E~F^*IA@pviwNM&jfK`Weq_9ZYDqcUssYW6_|n}~G&4z|<-#~i zIM+z8B1UyhUxFC3W$Ud{#^Zt+#)u>vl_VSRURm% zARY#doB~jKts9KZi|k9xi{Kw{N$MC3O^>B=lvL4mx_9QJ$ zz7&-eLkn`cZAu{<23d&@ckl_P4pK5lI*nV5tsEC>&w~=3-7D+9Kc-CQ1RiQ*2fz?G zaz4ZtAD$GJ7V0qlkR?JHY}-r0hU7VEh< zb%>VDifB^~H8f~K%HrRe4j-zmDFC02xq{h7i)lzIHGC~W{;=fG=NFru%>LZ_J(*rc zZ))NbHcw-O3W=4z^b3olDv}Ue&1Wsk#D)EvQh)9U4oSGdliTz}6Qk_4Cy6G;mNz|8>+-(q6pmz z1)hP)1f>SlafANlp7=<}D&o@tbGrUsyys&kSU{U&Hv01f_w`+FE*iuuCUFMtSs%}q z1UDchq7iv+LUjThmEzzdU(p9+U8L3lIx3gmnDmS`yOF5WIDYW_Hy7RRwcNHg0lYW3 z-ah4EvW5oEoXw#>GD zyxxzvo`9E`<^5BKTr}JUCW95S$@epuXes?*mn60O!8U{pFRJ>p5O13HB@4MLutPwW ze*a6BHDJVJ7FFY(mCd^qpWc>#ue-8<1Yi5>9)hF}NU6r#2vYDPJ)u(UkW9Dxm~j1$UU+uwJE0(zJ~A{Nwa|8Z)bJ7MFx{s8u$Ln_&oG^ zAE}ONV@gHEzCr0fNhB-&E@_TDw)mdJMe1czz{Qi-BSdvfX2r}dcq{$w=@`hcdrRx; zk>!)T!_9X1gPTsgi)$Ck=1WJj&rd#zyhGt2yk%VM28*#72H_DF>8UmMqIhzDy@eG^ z7NfTbE5wK18Vpu5!sRJu52~k9o3FOhwsV@U1G!H0TE+k=tOb#|;(N8tcvoVy9l4`b zR(R~Q8!6A zPDd0zy{jL6PXZ#xZxABd{mB&iz4a!8%-F;@2*+R9e=XNCPwGcELsO#L2=0^dD{KXR zFXX{ya$-hs?(9<>NL=1)X}_=^Bt2w1AhYOLn+IM34q|$Y!D2VBtSfOJ5xTkJqa12Q?i4cN$@BWokYj$6qV$;HDOQPNLPU z$Vwx-;}E!3vbqwWEY3N<;V?qk*U-IMsB_2m^ql+qqIxzR!O&y?$nafm@MjBEkJKKQ zr)f>T+FbZH>f6C)+uBq$IjG>g>(D#B^7>zy7C&bWm2dmSd^gGn;{b zXC(e4N@t}24>Bj5?7c5MtLfpzd`gM=8*+dVF+<$-F2ba-;>>{f#So}u25+A~h(4_R z;8I#s(cluyY0F05Uw7K(hoZJ%$~rScuLaqTnc7~-%dXTJ2yOhkvQH5fMK3}vloY4Xo_S?>z1DkoFuSh10D2+?{_L{OhghhU2vI`RraZES4 zLnCHbCMh5l64$HKm1p^~lTwBVl4Y2EEg^`=JAaw9h#lA{tn$~NDL*kiK~i90%~i4L zPx!w?EG)n*b$nZEJ*WGuI+mh4Z$3k&j%kdxN0ac=?5@#Xk4*(~YD7E;7rY(9uhcSW zPi%+C@l&~dsLxt$Ylc5z#9ZMJu78r1a-pMbxKQvnKzA%(6u2Se8=D}>y^)r*4N*5I z^s+wJhxTo~+oN)NPe3b@W8J6{#;`DlEOo=agde|S9n+$BCBDx-rx8+23^&=-c5_j+ zXu_29wIFgsxAoDo#dAHXnnS{Q*1#_m^c@&nmG_p_P2yTE5qmwen?L7KhYD$xsS}m; zN#uEl84(;;7w|!Mu-gep2E#dQI~7!b(yF4yvc1@8V>(IQH1F5U;&|iYv*oB++fgW=L92NwN zqTea!Wbhl$XFUj>{n6lQ=-_$KpnFj zucM)Ix=ZoF`M!}-F%>186w>pz8CsfJ!@Sb_zMXk06a&YKy${vg**4DM?D}i_(NJ36 zYy-Kt>3T*X0f-2U^5bxRL07C;vw6(P+B;9psFSNa-(vvxP&+7tyricdqeofm9iId^u8V5cZ%XoYhUxw)FU zvDqcUc3Zql?t%wDyYum_+fJeOE>KLM03(!gg_(c9pHkxe(UhlkD23}H z5U+)YSS zJJQ4`Cc|zEw&24w@3OKo{$1h!-m+nSa{HKKS3;*xUp^%1Qhm`8+nXXF0P!<2=~L_a z;YQ0uLIqhFQY)yb8+svu{0*UU0t3X3YW(0rhHyKQ8F2TSeR})8nh+c=E~*0_S(xl`5pa zQ}nsx&=&STl<-g>L}>5_7Kc}#NSX5zD#P<9Yq}WFK@BW_8!Z*gOlnQ`a_RpIC&44M zSA64mh9m?M{ok7We~tlBSU=SROQNtqJ#PQ|82|HJmym#ZT9=U6kN*E*P)+_FYYS~^OePv= z=J3^tQapT?uL3UMcIfi{zGUZ6os#5=4S&*05&K;^=hwol|Nv?imw{%?E}3i#Efc$ngM5Ym*blWLpZhbn6v`Y`t6D zdCs%iw`cZ7X&JLPBr#ggqP1_)G%zLlljg5y&u8`wepg0I;^P$a+TlE5S0Hn zQLxtf&AZMarZ2bumVe*R8?|H%^om9o{jFe;KW|R(Z>yw#N~L293K>|M4(-U9hX`PJ z(axioK6x;{yy%YFI?QPOz*1MM8Or0I5Ogi+EZSVb(64@y)w#2Zme@TO0ZO~?e-Jfg z%;b*Ny_}<}*eM#FTnJ+Peb?kkH@JReT%`d=>G}f2`)UOtlq6<+uMDdv6GL;&33LhY zt5ARu6Im4DdAVf5SlJ5e!LRId^N`c3&n&lB+^b(p__`i=IpZSWxa%)K7gnWX`n)j% z9N>Z}rSb(f1?&NI-3)nddv7%+Jx*mMhkYJ===iv238gPX7-wz83KU3)4BfG6b$#&B z266jN=G=m5wsbrS$`n8|C zqj9Ie7vFR#{dhP*a?P3|XCU!Jqp@eoKcVV)zJAA=suwnOn7Q7Y9#X$z1Q0gb_6~-$ z?#BL}j+A9(NVe`b&a`R8bZ6RL3NdSZ zcGNxr4X9@*Pc&kbNDI<^%T&-=3`}i_eKcTh4ur7k4H2Q|A#HHf*~H&nb=NYw;<$FY zmw7EzWWsNz1LdlL!ZOtJV?@z$!!jwwf+y(ISz} zf!W%dQOryW>DuP>Pb4SyTx6-%OpONdK?bSXKxE>IccFU8(~*M>_yJ0>q+qqkfbaXu z&QD$DnUQL?9fbyPqD9js7S}+|blYz>B46{$?3l)(OFI^P>=R231luiFD#QS zv!EIJ_@bAPilMjBYOGSb%88VJW*jX}->g4hC6i>HXDKxj(U?NvU@$U1#5Xskd8*v{ z_A>2^2pIt@#lQF)p{r-gYibw^pzQg3L6rYHwl`gY+44Vjw`fY=dFoH5tL`}_@<>vK$6z1V%{v=SvVr%)T8YDP8 zAi|5J@23#N!?j}dQZynF(0PVI&&-Fd?U4IeS0U7H=^HU+XVi!1+TIjGIG_`$QKtVrpac>`5DJ=;1-m{Nk$;$7O`cv#VqntLiRso3C_k$o;^#| zQbyDr&AlO!h?*h)MvJV!C}7Z5ugth9^@Rl9V&eKUH4%W?j6;t3J*vD~n&{7jh9h|s zFlhwc3d~8PIni2LVdd9ZxZcoJ2^;4_$0QG{4*RjP9618DwXvj1JXWdmJXHyj_ad^j z$ylt24T^r3xa%3&HbX!V6Y#(kfuU&NMgtg?mbQvac7%^{`;D;Erh0 zg_C$-K_If?!NkEL*_PVTgEw@-3nL(+RNem-+r`%IzKZiWzia%t#_8wu9L!T&yOz>e zZ~1?{0Fdw5xuS>hMM$55XjQJB-zVbuAL8y?Sc_+PR4JmZ&J4Egk*Enpm0^ z7N_4vl)ZK;Hg}oJr)kqn)RI_Qad^b5O4{;rXZ)R{tCSk>KY4_2QAT(c?Hk4aSf|vY zUUK-0wX#Ji?$Zm|-WhD__9H2i`h9VX2!qkUniuu-u-9Hky`9Vc2qEz(iU&h`mB;q* zJS$a?l|@7s_jDPvh4*nerPeYu(XVo(Ch>HEsj|W}v#b`8_9-FZ2GfuD4K1Q1gyZfX zOK^bzgHbBfUNXlhMR;&danK2p?VNul=icC6N<=3l^aDsB9YeHzg}ps}VpL5nsK@Fv z*s)pT#Nv1SMJo5RFC1SI6U9V4zYQ#fm96P{R7n>ig$qhpEO4?uOcXN5zz<7@B;%tp(C{u=f?;_|hM=sZ|x(2MlOPPyadji zYI`}bJ&`EBsU+r9?tsW%e6DxO96rKhS%v(>jt+DvlLs8pq5HyUrOwD^)0E|4^Sr2^ zjvIv1Sd4%S02z5N%;9{BfO0Vp=ZMxo`=x}1Rm^|Ds9|m2PaBx>7e%)6+%XI1UJqDg#2KZ;6mob{R{T7D!odQi zN12`Q=HhGj7Cmo2=KwqmJ{}=?k1^e84d*OVUp<(LwDVJ z#!%5RjNt0NB;D)EdlK$p)6TN8f3NkrPkQ6Zd^Sd4FkI99(rv-vvBxjqDr0GNVoO&s znNpg;Sq4dMhxtcG-U}+ibCoRL^9hN9UFECqOnJa|U2&3k!wfrE!H zqOU^x(R1DJlSHYan}+WT{k86m@byY3Zz=r}4x7`0qKvi~j4jUfie)e=th{FUz8B%< zko}2c+91vR>G*D;1=}6|oegdeS*l3Me>c5js8x?Z_{%84vT9J>3U3&KTuWhjCfnef z#!m^~OLu$oGo*2lRYu#b`VI<9+B64+ksEQTQkUYpv-4ho8T(MZJeKdmg{QF*+z?qlk~NK3gJ%S2X+#8 zPW5M(ujGtdp1{lzQJ5I-n1|}79r*e`+wsMx`=ogw>JJ|^7pa%bm&WzF{VqgBMdRKn zVbZu-_q~c^M~~nS>vL)P>re!0I0@`!zU`W#YWnY#QD%o!DjNePY?)PcF!|NbUy`{x#X#YIj#eez=mk0oud zLh`1+qkZ8OG(k?pFlt^(Z8P@$@9*gwegYrmIp(}lqeIldF}Uo`Ut{@bP{9-XN3F0~ zv+&-%f5aA^KIy4Ei)WzL4aN9*S7OdJF8(IyO$8MdC#B7Z-LKt=O$V#6Engwc0}0oW z(U=(Lc!C1g{1bV2^@UGxoI6!EF33dCx72GN!9(gd@QHmHR8d1t4_BT>3Y^3^l)*X# zag&MPkPiew7h*vO7qMjaTr@fqp|@35@63Gu<9NMPII8GQHjYHZD{!rm(3Pw1G3Df%2llw?TPj%KH{ z+~hMgmr2+DJ=20Fvz^y+B-$WMyykw48#@L|hB$VNRW18baQv7Lt|z6x-d>;$g<{4^ z{F<_$E^06e!iTx()x?b+`?6(74{XHlKdmJWC$PSV_^Wjozw}RE|IPEQbeRI7QYIOqUPcdWvtM8#wAArnD@5OCB=v07eFhas7Vd)$*@-~*EqTI73 zso+Mz@RT5oA5@8VAEs&c<*PArWF)TYn@-EM_#j}0)mniQxwU8=M+>gdFeEa7VKE$j z#Y3Xn5W4YUJipaWYboC7ns;35{;+uu)_;76YZ52VpfVm&db}H+;feht_>eM8%+o6& z_=`rXmrVrbWa0Xdi zUw97t+K0ow7^>rx-9GHUzt(CgX~v5EOsccta=FJ zhX!L>?yI=(H@HXpA)fi|4jeD8=Rz+Sb02&S*IrkTY57O+tGB=JHBF^ldpj-}REP1$ z{)`nbZFApm=Ypx73m@rJ(^LX8Hv#rnT!*yu!N_YRcdV|Ju1%SohC%d&iQfMuKFD{R z+yo{JKY7;aEZ2F`{`ZKeflkw|J)|gmcVshOgV;o;Tkz;EQ4*V z!LJ@D#hSNv;HcL#>`^ax(i1ZKPWAC;H-*ei~ z7(N2SmpzEbmdwWHs+}k+^7u+#!oX_|ALp0p<6Iz_Op7SQcAJ^zpuQ?d+!d=a+?I!# zMO*O1%^#w0@J(2}WEiekd^>L4@fbcRO2P2O?CYYg`>HP}MCt$g0!0*HzP0xVwUb`t z@|C*Wlu7p%hIXeCDMxEU+|V5dnh5IJZZ`Qv}%=HK3o z#y@_74Eo^}@)=COcQxk6m14M)zbO<$Fmc&ZOka2j(hsf0t6S<&*+^wLJWldK6}WB` zxNh^{IwWKS);y@koi8~yS_DE0Dp(1N)?iiRKI9$$A2Rm?DBZ7T}axugcn;@#r zx4rb5q^L985nDWrx9)iv2df&8Cl*INEK>CCD_3F4u?O+uTW!**kR&%A`WvqM$@LhO zf0*>TiHl%I(S`<*XIzaQA1=nB*lLaP8r+ zdUx5lD-e>k9=aWWcGIhwRt(#J`!p)-dc#{Vug}AZ{SKU` z-u?{64x5d;pJ_&s(`OKIUCTJZTWn5ui<0$g@wZPESQizKxj*|qEUA1RTYm8JaTYR8 z>|8mE;Kd`N+Of3t75vxT+t5k@+#N5Do^daRg*9P#$#%SO--pPJnvayRsd(`Al~}&( zF=-?F+=dJ>aKk4X??3S(>^z~fM-1ZGW6w(D_>tWBn@PFwDgKh%it>67-P`RYIQ(Tf zj(;7%jrKFcYkStqi{UC-@o8q`>P5*2IPy7)vnh*-`KcW6CrufNL20UPc!mehaktEe zp)eEQJa#jlBY%lo@=J_OiNLK_&&IoXJE%BY(A&5OC+BYtzAxm)6|rR);Vn0=T88Nh zrn==ub(4o4J-t4Q?`S=VIa4q$upWgCv|4ex|0`0iL+a?ESpCpE4AH4zh}WQ+{0)U? zv2Suyr-eYT`P+yYwCpWL#Ao;59~0livdd;6n%2GkGVWZ`fa;njxfl!2fiXWHYd+i# zJAA6P*AAu;Evw3n`ths8jh)oA8?Qi&7*3bycbIP5UCR4Y0}w*v{u&7`&}pD z?z`>vY%d@G{`v%_rH#RWyjCPBnj~L}31bqGq^d&Z{#_7es)Cg$Xg;gtDW-a4DpCXX zpoR4wXT83~dgN!_yQnos<;IMjKEN%73+O`(&ZY@Qj-i#I#H)Xy% zjJy>yVTq1FVj^*^m?+_D%ggn_)mU1E9b10Dl6%Htbl4FJ$%amzVb@&>3k}7jv14I7 z@DFS`UVzLZ(spNNr->7gI4B6I5&8J;-`S|EX+sM)RusH8`=hPMeJ%~UL4}x*NMTK7 zOq4c#2{QKo8UM+sMQM|bQ6n3nsH}x@R3Z|2;!;I}$||R?q>+nK3r`<~`C=>Su+>jl zcGT$jSJ89`KkV6yEt~fttGO9Q;$L5%h&ok_cYRe3)L_zpFHlNrS2o+H zMQk!?wPP`9vJuDL*n|9xV$K5xsJp+}hq%i_keD_OGZZ_dc`P+gH<++qQW8>7dV@5x0sN#;U%5`XCbGYb=$1S zDXW2LNH~Jbu}J15C?_A$@BI)hJe@5uHKU#uufiC@SW}CgtoPQ-d74b$NuDc{XOJES zguv2NPUY6cGjfq%T7saQ5x62UN^&c)*pd;f9p}b1kM0339wcyW7#@b1S5Ckb)gBz6 zxuC>fiG!kPKR$hT1CAUoJS|+U1_w@m*vID)HJaANW3lRO7W_~($+|x@jO01R*sT- zJ~Ooj*`?L6r&6g84=3MOkncN6ZRRdCXMBQ>vzk#uG7QjjGgsdL^|)jVpot}zIig85 z5fjpFDE{IgijN(4^X&t>4#6~TpbxH|^F*%>^~Kx9ACQ-si>wN&C4P7#9xS%qj1Fk@*N>6PP`=8K<hy3zf?~!qlCR%H}w*!q0joi5A=5;5$IMa1wO9skI^YGpqpWzry znOmDHnT9YDwdz5f2MR}8FW0r_=v74bHMjLtgcw0`}a*P4M2tML0QsQ%mbw zAvdherM_~bxR`QdxLa>@g^b$v`$61O^+ffORm%jb}CJ6p{a+(^t#ie0HMXIlBpVg2JSi26DLTvPmS5PUzAC!yYlu1magn^&+1FmQe)3Dzp)}hB(qe3BMF9C*(4cghYC3NgX5?XHiKnuf z^T(ANIq4A`n`n=?#&NNx;5P0|2|j$ZRIC$ zoSQ9*7!6{raooIAp)BJVvMTG5-AiRz>bUctcB>V}=2mEij>Cu)&S&wxFz*s_gSxHg ziFXl}AdST*P|<96#Iaypgf>0{JMmZZIf!TAD#pedw3X$8(^e`rwq-Cg!W}oSbb`kQ zXehf9iJt;C;ujKcAm4W4%Gd+`xOV7_tD(+b`OMUGu@JegdG6xe{PDxpbsskkT1hkB z^lEOdhd7B9w6EdjvG}tSXG3EXR4FtOCVz`}-megS4R%%Lc=eZYTFN+a^4VEj4&OVw z_~a$y!p(uGj~v993!@QP59LlN5wNb8u8iz7<<=~n9`xWTGZ55a`JEiQ6v^$(~!davAR2I&DaG#5h z;c2rlAk>Jk)=KQ$bqofv*yXU#=)%Vv*D1@0>q0+V$#E^!2#cWUZ8TA-;3;0>0^E52 zJfx+@LVV>YnJ7Jal;(Kg>o)9 zs-$tzD#ZRhKKqNqWY*QC-tY|9J>9?3uS^{V?T8!k;1ic3nE{ftt|KG*XKLCq(Oi_* zeHESlO5fk)%P@R=8Xoy>^#aS9YFaj!P61c3 z>*+MTreb_5C^&m@k{2Zcf)Ws(b`w@VJ{PgXM~V+9?xLx=u90TnRMyW}VW2TZ0;x41 z2Fcf~gqkK8iwU=<_~A-Lwx>lAHXPxpv+?kng_4Zpv}EzZRhYE*v@+*)iU87O>b1E2 zfjJmEBnrVU=F5!+rIoHp-v+vdhy~U2A-R+ zY9wa(VCBb)Yn(MU)WgI-cX}ZEag^sA#~Y7+andIH^98CY^Dr#gj`3|f@c15Xp!x8* z{@n8mqi=SGwy)j$3SRsu3zeEw%)aYctQs>5k-NWwmM5IOS-zcLhxc0^{a9P9!3Yc;gWIW@*eTC?7L2by3`p+7g^Gac z=GV%xcGQ{aTH3*z%V&D`1}+2K1Yv(b>7W5 zgrt=w`C`rA8@CaAFL{P{tDU`9C?XlyCjvJ;xD3JH{|+DR&2#6jRm}YvZkcGu!r0F4 z?Cv{}Qfwd=Tt5$^2Po0{@niV8%Ws`0bRn~D!<&n|xsbE2q$!9^O2@hx_wx(K#$avs z+gSN-z9X-98(nR@aQ%V4y$5Q&=N;dZwneM~5pscU<2^22;_3|c<VU%opYi7_V@Vhr#Z+Lf`ie~MI4Q1=QW?Ybw&@`7dzkfB2sHRP38aZWfXPbXTG@h zq)OK{_WC2JJ&=Kih0tPg$T{)MoI%w1yn0s{Um`FSH?6!9am8;VW6N>;zYV2Q6(aaz z+K70pne1DmuZ*Kr0%hk-Pe00-4TCXr_!dca`rgsaCodV-Oj%d)GS?LaPKz4%ZC(f!ExlPee6So`~U8t4YIeZ#l7X3dXr{al9646kKStp48X zKImWKWW-MP$PH!n0o3Jq$&Ef};a~2j}F`SK`+=g@Fie;F{9i#y#cHz}xJN+{EBe2PY%-pN7aK;#H zD&9}?tZqEQ7@R~{Mz?lz(C3YUFzFS44uyq2fMw+f&TYYBn&{FZ##zKd#DX8T>_Plo zo_Njs5$>$3!;x2tQNloB9hR#?*wJL00ft!&lCReHCz>!dS|R1KbXF?8m@O8Xi#H&W zQOc7;%F##%SJ$bZbb*~pyLBf{WG~0$ph1{4bvWKUdceC1&wFmnpN~cC@LKf+sNMM% zUK{)iT)Fgi448BRc>7&!F6W}Xy_#0B)u^pk;nGo45WIgsA27{V2hGE(8yKK1=rG## zj?^SwjbF=?wMjQG$GFNp*pZu$&1D7;uEB%5$5pD7G(g%iI38+O%}~jpGTc&zqdAS3 zKWiZ-Zmma9MXAT{*89$~qo^*AM=|}O7hIEqy_?JF=T7ScsjoL9C~K7Z`!2~77^i~^oep0Zav`&v~QhhkILeQm7D#|A3SeeK^YAhWj@gDeJzGw#H~ zNuyEHdK4|ij>Ww_bWuSj3V->8JKN90&NvpL4 zs#irYqZGu(1|ggQk!s3vXd*6n%NQi4jKg(HheM-q9ia-J(TNy2oTttQzs5T+?)T82 z(-p<-@6JF&CZoa&SNaDP^|o(a45ZI-?V_Ddzm7+smVVw0)>ii|(+D=y@)?96FnAo6 zUpWeKAx9vxx}CAY*aKF}J{&voW6Vn(fgtkn_cM?8O>=ZXu=7vEsqCAgrRxqeWh7}} z%q~Z5rARMnk!Wbyj8RA*9YQfyT1ndU7WaNH=Z?op%@^N$M=@E+LA9j&`OHohf;{nV)KWfYr1Z+D91y4UC;s;~Z z@-c{Trb;^-eeAn7JaVJ@;8&Cz2Rw4aNEgOd#u4ZyPDfd~!J(x&c+_~PgY}3Liwfa$>dxa_hmwpE3>~UN;*fL+R|zcfkMQH< zwHZvB-NU^C_pSZvjmR∨>OilL4kia={yb2{cK~H6KS&9fQi4nowC*2Mq(qjUWxE z66w#IJP0w|co6=i{$meN(eHI&I_Z=Ciqsah!C^G9XLx|@Tojk+>60p+tpnF#LjpVE z%D@|^=9kX2G;Mm6XS3g-IQweiIWr_yio%j4YR`q)=JaqF(Hl?6q#24U(f zyDJxW5Tb%a9#^IoVh-{En+fR?TD@>>_sMx48aD_7*M%-wmXzb)X3>b7u zoowUgQ8NRe*pU)H65}U`9d_oiOip3cd7A#RPH&E7qF6@+!aPSO& zTt_j_uF>O&;Gg%~r>?X9LBuBzx!H$EIf;X4UgJYA!PT%a^@yN>b}C~gkvEreDJp6h zMliiyXj2GJR+-yVX`u^GyK}SjObtTB)u`o3b1{q~k`a;`K)&szQ2NY6`WXj>&{`;2 z%0rou9Ep?|`t)<7G;RC@80yMlrkpr)v@LSMx1xd@(or;Tk4&broG#MXP&RV|Ig&_u zHrzUwaRS9eO%sguoTJsgb5QtJ))i!lO8UvIy$Zggm zS0n`QqUa(L5E`8zrC3u8jz(%+D0wOUqSMA>Tw5)wxhC?>z1>Ac^4HxXz{v0IEfvUO z?2kE91|lq}1%o1YO1a1NOutyiOaM~62|=$B!GiL^^RP3X z;aC?_-uAKxxuFy%y55E9H8mP`Lh&tb^tEB`%wz% zD2xtu*T#i96Q&n_kG0S3L6i5cxVWU^7^*9WBeyyPspSW7h>>tBy{=Ix=+l;xhO2+M z3Jd6$s&QHLlKG9VA?H4lx}zdZ{rc9(NF!pyPrUy@?N~TgQ-wz>#*;u?I>8Y06$)} zh-Q}bTQ_9jt+iWWyQZDy@UHy99GjUzl@uBbT)GyIF7?CdUoP`|$M+JhS6v0`wSKtr z6dXt1!sBoDJ{?u(K7fw)yz@BQ?d8bY&i-V#AoY!v_}LUH_~J6|rlNWi);{woa=GxY zwTmdpGzVuyT2s3LYMwN?H=x9#lIG+sbVHCLXgivb{;l5mB?4;Fuyfif-14{x+0U>2 z@;GzFOd4UtZ37iAU*}e@n%Exudg8n7sLblRuVw6Osa-6%6EW?^`}qv%ALiD_Hw_p+O;4_9dZPR7KM05T)M*^L`>26FR8%qCi|;oc9a=?9aa% zBh8IxuV0Hb*N96Q~*ESt0pS1-8%*Spt2H2F5S zA~5$~xcm8yD63<{V=r8%E?R&^H@N!1S3i0YLCicn#obx28&2ab7enowcdZOTZsJ38 zciCNKC<7!8$C8KFfZ40u8=h`@@#!o5T`ODg?#E;Cw>uuis>MQdk;Y9``0A}~D4K3X zqlBxdoYCj0n3@bqDHp3}RN@&Jq`6_TFpss=59d5&dLdU-W9e%@-Yb@sR{DVd@Q;@e z_sfU)%r3>#v!yE?|9JJa)zrD%u;Cg!DIPLqTvc(7o3_1b>E^Ac??(DAc+;!kw{~J} zCe5`G10#d07|pr($NQJyS>}hIHYW_zq%9bx@%#8VN{%-{J(X5jVj?LR-=Q-ZCwfx7 z8Jj-Yhu1zk=+iGN+bQ|a-?3%d8cdx%8TT)7{@jU-s~9mFG0bWHtEaB<$WMP>ENFuk zU2U8jy^0s&)2p-dLB+i5>C2zQ^7IhKI&ief{X{eDa(Jznqj_isW8bAAt-Ml_<2`I|>>ES+=}uDQ}%Zcwgs z&bj19MLqfDncW%a5si7)Z;P;U?Oew_5^wz{?s;n$TFBqza{eLEBmVZ^A7CeS2KO3C z%nP?%@RxByBA>gW2nh*c?^qa+MhFG1nj!S1{KPZ^welpFyQVq~Bf+};K)I0Pg51jJ zSq$FE(>O8lc^xBZYJ!*!N>n8dfL(=3rpWE+o!?RXq)@0B(}mabVxQ=-==U+os^H>^`Aw2q72|8_byfdhA;J<1II6N#&eCs)$$h3jrXEWB0R{Y?=p~JitxbjcT15p&52P)Ew7?(T9 zpY+Qq{^O6cAR#wyBEABnP78j)h(Fa^A5j{(0!t!86nd zAk%lyIxiRZC>cRjgiYo%lXwT;im1>6SDo6mD@TZ^w2SmK9IkX-yD}K8qGm zj_W$e4N*B|Ts!%ri?*fqPWF#i-vw=mx$UA?5io~qc!xY?-4gE=1S`=S=d7DwaSXgq z;1s~fYG!UiS;fX!mwmNzv%uoS$-jf0&{qdp-wD5RRpZ4oB%URBYk+uABCCL7&buz{ zPp@tn*J*kzL60uK^q~lgpMamg^CL7oy&AhRtC%<3f2H6VnXsr*X_&&zXR^9}7Yd-* z;Gwd`uN+kG`b~cA8UYvm`LB@#FLtbJ1Gvr*aZe=q%gFfwf)_KAse``=%MH#Gu1UmN z*Gk1%%)6fQ3=!*5~rH`+pVB{#V1O*3?l z+$b!pqOW&!{6NV^oJDX5G5|Vhar3oD#gz|{^1hFX*l};`Rb7b-uE+S1 zVVGdtjeqQ50(ztWq!cGl+(4j%bx+47I?%JRi2!KgubY~gGg2rIbWd{@_D|&Wb$#S( zZ~NwTYoEUr3o@(Gw|}A$DIgbLeV;XhKT#=Z4IK`kPxS0o%X*6^eFmC8tK_g5DNqPdH1BRhOW&Fy~o)z z+V{Sr3mm*J;d?tDs73tweSgXyJHy!zw+{S_&xI+RPf|S3$mc>n7hxuC@SeQl0@A;* zzHaF_4M3g6QMkdT7)bMNZU)s0<%B1GEiDdSrC?gW!0=E+E1OZvAYeRvb`}S&C!<2a zw@n_jJ|Q4tMg4E_jeXk6?~Im)vOZlN+Gi(0R#?w))Q6ITzoZ zq4nFj7>eAc8-X74H-DMsCl@-%ICl$Y_l-w!KD+Inv)0t1%<&o#hat>qnv~9b%Bo7V zW@muu72PSQ&ROT=hGhg~1Y`vK5peo{mFZLH)0=?Ak@Wuxbt%rN2u%osDfq~SZC!8!ln2z`5$Hy4FtQ)QyyQkjbAKO<+&>wC{)2$W zRJ;H5>5TRyYT{KGK8Japg;SmI*Z$XLeEZ%uY!|zAa*+{`5s(q+rw9yQ{yQw2G8l_} zgE&a}t~alJ!jbdR=j64Y4n*#jjDU=QjDU>5SwTR^jjN^(#-dR^!GC1AaaPcm8@Uh> zxabsT$ybt5v1#?lLNi4({k+8Ah4^&kG06zX2wX4-2;X%TeJjhMcPb$Tc`(oreZOwC2wa;KI# zy-NG$Zl<CXD5k^WYTCzXdMMIHOdh@?^)xxPpdaF%d&rOpaqBuD0Z z@uVW^Z;(s2kry$YL&g(inDiwfz0Xhkzs9lt@<< zz|1O+bXBqw&c#Ou@`(E@0!ocW^PAJ{oI(+Wkm#|v`T3VIU-1p|4z;4F--Ne6-OglarUZ+qDLi&|AW9dD2VWIUi94<${QE(Kq?#J@0 zFTu~ROvceI84!Uf&uv=vE@AAuAC%0GJ7_t6_T&S&bLH*$$qhH)2L4^1q{pC;K6>WF zb;Z?F&oHjchaNl%%b$G_3nETnLRdBS7WW-YeOr^rbv^_){PuZVK3a=O%47YwuYEgm zxi%Sr3k`u;_x}}FPffy=$yNB~c*BJ@Jb65)g#dF%bIr5(XHVklA779A=LX}%_DnSK zBub9Mb6UX4H_Hh083KKD;;euoK*fb<2y|Kzyr$3kcivT`i%h_vN%Jwf`D<)HQ44+Z zMHJ?ihmk^g)>+grsQbzbKnbNL5L#U@bZUT2^q->UiF058f^{17ACh+{Su=k$8Sx=n zgt^gbMNRf`l$3+Z1SG@4Y* zxN;)Gnhv6JZ!@-*IO=LE%tvLVUrq~kC^XSyuz3DRgjtGVX{y6F8;_!1&6e);INWkPpW0Ayr93vBGw<7zS zjVP>bMY&JD(;ikVUnV1Po*Zf4qlcy=X?Qv&Cwl6Xa-e5@jc+q9vUP+9g424ZP=q5iCIO=_odL39xLGmt z!J{<`yT3buN_{gL`&~vACD&0w2n-HJ2)MRTP*$B566e>=9p-|y6;>bFeSVEc?yU;} z&ssAoEC4CWa{Tb`-6%Af;hjaZvvr2GwH8geJMrbw23V}_6`rf&v;Nvgit}0TcfV~= z7ePin@5i{h;y5x(n=UTJx!*pOi=|^K1So@O{V@fXU$q!1p@9fDJD7|r*oLz0Dr6Xn zaiYFO+P$_1P$;WI5FIrVQ!l#$qnOt*#km-)(HuioVY{z_r=W>p;AmX2Bo+Ag+cpzcOvPEK;@v9F-qncrVZ$(J+$7AMHyp9v zzi~mK3y(u^{TAdNIfP?Ead!VMHuC}zGIS2+ESrh60XBq{Z^7{`C(tA*&h86)`Gy;W zQNs{B_A*?3^K1;L`wAP|EvOQTv$H03Xe<(^UxyW!2f}2r(rv|qQQe+0WMs7X;@Zm| zoc+tivQ3Ggh*20YoEsrG%td0Wg=U0Qp1D6JXzO6*0ep9?9Mx?m`DEnmKOniqvxI=i z$}wQV6_}G2j3jq<9~~^&Cg{s@uqWpSGz!lT&y;ufOhLt2ojeDlqDoOxSB%46N_JRc zDuzy7jK$+zmj^(k;k6`{qp0==n8>r5O|IYM*PbCj#W{8)reA+MmW0)#)xZr?Vk*?o zU|SN*C3QH;Mf=evKCpgM1mVzxzd?_N8Vf27EwGT7&b_K|b^rA`P>Am<8~cUgbav3VfLfvZol+ZyxUiv^bj9@;oTS8zup?;w?0Z!C zDbCu^k%%8M2J^3*i4b7>>+DWee6FtQvk$SG>@7? z*FT1P-_1v>$;Q+5SP0sB=Emz_4BmnAvhO9@>J$|DOBsRl909Ab7296A8{6FD5Eed{ zMnQHic6sruf}I~h{QbvWZxn(; zFT*46J&NlaA49>RLwJ36H@w+>pZvxj0S7N$i{F2gMP3X9hK$6I|M)DfUD1e3P8`C| zU*GM2%Q^hq4!gYooB#3zHlM>@oU5j1-bZ)O!L=A^{s2$j{4Vk_6tSbn;)cgp;jsrx zvHGvy;!r`|x$2(W?x`X$WESGMG5FrfBy89~pSTt}9!%-HvWY8}VMr8>LSDHUcW<@B zn0PHlr;o;?|Fsg!xBmhkWwo4h%Qi`IRwxD_K6MPPeDF?O9;3(pzrV~=ky3nDKMdEd z`6Ut$z5qjM2436cVB89V5Ic4{UYcKx7uJ4)eA2PU|6(AMiy9s&k zyaVf!CGZRjKum8PcCoKpq`nSSeT}>k0(Ue8?(ZWdB?6OO?S1{M%om7A!Ls|;BJj&c zu<1}2YJ{thRw>1-`|;GgZiKqDN;q(e4Hhv}|KeCJrAO>y?8|42SJ9Bp8y@||FxAzGzodJe$niI6-ZTV#xe-{m4xyf& z2$lS+XZBTK6P%F5d3P`89YcKSy%WW1>gF?k1aBP}#Kr#c82%4|QW=iW5TK>08pckC z4-}}*&O=RDFp|@Q5Y3vZ_%C97BGTt&09&5KD?3_IH#iT*(9n4=30rb2(imR7z_J}L zobW-&biiknUy03fc5>iwn4*Mh3306*Bzyy$@SWG6AXJx~%z#A$L z4}_~cP#(3K>+3@JH6K9hvF%b@;#&K>T*dV+4;vqT6*)~EBa9v5D!IrATu%sCsOaoL zQOQd5n!>O+JPt~gSY4eK4gMtzPwwvNxNQYc{<~`EYlhe6v)`=*W@~2}%pcno95xgX=j~lq_+*T`oyqz6{fEa>(TN&mI2@*|@Bx2^&X^9&=oIIbSLJDHs`+YD8B-7Czth z56J*)p`=n@JAh5E@5IC(FToAT`3N$%;q$sdx%zT;Nv`{nARy^w$$m(i*os%zJ&zp| z??pm_7iNx9`>~DBAcwWRFdWzmtx_QgrH*YPG;=B3dsq06+jqL_t(ha!ik$-d=7tD#WBu#N^49@bgk*Q+AD0 zgJXN^lQtVkk-kW_6k*%8VFlG<>Vkn>Ogc!w^vAGu8PV$=hs3x5RCUla+-fK0`NSq6 zDBKfKmIi#(F@PRkulDpsVESB4qtaJ+qz*>ouqnBzkoVch3C!%69mQEVFyM`vh=@Us z^I;rt<~SS5P^us1iwYrf>V#;dXomahA07r@-)UI0C?9{Jg54p)8$9XZON&E9@gbOd zd{OPO2;=8XMrES`mhNt}k552opbNA@!@L-caBR?C#8qmjH6ci)5oLO)1@6WIe38ZQ z-{yYes)Q%UkY_+JeBBh}feu#B&|Bzy;727U$i)mnI>ntcY zkuS!vm9}s;`WRN+d7wfXTLRZ9DbbkVgsUr+*NBAaxN-g|ymPP=HD_}N*qb@)|AMzZ za=eNQg#l?|U=LLaM^QoJ?hW7Y2&65VhT@V#DC@E!&#HrO`W#G1jYl1y(aF{p=?7xG zMnng4-j#6PRl;Hs1C+yw8LABx<_iwZv)S}8(*c@SXvCtFg&5byFqp_Kt23O;E!Vm22#e;;3{ z{gdIZ_M(Am6~ZRAV;sZ=rbqtvY;t$oP(vX^@QNo-3`Jsq1(o~vqpE8e`b4#k=ghaF z2#>LNUh_j*VXCdfwv%>T1g;qY-H5PXcGmyZp6t)WiAZQKz?Pb36xI(9euZ~3{36F= zZiYJyhq6%BI1TO;T1G2@6Xw9RrxCsN+p#Z~VR1g;(E9pf#+pSa5NlR@4_XHKiL<8! z!p~HI%7Zzm>RSfO72dzSB9js9ZX4>WHY6Tie!-YAH4&fHS5V2P0g`h|V0hd7L?o)3 zp+A%}#A_E^p^nlHo_qkVgVks=XmKbv4ofG^Lt0KNRMsw3>C%yz<_*;DK~qsNY8f*+ zfJ#(wU(hPuF?q_3$UM0XxlO^axCLX@;&`a_hiR;7K=ptbwvIv^Ihl&dks%15G8zL^a8EtyE1l>!pSdWw zhJ_wAK4nrIKB=qZzHNoI zryb4tyRpMU`V@0ygfOQ?nvYN@9i0(<67TJOJzdVQP|k22k~3<#9p<#z_tThJOOc*H zqxqm*EOMHJjUSK5q)3FDHEsb2PK`lpEh&24HkA9`hJ;y}Xfbx9E%y{!W=uzLpbB0M ztn7StN~iY5@>V4{Ad}}$$G8v|coc5JY`tS}XHC@hJF#uswv&nNOzcc-+qP|66Wg}! ze{4H>bJttXQ|FvI)gN}%-XD5bcU5DpYhAzL7Tjeza*7*FX|z(k0|9!xl!46I`frd< z!OCpIWs+7$4M-aeUV?+~l;CwA52MeMc@P-0!kkAt$>gK`pq0iMCeB52GwTJ39eiM^ahymi3J6us&>f3ds*r+7Yus z5}@xHdrBU#6dAN9`;*Qv4}!Zt%&2;=7*~OJV2be!dC#(^j%)GrTlt$Y`(6fikb96L zlGQpqE&dzhci!SXY@{^vgH1wDISd_=?jAg^a+jC_-wz=Rvx4mCRXUX8ho z1LA(`@)vc?G_(|4-CVn`I)HlBkE)(7Hm%lG%M~@aRzwgiM*}0b zzMeEi(x5f2^2)@9pfv+MD|6lZp=s%oH#EKo#)FGoq3P_TAbm`%%fZdF1-`IsKnF-3 z@Iz~%IL+cM5YSxB+s7G8SRNn&6kC352n@n^B}S|%k9o;rv@2;ijC{jUPawve8Oec1 zFUEzAOfKlxziQQCR4&x&nI&yk0b#>=(s<}GwlZ#6e}@>%Y5P8S4G%gtd8lY|HDtu< zZ!AN$Zf5!SrnA@y_p`Gaq8IdgBNZ0dKNaFp?u)IkEh4=}NA*4i`zp`!P>A2O1K*<}o;Ks6hKv|6z za3=Fq0Odxwcgk;exZ`r1tA}JS3c%(dWe|1i_w4xg+(B?JqFPyjDRGL!+q^juV!0e2 zuZo=j1i9M32?s4B(LA^};M*CW&){jcYEwvFuaml2tkbe0r716j1eD=mvFbR=)(da6 zqY!f3KefYwC?s=FhxjU{$$4zXP$=6LyHdgLzzt_v&%-LN-8Zy0W}BdVT&&N!z%`+e z@2lRM;WX}q7$Nox3cp1I6lD~WX97~yV9ARX4UT_kY4cVXxwN03s~xY7lb)=|KI`^r zrK^EDn|_dU!O63XAvtqL%ST4)_0({R#X4cCjX$f~Sb07q zW|;wSVHa93E{#yA`46NZZ8&2;X!|WCp65ykf+4>9Ph=thyIB;8W`CL z{%F7Tj9j17B|YwOfNi5gX!TA&_4~=AQsy4Es&wRp=}SQwR&+b%=5QYhGB!wcbJ$~+ zF$aFdr&KqT0i*+DcY_6+>X}|&p{%EsKK_wpdX%)B|h~eW%Wb<#cZMad*M!juG_x3jvB2OEDk{{#sM|;?8iZm{z}Qn z?I8JA*jf?a@K(f*07gV0j&7-I@qScWo@ynd>k{)zQg=j11j?$4;DH9LFHb?(tZ23i za>?IilJhZdN-E_1Fe4h`A{s_Qa1Q!L{S_3?&}GDtT8gP$LHZh;$&H+ml70S%*40yBMPRsdXo2Q+mCe(p&iy@s4E@$VsTTrsY;Q zBw%QlyT(P9Rk)kvR@!5*x%CE-*c6m=Nusy2nwDr(RwHkyJ8hStff8YqBvqa&&OM z1Lyi%#|-&bX0-6CUx+y0JC^FxR)CTi4|6L%7FLE!Iw;+@d|`UCm8$**1U{(`mi)?B zU>!ZLAdZQUbKEAqI}B#v6-MCn^BgfTG4Lyide?uil{W(PT^bTE^YpJ&TJHnQ?4)0r9SpI3B zrx+5oV647TG~7Lqk^P)hlca}w@tE*c9al|oJ3*fn4Wx7D*|^Bv`oHl%OE0bKV6Jxwgw)G9LVh5|MbhdjG(u@m*U}iuP^D@2WNH?dsuwu%&pk zGXgSuW;`KgI-P%&k~-9=oUeYNq%@g1jQ`0G({#e<;@Ihj7SHNPI#dS}7)A>crNZKr z&zM-X=qjnX%dAJ<(|yo{pXI!ZV2ptTzBi@^UTGE7#@LS5m~M@@F~GM6)E*!a8fe;C zmmrhyf?3vmz5m2&CTi0{pOk?4+|LPY-NdD~4as7)CmzcCKpr`Dxqc<41*VpT-L9j@ zi@=-*zVzkljcCr}gHI1z?zdt}>kTm?_owc{)@CY!d}0vn4yDQ^rx=?W+0qpR<~8 zVCI#wft)-2*TWqKqC2eBo{`>8)&}M$-@qwWgv2rg3Dl?~$G_TRDi9MC>K$*i4&v@u zR$E&cM%y8n>y(0+Ip}FoN*Jp0dUbTY;AbB<2KeU^{a%46BTJI6v^FGyYhJ!kVXbK* zC6@MjB!dkumjqk|6S$KAzYvsxfR? z;-==p$xbB6dTN<#Bi$e!R@`C+ zJ?cJ6RApU8zjW&WS5#PT*iB#&LuF2qv|zX<9=Y`wj9NOAxd+_8T>%fMhr9f-R z!&Bp^5-Fkd2I>3Xh$C-iz~|TIZ0Bw7J$$oU3QS%;Qf|Lf@pHHh>};V~G$AOB$?LFo z;3$%z0UTCfANM+K2eAUOw@&IG^U6!Gy-l+!X?m}P>br3seN0P{yYg*KV$bZR<0y_BrsFbfe#tveq9Ftd>1*J{$?$ zJlcu*eSntf%!W!~+fq7vjV>y8pUwh^8Ka?|Jz`96z4mZ%Sr+^KNLC#Q;b4a2zXc44 zOTck=c`-OBiufJ6Sq-VMaV_`3J>T`4+u}THNC~3!;HZ7QT&MTXj$&R0Szq2<6Mphf z`Q~CWD0A3z^-&RwebL9iYCEOFl^-(D({=R!9#XGErW5;hUhP$Y)zoN~B7}7R%T>(g zr@~dl2TTEQf72zFaN=@G@t39rK|w+`$M;;uy0@6ePw&7pcDPFTQM|5ot2fK}pP*D$u--5{28Mh3?8D| z8ld3h_H3o9dH$sj+RX9lfj)pqjaY>L86bB1k*)89=yM+9kmX|7lU>wY;VN6S*GwNw zDA+}L-hB~UIon;I{MPk_Es={5#JUG^il7ATqae2BbJs@P|CBXbZ-H5R<5r0XV&j8b zt#?Jfl9Uvdk)fHF{{w$p-oz`sL_v%2 z%NuIIqc?N!$L7;&sSOE?`AUR229IDUqs{xF0{*aqR`@UUZi({w?*Z}ZhN=K5W(3;- z=UOx9}?oVzm^c~Xi4Il zk?AZaG#7Ntc`2TaW5HNQr(CelX9l_iN|f18OO@NUZ6K*&KuxB<9Hr^{rdWj1L{t?|uHY{X}}5pHkCR2MOW|8Yto z@$!DX=b0s4i+gPM>-!Z~RjyjJQ|;S4q9Ho6F&Lef>{f{-O7jG- z)H9|sFGzRg9KG1` z(@9I@wM*e)*+DvicMdO4ANm;dv&)EvS=y0#wOEm|PeUgDe>h;id_nVf;3`r_rO1CT z>4nN{nUPD#^bBy%7X5(oS!=eHWnZjQbtxgsvmHA3gub8{1QJ=Kx=MWfFXf03o`>`>7UV>r9+BVl_<6KK2F^>%;^nn{>!VKfwsj~ zC;2PsGGaC;%Kzk(Hcy!4kYhJHt@yy@MS`TK`0ud6imoIN+%mAgQAbgLBD z&Vqx3IRucVFp+sV7-KEkYOIR=5eUNQALB-qNmCCcAt5rKges!qY9W+IcE60hRd&!S?r3NWgYmXmh6Hl^H(jtlM>N=>~4&F&GM;z_>X*dPH^P|7t(Z9nv}^?r_Hgd;iVKUS4NHEL;NbEqc$3wqU>0 z@Axbu>h$d6v=rfXHW$e_O6&IEBUA2}6CqQd_tXX;cZ+5~LfXns0lQ_4xOOrNK=u zMzlWuputB$B@!|qv<0qv5_85o9ILTGp;TT-@fCHm=S+_D$^!<3?;)eLgXn7d&*;gR zSY$V@Z|z^rU?!L1Y;g?h&)BBbGp_~Wf%^dQ+kOWUVx5dzKP#&#ak0V zgd)$e7VXu2*+3g@F!|Goz9PRHPe@vnOLv3j%IGD6Wk$Wpw=~VYXE5H~MhuSq17MBn z9RECt890|fFg%?TMHOiycvP=;yMZj`gX=@^viKVHXZd_Lpq6>}+E>v86@_x_f z))1Nj>g6dq5plCQ9oPx!DQXFOPkSnDyT#rnnS`bTpGK8dG-Eqtn07#;Emg@Gw$`=F zU%a>4Y#=3YjyDMr%ykv45YpQLvYKx{|#L4tA% zEP3qn7~ta6g%&R_4)CT5HrVj-dThZfyarKwU#8WmOYRD1kgwY1nm!#>-wb@AbJ6Hy z@tZTEK_~uLq;adS3s=OH%lulpYT5iE6aO9G27kLK?#thUk;{KOn8)uimielQ1|3TI zklQoZurPdI)#^JC7~2!FE6=Vla6HGyg-(949-|?U77mCqcB8oW(cGg}ber|N?4cR? z$1^keC#C&Lw8(cO;vKw;zCDAX-q@90cU6mVaqbD*B*N>IBh2j#LjC(f)2&^B(J?7O zzPKTtA!=qoLC7O@$lX1$U=XV(W}I^6@gB1LtG1`$d}lic#Pz2+!d>KvvpsbeoHM2ObM0!z6XG&28^(_EYy)*S zfql%qznX6-P)_Aa!-qlVJ-od$DobFGTlMZ=4le!XKDG;5qL}ZuC{&Df^!I@mW3ID|*mfG{W&(|3yZ+C*&f83uXY&nx3p5J1fcYGbC zQU<36|MJyt2Wd7G4^dHQ?3%V)5gl!C{m(`3=7*5vADg5)-&eLIJWuR-`BKMfIOTd7 zOM5;KNJ~VVi3g4!x^uo6m~;z^Zn5$DjbcNfmKA1EEUYJn?{RAn<({3txPwh!FxRyv zZa)(DUJe7#$IMmtHsE6zSd4N0HSagNZJhdnZE_x4(QWLcA! zm9h4GZMZ6ImX_!;3H+!qJ8nieN_J0;1^W9JnNJpbj@n8*Z>GV$HDOr|AY!_GQ78yesklrpUK-h9e4&F(80XNw&#b84@PEa{Li1{nHVxy*>hKAyd!jGf#L3WBbGF)O!m0) z>3SaEL&rLw5LMgUCu&iiKj|(j|0*(T2twU_h|^hidc5%uId*FA7(8%(8dAN8iT`#uMt2w_TB#gn6)wAPSF8=2uR%q@f*ET#A(xF$FWqc5ys-&C$Tq z)?ARInHfz~;Jx%-XDQ8h_qnx4zhwGb)*c~y%KPL4vFwz6!E=By^~wVG^#;zPiqef) z$h?e^6d)4rW5$A%i=f^L$(G&!L$V#%9eTJ^VgUD@QyIM1UwZ*VBl5b9>Lk(YQ`wJj zK%zLLJR-jfu}~1H$uR~D8#B#$^8St)`Sl>PN;3W1`A7yv&Pv{s?e5tsF!-4bwVI@V zwIec(wgTyKc)|AvsmbD99n1@SRJd?Gr4Xa^Be~gJQ4C2y!N!+e2;*MnQwa(%EfZy! zc@(CZF*Y_i;-H;emdNr3|LxqAN9{==<6N3YuPUUsHdAN81in6}(GEkM*{y@O~+rE)0kR-IGA^X6joHjEs*euAAf%^S29$NAntMT!vkWs_@Rd74Vp zzZfET9ba3R^+&Fkvw`PcbKBgOz~>aLjR-jhcf1zDr8(Q6H9O4Q?n}uS#+fXqv!^m! z(KPop8>{zCSX(i@u$|Rpog6qBnuhwt^4jTE^h`y-8kbjBIaZepc=J6U{%O)yZx+4b z5|&Z3KjhivR7!;vKC)9J4s)u zorB2XULvSm+YiNj$?^1Rjs2c>=4k z(VzK@NlZpJHx87V|Dl4}V*J#9Oe4MYA;86|u)2~*<|MH*_$Y!~;e6-g44I7o!8h?% z%qXmIa_a;@$g-<3rSIdjOv-s~u4u8;*i+U@Jag+8@p37NVJBE}tPH3bi{Pv%BmFTh z7x2ekJot2#f>>!GCkMG4x+R`JYrZ+zb*OjEHKM~Os(p;hU}dDl@I-fE%9uPYnORK~ zi)X_Vz)FY=zL*W@@5=4nonk2vPi8rrtpK!NCq}4{&pTaHiNEGE^F)hPEFf^J`A+6^ zVKyXSw%eQtKb`UuichFL{7Kk}QTAbBnTax@Pvh1v$x<2-Nj!o{39m7GJ{%Sk%v(^1 zxFgx9yR0&r%uy?gaj1`maKgAIORgQvbXOEZXL@?1w73iy)v};p4gWTJ0~C;xXa;pV z0falxHNy5Q3i^*_za8g$U!bK4)q?mIGa?xh2cQ+0X2sL|{4>=61d=ya@K$ee(r z>%ovI^K4=hm^*2BT9 z*d8p~!sX52Q!4MYxfU4tE8;0tU5;)n1l?}w|E-qsp9u1c&RTmKhW>E5EKMy3Yt#IZ z3KKFW`3gxAJcjL`gZ)t7iR|JW+ds+b#k^qA+%yFH%eakA zcII9T&LOxMNK2=pzEPb|8{u-@8UMdgZa>)+d|={Ap4TGf?q?cWIjF%4J21D5#4g6t z(DF(o3cYVS_8c=o2zjzodoS0^t?*3}EPqRAf7`5)wMFeAm1oa7Sz?s zZv1~|_J3yh|31C&K4~AvX*MD2xUkzRhNZoFP4cxI$ zj@tk~G*-G&I7o>A-v>}yDde4hPAY|!^|;rOF?u6IJnr~HLPCrz!&5#OvhKXLUHBXH zBYUw-4e?0%y_~Uf7po})i9znuN6t~%o6i4tEFgfHHc3cOJ=~noSD#@=Fzza&{74mF z2;H}>fAOM){cN)GQ})3XzFQv#WatNEy%4-ybii8m8_oh z*K(aQ-ZNhBJri?bae0Ba>K$BM?L} zPxA#aQ%{b`&t;kx8-ym`8V+bm)Gw7RTd`p`0-5XWm=7JWlMisJY3ghUJbV0`McDnn z4gDskqFOkKFAnsho||pMGff{`0yA$elBma)uZlXS-LE1g`d{AP{(nL!ZZ;4i74ojz z=5^vWI%pxwTJxs{);&{6*i}J3E6;B>ve_FSV}1-`*cNvwa=JH?tXb=OpeQ-Ec}D*F+B@R(ZZaV(BBrl;WNmudBA`%69HZeI87( zGNMR?a6icVeK+CU_SVoK%YQQS*WSUg{Jas&)Gum93g)VVz8LZipPaH}ZxitQV+1{9 zO#%g_YDGK_B+S4&tUp*!#voFY-6uWXfaLtOmm3OSvAJ;Q3*HrMMowD{Q$|u8-+gW;Jkb z&jV+-Qpaze-|{ph8QoOia~cRANcSjjOxwmNIoi)m6-Z#;FK)Cw-|W0!aX>vDG%&Ah zQ5T65kHNhHYj5mjoSp+LgrHRSrg3Vk!DoRTV|o|A&0_`TQy4;Ar&3QSOr3oXcN^|v z1I6uNZRFXda0izcI&HckaR@>+PQ&XKcspj*vtri+fFYsF3OQfuP=wiT&=Ybw9cwBf zAzX5Wyc>`(Mq--o4GJkp;hL>&r+!4kdnfNo-|veCcK5Nw;%u;QcpC}}^MTx(gIPR7G;YrxX7JYVuyb%%*Hp!Z+T-^D)$nbaT`!Nk&ux5Pbk?2 zC{qoB4WUbTI{$K)P-_{sH= zTwjZ$34ePq@qTq$LX(AQD=8C&M8R0sZqYqbZuLO4fsQlp%I5c4GOqM0QVIp+MMNaj zpsBOj<1a_0g<6D&LQQ9525K@jL$r#zqDim1It+BTx>H^mU5GXkU;z9nZQpHC>%&JO z%}gNwIpPhtqYkzUr5l!U9_t9)<9Nj4t7k1vt<^~sW>dDwu_r-gmBy`PO z8S@)?J1(v$hod_TJYQ18|ldx(NpnM~h5+ZS2b*}#5n)6t?69h4e` z$dkq3Uiy=d2B@ovAO5#3MfDyE`&rgUv}rSc>eEh&BEgl8XbD96Gi$bqml<)N2+%c@;5 zcwI3P(~mmO6#hbB>08hVwTQ)(B)1rwNnDmnU4+UqU6ewU`vPab=*c&L8c3)kAb=B;ZSiQ{lbj2?~g4FkScB>>Bq=@D@!#Hoyi| zEQb;$MN8dH0!zCdL0HPBd{+uj#7m~s*RI^%>kGC{fXMO~xNJ4=M9;^sN(Js%ZzUN1 z2M)`KTX;as{F|yNKTIw&+PxCPC}yQ@(fZ7)cPs^=l`)Q>5+>O5g>~~Mtqe#pHK;9* zjcCXgEP|aZQos&bvK+7{G^MEEd7Cp{5;{PN#NybAN%vO?TN>#2n?Jz>pvJZvhQ zBc|2F3?J0zC@b?f13xk{XhbXeyE-vOpH^=IS#OJ8ec zG*UUf+ViqjLZ^XU?-A*O2pf$7yx6*seh_~Vl@r<%pfVe^;JxR!LqK$do$@v+xu zIAM)L=XDWA3j3%U;DF{%Hy%#O?RD$7g0PIJ2p{CB{D???KWLySj6 z(LmK=NoC~N3qNF!I``Fk@ZHv%5A33+YB(#k^CdK+Hq@}~9_|CpD6LAEG5o?OdZI^5 zlwKB(3cq7EiuqJ4F9OHZL$||UR;GEa_0{6_jK$NMqiUtPrDdv zU1Eo%EdUJ1l`Pm6ExI+|?eZ*fA}ZR+USBGrp}~v=oS}&a-t_rZ{O7B*Sz%^^{^4vD z$)XX|ij0hhOF-ZHHR%c#o5LnvRcu9V*0BH^>F(g(eJAM#L3j{O*fOIByXSe_Log~0 zH&<(i!|Fi5H_ky>TC`Od{VrA*G#GmejmJNZIW6|>2l3sEo|YrQz|b6_?@x?>%NCz= zxzGXFYKJy?S}RO?V!BRB4Md0sD!$kH4(iH*o^Y_!Q-YXKPYE?J+ap!*`dbZP z7a0%cRb@(v6!L+&0RXHb5I|pRTDLZB8vC_pLjCb|XY`w^ok%lZ90MX1AzMepng5c< zda6{|E7cJE1DNlu3_<-ojGrG=82}v14 z;DtzSSuxrO7rR*Slr}m~CfEd7nbH${eZn`lg3`tSKZ!pHs$^);o_W1ecDvZIxLw3~ zk2`;WommN-B|DE#NeOv${Adfa+^g6d7Ck)jk7luteK_EDVh0>Vzh4-6-k9gsYM#E2 zvdI$(ZNwCLpWA)gS~1$Yy@-`M*nIFT^EJTZ^?YM;4P|>>Jta8ZTTxm#)E^uJ)YMiH zoet!gh~^<&Ycc{`#-IE>4;3UorwvuEKS0F^Jn?(>o9bP8LvcWi>Q08SUM%-?Pr3WZ zGMomcUifwU5b)OnOJexNm_QA;2Ws~ro)`1~{W~i-+EbvIz87m`d)`~IkGgQR;HAaJ((Xw2`};bT@3D{XzW$t+(SsJSp~X#LUcb18U}H zvErY@tPBHW^20+dm>4)bnRKeG!+CGi?b2?PSZd1uw-xq=?OAO&Bdrg5UWmX@$x^<@L74qIaF12kezd4XO+&{%FG4t1NQ9p=j7N%Y*{<&ep;kZI)+tcutX@pslQ} zYHe-*=6iy|s=-uM@ryfXxsC zziS||71dQI38dha_vre~^zMrxyRjq2gDH-sX|2P_LP)Kyct-&N8#&23H>Ojc!P3fN zz^8k0tD`?O^{|byH~}@=`?jFt9F!G3dqK8AK-VMP&11%!p2w&bYJEFiy+n$={IPU@#=-C^gl+05B3X@#3cZt3kq3d9+|n# z8C!?9E6`L;TuZJ<(cHyiFEyebse`3pzPZkC5B}!(=^w>#=ZRjY_6%lvN-O4HC&*c~ zVoqklJQv3hLPLg(N8)3Vrvo3#`d=>`LW^WKVKyn^sy?d!g9W@*_}!|*{x5L zpee*$5vFNB<;{ov9n5ZG_c1H#UHfg*kLa7bT-dEk(~hdC@cp;d zl5r6q2-0x0evStiYV7L<=`F`@;a#cj`N=rVkwVDaoQDXYZvAT$6CDR{?*LFPb`L8oCKmFyi!B}0w;rxEgnJP2#OJFy51X%{{O|h<;i~Ky z7&+{oF6_eIqw#|TH>h?#qU%a(UeOAHf&D@G>$@P`3%MAd)Z?WJJ8m_C%f1%_ELVsY zCU9qx-NC-eQ>=kr;bjl;^~y@-jwb}mgIKu5JpX!H1Ob4bqeWw`0N;-WML9pw*EM}k zW+EgYvLQv+93v!Dmqzpw1&E;qs7N$K(EULtNfnu9!0fDd)#GPg?j-;yWfskAud@L& z3+sJ|@N5GyDu5^WgEM|)wHP8bTl&`RB2u@qz5}H4e22#+Fe2`Ru@uYzI!yMb`DlJ@ zW^5@q*s*=%sXreOtShs-1~MZNx@^3Qd}aLhz+5UR5P#@KVi``FQseQUUDaAeO$oj2 zAbV+&jzt`~vy3UOZK{N{ywPw4VZBWps_9s{%}=3@IqmR)#Js68GBRfwSNn7mB^dXK zb!g-aRa?OawiZx;0GBvjg>ebklEvwIvz!B?g4B*cMar0=$N9p*oI5}Ld{DM(PI^Ca zO>kRT$m4^dh3VVcd^uO2#7SHgs%_g^iJ5wXMacF^;N}kB9M#Mn=i69WhCtR|S2KvU z@ne4S50LaOae#7XCye+53OkDMvtdzIKt+UP7D|MR%gT{jktZ6QQ(G(eyf~-b^p>hm zcxK-8_g^e5Rq~0cP*LXR-5b-PvSmz+*w`g3QySsh;uH^1!jmM>oGxX{=qZz5EcYo{ ze=H1s;&2C$c2{rjcQU#w@Te>!lHcyA1(qK+HRo61vsSggn91bN6xDX*+=Z+>rg@H6 zZD$teqH?(3HEDf}4|O*u_|h{&8wn!uhW4D$-|cY@_vypn#S0;?E?EqESAiSqWixpC+lul7RX#d0MA?QKkk;ITM`x%)L(U=Ka)nj@ zP0ZI5Qs;bqK`w_F_4COaj$>Um<%L7VmI(_f4*3EtAdM-k<<{ha7#P*zWO5svar<+0 ze~VwRFrV-0i$C%*n_AvaQKmP5%UiGdp=l%jkzF&R+m3zzz9GXvqu%V-vf6iWxxs{X zDydEVA1{FKOBb_#sd&KzefkoEtO+Cs{YSUhS9Dy@Ohl^*{x60P!FODI-B0gH1OP~b zX4-E<6rbBSdO#9Kq1xbTOj8-8gF4}d3Q$(2cb+HvDsBGtR^;{7%(yh%!0+b)bJo>a5~_AWRC$kB zoiWkws^I(CsYIgt9D9lHJ#cgUoNZl_3~*TCd%H;pD&;X8xRvRUv;4Rx{=2TE{O+uU zXil>{gJ^tLaeE^0enNmYH}rE}oY%i&=WqW~pO+ucMq2N}$$|PBED+xBR+owE8$GQo zt$ij#m}{Y<`HkB|y|meOWQP-4NY= zDfrVcNINxVBRwugQ5lVY3fqPPV7bkZl}!7MM)0o$>%$@;g{cp>D*~75U~fx%TmtoK zfsa(`U#EH>M(K-+P>t>v1cpnbaN23FX5CA6=`G0FE#x|7e)5uPXh2KtY7eV*ckk-n z!dy-a9~kU^6jwX4pyg!wCUqy%hDFrHIe5e6rP@QQ?BGekt9X-gvi?ejb9nhD3}?Ij zy_S~4$G_rz7|clfZB{hCp3;CfB6r!p{#^{;4`w(YahTS0f!}#whV~4-T?bez_%kh5 z%yEq`qbg=NU*&cI5*tqG1J>mcIOuL4(mP&f3GoxpCT1oh-{0u*fj#dz4r%Yl<@F)* zvZ|N(vzXs!_X#U69UV5lOn$pBj=HU)HNCIX$y&!07)>0~gq$&4fpI3AGerHlRfE?_vY;JXz%4^MZh zmzZC8({)0Rz1}@AOQBdTQ6R>XwLTPb%w7|}{{7(w;*!c$OJRB)`%(U1KsZ@YU(ACV zu3Vt?H_Q~yCxD(o(k8l;FfU+XCyTSN~6&ccuO(o zOe{J$qjH6AF|pk{qC94wN7K$@R|cj1VS}|;ALs>X1|!oyKbIKmb&G1_*5h9#!KJ;T z(z#>PM#wXcS5<53?UeCd%vmj_iOV&Eq?&R4F#m2!EpXap*JhnF6x7?HrAi{yMdg93Aq~Ma1de&RkKErWVQ}JkQh9nucA~p-4lfd~&wm69yc=8h!L{ z+|*WAkGi*Ev&o>k3^Nn6cL>6>Tn@p;Htk6WQk1;W>{4g%v20Q~`U(sTZS3*T<00XD zl+0fzyCn##t(G-vJr(A?z{|KqiXAPAbms7ka|NuF8_TM@(M_S5t$l;*hQC7DXxjfD zw%$27lP`Mro!GV~wryi#CllMYZDV3v6HRQ}Hs5H%H+FI|-`}}a=iYm&tGcVY|LN-P zy?3v*KI?g~`dQ%udb&bq?%5*X+4={8x2YT$N0bVI-fkR3OkHMkaP=Q<6c*0Bk%4BC z(!Yrh`zvTGQd{fawSUTP_F(PNFB<6Y!RFbVi}GXQZ*7a6&44bS{(84)qRKjamjA3tU1V6tda7-lIlD;@bw926Jz)c z4xV_(PQ-kJ6&Qjs)3N63CaA1Trn+`%S3aY@zpwa7PsNiIzt!QvhrmCnd&K8*hN?90 zNqe-39hsezV!{3@oaRYOsD~XVWlCTrDWFAZmo@5DXyG<8SI9v3fIN~%jjg*7RrL9) z!uL!ldXi(q2U=zNm3%&2A-k>@AN3|3csL;Wmo-56{@sFcGMZViDc2Kbyv|?yBIC~x z`|OmxGL}u3+zItNwmt^^V9;V4UwuCsiev*-(NbY-q-cLvXF@g$1cP^+sPI*pf&={W zP9i8#?v3O77i4RWI!vzajPwd>-|ZkfK0&e-&UISZ5qtB5Gk>|%CP#>4RrQAa3U_4u zM*|6a2 z(#i|c>czRhZm+HO&I{KHH!y_C!^>i9sKfvda|RH=w>#xvj`jncG`!AS6SmM>Bw^3& zlY&$aET;k{g&dIqTEWbi%1N!85bW+ZnQUE>;7Ku;JE!#6ABGq-T2NwLlx$=;#xO>n zye7IQRK3(vVY|7%nHJu15bK`mu6Y{hN$t+{W%Y3EQ`3aRUM`z_C-<>J-$)z9X$xD+ zo1m4N^ZRCFQc*UyKDr4T)zgZMMevQ177E<#C6FQf`XX!W4V#6=09#SGHw}P&9hC8+ z4)7XL(|`{yJzB0c4bc+3(~%WlQjg53*wHC!F|#MGkg!$*BQIR(spoR5!$h!B`9+o4 z6(&a=)R6$1MTqqX3-DRscTWn*#;g9K(bdPV#`C1r>`sG1Pvyh^p&N{;5}@_Ev2-b2 zwe2k)N>j~rL5#cu?v2i5-d^9=9&06L`%I66k)b;Cb-(rRu{P>sV z@Go^$Qqm&qCKuGzRdqRYuq9O*cbWC?nTZL{*xKP?<01#Xa-j|+jeM-gyc~vu8`1CRZz3-NZ zLI);UBAjo1GkW89mATezgWYp-Oz%ZR05m&g=aJ;o9FYvuyV4*e^aO5589bo!BD}s? zeJoxSZzWb9iM>fJOvSnc5#nx6ao2@w4$fh{SL!KLj3hJMIcgBOIONsQw@{buoiOIq zLZ~`x2Z7goNrw1FBTX`3PVToC!8FFAVl*Y;$6ZPyvP*(D3uAO8-rUKt=_7aldn+pw zMt2|zbZJh>Pj64TiU|$B3VeRgsnON%gQ4?C(2N@MlJS8BiLcC-`9dS_&3R)|9o9&W zMQ6F4pca&;!S#HRDIQa~+ozk(dRdSCX$nx!5e*O#1SP^Ajl0ojWZP@JF>&`n2rhQ1 z(SKeL?+oT@<<1VYYLEj3s_jdr92!kqJ(-%g>mLcg8my8JA!mKPVUW>l_}CmApiYtkkR4FdTKn0MUy^oE45UYXKi zZN?DQv>mzHc|y(bG^yN5s_(`n&*C%~SzJoL2VXMI_C@3J+3Vk1d~yFaOx{4Jd(^w6 z1Pvk0R9mbr57IvjlzVYw_%e{`uX0Bzl$g<0zTTE@(hO|lVt3(Tb+#UF@|W?D%kf(G z$(pq+9B&v1yR$d2fLN~(yq`+jJ-nuWdltfz#=~`VdG$lD&5f=VV9kr$v1qXy9bRYe zFl^hAcJ+8rIt6)^C{tDsg}jbl-VKkQ9{3AZ_R{t44YNWnW8k;TrxRK=&T4(VpZAIt zHx5CZgB4+FxQx{*4hp=iBUjMNWDWwoQ zayGGSaQ{xidhtqo>R|FN556o7)sD8 z!r+1w(i`HE#g$QNm~9!dmAs2O+NF!%pGvU9@Rz+^|b63tvwJ7l`snWoprr$gI= zSJQ4E>)wBUDnd9WTc#!7%|UEJRr*EMKn0wWju_Y}jGUWajzn)J;FRE1FN*1OnBo08 zaLtm70ig#Ocwe1G1QSjAx%CBRJ~iDw0%R_>6lZ6o89PfM9s#C(_%63YBD`}V0?`Gq z2!u>^epni3>&Y?7+Bht7o~V*>j3b5DG7g_zNQN0*V06K+NKI5-umZiDJFBp|Dl@a; zE7otiZyP?pwVczsaH=t8&ELQjYWT&>J1+zDYt_f^AF%$7cfn_5sIdj?Q5B_t1P?8i z?vq_}VwF{V9|tIZw40%OSy-No`WarH1C*?wvP_1%F=Q=^V@tMM^^mesEd({ljtimc zyD?FPWmOH#xTzS_g=wEV%<5}1E~}_i(VKHM*zsKRteaxR9QU*L)75je%bR)( zr`{`;eZ-nV4L#QG_#4T2tgo!MvSvKP9ZxC0(=Hf!6jKjQuwXm{=N&E@EDGeXkD&a3SK~*ZIE$b&SMM zo>y%@$HsbcW=OdooiIic_+Z|1BSc}dltuj}g5MbOlIs9GlkY9je384ZQ|J;?I%o8o z5GDMnKIB+_nVQ@IrA1QiepCH{f4Cns>WQ==`~j028{59jdMfBU!HmsUBStgmhfyyj z)eE)?f1Ctal;9RJpQ!wI-0$Aww@xr}@`3tl?RX%YUK`wz-*jhtbe`-HM`}&5D9w7U5NR%+}XETEam})Pz??ZE+%ar=hjF zWQid>jc3jYzxId14(Psp3k^n7gQj7tyR_~R1AAHK?6ZmXPov71Y(Rdw-wL;}$&0u> zUY_`9p1PP5_NT>UcQ&7Sh?FJ^*YUaFUhX6=>D?i=3!0H(Xh#*i11Te%aW+QF(&jYd z_v;Konr?HbAbD9+FPNV0b6H7nOPvPe&}i2@S9AnS>M*?e*VjXPx%#gv!JqBxdF^2< z0z2P2F=VqyYf`Gzf`Re|(ztba^p8~WxUY79Ph%{1jw-ZSH+P~CvY}!K_}BkV&cfL` zgCRqK`Ha)+64!LaRcK$|X#Xpg2#fC;d2fcMs1{V$V_55t3TrqLXz?;Iutl4P>ZdYX zU-bta*h9wj4n1)m>-iC`rvYOPPy4j=LRQFXmy`942MAuzAaqY`uP#|@JrjKaZ~SA? zQ1jPp@B4i&4P1?7%b9vttAW^v>Ug{1$nhL(Y)mm~3lQ|3^7=YCT^~HI5;e<#LU}8k zH*ApZAmLD=m)Yi6#-+KO*0pfM41Le-s{R+WYOl=0)&^X`7S_o8sn@^MmMmt9d`S?X zJyB>V{|BA^-}^vXq269mN3bZ?6HyWQFa8}2Bz()k)EA#kFEIjFy2DVgY&RSJQ_3Iv zmPJv0Wk_>&r6|xThXs_A60{{}_dJaSqJkCs_$P}P|3 z)sS~z_U(F{)lL)OQvNgZ_-E+x9dwvu6|pDUeLuO*WZz}d--{Suec-Jg;Ubp&DX4&o zGldCPtTt1HCF&nJ-$lIp$MN!FMH|QqVH>7)7iAkyB7T3zupSoW-(sMD$nej_WAi&S z^egN7)ok%k7VE?}(#`L3$yvnz-Ne^zSd;7)T!&?DH*AUGIH48dkjR~#I7_q^Cf3H< zP1UD)ySgH`UVtB0ffeag{%m0dBIl}lU9?UA|IhRPKW8)odcUu6MKf_B zV!hu5nVCru@NlFq*oFzYm&e`qE9v6EKOid*T7?}sA$2*JhK?)flY+Nf2JMxglMDuU zV>6<3$5@&4+lWxBW`yQ}m{W1A9rv>161U<0`|zwI1I8z^3Q*}4=izS2MYnY)B*t8~ zgrK?l1*05Pd|_lfz?yXIqQ3t81A6nJr(wmBeMFUkqi0np*H@H|Obw9UaHds}8-W3v zujMy)eRs#(1NiSdv#Obq`t~&rpPoWj7*Sj?xjoou=JClEXH)MSY#pyB1B*&|(H9{TaAV;U4ysO>7|KYlk>@Hsf(U6Ka=`$L{~D zMu>u!{`P`H`&EWq@QTl9N7WX_KB2bt1kDuINCM)V=ZW~&5+r@L9?n|t1Nr%4n9$JE z?#*wM{ufHCD+)Gx9}YZLtpU(ofk@wiA7l4$*EZ{|NSVoOu7#=kn*aBPM%erd8~}ai z&n|FY@j@JzslreZDHS6C%AUMyx8gofot{cgo)ZHUF%$T39Tq5# zK}2qN1|ZW=KqpYe+j{1V5O7ITNX^C{dBTJgvv^>*kclvwpNbfdez>Rru48=1Gy<*2 z{fM!>Uzj+jy1f$}H1D;jV>S8m^LW?f@jKBW0wWR8lL#1+UBq-LlKeBL8+APzrorj~ zgl6`sMOg*TaHg@x)#HYe*-5|cpwiAN*wWSVy{)ebl?2IG2f-u1Gt#_fcmkR1)L}Vy zGf2;CA#4tXb&oaSITYj%2f}l+tOGbPCpCwm0^_=c&l=REILJzS#8+DDxwwDc7&HaSoR6Kp%w6AQO2HyG_b5HwHUPen?8jt ztZ)_ey%5QP!Oac0UePI0?=6zBF?fN+i>fiQkpY}m5h0jX_821EVa8$EBF2XFF*#1~ z*;#S8FZJD#6C=P@bTV+q8jgmt+yWq?n!)M`+aP|WuqT|{N4D&ND`XH~4fz4- zy{H|d0vW&K?;aMd$}yQXi`O z>BDF^>_sn;+g9PpO1aj%YT#sDrQKqm(1Pequz%W@tn014W*E6GC5ewk>Ufj@m){}! zKt-hogRf%&LsGvnXT4^RG+!ZQ1V43YJbLwu20<0qU8kBYkA1+xV71;akD=oz?9W7G zhcXWY+P(IaM7mtDHdJ3!dkW!V_ikHxqQ6?uwPPIPty>1Y9osIA_C+>W&^{TiL7NRN zeejQ3Tq`Gs&L5)c^I3gL8RIH&NU62z(3ysQ%bKhgFg~vz&>^gin+1TjI&%FF?t1r% ze-V=<`mYhc=s$%dEgP0M^e|{Bp2zra`-$Iew$)%%c-^}bx_{9gx8Z|wT;d?;e-QRO zpWr)H+H{V|4Hfl#KwRqnE($mbCcVN>dO$#UM2PGm{j@&tW2lD>qEzzy(OHx7mK8be zJxEw|O`$JaD&FS{b-+G|S-Weu#X5-gXm=B*tOt9dymzpX?Onb)G4)&K2`s7El5o77 z?SN=$YV_%jz$C%G>1X?F-!NB;qqqLWYrV)10kK~bFGG6eE(fT5iDSN3=COpoHRN(v zav0tADLjnf9?gtq3F6ylVZ1>e-lvxit?5emAI&m;d}Y#;r(n?7;db2GX_TNk zQbAiz!KZz6fmQ8QU7`KOa3;HLjXI|oKvgq7TPl7U6TRW5+>ZrhfgrBu86EeEzz9m4hT%Kw%n@6^u(;}t7QFzxvWe@yTw_@mb@R4Fg8X~zo= zY8~EU{^o$)m0C}mA8VWPBZO~0Yr)ND^M;6&pC2UJ=;9d(ax#d8q9Cgo>39Y3t92j4 zHL>}akub{B-HN;&%US6vv++T;>%*0309{rvK7$qSzIeobZw6`*ThFKFTbo7oUrWHI zwQH9T^?J9%m>6BIe8Rs$Z({(^wU&Yq%6dUydCw^lu8{ipp9O5U5Zb|a zfowN1l!3 z`F#EkrCBAaG@W3|9IBiRXb+M-_qy$=FIc3230jXpFJ^cLQBTI1g*D4>0)2@=@VJ=* zo0W-0VQPHOeuY#zGtGLu zs&=87FCE=ETA!@hN8C|K;ez|$;M(aLA-ujfeApE$$PT7P`LImv0dwBCKG0-?_ zrrX4?6VHsL91pn4e20^>0X%lcv$c1yg!U)uMsy;Py_zKt@@PsY0MTH~;9UCaFUD~_ zEykQbUN!LH=t!gg^poLOKE z>~BimZVIP@o1n>|tvj9q?tMR3zYdhM97+`L)$x))zBF$u567ySYvFK=h)*M=lIh5` zU<;vUegLD3gvd{jhITyyKSd$KU^Y=B_iH&&t0RV zU6qJyuuO*aTNIJ8Rwsfeg3TH2L-X)g*T+Gk^L2mAIB>r`*#fy`Qb5OtGDe(j!u}q5 zV7g#ucnfJpczIj2ock}>`y_Wngj#=9jIZ;;+v(+-tG6gSwJl3%`jwHP7&nh|_n^Y3 zFX+8^&Y)VP;(S6`K7H=GOj)NgFSquh-mH~eWB6fpf%e9dzz6pA30xh4ClY0I(>_sb zH>xfF`%@8c)eZdVtyt{K*x|3EdU4y{DG^Hi+%4g-J0atU{f8^6C(jCYyP9KS3*VBd zb`yv&cFUWRs+q0O#T;y>(|p*8XBCrx54suuX5_$^Yb*`J9qe|T7o^yC!y7n{(t7;0 zk?z3_yvqFO%xHW1E~KKr=L4EuNE@z7gGV@n;OU8}uaa*!IW*Xo9eX&q!K;5|fW7{7 z5@$P)-_zjLeaA50_G*PajP_gxAqS0=j&|w@oE^>E1yOw`9N+AT_C3l_Y>$kd%IWwm zURA#gV$nQKP<7m3wQ2rlSIv}7>^JL$Gk!jEOxs-#tB>&HW4D1*D}6k9sUmV@7q@4L ztxKfyMAyAvuygH|G!lUWF?Ck&`5(%Wf_%N!x%9z-aNW&I=Y4xy1m(3oU^8^@Jec^O z?4d45*^Ar3+<@xxjV^?epXQz-_In_D`Ws%t?Ee&b|7~ePLci_FS3i3EL)!{*b@h}w z4P7=d_4cW+lRp(J3FA7@jBnldQ;hhfGj-;hr__Vrz&gf=2*c{-;?)Z-C?_D&gkACl zUsb#HN%PS8UTcwv|MTxl$_MKl4uHJfWG{VK_;jE!CuH!-W<|4f-(K$so;%BsHbQt zgQSlEm)TSgSl-(qI)u5^AiHv?KfvF3idaEx$^)O;5SQ+J4O=qn-1fd?R&cK#g6q#U z(rTf#XehPN{*P4otZzB{bn*myfh-HHhYEX_#SHN7z@h#)zg1n<1OZF3`J3$l$`Ng) zC664K>ExK*r)%t^Em#82)Kkj{Rh``kP4Vh?@sd>tf2&sx@lwmEw;ve>)rS zuW1LyR{ycM4pK#h1w1g&1%6XUt{Mr}tlwmK0;$_rlK5tohs|MYGrJp?HElCCGn?<1 zFHiwr|A8G`vI_aT&JVWsG>^k8wYh;2WeY?JA0aFnRu+dB7ex4^X~-P3C&Xe6 zXh9B`B3)gA3qSEtL>;n_dlx!c9>n>s)^qWF>zn%))nl{&$iv4%n}6_VDK$zrqoXhv zK*OFKTpVzpl+%#kope#pdP@$GY|;`u+KFIqTSkHvlG){FQ z603<0vzYR$Xn8*zNUbLYn?GJtnS;Z4QmuN~^eNh8aAjae)0siAA1q&4l9D|!^q19B zStaB_;Snq>PB72{B3IU=yiOKl>e@&bx8PF0*uG8z~xc zH!I!}e&0vL^h0yhOIAMZsQ3@ZK(URcJ++9u^Vmk>pyrmMVdh1V&~eu9$WhMTN;!FB zohh?R@ZuXQr6PFP5zzK_J==3qI6t6Rm$h8pc)`qBDh(3Ak2%<&X8H$^ib+WBs7|d; zI>q!OJ6X$=_>37)yU>`-o{-URzTgrX-P2Ok>@hm=E=3Ja&V*)mhIPb~9~)Ze`9*)e zVI>@pLy6vLuj(8IV$sPO0YOo6W&^%=ftZ@JDCu0W0rG!@h{vCHvJS2$@|BCva^Ob8 zI|5w=eVjkG(=n2kuW;TZyP0;;F7^$)kXj0_PxQh8wpWi7*^)ub(vdq#2Cw)vEYQ#{ztWXH>MOBa!1TL$ z@Yc+Rt3O;~K*LpQUr?9cQlhLIR(#Ss(=(X#7-X!#<2wWF_Beb6f{3Y>env2BijecX z5$x%mh1(BMv^PCc&kMQ(Wz*VT)TnjCoTqigno`8NAh2C?JIR#LX;XGb>|9LvnG=+VIA{@YEstvq z5mr9JQI+A;g{hFHDI zp_#afPR-yb(R_&~BLhs1PY0!F{Me%vgkFc9vK3EIG-K(XJv{^+`z*JD`oUdgmGz`E z#5cJ-;qA;IRJeGN5nK-~CZKO`Xv}mah$AbeMH3b!1We>E+e}AlO$pWxBNQl;wd9@Ce1PABia!fwP&}L zg8XgygTsk%<4#7+1}jbz;)$_Y*}#d9oJ{=ubpH5amcSlMU~W_4g~f<@jly`S;yJ_| z&ey5%7}U9(89k!#K&UD6l{zXJXtPQ?-e`7refo5^MS;GLv07-dK>|9Pr8VlS)z{O$ zDo5LBITngp`Er#7h@XV`bao>23Oa-bL1?&`14AJ+pl(VX@d#~RYv`30A(WC|-Ko(` zU3ZU9bCOUFrGq7z90{3n7qO$;PkbNoN1$@^f#_rtJ>3Wh9L?38pegiTRJ@jFHM=$ntze=9 z(gxL314sTEZX0@dXIYBfrbK@T^`lm?iPA@9P1Dj1s#as@p(KphLXVESALuiCVnb#s zI6Z+b!*aG2VU4!ur5EMpsf3LeN{-lTKg)D-_NhBW#PPgPq%y_?dIme2MzougnrC{_ zF*&qpYX53FrC|mx^VmG~Ic~>s9kr{DtGz5FMK||*y}54Cb+!X(v8$Iz*3jYbJs@74 zT(~rx4e@HUwQEtqo$CKB)SN`1u&$s+MTN{Hb7(k3LksTV##ZzEhn(6{)7P`c(7M8=o)L4UWQLA1 zwbCgehQ%6kd$fA5ROA&RRaVEx$qroOVYuk(Yp8x>dl<7M-(vfZtRv#B?q z0CeLC2;+PW%7x|{yCEc@+t+8PA_1V9bOlLT zfhqad;i;&IYar{$I%%JzV2=V-fqnbB>JvT_q{A-7lec7vt+1dsq8xlYw#4M9Vm~u8 zSAGEa7up=`f@Ip$Ek7aP51TR?gia8HI2*3aRMPmkStu z83y$jOfeEsMua%7kkTLsDCmYgLj?Nt6EkC5!6v*urd{iM5bSt*A*6y=c{WI@1^&ku zAbnS1nZ96nzOgU=h#SNfD=$podWCt~zQ>@$5XqJ@QYyQpuwNvmm=1mn?zBwxYi;`o zk^L#s;YzySK~s0;{yL{sI3lkJC zu|teaDmR`miPSwv(k?!+XN$ z1xiX8WvO5XY9LOJnDbv8YKn$rpRGT-DJ@42>gb;UdK%X*ol{^b8^HM}HDp2YL0{7fazlzLkO0Nae`o>ElKVa|H>xq6E!(i^(D3#W-*n4>qgLBD&7q8?yG}m*E*t{gz?F%KH zWVpy_3s=i`e*=MQ>F)t3?((!lxoPUV14el3?R;b1Lx4m)@q#}J1c|J=)Sx03nB7H$ z87LtJzK9?1nD3T}Jt>z{HH|=8AHDm&Ju`T@4zz(T%Yn5L$a%o>Wo=H>wruv1KD zw9H34aXYY!cyAjr0t(Z3^|HDqjKYHQFGHzHGg;o_YE4Rh|1*ybiy+~y=s0SBupv#Wh1h!J4z9SDY?`4K0V|B zX=^3zCe+U3@oLnDOquios>-vPO`l!M?Ev0!Rn^>ZlJ0KG)jQ$g7}KiZsi#)Ily|$% z*`V)=ayWKH?>{kLUQy-hC{t&U`msviX_YuFo3e}xQ86s@Mb8k>J|Tb_X&ew2>w60H z;FZPLbSKDB;Bg1MCgA-57z}$fbE*FU7AatuM92ne;L}|ix?pz5kAmgJegzYMNutN zE2sI_Zo_YH-EezrvvYATsb1Oq$?*@|Doh;rbgHRlt@e4xg6_Be6j&k@Vkij#0d;Gd zZ7dnOB>J+p&AX+5r;`b-MwPSMcFI1!x#qSliL242=ki0-mAxAdwk8k>s~oTJ!37Xp z((=Zvf-gz3yP7Sa{zXE7Heyr#bsNQs6WNvcqr$0$bmf*C$U}Q_{1msVDNzs_e z1Q1y*1hsPKA}Hj^qSI|VVX+GQRN)y*u8W1^6YkZ}S;{GJ&Q~}^!D_z=dN9i-XENM` z2G{`TwKb9%t;)^j9e2@u+%h?EZPU_QRp)*m_r$-J%gqbpp&Q=8GX z!_k`OC4%exa41Cv+aAEc&_dqBlh$4^Db_5SRZ|XA&*5MG{kp0-<$~^Jg~pMCy5lvs zCQ3v2F?6QMR}VV&QA!xp5ZfP?!5K$5C?m&i;jXWa zzQBimI=y-n;G;_aj3N>NyYQf}LS9mS;JVhL^?ZKuZ3}jo-NbAIe=z~MsJ=z;KJwAR zHv&r82Bt+UiM?Eq2qHnq3g#H$pMRjTu3hQycyUn-rEPe%<1qEmHx6~MY$ad9X4kT# zo3qYvEuhX*c`9f7{PQBloZ1GN=uY!3LSl2Glx(4{an!CFXc!)6zkkTkWIGA1!7Yt}C0( z*5@0A4Q^p=1v~2~sKy92moL~akYx5dFnjum?O3uY7CEs=aJj~xbHtCekeA=0%QdEjzJvOD&4h$715Gu)Mqvk)Sx z?M8BIBkUfMj#mJX-l);v>#9C{YUF^B@w?&a=Gn}OOBGx2sIsOHlQ$Rl+2`7>lTTc) zlF|%=aKRy2qY{TUj+w+5re)n0-f-mGz-xpGf#zcwlU#3CBL%uxmreWpPg z+8Xr&nVTvrR_OmtlpveY3#MsHcXaY5SV57;jJ^?YO0$RQxuSzOFwI$iw38Fzv5T|$ zxn&NtND{eev}sT)Y-m7ja-}I=NN&v|vJ?u@#eKo({D_T|itH|ygopX=_}zI1uF663 zIjy`1tyw_^VXO58a(>~Sz1MZT|0g!a30x0dSW5olY0bOCm=b#Bhj@5GiHvxW7aOKP z5_A)3y1Ri6+vUe4AbmC|c0TFL0Nbf}w!HO>+s8SO6LT1Szl+o2^K;mn>xi8&2Mr6* z)`8BKefqN~|H8=G0cl;py)=Av^EPn82Q{}|98idz^i{E2)&&<009@ zRtclI+y9%tzcK4W=R1gef*IyaOkdP>ji=kzh8GUqVV>z1qhtpLPQ^x>L^P6JKXiAL z5lfJlvIUvb-Pa*SUsV%?uxS?*moN z{MNpeIc@c#lF<*!ciN%R-49El=ZTPnqq-m@FZSMia<#`1uhcIqw|-=L_Dkf_JfpuRAWh^Wrq@Gu6&8wWyIEWd;cdz|Z zS=~iBL%sU)dxlG1*6pWSbslTlZ6Jx?$}_$M0$!k`zx2A-ry%gdke|l0wa)(5j?Qn7 z`Rye3kc^C9HdWfj8vrM(HTy&OkNGE?pCNXS6~Xp1E@M%f9nB;`akcyPJTJWX0Vav; zu2q2$ukW5`>wE^@pJjl#e_8Nv5NKaQT%wqt&xG5Wdn~5NjqlIf$xjy_=ee<6=aj6W zZz4YJN4{ip3yhG?>#;{*XE?#iWldsp)p*g54bcwE4$2a}=EOL7_=>(ZcK5X{ z6RLUS5ZQ8iy0GD=elAUPf{S8xzc#*!40%r5wV2K% z*wA7baCWlZ?f_NV6KW(SwbMvT)-uv9t^ zh|;rn!jC+x@K!TDI&wL0=%Oo6=y_joV<_uU8;ed`&9Nr8Hv0H=t+gkcDX$9n$h=lf z;hV=a@m^Ud4pjZuNs~du>waI>kI)?=Q27gfP~!!v$+sg`5Bm$w6RZ+c0yg^1ryH}I zc1YYW(=alRDJf1pl`}kO1b(Sks^n|)=AqQ%gJ^}vB9sT2O!^Kp^_*{dwwzR(Hx%i@5Ww;}xlg?G{O-ySif0jMfcd_xmNH>ay;XQfn%ISJ&z3#>)c= zqA@I?79Wc72n7>gHtOvOlr_&3+{Jpf$ogdevGqsbxfO(KSgn2%xVf_=D**o(aDJ%( zv`k^lbi!5CmEqN|!uir7U2ST^{Yfm4L{MDkPiM{rsat_UPXu-dAGax=Vi(;FKO&$P zjR{-51zLKNcFDzZ<67>Vm9EaZL}T4h?|&>!PkQ2Rtej%)>l;anQd9WnCs{RMuCvYawXsf9Tp6g~!P*LxPk2h|V`{SNg zcYS8NV%;N{4Qp<2L0hP?2n3Zcn6$!qNPW_Sm?zCil;y%SgVxlP1@&sI!spM>Z+6Hu z1$({N8zT+cN+T1ZDeDnlEV!6q+U4T{A)--Ui~0d*wiQ*{1y?TF^K}iVH8{A#Uc5*e zUXtdA7U#>y7ep)^RWSG59S)f;JGSz)7QD5UP`2)>rbXvcSj#VmbGaX&QO>F~*i>kD z2sqg?7>&$!iK;gx&NyMlOfBf&wO7P0;0fEYH)hp*;CVUK^2y5roQswm8@3{sb-eEF z82ZD)0_=1;yvgS{Y>T%nUX7~%`W=zj4{p-%wxQ{&;gmb$1aCO&BWe^lq8uRE6H0rw zwEWn+3+c6Oa4n2BEOmOc4NU>88&4sVv&x2bH%nIzsHcR!6}he|7almxM@Z0kN!>1r z;FTwD)J=&fyup7IROMs&onbVpRmy#k{zu%+@`7^QKx34-8~Im5Hq!7gMq;Rk_aoL! zMIn25BJ>Ty=#_Jg15+`Y;#^-lCGm;0D`6EqY-pPwyxJ`vJCyp~f%}E-SBKlvJ5jz> zO%Iz8e9D~q9rc+gIwyG{uVERznN_TcVODR>zJY^hG#;*oY}gJr`0t56^8R_^DHg?% z8L_aBWi5UYMmGT*0vkEgfEAw2C!-#n<%QF6Yue+ISYo8le1Iy!K#!Yl%!&)<_7oPJ zUQ6KX5rwK!=q6+Qo_jVP@3WQmHloj+Ctf8i&1`uw*kZntl)`L(OA)lVK4#nV0!+b} zDRilPPOPQnfoNrHzpHn)!8CO$v8t_-^@!_GO z*8U8Sbe&1aefz_|h+XhoO_e&Oe2{bTXHJ;<;ygqbvp1GNUDH1Pm+SdZW{F+ajHjmeuQ%0*D$MjAU28tPc$f@w1!7IeI zU5Xw3rS`*qd&DnAQjZADW0?v}!X`(EZD%-1SJFqJ*@s`RM~3sdqP3*9wE6k5=~snV z*Do7^qW@n9=*-OP=>%X$^f|nbFf!0W*^J+DZli z-zMU>YM@(p?zi2r2N``qlOH9FNsL@v|5^6tGCp#iZR4O2}+PfJdEYU4j7cD=s$KFvx+h+ymE z+!dJ@Vy4pwz|VCW3MyHGfUS-G!~F8&p*P)voM%rUq;flvY|M{Ex7;`OR2T_1d+%P7Y7y60k5ZZ zxtY=@+G|O9f7l}s;2)Red%LT~Y(f5aVmei? z`xxX4_H@efV;uxhqx=NK|Ge1$5r4iD6MEWbW-9;!dkQL`MO-zJjs=;nTRNSaEQ+%T z4N3mvh6B5a9ke&N9uY{m|2_Ku+x8W`2e9_eU&I7%y8pjOVQ2bC@64y53g{8yP!4T#5*)OyVp7blKhwxH761%Aq@g*DSwD60A^UFX1H5N zWAildkp!A~Ae@wfT&u7;m^?sx^(YX_TQ{$`MF#xG?NC-d1^;c!z5z8rN>7frXwVWH zuc%kCNBw-$3zCFI+P@MG+YO6^l$4o#4rR2BA)2|wQo*-yzn#Q$Y&=D08+5^Or4e0> z1+j}2+*NYSu;Ky=mgngfR8|H?D1tS;la#|lV}llc0*MNVQ@UHp5Zx5@89*zRiXRhp6VcC~QNfOk~)pMltJD{Nw6Uc}3) z0R-Bta|SFEejbn!O?kwmy;G=ebD}s}H4XVoKx?OWqH0pVrECy&tnBvurfL8@yr{&=X0#5%?y*Kj7~2Dgp{yA=Sz*ob(y6Q7v?AY zn1Y--$b@grFtahN7$bt?I&iqZlLfr1r?1tj+wlK%T!5Q~4MoibDF8N~8nU|=v<>{F zaI0&PXyd~Plp)R!f_mi56B4xGmp!qt39XobfBD(&L2}`g*jN4&$w2j3=?P0Umy(P2 z={KxEpRi&w>#Z2p`lo6 z`R5L#xI?#Em@Cr@3N|MwYu+38UZ0e@d-S4{zoi23-7dWXB?0FhCd&e#K&nU ztwvunzJ*w6+>mJP8x*EwPA}!>vt;%J)o_i>P(|77Zz(@~=V8nuFBJ|q9ia{ySh+FH zhcBKIzp5X-7R|$asJ6bW8jQ2{V**2ze;4!%V$Q=St+|#TTN}ovX`i_ktn~|t$)@?G zYc&a})A6<|gz_bHFgz$uTW{4_1a3?ZU$Oz5_x}JpzROAAJ`E)C?#kPd zpt*vNKat55R2AwoZvV}h>wuw-Tu$`qB*Vj596m1h$WRe#0^c{w&^x8wn$^9~Yyr8F+DB{Y?Mn1`%`fFK~2(r1DKIpj4coI348g}NaY-Nj3c2oG!e@sJb?`G^7| zat9<%=i$L%t2dr6;<%!tadO(Vn+7z76QGp{2VgZsraQklb9Hj!E#2EwhSemY;vOf_jxrL^+U=ta5XEruMrg66smk)-q zrC?XJ;zgteQ7v-fwJM)jr&*KEtyFj4kRBc$CLz{~-OYd2EN%r$UdKl%^sdi=$6>)# z;%n+2@WdmNU(Te_;VAF>0Yp&f7iG2`y_E@;D3a(bgJ?G%F(}!p)d)ZmnWX0$X*QFw zZF+nhewJBcE9;Us`L@qK-8{d}_WggAb&k=QMBke4PSQy_wr$%sJGO1UNyoNrt7F@? z^TxJqWAdMS@64<<^{v*bv)8G8PSuCApZ$A~`itcBt@mT>^CPKJ{DXNQZTnbgBv^?A zfP_2SnnXc5_7oTXX1&AG5%zL<9Yx}J!!`3>FfTUtv+5$ntvgb4KOM)DzFPn@!8OO3 z<&{!*(y=S>m6LwigyZk_yt=nRisdvTn@MBGDxKi5YA51`0i;cdhqPu=(x^&gGr>N> zKrSeq`#?sgT$NMzBBGI4W~QFEyR;!Q*B4#_aW`V^^#&l8@2KJx8ObW}j?4b?&>WuF z4`kbMUs`h?HPse2F4f`w(!MQhZo<;U)@hh5&T48&xF#(_4AXRqH%_63Vp}}SE8T^% z{*k2Yrlg=ECs@>PE}9}N^A;a<*&hS4v=6B_@WRc^ZP;suk|**?6>4R{VeuwA`^cyt zm|FZ3G67}co`RERanXIhspU{CH+fGt9rRCTC<8patAg9LA&dP^y23DPK?g+DR5I*p zxudQa_Ri5>5Yv{(C9**O3e8_q85;>%0%g6(lm2{i7TF8y~21x%F0z$DkG_;~P8S0;&{QP}eBhb2`jKmy%-fMJ#9*92VzB$1gyoDlldI zS-;`HbQeeR>z@M!nr_L+tTejt_DNbGH<@c5K#dg3GGk-DZM1m+jF?p>ps%vszArJl zghKAmNg>Kh`A-6ZiFht7puF06;}Td@b5LIjCbCcfA`+&*K1Hh!I8l`Ipr59aTn@4A zn}LepF9!$9WBh^3oB=&O_-RwA-Pu?2#Pimr(B+YRNw8|GhL*QaPPm|E^uz)&KqZ*f zxxlw#4hrs4n2g#^IlCl~Cr)|=*tJBSJ&evBhtdJ?s>fSe(g{nSlpKgP_?-EhDfm(vz#+aV zHW7~&^b4Y^qAxJah>?d3I(gCbGG}UWyqcX4#7ldNZqTeIVN8LTl&_#7Bc#onmt3tn zSWX_qP*Hq0`wd^9tqo_mY>Gh3P9TgFYA?kT6(By9U+^!u&(AAFUf%vuIwvgY=_J-? z8;6VXp5sL^Y72n`PEvRvmYcCR2KVk%Xn_!R%8Bs`@MfBqi(4b74nwx?g>Onmg;;h_ zCddt5Nr^RdD`xDJ7Q5muX_cposFaW=jmHeje3=#eH|p%As)@^Z!83BNf%xJ+(pT== zqr?51H#{D#Up*?(yV6BbT5u^cQ6oX)!2s4ScO_&||J%JBZFM^@wf30rUxLP?Qrkd+ z=N;p>`>TDK>Vge*no!Z|_%!HduZ!V#!8FQI75V6Qs|anF|rwl&&w6!$V8u zkm~Pzmhd1D1gDt90+AyoJt#>jqjrHCH(OIL682G)(rq$&RA~nnHCQAD?VP_E8#S?J zJ*YzWXIqh;qP>FUHg@I^AUhV^)GDpZMDOMCp z=30Gk?A^qNcv{=?f=MVY_gff!jRaF-svdlR<}8r~bD0ryeG2jXt)>Cx zPgKJ+o179J)vbd|FRtP?wrp6`71_CVs%N`U(gTV#PZ)6S4to=3mh+?l93SBaON)N5ZST;zi z3X}zm-a{ZX61B~u2MfVfj}8=%Ci%(gC$y^SoYf0ml&MTUh~tmK>2nBKF%2pv#PtT) zT{QK*7DoIjY>%rySQ{4OYQzc+1@i;C?j{?wnw{6yJzjtHvy(s}AJHT&{+1>k&SQnTKS$^jQf?7el=@g9~bfw@L^hhgSd<*H;Y3Gy7T$Z3ADj2@u+WkLSy8 z;5vU_Bj<3JV+wxp*i3}nc#dl7vAhuQGUATR!;>#r_=W-9N=)0TWumMD=Z-?xyj|ZT zh)YH*iy6$GOU-vGGj%0O>Pu3+((Ue$u_ zPdD5(_eO>m(eaDBSLfe+!gh?kJa@K{*X%pWj&w}zSXI=pC4n-N>t5lI zpF_6Cq``gIJT+G?SdF`H<~((1X=keXFLX@Q_1?Zoj!q;TmqwdnBS2>`Q5?2I8C8~_H^lF+}ogSsafF2h?P^BLW`AAV{7;>ytE^4{S zE<{%`ANV{E&q6q#Titnm$6@{lhIsDo|<+_pa7fg@vvAo#!#LyubGK4&4pVW+~?l6lSf?W~RX-g?S?)dV*8ZbB zr}8ShS*RubA>iSeYjdy|AGcr5`A`})%G79*Jk*U#hV8)*Jy`dx(7%7F_?%%ql#`NW~0kQ2~siMaWr$=eIm z00=mPU}t|3GnvP@s#{NZ{rMJ?u+8j+XAkF1Iz4M-e`xqUWCHJQo@;*W^G!E#kKN@u zkEA9+1FqStcg@A%*cM#ZZ2HBc0`zLo7jw8*b?Wt4SSei#USFiQde@Hb&EYy?!9@-? z7b6=usR6_1g`K;rI=%Xxl36gY;fVJ)3D4c!i#xq(N{DtZ-}& zgK;MOLlkG;BA2^-*WtL-7G7G{45}Z8jEP9)j!yG5w>RW;(}vmJ#CGN5HSa`cU2{X; z)7+0PmH(WKaF zO{;6AJF_mDO+9P?lMR>m-DHiFrt57f>%r z!GaJXlQHE;{#L~9F*|bJHuF(a>cJD*-JDL6VoF=Rv820ubUy*}d1k=YI|fCJPjFcW z4N3&)(NAAIRs#wo@$#0>%AV>Lakprv=LFYlyi1MtnO$clZp%TO26R({wHVdyVo^2` z8n+-17Y5Z0c2J*#L5K;mzl$gYXY|uMXFi1VufBUv(g>+T(-}NKFQlBCl~zq-3|wz6 zQ(3{F3lcb$m8Vb2@-DlhFdWa??H6)7t?-j4+1@~8`n?NWo)HU2ppg$EZsI#jWgoAL zexe#PRK^HI(u%YS361dSh;helj*B$=L$Cy_CDDu4P3}Aux&ti2@zd)fbPl3oLI^Lv z2kOCeSM;?$EURc0J!}cy+oV;h$w~+rlgpN?4?Y(cF8MPk7>m`0Bgfx-3=an!oTVmJWI>c3f7vd6o$-!C1XaoAPTjYj#rE5(i6%;UVk!A}&V!tQ6inJX{ z+ez%IUW|Y64{C9*DioVF`$tlgRs}iH97Uv{pP~qwE6WVEFv4=Qe@Z82k6uw9Z{y;01HZ$8CA9x zq|**>Fn%;FKhkPKSuUofgaaS$YCa!hd{Kw5-`S$D&LQ5%?Z&6tjo_zbXDuM;%z0Fq zRLE(Y`NkPC+3|r6*X(U)5eVGJn(I%~kSKbZ&Wpx2H*=)59zSWM-`U$sqNpfT(+)x< zZL`D(e(R+sL6OW{gWL3FFaO2S^hN%>jg$2Q(5BVMYmqCNXQIn(lhbXAVs_-X*j|m9 zg+zR8J)GOchL^4)Urg`?2)OUqz>xvZ&}V8L~ON+w5N?oAk=FxlCjCEn+)Md zqDs;n<0=D9xRh^*I3;4umMlC%c&|s~={+sW%4zB~?fc_fJwj2wl!qv)?7KBAid=`U zuOIxg(?>Cfipd5kqT*{8$4ooY-A&tr-iXWu} zq*A{nkeDb{FHFDQyB`4yGb~LBiIA@60wN%*M*iUq!{$J$)Im~LNh+$inXuoAB(Wcv z(d7_&$1yn{IGG1u#yFT*P#$>KZ4cMg_FFuWw zAbTu6eD1C#1wbL0ZHA=Y*kIV~IFxV)R}M=l&|)5~N?*?D5&HfTSK!@%C#2j%;2MUe zCg;EaT$w)y4)hEw^?rItTt1ijN?Vj=L13xALe~mXgSiv)yC^ut9?~hV=ULR~qrL2a zOY(&oVW2O;nA9Mt} zB?GI5K3}xhI^7GI5g^5ahME})=2~c=Uo=5fEUqt1X4`}jAIvKKF5Xhqvt@ z+7Dym05SN7e(}5l8IA{9P3i2e02bQ1Bi^V8dLsHeN)3`mSvvaKdH{fR*$kZDPA?j7 zSXkSt&S>(=;(E^aYd|iyGZ*-|a3m6edI*A&&C*lxWW<41#tp5_!QR0c3~gF0dFGq7 zItb5YY{M(I)@Yhtr=%jg^<#{8zU$i84q>6oI%|e~u^`MylXl43ceF^pcRww3wEl=t zqTI9u!$XmTR9~3_+l_DDI-<5w5bBGh^x5Hp+3|AKb*6A1OW@S8!UQF8&_)>gPLUvG zf8x$ufOIi3cXJ6Q$OQ(l)3&3{JRHl^>LgecH%aH5XfN{#z8 z#>@ZWw-TZ`c66(Dv(k!>G(Fq+lo{R27~9MuMbI5M9d`=pltFp z+Eg)U>0;YP|JRt@1H{i>?!SrORPju3TWG>id~Re$Z|~!M&*qT&y;m+@a+;BI+3TSJXn6;JFEw|M@EjO+3suC8vL z)Q=2cDvp(S2QOdUoz$?=r(;ukAZ-Z#B_pgZU8E{=ypkQyyQLNen=e$AOrTKpKWFZRHD2QuZhh@1Op>+ z5qBmML-tuSN14hpjKLeDN;+r5A;)-Z=28AR2qzPrfMVfAOE5#+_PsF-A)rNJb4lz9 zeDSv-`O&~I0L4k1iG+D7b^g8BA15G&MXVl!ert6~9u+gOWiNUF3D8mNJ0Cactf>>F z#4Txz*K}gLXZ~38iWy5Nh7b^B8nh=1!8OYY64?0R!l`~YI!80J%0bA5nak@K92Bi; z_%F5gi<&^ zWSfOXWfXHhmJY9eSE8j4yiA6lh&zUhivoImVqo@6cB~bd_ugmC++`mfCNgQj2*tQ!%KSm*FL*YQi}GFYQz!TsqP(cru|jjVjY=x) zmR^&eVIk(0D0uQSGQ=m@%>?6r`+o%Sg73|u6B113y(nQe7HWnyrJI6@)amr@K!(DS zOG+TGVzmP;YVaBBMNt4(N$W~IlW+5OI-Rdg=GkK1b{2WvlqL5C-Dm~+L9CVG7rHIB*I~k3YkT6F zdcYxugc&w@&-z%E1DT^1?HP(Id6Jr*>D#^6ku|gxvLIH_a!eDQqTP$S$`k(e*@JY2 zFUn5bL`}tkRtq!8n%?Yk6<{gal5S~%c@ii&K>$0LMq(!GKxppmq)GQG&^&K2y=DgP ztd%59I0FGfI422$wG{Mk(ewR~=cyB7HR+8)PNz#2>==JVu?0ED%N0&lnhH&PJ)l_W z&_Fp7HSV4je?R-vN%c_G^yskY3`$co6A~{glmw50B=$_0hCmTn+`yp&v@nP@9m$8< z>flQk2PF|XYsW$&tN`83^(UYA39hGSuP7bNEx73P(EE?35M<6L9A!mF7;2DYT07O9 zl$Z|$_(~e#k#hcml`Ibz?~*d7I5KbLYP{dUhgcw zc-(tiB)z*^E9n<~p3uTG(yul50$i{3yn|!eb@Sv-R`MPY@B1Fcx^!Cp(rUBbpW7#O z#^{~FH|p_tz5PHXf20LCs(>Gi~Q4pe#0aa=7qg4zm-uQOrJwKD&(q{M_~ z2b1S$gxJ3Ze#8Y@;Nt<^5Lw_tf=nyqF#4q29xl9(BF`$t%wSjVd?Io}jW%Q?-7AK~ zy=$;eaJTXw;lG7wE+#k(g>lRDj=wh7O1{oMp8AIQ7pC%D9Hj@0(<4JZAKZ+MCx-3Z zsLppbu0KWbbKJs(GhFALG!+)*1BCZ6F-l@Q@kz_Zq5K31V|hK$*gs70 zcL@r5KL;@}>|$rslzG{7;c)<{qtH-7Gq`Buj-6gak}$0&sXTSBAwt?;yve;^p`$)4 zO`=qMHK*L{M>0g3u;8xtI+zv1ELy&X%cO^B)Yr3C{27hWpQL()vrS_qIInBA5pGGNi9IQ)_-5ivZw1pbI@bo?;bZykan?$RNRC<9- zPgM6k<)rM+*p}yHZl-W;+b1$D5^014saL4gtz5JWBuoMw(TGIvnB$N!u8b)zSW?2W zf|B5mTilOYi22x6bB(snmOnMfhj?yT@Lq?DZ`7eACtOcY98?%1Wl-ssG#NZDnMB0u z-~%H?mm7v}Znx-q5(hq6%VLiu;zwB0V0;M!GPB?iRa!_xI=$km^Vu)NV0-U_6*5s`cP@EsdGfRd6@!RLRaFr4ht*m_;T zC`@ed+v_hs5));6xR4$K8DS!&p!~F=e^e^}DU~x&5#!|bg{nC+@}gP4buYnoM>sC= z>wNY)=P(dIKYwHNxcSHwHm^LODriTb4LN80SFbVjl8x=Vrv~r9d%y1N%6DQlf37iD z<9$ax1WB&2cR2ZaCSJXp_QlDcgG4g7NFl~ z92FAHvom;CIMNiYb`4xf6zCivI}U`}WmOK+Ce66V4~R3GW}*hU4VF-}|I_>X)u@D7 zi}!+dWLivoCzyV3+I&n_!uMH&OYwdy9XU1sI}&UudtOve|L|jv{QyRj*&o@7x=-Phm7bNa1Ig`W-KI}|N)UL=Mu`xg354WlbSHGt4z39Lg)LEg=UP%jn zBip0V(8Y2^+ao+1vKMOh4F>->Qv9SLXOj1y_!Z>O}2iRhiLaSB4AgW0u zzhtT`H;|%U6zQvDAQimoGY%EIwC=5kYa&IRL;})!Qd1HNNK85RWW=ULQ9f>(KOa!= zwW~GMuDUijM-p5MFxlTPu`{@-cwlNz6d)regoZi?T(woEIjoIF;4&&<^t{yk)-lg& z|NbFILI=)ov0wp{R5{LJSY7%bFh<}_=y10)fs$Wm3`6NU(#htR2_kbg2J>L6gd$8; z&xaxnY}zMbu&2KPOtD-rEHSAjDLd`Rs3WGS{T9+W1B*8(f5KEmaD=n6sKp)QYi%Vm z=UTGcz}+o+fXF8);uGD^Wg>ec440SrUp|vh5DGkQ;7DY2!^B#{`Eh&YYi1kAA}20e z`IY%l(2G@l{TWIx?;Woh)7sXF6`QCaAH@2m6qCk7;5poMkic4!{tT9%f{B-Am0lRX zF&k4yWDLTTbVW7t!>p9o=hGxe?4(qLX{RvgpuKI0^RX;J6aRTv-3NkuQw4?c6iI5F zHWh~**KtXVaBS`1z*#e9aC#N!&-~^**GYz%H*%0t#CEa z`D|X7PP4=M{hYM(fF5CGWs0{x&Mm#BUdFC`CZdF<-|WWIQ0o$A=#Rvyk1wRZLZM1I zB1mTpaCAIkev-r?tG^kg&tUY9M|hGqC;aUf5gs4)Pd`p+iNKMJm_o8QUbai7X&G4= z4EDgEh#;srACwzlI2kdb!H8baiK2r7zI|_@B*!D$8T%)% zS-NM8>&$@VMa}56a*VPi=Fhr&{_mEY&#w~K`NEOi%LVL??NtlQ*fcvBzMp*TDSArv zue`(siDO|b-a^hZ*c)=O;p6$rbI1X9tj_Cis0wH8Ts^DNQRb3WSN^&yqex4Z{zV1f z=H?tjoK0J(dFz5ju%^i=j*xe9(qujyi$1UXMRZ*A8@+-R^mu@u`+9seD$cq2*VU1Nh~1qtVr>Ma5d!1{$vDuehMG zabu=c!x63mI|FJ-+PM)%d_-Ai<7o(l0%vTAzmORBMajKxrQtoJm7udpqm^PaykoeT zx6)VSZn17g4Z?{1J<>W>ktht2a zJH*wDSp6Df3u{_GL2`NlRHN_NW3;@2oK1$YQhXq-PqTQF+(|cKN^#tT{SZr5iwo^` z5xWyjT#|p677dIx3Jcj8Ypv1Kmew$1HpOs6v+iW>U*NC;G@f_^Gk@pt?#)Y91yBM! z3q7LxWy4<11~#jwjK&vLMlz8nUSy;?B6aMJ^2kQTW~o8dhJGgjR;B0Nc6(%n&n^{%d<)i?dje>!kxTsTs9Y8?X{+at!S{WBWmO`A!EHFSEk=N#*z6?_PI zZQI!`?d)!|Y%F=h8eCWR_z%56Bdg; zaqsyRz4q0Qlb6HXY@_7$p+cv>`Gkm|HT$6^C{FM1`NK<9!JKTcExonJs8zc0d2$5z@v`lmZXiVrhiH@4Q5)f%7Jgk3 z?p;lslVILBEqcWFXOl^K7OcT7ay=3KzJENksFb0qMp)3{8($~?XZlb7ZXpc+!kilg zvm+clWs|{Isg!0TVDh#qN3GuWU>NVk<`Ao5bDvLscCq5=2LEl^!Z@S3j_*{L9pXPf zs5dD4QQ%2jT*p2PkWzd7zD}vivUq~k4nt*ZZheb#|d1%59zBAtb$yH><%j^qBm%0`;%Xg+bBQGEre&Cfb4BATy#tRckS~=PsF8&G$-bgw0TUmua7W9{839 z0mI@$DaGBVj$#BL6sgBvSwT|#1m(;I^VwD2fBYZ(KCpy3XlVA{^uU#bTr;^Mtr$rv(mG^AE<1HEIj{JaDjz9dpL(o+P?NiYwppQ5MFj<UX2W z+ZMNPKzil4&1Zx10}9Ch^U@SxC?KE$`m;vW`u+Zr>dYG}umPI~kuWM=a>Dr)Q?fouZxwlk{&(*F6Xw68+J_M20ytu=`XX%o zX_1BW&^a|%2@_GqB;MfMmdh}k!TuAdi?pOH_3Oci4%*n4_2wa6F-Ir0C*w z|4pJv1JU}Q4$_ole1qtOedt`MZAyb^VJ~5B5QJeO!Iiyo05$Nc+M}=W9!m0%y}qsF z|4!+@b_fO`WF*WWXCmRPqD)Ok&l5sQ5qCS6%&~i#yTNZSRxbBEnL%Kpwa~U)D!=M9 zJ!jif>NbzaMq0z$&sH+9%3T+OcOjH(Ph{(EQw^EUF)YciXcN~ySnK8n=|nRoQs*3| z-cRr~(hLx)jYi1Sx@JO`E=;T8Z*OjB9|6wM>tKKQ0VJI0!s)IcmCCE!oj!~AC9{-E z%?Xu$)c?u-f2Hvf2P{|)a5!4>!U%3}N1nRiyNCTH-dR*jmOAUIm^|)@&!AW6?TW>a zEp-F$cEL{8GNt6_TyHoYmO`2S;xlj+bK{Pw_a2pex)IKZdU2UWw;Utin?1VpmnuVf zYR8M~;&U|A-AID=$jo}r#d;3OPTBH||``0*IwfH*w+Re(SvwDV|Vn2v5Mm*7vojk!@#-SO~$Htym x$UrU-AR@;s#QaR}KPlD!*&YAA6dI84{BYt&Uo2X1JwLuLNl{smDj|LU{{@0Dfl>ef diff --git a/content/en/docs/setup/production-environment/windows/flannel-master-kubectl-get-ds.png b/content/en/docs/setup/production-environment/windows/flannel-master-kubectl-get-ds.png deleted file mode 100644 index cda93533164cad8c145cdf8877940bc375d165ba..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 25610 zcmZs@bzBpC+xIVul!OR~h=7Wo(jb#A6#?mzZgE4Tq=v2d7eLjbsXP1j?eM_@Kr}kg^uPf&6O)x=u}_7(z|lyS|921b1Dkb zZ?uY#6X_3`yPnF+D`kE6R!LW=KfX3`zjB53*5wbGT~@c8hhS7weENG69LK~X}!X6 z>i1_IEPa(DDCW6}wafh<+sC+zvzeMrc!cZ#%W{*hh+q1D?z?=CQ5td{G$mJ^En&mg zn_hwU+TDzQpZSCPqv`Y6AEJN2-&{Bq(($k?x(V0rK&038zZ=)r04x)L@b3yvoKGj% ziPg1pQ<+k*^x}ny>F$EX^ir&sl{)rVXQf&C>HyV>(iy#gLfh*C(#QGl*K$-L2b+3) z$ztiMInmip;_E{*r&2YFx(IZ@;KxJd@*AVSZ3#%oDbixs8;Y>Fw-pq-*%7%Ami06< zjV{!u&n*c?JJPr$77jTsfZWxR-RZ!6s(gfZONLM4zr_aRDv#{;Hw({)!VmC5(~y%| z2s_wNxj;NEX{QPl^&fnn0Vth>&&CD4BR}{mO5vPmo@R_r% z#CeOy8_^B*8$e;1^p9=S28C8)0;~1?iDl0w_wyw6#i6f}@)hunE9C#%5!og?u=)x8dylLb4pBP_G=z*I)hhtc|$@wTd4sc`dayrBP zfEb7%&HC@iETrtx)Aoz8S&KO;Ur4tirydJ`1T%29nKTTObSEluYr5^1(Zl_X1@9Mz z*r;`FUz~3n<@w($+dh2KcL)!(LOXwx+l#}OeGKKNJ*q>>EuA8r|H2lt17lByG5+e2 z8*k~88@FQ+gq?c>qkTt@gBt{!DjCaNRd zgw_TGPqQ+H&i#%J+?b@REj>B3xKnzj`Xu9-uwAL|T!cyHQpCMV3!&AiD*&AW-qGsPWjh|CqF!ubv!adCn;XsSm0SC6(>wb^GmTt{wB zZG(?YlN)nn_ol%}jJ|0uFKDvbd2dR-cwX$>^vKs`{(Y177!m_mm_pGWJUINl7iE(9 z8+}AzJ2~H=5>R|jjS+Qn(!B7b^!>EMI^h%+)ib3eBz zSN^CTTl#VekVVAc+PTj0=45_-?wNqoHsRBk2K3X!K5u$q@J{5i7ink*C}FXb93DCu ztEZ6&LS$;{<*aIdEbQBZ!`R8YXGB*;?UH7>TQ&URY+K=U8FIdi|DN2K%hx6B(|Uu# z^@Nf38SleMh9Jfzx#H8~7NX zHkk{w!^y~VT@a8AtPOuc!?55(7z=t?Zriv0n+m5?$~Ptb6u!w*w^|qmf9$1K+Irms zaWdsnw`Nc-oqkYaS8CHnS-x`wN1VWirZt{zK(>#-<;MVjVLE2>ZIK{4$m?|Prge+r zrWaA9)nzu+SNWdUGj%e3)GWQH{S=Hgo7OucG8r;I1GGl&0ysMo+3dHI*7QY1uhB^W z6Em_-JCT=*`Piw;6nYG~*uJ3KCQZFC)}|Guz5UvhRJr^G%Cy@9*nlN~=iyy#!Th!l zPwB98Pt_ava59U7@PPWUUT5*s)vR;-&SfLWfsq4ICu~T{mkhp_u^muto{pon`<0Ti z$(7v6%h{1VDStu4mcuR}dlC?RBZ@~5;y3Y*DOlz~2~LsgSf?}p?$%NkftEbiIcwc~ zxoB}P;*)q^p*505PJvnD-Q&-d)&~(E7k0S0h~32J(WO@}w><|7!>+{Wk}GwiokHTW zIBM-*o^_obYzqC^7W!HX*Bxo&0#?JR_tD1nDyqq@>WOvgsGZmUR3T z7gkp}n7sJkgYDm=^?DEo`4QFEmsK0ztdFszP1qpLzmwlmH@WbZ`DScmpJ$mqOT5By zjzUqy_s0z(wUL(lKMhuM$s2c~T}nQ4028cVn?!zmufPXP;K*B9$%)Mr#^#osF1eh8 zGBO?o=vi+EZu@7cNp`4zX;JNItNobsgYAk4EU*iZ`I~Qr0L02&$7no!k(x%@3MYr? zV==s;ZP^01q9o+@ zO)8&RMU76$Vv@CS_ImM4JS7BA*={y-Jp4iBg-FHDrVGSB=I9z1p(R4$@s+H((CeL% zSF|e%ax0!x%!j{?+wT!Z|Jc!RRX#)>yUvG~$FY!;gM)dQDb=?inUc&Z7Fo+2bsps+3%hb~3|0g=l#4F1M~4r@tl0i(LdxxsGAHo;=CgCf&#o(xp5 zbZBgKTU3+u5z45!vLSq+m6FSx<)S0V2=z>K^k)=ryNI4k)=re&U_&*n{xzAe!Z^PO ztl`bNf~`pGr_`X<@_uSgpp7M}vA%R4Lx| zXp5q>k>UWGhY&%N%4nC>0c{@y`_pVdS@I20#A!guY zm!-5>FqaX>G&N8rR)%7fIo&Z&+m}h({IOHmxMTT81U^)FkV~mEst8)xam0_<3dI3-&c}FK4%m)aJdL_cH3UcEDcFfMP0_U=Cf&KL6>xEj=w>R$kI<@(IEy&xtLv zqDCs=h zrcccO^mseb)9yyMT`oPcuXczT^~V&amFRNLh+vk9cv!h+J;cHW8cAebH1}&)*{!D_ z>>&~;J%=_*#ylExxX~zDa((^>pIHGZ4orW3dbHTtvAwciZ?5THqfPl|>+Wl!zIT-^ zRemYrwm#toWtMCFvt5;^*jZ-a#Hah;!DbH=RIgd~+j@R|QL6QSObmaDAdV1GHFt8! z&n8Kuez!!&7)9l{?{^6~-s0h&t=S^R`cC?ZGUcEH}LrOdbz`P06R?M&rB_DBiwud1qlCfh1UfR!yAoA@ml}=;!zwCUs`gJs~vFND{bMB+Q;7C%?g3d5RI=O12d(7l-*u+{|4->!G*wMlea;K=%l zoz*nd#4AE8pK+;{2RuJ*v0>3D4);85?b7zWnI#G(?AXs13c5_HQr7l&I!yx1LUS1( zH<#SB@#X4DHsi&!b9U5!8C1M> zkHT{>9w=L7^F^De*GFiznzLQHU-mSAcTA&BadZ4w!={;3Nxhl45Bzf_c?bXs&v+%| zNVAzDvGgEiywdun9nC;h!DKCNwtaV#XAxD%!t~&Lyr#;@Wj3*$l5B_-`;K_ zty2QL(=h@72SZu`ZdCG^S)1&1$i!~{9Hy_tDoq}iJC|Uk`}%e#5&`w#r=a!I(cuk= z^`D$y6J4Oy(I6tj$0T9S3Aa(rY|Tl@!&Ye&OY_@xiLr{RCj zO{K9#X-Kh@39^p=0Q#5eGcakfdt+pK`-I!}FH^Gh4gd9Ne^mIG4WQYXq9VkUP5yAy z)?rLnh|aoI`<~&`5K2&=rbsZYK5RR|<-nSa?N7tR)Rs7x04*2#)C2y%1>%1zD!K3$ z-n7ssbI-2Xdj0eAfsGKras!hYN(GxA({ko9+rgIRMJB~cKf+j=Qr;(AdD z0|GY9$gQrKxo3DAY)RtvY*)4FtW=2{PND^v$fA0o5Kvh)HONU&Q7fgNBNIBd^v#XtiTbG7B1;!l{tkNT&Op*d$P|x21-u~;RrUr!?xiTvEnvS6(@gVW? z$2e|#l>bH`pf+mwT;Jx_yHMMIdZK=fS=Q-3yGQHM{UH2}w}@-Sh^ShC(NlKFTQ1>}+%x=NsnQ#s-5KEDa$lF~Q*n1137jhXMFL=9 zRt}cE7PT8q>FOAw2e}pIgFF!S+KgwHy&wD`$w^DE3kxH7s>t6 z3gtmkgwyKG8lAmD6}o+6;R@&Udq1^h!*a!O_KTiM{&@A;kBk4Uvj5d-sIO8c<@Kvb zciWYW5^4~`LB?7l|9q555Bt&E*8|rg%fF)Ykm^ipMN=}fY~6MA_T#u8Sd4Z6xy8wM z>ZZfpnv=V{@(EiT>Pc=_OM&R5Bt7%q7Cqyg*CLM}!NbDboXP<&lJqqHJbI_>%6hvq z^10TXyaip+_FBb;4o%5?V$n}CGnEO<7xcP_MJ?eyk-d%Bp@&pe@9q$OOmb?`z;ae_u_F_hf;K{T2)c_86x>5W z)Ul!Jg?g6h{mu}N4PL<98!f?%g7^H$NtvLujP@ZOJ;D4WXt)v9T5Xj!AN6zKJDu_` zCe*!Y-j*G>`W%W z&sUz{6zsv15;0&M?ZGZN%QcL%=aZXqyil4I$kS}PfMUh(Nv1m!MztZLjjIT4sb_8% zN_hp1|86Wb+*c)}+M!|UTyN;@gfJWjIT!b|_}nHx6c9JY250SSH1H2U)eJURfRNe_ zGso-`MCZ-RrUE5dqa9K51+Hx8~d_!s5btX(I z2GCgLJfB}3X)@U5z2;4e%DK?XJrGfQcm_EZtyAu+14IYqKQPRVc=F zVg+KY)pyRvbnSFqC}%mDlfrRpLq#J`l(b<}WlFGD68^;* z${7{A<_lRwK4;Sl^rSG%p?x&t$TektTgfJRs`Mb^W7pQ(%w^L2Lok&Gz{HXQ}IEa(EdUEe-0tY(W$$Q0PT&YEG ztK`;ezJ`bFkB(vg8v|0(+|vB@xl#I2Z@^~Zcs`ZKb%!(%#<^l>@1sP^n%4jC4-OD`;gRatO=g;u)Zq5`Wsc&HjUDv4Ot^*A>{m9KnFnBkOL<&`1!PN( zeBoOo4OI0;54vz5Za%E(EMwQ|T)JD3S!R)EQHf2lEecwI*9!|_m2qy`dy<|mfN?ax zT|ed6#stp2PV6csAU#9a?hVC0%|Bg=gY#-6kL^r!Nf}(!wJtNa3XN)wm5-E^&di^_ z-wfe884Ns?l#TK2@8i%A^rx@(vR5A${|W)$az5SMEO1LLF2wgIB_`M`wdVEeFX?x1 z(ONGfUDhGGQW-S-pn11cKMwz$FGiW&kveN$=o>OK{cQ}>FQ+G@Irn-4B4onzs(tt( zowy$N)d=hq2>cv`9qXQdH=2AMEdF}b3Ebs$vH)gu#+cD8iG=RGF}Zz|+4Ux%R6`_` zt@(7krmpnlVS}n(48a2@ww6Rd#sbD^6>y{ zQ?M_+ImTPZSm$w9E1IQ7L}oLPd?DK*B1T|j%~-zVxs=kVfmFBZ0OZgPQiC>-CjU;# zE4>W5=OvynqphA$lVr%Ovd~f90n{fEZV$;Z)AYmre9TR+L|$OT6V=ccU!VDa_U!KEi8rRu=r9Sgc=GuEerd(D2`iGwkVsXF7+#&N}M zeJ}Dy1=2Eteo?$H*2qW|F`iTn7iK1$U#gf}kR{g+PCa9;@WqVOJdTKdbcmd`;jL{TB%+@mH=@;U~8b9b^r&dd_U;A5?$}I>h--o zZ)#VSvxgs5rawgzzYB(?D|zH?NJ@EZp^*V&2Zsg)fTQa&eIId~^;7WFlB$liY^qxJ zW27Ef-9jZaXg}3G8k({Gs$I*}&E$)_^31-!OeWFtd`^kI+;WX|Av=w1e7$x7F~K@W z3~BmOevqP$&JO1^b@BK^YR!DrPCwFBNgh}mVl4O@nPwKg_W-DBl5o4OLGD3{Yk`GF z5dw}Kl3EQ9$7ht4&!nrxx^2=(jnFjUS`x$B+=oVWRXD_uVWMk>6i<30motwV?L23~ zdS z>UqJ2^-&fKALjzT$@&rSpw9jxfvKZh|9lZ!`Rq%w2JToDsLAF%Kq*`1k;gyeRokhY zworryrZh;q7p1oi($QPb^X=t9-wnw{+283L9rzgadE*t*WYrp%!$t~gisoR3L6#epvCF_df(Mo zc1DQfp>^+7Dp1~h3JYlc=(6EsQr`vK61QRPN}rvAOkBC3Jo4(9WBVQyAiB~;aBdPyBm0+k3ENE3>BKQpej z1O`60_6nDo%x)Hr1Z+jN$O{KQ4IA{V76hS`>6Kfl#ZA@f-Q}5`~N$ zhYo|9cFhtNeDCdWW6?vt?t4GqV5`o4yJSWBjQy&YjQFfKFEGNs)i1=d_}-Ahrzpdx zF45V3&yoW0p`l9M#iyNpX=^SiEye$cpJRKYOQLy4$T^{uzxi3;t>H*lW zOf`Mal!6@uY^eelBk*c>Q5;8mUd6Oay{I21)%@PW*a#f}e=zufUC7D*?!{N{wH{5~ z&vw9%j+|WHJ=?q*Ok1WYYuwcv>MqN5q19(f!jbo zPUU)2H$w{X^`kfAaFb*ve^Rr^8p3yNyw|PBYqMNS;B2`5AS16StL@Xo{0TSq1IJY{Y>}zomJ9q{dULZ!f%WF> zU6LBkbIqQ~N5ewSy|eY@wX{ovW9fBMn1bDm#}RE}@woG;YAOV1>E#+(v!ed0)jL-A z^WKmY&1VDB`PPqwCr+b?qi3LiTKj~2@#x4kFk3?5k)Pcdrf%wKJd-GTKYdxY0NhYn zOglVi(l~3U{JwOoD5N?gQ&7CWQjODf-VP+WwRbOBpNMs2`G8hilh2GAO|>^zieus2 zN}}ibYL;2+Tf@^=XY~%j=$?aI&54q%_3Tii@}4f>R8QuT*c$UXs@eZgD}OSE9ZtN3 zdo1g(X4h=1a8R||k@(I~^ZsTi6sv=BZk~{4f*E8L<6$3+ZM_L0g|b}nl|xHXjuX4L zWdME0w_rt72&Xhg*oXRsSj24!;4tlrU)7Og%9(BKN46+k5a6?n{CCJxZuO_wT066u z3GbbbDP_VY_&%Ucz0}>pfDEiW7Bb8W5QNEss>`Oi>4mtzco~)#QIA4a)^!vJ zFvg7oeFXhN;;1A`iH42p10#s@gNAo5rFd%Xq(`@+1pdbVgFe-X6R6aN8iqns4oJkc) z&_$w~$EG@Tj0;73R`}hPXp4G?K0;iac|t3IXW@xt@s(}3H(;$B6hNhy7MaxSbWL6? zt#%PfLj}A?rDH!u%p`nk1D^Sqfi!+sJ>oK<$P+NFoS?bbNh@%B;p@1Lhfg1r5pS*3 zO_UVuoA?=kd>rDE-mT^YB(rrk$Qn!ijkz-@2#YiLX0U|%0PqHRYmAoxzpM_=TY67Q&i!{1KsgqAi2JJFLLqOHO^8i zd!w#Dey*>5*5n^(bM%A2r}JE~1`x0R_TXD+sB&kX*gZ7E>_2Xfl|NqjFnn%rH!!>g z=%!?C#)lTus~=SyeDJoXB#XgYV`KYxIWj&`=^fTb(87RUfm8a(7=;s!=pv@uB@Yzl zzHl2G^xNM8*Y8cQR)u~#%^yW6UR69fIbBw;I!a=c-H_l%KU@RXP)(!t`0m-HzIao% zfhBcF#%-5XT@AfzZs4d}fr6p{p6GtiV`Y#9A^sn)gx76yWMa%RuGIk64c^&9w^4rk zEPEL=(}n*U^)=7bpAeE}YRiLO3Xcs~;1)X`Rh_TfV$#T)h~lb@l|4}_ZvCv_^Zq6; z1_VVAI)#S=6MN#XPuJuk+| zC*&O&^yz7p)Qy!?7=1;+|BJ4iT)p~^d6@T5zrCUhdC7dSCAS?5A(6I&Wlhq$+58_HyAl3s?}!T!yOP zX?8XCKb9fs%04&{Iobw<2Q=hm-ei{J4eWn!|9*^LDj^Vl@Z)Nt@f3T3!p`r4k8Nnj zo}!oDr!GrO!ay#kUUhZ-auT47zIR1eyLvSukFX`G!)bljp3>Edj zO0AaZ>qqY0 z$wTi}k3u^#F-``_FN}&?dHRlN`IBR0w(5LC*6l~MIl;m&bS!xQv3`R&6zG@V=oKF^ zHhRoe5#qG&4@@qK6y7m{C14f|I^&lrUSBF4y<+bQu#FsV z5Y`T~s|qNUJfg^-d!}P&5T$!klVKV;Gn(e4ZIL+LSZn&f>;0gmJAN zTVB1rJ#j5)p<32$GbL{%d%<&8cqVByh9RCwYh%K$O*_SxPoIPp*{+`((s-P z*!}48mg=eQ+jyreVB@?LZ=DE)wdK*ORDecyL%rLkQgZ+5Efuoqd8sffHCl+LiOB7- zhp$GYxD`1~@pB&8O8D=}6yGY5qE}+bVv91rpI>!u7 zF5us02ld?k6&?v7xqDQ%!n#i4Jiar^j#fv@!#&Cp@NP{#0f*mo-sbl>TAY@nti5YJ zsZxm2yWQOD-|eqn;sOZbEwk&r?-B5~isZZ}vx2VA{LV?Y!ne2*5L=H}GDU6dLz;F% zC|-sK7J^h0ztw1%d|q)@54E)M`e@9aB^lz7L zPmLs9!*CwX{S!?(S(5llgD& zPU1lnx#mZ1e89ka5*KDKoTelkKrMp&l!JlSu8+w)L&-ai72(S8&k{Ex7h^{kIEm64qL?!MXg@%10Z?0|u&2RS(t)YM=hT zv6EbpB9q+WX6n0Q{fz%rl`U@p{$+xI*>_s$sCiJ9$R@02Ms^gR4Au9vGXFiVeO{jv zz?i?)H4H9G#I}uF&|pvP{i|Eq@@kv9cHMGL$eGoC98wjYY*bMjGVdg}kIYi&JI5VP z>H&|Ggw?LO7gJZkC{(L?QRbkX16>j!#Zv2^o@`Sz^RW#QS?fllPia-8Zpclg$o0yZ zZCizNgt4*c1oWb@VA6Og##AHk8fP)j{E+*_`oGYp)Yb6;*NY6Wm5jzk1VI*is*E?Lmw8yjcp5Q)mqoVSR39c|H%0C)DWNjivhO?3C&R@v zQ;wFW6`yDJ%=8&F86a46&DLALvDP!nU$R9)d-YDTzCA8%>doX=?+xQOb+$7j-(jGf-Ihz2fA*O7VsZ z)q4fBTwgoRP7;lew-GnrPeU?1Nf6&>j-F+Hl~i5OrpmQw0WZ7wbK51COZxHQxN!Pb zg3ZxzKEnHdpi&a+oT_Ne9kFLG^g9FhZyQ=tlev!*T7~YsA zJn6xiZO&GzNadYzqmQFT{lCARnhR4<;_EmYNVHEAdg#qMwe2@9*{Mrn*4Y&O?>f^0Y)QzT$h|^7w4MgXG+ylKGZ_khYhIWCX)XVh;B%ShC z@9g!``a@{f8%CP80?N1i`Vml|ye}LcAX#!LlO1pQP3Rr1Yoe8*<61;1tw_1>Eu)#V zgEnCgT^Q^Ta>v1%Ks-0rj8^*nr~<%KPzcvtRld98cX>&Fzx7NE5^c;tn~@^V72 zrzsHy6*&6*P4mP9_3fk1D)*(Hd6*w1*T+tgX~8ohp3&!LPQs_#dAs53-h7S20yZ*< zqEE6qGc)3)v-Z-LX}8uUH|m(MeA=!TsPa=3{*qKY*dI8+w_y`W!W`}c37oc6jU;3| zI=)m`EtM9l>JM^lSsJw*oM-W~lnOpRxEof++dN)tmdK?A^N?V;1;^gSPu8Yine>yt zrSd}Hx-CP_D#`w)8A+t;*VB5z!KLw$xU)G{L|tax!2JfnHir%lz^mugM8!*?-d*SRlrZ4+-xiY!Qu_*{7=ep}of)!l{cHJ2> z=UnH*2J#BV-40`YF}7ju8SCc$v~Z=yGUUArtWOu9h_-0Ph(0B>aXmPxT5!@F|CzN! z;%ya}sjG6C?6QnrK9sE`6FBiQP@IgJq80)9_Hmowl(=z4+#{c=79OdO=$($2pN$tv zf9@ENCpsY}j;c3qj{#JCh$QXYVwM^&870O| zernV>$I?D?zBywU`eo`|qyHiH2w_6WgqkY-J-P_rxKg!?i zKkkt^^5s%s8XleWe(kGRnl@T`;CNPL6Vtnwfgg7Pc8Y<%5ScRZAvh8xt+9DDgAbE< zV?rY5!~T>xS%r%0-41n8o(!y_f@J4r2X;A+4QOx^Svp-Ng-@nm!{a{g-9xgvW0Oqx zhK05hMqwG7jzj90fT*+54!4-OBCC9xlmp> zwvc3XX1)eKE!~y9pGodj>R{nO*dz^^)N8iVn>YQ{KRAC3X5YBA^%Qwe|2k_9tIhbH z_Qk$7Wps@HonEa@XI5-ZY+b8+aGBmWo^kal?G}>Ym6Lo76i_H`XGVXzq6%0b}tOm+1Qe zy=o4&e)&6>7fAAg#MdspNfEl?-sF{(9&m9o!!^B^c{B+3nyLpZup3m69g_lH;O2rRvmNQe5w!y%=I6V~S;=e%C;|Pgx-EjE{8ht^MiPQv z4rH9(!jZaBSU8b!Q{};0_l zS@-+x+o(d3G2Q-Isjh@G(YYfMKfjAlD3ArR;-JK9ocK?^$2%;zdb(H{(fh<67VG97 z%6|GYL+6*`csTtS_GS{Oe`xoyoSPejX~n`#gx zIDAy_pVN{u^Cj=F6%{-%A?n5g_PcaQ+`>8%hGih zH1ZbgUtMa|NL_?}9GVJ2%bt(Bp}^)xmqsb#Wa*n0(jx`B-)(#$LIh#D$;_nNNU;|%~IdP{^KV<_V)c$`S#X9!BLBZ06N zqWqy?!@Hepw-tyxW;E}k0XXJRh+)Fs-DCo4H`t``(~ye^pA>(xH5LV4U85`qhWyNj zJ==g`1Gn5^{Wz=|_ZtXs)!y?-R3*7J=Rc6VPgu2fv1QfM#kZSdmo|@jlZqQIzFp=i zdHQ9p3EvPV(4O?fuAE~Ci9%L@cRUu-C9+zv{Vi#v=3bq_*fGX{z-_`A=Ou4Go2(MN zRned>Z&RA$sJDG2lK?WGioAN#(ZDi2se;Vf(!f8+Q3A4!jM9>xbYVBIilQZcquVx*Mt#O#C3Rl{xe`uvWG=!jO675=GW%4 zDF7?Lh6&*&P>o;U&K%APvoL$zcOamib>9<{CzXSI2d^{Z26AO~64@3^#(o+QqBh!Z3W6-{{ATrneo5&Wd3Z&* zqpIW)G_fZpwR|_J@owXyjjrDkP`Bwx_}sw|$p@yv7F=Jqi00V(7;d6#3IdAQ7=q6E z6_g&NBo68Cxjib6tTbMHuqjdh+UMinzJwQvP`70>%Pyh1=&TKNL{0>qFa0!lK_Az; z|0^e^2-I3ta-}4tHEcp=dM5^Uxh`0YWU2L=`CvQk7HsK-i(oeG4ScjVp_{TYW_z?p zcpJPXH`$0@7eyQGnFcHvx=F|^Ud_i9lt>pIlf!@Fd*x4Y3|Q30M@wcc-$EUHvuD6w%ms|+1{qR3B!c}~9wN}*@0}6em6ZGr&_));NodqkY!OY7%sA!Yh z{SGnTsxxrT;&7p6a^C!;m`NSsxpgZB?1+l>+3D2E(9v@7hEMd)4@|E?_HA*k@iE18 zp<)(gJk!~J0GOL-2sYyvKCvx8=1$ZQuYylVIMh1l;iZjfq~re1#@0Z0jz?=d4}9@?9^T0$0FIuS_Q*=S zvWvDXxOBk;=Lzn*L7o7a*y;t_)Gcb94qhQazZS{qm3Mo!pg_Rx)bFuW(;Ul(fSbzD zUWyc(b)RxBm%z_wtu+rHoP`9sy`G7|$UX>skNM8Jfw}T3DUNk5sM+A6FxK`qMC`|P zhz}0w816NS%32VF@2~D~HfxcPj}fmP0pnvY82{SPnG+ z_kfaNG?W>~mtghBG&?8M10{j)NKU9_8Fv|*AGz1)r`!D_?cZIs7xC|Kff}crl#&S& zzJp_rH)$1i@GQ^_DtFL>&;$BA_ZJs<{6)?>BB#UKMbzwNt&wtlX`B* zrX{_a`=PYWL^-^};Muuve&H*U%N4nnNw#yNU3-*I>C>-F*3;ENLE^_Nib+$i*cO#2 z_^H~|2-Fe2e3}kOZK!6sdcnM*^s^H5>pL{Mcb_@$yycB}iRI+NDWwjK>SFHIkTYG^ zv7Op_VSIbrZv(HVJjv$*TnHevu{KxSnqL39UbTYU1)v!?e&m~%>fP3kTs3FFCRwg} z2rj>Oei45!*UPH3zp zKL3&}U@x)nOAbO|OdoMNRdD6`dcWq9AF7R<5q*pHQ9Pc_{i@NTNhpwf@Hub4^@pZI z+o#Z=4yug)*JU)1WoI_wcv|x(VBAe|#_Z`UlYJR7>yAx}K|8YIb3hl;j`Y{i8n*hZfg>+(F`C++<#fQ%e@pLnPL^Y6Yfu~djn7an@I04!n zZ}WB8CG`v@8wt={{F2HhRKVn&`N!Dqi{ApI4R-qXSAZ zLrzm}!b#!lFL1m81%qm>-` zfX;*6*ZI%4jlD~2b+U)h9>P*)LXH*>;@ac0=R(BLCtkV2opbrW0Op&hkkvlpHVdtO z-rQ}6u!Kd;8%zSjFo^35F}*ZiGY_P|@9sJcPk;_C<13*|Y74=rbYZ%%L5ir;U--2{O4!LYh9q0ts5*oBRU6srhdBxNuHK9(%QY zI~Rog{p!kgc>Eqlb}S0Z>!vMd0SUT>k5}-B8p3XVr^-sGuX8wCYO3ZY*ZOuoyiuqK z>w4zN`2vj{4Lm8$;!zJZ%Q^0Yphrf@G|+VUkh6Ci#X?^pp4F`&F=C3Adl9FMpDdWP4RnD?J*nE!%-P`C0isF68^S7ZlElk$9%? zx}HsX=Nt9C*%^!G9g)<6XYoU1AVH3h;oVfcY)`?O#d}@&^QG|XXEuUr=7JD?aESf= z4$i}*IfR(QOtKA%L&=2muA`Vut~}c>wQhHVH0`_sFKkG{KJ(VEcP=7LFvG1E3ns=VcP zeS}5g$`1lRg}tzKe5bfLgwLJ5qG&feLCe=G&mH>QfnA3iURaeWDw;bdg(p*87!-C+ zmTOP01I$S+TIRK!C|~NZxew6VZ8v81eQd=OAc3kwQ)L1<-*A6iBgyZ>jAl}V$ z4D9zk?X?C)CDu_RpKbt#2ssuOFEe#Qq{NJk*%$1@27@1hb_P0sVrLGWm}kcWzw*=P zUnIDW(utGctR0?CCySX+Fg1s%_h}a)$wQMgTSPN_E}LP4TWTf66H9{&KBx9F#)4xk z>#Co+q^BR?=$M*Q{#eU&W53u)e{YFx&$*XCPbbcz0~`|4m=Q^BEY)`wgHD`AHtX|2 zqqBO{Pa+^;W-zOa1-;hu?-0BdrCFp%ZM-9FE0FHt*nNM|eF6c_;+vVfA+Z0DCAxAbh=6p7p#(pOBG z?rB5ybWvvs>n8r`GJ_0BBc7Yp!j{jarpHVFlHK;Y)A`JVO{o5zM(-Qd6L{E05jQK@ z*S7R(7#Xn8YGdKER!!t}VVb-?4`Zis(wS7Tr)}!>$77Wu4TVSwOun1sb)Ci$z*lhjRGF>IwZea8nzZbUq0v)hmITN)Df2z&(EPMRzsjQM5(+6)F4A5hBt0BpKVJDJ_^C?3`cs14~T z!-&6%^ZPy7rJ~YdKI{F6-(e1Z{p0OU!rH7+x}fCBI>nWi}qcJYX!kUj56mj%5Cm}T(KN%niqw|Q<1Ng z90IuxTi=xUKPcA~FCOf%AGwH$kIU6bC7VIC@)+|;Imlf@pLu?uZg^64zJIfyOFS>j zpF_$2{#E_v@2u?izs6TSo^e%d%e_c0FKF(YmnL^s>>UNbz~4%Y@cNsW73Rfp4ZEmJ zh1a2@gIdFX*-x0Sj!|Yp#Hw<&%4$~h0*m97PZxXcHswrz4s^4Q-OXt#HAQp}Sh&m} z^!QLpY#ZiEP-$14<55Euv)3@@s^rYQ_ZAU1qCeq<)FF%d)XX^@V;0xG_Sn<0drgHh zCGkbOr`o5hrPcfBIRctd%YvBFRm*?)P z_&$EWO-o|rp~)gi)*YIi{V$wT$-j$le=1))XLaO(!MZt6TlC1t@5~)5;irXzx{D^aq>N$k>+MHhofA=XU_q^VXabr+pN-_pRyvswuF@zhE~>vv@eweE$ch zZ5KeJCjR>wn$b4Qa8S8V$i0YZ0q)0V+&bG;Rll=Y7<_%z;A1KW*4E&6AJq0}6enPK zr+0_!LCWYDfsztSO>-kn&DUyT!0r{JOdoy31Cwx-E9GN-&l#lytnOV2wyBGJdY^Wc zq|vAIm(J#c$B5^Je9#2o`#->VlJzJN11TuzQ(GZ@3qoVuc^6tZ{Ngd`Q={G7P$GiK zdTuv-GJ3-9**2=Pfz;;)HAXzW3oRRAR`hx zLnJ_lAhNnnWk@u8Ie58h+BOnVJ1gv61mAqa5IYceP|Yw8QIl-=e=Lqs6%BP^%3c4w zpPIeZf8s!-XjG<9u3WT0H?Q4W2JGYk>E#yh^axaOZ%`giy zyI7(hl_CmTDJ(EHX=4NE1QoPv&(7X9s!3m=Uh5a&485JfBh?m8%9h@|pxG1*gcNZ0 zF*G|b0ODugzz+||PIH6jP?(R8`T+<;w9`kV2r4eij!>NOW(+PI1` z6F+D7*q7AqMiJk=0R)Tu$M>xxX8{m3DUSHWsug%8iJNuEJ=KWi+)w{oJhz(aK4;fy<3T&#DzWj*_S|&dJy&)6fYLIgdJ;V1s|D+ie9MnQiEB>~ zXU+x)Zy%T*|U0es} zoP(tPPQH7a0ZYqg&Wo@Cv#bSUBV>5dd4gkKf$Or0*&4M^o0jnd$Manpy_4tS%+MdW z_L7pbQX&%*{yP#7T2{UwS3p2RtO6v;ISzPjh(Y*S$c@GCdHc`iYdf?EpM!4R+IdpA zG;CIgYv=I*H^k*pG?$#Am8XhmqT)WE^X7X;CJKFy?d0{pNs(3OJx;LrVb($!xUb5D zjxmUT0Y8~D{rcyjjl`()22oyA-n;gVmGIm7g)OhvAhz!Xp&h_HM$aEm9_m8IywbS; zWxL%#QZJV{Xhq?zHlPUUFfNsMLxeYDI;eeFuU)tLXKOCvwc6el=J*&)MP3FXU>TNZ zidv2{hcyAFT}IJo)STJJu|ByKLq}t7eNN}G*w=E5gUSP4E}RV|F~TnPM>gFs7itfC zDX|ZmP`k_TImvr3mEzO0-Its(J2?V7lW_kWd#P~S8Lk+taeWw2 zyu=i>)aBL}z*vQZFs!Bc05K_z0?^!DW3$F8Cu|q)02EjE*HL= z!fVUrOJMv73)rjMeD-E~#&Do7`WYxe7_4 z2~}mF6QSn6SoZ3Z^K_Z{`QFs-j#sW8UJyEjIrdEiuSK1GKQ3&OobLX9@@B3}vn^)s z%MLQW-p{uy{%8sTL;ZT>Ia?F3Y-5j;W)Lp{dqNNVy3L6kSp|{Y`l~lo0d}PO%U+++ z4FaR~LB4Bx3|`wywU;p5$34B${JYfPc1VO!w&Z`}Ziet<2J9b(Ns7M=$;lWxObX$V z=ko3y|DER+F69$P>|TOHZuhiMhCY1z^*tsTAGQlo&@`KVJ-dk}gkxH#xTpAGqyC~+ zXAR1pnTTRzX*@w$oprMn8&i*!Er!s4Dv>ANW#Jn}c!`g$!qyY6VC&|z=@i13<(_q@m!X=h+wwj+1Ehae9!DQ5Q(z6xVaP0 zZ$%IZHMi{pdqVAw-L#wZDy+{w)w%m(;#4aGdU>>o1a`NJE>Amuu2Q@tUYHSQgfpzj zi?-nJ5H}S0ek)h^5b?&B{Gxb%!Gi?UXQiG2B!#2!5DA5X9ec zmvZ2^|91vsD=nJU@Bg9y-B$0KYqkH=t*OU@AL0gH+t;=gE;rVFTPyE5jQE-9V7>3@ zi{j@@tQdWk{%CE^z8mvU|NguBwcir53~Qw#@wyurqU1{DKK5DeGSh2ZUDU)( z>Ai&Z<~yV^)^W64&eFwp%zAnO_0xC-`FTn1mK7J=It_rHGRY9=9l04c2EL6dbJx}->8=98K;Yvd&q0;;`~Rt$|K;?iaa@6 zPY~40=*O#9Ss9w=*!-jgr>|OVX}04!5I>9~$5sT2^a=K3Ie%D*_z>`}(iH04B!xvh z<_$kcM*N|zbK5SF#i=RTcSG6y#SsfIc*<*Nk{ddO7%wKHnF(JmK!SFSxn4)CvD?IG z>9+TPota))(C{zLCHHqt2YgFYzFyG~?zIoIu9N6a%yFi((ZR7Xtee1omcf;cJZ$WV z%bIB1@lVWN^CAw75oYvD50rg2-`?U%+Sw@>sWZuG+ZItW#P=^q|>u`jH~*>Sy=B0V7XxfNwM+%EIsk)6$iOY7HRmky8{oQg7Xa^TT4F5w<}Xwgmbtq>5Qvg-i*`Uw zbvxK~-K)qFiqH9-;@_5C84n6fQG{Q^9CwMYxexXW1=>wln19F)*jkxR>)IgCD*^7z zGCy|-ETebrzCgamSbNSsVZWeklKMXResZ}!@x*PUOwZrg=#KezSHp=JY%&7#4>O5< zAH>`G=j_xEy9t*&{Eps99vycwWc_((u%okE4qvf&sYbGr?sPbPKc~78caN4oh#2Z+ zi?XZqa(JCeHc6{hc4@XJL%Tsi3)gI8q;JX?@{{-bJH;jbo=-f&%Eo_SayS1B?TWpY zLE(Y&!PyJH*h2nM>}RA?zAds;3VE*hreH*NXyd-C&Ga-;g7wa?3A&}I3TT~(B5hJM zM7A-$eW>%`$T~>{7v~;x&U)U;ib~#8yY6#yl8|a~pc42;MPJu5maI}JbZMLV7Xg$- z)Y(n9V;#Nfr82Gny)@o-;D|HfouervT4@IGZlWqzzwG&|L#d|Yt)UuP9c`*9liyO4 zndZKW7s`EiECT~e;dc3m*>E}5II^yu>v_i=T#s@E3^8uaHl@cwhm2+3ooJ_-Hjhh( z7quDklynd7RKp(hX{isOHe%#c03J#cutZMkXB=~sk;e}+j3AOl6Xa$O!RNc`52GH3 z22PSunBP70olUl$72LL3*)rXECz=h7mn8SS_KR%C?$nXUe@XCUxuH-*)gP`OFp;uW&-ml9V>hL$# zylwlxU)7jWY2su}GN&qr#L5q%Qa$>51}j6}7H4qf63uPyB(*fx&}@VNTyqz*sdD{h zbVI)>&h-$td0AW-bVsWP)VzO4wULZQPYr;|c7?$AVv@E(JYx6L1LfR^A+M}0a=gS* zUs{s(?X0NIr4PwYadY3k-`AFq0`Ka@~Yk}^E{VaW$VGnlt|eXj8x71@`1rVYwb zAM{`eSo*9~pZ_7}R>>U3Z!~MZ+U(9?JaTub(i<>>xy*snErbC>mkDuS-q|_}(O@}w z3j;k0LzrTB*Qa>&ja51HqhTI@8P2O zF}HBzti7pi5aR5WoB0Y-cIIcs5jMdo@N8!Cs{PbYm9zu}!OvIdUT|lm$P1sH8XYCl zy`l^NCWtAjO1i`s%dklcJo{SCf~(Qi!CsT_=y+$S7-jX};&FW2nv>7=1};2t1Q*Ct|`qcSR(|N4o6aE53c$Ql(* z=cT5%P(UOm37?$Z`u3g9yPU?Z`U%mVbNgk!3EGHtbkEnb?4#;THO1Q{$A?)ywR{qC zV|Aa{3iTZj4`qy+bvwwyG-$~`2QN)5D5x)qUD+o(o|+!@g=tX0U) z!^hZKgP!!#83<-|7Ub5#wL|-i`V|9rE`K|KYv{KGZFO7eF@k}uS?4g8NO_Vb1M zS#^E2B3I$)?dc*Sp@Zi6YB{1C#(b4t3*9yJ#w?9W&iA}HJ0zT6lbhg#CZaX&cKRud(q)>SJJ`IY|W`t4_z0I$5iwp@ZRw^ZFs8p_2z z6Ql!PDtyO8sNk5LB^EM%;Cg5iRk^z}bz=~_t64(U_x}=yxGptB9~j0YRk3KAT-#tE z%#7IAFfhARllJ9fxzeaP`Z6=sEZ-A-Alub}WaPwX)N71+lzZ@eZW|_ERD|aq)b{Dq z`yu4ONit2YnpNHM=hD!{xRQa$FzP*Mxgl5ndT4M&F?#FK13!)``n|Z4gl1Ex{W<6WpLq@@7L|Fa zOF$6KfXwg85A7(2x#3XB(kHwR!wM82LOnjj)U%En8C7)Ype=8_{5Q5>$1YwjFlaIr z*rXTaL`AUB#F(vvYJ~rnOQo9XOhxXy=1|wuf25ZS%W=|?Aja00!hh+{9KZnjwgN)NOY`HmKo^ND}Mh8UYNSqv$j*4#j z5J^?I=c~XYuRueUc#oAcX;R+&GAZD-3!)$_H?_Z|DaO29moK$m9|7F%&v@X_x|TWQ z2Lstx%{~Lc=54?AKN{zGDir<{I94(JGwCzUFJ>c(%ecD+FACa;U7W*XVJZ1Cv})W9 z4D^KJakJX9Pt~__Pq&UOZFWB-KbJdKb=iYh(_?ApyW6 z=Eq#VuL{qJEvsrNKp{k3hy<}&q~N*JV_)FPsS)jS`uxIZx?MaRJvy`~dK#a=tnYeD zZED_9ZQV|=2E}Bn!t&?SjdA9r`Z=tlXaGG$$=^-qUh}0GdYLRX<+en_#Hx(Nxd&la zue$=pQ9T;HqZ!ZEmbL1194QkLIR9j^2`lMUzm@6<@n#zR;wt4i8L&LC(!=_9kJS*0 zjiAWW_pxo?+_@Ae%qz(I>qm~8W8=l{Zj@23LxR6xtDa6;r#A`=)YkZS| z@cM?E<~K?fYqDpAa<~WN$C+!Z!6-4VMgf0f*9wxJbZH1I%6Yxd>xiG^vVWjvLA1*d{c;-pdZ_tml!$4Q#v9( zZ}1bvdjNya4gWrEceUjO{s=kQs>f7jo z)BWQW(M7x}ysf6iAYhc{eAEe=y!Ip|m6=0gp69?JmpLcs82~hzh?pm?63G z3{OO)P4o)^;Wd!8UC+A+NS3wj9adj8uw>Hi+uomw$~>odJ}1uJWP=TJPQLRODFa4{ zq?6KH)oLblnwM9MDES+}_#&lHVa_-XXfoEtF=JKyD3cxAU0LhXM^gp5>(d`2GOvt% zVy>#ltW4*OqMtgJUSpbEuv;-+GE@9nEC`B}ykLn0%)gd9#NNK0Q=2@+LX0mB!h2kK z&odc?mIJIHH?0<0)skDuFqAQR$XVWy|dT0y=<~a{ZH1IU!fP5<562Xdhd#=zwZ`qM9R@)+Ewa+edwIp1{gC)nA#Di*S| z>lODU0q^B``)lvD#XLoBTIwu2(_b8`rnzQpW=!m} zYH+M~f&&Gj?^&-+A3o}p_TH(6eWl8{{uT@o9*LuQ&y<1N#Y*4U-u6yWwAJ^!Q>QvvYVT z=Yq0Z=QUimkE?#i)aCgLO36}mt&eGEz?z>pR7OUEZ@ebI)u~NjB3uox+*(lu2ZVE) z;tys|ClIBevbf&$FS288Ybrl;a2q-z9EDPPq2y=RA$&IstM*#80=({S`X}{C$b<}B zin*yZ6`_4lsFsIV+isf!TIUxPt6!eXJHYEs1aW6Xo$H|XSEb5S=W*c@{uvmpg<#8bd~=#z83r{)DAx& zwh?R}p_c4cD84b^UYI5QUoo6eDm zURZP2iEO~~Gd=E;R=-A7S@2?`nCizj)-!1_JT=`qxyExvD@o}^tHADvAg3LxFad{; z`h4|n;ixY{(*xSEL80mH0caN`Nw;;~QbC!Tc*n{+*92;`Q(ZrU-LKeCE02jY35a_u zpH!NUJ$Bw~gv-rLuvWddB7rfyQY#Z1XXaK(Y0q>$es%oWej_j`9mQj+n^N5g;}JG~ zWAIYetvnrWtWZ6~b{0{`1|UzCT^-dv>ttn92YDn%1bbYY8jGnF=oHLloQPEBt`f;? zC}7p6c2GY6+1oRRhUy`)t-_ft)P=Q;D?fh_U6zmwELy`VB0MHVAhXp?W-8wBI#p>L z`@yS;H>o-9=*iz58$If1m*^)#3!kW<6J3jQ6A~F@;#fJ20q(QJlh*)^&R+g(IC);! zt3Gh}JVKzrI8c3^kxK)5Dby~dF7JW6Kzb2CBa62J9V~wEZRJ7T!Cm0~VDaUa!x=3v z&uabkxs?vK1j}ZiE$xF*NFBroINLBLw8z&d8l)xY^;)4_rTC8O)g#nw9Ik(Nc`DfN zC3=3s`tR_O6MGqGYlIPMky&&ZC=Q*UkC@DSidAv`4J2z$>( z96ufj4td#O&^2qbrEj|(&T9jV+;%=A-{%p>rhqeh zxNL<;Bi1AS*{l;sE}N_WdZCVc1%P~~1Iv;0lna_lc~Ua9MlX+`gM<{!M8LhZv7@+( z$eJelo+(q*fl0p{4h@I4gNB2)K2VnPy`FF7r5U+!c6_sIeO5kvm-vRsyS zN-SE~+bCRgbfaY2Kpr{1=tMd+!-iU+F$-am?VN20~f64k^h`uR0=<}TVy_b$Qj|k&eXH0zOg*r1USI}H=+usH4Rua+xL-U1e zfNzF$)qvqDx5!e(wl3e;X-O(9k(t!l`Ilxh zy?qRkeAB65DeaZ*H?YE&M#%qnZaQ=2D$yxX}} All code snippets in Windows sections are to be run in a PowerShell environment with elevated permissions (Admin). {{< /note >}} @@ -180,9 +197,28 @@ All code snippets in Windows sections are to be run in a PowerShell environment [Environment]::SetEnvironmentVariable("HTTPS_PROXY", "http://proxy.example.com:443/", [EnvironmentVariableTarget]::Machine) ``` - If after reboot you see the following error, you need to restart the docker service manually + After reboot, you can verify that the docker service is ready with the command below. - ![alt_text](../windows-docker-error.png "windows docker error screen capture") + ```PowerShell + docker version + ``` + + If you see error message like the following, you need to start the docker service manually. + + ``` + Client: + Version: 17.06.2-ee-11 + API version: 1.30 + Go version: go1.8.7 + Git commit: 06fc007 + Built: Thu May 17 06:14:39 2018 + OS/Arch: windows / amd64 + error during connect: Get http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.30/version: open //./pipe/docker_engine: The system c + annot find the file specified. In the default daemon configuration on Windows, the docker client must be run elevated to + connect. This error may also indicate that the docker daemon is not running. + ``` + + You can start the docker service manually like below. ```PowerShell Start-Service docker @@ -229,7 +265,13 @@ wget https://raw.githubusercontent.com/Microsoft/SDN/master/Kubernetes/flannel/s {{< /note >}} ```PowerShell -.\start.ps1 -ManagementIP -NetworkMode overlay -ClusterCIDR -ServiceCIDR -KubeDnsServiceIP -LogDir +cd c:\k +.\start.ps1 -ManagementIP ` + -NetworkMode overlay ` + -ClusterCIDR ` + -ServiceCIDR ` + -KubeDnsServiceIP ` + -LogDir ``` | Parameter | Default Value | Notes | diff --git a/content/en/docs/setup/production-environment/windows/windows-docker-error.png b/content/en/docs/setup/production-environment/windows/windows-docker-error.png deleted file mode 100644 index d00528c0d4cc4fabdf9c44969f52cfb64621e313..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 81774 zcmaI8b980RwzwVJwr$(CI_TK8ZQD*dPCD7KZKq?~b~@(Q=lZui}q#y|og98Hu1OzWFC8h!d1UmKS`!N*6pZ94!MBYCiz|Ja?B0$wsc&C3Z zpdF+%oq>QbQU37)HqV>;bBhp=w3x7}2k=EMq>rlFADwKE%jW|+b zX={FjE&341S(IsA$CVaFUE!xKRa8_|;heJ9H5e4Jkkqv=i|>*DRkk#FtdaKAA!{b* zb+dEN_2kVI|M3r6SbvViHfJ|Ho@XjYy|Ggl4S=uxOq3j6wBVd@FdR=x)O?;J1^ zKXtZEHDi4t`|By=Hs@Xx4qbr5TRhhthS-d|d zE5WGZma72XMZKGnd`F83Vg4$~Q~OJJNL;yIWC9I=3!P@XS(JfAOuh^cp5T^N*soyN)Ke_n)T1JyrF;d(^Mc&?6F+l2DAm?WbYvf-64R3J z=*FFl{#%bXkjM#iQv?E^O56a$`tQoduCgL942@ncGnxq+hGCluFqMjIJn(oSq3$js z*{6v}CKiwM?FczH8*}=8>3Ndl$O#o#d*@oym_wdlmxC} zQW=##|D2qsuKaQVZ+_plt1M;qa3hS4y%q?RRP2iIFUwHUvyS|lJml&CrS#gX3r|Aw zG863XHWtw1c6G~ysab@AI}ZhqM#W)YR`)CFe-Hc*HN6p($e&_uD{(YE zI7ob82Wt^m2r;Wd(jpcawo}8rzem|#!#ehg%(~zvWV_vw)~DJ1E_F( zEz@9r$#$XQ>*(E0jlll)wqH%nk5srIqNf8x&vHZB=9!JI_Y>hN{FL*t|JSW!M6Fk! z34bI%>{oCmEq+9s9|pm~b#Gc1<;~a@jkId0R`ib+fe_4Fa69d!SiU^JR$Cdt4Sog; zV%2^_W>V|bbF3$6feQL2inTO})dN1wMcdQxS^;k|9TF=O4_oT@n zhLc8*J3kU@3I3hhkl|iTVCzHLj}!4t_DX%xr8i{vjgToP`aJ{TuX10c-TdS>T!-KM zfI3z#D8qyB%XP6|rG&1AvslkNe4RWDO5-SZ{H?<$Zk&jc$HiM7W}j4W4jMKY+l};} zzy8mr`;VQ70VEdPT#^f=sRMAWMk55 zu2kPQ@PP~bP%?R7ny1R4fR2e7_5#8mIcu1@0`x)^4UAWQK2&=$iaW=e)5exE)JX2^ zdLJYZz(anu9;eL5Kcrl$r~1d+0Cilfkb%Vex8uBsMvvt!H-4eOfpy(b_p(Ah?)X=J zL{Qq-`k{2O7^d7qwW}Y@wpy5jOL!y8&ONcG19HQWGOU|lU;%ek=<&y6G=mq89 z+ZTmVL3NpryU7OA%G%Z#7y3vYsW2vek(}$d`@Ea(URp@DgLRQ|vcnil8Am`5f~p@* z;xM-|<8HOPhn=#)W#pM&-86_u{Qrp4jgqNFU!D7bC`Z^yFw$%{9By62Y`g=t@q5ic zPHsEOn?Nrf4W-G?MHp)FrJ!NN3og?UWh!oeQ{|Dp) zw4`iTVUBTv(|9PYW1q%vZ0$IRq~|AwKCWzp*y`Y_;v~;0_z<4Jc+vy2lA0l?BPzFJ zORS>>eiL$lI*xtKL3bj~%XgI&&GJe@>We9Z5O1*E@reNW0--4c+>3)fUmE=|zpghU z4>=-`<*GqcfE2f28Cu}y@}S}OJERR-qa5lBDNj>sKO(}*tgYOc?X2j=#^mowDlvS~ zAX!=P-+w${?U9@x0+8>xr_!b|ass+@+Y7#g&`kyy1|~_eT1Dcgy48zSK2lFbl(=PB z8kGDz7~PH&`xOHh(mLCaKGEI*^}~Ur)_%k1-h8*VNQ)g#WP185u#1w*dvS_!1wt(S z8bpH25lzvEM6@Gd=9UyNc@dH+Dv_eZ%n`CDVUD6j`IlJn=jHx);gZKlw0AsIb#*xc zb3Aqm|8h(IZL5Lkw433=5edU)Ee6Z-{LWNztmV)KWebGDrSL@#WlXBZL>;D~BGXqb zO7nHALWWVYS(86h7+8yP=xW-)ML>Ut^zDQQi`q@Wtoe*X^QeC3LWezF8 zw1Hyib5})Elx!-&kyg1*En*cgC!?={rC_cKg=vib!uWnd#54|yZ`v5fQ<6nDvl~H{ zXEUBuD3rI>fM`7ttc+J0NaM$Jv?Uy!)PT7A@X*Gzes)P&GK|al6%qW zW=;NRKP8NSy>Qw6VE|{CKgX4 zD+sIf3rR@~h;d8CAcLBM*11i|xs zt;Q;q)M3oo#K0R=cxyglM$Z1q`(X0~&iT57j3q0J~o2t_@uNh22@^g*zuH-Vuk4iFnRXlk_^;SRd9X$ z%__y$vO{TzR9xTZXS1XnmlN+~wK)>?7&LPZ2|iDRJ~&fqf_pI3CdVWnCXZxtxRQbh z)2{}O#!K-VzZy1eM1~(@Jx&9_yUKJUfrV)2K`D8*V zNm5&Bm6|EFhq1rk7YSzvJXZwrs}@KM!c#>0O<~nyTR(eV!cD8bdz`&?UR|A~DVfB4 zeMc0gt-TfvQq*S`brE_0oiqVyFR(|D52(vx+eDXIGZz5k$i)U`s2rJrf*cvp3N%Pb zNyJ@i z`xi(~V+bi(;ILrES#r)C?I=h*HRD6PuuswE)O+P3@9XvdpVj@=HyI5jo9 z4|FNU3}h4|iFJ&uxhtFhn%oG|KC&6!$|+(x7Vi_Dtp|wQJD7dzWx&l;iv=}=PVe)w zz}8#mz;A)a2^pz*2ujzDf2ipR*C)gW>X=3S`HENL@5pP{dbj^q7lvWT;jWTbUdrNB~+nmpO^;Ra^9hc;TR^CB@neCje{<(oTIRIZ6524)PzBnVWY*zm|F~+hHv)Emi7wu?kovTAv-`~Lh5i;)7NDIkMgxGgIs1FVg%YbI^ zdvloVPM7k)ruBe$yRN>(j>liLNpPdFqm{2pXypySg(oj?f>V3SDE>6%sIN$xXi27< zH(7V#86A~hD-ZJNyrj8npdiO@?AEGMN#v1%;VbV$ddMZXpGyRAUVdyKNS^;j{b9}g zAFg^vZ;8at@^s$tpZHZPiw-=d0{3%2UNBCQz*Ed=zM5AW67ymxhDIgLwx5Qc+bS8* z3=;pkQ4RYJs*QfAk?0jdaC$+oGPd}sB(lw>xs_& zJC&6iyk^2;vCuaQ8y=MeCpnrX6BCMWY$mFU)Rgp@F2;2PI3}rKau-PSdi`^BjsA>Y zb$4<|T>njEdnut-OV0F=$*2A#C@={OQzbFmx|}q)>0+E@T#n3Se3r3dxl35thV#x* zRG4Om=``6FhLQ{|AX{Cz;}fBrGTS<#H&N&R9^Oi#v^q?xTC^uwH+hgg*%L;0wVv3Qa~wV!eZ6`HxxHfF0Wk!KpG zHMCA&G!FV2z(n>GBW~UUoBY-Spbt+vh&jcJ#mZ${b8|ZkBw7QZVP-}OysUJb8nXCk zTjRwV>q41X+_v2mJeFwf|DprVI#KZeFHm%%bb(C~b?xgx_-ZKD!ovEAQYJVtCN4@jcRdkQMu&V%URne&{I4L?m0?^dA6-xd-Ur3Dn@E}!|rjM z+Ot3VIhks4nzM48`53rlJ<~bT{Sht4pIW4C(t+@r{4sqQgN zkw|%AWF~~|{0HHM^d(1Y*zwv?URh_(iX}2ug?%RCrsP@(?d?{7`0XzxdLMRwf>Uy7 z3;OWk_4r5Dr(nh*sf0AwRu+qT8Q7low|-nbk|UAaXCoFs(|damrkl`&Y>skpok5=s zALlqEe%JcC4sSJltOUjU+=147T~iAp!*WKzO2^iIkpDGq%UIsOT$8{a9N>;k1VCyt znB53qilR`}dd7MMOAgN+-A)D#xk}ga_qn3Mv=@p7UB@>UYbwP*j_qtOF?Ki^Pr$!+^uE_}0b5J>P~Dbq|LzbzMq8+9Zx6ddTrP}+ z;P$^MfWu)Vg!{n_nHK|^_PI~a=ROm`68(K`H}a;ny7hVtmzf;x=7uM(%pxWlFsTyJ z*ZiAtZw60&`DsFCLOsOdQs%Oa!^(pHZKvuwx%m9abaQ2G5g5}-MCg4hK6edzAUXH= z%X_<6{&VzSO7Z>xrK+k*#K>5q8?;P4MQY~@)k3B!ns-N0c+EdoJ>KI^tobKf@|hEs zDEPI--_p?2YT|OSjm=uoEnK5`hpUF;IO5w%J_S@042#VA`+HGmJ0j)NKAY8z-aCB; zcM#g~5!-uvzdQmB{EXH@#KkgdRIKF8n+%b+K2g6YS^~%b^w8?}pdkEhgJosWxZ0eJqhJO5HYpcqJU$eccm2_cx zl>j#!xe|@7&&3bl*XnaWHl%wg2JgPY2}NK0?n?*jTtgVU1<(*}T&Uing;7$c8nAN_ z63j$tD7?FsRv<22weYtAGZ-!2&3J7IY~>k+F@7NC6WnEu)E5O9JIL`>=eZIRNV~y` z?i0Sx>6xTw&iXzZ+$&ziKL65z%i@MgER^~q@y8C14Slt+nh=Q>d@G#2pxE-1Zr4_p zLi3f`-B44Tp)$rDz-ID@vyw6Eey(DMdyr6bHP$?Iuz0Ys4;pJx88}uwPWk+8Ph7bm z@O{r%R(gZi*Xt#}V}!W#eR_Dgx;oCEB#FV^(}zDou?OQBkM1!PvC7-``9%z^8oFOT zIjGpo+0P5}$=4GH^6pn72L}+bw1&}X&xTF8n5eb8gB+X0HXAr}_&oDLpdpIC=O+f= z!+Xv5bS)6?dF$o;?)oPzxeO2Xs|$wksc(^n=iWP-#DVKtJs)gHo0{Kk$`XgvH*6(K z-u3}j(d$OCWm>6>c)4phc_-H*NeYO%CM4CPd?CjQp*xS%{4=(ez~#Riw~k6*5=j|KD->(OzSF8g5F5Q~+pk^PrZr3&6e<*QF1yM17z{iH`Y!k_iF6t`u$ z=}DE1b`Tj2fBf_}q1XHJ6U2B=qNSg-So7H@urGW1*i}&6~eY#Eq?`sYH zR6H@|2YIVj^Ds#c@;mmDy@P)$l*T}zHa@4Re6>W^TN5Xw>JDbLYaHxBr5Dgpsf15$ z$I7IJJpCg5YbwGbJD^yZMwExBupQ5QoW^lY>N8Y+xqHofZ@1%(sFVa=U*MLzn_;P! z)e%d;+W~>#mmj1(0VSZ60Xh98y^zV5JWOtyqNShUdHRiWx7*f!=kgwvOL>iOvtM?G zGZXDt)aqwp$4*6kp2Kf-S{cg@vy!lssVf+DL-T5) z7XFFY>5H$F0k@)z9}KX&2{t=kW(wD#mJkMzPSjaX%HXZG<6eil_I1AO#y&?@cfer> zIu0Z=cc1aL`$-N_TfTduvjqxC7u*S(m_SK{m+jAEd~*`)hYU}Rz`=^AeQW#8T0&vSsyfqz9OcVbZCUae7BP#( zlaET_{=4*T99Cco(!n4mUnPc6?-?lC{~a!#A%5_~=`R^=>*QcbY%{w%oyDRs@VSfi*la`Zh2C!^GuEXI;uCnc)$iVs z@8n4E?CNc{>=-yDTeg&qz!6Og727;S)t1yJBka6+>>(G4kHU} zd>&r_E|W&X-p1@%b~+5yBt?VIzHc561^)ZGCDD0}HNLrWdN;qXBaeSXjdYjk^=`9T zguenO-xxX(yIpdNMA>tjY}F}E>@$~!1$o*~+wOkOtjj)m0t`QVRH2rX1g8yS(hR2uK23=k z90~5%C0}(Nm&3z;98G!AVM|jWrj(Q!`NMu_$b2OG09P#vhICauY^PpL{QAaagcYq& zcdwly3^ManQe)3SgK%WD$N;|3?(pl=9!2G-GmP`(%_M(21wau-;yF&G(`8NSw@ALb z2rkXV{Kd|fWhN0S-)bdUjvKPW!!+4mS@lwV+Q-kW7a+eLfy}rY4nOCuYZQ8iRz1x`WBk8%EBexjiCS zcW%w}P9!B2P}Z#WLzP}CLimM43{?ztQotw(KQ$PWMk4#XjJGW8!z}r>9<1nVBk5v22)UXB*3X(bKC1!td*^3BP}F0YI&~!zyKe#|YjY6Y3H`0@0<bE1%cc{)kA`0~w;;wc>?}RTZPh|e@mSn+ z{N>0}9P){P2bNu9^-!>2nvyRp%$#+Cu5IwxZshALBC= z`HW}EMmqgkd-(B_YAd$xJGujbi~yq8tatpumTM6daQgd4$*(IK6JMK>u&k2TqSOGCz&@q%1UYA1(=v zAC0u2yRd5U6+~Z!&31Y9zm*f|h&JWSkn;4!p=!Qxp&Jd@In#bvuT>ykG&Rrpr(&CV z5_8OfZFHqW3MZt#xqZ1542YJqvhOu<>O1PdwT#tM(PhI7YNhrb;OKeBa%}d29 z8#}vD#*D4UM?%6lcBX&?a0M&Lz^!vv%>m`Q5zjYj|n;YooxVX~Znndt?#>=XrM51jOI`NQ%HX4*Xvi{PW8(%5HT{z%n zuz&{BXsjfHd^lLa&Rwf%JtBIS7`B_F_(#2BV%YTXsmYR_AB=R~i=03!*z}YVP>5}| zZ7GvhEy+zYWR{|~CCIa5hmGk(`({C(-AW+5WyZXd&R#vdmBkDTjyM1)?b;6k3g<+N z@j(V99A#`BQLA+7DhN6<4P4(mUPBI|&g5o8NtLOkzl6j_yfpAEzXu-rsB1=eR{?VL`ncOs*%E>z^v)UI}0rR==y4d=b zY4T;oi0_264(pWC`Wli_{zh%~SSCFjS{@?9a!yp7ky^tZwkt9{XI0OIv$~B2CR_~Rwe0FS5h6Xj$07fg)uCtZ4+wca>H?C_}0x9aRMI#r2UAUn4J|`bWmc* z%)b4VM(VkeC5!s4YN>2^bfSFdQ@nXNfK*#Sn1dL?a9eY>0|2rb9_@IiN?tLhby@xp z(35$}I(3NCB}Lzwpq+d}qsGy84$K2nu&kI3FsVH)pB;dyn4(Ia2_^Qa4pY} zL2ANT^HBpO-#qY3^2V&fWcR~5DLQGCmidhB$ypl>j76ChMPg)u3adR@UX*E!yD_?S zJlcE2EsZ~s&^{w}z>eW}U%pl&H$7MvtJx*hU)w`ALp`>7o8052`jm_$}UmD#l&dUa`0#T$z4 za`6pfUjP+jiun&AE$Uc#3jL!;jy@fmU>+W1(8AC?UxOfOH| z1cyuc40l&b9SN9{4YNT3m7F2G4NppypScpK6&2C7x9fjQy}1~ z=61s>HlTgjkTW~6ixZsE>`?;KpA;e_Wd`Mg1#g<-3!B`Q$f7t>%Ne_wK|k`a4I{x% zC$I6|A5&f|!{;8VR8tSs7cz(kf|xF1YQAfp>Ls+mzL;QX&*mU)G55Ak0$ z;NCBsKijj!6!ZmuTEy7xZ3b5r%6a-satm)Jjf|2?N~nvk{~%e0qjL)jUE&fK;&5v% z+k1}u5`?9fK6tKPywKVkhsrthw4pEa=#N0x6h?w~)BAi68USn|kEG$Csu$3wWnH5} zb93I(_K?6Y6KUl)l9VleG@j>3KO1%`I*xv{4N%{psKg#`MgeVClrk&aq7S_;nNjEt zUBt(G1JjbGHW_{%O6B#;dsUh0L=vVYO;pgPOHMCFapg>q!%_!0tl}YaLFh6W_i_1w zANyk&c-aBgU+Te4vUAqXM7JelkX{_ANgLl_edUgSud=dsNTQJ7y}x#+%{N7eF%^JGy`7&M+J z6m6tCWfdv&ELZ~Ztf&DR~VB*aY&dD|{=1_o7@E`LCug(wv8=w&wqfe_z|k!0y}&B$t9qf;Tk=*=w@@0Nc3iP<6-JJ; zq+rZF<5k5XqVbehk&(uGJ^9Lt=ZZ260Kq6UcJ_ws<;YNp$d6uR#CUs`>`cOqQ~Hte zpzRGZN}xqbXQ-pY;>s(`m>{=Ro(&1?7C*&z*)n;ZJ5&GsW{a{;x_YWLbMW1XsIVLn zwJH+RI%kq?w@3xBi@5`Yq#Fn3(-{jCz&|KU84jFDQH%`!#y$wl@q z`4-n{&93IqXYHsOy>5L9<&DW23F$)qDUd)bX^3+L5!q-icq0&i=Vc+nYaDP4-1$1l z$Rz^b{#vxHKuF(-GySc3CfDJsIlq4=UhLI3N)E1aQl@CIZ@YalTeR zc*pRGW6si>wek*ZSR=_fDQg9cS*r1N#qyH&pL4GCEp-lTji)Il>V3$n3DIMWaphDt z;AY(WMNnZ(8&d{;=mw;$Fl1o)p$X#nFqsXTV$JKr*HorR@bkXK4?!Y6NbKHm-uhd| z8C!l}{#54v{5K`4;{~P@)j&t6-}yrAL>V)`^-dDL--dZ?_{uG@n3kCR zyEz5b;n~w*cO~(p!wtN-4K#2}DTKVnH*g~oZPn{c)dnRRY_nYXz@pwQJPh1mW3*c8 z?TVVZ(9O1OX$xPy{ykZ3VP(+Ayd`6_UBuXJ&}iYHyVX@f@g4;}G3iIA2Z7n~lH`y; z`zaG1x{MBoKLv-p)6)_WO;auhcuRtsmY0E>`EvJ|lly)&x?2tlLVtQt?qDNSo*>(w zvTK%--DOB5+H6Pl7sSgOjWlyZvtEzeo~Rb7!jm+6m8c-^A!&_L@O86Jn7e*PICY^A z=*u*NzQ07fn_!LTl&w9ntRoz63d-S`*QWslk0JvtIo4W{UN zE7@-F1dhwoTFt=Tv_8sWWZ%XHOe^I2A%N!CaCeXPEXAc{IAXwM`{U-&&PPw51>1ucI!*8iSxr8j_xf{9E%q%PLM0~kx8OkYrTJPJTMJLO zRZ8mBz=k;pHO&KGW#{H45b-dj_~w+T<-jfHg@1U*m-=}bam(VTuEwy8^{<}QoY*pg zlhC4Qzfx%YcI6V2g6*e|R(A!aF;2*BIZWjSYPBCC&#VR?(*2$Q7MpE>pEVYD&TF-3g#SiP(}{pJpBu`jf(~nX^)|Z~ zz2vdSE=+XETrV<1`SaJZqb3P2hR;evH}VD;J5UB*-TNEIuN^N7ISAFXEek^WM(q%zs9pBXqtZ7hVmR8fxE)-KlPIw|hl;&n?TEDRBae7T7r{7s_vr9Uhu3YntbE6Q?n z=At%dlNh6fHbw~*gg_A)5yf0pi`YtpqQpMKqX$9W0t~M9Np82jcHtaFf&JN&3Yu`_qgS2n7#_YFpc_T%^G|8P@Hw6T*Apw z;CGJG{gz+Mcgr(krSr}x)Js=Yrf7>7e!@t^8SUW+rL+Jkiye1i%~RsxsCBIVuOjU~ z0&G8Tkh|?}*sDK0ao~135O`eSjV6gyYD|CA#2O~X=M#FOxAEUed4FP%O0KU^28`&} z9>o9`-GXbGn#UM*8x_?r#RUi2$v@=%FA>M)d4O*;_}V;S`roGC03@9RSUrbv2ry;b z-3SGxn}zz9{x!sJ+i`gYtB)e!XXlwO9NknLNfzb#AzLHIw?JGq`>Vzggduu z{C8TzK>%!J&qrXP72*H3_s3DyVFCN@*lohVj+pWv*mN)0R5;L^;}1mk>Vdzm?|-sN zmLOhT1T30w7_#+y@9EtObbrkz{&OmG5P?%=z;hLrt1B)lHW}n}BK}K13~GNSPQOCq z$H?Cpg#Yd6lB74vxr51(`0sN4&#$ej(6xI$<$9h3oc~3-#%LhgsmuPs(0`8RFXu;g zRLFayewTP1dT#v7VgEOeHN)^{L@ltWnE!apX$ceH=CA=Cj?ySMTG zE2xZyUTJ{Heq`+o5ZEcuYFpfg$a$W%zs?Wn99ZB?JeDTN{(cbT1LENK9QzyR)0l~W zCw%_#m&t%_L^XhDG9Jfq3I=nHdqS~s9qJ)&aI|j5LT9U@QuSp3L;e@rhxyF6YJRCX(jCaO5hNNe5^9G z1v0j&&5qFjZ7Qkn8 z%<DoH)qQ(!X>Ki1skeaM zy9eeExz66M~=Q*3JYtyop4CF{)^L z@n>1co?w7jWV7g>%=tBGzb^3)>Bq0dfKUoepdJ`{v!ksX9(I)Y{7Js{5XSzX1i7-z zJ{Rr|8G%_Gt$B+tp-X~*zMd&)=2PcI^v#*;1M`gb;+q=M=Mu8=MW}&-Yi654MHl~; zj}9m5g5A2muS%>yo*~WFI4ydN1yx)nYRzv%u3{<@Zjm&@*jZOb36b*P$ZG9s&=q3PBFRC*rNqpY#$O zO}doISy-T}sUHpxcWU1?vlpk_%{>G+xQMY^V&l^28W8~4+=5+_GD^U37?he0`^;`< zrmc=vocH-0wq~eqolkfKt6~QsnpPNk#}kxmEur-CONmEI5}&C~^@kWEq~JCOAfNmxev9edQOTVn z2jO;jiC_~31$1_O&*DV-<^>v#(G&D#lR)gTV<7j#2U`N-yCDl+A1$YE?4hcL4m9(l zb?LCta|9IDBe+4og+C8$P-YefN0D80R9e-K(M?fO}B7HMr50}gJa!aC5(}S$M&~hK>OoxU_ z^hcT9He`5T*mI`4vGX7coZo{(71pKqawgIoEvo((FTAn}JTHi-=#7HyWy4({KCI-< zY7z}i7Bg^|^pI0*8$xN43N;ZPJ>rx-ybC(@ApRODizAe1nYe%uMq=tY|xfUtr9i1?^h*J))}6UA7tp- z&b?2&QS>m}1^sbRRJw;5I}{9uEE%7{DR;N8^@D-0FdlvGVD#3M!cY%|lvE+%dJIX7 z;&X=4Ss`VX_4R5|zx-TTIdZ7P1D6PeHzD_vJ+Hij*G9EJppX300|&sZT%=B7c)ysj zQAGw@$kp0=(lt+?D%ID_&X%7Dqn@uETdyOz&^}P4p8SCp8bgX5CfuJ*Y-zf=zU!{T z{K5VHVxV*i!LpXUEUSLWC@)BZAjt98+))Y&#BG80G)2$V$J)3?9qg$`Z6 z+ra2VD2QmpP0&`4LrtBeom4@EL0=&73JLQVC>s;`p2>|Lu8^#Pg%v4n{9fmjs-0~C zupf8tC)^))mk44(T;JLZXzDjOap+Z5g-BMTnoRN6rgULDHr#jizG0~9SF_%8e9D2w zYBL63TCJQp9hhZQ4vZ)yeSU5er&0wl`@F`sR)0z0t?$MHv@G=_s15{uq7D!(^ge&u z;qR7Hi5>QdQccGU8*U24L}&%?uLg`E$7`G43%RT4s|c(FU^;~Y+(-zr32CUi8y)Zr z9k-xvnT;3w_pxqPfMR$WKnMwNgCh$*XU^{&T$T}1a>fQ34IMKcG7$Mfm0Tlr?jG=G zxLH8-%G`IhFr9WU9JuvxHld-nF$>$9A;D8#)7-NmcFAWdC`H-j)GCPbJ@9J z1SmH?VY%JM3^!tbt~_jLy^}<#9u;QLnOnY2yZLMZ zEJWym@yN79&iIp%#Ryc)mo`}3Ow&h9{m_T^`lhIZ_?kM`c(iiW95ELiPVxZDZPwc> zVwMwsQU|_7=2(bm1(XhF0qC5dRtTo}TgtB??ole#r+EA!ZpxcgTz!M0nse`hqF(5S zZl=J9s}*eb4LyDRjqP~(oRA*1%HAkn7_7z5h^Uj830|8)LH)@fVk+#Xr%h3wb&OpaC7cS_Vp&pOR?I@A#ZOn?`!?j^mKxA8bOLZ zy^N)t$oi!m?G|B{eqzGXvC!WO7aM3vd5*0wuS6YSMhZyZp6sy|tPLbDSb(dZISjhp zi!Ar5tx)m*q%{OEh#Q*Ga9r^Q8k zrYDPk59eR?in+RqeR2W>{N&QPvKKp@g?n#&;A&2V9@30Q@vb$A#rUKDYCjpM`r1h) z$Y|uLR$ZXNlf#YbW#HR3;_eDTys(v33P)mZEX771`hw2xNOCruu(Y2r1~QSulC(u< z1Fu4ji&s*cwYEWU#W&KtUr8ARV4yvDZ^rbJ)^q8&HK`^Gyu|FQ1tA(d)QlB8QMSgv5RCCx_dClzDg zt{gms%VP4LPH1hlBNP=^;5`Xw(_uJ5VqI%eCy31f|BkRN_gHBT(sAfq!iUsE{yA(r z1skF{6<-{@i+{wmTir6kV44O|$1p;84X9fa;~t9fY%Cx0;D>45^4C>_b+X@J2p%J0 zRuWXnBQDvO5SUn~Q2+@f}S*CCBm|?kD3C*lt&(Y&o|sCJA8g*V+09hJG|F7Z{a`u zptlp4k3V-@)(TNbvg@O&9yRr(O1Sw~`A>vI6M(Ij``V4rDNTvXWpOa^{a;@nBQg*UhK+&l(R*sm@!(cp`Zf;3-68D^23~igk|APllDRzG3rS zYK%c3tSgg8rzAbtPL{f9qo)Jk%X#KN(bJ8hIY)YM<%e>_X7wP0qi8GK@dG$60eDsc zY#j+3DcHHRr2s8^G9&HXz!n_q@K5nZ8(0@D*#6-AmDY0Z63xbw5EW~YUkUSA5nOU! zD~PAXZ1XB^y~$^9%S1o;P~bpeq+?x6#*MvFw9uJ4x_B$ivKCgZDY0Y3BU2tC?LMzy z=({tOb(I5CNYyeHSn*!ju}`+<5y|g!C(4-$$4T*cdJG1?k$qGMM7qv%q*@*>^psTl zXAecqhsO_G)&>}7FU=Rn(t3`{IP53^S9g;j5BwsRk|g)+MzqFA^{vlDm4aD#EjTeIqfQMmV&J$u18Mu2LPe|`za5dGqAG- z8f<=s>*p6N4!>GhYtz^Z_E;?JXy>|*^LS>{L-g_Xp zrEN^;EgC$VFv@?@@$*zcgwp`vW%&W#X>ii}0~Qx=AIvDRkMa4H z+Ec1-O)sc7GTWlr+V%Gtt+yf9+36^0zwL$tjS)9tOn?5@1lf*GbChA3s2)7OsjHI; zDakr-ADQ}3FQp&K64s%h(%2RUaciX!J(ht<#&2~=dgq;;v+ifP-=BSo2i26qVVPUFzHyL;pA?tJ9Fd*8b! z=X^hV>>hj6u3CGpIoDiOdqtkPN_rAcQsiWveG9d0MkFSSu}qPx)#X^fS$IYj38Z(s zn!=e7J^Aaq(ISOZk^fBoph*+4b>jw&+!AA}iKNRH#xp3^r8P?|^$;{j&^JLF_!m)7$Di@);u`ny!d zh3*i8P~T_cpc@L$xlwH1)5jGQo^{?7KiUj~;djxk+K*$ne~JX$y0u9h&vf^0oDQY^ zP*tfrt!s5swRt+b!<+t?uyK3;#Cf40cR8cRRAi0i3DrWGMoI(?&0|nQd(USO>)vmZw)OfxL?iJwEU}Ucvo^gW9;xBdl+jZ+bpFlf$-QwrWpp2@7;MH+&c2bkUQYXRd+M1Wm-rs zV6IbhfP>3T`uC;F2R9+)a7vw?sb72wk5#mSatW6spt;!@6y=4m0p;_rezN{pWGqot zxI*mF+f-O2G1VZLFq8+82bWHexwGb46JZL+q8@Ai@`IAQpdMxSF#~@`qW4jksojkX z>6RkhJ`Ec3G6_b^`NsL_62Lk*y^o>>|P()Q|@|HxQu&DHyIB(vP;(RkzV>9HBiJLJ+a!uCAXL84)At5`BcY7ciTI7U>8Ta1Hn_ay%Qaz7ZNG ztB#>i5X!N|9x1dg7U`s%2wAnUzycQvOUu^A$hbH>GGBoeu@=OV5@G*%L+C`2|_TEza9j4byOPE`k=Zr zMo0MlO8PeGdv4bE;im>cXmy4$1}sfpmQK4xM{6#&?t(fZvItaG36I_7 zz>cisjx_$cOJVEr&7A5u)EUPAT??+?gqc!H)xd4AYjg1Mv}VvmAvrW8j$&3%3z9o_ z#b8MPDSt{mJ0Jh7;Gs@?e?x2lwn4XQy(36%Eo|KkOxRgHMrZrARd*z{DXi^j#}mIf z+6kGRp!Z@HO}>FS^z8DMAdU4sVHqfHA@eGPP3?B~81sxwZ8oe%@tEa;LQm5U>szk& z{>4qygh997qj4+4apRfY(DRMz5UL@b0o9;(P=DQHz!95_G*|)m$~$%UhnR+`PF2V( zhBfg^>vSg8I0qJndbJurzKMQL8qgu4TK(jt$tLZ40(kMOQ&|dBQ_%_Huxf&0kHN;( z)(*3@k5SiQIX<3zwLo*--yGk&GvC*bhHHX@{Af!%!Wl-;|C3CebkoAT@0PJsRNRqYaL+- z?td|CtCn(JOmiPL^5(SPYM2VR^I*``tp)5!KHj#! zXXX{(=>uUAF0&ysoJ3Hf`_YpSq2uqWfm)3m z$}v%)Wg)Z~H7&~iMw$`~gX8M%uc$|J+cB!3v=V!O9aZg&jBsCHimI4~@3>dZrYvnX zk&fB7Y>ZhSgX$y+{MoN<%p}t!aLjsSQYnzay|a6<6*xni$wj$rTg3IaYMa5~$sZ&z z?$y;yJlMW@$TqSY^k;7u@)a*WB`tOEEg!`cS48i>`qp~Lgrya^x(k@|h8Ux1n$eH(jAuI*T zkxMkzDV-`wAq0!!^i!OFoYF3SLL(xx^r5R|;F%>Q$uK8tFmo@^bUZTpaGK}TVHG>+ zn9weJXBX$c)N5}22D^lu?2BhU7oM{*a|2|0`t`lJiAtN`%Exc84XNj>>fDTz%+T$T zS>~a&sh3YRs)o_V!O}J5z)6nrwA7C>jXla>DvH6Hp7*&jP$CBxpMk(pFU%Flk6ptl z^a|N0K&9w)M3`swkU1TVm}3EwWovd6NT0IE5MG#AfFjF7C|oFWw-^yp=)DeZqt{2v zMd5bzU5$BZe#ePlo)pXO%w$l0F;+yM1Sjt=7e8&5WuC;4X57lg1ika5I2wK;mo&UZ z`tQ1Tn@-$sOEmno8;Wt9#n3%k!`2JxdjH}=C3gOR&~R~b?F$tNfuE!H?y9MXUL}fA z=H_$UgpSrT2-Q43?r(uvtL>e}#(}xHBggm+9g8F*LLcb=vUTp? z{+9HroaC>l?uOn9TPy)R+T(rgCJ4leyDJJt_cYA17Vr0eo>f$JZwI=%?b7Z*vzBQ4 zNea!*U-Nd*`v9@Q^KZ}m+tK>`OV*Zv+Y%$s$(DF`$QbML{0BE@UI=xpn%U{_!^yX; zEJ}wHf}o_EJ3(cYtY<+$d_*jpT4KExl!oEcU8p^2!nM!LUh43*r|tdfUp>s%IeWDp1tN&}WgdsG{?@r#^GsNZ)$AuP(1*5nSLysmu+NN%{$viu6;<&Ct*be~hqC zYY|H9uKXeCD^@fu0^F4ZXtxUHcZgkfBEyqkEwtBwH-|l-d0o)k9a(LovF+xC| z8Se23O#1^V4Q{G1o!`>V?EKdldhPrh&=E_vi&Q2Htxaz{H26q@<#765hRzInrKDUB z#5tfg6<}Z>J`ueO@Igj?D=hf$A8klPx-6+z&ugE#*cAZU?Y@4ZoZV@o-0GCvsiWG4 zgZo*$*ioqBf*gh=^-*?KA1hb5ah!}QP$1uXzUkbF__lkjb;#a?f}J2B$c(YE!Dv{{KHT z(lIN}CfC&!RZ$5=mTAB;60&k{8Sr3Ug7Qbde?0@)t_yY^5qU;=*y_4nM9Hvj%7%&(gm!P$|}@*~{Wb&nJz(6@Wwi`F($n3I~A) zrC7(CENK&-Q08N0DMPTx4f4^*N-gii`_ypmh1i?s!hH5L%Poz6T6iD)cMHxe#)JmW z=>kk7LADRW3*%Y>w*6Gffv%{KG1*B1_q}~i-ShJ)eSPVMH9JwQ(F_Unt4K_Ibx}?K z8$SOT@bAEq{r-Dy%7Qu4-NOAE6dS%hzx?DWFO>?Ui@czY^V>h;N)@0@r1U4Ch>0jH z7CoJ94%c*^{ZPvW|833w=xV&yjc-x~Y3Hm1sOh{TsSHX0@$U=|Cy?7OqA}QHZ`;-u zFmdnKu{$8l9(<2*s6B@3p|HbwIRRp-j%6*aFAC_+Wj7U?a<_k9F8)~fUm^Z~W3(}Q z=kN(BUoBL?9mie^fgICVb6L6`D+1QEh(5o$KR74>ZbbGy5Lz8B9?)I%wq#f)7K3Bb z!m(>m#nm4lcyEKk1ps$9On&AGO1*3sErFfw&asdXhf4Ms`UFfCI2G-C#zHUbMG z62pm{Q7FGRUt4-lVVoKlu|hs9Uv|toYnxLwpBEyN)gGK3L&ATI$O=$WES0^BC;sET z{MVp=@%UON@OI7VF|o3-If9lC965Mqr4>cejugEVE-;Fyr*?84_H`MG$%UumZZyHu zxut4belz@9&W&0%Hv&!~*aHB=SWJ8YSbKXC$Aul$&W&;lps(A-iras$mjjcPSPQV@PeXMbRz`L9^=uRE+#d?E_Gkn@ud_$Rbsh!d>i z8!>MGXz7}aKlRCgn|4@+6_4lff%dDm(#O9K#N88YIM>AU&p&S*jt(h*EV$I zAL7rZ7Nufv!(*H;((cP*LdinvKnjn!g*_{0GM3xXQ!`p^;6(=5PzuhmRz~}hPqZzB z2gM(?;lR86TbT+8uFfOc3mC^j+w))-uHJZr@fe%XrNrM!xjvr9t1d*w5TPZ*VP#yz zeeczj#(J(~{0>pO`7M`L?G{gt(1bgleTXL!Vv@mV!lsd*h(j-y;>(*@vxCE)%s zMp2jvbO)jHv~Bmckq^6(&)oHC%!uEsfdsP7pJYZNq1yH{R}u!?)zjBX)WO4xUfX_F zYeagl*y37F-SE_o;?Qjt>vm>-hB6U>N4z{~f_8kAyCv77pu<^%B3`gzoD6ljGq^kN z-3s+M1OzO>godsqYfxl)Us=Y3?Rg;H z#}zm0FFo&j8(n>F{uBG2kavv;u2!m?ikagXa6;Sz2&o_dRRj2pt70BgpV+M}eih1Z zX_5O;4bX5IJK;gbQQAwffI%;)a#sH2hIL_$1{m^gV(%%fS67q#VJeDJa(UD)yNs?m zfa9o~v2deO2G0Qyw?)tYmq^FQ_J>nbjF=2G!) zU@Q;Yl2hGB@tciJj#~A_Etf#F1lHh}q>cWFg!uEBDEc$dE*w4(Z>}~b%YU!Fw$V0R zJ=y1&#mefJ=)>GGHX}E*eWxl1fI%+1F|&JH;CSUR=b(MO3(+U|96nt`QBDz71fuFr=Xld3(Y5@FrsI+#9lQiO&T6f z(hi2O&)YAjWi4(9-}f^b!axv#`@(g1$fPm;#f_Pm>(r$)LNHGn_p_a<*b6raB7c;0 zk~_VkJx9fM0dAD-4@qy6C6%F`lfl=s4j7#^KW6FxelD9?ag^d|+T6f>`y9=XJCYCi zlEf@ZqnvBFuNa!|tqGRI#%Jmww@I=`WWX!QE1Rwr^t?WUJ8K7zhXFS!p_8@5lWYlQ zBML|!Og@%bxdAaC0^Cx96|JQwHpnYEk+ibEQ=pL>Uq`7r|S%3;&q&=kzh4Cb2KF*+}@~xm*fiEaAgpHcq1lV z{bW_pTKB~#nW0O6BJXO=D}LFC>hz@#VW1N81&7~s+Ut<{c4nV0HTgXaP+GA=F}cPw z3x^JJRk8b9V%h#CI@UcbJ)R8EDQuA$Ec{l(oUuk1BcSW(o!u^0Em{)3xLz68Ed6!Q zvuR~JhhFVg-mjnc$Mx6119-->b-!s8PYkrJj@_88PlZ#(#b&0_DCYm1(h^-NHHT}9mk%2M*vNx#*4#sz@qk!RN2JFa$epkpFMgJ zcyn2w>9r+r$;sJ(!sZ0S#HCYNsf6v}#A*Mulx7QH5MGGgnNf7TG!Do8tn_45yNN&! zI5^phj10mY_ab18{P2lboJDi_ETl+RWdu5>Xk-C<9f;BYp135+MpSkO{9C^2f_#WTGcwdhk`XT0HOdF*lHDrv4>WeG4r6u(? zD{r8X*IF2Uluu_4(~@pX-f?k-8WQ?N@u8ju)zA=`^^SHGP=`9!eQVuV&9vCmNX3lo zN6bc&rxv3;F2L?3VPL_stQw!&NIC1CwqL$0VXJ~_1BNC97%x+^ZMn5ERh)>D6UMhV zv-GysQf1{(&R)3%E#8m%10*rbbfKGLFGjdVT5o2!>!VXPxyXRTyG!z=md*xG$v5C; zr>~_?5_E3O<1 zx^*-=;%uQQRRT?&M2tIEKy2CbBqncSc62&&?}1CrGX2$bv@TzezD->AKbrcvDf%0I z&p*3lBRrMxgtPQr3wZa1iHQn+GE22=7cZ*_UTzDD1M8uXVPB&azsNa)68vYDPW63v z$eudvju^!4W`D7ij?au zjSD-c-1`S5b2P6(G8>Rgk)v0zVH|SJ&Nd{$OXL-?@ zcA>2w?E5C>Rp3F>y2t9qOvIK*B>osNmV78zTH|`Dt-;G} zN=;|q#rkUROY4kCd6-dou*pb^1Hbo=h3;wRGK2C)@ZILellczsno$<@1GJFq$C>S@ zRy~f%*TszzL;7AhLSx4YpX(yds9gW2%d&rQDVP zH(cq0hrJ|~os@$1uE}=fv+bMx5IeQIiE8);XTAnKA$a+oXnk+uivh|Af`KtTCQZU3 z9NaXfp3&87dr8Wnx(Ty<If_JD5Ti=3 z2X?r{Sm+csid<90m>nIU47)LKcsjS;W6Is$-CRN8X!exl@Z#7nmUk z5@vLS$GDq}>3AY(ZN~q}2|##n)AGW#Sh#;GhRHcGftn}-f!^Lt#gVdi*U$H<92`2y zLzZ&QZQ;pZ9EItZ%X;`UP4pUW1UP~&f}l`Mi|Y!+kH7IhP1^74<^j+}m(>WRYlI?W zBt|c%J6)S?=w_)#*K1SRmYy2nKux-DkwC6YNR&ufr7!rA7hSDZu72)V8din=b5mT~ zF*~wb12p6|LO$yUhr!RSm~)_0pAW`fkw~v(9}idTbl1g*-E#e!Eniedj61`tEdQ4s zEko<|TezwF)t~)v38hM0zi^egi$!NjM{`zq;}a~dl06`sv^Bb3j^#gHr3KnEbgEBt z9cKr1F}*yRyuC!B)nF;^ED*@^mSFG%E+%^o@;m?fK8H=V>|VXeILKaxi}Jt7Nnky<`bzIq|Y z;{3EL=PqAaJ^T8SKP|k*TCCYa%hri??i$xTFO?ghk(*YOrS4dnuH;?i;iy@Ovj{5} z!|o>c6bEk1jmuL<_bZhq`?q3>lUFUjtcG$p27T|{ z0eYF4HpO8SN$#6`g*HhFH##3WV9?z_z=m#*@T*P%ch)=9p9Q(3^4v` zk(PRT#p+mM3m3OMpP^LlR78WlMLn&iQsY^E9=`8jWxTY6FBdGkn+M7h(dn+eUcOQc z2l7ssmC2Yr&phuxM3*As*niEBYI1K_b6P4c0+Bjh zyDl4kgr9~mf7J>^?_Tp5r#o!$n#XlnnhE{ypMPlId|w}|k$i|M_)q_E(U<{(DOJw! z=vA?>KXA7`yP&)zI#J{2mi~E{*MX*%zKf8Gm;{r)jUi`r-FNZgsgKX~cKr_8GKWn8 z#)|w{y4Z!!Lx3e}77^F5N7K-D4G<^^3S{>#yI(dOl0_uzZ>jbjU;#d$k@Lq$TG}_I zMkKS`Nad@j#Vt%)HKd|8usBPmC9Bzz(7tlnXD@>4mWWaB=i$PgK4`nA1oeKouj#Y-~nkm;vg~ z2J`45$gDlP8%3SvE0<82|LPd2%t`v&YOFe-Re)`-Kafu;iwS!2(;)6)b9@T?i8R1j z#5(gBIwt-_{u8uQZneZofPEAXRNaXF?i)zihVYMDn+m~60BGa9y50Vzw03e0(DRGQ z%0OtIi|z=Y6diNb^ z)$b!FGiYJx{(PhNw!v%9B(o|f0McE(Z=_g%oebGi(jTaxtZwmOvg{Bc`wppDu!UEC zcEQM}f^nThOM>y^#rW)=hjUlds*glKub92;Be&BOO=rVd?EBcBKM4wq@1$s(Rp-2+ zAXcjz%}7HK=T{s-OA}rZnMEq)_oEX0`o&P@`uK6fN1~2FYPX#fTX=n&Nk6ch^VTbL zut(_LhY{#$I?Z$9NCGZoY7ry*#6{up`x^RvZ)tQ2rw_X*6O^1bKSqJSeRA5Q>~Z5n zomTQS)nzQ>rh%~fv}rkzl>_q#P0r|LL0XNbX=*wSe}WNG>~wlvrp`zs!oVD+=T9Pz zII*!8FS7UGK0nJw!a*GKp2by|lVwBc1z3VIlE^Vb+P3MBh zNWC!;zWNg{{zPJ@fH~DNEcFQnn>8$@?Ama;cG8%$Sl12lL{5>Ag7;}7agMEAvB9RJ zdpK>^MaLsd^czX(p#(#|TBY+3MB=ehbVWTx+(;~JWX#bp1C9lpw?D!dS5xzPP&)6F zbfq-@L?>Ai2p$Au=yg;QCTu&(r5Mr4sQ0zWVl4K*d>so1LM;}vEV|~G@jxK(iCWzPhKc!Xjdh)&O6O}DDP&s zF0Q~FX8p~Xa9%Q?oQHpg9j6%ABp7CAAf;@byY8xl6IrNB zjeWG*ROYkFpEK!&^VSJx?^X$rbhWk8n${|_5U8%OO9PsygeOr=D8-FJkxo<2) zW~%cFBX4=qs7?(R)ky)FF>NP8#(A1$#C(bC1sr>GV_KX*XDUm)^-kNCnYG;nvS`_$ zzT~;Qc0=ZAqP%uv%!`NZ&ztzXsAtF?ff^6k8-}3X_n(>e8W%a67a-X|B2)f6hb-yd zZHb^c`hCOqG&dDzt=M6acgfvs=&S{uZN$VyT(<+n+aB2}R6CC-m#C4?a$;DW_FC%e_%NP^l82AQ%e#h-YfcqAF4r31e zDkU}2cWLg<{h^jH?GLZ9?YHoU zdAzcAKLM9b03>^~4=&G! z0#@~mQRal{ZCmO~)nE2p9nhRtnga2kNJ;pqkbvBrCBV{Xpd6i%j(y6xne%obB6-hv zrPfR2#+`otV=D0RjL#XP0B<(**_s?~T2Dv)1;N`T-uRkB(XxE4B+S8o9EC%LBK6QM z*A{P^@Nq+xV7qb%hH-t(vg3BKcizJshhgQKDI;#GP}fyC){8qE7KsBG)U+6*PZmF~ z60uf9109nCJeb>f%zsd+0;CbB7|ZTlFd)QEMXXn1671}=ql=zswwc$J8u%BL-;L+@ zn)*wk{1GIAFps?d?PXY7383j!X4cQ3%WG>{^L)`z{E|P5hKwF*?aH1MM-LyYERkw< zP)J|2WgxLoIMsgZo@jHzT3<4tuHc$lhga5ZQ8{U6cilF*82VWNn);$z;(-5WOunS; zrbL0Hpv48U`FRS>Tn0cE7=4l}3w1LUVO2&)lE3{qabM}s#oJ>Uk7>SWifVS-D1_Ng zKB;CZ;t1_PIU8+LgYOaM#-3tG3b!Ty*=pAew}84x-s5r?;TRrgTeLf!SaLZ2+H)R} zzTUkN4R>Aqi&3lPAsXA0s~7Is`OPQFF*xwX(t+dVAx&OQt_)d;Lbnk1CI53y0H z>l|4>sC#T`%3xO432Vf2a6E~JZmo4u;-3icD^vIV&D8Umh;F6ZNVxx*sk6QP#+iY` zU`qEl7K;29#Qb{kWdK7n@1Lxde9>29MR9|y^!wjPyzr{Z?~BK9R)g99u|f{CKh6FX zJO1VBo|=>CzC_Id1jvVyJDR0N)|%f`$J@Y$=7t~uMOJ;MLNUYh%j$!gfcnA!pvQm6Zp?U4g^G?qRBL986vqUR!Jq&htfIN=ff8?ZK{B?_EFfQVknCHLW-vM60!J)mk!O z03L`SoqA6)Gmd%c<-zw|GTJj~{vJ!P=uf?LtBm$qhn)#RFghnPPNk_*dl(|>vQ*1wG=bTWJ!to)BGLY*q z|BFKtOJVPndXbWgF*9=|t`cnahT#bLjQB)OOW#&}<(=YSn}6Jygg=jaYa|28`Pzec z4%{A;b=ulR%Lc7Rc;0 zF6~yJR$?__JIbdaoHfarf#H&aK^$Ja+l;6D&5{m=*?$ngb?rBQp zr6=b@fPD>(0$QpyK{L2{E=TF+cUevS6+08do3g)xaJRPKvgfkvhhz8Y%SK>1IwgYH z3^z>)7X|m{ZO`>4;BUR$>Ct5@9~D*(<~rpU{(K)!Cx6eS6E0`)XML)N3FbQwIs8^V zCirs>YRlN(J6(R)D|&cwoQ_Rcl%Zhz%v@#5G$$MVEOYJ$a6eggkFZA2(cI+6k`W>4 z^tfPKV`{{QxV5EkZS5psQVfJ*B70^tcr$A#*xkW;kV&bi!JuGiQX*B{rvrxFSC zyyrpnNi7R>37_=QAuZ82RxB*L6a+PTNV zC$wDgtgLw0A}d!QvUNyj$yhJCCxrKvy{Y~N1-^tLuVxMxa~~W9dXwgYs?3ja2K`Zx z-wwlR_wwvekTYM0e$tO6Cqq(#d3VN=3o4!v=W;Or%5EOI4rwq#K>M_k|6fL?R1_pv6pll*>OfiyBP4;(v0qJygedePXT;{TNd)MxG=katS(;TPfzSOFg_TioO z**z+N(I;T@-Lb|;htw*7BKYEA@J9VYumb^VbE{-0i{gVVz6*gl!KKR6>*QQ$fhYl2SGBdCzrd5|iNf5wo&Ie)uo=xfaWd;tusR zB0&!u3KK)Yl}xPV-f5neM(Ukt*f`8TCD6py+@`*LRtj81l@>|#m+SYrZqyrU66=HReZU@Hv*713%y5oiHjfg)Jx^RMqmg(s zmg4#wi%DjmDQFwEHUr^FB=I?Gl@-M%vzbFZi>vA_;;uKOsWBYKQaUnO)_3>)f>KBT zG3wn$jxed))N&ETON9{SCzCGS7)Z;3^zLLQ$BErxZy?F1;|cXRHLmto8{kGa7Urp= z*B&^quX?5FJx?V7yl8DL&I}tV>uyC4!K%B&h4vkte172J2!mk_hH-LHdrX{$KT27` zt3kgJMRt^?lY}f@=nmMGY%ZZ9yOz;tKnou69fV%Z6wVU+U+!M9ygK!sX1U+Hm9x)X zYEt|K!kKuXa{<*w^Zdw#Iz1^>33_LqAzL(au& z!X=F(oebXO!G#%SYs22bkPH?3s6Xp+ZRI{b3quRuri(Qhe0i#Whe^Ew=RG!f_6rYnw3-ft?+ve&(6Ylsv>VjPtl_e|sFd=UG3g zrH{ZD6e|v$75dzHXnKRpW|?{4+ygpDS)AlV2Phoj1ebeMRj*S=+0Y zhL$_1Hb@AzH*TLgqrC@Rs1+b~npqYbbP}d-B|Qx*E$VR=3+i2OajarnuO1&L%w5mu zG-Wk8#(VOfZ=PPgkN zdzojb5Ai#?DA}ucGBQO(xVT{_p4#$yAI5qwJsLf?-I;FeGhyK?rJ?rAokWZXs>1x}SOHFyoVMe$g@BXZY zw#f+zVxHS118=MInP!!*Nk-#*bmO8a=VWs2_oY#$T#IVYshb{9w)304w3A-|X~dRR zd6XmxnueE@EQ_t{hraoBm_NJ_m9~vzX0*sCNp9RSID2kYE!QOdS4XEq*doRc+AQ~X@0mfJZI=xEcvJef9!EJn?IVQEpb_;U0OpEq42|2qp$eRyQT zFE9xe#2c72DaJS=CRJw8ZBeMVbzyyRy@s)0 zBa(n1il?;%i+Gt=#9}TFO-q9!orET8*BqBNYWeMH9!4HK`e;;qhrr9TV|*1x#BU1Y z-E4#mVP+{W0c`cK>aPS&&q(ENo)fZspWXgaQ?9)yOWp5v$DFA77Al!lbqzq7U##Tv62DNOR2y+YOn|Dbj_G9>yB}c;mEl z(UC;%02EoMO^dm{m<;^m=(+UX`KZ-C-A6v@dY-B1d(Tfn)s4xkm?$#!##m>sc5%Jh z4>^K9m*VqRW^OpRroPnxn05N7Lb!Eyd1L5PZ07OJ`+wl#%DG3rxK_1bfakM1nJO>j zj~j=!hYeeMKB3^(%mNe z0@L2)co#`(Y^I)cxT)R&IN@TGKx|1=r+=T~)t{P&s5+oa%p$>Np$jA`-hy10-6Xv12VK%uAixzSmv@CqEIC>0|G-Y~{i@>C$a$CuRKK)I^? zF`en`K=IfpzU_*kFgGDOD3RQU@b|aj>D?i7stidF^9s=CGQ7$4bw}Jt`pRts))b}D zzT`oH)tSNh()^HY1nGPoy7{0GLDMGw%E6fa)c1=9eFq{~NIV;-DJBPbT9q1L$FW@E z?d$i*hCSU$*_gV;Muen}2{!;crlgkd9B%}uK) z1dA#I52Fl#K)Zi+ja$o)*;0GnO-y^V6Pqy| zJ!5ua<`B-dn_-Q#IFqlYRHwW&>GN5mH?1afrYSRk2RmxST&0JZiB_byXA3PBOZCqu zcYanFG0pBg2JXZ~?f$ghtzOyvX`BLnfG7IIm3ecw%p6=u6~D4$4Aiw!erP{PF+GN{ z7O*0I$t7eOP$c~IHu+%CoD%WF`n@|k2gv$%G#y!(4VQy79)?h^=d;Vk*{VM;yOQFR z;9XI-=Dj4jEE>al-rf(*sLhDink1TYg;yYIe|kX0flQ;eprfjv;rJ^({4(3LcI@0alwVn(_bwGXG_cEiSj9a>_zf_kSlG@|j z6;R0N2Ih_Ta%di3;_`p)Dc^sk^+aO4nsIfm$AU9fb3z&#FH!Jm8-stJnqM4mov=st zTn+2RdZLkYgu{o`gRi}_l@#Q)#e9vhr0yhO@u@t|a~mC)o}5#akR9m z0jJ({8hq%vwC&I!?~g1-sXy(+(QI=3qWjw62~fM^KJC}}v-Bj|H`ppsbwlk>olF`D zHeB)vXb|i+&_3M^Ke8(*J`PcCIi2NB>X80qN)RGn2Ef5wo&hCbCxZjEdGPa|;QPq5~-;TL2Afn;2Q z)`Y?b%DZlk{b76Cw_Hhua z44{nRpLDsSy`{59Hx;q3;pPoIy1*UeGV`+a9J2PVO$N8|Z_h?Sb5o8%%ISM&r?1}Gg19TV}(;(!qR)gxGE3n$*iWAg4OR==J?Rq z$wt35?iT6M=>Y=OwVCzKD)vI_2V_|sx{fCK3wPM6fX3^p~?a(3tg~>R`#%c{~a2%AWM_ulZ zcnnJq<;EN9LQ?$$D*%8nmw!U0Sjou|p@{>Jyc#e+r{?Zj4vcU1!x+H9yE|+_Wsbvb z^f;({Op)9#0`2fQ-rJX74d<2JIg+jK>v@SyOx~ww&>>ykG(ShssBN_jUxI8wzE#Z@ zP8JqhijHk5L6+T;w{AL>l8c6bbPX2e@2)vk)#ruh+{Luowb9j7DK$mx$=oaMtg}kd z4OcuXUq?HClY`-2Xl)z@h{vp$;Mqj}R=5`N7)A`r(-EcQ17^_w`4O8wRYg{ApS zW{akvwQBY+hYK5z7e%xa|G>asdutkg_xIS(in9Lc2mY%;$mg|%$GD9+_`_cp^>eVul2L zGSqSxTxYET4lowxrbajJFRT5Q1rAD2VH0YWjO)AWvNpdsl&MLSjVsqX|F?Z!d1dun zx@6DdS8M5KMnhSw{xg6Rf8CF(<$bTi+*hYSPV-~$&o(Q`LKOMJqF1U8YmJY% zGXWM|`x!O5GCDc;tPjnb31Tz&2m@ z{K;mvRV@bXmcAy1439E`d)Z^peO7~9%{%sK?h*A9g* zS5>2@Z4cMtlsS>4h~?+|+~~CG07_oR&4+mGuN5%w0|exlAwD7U1w0387H9A7$aV?X zR1UIep8-)gOw~1>*T}S1P%OaH_!R;`FwT%uE zGs|Xi=@8u|ETsLoV_Zl4ixh&eq-3*4;jEE{HhVI&MGS9wYDcq^SRm`b95yn5uA@pZA zc~5U}+e+*`3lz?8=9OUeI_g~lEy@)VX%<~?al8B4$9zw~+gN%$F1`2|84#H7z z#2-@VsS;jA%n&*R#Ndo84qv|L?Jws@=1xi-SiEsqb}DOmaqNo z@s9KQ6k%!E+}KdCcSVH^dDuPJlhxh`JG(HP6h>AlNQld}sf2^}buuor#XN%?!j84y zeeR|#&xQnqelKbk$)VDi&BC5Bdv1LFxO#}0TOtVR_0-cQB|yOs9Hw_c8wV}{C}(ts z{Wb*CFP5B}xyRx^AQ9~EBITg93-~@6&B#c5} zpuLqeoW@IQYW_9nI{UpOK!7Q#e-JTR%ews|T7TkrWmx&*0N=~PNT$_>v(~7P#>_g{EM>Ly*pI>O%bRR4k+4SBXO`E~^x1ZNp{F+Z1xO-yO~7@F9c$|Izi9QE_b1w(ubW1lJIp zKyY`5;O_43?(P~iNMpg>-JQlgxHazX(9kq|+<>gK^-Bhonhx0m1^k_$#+g0OvS}H|6 zbQwPSi2+MRNZ^K~hc%9EN7L#0NGa<}0a%UGbfPEVvIkPVx>qn(TzF;o+*$f%(QUqK zN4>zInzSE&3rF!#8)}csd?emJh{rFpwae-0uV&+*DYzVX>M>ZV^j-49g8LX=?t7DU zXNoapiHgJE%(ypLfc>KGBa|yWJD)xwNSQI(tm(Bs!^V?zyS)p73gJGz(-8-V5i}Iw zKbdYv&{@rzu%m1}K=r_p}5jhV8NT}ye28o_`wJ7py=WcwfnF3V~0P(gu^&R=7jgU~g% z)@Lw_zb%!(vt=Si=8C@Jbc%>o=d&w?JVOHA2^Q#HPr}a+`RQ|aCNF0=ssKYD4@G9+ z3ybv0p9R`?GN%6wBHlxm|AjfY6Z;PcWI0m%7Z;UQ=Ld2c*XG#bRgstb_JuP$>mtE9 zDGBOJ!5&TAvAiGFMEhdHKFJVe#R|wxQOQ&ACx#9;5|yN?$~G5V;`{kg>mgA2!$(?^ zT&)!bLAx(xeMOPMo%=`uY{W~U$G(uibm4xlxSRKIxq@QCepfCuq#ep(krjG-bBs;} zZnqIM1Ylrw_UWcyQk4v$qjKJiCDCNst=9DmAH&Ouo&Xh}=;Ah2y>Ndzm(+A3``Cz# zq`B*BiEc}GcD_K&K{d=-``MxUq7YC~61m(jHT_*n|Q6if!Y8pIrKO>BP8wC;RJdg|iJ_<#D={YQBUCgJ@t55&z zky>ss8C+eP>0Dx|oxhWInlkDPN47|<()MFM2tZQ~RgLZ&9WcbUuJ!Z51E{%u8tg#Z z-Ik5^PDngFpIivgHr;*P4^r%e#KE*6SK%Iny(P1lZBHjL4yV1#-QIrYMe;>9h`zCN?siS?K_bX6*nBy zgd?jS2E~&o1#K>8C)P}5DhtG()&!%cIp0qlUu;!y8quG1*JbX|6SG2>A))fue*VLg+&PHGI=`e1CdE$sw9aXc>h7p} ze&6v+A6lJkJ3IboFZh)sy5r(0@m_+X!8z+o)}gGvZh?ULJ%!or(o4q=H0)7-X))Fe z3DAQDQQQhJi;+z^xA{XW?H4&~+*4J>`;XBMrmMvz-|h{+vjzxeSh-8K(0thr39omY z(PfzMO)9nG#e(2~&sIpXJx$3C2o)_*m%mG7{NJg1kOA%c%Q)Qqr>W_0N?i`S7&3MsXzYBwBk!sf;s3ltdyu*Kkt zn|dN2I|vM9I;gdF-&9J3y>rDkh;;o&Ibxn@+ilgM0ikE3k8`bh5A>6NYSrk_{X*mN z_u{>oTK9!Z_$TxLc`E9Q0&YHoTb0v=Y6G|-MxVsnccg!WhQ{(kxrf`yWxiaPMGdHb z$fuZz!5tZLiZ`;>7Sy8BaMcnvM2TG;+1wkXNjV__({zbGWqsFjLuU zuWr40NQT%aq4dz+?B&Q#l_T|9N?nkpQ2YPRa9*OmxMp?uNF%9Im5ZqI?S3ey8f$U) zBwCOf++g@r!QaY|T|MyzC6`qc4oEZG_`~sERg=rMZhnP3-IP~|xj+7j%b%RfYK{QF z>@nPgpc0|?fi(+FhzucVvGC+6zIHos^M3Wq6i<_c#`*c8j*eBCgW`}QKI=tynhU{# z{!QGMW4bU^HDV))SH-C=AGD$P?kyj)l~>hQb6WdQ*ie_bM#*M+NYwe5rTRgE-e4!$ zA3ith=cyEJga-UF)_2jOtUka{72R9)ul$ecd+Ln|hu_AQVKOAo2Y+IiM5w7~ndg<= zo(J;yfdcjj1iT#HXS>w>1IUYe@(HaUx1$+dc4JW!oL9(X+aILNH(t4QBoD*Za(1R^ z%SV+r9Chk6xC-8c(I^4GOXO|7L7e_rD; zy^kX4o|E@4cA{TBUZ-&?Rm5GoRyV8NnoMz2>R3an<`sVzfvq5D6mn+Sw?xgC<;I8G zC{Q1WvJyH^$QMetNL@oiNO==S`IXlj&xvZKpPrlp;ePjjuR-F$bewBftmg2!yH~E7 z@P&1_scQqyYcJE^uEg|cL)z7b(0C3*A zy6|-u)uB&3iM7k|6{^*%VhXnA1}Z<6?v#3Zq;Sdi>KSFc^mZj&`uiVQn)KV0QU4c@ z%JK4FPy*$DmT}A?va9n|c$3x+1?49N_Y0pMOCpqTjlJo^lo-X50!VyVn7^pBJqIME zFB=Xf7RVQ<`^Ix8ugxEi0V=h8en&g7)xThy8Ll0pFWz94Wb!5+zc;?LvZe^X?u6dn zKi>3(t#n@ZN_Q)j=l~+b(Ad~AaG(A7p6pC|D6KqlqN=%*YI@j}HZunF0@_nu*ladB z6807R$BGMR96bJi^&>kAHY+-il`^E|&07(7Ei1f%rPZh?n7=&&12tNBO2FM&hD?W8#+#D{|QgRE$&uKkq8=Ah1@ z#cdyJd4N2F#B8P~=RL-S=aK%%{C=fA@hq5l9BYK*L6|Di@wr;bi$ zGHae$R33iZ+*kQqtTE(72*-K36+Qb;+$SDmE32Ys#q2S^Q|Xk|y_ND47u9Ey;Z^5) z9>7c`BA}#YtTN`z|FlUSnI@St%fZc#OSEEHFZv{)Fr^vg&kDt23Z*w{P0y)tan^QS z)=6VP1^|GW27FA~+b_Zy;dE)>8l{dGA>z#6#Ox>I1lADPzKWXh2ptV}i=;ECJT>AajMnxan z?!eGi@Of*?!2TO~-EQmP`$Zh1r4~X_K>)hkuyt*;589oSt z?{Dd`+1ciD*y+XkxY5RnbBxr`*eAbdqw?CVn^|@!pDwMu&loOn zJH693Dmw;0@-KVgL;H<=m^19cGHy1-d3pur?Aj@mre>xHppScf>sIH(4wn{%wLf zpTeu3TjP3{mkniOu7ew}KPoft$!~PigGpuZoh8U_FoT(l3gI$86DYTqx^{MUVG%-& z#e?cR&(Yb;`3}gCFNy4gOSJJdB(br=N7580u52VuIN@p|zDF>K&-S9S;y|qXr3h({ z5r4TcN4{lP-VJd-{NyDIKHjCu5&Wc%Wc4-BYzdO*=?6Q-@$0vYpsq5LdFtD;mGYZT z>SEwQ-1os49#mLJOHJrGElv@@y*3sv#HWPmZ@r}4yGFPVM}5UNSef=-M`LNuiB?~P zL|vNe^hRKX@c5r{*T&5Z>yTKo@zQ4S!SA#l_V=YIBZm@F8+5{k;}n22seL>ez6H*Dt=$ zVEIlhOFYT2CRPxi#P&@g#>?dl4LqUFJ6Q-0=}YC7g+ZK0_t`-Cm)BbU%*{Uzm-)f; zmkl$PhKIJOzpgLTRn=SaLY738dANWxqv#CM*U?Kn8A`fKFnZ06v*$+_L54owrMJdD zBFLJ$pfWji>E+cmpom#W^C~Qx;^Q0pkD?@mxJB#bQeMS5QZ42}^R;r&RfkQnnHKAHMuX^fPXTs2JWby6Ez|XnHf|kXUfXBN>b4u^=9W?}HF{o!v{!&L z{4h)M3`6Zb8u@K%Yx+75gb^Fvb3Ly_IufO4%M3a+1Jd}*t}S^|^wo9I?2CETaA!1JnI`{vW#f@ZiUPdQi4AEML_s3**#CXb7-#gB7UJmdwLMiEc!-e+) zc^XgOgkpzf)63JSp0>TC{rAIj2zY&np|+KyO@hRJ)w9z#nzDHVLi#Gsd1oMkkmd2Y z`b)K#;ffHby&DfjHLydQ2d(2qp0DZ!3DwRr*cymc*=kMm_4&%mlI40Nv!ym=3;u{L zasY^3Q0qDh&qnOnSLCwZ=A-|sU5?S@__U46s&MucGd7tTv+lXt(^CqsfIXJL!b$Q& zT1D^2TP=a}9@O1z#?x)KM}$iFaxuj=r`Ol|ynl{Q;D5+vMFwnEm7rqTdE$<5(h7U2 zv|KRLSh_lij@?MXzwFuBo|y_R><`Fh#1)Ny-8#@*|6KOkvsFEfub9DwN;~{{XVFvQ zF7z4LbHOD*mlnAh*DzStLNpZe=fqJSHzc_XGp1Rgz%eMI0x?k{d8-W$g(QbB@*IhO zozSx2PpjirZ9Y!80#KHZsR}-xjwe>E0n;sJg!tbsn&pEa#|IJROtKH1jt{mlH#g(n zPuLZaxNX?*Y5Q?r4z?E=ej)M5XM@j9*(M1qo=@)Rt3&L4w1WVt^GTPD5WO4@{5Z$?vV ztsle*HfO{3@GpnTBh^dgJELmX_wM@KXAon$FHL@4yDoKJ4H%2 z`tNsKz8XxoxL`L~BG(7kC{XeFnOx0gP}vq4`-Y=o0aWt~x=@BWEBmvNb++~e#m9(a z;!wLjgSJeXV2o~A@_uQ{`kJ8IXvBEO^ac+~Y4R1p<$zonv&XS%>rJjN9z?Acv_rnp zu}(~DSdaHS_<#&*-^Vj;tjd+r_G+s1!j4@?nJqH2UkxuBHEfL>4x_nEd}^Vi%C4vP zR_5ksVDaa-XVtyD6|+nh>&g==5ITFhP8iezonFfW0q*Cw z0V-YPTAVrO=Thsf5Gg13s{{RM;H-S3hpHh&iI$I__MhoJrM`<~Hj6!rOcDDN7}NUF z_9|o>;%=NA_oh5G!s(Flc}u!c;0C<~1pX0{5^>HuWw^OEajBe7S%csuMQlk$A%`mC9~5;`(NW=Q-eQmZY;WXRnw?0@#O3ZH|%Q%`yAvn#go z0v9HK`JPU_6#=<<=JAX60lL3b3L@-lKnyXnAOhRx>538X5A^9SejE=m^DRM(dCQ}R z-ej(TiFY@!L|pW!p)G8jK!6dN&YHj7YDsi)Qnv$REPq9%APj`)IEj{UJ(e!$lFxSp z+WcKuEO)_f4v$siKe5JB(ljhZ#syCJmF_jD1O&5aO!!n*ev6Nm&K9sb;#gbwWxgHo zVj~T@tjdGbS`^YUl(~q_q;kWf;D^*2+GyIegrLG88%xOY{;-?R7;{0rR-*` zn7~15r92&lFuR}HKhVR%Nn6dU=IY=n0e$$+2)2t0Z+^I{Y%+;@(xPvu1ZQbM2@A*) z3%0Tw-bJ0eV3!1Mh%UTskuSVm;p9I-z9)wjHFQs0mHwmfIOP_E3ALhBCf9-J35tnl03r>zLrNfrq`An*`5Nh7OXafvk z&Vmb}K8HGu?;aYR`_AX0LEH)lCKJ<&beKl6{f!~dhb3<&Q4>~foxH$C z@^E7nxhrIt@|;aV4|ZT#>JGPN1ElV<`J$gv19E2xqm;Jo*k0$iw>WvPZ+72+`;Tup z9{ksWpr---!sf%>h6Uo?Si5~LW7BJ08L?MdGLnDUl?Vw_A@&6{8D-KhHo8Vr-%;|5gIlNaDf!yIj3@yhrryI5Q+*A(d=Z z009%b4V*$dV#mMnEej)RZx21v`9UPPiV~}ZPRP)NNMPOb>l6J!g0kvNtx_ov{*4Oc z8U2xhHj_EOfj~~T9{UxB^leKE8w3ie-B~4vFDoe;Btzq>#az2xRb2Zy*tWh%7f>*w zBON7JAc7d2--)3maig@k@%b7I6@Ed(J&2x~SRYAN_Z^H~E&PdnYAF$7{-ap8?$aW& zI{bsJP;{h5bY8=! z{@_Q+(|Tb_z#dpLTk^bOiQ{;7RVi$eQSmxY;IGwboYXauqg55~cwYEO?UP;qxuHbS z_l8mwv8HE0uYJ2|s`2F%Y>Zo;`=HzP>MZG=j#@#-443YT#H`~0CwljcQd-7@57Lfg zh?2|gyIOK_<(I@M;a8t|WG;YquyZ!wVg&(nr<#fzcbr9Io?)P~S?8j`*aB=a_R@E< z$uCOxW>oL+2G$aoB)r>%C9!_ECEG42G(mEoEnKdeYXwQonT^7!$n7x27VFmbq@3k~ zb!zq~nNNU~ZD-<_a`J3gPemRY?s2xGY-;H;I5r;>ol z$)BxQTK=!wnV?TyRV$|4I^RlrY03+C#@_U>VBm|G)XOizfk3JNlqWmar)C#1)mBQ3 z4^;_IZYa-jt#g7s)>sEPWap~zKwtrL0s|DA7j+At*n>VGc7joD%T$4^od>|>moIzL zFK5O#sk0JXJjQ}m$eV6!fJoSVYC}`!p}_EUGd;2_Z`GT1kr?PPz};hDfFGEZE%u}$ z{_|h9B_Z+?{R)gLH<&stw64oZM}cKM-rhoC%9GtT1fzDm0#1yQnX0u;L>z@jLWPm* z<umby+-vv-2X2(Vu%Ez z<-`#lu(NAx#G3tcUVhbJqC3WYj{9_rga6FvvUt34N;E!+P#ZUden9JfFK+)^$ zG_smp=o@BbBQ&LbW#STCPZB$;Ph?v(V3U|jAdmg_I(qoSH?t1)trXnLOIP;rzM0?<)lT#$nFN8YRx|Ou-f7GnpPJ9WnsL=Yg%E zK_g`d*8i!&0ORg#2?@{zlj<&z0a;^oXS`Zbe%utsN6330V+1d@!kB+4m2&5Y?hfK* z0iG=|g*S8x50{p@5t=X0uGUgVAIwngb71|`+Lmz^kyJDsEB8K-Q7`vSjUuZY#D91= z8_dSb)e*IWkW;`Z3=B&MtL#NKPF&Um=@%rSl~{+Am!TPCSrZD2A;3PV7!B>K{5~@Z zIf;QvPHy{5TNrU`^=Thd0OazSM>5tkg=lb}>o6$Y35Wglexk-&AXRIj!3s){+s5qS zFBTvmh*;+0?C{F(_BWdMR}w#Vbiw7D0MYfe;)*c^8E6F$SMAj7;fV;NtxjA!eN}NMfcE{6g))Q3hSU#|GU78wnw;oRWpOG^YSZuIB85N2F48&!~I2GiA z%shfhxcZnWfn`eBX)Hjme+;#8AAY7I1bxwmzgJC^ z;jF_Ve!Y${m~ounEl5QrV>i5QzAdY8R40(O3GU17wrxVwx~ zq2?fDl%TKb-K6vjkL3K5>HEAyY~T)iI0b9;u%`)Lv~jGbz=xD)p^rY$%RZ#89`5g< zCNCCrbbZ2=v!*KJDw)uU)cM#@^l%S9$dFohEK^a&^`~lsBq?mQJi(n5F&3a_NoYIG z)ar3$0FbYS$7e-fnsD3pF^r!HqlBz#P_9aR-c*I~NGHrJ+ZFqt}~S z;j}%4!V)kkjh_fmm+v+6WD0&-h+qqAODA+SeE>kUPa=DdBxMP4VhS<2!LQv8c%wbY=L)}HrraQ3vOhpSjCnYA)6t1$ z_@UO*BVrHH5Cfa?t}G&=X&Jf5yvz}RW7DKHJ2>x}^QvZ^9tNSIa7NbooNhSSq!Qe@ z52Cok{8dPQ)VBu*)4xr~FTQ`45r3Qf=XDrFhhCL%iB;Qzb}ILxEm181^tOXz5#k{a z;drX7mDoMNKCRE>9POm4&-k4bGbN6_y5sv|xGrVHemY!S+$y4>mS2+SL42cn7C5Vac>YdRAcPTi zzSz#FZ-jpBV|~(au2;_=hJRCcbXVyct;Rm*hP$43AuPS*OtLxFp{~qR)ajqmFGay~ zZDGsJtnkWz%7@Z48x%S87)DEhRQ{tj_`}MkCjFUKz3GgAaGN6VYgs{hy-!4QWfMlT zyZe>vg3+{Xkb~SGSbn@}{W5S4Fsi*Db}BAdu)p1oZchez3(*eIL*a%5z)@J!WoXyW zqpJsZUE=B<)X;_h!k4ur2{V>O+tHUF`TcE&^SYtADI}gZM@EhxuT`4Px;dH6y*rJ| z0i!w{2kEUp$MB*j>|LDYi%C?L(yN_XwQuu9$`ih%bFTxfO?6D0H;HCM4N-uNj|3Nw z7s=n@FDPdoM79C&Uwx%GJ;`K5gto(R{~_p*jyP|4f1t5)I*IpNoh#LHCww^i7;sF(|bfM<}XEMZcl5`ee%)bZGWS_!ID+&LI_&h(UbtHb z;!ZRQ#B(_>h!7frsS34h_sjS8+jL1D^4~VfuWu4}xWxNib68WB1^WRihwwS`D1B=R zMjWrDLwn}$>@RULguF-#w_f~gRHTv1w=|B`O@A&Ovi?nOEfVz_xznW z0L9y%t9K~s@$PEf=!s{8i7ozz%H934O-{}G$Z%y%Nm6H1OJ1=UpQLl4>sH5csTzTo z*pJwD{H&_UQfsB&g>h^ex3BtsPgr<1+J6_vlfOLc6>b)nFqWq8DD2&n7rF2;NZE!w zYjQVVY&V?yad249PDbEO%|67TIM%j=V?Ws_dv1?)l;qwU6T)BYSH)K!J6OBU z^xhp5Oz+CA%c+x5)+)peAhH52eR+{%`@iu$L%8NUuaREsy1uSFIDJ!yk3YQ74z28R z*tH80Fx5 z=71|obVfcRm(GM;BtJ_?l>FFSUcMqiK6Y)+Z*SIH69m8b@(~!(KBJ7=HR}vpup(-lV|nLzZd)67M`-IBQN}+2c3R3iUI$#|=VXmjyZ#n=@ zOGbZ9d~#D(&-H`M^alFFKneym-*W1GeVS^!fj|w?@47*LVDIVC9z0GFSZq6xMU$Do z{s*p_?kuIT;V^TGTJEpm~BzDrG`G-chI7)4W+0zOcNAto{ z1|g58SfcBjh4j$;n3wM(-N+HF8p^A+XvEQiLM2xU&-K&tU2a>knuYa3oL95meW}Cl zx0-L2AxGngguV4KcG}{Xb#9?!aqZEbjDS0;3wx0yZCw+bgKw&oCpgBx!%U?m>J)7i zo8_Gje&)ptCel(GEiBYU?l=Bjp9v~(c*Sn;|; zJ%!B(r!{c|1}xi&)XT)=TOrV+{+5hDVE2ggfR^n}32ec21f^RA@f&|Iz3=&Xmh#o* zbQ>xEA-(TBD5z{tP{=Am(ru08)q}llm(xQx!faRM_s&M#;xiIoovoaMt|2{?8D7=9 zKZOCCm7*hGqDp+dIFi z;u%#X<_sy4L=LLu>}jhYy9Grf6;dV| zSlWwLH?#oeo;DQP5($$HcmYa0?BdE_gKwBWyq|Cq>65y6JChEL`;)ep{ULK;ov(n~ zyiO#OVPn}=><@?!JK1lU;Z0p1Gi`s&z-A#?Zb)qlzmM4|y-FB(5vt2Z13MLMZeOh0 z*se8TBzn+fyKag2iuyUv@8O(=Q{}GGxd>%a^rCcjDlPxk^@Xy}fJ1T<+hJ%8q{Lj7 zv2@KT-hO7&lJ1J{YzGYGdneJR=%4ff7faWlzFv60(ZzjjveMJwcH$Xg7|^I8mjv^> zIOj&U2Zw*riGi-ueX{e$-)#PSwNS%8bn91^R`E1Nb8ZFBzlP~+xXN8(=5uxU;#?8- zY5mtu<(%hrO^Hw0K41aJza0A^GA++7k@~YMJ{~$(fK*vY$45It{-fi(z-Rth4b(&g z@0Ix*=Gxa>t5!x5!f9v~n$MKw`p-YsH&-toy}CXl(w=O6I}!aJocP(*-%d5%Z}QbRe`fTSD!B>vH6+{*t>r`9znk z^&qgA!X7+@A)7L`%jkf`PpnFhezT82x?SBM@L1AIf z*X;8Arm*V0q3khD@u7o|B1N7)n=?{d&!`KCuSJ-p#ie4T9o*+PRkrs-A^5n0T(i@4 zZgIV0MH7!lD^=I^z!<-?;mHob|2qEimC?_ifbsH(G7q>qMf6K!J+f!gL-;g^f4Od( zw{l8jwv_9uLQgl+Tqb}mLpyJ8q-DAJ37@a&Pkuxfp+6)Qj_KJDZ%Cj2s}O^)hIX_g z1po^ErN>3%N}MDWLw<17U?6iVRe$GuIDM5HD7L$q4h7po+(Fk?;sg^ z9|GCKuy~v6I%tR?OMZcB2Fu&o0k1;dulD7(o&JX3GrPvwHp#Rf>7!=Jcr zt=INvq;CV{{!c$bvsOa%(z%z(j-s7R=E;|@v`IG7-zWqu&weIhw=B?Qhlr{8BtJQU(>Mq{eWJ6&KQO0K7!}&Fv+>3oHnh@B!NO-nv+uo)s}XM{C5k6g z>!J~0MsyIhewwl&>N{WKe&mYlBV*JH$L)>-)f;1P{V|uS3RC~x8v7=q< z$4<4g$IG)JJgLRMw|2;I#xFw!?KcF7f242gE<@h7y6M*~PjN#I1ti6x?x?a-t|2Wg zgzeTcPVRGWwP)vv`j`*1cNQa7XyF7yq{A9rW^bjbzB!~U#p0XpVq`O zBdE!Eer#p;ObvrP9q|0Iu{2Mewz5i`PE&zbSnmdQSj5Wu@J%~>pp&76RK!?}pu$qJ0 zC(rHh9?&oB0uWk$xzP3~8(+XM4p>$rsOTmfJW1x?_wj0O4P{Uh_cxY(A(YK@aAHX1 zab^okUPKVb3kxB?e6(;lQZnQgZftom`FoQ2bibL*;nvAJpYD2Q2XzR!fENLBJGHi= za;*c8m#4{dY|HNbXFboiSDY(Q8A_ve{J>5H#ZEh*E|M%qSOSeD*YnjlVfX!4`rRO{ z*kF^~6udpYtkJy`^yE?5`46r>*>%emO&(b+$Etr2A&3l((~eKSdk|CS(oZSTsOS`D z9~Bvv!gKx>BN$sl!dOX@RiNF6 zUqF4%(hfTk^5%v5p~oBc4WtxJ$2+%gLTysRMr-0R`d!m%wPeHl8>)S|ka_IWSA-&Nrq$LsV*<=Mji#uEA!5!KZj`B#*{dDU z(p42Or6LLQs)vwshjX+0mxATWVlOha6UPn@kT4e^5JI(25l6BrpLSg$9z}2fgSv*0Uq?rmuqoXu+wbNIP%f6zR^liCa%%-`dfFt6_xAhl)$vtLv>n^)63+zB>^qR1WjFfY z+b|)Ff2B0KPA2kop6l|A6E38%X1<2*nje?wWl5xbs+x!)Uuxe*og14_eR*RJEwI#k$<5h_pu0)F z55PpFU+XOneM(c!#qK!b?+DT5Yn9TPOC9&RL+ck{gud{Gi1tGiN9B;*+c>Z;Si02M zxJU4roToqLiz*B3fo`4lLE%eWt?kYK<^l*=>PoC7!3rAIFRD`}Eyv3w<{@_At4A9r@Y|Yi z#I*UtPm+94BIL`!%VQ{8ST{sMt{Wh@k&zJ{Akd7wnOQDQZByrhG(dJqzSBDv;bdR~ z2id36^+MEJQ>Po4T{lqt2gfExp!GqT7UX`4x!m7%ynUN$_|S?4VhV}6MF~NG^(zvZ zq=PzG=3-~~^Hn2jhtw?*3+LT>f|^GVS$7N2Ay)kL1YG*Fxo&$85l){EJKF0~w-u<> z(^g%=qf)=__UKKEY=d9kL_(_FV>f>%^xZj-L$xrVc$w@&o0A}ce4Burz{?13lPaYv zGi2vmxA%EU%JzoYx-KrzAr9-zFM6}p$X>Wp9_N|YIgB-f$$@K1=Av952p{lA*CcyVwUzrj;J@{zH0(6>Cz2_S3MblcY-g33K~w>SkF(E+||pK zoWVXuPi9`82fqSjpwfisA>$66**CrB1k1u9eQ(hc2Mqzke#dSjN$Rx_@H}rWm06%%Q?bJ&pPAo3W4Cu>l2qM6r%U?n#^=`q%l-I zIL5dMjKDBp);wy!d4ul3e?31BGyt+ycCeyL>GGky=%hFgkVfF-iySo*&j&&AA#L|k z?3!aOpW>fxv|l$hJ+Pvi*_`(oKfgU+S--gbVcJPGx&IiyWyV|``6%7t&6LYCx1Td| z(tk-r20q@0=`&Eh+Iq109U3422we2|_2%KVtW-5DC>=2#_!8d7(tM{c)+p?@qZYcp zXt7817oH0)rgwr`V|Ss|1U#7;JKJ!2kdEEL$A`ec_U*-IDxeKqm|Eum#MWsAi=sv% zCT;sUK|_jqN?2#CDvcHVdighTtc4ca_U=@!4U+Hul# z<&{*9^dZZH;FxMTJDw+A!CeAp6;zU>mWpHH=7(*cYbyI~+m@oQjG$8hha$PV~5VWb`bi_KLXN&A@jAYfMrO?!!_XQikeq>ud>`}uP z`{ZLQ37qr*A zOOE9E`=caKJ+r3O^#bIj`1XKahQ0F~1Eb30tmqwRth zEY#u;MQU+Z4er4`f&tpP+$<^rx}PKBe$Yh{MF*biJ|$>k&~{I9WgCR*may1D_t-`4 z+<(3xqe@OIY<6c)_$@=L(jUxZ1_}km*C6vul749*VS-CdxUP9pV1ve<&LN; zCqzl_^x0mwUQ`5Zp_fH2Z~Tmp%A6ZP+5en1f3@CD&qblD>m~KAQT}oR!A6QI2?6(w z73+CnCq3%%mTFT4FY(kyY3ckItb>Orlf-Ovj0*A2Lf_qKM`z>Rs6kxO!{KRpIxDKi zBH3Mxw5;1v-jO2DZ%n~OZw?Nb;fQE_NNtBqBA<4)x- z$pNl*>mFz)Mhjn~0jYuL%GOi>ACMKR+4#1jt8;JrfEXa08ENIv<{<-1tQIx{pWEmC%Zh( zb~ru?u*yJF_6ylEpS5bcLTDe=^x=_9I=aoRGYf67IxN+Ki z>1hC8>I~OH;VnAsvD>3%rC`D15(}om&CZ>KUK#VgM>rUvP-^Zt(y-ZxW z;dzaZTG1Z$$d7WVHOf$P-Xx3xvM$ znt?a)m{^$%<_w0Kx#uWFF4prgkC3BmdfLgXt{oCQx%X>bB5H5q93V(Uc}|ijQUeoO zbI-@{aRfoPq*VQgCiqFzguVGl{6C&Ib7HFYH;|zEuf-y6IyrIkHP9WuO8y8;gTtNK zD%}K5&B3MFp1(c)sWbGWtq7{Sx<;6!JHxv*6*;{z3I=^U9*~I>(f|)}lzGs_(@U!- z)uY9B)G21|TSJwl!-c5>hrx#NIQ{66a0E4jgqZ?&cW&N)qTr^)MyF1nlpk6u@T;Ul zzJRxCl*3DC@?B7382y!#u zl{nnUH{j;`4S_jzN;#7R9tMh&s!No2ibIGlFpUtOF0tZr(nI!lQ+B3nCi>S0${Hw% z13IXY3C~5+2#9I0F4A$WaC&uR*L=lChqi|# zoA*W3`94s8r;;{78~%PBr#aW^anP7X`QrfYW!rzW+PZR0Id&gWcY7GfK``yzk!qOt z!b>yH`+G=kZdD^A(uuuE>)TMWwlmOAsr4e-8PET)4o5^LU2sFl^+8^H4W$~Hzk?AxqlE$Dz&(G&oV z73_w%vYP#-2uT|KrD8!D*WHCVI2|uOUvg&@b@@}qo}9y>dU5jbYdSs<*}8Go@_XWe zDm9H~u?2)LFFgva@W$K~T zaiS<3B96K#|EHYHbGyxiD_O1L|D)?1pDO|Sv^|qdY)x$2wllGvoQWp3ZCevt6Ki7Y z#I`3kPK=Xe^VHV+?uV`Y1G=iKy1GB~@4oJ3eZ+fqDG;1x zq+Z2Wovol07^Z)|;a95kdp5N`#XjtBidkFd?+?2l!B`jA(3Er^p-HW#kpj1qDZ~(d zUhf-tv48W}YL0~sHn>W{TZqMjZ<>5Nlz>ZP39g*6Gz=`+e-X<$cGa696mlkIkoQh@ z2&BEkjk|@HnsAfi>Of}%`w!nSrh5iNq*-bp@3!nt#}kebOcKAFM8+)iF#V2Uq{;lf zGxS8d)?*0}>VDx{H+>!QW}M^|&(V_KF}iEV#mxn0B+oLAx8kJ`3I{Zq&({T;7Y;J( zg#Ml0w5VSX2xZO@v4reOY8Y3(*o|t8MhEHHL3L4p8H6S-_i-tWOM{1Qq_T>8Xh8P5 zQudfcL<>5DZSWiEV~JTNl*4$olU`(pLY{UZyT->fYkYrAoKzqy2!sCNj?8myS}Ut- zR=-YTNnXaAe00{SPeJlns6<2|_mcsVc5~^>M!tcmy1#QCV3vAsPZ?>F&prmn*HQyj z#GITE2Cs;+sV{~~qW;J+Ik+CYlP@tNhiCZT_WHc}Vt=S%Bt(F6&1iV*;QW2}1vl=W zKCZ)uxr}TXAEA-H>OnO)(k(;9*?moC*E+W+OsL45nP8!6E|M~l{Bk>(Tbp31O|U%? z3qJpeU4f&?;lSb=w#E;;_jd0q?&G8;#9ync7O)#-r_S*W|EM<2Kyi!94i@pWYvv<5 zhhAXUd?z)nrf-teMe%}~^{!{}T1(68s}>jG3@0D1I|EBlJk4wD(AO=_$ z3%+Er@fQo$LN81lTDQ_2W1~jUGw*#>%R3k2Q}BT&veFt8C*x}+9?MK_j!q*6GQKhr z$yE#r=WPKOd#O0)P&q>`6}Vb&Ub^O%n-=0=iY8hK0NpQNa?_1q>@*fi-tWy_bc@QG z;53>TIpFVmqh9|K66RP&_TVuqRrcvsx?83GQrsONYEM#Q;SJ#@_k2<=*Z#+|ZK^F4 z4}pwTKsT+Dj-?xWBm2fL`&FxT-rZT=l;-bQO|0l;rY(yN0CIa9!H&2|iSt#=)#lq_ zBjJ+EtFGs^{sip(zc_6w+8)9tkcs!UHQJTi8cnX;znL(rb_I901M&-fn%@jN<%M(g zX{DF!7@PT8Bze&<`o}KiQS`Jf<=aDZ#D{I!=e#cAEY$SF=DRni} zVoK?bCA0~`sPDbNG4%05^84U93h40(^S2R*yokjX?PnVW*aBW@(@7|h8}*|cSvs(q zI7;v2)Y04V;&()RF;#(s#=kWsOrWp}{F+bT`UfTLB zL-@t4#}hQgj69|-v;Urn=om7Nd5~EqE3tH%h_iOReiKS==1b6=p^$b13%vM%H>^!llIsiGKrX;%SwGWeHuRaV87}kxm}loSYF4W#bRNPZUt>OseY| z1}|K!U$5!Xy?R^kpza`4H&)@oW0tC@MmtR@X~oqA_u#nei~o~U>fu!pAm10*^0&=C z#`4(Dq^M>vD_z^F+F2mRM64~gm~g3<^kXvX6{`{BlQwd3;1;NQy{4x->Ju5Xx7hPx zmIn5GlQ5~$BVRyTy%N@h;uErc%<*kkzev zJAi+CQj+=+BYgd)SM0l*OX~d0G^m{pncXfTY_DZKL6JPyFuY#fP_GdV_m%A0zTK?f z|$~+yIAh{d;Bm3(p98{~7^$l!_UH$EbAzAE=CSN>6{_N#4O^eVVpZ9aw0SiU1`&FfJ6|LcJGIG&@X+J(bTB%j)ow$sVqHS}2)_{f3N<}CVsionrW6;$KkjJ-Z% zA|=s_s@{5M#n$~($|P%7_t76!g33{1v{Q8_V2B^Ahd)3SXxbjP=;a?4WWFlxp-c;* zNHj}5xnhy74^pyDIHx&n5F??`zD`aDfs8RI8_6I>7=9zYi@b@0S4jyHOTNFY5m$_J3UG$QuPq#}mHuVU)cLcbo!P z{hwv;OuD&Wy0GT*O)s!QXc5n5nqu{oUBWT~?~mBtohBDYwJ%RT9g`61=34o)q&R5+ z^yrYEUL5i`DDkFvF}?HtYPSi$b?MsN9+ph*qIp=^U=g0cgFY3=kJ8JaMjpp1)C@v5 zfohH~ay3!Iu(?I3CT9pol}w@{lE}!}H2sNc{WoT%0-HBkXYh4)pOs6kK5#@4Wo5-P z(YjHIQ#WN}RcHcc0>)>mZEO0m3}Jb5Ez@1(+hVVOW^NKHgvuDnWA{d@swI!=+Kj)~ zn7<}HUp_|*N((4Q7{p!y*zpji{#~#)I#9lLGjG4ywY$HjW&>&Mwt1C@K(&p?-rY=t zlxYS*-d$~Ybc#{60^wI|<2X}t+yQV<`OV*8+zAG-g?=EGb0Kt-&p9&i!|09OfZh*v zH(30I{D?OpEnod$4D3!mUMFkBgvt?Q?(U9lIHdF51_(T-N(8eZW!D6skfr*QQKVnr z9Ty5Z`XU8!c{b1kKIz?(BjU0f(V4;w*tp37xX)kHJB91v8JUA2N!8cN<5Wy;PTZxk z?mk?i_eF*m=^lz-{Zi+=FaiSn$V7|lv-$>%lZnO@%_?ljw+*y71IHL@5a(@rK5V}| zpnBg-al2pFNZbVT&Q?M!)DQW06Q+EVRRvx@b5R9Vl3o`$o&!r2Xj#JikrSG1^Ip(b zepq28d%ymLS$MIvU1Msl6J4XG27{8(jk0bDZ(6OS_^T5aLf&}sz(SOGXcxFL z!WuF#Vu><6j3~smm3VL0v{+E$Ha^hNeFLtbwx1a=s2 zO<&I3HTNo39G?`F8IlIUjGb#%O>8sI9DSI1MZ-gV<)@f8Q69&|Xcu2;4EXbvG^$NL$9Yt_$E zK5bXx71T+gqz?DEOH8MeGJ9{RU5bOgQ`5Q`wZru`#F#?K86%P6Ta0=i<5NIrhpP}# z$srx5W%7VXO>hwTh%_;Csw_@xuM4cP$KVUI#1)*zTo>nK){g%Abp&ZYxJMLRJC&1_e!QbUdDrd&%xM;a@F+Vif=0Ip3Xk|SlQ?duWW3jT}( z)A(r+6{CS;gBJ1!EE|jeK}pUBk!4N$OP2JXyLDsyG45LYv7r`2SSIA)!lj+**|;tx z;jl_nEf*^Z!cnk#^FY+%WJRns)sR>)C`Lu`9VyeNB`>#_oKnx&vMUkkXflyEDVoX^ z(@g`Z$+ws_cXrQo_(KMhBS*PL_;j$kUlm%7IRB-f@<_gM>E9p!v+NJN#5p-5g-h-a zU89bnr`iB`R>j2)k(H)pr1(C4L-wZbXXJxd3t116(HHbF2jF5NLGfgs2DpVnQcX|; zjDj=?L7M}R0Ge!825qb^*oFoUbu$U{=U5)+Ld+5Y^t7)=6Nm1%TN5#Aozw7<%Q5Gb zc^BJVoG?QZw9`zztf7KR54kgGwR=hne@J3q*2KjMmqpKHJC8eoaIHL(n>p)uU?X=?0688&a4tskuWMw&8-=g1_y(DXG@y(ffAE ze#Js?b;gQQ$rvv&-RMY~`mr=WjG-pYPiFGA+V@(`xX{gaKF9`iylU^A6KnLgg= zL*uqr967Otk~o87YGDMtF7de_UVN1A zX`$P3GBk+sEpHy#&sBfZ7jAvW;PF_sk-u&dB@YfDmSZf%0MYQc!&Al~0N@gnZpO_h zXr2x0M`=prY&?moUwm+Y)mJWUe>HzhD-FGJVoGp#IzxCjR8njwA%(C~686!7GOYJIXVf3sDEPS|DD=>XD zB%&K=uY6rwb`iV7p1){3fY&ps2z_v66_7m9soGAApk8UAPRxn9@2Fd!f*dlIH}ykE z-FN2-{rL`WuzmDn|5b=5>LP|bo6eTgLVC?DSFFo|2p9+2%NiTxSqT-$@dY3&#a>y7 zZe>86FhD3c(iv_Zj|L|fqT-DD4mO#CT#e9{d_7RrR^M48T`DmS^k@RsIZT+bj_}%f zHTScJEQ61j>~M8Yf4v|Bo1gEpyf*wo}^Jx}DPn)SfyD`UQNbSnEbrycqQ zk1#IR&4l6B;^dh-*E&!mfSAnS#FPPKAJy$Q!8(xF0O#$VmT!0vI+VQW=(fp=se+1L zieo|>%sQBbOWsCPmb7w4?c6@6$4|nbh#$UM5d)+Mh1n1f#BA@+d&A?Yrq_m9 zLvQp-Ss6Kk>f2K5+ciyf%b+=bp+bWMKSh>T%O45nUiK4H%gmOyBK23!K)9+9W5C^? zOyMm;C_U%I=?f%|aU6v*#lu1-0r)n=f@DWUVs?@95v)6uA9qF4XZ7Ye|uDY5&=3zd1wssT8Z+iF9P5@>Pk|u3}*Ivot~w`bQLo!MCzPuM}JrCZx;r z*D=pNpSL-Toi|0;NR;r7h;RABA4M+NDKw5XFT1c(2Ex#^1sp9C(a=7 zF_Z|oEbV}=)e-*~R?a=or1szJorw6*!6SbDA;|lbjE0*ES7?-Aw%<4REnH5V9NZ}3 zdU^>OwLK%#q^a&=Uxp3x0+73l5Z%Qg_tvjUWM3PHZeuC9FmM#(y4@{)mbre$ZwI#? zqTA)uu*>Y84$117Z?5J?XSj79 z8_#1HKd}bivEg*S=0`v`Wbp*|JQ*$-vRjoLD94jwn1HA>U&Z_4%jQ<3xWy}s`)ZLh z9y)sM_3janM|_WCa*>8h zs68(=waOaY^)2b>McNxeNd+0L5e|5td48GcO3!kd$q+{c3{P9ob^F9Yv`kg;7aRL> z(;`0bJQ}3-;F9HMbQ0tl*oL3}WvE)bh_5rV$fI=M4#&;-=(o+oJTVr<`<>J?4r_rn zqpZ-8fHBH>nHZrI(Mx>PytCSKISVJ|d#pQl)uHyzCGhPFWAs!#yoqttP8$EXWa2{$!%j?aHYImaHWV^ zX<$DD4OaH!3%75n*3DG#rLujKV}Qwmi;oY=^*-c!qAW`O?U}!L^|5!ml8qpI4ms%K zG}+rB#XF^GZ1qunyEd-sVZjzHbbqEPCTSKQ`YIe!OklgkzOhfsp13b?OK`#WUhi|u z^H1Dz2a+kMj+wqw7~4N#Qr#WXSD%X!nCuJQjt0h+uD0Gm^DrRk_~N-2-Sy>@21c)tZMjf#C zl`qq-aFHQimG(xkqU(Q}!EYIqlamb1=tU2rM9=UPL-vQM)$1Ro1qRgBILV1eb8Q_z zH~;W3&E6los@Md|>5g$5%69X)d>a%M-n2M4NghzsX8H@B;eET`Jo)B+W!hPH=;S4a z`{OQv_T7%WR4~to!Z{*s&9iQ7YkuX$e;jm&zjxePB`0~p)9TKy>6a(l_$P{Kw7RV2 z=V;DLl>e{1J4}^*yS}Jbzh6EdRVxR5wgh>6Cxk|hu20?;X*`VJQWyn{<`nz(VyggPLm%>ufwdEa(YW) zs|-3oA}R-Q`tN++w04=?cv?{0)<*+?ggF6@Z!g=FwLFi*;_sCI2M2kLApOrrD|_e= zk9YKcwMP9%7^Re46)YgG3bTRUA~w zjb1kF#*e?T(D!~b$_lmvhZ?rdJOC`70W?)kjh_fTEv!Wl)y_%Jc5E3=na8i0=~|62 za8_(1_||$YfoBOQ+70#5>5E+~{C!*O) z0MT`nlHPF=K8oSk+u3_vI>H)*;Axn;4$8+Smd_M~29X^`%ftX^j0xrHgGz9${~MF! zvVFLIk7`Zvi#a=vKYvt9qz$#NlNd#)w*jQjK1A}&`qdd*WI^N}|3Qi~irjLzvHf|q zA9xZ?MKUU>l?(dtGJ!kWqhUXn+S1h3z=4v;B0&3&A1RUh1%Izt%H5o|xqg#Oe&`x` zZf5>1(l^tlCwF>hw~X0eD38ppSlH^plr)djcLF%uB(pT)O*)1nhyut{Q!_PRSa z-c{^g=)bMpx4w;_R#usCUoX@dN$G{1xg8E50^zSc$FF%bsSUpF7(wzIX_{^%_Je(@ z1ld?bKFvPdb=&I3kHeNcqce={5$6)NDj; zg5q`w9}mAcFthuuy+Rr01WBayC%# zvEwWeL65<4mTx#XKom8TUDVep7Ap>e!3`gy_LLI>&=ytiyFS&8>}ldUKK!IhBr(^p zgTAGd?P|c&k=HK^pGOq9zH}8UnulX%!>Z|MQWF4!Va#mXXN=%>^N~>;fA6)-;i8PB z2r$9w$YU~xLTwIz>4*LU(jHj<8GDa5@qpgGP6GB33hl7ATB*RBz_Bl7J`o>4^W*10 z(+p|Ti(9pWJQ~Dn7xB27$sL9m_Y!R60^MPuBwwW{73*A&S!X8E=^YlYJ`w>b>M3Myi8p5xi@@I^--9aJj4 zMZ{0|3Z?M3=ds3UcUkXUpxXj9LQadyD5(d*XSyi6UXN3K>^yq|C!7s>9vDBs*fP;? zKO8^kGGK0B_0Q9wh-9B2YCQG<2~Cj};&UCzd#45R$1ia(I7~Lo$Ua2~O?wJtau|Yh z@q{+M5*DZ^Uh;ES2&yVoF(LwkV|cf8J9fy!oL@?jL;gs(6z4b5lYwyQgd#H7Z#X3o z>tn*-8YkOh6>K_@!zTL*9**fGh8O#!ZE<8dy!>*U z@P-?0`7xYmK5Qa85?>)cQv95s>KOT|q3wAWOly_jzdw}B%0EYFgc$#>CWp5|%0or4 zmy}#*1LDy)lbyP-5YaIrom0fVj~Dkv!*gLZJ&*1U`+<(#pXb;8x@BgOyz$YBD-4DE zwi_2YfSc^s%G%~Wv6ou!j(Z4T=S#tPn0)0op1rNvY^d~|6k zD$#Jkp+8&~DL`G$uxAwFoH&Y#5@O*DRn?or{-6wve%>TROcs5S1#&buHHQaRGYWIo zxx0lR+|JHN0-FnJEp=yAk1!NOA19zGgl#PpHAMy$G~Kj{$ZTQWQ!1o723xut&z{nF z)Y5kVe*+zb%Vqd@Rv$vKW|LV#tII;a%i^pmeE++0v0-e@pQs&OZ zipaMr8VI^PS68&5ps~w_@9GjlS`y395rt%AlHZEmVHqh%DZb6gT(Mgw%d>qPb+aeS zQ?Vz{==Xd~y}c!6cwTu=3m$E_O|>0uSeq&IZO)<@`~}a0q#=L%G&LR&L)q90lJzK3 z)>N>n)bE&ZbGHsY03)gxVSV>f3~La%n%!)crT(y??3IMVcyfxL88ot~@7`@0fcXQN z-;C>hY+DU=HnkjyD~_p~m&5WV@Rl$G2rio5f`3YWlpB4hRIXALuP*`NCnxv2mr&<2 znQ?lze!OQ?0)9#2AU`^xsq={-?W5jRfED%Xd|Ed#sc5; z*8MJyxyOl-5a&PmcLCC1YSSsShnB&;hXz5M$um}```Y0IM=-Bb+}u53_trwbL~sRM z>?A}p76C5|*Ah*WmZIe$rYpvYy@iB=8I>l}3u@kVw{oBVn_eL2Tar)WA!Zz@x%5r^ zUSJr3Sunh894HRMJF1ECN_XL&n6)g5S1)T~mw9U^iy&Ch>sA-RH+$YJ>I zvI#Gf_xFnMqCz%19=^)-X3ijC;kD@=+Hb(J!MN!-&SI>Yp(h-p;8FPt(C;Oo=AOsNd@o(19J(?Or9w(PUO ziW-$u_CkN1WFma;=7N0D>aMUFL&<5Pslb=NXY<3nvrDs)x0!-AJn!c@1T#aS%gc$~ zRE8#6MVMF(!g&9tE7qtW!TkHgMwKh?FJNngnSW_teK@a1G-*?37(j(r^}Z|d#hyy7 z{G13|j&XC=#E=nl)4!&abV3iVK@R~St}DGc^oW&o){(;ulJQgNeFZ=xd) z7j=HS%!lUIvsXJLo7NS2(IsPdH$(QmFI5-3?hXqGx(jR1>Odh&g^c0AX-eMFd>`|Z zv{SBErFnOWkGc|qUsp0kITR+2wg))s#|8#glDsoRqiC){K&}gNI#g%8W#%b*JlvX$ z3$5Bzv`Mo3QPa)1^Yy~cm<`l3Nxk=zqej@*9#S8C?>NyhTudkm-1(Fk8qm@fvLXQh z$yMLHgtlMcU5u;FO0^LsQAqPAWaUt%5<_#{7!{*<=FIE6Za0! z%*J}GlR`E~Zbs843%WU%a9xx)!jX37j2`khwy)t9_z%C}`RQs_FHV;C<@i$4$74@q zpzoVLMujZJfMG9uW-c}OVlDOcszoXtL??&x^kcmDVi85z=5o9`H-qzJW%Hs{q3<$; ziW~Pf!=CbUj)VM+Y|ZJx{0Xx|J|lb_d;zU`hE?Y0HaRkxjz<>V?_AfMBCb!L0V}TB zzY}^UM-#)@tZ1!*%BUlKB9l(j9n*V>1}?s;K%J(%9Sl3DtPHv$UV* zvh4!2MWCAozw0JYuy`U&Y0UDz`NuVp)CWI67gNG!F&hSEug!921F+b;{kSC{&;Z%G z7b@vtnS$LP@^_NM_R+&jnYLWBPw4Vd)J0GKbKVYvo`kBX z&!5mg#8EU>W`on3gXlf4_4likxsqZ{*)1RCJ5`z zd=6V@BrQDo!7yEb67`0B^Lpm5-5h>97@`d|MdA%|a_NeYAPjf9Cx9E;ivH(Elz|Tc z?|}h}6WvLkS*~9r_^hszUclF`&%9?Ne0J>=#rH32?Ym~w?SYR7wrt)L+)A?zCPdS7 zuVZ9ou7Sq!$vIePQ5+Tt~$|hVFtwp#Z~u}qCnB6B2i0+ z@YeUMTR$Kzac=L9TxLI4&1Hn|3#U(U=ysUjB~JQ5e8x*j74q{ks}DcCz?+wgxSt^@ zR#0 zrY$UBujrH4qkOr4RH*0-^+DQ8pZSEr3SagvFu@PDvjO4EDSUTnOYx6z2b3PSU7xUG zb8SzFPkWf~hwe5?n*YolbG-~UxEq?-mN(p=c$xMO1j_smnmG0?eWs?seG2jS&W?AA ztxv$%x|4BXC%HcLPMX&;#y#!P+L52m0$*g!xcJ3f{voWgk&|xvVz_48Z8tJcPM0ng z?po@{tkHs6fwjVtx>WEr@HFk(0>x=8YVW4}ex}?D;Hre?<-i?<9hY$xs=Rae;ZAH?cLPnf-Suu>P=_`Hdg@U&aHs2)^&mNVIiv^qU0D9QHVC|K+bgV6J!={wjHP3_^1cf5 zG)_cHfz%r{$x8FQiQYs4N+?x3NLi|2Q0!%Dhw0vJ*7z2zoZG zvcpZwsRR)6ecfgz4)MUz z5ednqMoyi?Vox324Ve6Cj47r(C!xsi<-tJX=fYVW{Da7vxeh#?qELV6XW+kh-*e`4 zS8EEps~=xvq4r^xey|l9Ee5ra6Z?Gw$p0DEQtFQNH!NnnhMmpJk-H!d%E&mMU|Z&Gs={n4W}_L${=*P{Juv0=(l+(>n;{<|#XDM; zv|)jvmv}JhG_^%IO#Ku$I}cG~Y!1qm=?Uey_#wcmMqBM}F=4gdc2q zsS~~1>AlEC@T6%?+vpl3cU8Y~_ekw9-N$^5VX5g{5#vrT)wg;9o1Ko3W@u7(P)-{0 z{`iYRhBJgD?m0A)A5DN1d#Vd)Jl^Rc;jc3Y7D^WuhW;9Aem#1QrL8AJTKQ12lcX~kh}W{&T_a5+}l%(@#G)Vq&1iyF+iPFbZ5IR_0x*T_FY77 z`}sO5XS6mxDDgZS|7bF{lUG-w7-*c_ z1i9lbRNU5?9k^|5zWTM6T{wI4tpK0@I+2HRtDZoJE7Smv;EU*M^XGF)wg(s)Z-720YQ(K z~Bm?zprb>8zc+ zjGO*ghB_^hUqU;?Jx?4Lv87PspjUt`#p9HF3_8|amc1EoMrrR`?TH$Zm6Rx5&ZJlCKq8OpT_whrdzH2<{6hP-fg~&y1bwXXiJZD<*m5%1C|t&YL?i4$y|~N zzxNbhvG7YISV2;z5yt0*<0ojP3FmR#WiU@S z*lblCO%?@8IFDqBc&7PXq%SWr{q!GF88Lc&b>wdgozEfHGdc8DY6RWK?9;Uo^Apq) zX?7I*fo|gun)k<^Cpsi}YgUgj+>w*f{B=iY#`!o!(9{0B1x4or->)34!v3^y;aM5} zlf>|A{XV6qPIV4_;R(biGz=o4VEyIyboMEv;MXwn%SS1mX+P-g84_wYXu@kuE=4Wp z+k8BzlOxbu$M#N9l|0z_L4YCAQNMu)Z!!nAbH9XHSI_UP|wA*W#*|y&ZVbBp0Ck({v_ZVDh;B4sMhOyow;*f@{ z)qo^k(?U}{TTkOKZ_3~+4UbD>wDm0KIClW}7Jy;`jI+PS7*~sB$tb=*uf|!h(+>5F zc5=+u$C=kPi*Z84Bs9DAKzxd+s0J#%a@07jOMu@^ZC6ef^CGY*#MYY9dKVf9FUfR96aj7l_^!}vpuTbE#~y|rkT_`rFTAJh2P{#|#* z%o{t-h}$-N(cakV&53<2XQngODfLjFPzT4*C2u%;q!prpz!%7Prs2D67?2Xcer%Jm zA_Vz>E6?g7ZxuzFG+(R|a%QQ#hkT2S9022&A2&xf5IMd*5-${3T*rBSl%Fp<_bWFC!|5G#UwrraSwG_l=U&$^v9r=Gdkiii<)vnK zli5n)ig5#jXnces{AH@cbIuX0qxqXvAH7yfN^eshZ;6PBGr@V)10OmQ)31nuaa5xC zlNKizrxC0kcX56m#u3=ktOh8y7dvMO;)x;KI_hBr1On-CF2ri(Ka@-eF`IJAqQ7vA3KJ9z+P}1-x)8D)SAZ~T{;h^K(OAF( z5$pxR(_;bFAqs>(Cyj`_yjV{=dyNTNl{6NnKGFs%FO+mjA5J zn}2JJa>m#+$WqVjo|jo}=8M~=`)x@t(-fXJow^c!>1e1PWixS2O`Fxris;mdomWtzzNM2qpt`UvzOZ~I8qu1ysOIQg3@So{TM$8cd z`6MUf5p#O4|2Av8AYW@QD+hARV{ACe084Ia#oyo#bH=HIee(IdDE6aYi>n+yNs2WU6(2mEO`ikT_UKY!HO!QPKpgG$}d-J|HpJ-Og4|QBo zW+4n7PDnPICJDXLAQF=dPuCJkL&-B6f2a>3n_o+qA~h7^o9U>j)mxKzT-aBSvZ$h{qd0-_-N_zC}-b z@}GT>KisH*{V7=hC37nZrnHI~5OXgQo7+oiNA>Q|YlTS=dnQQBfdhH!n` zc(yA$nuoJ6*k4&{*;zbFRENKNAHTz2llQl&UBx)$o*&Kt!nz3b+B}V`_agq`RI(Fb zPgp8YotCi*IhrB@O$mlKM^j~(tEG$DyET6Q6hgewV4E8b=Ae9mICk^yBWQ=bQVzQV4%w6UePTE16k1z5dElgHAI z@wNA~oDdHJWWDaV*NZmF@MXQ9NPIx#Q4OVM)!hja73OoGu~K?6X0p_ zlN=vhs9xQZYl^qZsDXlSn3vWg;<`@ohCX{F=se#`7KQ$pfJ0NfcVr;qs7uH)oO>!X zBNyei`r--vT^S=zHOd|}aBOt1`BNpqd^Gu5nzv0E7i3;#2^hFrCh4`|!XqD2+Lg^7HXs2zTZ zVVk4^#7JDaK`;)Q!Iv*Wdp{&Z)nf@_&7r08KbG!2eBoF&HeiA4VgQUpJ4R}Q4Q3co(hJTlC;-Kc5`M0e&oOsGjUKAcewjc?Y zw~wHmAd9O_iD_P+>#7Lxom9C0LigBR>MWi+L`C9}I4Fv(}He!?Am>lsdGI z8qDqxLtRbzq1D3p)D#kp43!!>?sE^#0%fe&>I9Xg^$Uixx|I(9Ww52!yb9wMOY9Uo z@k^{a&?2+}3-PeuQhK~pb`^HgM@)_yOQ$VK41aHv56792GyP>w*+7ysE!iE)pbW=k zCI63zUEgAE5dHNLaxpI$ciesPwt%*HU65O?CzkNMl6hz4!G~ZqYv4pB4No~mC04AF zJWfHSNCYa>A4|#RTxS4ERL2tuJiBPQuQn(|)25e~5+C0qSMZnQnS%@4bSEee zAqYls_%K!RPW?Scvq~M4Rw75A;ZMGX2E6fV&)^jmudJL!x!OEuqv%4Od7+;$5WvB* zQAmKz?AFVmk}8T0rlZ3dq)J!rRs_$f@8(bk2S3qJzxiMX#Zc4~m}1t(QI* zPL+B^0l9Mq_pqcmp*Pd(%mb?{wobCEGD3&qXxP2X1ZLJt#rp2uU z46R5TB^2$bA7hbm&huy~rZE=u2i3nRFqo6S585|I-m$)~ZIxnDtNxk5lTC&21ZwhL z%g52x@Xuv@jfvIZa+*{{^OJ)@QvLWI^?PL!!-K=wX6>d!b&4~1Ntapi8tK6a6D!Rz zZoz$-EBxoDvUN{;4l@0D*&J;kKo%=BpdZp4G+w)U2;V%eri!D6PTZ$ca6a>UbgpKYE8tEpL54U6bJxd$5Qk07ns87qCMLH7BGm6)I_2#Q#yMJzKfZsOxp)`#+Nzz_4+ELI+> z+>;&uIPkJeOBfjYhQ1}7f-x_-=D3m%cjMbirI-A3OW<2;+{Ko>j;JW4*^wFs)8#V~ z{S=RhoV!v8a5H+6*!iCtFbgD!cN7@Mr)+LDmsS9mB{e98<*6aD8q6217$ziw%U1@a z4+-DUnwxQ|%6Mhj{YPT^CvoBn*79KHjjCl?`)0~dWyM=HVqr+a(c{-o)14OZvQA)F z&k0!-N7eakpXP4M3C;v&`R8krkGhkB&95&j$6t+FeMubtMK3;)0%)4i?yPQY2~E6? zn_tIXCdZE7(wVKpG$8N$D?eq7bZnr28x_4Ln|h$`6m$QVKZ*YGDI71_9j0w$BWX-l zys0v>KL#S5un}>b>D!~kjbgrcjD@Fem_6JD6T5?VH*Xx;*S;?qqTwtw;=wc7q+tAw z3`bynh$Uh>bWeAw{ZPq6f4_7%x|E?A>ZI?SJ6W=vRn4AWq{RvnT3wu%4h{(F?+{mG zw4s~(w5P|Dbtd1dJ5q;9CFoWjS_5kXgRH-PMBNg$rfnc?#eqDEYl*#901~0aJZC#% zM)*dF5ze*!Vz!%F1*0DVF6gBedKOm`EL#E!-5PvLhl&Q* z@S^Msa}t>HoDh{rezDCiQE#ClKK+vyqF`8}g_K%=aF@t=zX_{-I(GxI{qRz>msag@ z&m-~c)DM|M2qileJ-E>d=Sn!=e>4nPJ4)gE5y6=gpewH(=ZW>TR`oe@bA zkEbs@D(RMsYU^`b-V($i?yiY$Tl|APlL$=5V>0O01uU*ktYy&AzZ~CCOB}plsGfJEk^hp;w(8E)kU_$13;6RdjIDfHxA9vypBH) zK2MIM{Z`_|VVW;x``iPDPLxdv5TZiB@4`SR*-sPT1f>17%b>LVy=FgiVXfKdZ2%2x zjI;g%cDdX9sZZRfN`IDr1UZeJX;<4xP+*VD=;9nA&8-w4yM}qg2rbFg`iSG(%0tVK z_qI)(cidq6ZKRqlK^(&&Kl7=qV#ZRSKU|R_Z!MCVcTtZX@8-gMfkTP>-f8^58+_Ov z82jHp_0pUfA4*k)z)KEZa&^q7r&nk(eTI?hG!_AW@2yH|v!7DuJT4A`-wm=HE&Y)* z!PRJ}hbZ=0y2X}%m1%Ao6MNx=8~ZX~+E;taTj-%5Kt{x)7N92;80o#fuYL~YV`6+q zg>P*@9pjgB_V(7u;NmAKbMC)TzGjPm{+8YqF^H(RF~wOsav8*nA~QZZ2{V723#JX; zE680Ai_2Vq5#_7@4B`DK;r_IDJDGCv^-V?Z1PWSN*pM^05;fe|ONzL2Kkd(C%^bJk zBhkne&_7ao<+DsZPQer=-gZ5_44e&Z2M`S8ZA9DjO=oSPw9e@iWsy=~^xR)FbM${q zF*Wt8feuGk1X>eex?LSj7?Io}aMv}ZY8YunpmmZ56sk8$Ypxy7gQY#r#ND%^TL+<} zimq1DhoNb(H%=5)_O>;&8g;tk1Yk7&vFR|>9H5*^A^{#GLo1}|6T zP~u9_`&iIm-Df4vE~ef!*A?v^9ggnZRwXFvcrN_q2~h#?xoUK>sr2agJ_aI*&xN@u z3?<3}9lWIq{gvk26MU8CpZN@uH61ncqb`@xzWk34Oo0ENU)AN@r!t{580+n zQ41mZ9i~w!3C1ssh;d@CGbwC}6T~ypBG+$SYX8`ljvufXt|twbix@_jWWZmBxccd` zD7GO4k+t^?l<<2=dJK%mY26NjD(K93Rhd!>8YCUL4en^S z+r#I&DsID|F2fdJUpm)jsc}~n)ENb9XbRW!3Bz2@0$EMS6a92w*+4xBhEoPqL)113y<=c53lj_#A zO}B9a2%$Kanke4Lx(d{0`fbtdWZw)0cC>uuClf=K$(POo67Az`KrQKVpnK_d!5l&&f@cZhP2ob<&aw6ktsBH$fTBA3A~K z8CW#QT4IVPLYtI0^Sj=lLJTE&yh{|oYgBWGBNqX;O3S~4wzs-kAMS@=ZkmpzFparql9n|7LyyWY02_GOB$IY+spP%xLs#Rb-f0QD z%a}9w1b>Mi6_^{^s;nOBgXd>uId7|})kxeyVx{~o?8V_RKdK{l2!8*#^GnPuQ?6r~ zj*fbO#IRv&*4{wQn>qNJ2-c}6tL?k6+LPRF&Pom=V_$iaC=Ry}IxVJ;1T5=Ssd!>< zEjd)~{WA9Vf3PMr#J|>qZ2?#K(OYh2e`x7Tt?7-L3=Al%_&(yF7O{5+S?N1H%sIjw zC2KIKEtgq*iX{4SjBkX6u{$!ucP{%9EztQJh*To(n?muG*oBo>o-<>5XcgIA&EzX< z7yP!|4DzF3#Sq;aNz?YwL-&6fhOTTD5cE*~B2gI4L554f5Qhb$CTK(%2R9=Tjt1V`76ws{1Rb9sJVbDOuq$r*U4xpJ9!5PkgyMvOWneti1Rt9uRCP(I zVHY3Io#&5@Ii2gE|4-GO8V}+<-w2M0B2tY$AyyEs)3gR8I@TQ;7wT|uAjLLGd78lv z=^~QopX0`4D@yLl@x)gdDVUh#S9hSB;LHU zJ&2LyxG__-?(yF^RSqm>Y64;Bc~vC67TTUWDSB9z4ZA-{Jo^l+N4$B&!I5kXiQK)o z3V{;aK7%9n%EyA5-`imhbLl_8nvNmdtpd<@BFu4@!%z%yC^|d+xrtx=1bMD`1LXx< zsd(OWwYiu|=Y~0lyS_JWC3%0Nw)CN@FGvW4u_2%2ZDh={l+5xAkcId$Bj`heh%kmZA4#Wy3bWhu@XL>-;skF}zfN2yY&B%QJOB)eb9M?nh>s=lv%}eNjJ7U| z%y$gGUdbR|Sw@*qLhX)57kSv=Z4t_)(QlwLx%0BMw6c2&-SE&BYo+1t$vJ4HK}Q(d z`tv2M_?X?oiwv7S;{a#dl&aC!N!Xpla`<`2q#5OJTN-36|unCifM+fiY4sFP? zE%oY{9~nO4eNQ~W`HPR)_sP-hc>G4rXbBIhP8&K~OfAY^r(5PbUO&nVp6hhlP3(=F=nItY z!-IJ&_b!Kqz5hmR%IqYh7tLhcXAgn9x5HT7+=-7E2_t=dP?YM{LoYz8x}X!6#Styh z?asS6j|vg@-Q0s>I>i*q(2) zFQQyT+>bfsJ>!&+VptOZQ~-YE@CZo`eXONf3@&Jn{qALKqN&lTpJ~GOZU4Qzp0wZd zL0(Op{%s6R#w6DodB24d?qRS&(xk)4wW%lgiEQt)tDr<>M$cydcH{#Zt4@&A5De^> z)!hu9tC1K{-M_2-G|b8phUp@(Ngz1I+4}u@K2SD8p}uD5d5r`kxCcqIR|&LHSKEKW zyQSlc{>E%c$r~A{Yk&+uA%M_8JG=0DK z7rXv)*ZaBiv|}=A04Z1&iFBmIt>5$#FIwi82?>e^9YfvHnY7%;Y<23{a=qmGGhBL$ zZUJj=0JP?G_EfQZR?D^W(QNG&G7y%(Ap2OEZ>=EJDOgnF10k_b3CfRP86`xTfs<8T zvT|g?X-6iOYZ!!Na)1#?pk!KxsGQGRE_iHv=_woROxx4qMA_knq+vnTSt)b123hArM4&sse#y+}qge65T8GIE_lN%L2u6SRoI zOCshP0Bl4r?Gixgdp$wt#iM)8JI$YK9(MzNX=i8b3P2|9-b76tC-4d|rKJhXlR}TY zKbu+o`H`It3ec8=f%)7%!k;X!8IEUNw}#mO|HyqoN8Gx zRAY}SBox&TDmPAR=ZI&@!G82bQ&_rXsSE>}3xSmVM@TrJ;e|l4plZE(J|VW&^uf_M zcY}|PA4l8}{7sVQ5CA)&n}!o^&*FpVTEop_Wp*4Acuk5EVxtV$<^GHA>)U9Hlj`h@=i<9M3l`?nasTh+_>R07E z@q8bH+W5)g#vyNx?)L}|-*2!6qaM;>;T2$4PyG3qpKP(OtImMT1BcD10E_~YWv6csUF<$=gZn08>2SJ1uo+^)-c70Nam!EX&z_M9X zbbXKGiu!x_jGLkA>@R$WA4abJvnVq2qWwy0reD@MXQ9>25-mXBjw0qYpm0uA{gjd1 zQpsFzJVd)-v-6IW^Vdz+CzED(kI6_Ph(*ZZAqXTmM&b?(VrTb=vuC&@wr)hXg0+Oy z9ubvangLEEiH+?NMKdpd1kY87RV-w2QS}AjO1g_2Os{X>+CP`2K=quStoNHZE71M*nbosOkvzLV&Sbp$KRf^Ds5mGJK%g?=V=p&Wbz7Vr zO8qasVZXF?(-=t`ZUEP0bM?X3`}3FQ$B<8)WG|X-;7&=KJ~>of!*=I^e=M#mgvuZ} zK0E#aGo*O@NqMPdf6(auL~RbInldvdHzA=E@}H|}a4w2~avx2ibGotj2NA5ad1d50sUF|||vt-yG9ASel{ z7VhUeTylfD!#}O^pXT}hYz!2pLpcaef@)+y%R7e$Fxv$}Y(C_P79w3lx$Gc2x^{G5 zO5OpxF8f}}n_maU>emIwMo#xaGdx6~_?-}#$OtI#C^5R1ny|YcYYq#|&PFMF9?Khx zB|wqfV3P}3O$u(Xm;XapF<-w+dYBuW22=9CwhWK~LckQGIvcH%eq26b;(RQ)I9jn= z4I|wyZ?D}$Q=qSJoLuNf$g*neO^(-z5@$%F6t?bq>KC2_iH21- z7*0diYFyQCNtKwDP6*7SZVxC7tDKoG%DT^% zC5QUMwK!XP@28RshqsR=a)&q3r{iClE;r9d^8Qr*tuZz`3l5%j{OZX)(%J}qsW56J z<#iKM*?xW~QWNZyW$_6&1BC4tZDk;692UyDSQ2-*XEq^SbudMSE^o-XO(>cUD?+Vv zVW(aZ#_#M=^6ERN<~b1-G6gezJWm5dAtLl}AUplmKRu;(izOIYPe9hVuEF>pmqO5Y z1$|@;xI!^O{V!C3&(8!kx}357<)%_aOvJUrtZy$j-tMkcj%-@(y!XYLA)!AJ(`=d3 zxS!gnuat)%xL}4VKIGGvcWw>0WQn`E7FcW{9q+rE^e)G~;wXrSaxPpSjb>I%nEZT} zi{)Yzjwj~9vhnqqKdH7*$@wl0V8;{hb+qI6nf0fLVPNVq9L5hjJ086ifydEp&8-O8 zgtcx{z38(M9=F4(-7SRKVS6q*SAqyPMT4fO=QRuPOZ8fu-uMD;u~nd1VTa_6?a11 zcG0Zx^A1d}K_vVXL=tfJs*E-4Q-9_MjVAy@JAqJLlwX7qS(t7|rz`Cmm5|ih&#Wz` z@+qaI-RI`FC&&oSiO)^eRf6*RVipr<@Dc>m6)cgWZ&4 zEqyYltol6@*3h;DXDo}_8s5iqi-z&7uqew*F@t!_cqY#1Hrn3%@79j*!|Ao9Q;wAr z-4WeS$OAtkOZP3T1qqCiDXwRS)ejo|R@OvKaNZ}L8@N(DCqk*B;f%RZ6<>Rn$*kXt zGoN%dC{au21LPru&D7YytGQY!jNu7vL(EL}qb35XuiMPvS|g4QI;UqS(BA?5MFUX@2pzHeZ24VAgg-9;T$r-2I*s@kGScwfVS)!?t=9WXJBo=b z6Z%=$K%))}j!T6d>vqs{(;;s_+2aQtxtgr zK_fjoBaKdILVwm3Oyz zn6RI~7nU3u4zONqmq)Z)P&ILhpY==2zk?+s@pH55SK2U7#Qwfw+Wkwvvb|OOx?k!! zf5w)`y?1S7`81yJL;2890d5OJyVBNQYy;o6a-*a@KXFxA>*l--E(6d|B}uc`x5C&p zgqni9(Tc(OGpQ6)$4G~|=fRs?e%PBT`*Yi$`lR^aUgJASyte&l3r@%IzLWi{dteI$ zQS@+5Aeo2}TIIC)2@20o;!Qk|B@4bL4r~ft4%yCcXNU-A{YML-QQWh`iF-=F1<5nG z{SkY3kYiy8y+~5?+UY}yK$j%HgwRY?v77iS3qrfel_Jt^8~ft!piMW;*{gdy3j?3s z`4a{E9ouWC>PDeeR})fm!A1-ebu0WSxzQy-NY?J~^`GkYmYt866vwhbYnvUT`ORw# ztC6`O`t~D-7lwbj0BRyCgi?+6cda0Xh>K5c?*VIVJVo^#xjP1|G%%XGx#ip@P!V4S z6JZ#P#17g9c_B+cAn7pTiQq!D?{G&S+;$>b{{Ae4LWZn=mut zN(nllL~;1Y+2`5g_ZR~Jwp;Fg4w}nMZE!x%)RxDyi#L#O31I1I<3xnf3%EXc-@@!7 z`Gb}>hS;}?;g5h1=JR?O_$~R7*sLu!4Kr{g4NZCHnwqaCY?yWb1@9X0)qzyR{hpw0 zvt#r9rp;TizQ_6Q{=O5Y@ZFV6Dpruj;3eVNY{m0p*KTLEql@zKbh*L3E7QD)zx4>p zzmEgujD_$=yrlaJT+aGDx9^>wHse0X%5ueTf|UYiQn(QT zsaqIe5V+tYm=@R9a8+kO?quns7xt3kJoxf8)!Qk`InXKh^|v=6*w0IglXx}uVf$hf zj}LIOJm_`#H{s3D7u5uA#^hXnAN~BRxaJLl|J{^{|AX0==~kF+5MDa2$FsRTb%3f8 z|Gvp*cBR50rM^v6FX8TO&6} z2v5f!?%)%!d$k`ud&FrEK8FHYeBfz%yGUzr4Hu@)FK}ePv(8bptnAba))Ni-FGjFL z+K&qdD!6pi2vCNIs*Q$yD$1c>)8h71EF+Erae)NZ4dwC)Dxd7MFcpyLY2=gs% zcS9prrd-+@IOJYnsgXVp&8X7V89&3^#9z&sZ1-FE;m|%m?E(m5zCG^#DEHcJS>$Hp z6~6PcH|JIV(X#b0PuRG;E8q|~eihhZX3f(UPx3dm$=P>UtHaGBy3N7NSg^mtqSu@8 zH$)vb!OA}Z2@nN@09Bkvz_9v@*eR383ABH|Kk;6#wZ!bVs;WwfzfY6Ye7_iPG8F#( za{lK_2L_J6mNzl~PS8?{b3o{Y61p#|O4RV2cNys{K%|HL|Kj3n{>#N@6yViIkx$p+ z|Nn6MaA<^_PJfo)-mN@>%=x4JfV#mzS(&&|X%XQ_zsI03ls_o=z!jtKMwAz3hxgy$e7n8-T0iO6$E>l|qU@iN($z^o6W-!vL+}iB_qVcpElG=CE>^04o zAzO{R-i{$wMCOavfb*#0+2%duz^pemO>^5O4}ob1L+)E~6y>;|Lqa8qglB;1;o%f? zd}+{TB7IcQPzL|!EP>&fat44e?LK{9>Tg;v79edI>UzBV+vsEaDKPFG0-u8q6)TDd ztKUaE*#XMqz)7BFlG-$rV6U*MYpgT+T%*lYz9;lePHhg8Gv=x?h zbvd4|4ukn*KNcb0-KZ`D+{j;E1b-?cGfXV3FQMdUrfuqqG9HmJ9{w!%@Z$zQy&od+ zs!~c5&Lj3Ub!uQ+1{CdWsU}NT5E2sNeIV*&@8eG@+)?7A_JNb8JsV=YHy8)n^$md6 z`$a;>ssl#=l&dRFQjM9SgJHG_yQSIV-jmd*h4u+zerg}AQ7shPtQl137>yiI=gFOJ zXcI9x^B93=_!T3nbX!uiMc--%>F}zcGjWfFs~Q0um+^Hfq4`-gFFQopFej>>lQ3Hy z+#b}AmHMsCjMnFE>Hm%4^OosI{bSToK`$iR9Re9}sP6^-ZgIqEd>M<4`_M}}9Z%+6 zW6_M!W^G!~f3DvHNZ_r-UImmkTNUq}tu7?o#anP`{7G!Ylo#c}4-6YKUG4ddKYfSv zWhsx+fyE@hdMCgL0UXbTQn7T&OEfGC&W_|cnz%EDojnu7jh6NUeGl=XCfv!4r>H0O zzMN7yrwS_AU6+$E8%zP6$O9)>3I-kD5!VCCRfjlmuX=GpHd}7_WXHUuc-9-mg1jyr z1xEK%m5YsLG~MN3Z*Go(RwWHe5dVJWIB)@IX_GA94o8`504_5pPCc zD1p3vERaz}uK982?MibZH|Wt|Oe%hf_`&<}l|s)Ow|K85;@_{5z*nwCLJ=4~7q~qw zUVbD8l3sreu=!n_>@!b^w%Zw6cB{ zqR&mMpBoFDCxj+%PTYRRx!?A{<-5V_J~mk|y}wdj0uIGY&m(sin6ACbep@2#U)|qi zl^9Y^n2ZEc2Qb=2djE)tqMb=QwPhI`eTuIs%- z00sAm6=7n|V{vcSBP#~pL;i5fp{HSf-A=>%^#y~Cwm~C+$lV8*0E}MW`lSKmFF|-H z953GB%FIT6+%PTSxU|RT^*x%v)(nxlYiWf%)IfyY)JKas8ND`Wq?z&L3$iFtD2m1w zX+)a(CAy`HU7dpecqD+Uyt90xo%DoZ#kF(l?gVdbwBpnGj0P!l7P#WYtPOkY(mMLx-T~CF+ko!!Sv>NeXCN$I7`?a;W=V;J1>{V+loh94Z}Q;c-0@zG$E({ z2da1KK5YX{u_?UcTVO|M#A&hx?Vwy zR99q{JX)~ClMtAQo2oZN)ba89d}7-Y+vgHs`TenWdaUW(=OqKKVl|If%|Y)Zl6*ej^GqG!)Hg43W{m> z+WB;OJlhi6rD>*T4^u!5?pAeSVjb%2f<+1Y%`q@~QZ8CX-r)e#{~+GMYl92ju-rnZ zafw2jiEAeZS@I@N5fK$3p6D~UM?P|EiyTaodUf}8cm zVAZZSZVvaNHdI%JLBB|y29l8wThsP_4%yAh+k<3woU6Xn;1onCAhA9MF+bQF{OUS5@LHrC?{EzVRaO?%mC7fDvNa4x;9)GV^GO(jX z6&>NPtzPo}OHtq0U5$v3E;qtm8a#5BX_f8NjtVrMxl+r8=eC9sb>$3z^_BX@bJv z2qP87NZabGzdtno5NPBu(_#5#VmFK)n#8+-i;Ggo5_-cJUuR3`l&?>Kn3ftDdrt0` zn`7+3k8^g2auT6X;y5D_t_!RkvC_J4$-wX3^BR>o>^tE)Ca4$Gu+L7puCkMpfC8!BHdkDh8}UF%0p z6=J4a9Ale4?*)E!$)1=BlTCnoZ5czGz6}ZypwR{!3GnTYOO)TNbJjVgEaxXyWGg{az;?oHX3=jSuGj*VMas2KJt z)n7Co`^}b!L1GnitU}vbhurK^>1$*b&VO!&+57a^|aV}$qMPq z2cFkPr9WMNK{?_3RcoplTSyMse5E=qDg^CzzdspP+AVR8&fO&jiYm3=e_)+6 zUyg}&Wz*c)e_{ZwvLETwF@4+nERqrs^V<%~*0w7J)paqB>qrSJoe%|RSpmPIi;o-k zXB(oWZI$9kg}6#1lJnBCRaww~QUuejykmbwtNLaNXK(@jx8Fj&8|_(BZ_T0{U9h_jDeL~8cd5x5hB*3wN|_%k%L%{YR>271tGubyS|_b zh`Q|ezMi~DQgPr)q-mTEPTr8f6><7=u`0ZVN?OK`l9~t;K!1`{w$KcmF}Qm1LFAn$ z{;>M5>SSZ_&)tQ{cNr<_x&J|K)70nhk`?)ksuCnD6h{Y01s$gX?G7Pz*f@C{k zgRCA2P`yp=)osTDdV6AQ6=+k86L=dG>Ej?dA#EnxGpH^+RlN_R$xFcZP)k;B1)4Xk zEKT&`*TiiHi@>%Oj5C-xU&(~2}d7Cfo1luN2h2T&} zjf`^Oul`QT2&aCJ=r{MmOo9ls&4v|GyQj}ZJ~=bzvNXgxOHCnB_{+ojT|-OV85P3? zB3~AzqN>Ct!A!3uCFj_uVx_JYctO`+%zr-_`|LpCUoaS=PF1oI8wEag8JP<orMIOVrzkdT@ZNvz#!G5 zN2$KirZQto_hr;EUFU?vN)tWdH$uV`mo=TzunFSUtL)VGvJF##`!+AyKx~bU zGaEsd2UwG9mFW7v&Nt<~!0uBW8lA+d^+$y>G#BnB=K039C(x*Pe01 zd3}K=CP5hKf}$Gb=Y*rRF#;GUOBKzwk&1jTnHKl8c0qLIkhaIe+-L(0b(OsOvP=_{ zkneu;VnIoe9P#wEL*uPlW?fYE87^L-WM0AFrptHf_Nm_z2w-@AD4ZbvNf%Q!j8WGh zj!dYEva*GoUYJ-w=*>pwhcMDgjGmz(#F=nq-d8C=0h(`ZoW>8I%aB2L8A{=Lkb{=u#4R8G23RE#O+=w(h=sL2Ygv)Ss7ycHa%=}eLPVc^yAf!pQ*lc)9V2P?x^hUiKwq9_LN*!(qGz(vt> z9~f#)XPfdwc}SBL9l*CB?X`SD2wQd2;+oEGK+@NNvq~;WXD1}^y=y?XMI;?|c(JBR z5|rGlEtR?XSW!+_~8G-z7ivyRUN;#;Z+j?nvDRFr;xDCKLyW&HEjmSCc| z{pcMzJ%iRgYSZvxTr6+K@0ZVQcwR9E1HJxjl<76Mgz76%gPr_Pj@Pg@1G>pKno$o^#uBq{c_?BX=VE#kh$r_6A<;;8@WP^h zIKrbng`%DO4HELmDyokvWP8=`08Q*rS@-SU<-oQvEz53y6}czE7j;S&*=nyLVTdpZ zX_EYYj+jvRTabJ8@)LjY`(lE6v^+<#t}AUZhy za$dbd${Tm6P~R7dKrtg^tm=Z5%T&A_Zz&S>2rcI>#}Bp<|Cm=ocCtt49LfycFf}|L z8{|#)r0>%}mL8=l9dJqFeZsXwpH5uE?Q_aB9R}fPe8>8$NmemxzZmhP zx=i_Ns9(AUm+fLzFS-yT=I|{v==CN1bd^NNksuPUgQKnaAW=PUG{16lXLmlov2N?S z$xT{YA3Cyi_W1XiYuDgHguq#7svL6%9*}LLmh^EC+g_Nxo;Q=CyaJK;C_)(Q>RsHnyb zh+ayzpSdKF@qeQoxwUk0tPoXPedsY4NZ8z5c@F9~f2`dqbif08xEVd6A1m0bb>n){cSx0rI@_`oDn3N>hQrvLdAMj#uyk^hx z=Y(SXe`K)Pn=3!_rP=NxNsJ)$x6(0sN%mv-M+vHE+DtA_sA_zRE~(nW=Mct}#l+H) z_~0=y14!@_sQ5pW^3Llib-h!6Dr#JUMQ+ICfM(Lr6u)|LPciLpl=A`&6`_ied{Ghx zW*Hyfs@Mtd@q_Bt51o9LSMb~p<9q9$YLdG%OQ~h(2*MlNB`IE@IcY_CeyOT|V3een zR&7Yv_ny=SVKaP>L!0OAJ@Lf*((ckpdbNOkiM&fg?eE3v-d0Txi}ty`+uDR*PLscB z#@&A_5H>Ul4mZ>Ec9G+Z9G_63O}MS27gvgg?CfHN>MGg)2APrRH5@axk`eKRH-B;< z`rDUQlAU_#i$6h!r!$Hhn*t_ev9gWH&Q)HcOv8}q!_|-%)bYtNA7mrLf5^sgR1{NT zWz+f+Q>F>G1c5XW!eOWQuT>mgxP0X|9hT~ohaKvRTQak-vM#UgAe?hY(#TVB-oDX< zHaKy4p#839b~My7$=(;GBu~kDe4}ZW!0Wb;pm!4JrWza3hjqYGMi|@HmrDr+Ku037 zuPxOY*AF;llz!6OaEWq+S5u(<{Rx&}3T1tkmg;EKkF|0_P0lX5YB}e56(9TIo@t;p zl3#-#*SWYDD=#1y*ntt#?94ZNy}a2a(AC{B2$(56P7W{XDTBmgb_H=n(ZqAv9y?yU zrR`f!Q0p6?rvfZzk=p|y;D7&0zvRXvU;M0|cNHIH^k`^b+ekNkv|>Bn{O?2p2#dJk z)V`FK`y#4+!C3Hlz`cfe^ji-=EWi>VDM&lufO&>2s2W5U17W%svKoOX`HXl?Y6825DkQ<(IVaSy*2 zw-n()GxVg&Ck=JgXAPr$p@}_T?5#T)3+ayYRvMImwng&zxow5+XM<+P;g!CvZ-S+> zp-@{{(cP{0)QbcM@_H_%2Uln^pB0+L*pks(uGXF8VX8#7f^vYlHKTFYM&1r+3F&_t zd-1&_wScZza^ao+I&*yXt0>rr$5PpTYd&+jlM=Lz_2@=37;4L)TOD*nGdb0r~yRp(|ZSg zN8TpJsnR|E=o~aPvt*wY1vl(=DnyBi0=#?Bur9dOaHjy+OhKs=8?zAt2zR*gN2_&R z>M@E=j-#Fad=njddY)yZL2h?LPKnb1<5QeuFw7FoWU}2)Mfapd_4N0LUA#}JxPsqh zCC6^2=fhU~lIuz@UQ00#)&Cy26REQm@cb9Ni^Mk^6JGxgwHcaBI}LO42_y_a#y!m3 zd%8k1{@qV&CYguZ{4Zz6o2@2?H*VkcC1I>t_w}}o^ypFxkIDZ=_#e>D_`jgt{e+bj zwdu>TLBn5<$L)1Vn$!&8%D^cs4)D|<54YpPF;y4bvek}CCEN`r)X{`i^Y(K4y&p=l!%cOS0w4vg_hwkH z`3B@&TP~?X!42}qvhDXW6cREV%ZnScbLMhXV5(s+rA;pKoQ)i^+N{ znKb40rRSPR@u#DYZbzArKYO2-+Te?_5W}ek1O<&e#gB~Kn|XuchkM2b8hW`lz9R-o(=%?+iZQo5=o73$UN|_pe)vEmU)2&s zhs^ZwUuR+e<8)bTG#%owQz{KT+h;Bsrnbje_O41vJP<^;s)|>r@j%y!RJ8nP=ra-H zJCXrBGfove^X7?IqqaiHh+?Bhiuy;$7R;G^8W&^xJ2q~Yva3xhh0C$d8S3!dY(G*h z%p_u_^lY7ydWYRhpj!`+A{yP|XIKgj&~y)Rx{mqw=~p_^jBN5J1m2K=*wVM#@Oi2> zYFRgqi0&;*y2gZJ1Z%vyJ%EpDZ``=S=R*{OowC(Aq=_BbU}%{EdgudWk%9@5<8=hV z4~pE2clcUcWQZOVeU_GPo=5c+lFFFhR0f}F=Nn|@n0!a``DibxkAzZFe{<3&gn!Cc zEBK0H(|YH-dA&yEio5wg^G#!2OG)+roca}VlVU(%dXr+tML?=ZA3L`FJTuo1zSzvf zg&dO{0+T!hO0z8D z$>thvp|A1=E7K-_1<9Fk(M~`gD#1&za-t79Gs5>*ncnhd#v#V<3t`89CKU-aN#*?( zfAd)n6l*%PQAj2|wtvD9vm`!aX28ceRT_k@mi*J(w|_amQiv1{mWET}j=sb#{*}k8 zjqIxWCRWo%Ah#J{M8b}q!S$U4pnZb3r06JZCt(Ybro|p!`$RO0Vv*FEaTue_Jx#fg z)g1_Hmpkd*WN97F^vAQ;xVqOB0*;OUQu=Yz%Kn^Rrkm{C3w#04a5zp@Ec9+ywu=xM zH|dMKp~3nJin@siWl Date: Wed, 21 Aug 2019 04:45:17 +0200 Subject: [PATCH 65/74] Update required quobyte secret structure (#14876) --- content/en/docs/concepts/storage/storage-classes.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/storage/storage-classes.md b/content/en/docs/concepts/storage/storage-classes.md index 2f130ce7ec..a8def3012b 100644 --- a/content/en/docs/concepts/storage/storage-classes.md +++ b/content/en/docs/concepts/storage/storage-classes.md @@ -522,11 +522,12 @@ parameters: Default is "default". * `adminSecretName`: secret that holds information about the Quobyte user and the password to authenticate against the API server. The provided secret - must have type "kubernetes.io/quobyte", e.g. created in this way: + must have type "kubernetes.io/quobyte" and the keys `user` and `password`, + e.g. created in this way: ```shell kubectl create secret generic quobyte-admin-secret \ - --type="kubernetes.io/quobyte" --from-literal=key='opensesame' \ + --type="kubernetes.io/quobyte" --from-literal=user='admin' --from-literal=password='opensesame' \ --namespace=kube-system ``` From d66304c4b1bcca624dda7f836766e998eca60809 Mon Sep 17 00:00:00 2001 From: oneoneonepig Date: Wed, 21 Aug 2019 10:53:20 +0800 Subject: [PATCH 66/74] API Version Incorrect (#15734) --- .../run-application/horizontal-pod-autoscale-walkthrough.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md b/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md index 02a7ef6e7d..6c43983c57 100644 --- a/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md +++ b/content/en/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough.md @@ -287,7 +287,7 @@ For example, if you had your monitoring system collecting metrics about network you could update the definition above using `kubectl edit` to look like this: ```yaml -apiVersion: autoscaling/v2beta1 +apiVersion: autoscaling/v2beta2 kind: HorizontalPodAutoscaler metadata: name: php-apache From cd9fab1774e6f58ef6e773c797a1a27c46b02e74 Mon Sep 17 00:00:00 2001 From: icheikhrouhou <38262569+icheikhrouhou@users.noreply.github.com> Date: Wed, 21 Aug 2019 11:37:18 +0200 Subject: [PATCH 67/74] docs | tasks | configure-pod-container | assign pods to nodes (#15096) * assign pods to nodes * fix translation in assign pods nodes --- .../assign-pods-nodes.md | 98 +++++++++++++++++++ .../pods/pod-nginx-specific-node.yaml | 10 ++ content/fr/examples/pods/pod-nginx.yaml | 13 +++ 3 files changed, 121 insertions(+) create mode 100644 content/fr/docs/tasks/configure-pod-container/assign-pods-nodes.md create mode 100644 content/fr/examples/pods/pod-nginx-specific-node.yaml create mode 100644 content/fr/examples/pods/pod-nginx.yaml diff --git a/content/fr/docs/tasks/configure-pod-container/assign-pods-nodes.md b/content/fr/docs/tasks/configure-pod-container/assign-pods-nodes.md new file mode 100644 index 0000000000..749d7495a6 --- /dev/null +++ b/content/fr/docs/tasks/configure-pod-container/assign-pods-nodes.md @@ -0,0 +1,98 @@ +--- +title: Assigner des pods aux nœuds +content_template: templates/task +weight: 120 +--- + +{{% capture overview %}} +Cette page montre comment assigner un Pod à un nœud particulier dans un cluster Kubernetes. +{{% /capture %}} + +{{% capture prerequisites %}} + +{{< include "task-tutorial-prereqs.md" >}} {{< version-check >}} + +{{% /capture %}} + +{{% capture steps %}} + +## Ajouter un label à un nœud + +1. Listez les nœuds de votre cluster : + + ```shell + kubectl get nodes + ``` + + La sortie est la suivante : + + ```shell + NAME STATUS ROLES AGE VERSION + worker0 Ready 1d v1.13.0 + worker1 Ready 1d v1.13.0 + worker2 Ready 1d v1.13.0 + ``` +2. Choisissez l'un de vos nœuds et ajoutez-y un label : + + ```shell + kubectl label nodes disktype=ssd + ``` + + où `` est le nom du noeud que vous avez choisi. + +3. Vérifiez que le nœud que vous avez choisi a le label `disktype=ssd` : + + ```shell + kubectl get nodes --show-labels + ``` + + La sortie est la suivante : + + ```shell + NAME STATUS ROLES AGE VERSION LABELS + worker0 Ready 1d v1.13.0 ...,disktype=ssd,kubernetes.io/hostname=worker0 + worker1 Ready 1d v1.13.0 ...,kubernetes.io/hostname=worker1 + worker2 Ready 1d v1.13.0 ...,kubernetes.io/hostname=worker2 + ``` + + Dans la sortie précédente, vous constatez que le nœud `worker0` possède le label `disktype=ssd`. + +## Créez un pod qui sera planifié sur un nœud sélectionné. + +Le fichier de configuration de pod décrit un pod qui possède un selector de nœud de type `disktype:ssd`. Cela signifie que le pod sera planifié sur un nœud ayant le label `disktype=ssd`. + +{{< codenew file="pods/pod-nginx.yaml" >}} + +1. Utilisez le fichier de configuration pour créer un pod qui sera ordonnancé sur votre nœud choisi : + + ```shell + kubectl apply -f https://k8s.io/examples/pods/pod-nginx.yaml + ``` + +2. Vérifiez que le pod fonctionne sur le nœud que vous avez choisi : + + ```shell + kubectl get pods --output=wide + ``` + + La sortie est la suivante : + + ```shell + NAME READY STATUS RESTARTS AGE IP NODE + nginx 1/1 Running 0 13s 10.200.0.4 worker0 + ``` +## Créez un pod qui va être planifié sur un nœud spécifique + +Vous pouvez également ordonnancer un pod sur un nœud spécifique via le paramètre `nodeName`. + +{{< codenew file="pods/pod-nginx-specific-node.yaml" >}} + +Utilisez le fichier de configuration pour créer un pod qui sera ordonnancé sur `foo-node` uniquement. + +{{% /capture %}} + +{{% capture whatsnext %}} +Pour en savoir plus sur +[labels et selectors](/docs/concepts/overview/working-with-objects/labels/). +{{% /capture %}} + diff --git a/content/fr/examples/pods/pod-nginx-specific-node.yaml b/content/fr/examples/pods/pod-nginx-specific-node.yaml new file mode 100644 index 0000000000..5923400d64 --- /dev/null +++ b/content/fr/examples/pods/pod-nginx-specific-node.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx +spec: + nodeName: foo-node # schedule pod to specific node + containers: + - name: nginx + image: nginx + imagePullPolicy: IfNotPresent diff --git a/content/fr/examples/pods/pod-nginx.yaml b/content/fr/examples/pods/pod-nginx.yaml new file mode 100644 index 0000000000..134ddae2aa --- /dev/null +++ b/content/fr/examples/pods/pod-nginx.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Pod +metadata: + name: nginx + labels: + env: test +spec: + containers: + - name: nginx + image: nginx + imagePullPolicy: IfNotPresent + nodeSelector: + disktype: ssd From 4db47aea47edad58f41e562324489546441e62bf Mon Sep 17 00:00:00 2001 From: Julie K Date: Wed, 21 Aug 2019 15:29:19 +0200 Subject: [PATCH 68/74] docs-fr | docs | reference | glossary | admission-controller.md (#15940) * docs-fr | docs | reference | glossary | admission-controller.md * updated translation : mutant admission controller --- .../glossary/admission-controller.md | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 content/fr/docs/reference/glossary/admission-controller.md diff --git a/content/fr/docs/reference/glossary/admission-controller.md b/content/fr/docs/reference/glossary/admission-controller.md new file mode 100644 index 0000000000..9d1f400483 --- /dev/null +++ b/content/fr/docs/reference/glossary/admission-controller.md @@ -0,0 +1,22 @@ +--- +title: Admission Controller +id: admission-controller +date: 2019-06-28 +full_link: fr/docs/reference/access-authn-authz/admission-controllers/ +short_description: > + Un morceau de code qui intercepte les requêtes adressées au serveur API de Kubernetes avant la persistance de l'objet. + +aka: +tags: +- extension +- security +--- +Un morceau de code qui intercepte les requêtes adressées au serveur API de Kubernetes avant la persistance de l'objet. + + + +Les contrôleurs d'accès sont configurables pour le serveur API de Kubernetes. Un contrôleur d'accès peut être "validant" ("validating"), "modifiant" ("mutating"), ou +les deux. Tout contrôleur d'accès peut rejeter la demande. Les contrôleurs modifiant peuvent modifier les objets qu'ils admettent ; +alors que les contrôleurs validants ne le peuvent pas. + +* ["Contrôleur d'accès" dans la documentation de Kubernetes](fr/docs/reference/access-authn-authz/admission-controllers/) From 570ba84ac789cb84946b3058f2fd832aaa7ff4a4 Mon Sep 17 00:00:00 2001 From: Leo Di Donato Date: Wed, 21 Aug 2019 18:08:00 +0200 Subject: [PATCH 69/74] Fix links into Audit with Falco section (#15958) * Fix links into Audit with Falco section Signed-off-by: Leonardo Di Donato Co-authored-by: Lorenzo Fontana Signed-off-by: Leonardo Di Donato * Fix typo in audit docs Signed-off-by: Leonardo Di Donato Co-Authored-By: Tim Bannister --- .../tasks/debug-application-cluster/audit.md | 48 +++++++++---------- 1 file changed, 23 insertions(+), 25 deletions(-) diff --git a/content/en/docs/tasks/debug-application-cluster/audit.md b/content/en/docs/tasks/debug-application-cluster/audit.md index 83ca7c02bb..7dafa2c500 100644 --- a/content/en/docs/tasks/debug-application-cluster/audit.md +++ b/content/en/docs/tasks/debug-application-cluster/audit.md @@ -262,7 +262,7 @@ and can optionally include a custom CA bundle to use to verify the TLS connectio The `host` should not refer to a service running in the cluster; use a service reference by specifying the `service` field instead. The host might be resolved via external DNS in some apiservers -(i.e., `kube-apiserver` cannot resolve in-cluster DNS as that would +(i.e., `kube-apiserver` cannot resolve in-cluster DNS as that would be a layering violation). `host` may also be an IP address. Please note that using `localhost` or `127.0.0.1` as a `host` is @@ -493,16 +493,16 @@ plugin which supports full-text search and analytics. ### Use Falco to collect audit events -[Falco](falco_website) is an open source project for intrusion and abnormality detection for Cloud Native platforms. +[Falco][falco_website] is an open source project for intrusion and abnormality detection for Cloud Native platforms. This section describes how to set up Falco, how to send audit events to the Kubernetes Audit endpoint exposed by Falco, and how Falco applies a set of rules to automatically detect suspicious behavior. #### Install Falco Install Falco by using one of the following methods: -- [Standalone Falco](falco_installation) -- [Kubernetes DaemonSet](falco_installation) -- [Falco Helm Chart](falco_helm_chart) +- [Standalone Falco][falco_installation] +- [Kubernetes DaemonSet][falco_installation] +- [Falco Helm Chart][falco_helm_chart] Once Falco is installed make sure it is configured to expose the Audit webhook. To do so, use the following configuration: @@ -521,26 +521,24 @@ This configuration is typically found in the `/etc/falco/falco.yaml` file. If Fa 1. Create a [kubeconfig file](/docs/concepts/configuration/organize-cluster-access-kubeconfig/) for the [kube-apiserver][kube-apiserver] webhook audit backend. - ```shell - cat < /etc/kubernetes/audit-webhook-kubeconfig - apiVersion: v1 - kind: Config - clusters: - - cluster: - server: http://:8765/k8s_audit - name: falco - contexts: - - context: - cluster: falco - user: "" - name: default-context - current-context: default-context - preferences: {} - users: [] - EOF - ``` + cat < /etc/kubernetes/audit-webhook-kubeconfig + apiVersion: v1 + kind: Config + clusters: + - cluster: + server: http://:8765/k8s_audit + name: falco + contexts: + - context: + cluster: falco + user: "" + name: default-context + current-context: default-context + preferences: {} + users: [] + EOF -2. Start [kube-apiserver][kube-apiserver] with the following options: +1. Start [kube-apiserver][kube-apiserver] with the following options: ```shell --audit-policy-file=/etc/kubernetes/audit-policy.yaml --audit-webhook-config-file=/etc/kubernetes/audit-webhook-kubeconfig @@ -579,7 +577,7 @@ A second class of rules tracks resources being created or destroyed, including: The final class of rules simply displays any Audit Event received by Falco. This rule is disabled by default, as it can be quite noisy. -For further details refer to the this [Falco documentation page](falco_ka_docs). +For further details, see [Kubernetes Audit Events][falco_ka_docs] in the Falco documentation. [kube-apiserver]: /docs/admin/kube-apiserver [auditing-proposal]: https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/auditing.md From b7c886938e8e1fee9494170bf52a8b14c909ffd1 Mon Sep 17 00:00:00 2001 From: Zach Corleissen Date: Wed, 21 Aug 2019 15:52:31 -0700 Subject: [PATCH 70/74] Update chair and approver info (#15988) Remove shavidissa from approvers Add emeritus approvers --- OWNERS | 4 ++++ OWNERS_ALIASES | 8 +------- SECURITY_CONTACTS | 2 +- 3 files changed, 6 insertions(+), 8 deletions(-) diff --git a/OWNERS b/OWNERS index 62138a57ba..f1f2f35873 100644 --- a/OWNERS +++ b/OWNERS @@ -6,5 +6,9 @@ reviewers: approvers: - sig-docs-en-owners # Defined in OWNERS_ALIASES +emeritus_approvers: +- chenopis +- jaredbhatti + labels: - sig/docs \ No newline at end of file diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index a4881cbe17..dd33e0ce96 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -50,21 +50,18 @@ aliases: - mistyhacks - rajakavitha1 - ryanmcginnis - - shavidissa - simplytunde - steveperry-53 - stewart-yu - tengqm - tfogo + - xiangpengzhao - zacharysarah - zparnold sig-docs-en-reviews: # PR reviews for English content - - jimangel - rajakavitha1 - sftim - stewart-yu - - xiangpengzhao - - zhangxiaoyu-zidif sig-docs-es-owners: # Admins for Spanish content - raelga - alexbrand @@ -144,11 +141,8 @@ aliases: - seokho-son sig-docs-maintainers: # Website maintainers - bradamant3 - - chenopis - - jaredbhatti - jimangel - kbarnard10 - - mistyhacks - pwittrock - steveperry-53 - tengqm diff --git a/SECURITY_CONTACTS b/SECURITY_CONTACTS index a91048f714..6c33b7c038 100644 --- a/SECURITY_CONTACTS +++ b/SECURITY_CONTACTS @@ -10,6 +10,6 @@ # DO NOT REPORT SECURITY VULNERABILITIES DIRECTLY TO THESE NAMES, FOLLOW THE # INSTRUCTIONS AT https://kubernetes.io/security/ -chenopis bradamant3 +jimangel zacharysarah From 63eb064d96719c2a99c70a3ffffe7134f6566f88 Mon Sep 17 00:00:00 2001 From: mohamed chiheb ben jemaa Date: Thu, 22 Aug 2019 01:20:32 +0100 Subject: [PATCH 71/74] update sweetAlert and fix scrolling after copy (#15542) --- layouts/partials/css.html | 1 - layouts/partials/head.html | 3 ++- static/css/sweetalert.min.css | 5 ----- static/js/script.js | 6 +++--- static/js/sweetalert-1.1.3.min.js | 1 - static/js/sweetalert-2.1.2.min.js | 1 + 6 files changed, 6 insertions(+), 11 deletions(-) delete mode 100644 static/css/sweetalert.min.css delete mode 100644 static/js/sweetalert-1.1.3.min.js create mode 100644 static/js/sweetalert-2.1.2.min.js diff --git a/layouts/partials/css.html b/layouts/partials/css.html index e36d1426fc..520611ec8c 100644 --- a/layouts/partials/css.html +++ b/layouts/partials/css.html @@ -17,7 +17,6 @@ {{- end }} - {{- if .Params.deprecated }} diff --git a/layouts/partials/head.html b/layouts/partials/head.html index 30e3f28293..da38d8550e 100644 --- a/layouts/partials/head.html +++ b/layouts/partials/head.html @@ -37,7 +37,8 @@ - + + {{ with .Params.js }}{{ range (split . ",") }} diff --git a/static/css/sweetalert.min.css b/static/css/sweetalert.min.css deleted file mode 100644 index f698e78dba..0000000000 --- a/static/css/sweetalert.min.css +++ /dev/null @@ -1,5 +0,0 @@ -body.stop-scrolling{height:100%;overflow:hidden}.sweet-overlay{background-color:black;-ms-filter:"alpha(opacity=40)";background-color:rgba(0,0,0,0.4);position:fixed;left:0;right:0;top:0;bottom:0;display:none;z-index:10000}.sweet-alert{background-color:white;font-family:'Open Sans','Helvetica Neue',Helvetica,Arial,sans-serif;width:478px;padding:17px;border-radius:5px;text-align:center;position:fixed;left:50%;top:50%;margin-left:-256px;margin-top:-200px;overflow:hidden;display:none;z-index:99999}@media all and (max-width:540px){.sweet-alert{width:auto;margin-left:0;margin-right:0;left:15px;right:15px}}.sweet-alert h2{color:#575757;font-size:30px;text-align:center;font-weight:600;text-transform:none;position:relative;margin:25px 0;padding:0;line-height:40px;display:block}.sweet-alert p{color:#797979;font-size:16px;text-align:center;font-weight:300;position:relative;text-align:inherit;float:none;margin:0;padding:0;line-height:normal}.sweet-alert fieldset{border:0;position:relative}.sweet-alert .sa-error-container{background-color:#f1f1f1;margin-left:-17px;margin-right:-17px;overflow:hidden;padding:0 10px;max-height:0;webkit-transition:padding .15s,max-height .15s;transition:padding .15s,max-height .15s}.sweet-alert .sa-error-container.show{padding:10px 0;max-height:100px;webkit-transition:padding .2s,max-height .2s;transition:padding .25s,max-height .25s}.sweet-alert .sa-error-container .icon{display:inline-block;width:24px;height:24px;border-radius:50%;background-color:#ea7d7d;color:white;line-height:24px;text-align:center;margin-right:3px}.sweet-alert .sa-error-container p{display:inline-block}.sweet-alert .sa-input-error{position:absolute;top:29px;right:26px;width:20px;height:20px;opacity:0;-webkit-transform:scale(0.5);transform:scale(0.5);-webkit-transform-origin:50% 50%;transform-origin:50% 50%;-webkit-transition:all .1s;transition:all .1s}.sweet-alert .sa-input-error::before,.sweet-alert .sa-input-error::after{content:"";width:20px;height:6px;background-color:#f06e57;border-radius:3px;position:absolute;top:50%;margin-top:-4px;left:50%;margin-left:-9px}.sweet-alert .sa-input-error::before{-webkit-transform:rotate(-45deg);transform:rotate(-45deg)}.sweet-alert .sa-input-error::after{-webkit-transform:rotate(45deg);transform:rotate(45deg)}.sweet-alert .sa-input-error.show{opacity:1;-webkit-transform:scale(1);transform:scale(1)}.sweet-alert input{width:100%;box-sizing:border-box;border-radius:3px;border:1px solid #d7d7d7;height:43px;margin-top:10px;margin-bottom:17px;font-size:18px;box-shadow:inset 0 1px 1px rgba(0,0,0,0.06);padding:0 12px;display:none;-webkit-transition:all .3s;transition:all .3s}.sweet-alert input:focus{outline:0;box-shadow:0 0 3px #c4e6f5;border:1px solid #b4dbed}.sweet-alert input:focus::-moz-placeholder{transition:opacity .3s .03s ease;opacity:.5}.sweet-alert input:focus:-ms-input-placeholder{transition:opacity .3s .03s ease;opacity:.5}.sweet-alert input:focus::-webkit-input-placeholder{transition:opacity .3s .03s ease;opacity:.5}.sweet-alert input::-moz-placeholder{color:#bdbdbd}.sweet-alert input:-ms-input-placeholder{color:#bdbdbd}.sweet-alert input::-webkit-input-placeholder{color:#bdbdbd}.sweet-alert.show-input input{display:block}.sweet-alert .sa-confirm-button-container{display:inline-block;position:relative}.sweet-alert .la-ball-fall{position:absolute;left:50%;top:50%;margin-left:-27px;margin-top:4px;opacity:0;visibility:hidden}.sweet-alert button{background-color:#8cd4f5;color:white;border:0;box-shadow:none;font-size:17px;font-weight:500;-webkit-border-radius:4px;border-radius:5px;padding:10px 32px;margin:26px 5px 0 5px;cursor:pointer}.sweet-alert button:focus{outline:0;box-shadow:0 0 2px rgba(128,179,235,0.5),inset 0 0 0 1px rgba(0,0,0,0.05)}.sweet-alert button:hover{background-color:#7ecff4}.sweet-alert button:active{background-color:#5dc2f1}.sweet-alert button.cancel{background-color:#c1c1c1}.sweet-alert button.cancel:hover{background-color:#b9b9b9}.sweet-alert button.cancel:active{background-color:#a8a8a8}.sweet-alert button.cancel:focus{box-shadow:rgba(197,205,211,0.8) 0 0 2px,rgba(0,0,0,0.0470588) 0 0 0 1px inset !important}.sweet-alert button[disabled]{opacity:.6;cursor:default}.sweet-alert button.confirm[disabled]{color:transparent}.sweet-alert button.confirm[disabled] ~ .la-ball-fall{opacity:1;visibility:visible;transition-delay:0}.sweet-alert button::-moz-focus-inner{border:0}.sweet-alert[data-has-cancel-button=false] button{box-shadow:none !important}.sweet-alert[data-has-confirm-button=false][data-has-cancel-button=false]{padding-bottom:40px}.sweet-alert .sa-icon{width:80px;height:80px;border:4px solid gray;-webkit-border-radius:40px;border-radius:40px;border-radius:50%;margin:20px auto;padding:0;position:relative;box-sizing:content-box}.sweet-alert .sa-icon.sa-error{border-color:#f27474}.sweet-alert .sa-icon.sa-error .sa-x-mark{position:relative;display:block}.sweet-alert .sa-icon.sa-error .sa-line{position:absolute;height:5px;width:47px;background-color:#f27474;display:block;top:37px;border-radius:2px}.sweet-alert .sa-icon.sa-error .sa-line.sa-left{-webkit-transform:rotate(45deg);transform:rotate(45deg);left:17px}.sweet-alert .sa-icon.sa-error .sa-line.sa-right{-webkit-transform:rotate(-45deg);transform:rotate(-45deg);right:16px}.sweet-alert .sa-icon.sa-warning{border-color:#f8bb86}.sweet-alert .sa-icon.sa-warning .sa-body{position:absolute;width:5px;height:47px;left:50%;top:10px;-webkit-border-radius:2px;border-radius:2px;margin-left:-2px;background-color:#f8bb86}.sweet-alert .sa-icon.sa-warning .sa-dot{position:absolute;width:7px;height:7px;-webkit-border-radius:50%;border-radius:50%;margin-left:-3px;left:50%;bottom:10px;background-color:#f8bb86}.sweet-alert .sa-icon.sa-info{border-color:#c9dae1}.sweet-alert .sa-icon.sa-info::before{content:"";position:absolute;width:5px;height:29px;left:50%;bottom:17px;border-radius:2px;margin-left:-2px;background-color:#c9dae1}.sweet-alert .sa-icon.sa-info::after{content:"";position:absolute;width:7px;height:7px;border-radius:50%;margin-left:-3px;top:19px;background-color:#c9dae1}.sweet-alert .sa-icon.sa-success{border-color:#a5dc86}.sweet-alert .sa-icon.sa-success::before,.sweet-alert .sa-icon.sa-success::after{content:'';-webkit-border-radius:40px;border-radius:40px;border-radius:50%;position:absolute;width:60px;height:120px;background:white;-webkit-transform:rotate(45deg);transform:rotate(45deg)}.sweet-alert .sa-icon.sa-success::before{-webkit-border-radius:120px 0 0 120px;border-radius:120px 0 0 120px;top:-7px;left:-33px;-webkit-transform:rotate(-45deg);transform:rotate(-45deg);-webkit-transform-origin:60px 60px;transform-origin:60px 60px}.sweet-alert .sa-icon.sa-success::after{-webkit-border-radius:0 120px 120px 0;border-radius:0 120px 120px 0;top:-11px;left:30px;-webkit-transform:rotate(-45deg);transform:rotate(-45deg);-webkit-transform-origin:0 60px;transform-origin:0 60px}.sweet-alert .sa-icon.sa-success .sa-placeholder{width:80px;height:80px;border:4px solid rgba(165,220,134,0.2);-webkit-border-radius:40px;border-radius:40px;border-radius:50%;box-sizing:content-box;position:absolute;left:-4px;top:-4px;z-index:2}.sweet-alert .sa-icon.sa-success .sa-fix{width:5px;height:90px;background-color:white;position:absolute;left:28px;top:8px;z-index:1;-webkit-transform:rotate(-45deg);transform:rotate(-45deg)}.sweet-alert .sa-icon.sa-success .sa-line{height:5px;background-color:#a5dc86;display:block;border-radius:2px;position:absolute;z-index:2}.sweet-alert .sa-icon.sa-success .sa-line.sa-tip{width:25px;left:14px;top:46px;-webkit-transform:rotate(45deg);transform:rotate(45deg)}.sweet-alert .sa-icon.sa-success .sa-line.sa-long{width:47px;right:8px;top:38px;-webkit-transform:rotate(-45deg);transform:rotate(-45deg)}.sweet-alert .sa-icon.sa-custom{background-size:contain;border-radius:0;border:0;background-position:center center;background-repeat:no-repeat}@-webkit-keyframes showSweetAlert{0{transform:scale(0.7);-webkit-transform:scale(0.7)}45%{transform:scale(1.05);-webkit-transform:scale(1.05)}80%{transform:scale(0.95);-webkit-transform:scale(0.95)}100%{transform:scale(1);-webkit-transform:scale(1)}}@keyframes showSweetAlert{0{transform:scale(0.7);-webkit-transform:scale(0.7)}45%{transform:scale(1.05);-webkit-transform:scale(1.05)}80%{transform:scale(0.95);-webkit-transform:scale(0.95)}100%{transform:scale(1);-webkit-transform:scale(1)}}@-webkit-keyframes hideSweetAlert{0{transform:scale(1);-webkit-transform:scale(1)}100%{transform:scale(0.5);-webkit-transform:scale(0.5)}}@keyframes hideSweetAlert{0{transform:scale(1);-webkit-transform:scale(1)}100%{transform:scale(0.5);-webkit-transform:scale(0.5)}}@-webkit-keyframes slideFromTop{0{top:0}100%{top:50%}}@keyframes slideFromTop{0{top:0}100%{top:50%}}@-webkit-keyframes slideToTop{0{top:50%}100%{top:0}}@keyframes slideToTop{0{top:50%}100%{top:0}}@-webkit-keyframes slideFromBottom{0{top:70%}100%{top:50%}}@keyframes slideFromBottom{0{top:70%}100%{top:50%}}@-webkit-keyframes slideToBottom{0{top:50%}100%{top:70%}}@keyframes slideToBottom{0{top:50%}100%{top:70%}}.showSweetAlert[data-animation=pop]{-webkit-animation:showSweetAlert .3s;animation:showSweetAlert .3s}.showSweetAlert[data-animation=none]{-webkit-animation:none;animation:none}.showSweetAlert[data-animation=slide-from-top]{-webkit-animation:slideFromTop .3s;animation:slideFromTop .3s}.showSweetAlert[data-animation=slide-from-bottom]{-webkit-animation:slideFromBottom .3s;animation:slideFromBottom .3s}.hideSweetAlert[data-animation=pop]{-webkit-animation:hideSweetAlert .2s;animation:hideSweetAlert .2s}.hideSweetAlert[data-animation=none]{-webkit-animation:none;animation:none}.hideSweetAlert[data-animation=slide-from-top]{-webkit-animation:slideToTop .4s;animation:slideToTop .4s}.hideSweetAlert[data-animation=slide-from-bottom]{-webkit-animation:slideToBottom .3s;animation:slideToBottom .3s}@-webkit-keyframes animateSuccessTip{0{width:0;left:1px;top:19px}54%{width:0;left:1px;top:19px}70%{width:50px;left:-8px;top:37px}84%{width:17px;left:21px;top:48px}100%{width:25px;left:14px;top:45px}}@keyframes animateSuccessTip{0{width:0;left:1px;top:19px}54%{width:0;left:1px;top:19px}70%{width:50px;left:-8px;top:37px}84%{width:17px;left:21px;top:48px}100%{width:25px;left:14px;top:45px}}@-webkit-keyframes animateSuccessLong{0{width:0;right:46px;top:54px}65%{width:0;right:46px;top:54px}84%{width:55px;right:0;top:35px}100%{width:47px;right:8px;top:38px}}@keyframes animateSuccessLong{0{width:0;right:46px;top:54px}65%{width:0;right:46px;top:54px}84%{width:55px;right:0;top:35px}100%{width:47px;right:8px;top:38px}}@-webkit-keyframes rotatePlaceholder{0{transform:rotate(-45deg);-webkit-transform:rotate(-45deg)}5%{transform:rotate(-45deg);-webkit-transform:rotate(-45deg)}12%{transform:rotate(-405deg);-webkit-transform:rotate(-405deg)}100%{transform:rotate(-405deg);-webkit-transform:rotate(-405deg)}}@keyframes rotatePlaceholder{0{transform:rotate(-45deg);-webkit-transform:rotate(-45deg)}5%{transform:rotate(-45deg);-webkit-transform:rotate(-45deg)}12%{transform:rotate(-405deg);-webkit-transform:rotate(-405deg)}100%{transform:rotate(-405deg);-webkit-transform:rotate(-405deg)}}.animateSuccessTip{-webkit-animation:animateSuccessTip .75s;animation:animateSuccessTip .75s}.animateSuccessLong{-webkit-animation:animateSuccessLong .75s;animation:animateSuccessLong .75s}.sa-icon.sa-success.animate::after{-webkit-animation:rotatePlaceholder 4.25s ease-in;animation:rotatePlaceholder 4.25s ease-in}@-webkit-keyframes animateErrorIcon{0{transform:rotateX(100deg);-webkit-transform:rotateX(100deg);opacity:0}100%{transform:rotateX(0);-webkit-transform:rotateX(0);opacity:1}}@keyframes animateErrorIcon{0{transform:rotateX(100deg);-webkit-transform:rotateX(100deg);opacity:0}100%{transform:rotateX(0);-webkit-transform:rotateX(0);opacity:1}}.animateErrorIcon{-webkit-animation:animateErrorIcon .5s;animation:animateErrorIcon .5s}@-webkit-keyframes animateXMark{0{transform:scale(0.4);-webkit-transform:scale(0.4);margin-top:26px;opacity:0}50%{transform:scale(0.4);-webkit-transform:scale(0.4);margin-top:26px;opacity:0}80%{transform:scale(1.15);-webkit-transform:scale(1.15);margin-top:-6px}100%{transform:scale(1);-webkit-transform:scale(1);margin-top:0;opacity:1}}@keyframes animateXMark{0{transform:scale(0.4);-webkit-transform:scale(0.4);margin-top:26px;opacity:0}50%{transform:scale(0.4);-webkit-transform:scale(0.4);margin-top:26px;opacity:0}80%{transform:scale(1.15);-webkit-transform:scale(1.15);margin-top:-6px}100%{transform:scale(1);-webkit-transform:scale(1);margin-top:0;opacity:1}}.animateXMark{-webkit-animation:animateXMark .5s;animation:animateXMark .5s}@-webkit-keyframes pulseWarning{0{border-color:#f8d486}100%{border-color:#f8bb86}}@keyframes pulseWarning{0{border-color:#f8d486}100%{border-color:#f8bb86}}.pulseWarning{-webkit-animation:pulseWarning .75s infinite alternate;animation:pulseWarning .75s infinite alternate}@-webkit-keyframes pulseWarningIns{0{background-color:#f8d486}100%{background-color:#f8bb86}}@keyframes pulseWarningIns{0{background-color:#f8d486}100%{background-color:#f8bb86}}.pulseWarningIns{-webkit-animation:pulseWarningIns .75s infinite alternate;animation:pulseWarningIns .75s infinite alternate}@-webkit-keyframes rotate-loading{0{transform:rotate(0)}100%{transform:rotate(360deg)}}@keyframes rotate-loading{0{transform:rotate(0)}100%{transform:rotate(360deg)}}.sweet-alert .sa-icon.sa-error .sa-line.sa-left{-ms-transform:rotate(45deg) \9}.sweet-alert .sa-icon.sa-error .sa-line.sa-right{-ms-transform:rotate(-45deg) \9}.sweet-alert .sa-icon.sa-success{border-color:transparent\9}.sweet-alert .sa-icon.sa-success .sa-line.sa-tip{-ms-transform:rotate(45deg) \9}.sweet-alert .sa-icon.sa-success .sa-line.sa-long{-ms-transform:rotate(-45deg) \9}/*! - * Load Awesome v1.1.0 (http://github.danielcardoso.net/load-awesome/) - * Copyright 2015 Daniel Cardoso <@DanielCardoso> - * Licensed under MIT - */.la-ball-fall,.la-ball-fall>div{position:relative;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}.la-ball-fall{display:block;font-size:0;color:#fff}.la-ball-fall.la-dark{color:#333}.la-ball-fall>div{display:inline-block;float:none;background-color:currentColor;border:0 solid currentColor}.la-ball-fall{width:54px;height:18px}.la-ball-fall>div{width:10px;height:10px;margin:4px;border-radius:100%;opacity:0;-webkit-animation:ball-fall 1s ease-in-out infinite;-moz-animation:ball-fall 1s ease-in-out infinite;-o-animation:ball-fall 1s ease-in-out infinite;animation:ball-fall 1s ease-in-out infinite}.la-ball-fall>div:nth-child(1){-webkit-animation-delay:-200ms;-moz-animation-delay:-200ms;-o-animation-delay:-200ms;animation-delay:-200ms}.la-ball-fall>div:nth-child(2){-webkit-animation-delay:-100ms;-moz-animation-delay:-100ms;-o-animation-delay:-100ms;animation-delay:-100ms}.la-ball-fall>div:nth-child(3){-webkit-animation-delay:0;-moz-animation-delay:0;-o-animation-delay:0;animation-delay:0}.la-ball-fall.la-sm{width:26px;height:8px}.la-ball-fall.la-sm>div{width:4px;height:4px;margin:2px}.la-ball-fall.la-2x{width:108px;height:36px}.la-ball-fall.la-2x>div{width:20px;height:20px;margin:8px}.la-ball-fall.la-3x{width:162px;height:54px}.la-ball-fall.la-3x>div{width:30px;height:30px;margin:12px}@-webkit-keyframes ball-fall{0{opacity:0;-webkit-transform:translateY(-145%);transform:translateY(-145%)}10%{opacity:.5}20%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}80%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}90%{opacity:.5}100%{opacity:0;-webkit-transform:translateY(145%);transform:translateY(145%)}}@-moz-keyframes ball-fall{0{opacity:0;-moz-transform:translateY(-145%);transform:translateY(-145%)}10%{opacity:.5}20%{opacity:1;-moz-transform:translateY(0);transform:translateY(0)}80%{opacity:1;-moz-transform:translateY(0);transform:translateY(0)}90%{opacity:.5}100%{opacity:0;-moz-transform:translateY(145%);transform:translateY(145%)}}@-o-keyframes ball-fall{0{opacity:0;-o-transform:translateY(-145%);transform:translateY(-145%)}10%{opacity:.5}20%{opacity:1;-o-transform:translateY(0);transform:translateY(0)}80%{opacity:1;-o-transform:translateY(0);transform:translateY(0)}90%{opacity:.5}100%{opacity:0;-o-transform:translateY(145%);transform:translateY(145%)}}@keyframes ball-fall{0{opacity:0;-webkit-transform:translateY(-145%);-moz-transform:translateY(-145%);-o-transform:translateY(-145%);transform:translateY(-145%)}10%{opacity:.5}20%{opacity:1;-webkit-transform:translateY(0);-moz-transform:translateY(0);-o-transform:translateY(0);transform:translateY(0)}80%{opacity:1;-webkit-transform:translateY(0);-moz-transform:translateY(0);-o-transform:translateY(0);transform:translateY(0)}90%{opacity:.5}100%{opacity:0;-webkit-transform:translateY(145%);-moz-transform:translateY(145%);-o-transform:translateY(145%);transform:translateY(145%)}} \ No newline at end of file diff --git a/static/js/script.js b/static/js/script.js index 45aa30a359..7c0d9bba5e 100755 --- a/static/js/script.js +++ b/static/js/script.js @@ -40,13 +40,13 @@ function copyCode(elem){ try { succeed = document.execCommand("copy"); } catch(e) { - sweetAlert("Oh, no...","Sorry, your browser doesn't support document.execCommand('copy'), so we can't copy this code to your clipboard."); + swal("Oh, no...","Sorry, your browser doesn't support document.execCommand('copy'), so we can't copy this code to your clipboard."); succeed = false; } - if (succeed) sweetAlert("Copied to clipboard: ",elem); + if (succeed) swal("Copied to clipboard: ",elem); return succeed; } else { - sweetAlert("Oops!",elem + " not found when trying to copy code"); + swal("Oops!",elem + " not found when trying to copy code"); return false; } } diff --git a/static/js/sweetalert-1.1.3.min.js b/static/js/sweetalert-1.1.3.min.js deleted file mode 100644 index 5c997b4451..0000000000 --- a/static/js/sweetalert-1.1.3.min.js +++ /dev/null @@ -1 +0,0 @@ -!function(e,t,n){"use strict";!function o(e,t,n){function a(s,l){if(!t[s]){if(!e[s]){var i="function"==typeof require&&require;if(!l&&i)return i(s,!0);if(r)return r(s,!0);var u=new Error("Cannot find module '"+s+"'");throw u.code="MODULE_NOT_FOUND",u}var c=t[s]={exports:{}};e[s][0].call(c.exports,function(t){var n=e[s][1][t];return a(n?n:t)},c,c.exports,o,e,t,n)}return t[s].exports}for(var r="function"==typeof require&&require,s=0;s=0;)n=n.replace(" "+t+" "," ");e.className=n.replace(/^\s+|\s+$/g,"")}},i=function(e){var n=t.createElement("div");return n.appendChild(t.createTextNode(e)),n.innerHTML},u=function(e){e.style.opacity="",e.style.display="block"},c=function(e){if(e&&!e.length)return u(e);for(var t=0;t0?setTimeout(o,t):e.style.display="none"});o()},h=function(n){if("function"==typeof MouseEvent){var o=new MouseEvent("click",{view:e,bubbles:!1,cancelable:!0});n.dispatchEvent(o)}else if(t.createEvent){var a=t.createEvent("MouseEvents");a.initEvent("click",!1,!1),n.dispatchEvent(a)}else t.createEventObject?n.fireEvent("onclick"):"function"==typeof n.onclick&&n.onclick()},b=function(t){"function"==typeof t.stopPropagation?(t.stopPropagation(),t.preventDefault()):e.event&&e.event.hasOwnProperty("cancelBubble")&&(e.event.cancelBubble=!0)};a.hasClass=r,a.addClass=s,a.removeClass=l,a.escapeHtml=i,a._show=u,a.show=c,a._hide=d,a.hide=f,a.isDescendant=p,a.getTopMargin=m,a.fadeIn=v,a.fadeOut=y,a.fireClick=h,a.stopEventPropagation=b},{}],5:[function(t,o,a){Object.defineProperty(a,"__esModule",{value:!0});var r=t("./handle-dom"),s=t("./handle-swal-dom"),l=function(t,o,a){var l=t||e.event,i=l.keyCode||l.which,u=a.querySelector("button.confirm"),c=a.querySelector("button.cancel"),d=a.querySelectorAll("button[tabindex]");if(-1!==[9,13,32,27].indexOf(i)){for(var f=l.target||l.srcElement,p=-1,m=0;m"),i.innerHTML=e.html?e.text:s.escapeHtml(e.text||"").split("\n").join("
"),e.text&&s.show(i),e.customClass)s.addClass(t,e.customClass),t.setAttribute("data-custom-class",e.customClass);else{var d=t.getAttribute("data-custom-class");s.removeClass(t,d),t.setAttribute("data-custom-class","")}if(s.hide(t.querySelectorAll(".sa-icon")),e.type&&!a.isIE8()){var f=function(){for(var o=!1,a=0;ao;o++)n=parseInt(e.substr(2*o,2),16),n=Math.round(Math.min(Math.max(0,n+n*t),255)).toString(16),a+=("00"+n).substr(n.length);return a};o.extend=a,o.hexToRgb=r,o.isIE8=s,o.logStr=l,o.colorLuminance=i},{}]},{},[1]),"function"==typeof define&&define.amd?define(function(){return sweetAlert}):"undefined"!=typeof module&&module.exports&&(module.exports=sweetAlert)}(window,document); \ No newline at end of file diff --git a/static/js/sweetalert-2.1.2.min.js b/static/js/sweetalert-2.1.2.min.js new file mode 100644 index 0000000000..dc8f5e78ec --- /dev/null +++ b/static/js/sweetalert-2.1.2.min.js @@ -0,0 +1 @@ +!function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.amd?define([],e):"object"==typeof exports?exports.swal=e():t.swal=e()}(this,function(){return function(t){function e(o){if(n[o])return n[o].exports;var r=n[o]={i:o,l:!1,exports:{}};return t[o].call(r.exports,r,r.exports,e),r.l=!0,r.exports}var n={};return e.m=t,e.c=n,e.d=function(t,n,o){e.o(t,n)||Object.defineProperty(t,n,{configurable:!1,enumerable:!0,get:o})},e.n=function(t){var n=t&&t.__esModule?function(){return t.default}:function(){return t};return e.d(n,"a",n),n},e.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},e.p="",e(e.s=8)}([function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});var o="swal-button";e.CLASS_NAMES={MODAL:"swal-modal",OVERLAY:"swal-overlay",SHOW_MODAL:"swal-overlay--show-modal",MODAL_TITLE:"swal-title",MODAL_TEXT:"swal-text",ICON:"swal-icon",ICON_CUSTOM:"swal-icon--custom",CONTENT:"swal-content",FOOTER:"swal-footer",BUTTON_CONTAINER:"swal-button-container",BUTTON:o,CONFIRM_BUTTON:o+"--confirm",CANCEL_BUTTON:o+"--cancel",DANGER_BUTTON:o+"--danger",BUTTON_LOADING:o+"--loading",BUTTON_LOADER:o+"__loader"},e.default=e.CLASS_NAMES},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.getNode=function(t){var e="."+t;return document.querySelector(e)},e.stringToNode=function(t){var e=document.createElement("div");return e.innerHTML=t.trim(),e.firstChild},e.insertAfter=function(t,e){var n=e.nextSibling;e.parentNode.insertBefore(t,n)},e.removeNode=function(t){t.parentElement.removeChild(t)},e.throwErr=function(t){throw t=t.replace(/ +(?= )/g,""),"SweetAlert: "+(t=t.trim())},e.isPlainObject=function(t){if("[object Object]"!==Object.prototype.toString.call(t))return!1;var e=Object.getPrototypeOf(t);return null===e||e===Object.prototype},e.ordinalSuffixOf=function(t){var e=t%10,n=t%100;return 1===e&&11!==n?t+"st":2===e&&12!==n?t+"nd":3===e&&13!==n?t+"rd":t+"th"}},function(t,e,n){"use strict";function o(t){for(var n in t)e.hasOwnProperty(n)||(e[n]=t[n])}Object.defineProperty(e,"__esModule",{value:!0}),o(n(25));var r=n(26);e.overlayMarkup=r.default,o(n(27)),o(n(28)),o(n(29));var i=n(0),a=i.default.MODAL_TITLE,s=i.default.MODAL_TEXT,c=i.default.ICON,l=i.default.FOOTER;e.iconMarkup='\n

',e.titleMarkup='\n
\n',e.textMarkup='\n
',e.footerMarkup='\n
\n'},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});var o=n(1);e.CONFIRM_KEY="confirm",e.CANCEL_KEY="cancel";var r={visible:!0,text:null,value:null,className:"",closeModal:!0},i=Object.assign({},r,{visible:!1,text:"Cancel",value:null}),a=Object.assign({},r,{text:"OK",value:!0});e.defaultButtonList={cancel:i,confirm:a};var s=function(t){switch(t){case e.CONFIRM_KEY:return a;case e.CANCEL_KEY:return i;default:var n=t.charAt(0).toUpperCase()+t.slice(1);return Object.assign({},r,{text:n,value:t})}},c=function(t,e){var n=s(t);return!0===e?Object.assign({},n,{visible:!0}):"string"==typeof e?Object.assign({},n,{visible:!0,text:e}):o.isPlainObject(e)?Object.assign({visible:!0},n,e):Object.assign({},n,{visible:!1})},l=function(t){for(var e={},n=0,o=Object.keys(t);n=0&&w.splice(e,1)}function s(t){var e=document.createElement("style");return t.attrs.type="text/css",l(e,t.attrs),i(t,e),e}function c(t){var e=document.createElement("link");return t.attrs.type="text/css",t.attrs.rel="stylesheet",l(e,t.attrs),i(t,e),e}function l(t,e){Object.keys(e).forEach(function(n){t.setAttribute(n,e[n])})}function u(t,e){var n,o,r,i;if(e.transform&&t.css){if(!(i=e.transform(t.css)))return function(){};t.css=i}if(e.singleton){var l=h++;n=g||(g=s(e)),o=f.bind(null,n,l,!1),r=f.bind(null,n,l,!0)}else t.sourceMap&&"function"==typeof URL&&"function"==typeof URL.createObjectURL&&"function"==typeof URL.revokeObjectURL&&"function"==typeof Blob&&"function"==typeof btoa?(n=c(e),o=p.bind(null,n,e),r=function(){a(n),n.href&&URL.revokeObjectURL(n.href)}):(n=s(e),o=d.bind(null,n),r=function(){a(n)});return o(t),function(e){if(e){if(e.css===t.css&&e.media===t.media&&e.sourceMap===t.sourceMap)return;o(t=e)}else r()}}function f(t,e,n,o){var r=n?"":o.css;if(t.styleSheet)t.styleSheet.cssText=x(e,r);else{var i=document.createTextNode(r),a=t.childNodes;a[e]&&t.removeChild(a[e]),a.length?t.insertBefore(i,a[e]):t.appendChild(i)}}function d(t,e){var n=e.css,o=e.media;if(o&&t.setAttribute("media",o),t.styleSheet)t.styleSheet.cssText=n;else{for(;t.firstChild;)t.removeChild(t.firstChild);t.appendChild(document.createTextNode(n))}}function p(t,e,n){var o=n.css,r=n.sourceMap,i=void 0===e.convertToAbsoluteUrls&&r;(e.convertToAbsoluteUrls||i)&&(o=y(o)),r&&(o+="\n/*# sourceMappingURL=data:application/json;base64,"+btoa(unescape(encodeURIComponent(JSON.stringify(r))))+" */");var a=new Blob([o],{type:"text/css"}),s=t.href;t.href=URL.createObjectURL(a),s&&URL.revokeObjectURL(s)}var m={},b=function(t){var e;return function(){return void 0===e&&(e=t.apply(this,arguments)),e}}(function(){return window&&document&&document.all&&!window.atob}),v=function(t){var e={};return function(n){return void 0===e[n]&&(e[n]=t.call(this,n)),e[n]}}(function(t){return document.querySelector(t)}),g=null,h=0,w=[],y=n(15);t.exports=function(t,e){if("undefined"!=typeof DEBUG&&DEBUG&&"object"!=typeof document)throw new Error("The style-loader cannot be used in a non-browser environment");e=e||{},e.attrs="object"==typeof e.attrs?e.attrs:{},e.singleton||(e.singleton=b()),e.insertInto||(e.insertInto="head"),e.insertAt||(e.insertAt="bottom");var n=r(t,e);return o(n,e),function(t){for(var i=[],a=0;athis.length)&&-1!==this.indexOf(t,e)}),Array.prototype.includes||Object.defineProperty(Array.prototype,"includes",{value:function(t,e){if(null==this)throw new TypeError('"this" is null or not defined');var n=Object(this),o=n.length>>>0;if(0===o)return!1;for(var r=0|e,i=Math.max(r>=0?r:o-Math.abs(r),0);i=0&&(t._idleTimeoutId=setTimeout(function(){t._onTimeout&&t._onTimeout()},e))},n(19),e.setImmediate=setImmediate,e.clearImmediate=clearImmediate},function(t,e,n){(function(t,e){!function(t,n){"use strict";function o(t){"function"!=typeof t&&(t=new Function(""+t));for(var e=new Array(arguments.length-1),n=0;n1)for(var n=1;n',e.default=e.modalMarkup},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});var o=n(0),r=o.default.OVERLAY,i='
\n
';e.default=i},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});var o=n(0),r=o.default.ICON;e.errorIconMarkup=function(){var t=r+"--error",e=t+"__line";return'\n
\n \n \n
\n '},e.warningIconMarkup=function(){var t=r+"--warning";return'\n \n \n \n '},e.successIconMarkup=function(){var t=r+"--success";return'\n \n \n\n
\n
\n '}},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});var o=n(0),r=o.default.CONTENT;e.contentMarkup='\n
\n\n
\n'},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});var o=n(0),r=o.default.BUTTON_CONTAINER,i=o.default.BUTTON,a=o.default.BUTTON_LOADER;e.buttonMarkup='\n
\n\n \n\n
\n
\n
\n
\n
\n\n
\n'},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});var o=n(4),r=n(2),i=n(0),a=i.default.ICON,s=i.default.ICON_CUSTOM,c=["error","warning","success","info"],l={error:r.errorIconMarkup(),warning:r.warningIconMarkup(),success:r.successIconMarkup()},u=function(t,e){var n=a+"--"+t;e.classList.add(n);var o=l[t];o&&(e.innerHTML=o)},f=function(t,e){e.classList.add(s);var n=document.createElement("img");n.src=t,e.appendChild(n)},d=function(t){if(t){var e=o.injectElIntoModal(r.iconMarkup);c.includes(t)?u(t,e):f(t,e)}};e.default=d},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});var o=n(2),r=n(4),i=function(t){navigator.userAgent.includes("AppleWebKit")&&(t.style.display="none",t.offsetHeight,t.style.display="")};e.initTitle=function(t){if(t){var e=r.injectElIntoModal(o.titleMarkup);e.textContent=t,i(e)}},e.initText=function(t){if(t){var e=document.createDocumentFragment();t.split("\n").forEach(function(t,n,o){e.appendChild(document.createTextNode(t)),n0}).forEach(function(t){b.classList.add(t)})}n&&t===c.CONFIRM_KEY&&b.classList.add(s),b.textContent=r;var g={};return g[t]=i,f.setActionValue(g),f.setActionOptionsFor(t,{closeModal:p}),b.addEventListener("click",function(){return u.onAction(t)}),m},p=function(t,e){var n=r.injectElIntoModal(l.footerMarkup);for(var o in t){var i=t[o],a=d(o,i,e);i.visible&&n.appendChild(a)}0===n.children.length&&n.remove()};e.default=p},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});var o=n(3),r=n(4),i=n(2),a=n(5),s=n(6),c=n(0),l=c.default.CONTENT,u=function(t){t.addEventListener("input",function(t){var e=t.target,n=e.value;a.setActionValue(n)}),t.addEventListener("keyup",function(t){if("Enter"===t.key)return s.onAction(o.CONFIRM_KEY)}),setTimeout(function(){t.focus(),a.setActionValue("")},0)},f=function(t,e,n){var o=document.createElement(e),r=l+"__"+e;o.classList.add(r);for(var i in n){var a=n[i];o[i]=a}"input"===e&&u(o),t.appendChild(o)},d=function(t){if(t){var e=r.injectElIntoModal(i.contentMarkup),n=t.element,o=t.attributes;"string"==typeof n?f(e,n,o):e.appendChild(n)}};e.default=d},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});var o=n(1),r=n(2),i=function(){var t=o.stringToNode(r.overlayMarkup);document.body.appendChild(t)};e.default=i},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});var o=n(5),r=n(6),i=n(1),a=n(3),s=n(0),c=s.default.MODAL,l=s.default.BUTTON,u=s.default.OVERLAY,f=function(t){t.preventDefault(),v()},d=function(t){t.preventDefault(),g()},p=function(t){if(o.default.isOpen)switch(t.key){case"Escape":return r.onAction(a.CANCEL_KEY)}},m=function(t){if(o.default.isOpen)switch(t.key){case"Tab":return f(t)}},b=function(t){if(o.default.isOpen)return"Tab"===t.key&&t.shiftKey?d(t):void 0},v=function(){var t=i.getNode(l);t&&(t.tabIndex=0,t.focus())},g=function(){var t=i.getNode(c),e=t.querySelectorAll("."+l),n=e.length-1,o=e[n];o&&o.focus()},h=function(t){t[t.length-1].addEventListener("keydown",m)},w=function(t){t[0].addEventListener("keydown",b)},y=function(){var t=i.getNode(c),e=t.querySelectorAll("."+l);e.length&&(h(e),w(e))},x=function(t){if(i.getNode(u)===t.target)return r.onAction(a.CANCEL_KEY)},_=function(t){var e=i.getNode(u);e.removeEventListener("click",x),t&&e.addEventListener("click",x)},k=function(t){o.default.timer&&clearTimeout(o.default.timer),t&&(o.default.timer=window.setTimeout(function(){return r.onAction(a.CANCEL_KEY)},t))},O=function(t){t.closeOnEsc?document.addEventListener("keyup",p):document.removeEventListener("keyup",p),t.dangerMode?v():g(),y(),_(t.closeOnClickOutside),k(t.timer)};e.default=O},function(t,e,n){"use strict";Object.defineProperty(e,"__esModule",{value:!0});var o=n(1),r=n(3),i=n(37),a=n(38),s={title:null,text:null,icon:null,buttons:r.defaultButtonList,content:null,className:null,closeOnClickOutside:!0,closeOnEsc:!0,dangerMode:!1,timer:null},c=Object.assign({},s);e.setDefaults=function(t){c=Object.assign({},s,t)};var l=function(t){var e=t&&t.button,n=t&&t.buttons;return void 0!==e&&void 0!==n&&o.throwErr("Cannot set both 'button' and 'buttons' options!"),void 0!==e?{confirm:e}:n},u=function(t){return o.ordinalSuffixOf(t+1)},f=function(t,e){o.throwErr(u(e)+" argument ('"+t+"') is invalid")},d=function(t,e){var n=t+1,r=e[n];o.isPlainObject(r)||void 0===r||o.throwErr("Expected "+u(n)+" argument ('"+r+"') to be a plain object")},p=function(t,e){var n=t+1,r=e[n];void 0!==r&&o.throwErr("Unexpected "+u(n)+" argument ("+r+")")},m=function(t,e,n,r){var i=typeof e,a="string"===i,s=e instanceof Element;if(a){if(0===n)return{text:e};if(1===n)return{text:e,title:r[0]};if(2===n)return d(n,r),{icon:e};f(e,n)}else{if(s&&0===n)return d(n,r),{content:e};if(o.isPlainObject(e))return p(n,r),e;f(e,n)}};e.getOpts=function(){for(var t=[],e=0;e Date: Thu, 22 Aug 2019 16:08:32 +0900 Subject: [PATCH 72/74] fix typo (#15996) --- .../tutorials/kubernetes-basics/deploy-app/deploy-intro.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/ja/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro.html b/content/ja/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro.html index 123d2683a2..c58db56c9e 100644 --- a/content/ja/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro.html +++ b/content/ja/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro.html @@ -21,7 +21,7 @@ weight: 10

目標

  • アプリケーションのデプロイについて学ぶ
    • -
  • kubectlを使って、Kubenretes上にはじめてのアプリケーションをデプロイする
    • +
  • kubectlを使って、Kubernetes上にはじめてのアプリケーションをデプロイする
From f600acf2b649596f292293b738f80988f4471b3b Mon Sep 17 00:00:00 2001 From: Piyush Kumar Date: Thu, 22 Aug 2019 21:12:32 +0530 Subject: [PATCH 73/74] Starting from nginx ingress controller Version 0.22.0 onwards, it uses placeholders /$1 or /$2 soon for rewrite-target annotation (#15504) In nginx ingress controller Version 0.22.0 and beyond, any substrings within the request URI that need to be passed to the rewritten path must explicitly be defined in a capture group. Please refer doc here : * `https://kubernetes.github.io/ingress-nginx/examples/rewrite/#rewrite-target` * `https://stackoverflow.com/a/55193468/5527839 ` Currently, what was mentioned in the docs, didnt work for me. I was using minikube version `1.2.0` which uses ingress above v0.21.0. After reading the docs provided in above two links, was able to figure out where it was lacking. Have mentioned the changes in the proposed file change. --- .../docs/tasks/access-application-cluster/ingress-minikube.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/tasks/access-application-cluster/ingress-minikube.md b/content/en/docs/tasks/access-application-cluster/ingress-minikube.md index 56cea2a220..123699856b 100644 --- a/content/en/docs/tasks/access-application-cluster/ingress-minikube.md +++ b/content/en/docs/tasks/access-application-cluster/ingress-minikube.md @@ -140,13 +140,13 @@ The following file is an Ingress resource that sends traffic to your Service via metadata: name: example-ingress annotations: - nginx.ingress.kubernetes.io/rewrite-target: / + nginx.ingress.kubernetes.io/rewrite-target: /$1 spec: rules: - host: hello-world.info http: paths: - - path: /* + - path: /(.+) backend: serviceName: web servicePort: 8080 From 92e439e1240584372fabd2e9bbf6b13904d3582b Mon Sep 17 00:00:00 2001 From: mohamed chiheb ben jemaa Date: Fri, 23 Aug 2019 14:13:18 +0100 Subject: [PATCH 74/74] split falco section to a new page (#16011) --- .../tasks/debug-application-cluster/audit.md | 112 +--------------- .../tasks/debug-application-cluster/falco.md | 121 ++++++++++++++++++ 2 files changed, 127 insertions(+), 106 deletions(-) create mode 100644 content/en/docs/tasks/debug-application-cluster/falco.md diff --git a/content/en/docs/tasks/debug-application-cluster/audit.md b/content/en/docs/tasks/debug-application-cluster/audit.md index 7dafa2c500..0fe8928260 100644 --- a/content/en/docs/tasks/debug-application-cluster/audit.md +++ b/content/en/docs/tasks/debug-application-cluster/audit.md @@ -489,111 +489,11 @@ Note that in addition to file output plugin, logstash has a variety of outputs t let users route data where they want. For example, users can emit audit events to elasticsearch plugin which supports full-text search and analytics. -## Webhook Collector Examples - -### Use Falco to collect audit events - -[Falco][falco_website] is an open source project for intrusion and abnormality detection for Cloud Native platforms. -This section describes how to set up Falco, how to send audit events to the Kubernetes Audit endpoint exposed by Falco, and how Falco applies a set of rules to automatically detect suspicious behavior. - -#### Install Falco - -Install Falco by using one of the following methods: - -- [Standalone Falco][falco_installation] -- [Kubernetes DaemonSet][falco_installation] -- [Falco Helm Chart][falco_helm_chart] - -Once Falco is installed make sure it is configured to expose the Audit webhook. To do so, use the following configuration: - -```yaml -webserver: - enabled: true - listen_port: 8765 - k8s_audit_endpoint: /k8s_audit - ssl_enabled: false - ssl_certificate: /etc/falco/falco.pem -``` - -This configuration is typically found in the `/etc/falco/falco.yaml` file. If Falco is installed as a Kubernetes DaemonSet, edit the `falco-config` ConfigMap and add this configuration. - -#### Configure Kubernetes Audit - -1. Create a [kubeconfig file](/docs/concepts/configuration/organize-cluster-access-kubeconfig/) for the [kube-apiserver][kube-apiserver] webhook audit backend. - - cat < /etc/kubernetes/audit-webhook-kubeconfig - apiVersion: v1 - kind: Config - clusters: - - cluster: - server: http://:8765/k8s_audit - name: falco - contexts: - - context: - cluster: falco - user: "" - name: default-context - current-context: default-context - preferences: {} - users: [] - EOF - -1. Start [kube-apiserver][kube-apiserver] with the following options: - - ```shell - --audit-policy-file=/etc/kubernetes/audit-policy.yaml --audit-webhook-config-file=/etc/kubernetes/audit-webhook-kubeconfig - ``` - -#### Audit Rules - -Rules devoted to Kubernetes Audit Events can be found in [k8s_audit_rules.yaml][falco_k8s_audit_rules]. If Audit Rules is installed as a native package or using the official Docker images, Falco copies the rules file to `/etc/falco/`, so they are available for use. - -There are three classes of rules. - -The first class of rules looks for suspicious or exceptional activities, such as: - -- Any activity by an unauthorized or anonymous user. -- Creating a pod with an unknown or disallowed image. -- Creating a privileged pod, a pod mounting a sensitive filesystem from the host, or a pod using host networking. -- Creating a NodePort service. -- Creating a ConfigMap containing private credentials, such as passwords and cloud provider secrets. -- Attaching to or executing a command on a running pod. -- Creating a namespace external to a set of allowed namespaces. -- Creating a pod or service account in the kube-system or kube-public namespaces. -- Trying to modify or delete a system ClusterRole. -- Creating a ClusterRoleBinding to the cluster-admin role. -- Creating a ClusterRole with wildcarded verbs or resources. For example, overly permissive. -- Creating a ClusterRole with write permissions or a ClusterRole that can execute commands on pods. - -A second class of rules tracks resources being created or destroyed, including: - -- Deployments -- Services -- ConfigMaps -- Namespaces -- Service accounts -- Role/ClusterRoles -- Role/ClusterRoleBindings - -The final class of rules simply displays any Audit Event received by Falco. This rule is disabled by default, as it can be quite noisy. - -For further details, see [Kubernetes Audit Events][falco_ka_docs] in the Falco documentation. - -[kube-apiserver]: /docs/admin/kube-apiserver -[auditing-proposal]: https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/auditing.md -[auditing-api]: https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/staging/src/k8s.io/apiserver/pkg/apis/audit/v1/types.go -[gce-audit-profile]: https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/cluster/gce/gci/configure-helper.sh#L735 -[kubeconfig]: /docs/tasks/access-application-cluster/configure-access-multiple-clusters/ -[fluentd]: http://www.fluentd.org/ -[fluentd_install_doc]: https://docs.fluentd.org/v1.0/articles/quickstart#step-1:-installing-fluentd -[fluentd_plugin_management_doc]: https://docs.fluentd.org/v1.0/articles/plugin-management -[logstash]: https://www.elastic.co/products/logstash -[logstash_install_doc]: https://www.elastic.co/guide/en/logstash/current/installing-logstash.html -[kube-aggregator]: /docs/concepts/api-extension/apiserver-aggregation -[falco_website]: https://www.falco.org -[falco_k8s_audit_rules]: https://github.com/falcosecurity/falco/blob/master/rules/k8s_audit_rules.yaml -[falco_ka_docs]: https://falco.org/docs/event-sources/kubernetes-audit -[falco_installation]: https://falco.org/docs/installation -[falco_helm_chart]: https://github.com/helm/charts/tree/master/stable/falco + +{{% /capture %}} + +{{% capture whatsnext %}} + +Visit [Auditing with Falco](/docs/tasks/debug-application-cluster/falco) {{% /capture %}} diff --git a/content/en/docs/tasks/debug-application-cluster/falco.md b/content/en/docs/tasks/debug-application-cluster/falco.md new file mode 100644 index 0000000000..003b287602 --- /dev/null +++ b/content/en/docs/tasks/debug-application-cluster/falco.md @@ -0,0 +1,121 @@ +--- +reviewers: +- soltysh +- sttts +- ericchiang +content_template: templates/concept +title: Auditing with Falco +--- + +{{% capture overview %}} +### Use Falco to collect audit events + +[Falco](https://falco.org/) is an open source project for intrusion and abnormality detection for Cloud Native platforms. +This section describes how to set up Falco, how to send audit events to the Kubernetes Audit endpoint exposed by Falco, and how Falco applies a set of rules to automatically detect suspicious behavior. + +{{% /capture %}} + +{{% capture body %}} + + +#### Install Falco + +Install Falco by using one of the following methods: + +- [Standalone Falco][falco_installation] +- [Kubernetes DaemonSet][falco_installation] +- [Falco Helm Chart][falco_helm_chart] + +Once Falco is installed make sure it is configured to expose the Audit webhook. To do so, use the following configuration: + +```yaml +webserver: + enabled: true + listen_port: 8765 + k8s_audit_endpoint: /k8s_audit + ssl_enabled: false + ssl_certificate: /etc/falco/falco.pem +``` + +This configuration is typically found in the `/etc/falco/falco.yaml` file. If Falco is installed as a Kubernetes DaemonSet, edit the `falco-config` ConfigMap and add this configuration. + +#### Configure Kubernetes Audit + +1. Create a [kubeconfig file](/docs/concepts/configuration/organize-cluster-access-kubeconfig/) for the [kube-apiserver][kube-apiserver] webhook audit backend. + + cat < /etc/kubernetes/audit-webhook-kubeconfig + apiVersion: v1 + kind: Config + clusters: + - cluster: + server: http://:8765/k8s_audit + name: falco + contexts: + - context: + cluster: falco + user: "" + name: default-context + current-context: default-context + preferences: {} + users: [] + EOF + +1. Start [kube-apiserver][kube-apiserver] with the following options: + + ```shell + --audit-policy-file=/etc/kubernetes/audit-policy.yaml --audit-webhook-config-file=/etc/kubernetes/audit-webhook-kubeconfig + ``` + +#### Audit Rules + +Rules devoted to Kubernetes Audit Events can be found in [k8s_audit_rules.yaml][falco_k8s_audit_rules]. If Audit Rules is installed as a native package or using the official Docker images, Falco copies the rules file to `/etc/falco/`, so they are available for use. + +There are three classes of rules. + +The first class of rules looks for suspicious or exceptional activities, such as: + +- Any activity by an unauthorized or anonymous user. +- Creating a pod with an unknown or disallowed image. +- Creating a privileged pod, a pod mounting a sensitive filesystem from the host, or a pod using host networking. +- Creating a NodePort service. +- Creating a ConfigMap containing private credentials, such as passwords and cloud provider secrets. +- Attaching to or executing a command on a running pod. +- Creating a namespace external to a set of allowed namespaces. +- Creating a pod or service account in the kube-system or kube-public namespaces. +- Trying to modify or delete a system ClusterRole. +- Creating a ClusterRoleBinding to the cluster-admin role. +- Creating a ClusterRole with wildcarded verbs or resources. For example, overly permissive. +- Creating a ClusterRole with write permissions or a ClusterRole that can execute commands on pods. + +A second class of rules tracks resources being created or destroyed, including: + +- Deployments +- Services +- ConfigMaps +- Namespaces +- Service accounts +- Role/ClusterRoles +- Role/ClusterRoleBindings + +The final class of rules simply displays any Audit Event received by Falco. This rule is disabled by default, as it can be quite noisy. + +For further details, see [Kubernetes Audit Events][falco_ka_docs] in the Falco documentation. + +[kube-apiserver]: /docs/admin/kube-apiserver +[auditing-proposal]: https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/auditing.md +[auditing-api]: https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/staging/src/k8s.io/apiserver/pkg/apis/audit/v1/types.go +[gce-audit-profile]: https://github.com/kubernetes/kubernetes/blob/{{< param "githubbranch" >}}/cluster/gce/gci/configure-helper.sh#L735 +[kubeconfig]: /docs/tasks/access-application-cluster/configure-access-multiple-clusters/ +[fluentd]: http://www.fluentd.org/ +[fluentd_install_doc]: https://docs.fluentd.org/v1.0/articles/quickstart#step-1:-installing-fluentd +[fluentd_plugin_management_doc]: https://docs.fluentd.org/v1.0/articles/plugin-management +[logstash]: https://www.elastic.co/products/logstash +[logstash_install_doc]: https://www.elastic.co/guide/en/logstash/current/installing-logstash.html +[kube-aggregator]: /docs/concepts/api-extension/apiserver-aggregation +[falco_website]: https://www.falco.org +[falco_k8s_audit_rules]: https://github.com/falcosecurity/falco/blob/master/rules/k8s_audit_rules.yaml +[falco_ka_docs]: https://falco.org/docs/event-sources/kubernetes-audit +[falco_installation]: https://falco.org/docs/installation +[falco_helm_chart]: https://github.com/helm/charts/tree/master/stable/falco + +{{% /capture %}}