From 71cdde7857b8d169518fb6c4b1e84acc80d0fd67 Mon Sep 17 00:00:00 2001 From: "W. Trevor King" Date: Thu, 15 Oct 2020 12:45:18 -0700 Subject: [PATCH 001/258] content/en/docs/tasks/run-application/configure-pdb: Acceptable overlapping PDBs The previous "must be careful not to create" wording was making folks uncomfortable about brief overlap periods while transitioning between two PDBs [1]. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=1861104#c29 --- content/en/docs/tasks/run-application/configure-pdb.md | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/content/en/docs/tasks/run-application/configure-pdb.md b/content/en/docs/tasks/run-application/configure-pdb.md index 8113e07128..3823cac4ee 100644 --- a/content/en/docs/tasks/run-application/configure-pdb.md +++ b/content/en/docs/tasks/run-application/configure-pdb.md @@ -236,9 +236,6 @@ You can use a PDB with pods controlled by another type of controller, by an - only an integer value can be used with `.spec.minAvailable`, not a percentage. You can use a selector which selects a subset or superset of the pods belonging to a built-in -controller. However, when there are multiple PDBs in a namespace, you must be careful not -to create PDBs whose selectors overlap. - - - - +controller. The eviction API will disallow eviction of any pod covered by multiple PDBs, +so most users will want to avoid overlapping selectors. One reasonable use of overlapping +PDBs is when pods are being transitioned from one PDB to another. From 4ffb64dfb7f4f74ae5e6baed1f02c9c28cb43a34 Mon Sep 17 00:00:00 2001 From: lanandra Date: Sat, 14 Nov 2020 12:17:24 +0700 Subject: [PATCH 002/258] fix typo file in languge id ingress edit content/id/docs/concepts/services-networking/ingress.md --- content/id/docs/concepts/services-networking/ingress.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/id/docs/concepts/services-networking/ingress.md b/content/id/docs/concepts/services-networking/ingress.md index 1cc56c5960..6baae2adc9 100644 --- a/content/id/docs/concepts/services-networking/ingress.md +++ b/content/id/docs/concepts/services-networking/ingress.md @@ -89,7 +89,7 @@ spec: ``` Seperti layaknya *resource* Kubernetes yang lain, sebuah Ingress membutuhkan *field* `apiVersion`, `kind`, dan `metadata`. - Untuk informasi umum soal bagaimana cara bekerja dengan menggunakan file konfigurasi, silahkan merujuk pada [melakukan deploy aplikasi](/docs/tasks/run-application/run-stateless-application-deployment/), [konfigurasi kontainer](/id/docs/tasks/configure-pod-container/configure-pod-configmap/), [mengatur *resource*](/id/docs/concepts/cluster-administration/manage-deployment/). + Untuk informasi umum soal bagaimana cara bekerja dengan menggunakan berkas konfigurasi, silahkan merujuk pada [melakukan deploy aplikasi](/docs/tasks/run-application/run-stateless-application-deployment/), [konfigurasi kontainer](/id/docs/tasks/configure-pod-container/configure-pod-configmap/), [mengatur *resource*](/id/docs/concepts/cluster-administration/manage-deployment/). Ingress seringkali menggunakan anotasi untuk melakukan konfigurasi beberapa opsi yang ada bergantung pada kontroler Ingress yang digunakan, sebagai contohnya adalah [anotasi rewrite-target](https://github.com/kubernetes/ingress-nginx/blob/master/docs/examples/rewrite/README.md). [Kontroler Ingress](/id/docs/concepts/services-networking/ingress-controllers) yang berbeda memiliki jenis anotasi yang berbeda. Pastikan kamu sudah terlebih dahulu memahami dokumentasi @@ -442,7 +442,7 @@ Events: Normal ADD 45s loadbalancer-controller default/test ``` -Kamu juga dapat mengubah Ingress dengan menggunakan perintah `kubectl replace -f` pada file konfigurasi +Kamu juga dapat mengubah Ingress dengan menggunakan perintah `kubectl replace -f` pada berkas konfigurasi Ingress yang ingin diubah. ## Mekanisme *failing* pada beberapa zona *availability* From e910fb10a5d7952d2cde344818573768c33ffec0 Mon Sep 17 00:00:00 2001 From: Iskandar Abudiab Date: Mon, 23 Nov 2020 20:45:53 +0100 Subject: [PATCH 003/258] Add Swift client library --- content/en/docs/reference/using-api/client-libraries.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/docs/reference/using-api/client-libraries.md b/content/en/docs/reference/using-api/client-libraries.md index c14f0fa9c7..96589c6a55 100644 --- a/content/en/docs/reference/using-api/client-libraries.md +++ b/content/en/docs/reference/using-api/client-libraries.md @@ -74,6 +74,7 @@ their authors, not the Kubernetes team. | Rust | [github.com/ynqa/kubernetes-rust](https://github.com/ynqa/kubernetes-rust) | | Scala | [github.com/doriordan/skuber](https://github.com/doriordan/skuber) | | Scala | [github.com/joan38/kubernetes-client](https://github.com/joan38/kubernetes-client) | +| Swift | [github.com/swiftkube/client](https://github.com/swiftkube/client) | | DotNet | [github.com/tonnyeremin/kubernetes_gen](https://github.com/tonnyeremin/kubernetes_gen) | | DotNet (RestSharp) | [github.com/masroorhasan/Kubernetes.DotNet](https://github.com/masroorhasan/Kubernetes.DotNet) | | Elixir | [github.com/obmarg/kazan](https://github.com/obmarg/kazan/) | From 021ffe7a87e756efff7e9410b16703f61d1c1778 Mon Sep 17 00:00:00 2001 From: jess-edwards Date: Fri, 25 Sep 2020 09:33:09 -0700 Subject: [PATCH 004/258] new blog post: Custom K8s Scheduler for Highly Available Apps --- .../image01.png | Bin 0 -> 13525 bytes .../image02.png | Bin 0 -> 30770 bytes .../image03.png | Bin 0 -> 28564 bytes .../image04.png | Bin 0 -> 19665 bytes .../image05.png | Bin 0 -> 18311 bytes .../image06.png | Bin 0 -> 19689 bytes .../image07.png | Bin 0 -> 20712 bytes .../2020-09-30-writing-crl-scheduler/index.md | 96 ++++++++++++++++++ content/en/blog/_posts/image01.png | Bin 0 -> 13525 bytes content/en/blog/_posts/image02.png | Bin 0 -> 30770 bytes content/en/blog/_posts/image03.png | Bin 0 -> 28564 bytes content/en/blog/_posts/image04.png | Bin 0 -> 19665 bytes content/en/blog/_posts/image05.png | Bin 0 -> 18311 bytes content/en/blog/_posts/image06.png | Bin 0 -> 19689 bytes content/en/blog/_posts/image07.png | Bin 0 -> 20712 bytes 15 files changed, 96 insertions(+) create mode 100644 content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image01.png create mode 100644 content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image02.png create mode 100644 content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image03.png create mode 100644 content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image04.png create mode 100644 content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image05.png create mode 100644 content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image06.png create mode 100644 content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image07.png create mode 100644 content/en/blog/_posts/2020-09-30-writing-crl-scheduler/index.md create mode 100644 content/en/blog/_posts/image01.png create mode 100644 content/en/blog/_posts/image02.png create mode 100644 content/en/blog/_posts/image03.png create mode 100644 content/en/blog/_posts/image04.png create mode 100644 content/en/blog/_posts/image05.png create mode 100644 content/en/blog/_posts/image06.png create mode 100644 content/en/blog/_posts/image07.png diff --git a/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image01.png b/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image01.png new file mode 100644 index 0000000000000000000000000000000000000000..91e885613945a9e2624a4984c0bebdcf3eca6c33 GIT binary patch literal 13525 zcmaibbyQT{_ct+gNJ*z42#PfG0K$L>g2aH7hyp4d<0zfdse~xfLpP%2AUQPBT_X(L zGBgbJUY_{Y`mOc;!#bRM&)$3P*=NUR?-Q=0{g8^Bl^hQbk4jzb!DBo;0vIrEASDL= zz9$R3j)y0iqW(Zh-+gK;)yLUjH1V=F{_A&*j>6GFL;H@Ysj0$S=BAx&9@lty_~xW& z!f427h-gt*Ru6S<0@n9_=^z>%#q?Y0q&FCa7=@?}O)4uPa(a1e&1zq0AHXIZlS2ziv^1pPfZyXSpaj;QZ9`bcb<#`)>y)lXI`j zxctdy&WkL>t@W2K6Z7F|xV84=hMKrp9+h(~TbYwmpPRM$`_U`!E)fx#`4m5vlkATU zB?kte3@+bg9llrQ`TjT=n~uWDW#>1lyM-{@+={@c>Vm)#H;}pvs1KQ>u>Tx0sKB#s z1+e`&|Mysh7EKEK_xSJS0c^nhze)Y)`2Qx$`wzQ+llot>f3p5BvV+inzx_8eV%C34 z9$sPzeXT#t`5aTI*LY?$+i%@{@yg#v8ubA)#+K3R=|QGIF*Uy7#*T5hfee0R>YG%% z*rnKKeH1%vH$U=F|6<^+RM`*1O2_GrjR){OGl>-uJti zP1YHLss}pP1W0%0ydcN1+baZ5&T4Nr6#8$48*E55q4bWs>{Z|t`m4I>V#I@4GVbe4 zvYq%-c+qv7pz3e--doD+xOYhPdXGbiSrkk_2DD^ zz7{P1`q{2$$I`*MHz{mHg(Wb#@xbv{k(k*#8(7xwrF4IS{2m@Aher64MCx{)#p3D$ zrrycyOhqg41WBy4`tY1M{|hx@|IFKhaHx!8WDRk8YY+wae8-kIxC5{g(O})UW99*6Z3%OpZLLS}_REPxTs7 z_VffHXZG-r0v?j?e+h<^8z(>P!7o?CDrG$+XZsd%WF=x}SUuzFWnG0|f761?T)Miy zaV@!ewb+lDs70<$8dNPx&cOfzRe0>VID6CF!-%=_-+mny@5gz@=TF8Rddb_=#D%4k z1s`*q&PZ@~IVBKd__4$<uwI)Do!Sa%K4#JhUT zYnXAqa5>+lRZG3*GpH2sjZ0tGV0cX>k7hiDgC_#Rh=jii6-$w)9_hks>KQj@u$Tj( zd)^a-gz&uzZI9YAeYb6t+HB3uEdwzt!zcJ4%Av{lAeG}vW2d6dBLdZH*~ z9}rmk2_5(1Q%q6JlQ<`|Y7Egv$MF3*O(CBmnrvSK=oQ>5C*ya1_`xtSf9lv5H&V|wcj-{xnKKEefs0XcH6{SM23X# zcFZSiVXySVf?EN}uj6RzV9T9J86myiRBINAsf=W3a{?9|L(O&DmKZ;2khFxH0I-$X zz)2ugmg=mkv5cU-lfr^`jL+HJuZAIhogOvfeGSztEQcY2eSBlS?1y2@?II0>hUvlH zD9g$(Z!p)ONVWOk^s5p+A`BtZJeJM+Wc*bi9P=X|XJw#LdGgDT?qtEt?5stQQ#-`v-a!X-RF$%k&q?{sMH! z7iK-Ju|9)NAE*AXHiYs^B6ITV$yEgdk{#`}Jv`J2NYlxD@!&5q3HVq7)i73L{x8kk ziB%^090FO=Q&#+%7JAb3Kwy*LCv<`eJipV=Bcm}C?i#ZE&;8jBgF`LM+;0!v7@gou zy(74Wf*ubDv#HUd=lS>VpgqN{+Ix!y{CH9%?&qw$I@C;Q0q5iUh1YrB{3FEZ1K#0| z7u6l$yp-gzIEaWOIx;(Q5RLY+Dby{o7ryaqL4$|*2-!QjyBSczl+E>!$KK-8kTX29 zgi_S)z6pG@1kImiH7SFgwS`M5>v9t@Brr+f@F~pFZZ0jQHRRN(O-!fWsjAL=Ctj78L zxyU4Se!_ZB0n|W6<#W}J3 zpv;Upi2QH3E`GQ&w{QV-5u>p0$MMvNqNhoS(U!dLUj;tMAm@xN)acV7r$i#`*WK#R z=9NCDq;T$;zoJ08;MOS59|Vs>rTy7{QpMjfZrRW}Sr#0LYp0ueNe=r%OjGfXH~Z`& z%u7XLySt(7k~bX*ueLDrxQh`!U9l0vYA78sp1Aus$)8u4>e>UvmGe2KxeUfT)^v}ksqDXR$0^-pCa zOohq zYm|E4i%_P5O+gd)=`F(%FTXud8^9bcC-&>NVZYbq>SG9QAB^dV;e(4A?!7aW5Fx*g zWaTu;9IMXUSE0ze2t~+1^}u1SEPy--#`9&gNjQm3d0EH@Ys6p=*h4qJ6q(FZVLIC zDbSHBVXqr~6#Om5VsteLwjJ7db1>4G40cFjNEbQ z?yW9NK@t7hWjJ)4MJ5AwXQRfof~!gE;jfESIp;vhS>>$FH7z+A!IF;C=4_*9Z-Q~{ zTHuGjnrLqo71R3xjE!k^MdW!iEyL{i6h(&pnn5 zbW6TPr+Z9Ve%Ux*6$mh)xj(Hu?RMdV>^NFBogMc1-n7$nA-Ep3{i|Sst&Xg;MX%hd zC%TXq1ik5L9fnz^N6ry%_mCp}r@N~AHgecgScuk$y1ZZ*;w)~jfl(RZ=XFnijlWJW zEcMbqvdZjIGxuV?GNTl%=z%%KjuwXv7$zi&?ri=uPx}S-6C0Ap&wTc488M7gRhr#j zV92-g?K8Kn@q^j>fORG!gV_Z7r2?iv6$EbOaBttZh#rsTP*@;`O@Kc#sf4Lt9&c?w z+YKVOK*OUOY0X4*Y;~udq-II_5+2X-QHD#q7=v$ z^zzNIitHcS@RpYaX0>SFsz*s z#|_G(=IT|yKS=~6S17qFg=nT?LZ0w_Cxgu0_P=#3Bq49)MYK(ro^pC4?FH9nq+>lN zN61m?q%(e_+8dIUfL7AJMsOD3y8@|e@)@_vJ;0pHn63|Ho-^uG_=6Dbj1v|Nf+ zgeOK}S^4~lx93ihI+xY+$WEIz{A5IcB~SY(Ok3?gdW7XJ`v0|o7(zbK;E5vVp*AA)134 zOmJn16K>Qh&~D;o}hNQV2_#xr&h;@WJKFRNs}SZckO0 z`;NRfhH;7>sf0(Hc)yk7Y87}d?V+`dkM089qy-{&MmM-bs3tA-QMN<>?~HYQ79N*b7fJBQ0UfF_x2<%G)Y( zJp5jTx$BJyrw0EPQYqCtZQS?jT%l1~A)39iQWn&B(8ugT@>~fj>oC4xN<4|9Heaiq z%9_%Xnu+$rnn0RXc%6+^HXU$yr2UiENbn^<#30tDB+5%(X7zA_btT;|#Enh7*kE`4 z^@VJHl8*ZV-4tK3iK|b#L}}`R7Etd@i6#J!$t4&o>cpS*oSaH>9q*xd%u`ZRe>?(x zlee42HfX+8cAYZj5^!YixL>#HNk??3)J!m2-OA!l&iVdu?fR9(r8ku`VTz&SmSJ>M z>{RslBvc$MQWB9N+7jw`BBwWyO=@K#tTl=CaXlcbK@Z`njZG<)rx)o(#`#xP z)twBxR5frHw(lqA#4kA|S2l$uDnk!#e90kf6~Pl3&g!IVvYud40;R7=6)_;feY8*= zrYy2~aL&Qv6IH;HwJFTw&I>ARYhTZ>cJ z^VoPIC3IZk49%hcO4b@_cpjhh)dy@Km8V+~8q>zxSZiQFm6Qs8G~-)fv^5hk&mx8S z=!S`yrlB@sF+xKPrjZQ-xK-+ZfEPd|fHwdH#veF|f5pE5lmck^hfKtO!Xv;KP&iew z0h<2?U2x(5EW1KoFsgrIHH1|E87cq&Ny$}Qeg=;WE#21N`XpFrvr1#2|2SLdp^*;9 zPr**zbCN?Nw=)d2OLsL)*X^j*dryv}(!L;IV@K5))&g7F(6cITjXRl5*~R zcsT&w2RN!W2Tq$HJhgKyvx^Fo#D4VFdA<}mXUIWdpQE6kUxgO+Y-*1FaIMF!q8n+@ z&6Kc`61I`1Mf}30N&bVuFDtk@TFpv@#-~)8Ycp<6xG&rJGLc*cT?K;cSbqc!8pn*R ztopj`nw)|7fgR3lJ)%eTJ{M^`PGU`PZnSeSPUi_ySWiV@Ip%BG6Yl9aPX9>8FiOL{ zF85#S8>`e5CL0$ioHTL`kw&#YmoBR?n(ghn7G2bnqB&ajQW#Zo&2Rd2`yAK&4RpS^ zp7$~0C9tPs!o402{z5{+eBau56nJ>Sc4wpp5*}rrCxP=88O82xM1RyBYMM>UF8daj z{=2PpzSh5B-5P2jC3TGsO~;ImV$Vc)?+s^#uL%T9&j!8N`S?+M6#14%p5Y-xiTSA( z=ci2V#ywgfb%(bQJ>vXStnCf|qzY$=SJ#F{oVZE6g4NsEJkf+}D8jQ41iQm%)c})# z027x3!or-AM9$qVXue=?Pv1~w4G2tu+PWX3J~*Pyi%h;@I@_DS!|UQNj1qp+w6z}| zEmbl2=O($fWR)-XXNP(p(u=z%2A1zXPzgx3#KgxXcXKafq%@=6oWn$W;`CxlqBsb_b4WY(wewcVXAbK~R&kML8U_#)>wmv1w+8R!ZIw31eyQl3q^(_u#MTkuG z-l#Ke3@-n5&#Gw2>iFYLk$`jR&ZLi*{^JIgqMO#ocH)^ZXe!Eb2L3I$ssaN#SAR2q_6ni+ck9G|( zAw_KkAXJASRVTJBz`ts!lJ9S7OeYbXWi8Mjxpze#mL5EUQ`p%Z9INAEnIr?c-F+Pm zxMzD4`?U+sG6}8-eDEzBfd&(Ss$&A!tgOm6n>ZnB2fs`m^r)QDxRFE$&Y%0>6fn;qHw&*ysvF6|~?K_()rb@qpE8-rcj2Az%y0kiG5} z@xH43@)mgr=aOG>8Y4hf!G}D_(fzzI8h$MbS7pu>A=ujI+C48}vNe!zA>v7NbJ z#_S;(=MQ(|CZjYViP2Qz=RwxAs!v_%#NB=YzM!1+{8wnObrg zhO$*vyQERrbuS)_tr(dxy!zI7!pT|7xHgHHXg})_JyE};I;}1+mRP1od*9B!d*>i1 z?a9}tY4M*6LvIble7BP|^lbN%SRUIT4jbPomSQk5jNHWxaE_^wQ+;`7SL ztB-1?4%9#{whwELs5bMWBSW|6C4QJ3vutnkv!YTA7CPwB_wiu9$LbJRZdQE@z0EN8 zqkH>4z2{=Se?cM3)|vpBv^K)nJqW(l}ze*(ruK+@iPZ5GOWWv zoTg5`PkI_=dD{G|D}%Ckr>3+&2TBLJmXSsZedb z(9SY-HaFZF8+dk+b42?l2H(B5BS#5?Fw3EcfxD><*j;)*ZO+hz z<-FTpk@IvAo+cy_OV>-eK)S2*b3{)+|9nw|3?KXpzCiV(S2;iW!AHDPq(9q725gMP z0&!=A{#QbG_5|^C6R6_1E-21h{4Egs99Wg@E%++!MLO{kv(`l;I>UI()qFmfr2B{S z4VdS~Qhsmd6a6@{p8mBr(FcB*^23|jBtyPCdvS4z?n)D6WOmG|@RYb&0eSG+Z=9@^ zb&J%tLXXKHJiK>(#pO)piNIGrvHZP>x12JbQ1xTB!SSy(KO~g=j-8H2{QG#^R(zRv z8Q_FrT{O2tbOtlT?Po2XFc`maR~Gkvu^*>^Kmq3O0jrP-IrF55bp$i9=p1?5kQGO= z#6WrmFLMpmRuh922Z5&F?9Sve+>SZaHQ~*IPJvTCaq9Iwsgds}u3UsDA1Op#WM)lZ zBuDMUZy5SGS_qI$@h{n|UbRyhTYMr;ICvSRCH~&l^_bQOlz?ucI+#{t{X_o7O^S(! zWpM0GMe50hw0q}G{E)RhmQO11Jx3b>-i|LxbRe4dds%ajLMRjQtaTLoIfGN&uTgQS z#u|f3#fO?+FxQ0~VObB~4^8-`90H@w-SzZWK}1BReVO@oJCa0yYBBXAb&RFk?~A1ONZ2`94SpT7Lyluf*? zekU*#L!x<4G4xSg$ar=(zPN^83ic+8Y`&a?h9j#`n+M6DH12otP{0e?yo(O;iS!rU z#nQ$RcppZ|p5Bl2VxXS}OrJmxMGVKS(1QXR`i` z8?+kWkFg9v;K6n$*uapCVFFSoTo<};El;gd`q+WJNTBlT*l|H&5{5C}I4AI&g%0$d z$B^60u@BFM`bDz_mf>ZBJMn!q9amDKlt(|yJM23rwyx&jUMNoPWRkW|=)mPe3N`Ok z8RL7$`#KeKwfLX<5>PJaW;_62TUix2J(mPRvv?P@>if+@R_pz^{te`omu_!@!WYc) zmn&Fp%4|xL7fGrzC0(rfAI@&iKY9<+M5+Ft#08nov^9wjc+_Xe^}&E4HY zSDp6Hb&I)+O8)MJ{Q=1g`iRT<70JMd`1uSe#5~@vzDhiQI<&PsylKkwk{p z>wC04Wv@Kxe%bwPPD80t7eMMt=N-Gz9~qxj;cT^Lzw+&02H?)Lsx&VL%cthGh zkx308_%tbYKJE|z5b&M-7)#%w=ylc@cD3ZyJq+;+s(6mm>Oso8&CT_u(aaG?o_dy+ zpZzPz0@%(U0I(bYE7Yf%7)oo<+}VvYz5HIOB6atPI-FviqUn81=6r@^Ku6&KtjM&( z#N`@PS8nPWATlY8=}ceq^2t)(kAc$ykw6m-z2v7q3S&9TTA`kq(5E4|)$`dSNBHf# zWM9Gg8>EGHqq$pbw!}UG%whii!}H5tTUxwB775aYSL`5>&`046>$jcwH}?8b2tiT!GZ-+54n z?~=vJ#!@u!exOri07>=8{-$Ch$XKz$;)!4{<~!zvy2@E-!2?R<=|~ zsPH}&3^+W+K^J5rPCt4@xOQ!nNElJ-@*&g1TYt6zU9 zyM&lKoK4ENOxE>S6Vslc3whXU=N@DQkG&Tp=W9RDPF@GY^E~)mJsRjz4$#k96Tq$Q zE6GR1-0~%7MTbzA3{cDypFDqQ2!H!X2w}$Rhrn|*pl@IIY)RiPnl_!tma-L@=tEkjX`*EP=cyZoLjFaaS~X`!ijUlVkp{r}u-&Q7|hyN$zZ4X3ybp6hI1eSBfxJ-3bCQA#0=SMp8( zEj2rrY!ZT`UMxa0NUD_~GNpy8<4<-{Z$u`hBsH@><~rL4vPAtZY(`;;OS#n1aQ5PR z(^Ely4Doe_YuCItCq|M4#tRmey4FYOy=+NCucE}RHTC)n7^~4;{lvt{v1e`;w{~|! z4yPED0+SDiX>bMGC$_rHIADJQKgJCaa(On8&OCl>U?PXmrxSs^_<;0RCp0+CeLjYM zs4MqO>U$q2eA;KR!gRYMUPO)DUgJ@yZ9qqbXVUzUn%Sr+XZS8V-@Q%x9w7TEbrS1Xc<}Z{yctC z%#0&D$oTx~r-6Zi3&!Pxwxz{#!BzVMCp_?5KKkPM!xCJkvzYnm?ZV>BXO_!W`SI4t z`=89Sb!=mzN3XJ($wxD3d;=aK>@JB19T*ap{L1_pzEV=2sLe*^MNK z*&&*BRe~djeX2H{*b9+X zxnrHC6HWzVIA>rC#z)`s6uNT*ImiGYbiP1y1%o`$WMxAR)T$u>;^zspGyVDKPr&c5 zM?gj9>QO`*(4!?u^cR5lf4sTjKXZabjMgnd3nB_x4er%F{v6HuP$i@Jl}5Dcedb7GeFPoUdvmC-zQhca3la60Dys$U z&+#%(I3`X5aF>^^ss)#BQJM3F(Ecqw5rxM4IXQWSNd*$Gs_-(YFs>-5@jm?$Q2A~{ zL96_x^^#rli;JCI;Ipa+W|tS7r83vu&d(O9rS|5!>_(95z`3`=NPFp)7beRZpC7$D zOJRy6f6!kktjjX#L52^*4v*Nzja;5}7@L|1(KyskBuze{A%`+O-)903b zYo7YE=VusMT^k6EefD+n6CY~;`7`0$%SAwU6yTwNB5I_ew8;B#L;!Jh3q-zjNbeL_ zh{1;RBwxoEJ~t`VZm0=n3L$^Se8HTOOm7EI#$ud-YG^yuSf&Or|AKk~MF`GcJ@$`? zzRHx_9XyC`LT#maZClpkS$^2vEdzL*|K55C(H*-5Ccbil#D|TMX_>_XTo6cMuDrMa z;7}hw>!i4EoJF<}63U8>2pxick}u>m;`D^y7U^BC%r4e_V{41WNLy{HnNt2_)nYed zw1XEF7B0GE)BS`h1x^z#gzh|jJZ3YJF!- zo8G@?BekETyqRvlxsFPD>$oe`TRvje;GMU3K6}2K{#3m2H{I6s_w~$R4zpheBP!cq z;jc!aM_=m~b#M1A6#MLoowGbo6{xZ`mR06DT9EL%S1ot>yZb9*=OmP5|8#<>v__tQ z_}#Uc)7@b(0Bl!tp4#sHXiN3IKP_>-IHvIH3k z;~(#*>2G-VwpIaL?Q^*oowtAZ#61r96&nTc{xt9@{(1GiXW*yR>U%!!JzHt7+sQ;q z|9BN`;^h|k%JhwX)alAB#}RsL%bOOmB!O+%d(BYqfibT1+8_@wF(U?}b+#`C-6|R7 zO^Z;sq}DhON=#sz4g)rd97i;cta`J^HP6pts||haA>$2hrzNS|(RccXr!f=DAJ{rr zKO)9zp1Uq99vm4xFYrA)H0<9y+ea(7Y)Ki}5BC*v3L1uQ;}vF9Mm5Fk{h~_O{r>NhTq6wcB=HW#G)AIss`ePR+1VU6 z5YpeV^9{l%-!4`stMiAM!)=8Bs|5+ZwE5Sq+pyF5G(1s0@Z9Fi>}*s3MQg>uK;KRJQ2J*It`(Pp3}Y$QwR^#i;? z$&V(4hve_s#_z6rb1W-1iHGLmW&QzWd3+NngZz+7S#WXcu%DMGJq)jMu=)xh00Fb` zJ=N(00`Mji8Ty;NtccA9Oo@*b-mMFk12+ypw<>INp29(HcYQwl#? zo}@tIX*2JHgJ3kW`%YHcScmOn_RWp!Y;esLQfgW0F#ExPg@yFdq_%awasu1nV1- zo7O$4Fn1HgO!+*Cs2AvSJ6kkd;P?Hg>3*k)YUS2SB%thKAWK|VqEtr}f9F-z?AP@v z9m#`d6Vy7dX13=DhY10RzbncL^s$01atFIeCR8LIgo8kb(IC%x-W`VDB-n(L>iKeP z66M?t=|t{_@Qo}Czha0dQ#C7dji6lUBcNr0rp#!0AdCqqvq6Xsag90oIH%7}I30%O z)(ZJtCl0exB}`PPHg**M6lflvM8G`DF8ikz@hXx}Wt*_w_mUD2Nbn2oyC!bYm!u&A zZ~5?Ss$pD5kN^*c!-_@mn!Y9MwrQdY9)Es9wsI2@zSVrMD->fDIv^9nqghS;zCvV0 zN6;>PkVRae2WUQQ6=(VIrdzaS_@hhQLRe3K8(eT+&B*wEib&MWwEGTDwXf58`6_>{ zrp#^MKpwn-D=RB4s78#HaB3>Hm$Xxfh9p-^#?&=Y3EJ;JxuK;U<0*&75apO#XUYFz z((4QN93yjPueTcfL5y-$QxWG?wL4N3kFi3%`VPH!0B4oa>8FhAg-W>Ok_f; zTa#@sOw8Y`_8dzaL)MTPJF-)(a4f4UfWUG=RiS+TdkP{scf*8DrC_V1i8=R7F~qaY z$#f+3Q*u$Eo5`&YV%ec~(B9qTG^-jdn$}srK8`4kF-sRxm>6RO*Pw*->(yfpDr0iq zdVYZ>NgK__8Vew>McF`DDtwhv(&l|xU6@fjMg3i;!=mhOUJ@2Jr<=2ny?9Hg9{#Dr zP2^KzvfRs>qV9^aGNxPfiXmIsXH8@w6n%`62lWUK;b`=2_am zWtWcjlCT@#lg0?x-JX;17YD;zye5p+MN_Z(R`mkkvN#7V9`_waZSlof-DR6k@dlaw z9OC^>0G=G{A-yUm|Iod0J#t2&le2ldQ=v<1mI94c2+_%ol?(lYhrK^>#sx;0VYF05 z{mJ&eH)B-`RMM(c#jBPO_82SJ9V80Wh&?w1+&k6;oO%VX3{lvju*;Wan!GiEy^wA8 zD%uSBhfkTrOfmc}GA|H|%JA}st04U10TxA*Ht5;xCc8(k&}TAtEBSmucX~2>iFnK( zeOm*$_|c{uJQfRR@704}ZY1a!MX@ixZU9E_?vJ@g>*F=^<#*&Tm532mb4Wq0f1P2J zbhUrx^EhIJzd5KWQa>_e#LX?9TQTIukkI&5)&KR`qQh+L6d+VZ_t&$aEzfm<^7g)x zzR?l|k*APgk5r()HT5IUyXxSa!I1i?6!(ta+c0i^PRZ+9$!@>t1&LjkWU7zZ4n1}M ziE-MkKR*U2v$ZKI|7Tn1zayWkn+<>6X82dB9KgN*ch;M@dhWU;k!7?{C{qwCT1e=T z2S))=#~Z*%yIRne-n9G>5+4t`23z7)#lF-rB(*2J&O}8G2C8MBRD4+-r;2V-$`C zxN^HzthcF=5FARyK4HdjiK#{fvPlA=_S5g)cSWeLC-86cXS>$LMb zR!Z%}KmwWn;0my?^0Zq-k`;2vtF#%n<>VB;bpD(qzPFR$DYOhUK!kIfG=0dVQv$k2 zRf3=YD>%N&wXW{7050t+oBG#<7l!}3WAazy#Q(eiSb)E;vHX1j1+R58|7lGs&7kspV08T1^vtlLGDLTzZT(wYx%|QK!6kel`HWg{ j{q-Z(Pae2;_;*yo%LiUeB>>lz@YGebAAG%U9`OGFbqQNa literal 0 HcmV?d00001 diff --git a/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image02.png b/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image02.png new file mode 100644 index 0000000000000000000000000000000000000000..dfd14d7cdc9943c158cf5b380dd5d07b1beb4409 GIT binary patch literal 30770 zcmb@tc|4Tu|2KS&HH6BRy@hNc>rjJG$~rWbVo(VoV;Hh8QB*?N#@5I>hKwSNeM*tN ztYsb9$-eK;IbGlHbzQ&bx$o!x=YGA;!JLl$_#B_@{XU)<8(m{%=3@o`fK~VUl^Xy+ zg9ZS|=OYZ@n~FC))&StWt$Rh&)TjSLXRdH^Duv_~hH7@{7@Km^JP)0|t;iJj^3@cR zo6y)zB~!Ipw_EF5jefgT){!|if5JcofRX2-kztk$}ufbxn3;aBXku;Ae; zp5gS`lksQf<05WcQt;m`?&zbd%wEjsxe1;^p7!;Pt*PDc?_uh^Be;r{`LIN zk`VNf|M>s{TK{_fM@_Jm|J#*s^(5kL6)kLoU9ul8sHLrssRsNi`sh7JBB=w&+L(G7JI{H_7WOx+@#^R68AQ!+;YFx z_n^FExmev|LVTc+mYl)BXD&aywuN0}JT(R7nNt|rsyf)$NTP?zT&glC_1m9MlroXf zeOzuf+FPdIH;64;*HYq5)-Fv!uV_-&buvMNMe;0sLG{O*GAtccsruE3AdUwG9ioN&7T=%Ks0c>Xc5OmwC@Z=Ovgte@LTWtMG}?o5 zn`=YbeRYOX+Ig^TR-Ai<4G?Vo-mqwSp+|ff*NZQKv8Eqd4x9IEJh%Lulr2= z?Lo)cfj-vYdDNme2Hu4#gRz2OovhQ=is)=>3)Z?U~#Ga2jn}FXN<~7^ee;!RXQg^R?$sXU=%{4cr zx^G+Cd1$TPRkreUcL1B%6p7L}5~BZt&P+bs`S`)q?36|9l17|~KsFO)k1jJ?bjd@f zf;2+DeY-r)@@RK6PtSRxWrD53jm(yflZ*gcNXui-5({5$#V3uc;y<^nrJcDDcaObn zQW#xMw>)R-WaVp`AU-7~s)&7&BF|vdn5}n08Vzn!Q>l>4VDe#wqzH}jp~A%R1g|OD z;5|aX*j}#d#Bq&lO<~T3k$#tT2bRe+0G9NqPfs$a?|vofq$umh1X`84rd!W+o(#Gc z>^ocAnuJyK=uK7L9`fr~eqcaH7PSsl&`h%I{bVg!>%G?;*<7nHv|`FhuIP<;m;Py2 zf6Dq%>Ir_Xvw%!`wz={ILn-pwy1)}Pj&|)@c7dm=bxh3lK{x8P5r{G9yBk#!ti-Bv6l%nm?p+7`?<-kNWv_Lee}C-DU2ojjVPrI|L1! z-EjWixK6^B>Z`i}}0rVw< zdzBcX!UjNgifVk`Zc1=36>qr~s$3eR&$b1&e^4Zs?|1C_K>is~_?M5Fd;IDQu2OaG zg#anwRRG77#1vOlBm!q*_qf*r=dOBIkX#|>iL!c>S)Cv=lDBg9FkgNm+HkBgIfXH# zrE*WE<=q|);heqbaf|8wUWK}fTh&P1{N%cg+#<$su!|7la)wT{tH{&}dz$d?`MH+T~xG4o|U z<%oCdXM)48?psG*XPJzhqsMSL$?LV5jl)GDsIma34$`cO3%WY@*_=cofPZ3AB|Ua3VYwz2Ph(fi6?ERM+J}e;I+YPb6)xzB{3H29{7#uW&RHR(>p@!}3q$Je zV$o=5=8L(n85|BP#ekz%nSFj|?V+*QA+ap(E-@Kk8(BY5dm1d}Qa zH|zG;c#hhe!PUzKjtZ-(+qHG;Lcr+^B+&rI$ijU}nZwa9XNO zhF|-@DO`p3O4; z5SA5FCST?W6*y~$0j~KZ*-5KvsFblnMI4{M|0PJl^`Ti6Kq{8Nrl{3@Mu?Zg@y^d* z8MJa>=|T{=er=pqMLVKOJ`OKWgT4k2I?Sxyi zrIMng^i6^*wyCv*q5!2W6xHA->}*OMg>ezDPrD_|B(|I72A18k z3Y_{nYDa5(UGL(GE+Q7YYU)yb6dXulLi4-kx@J3-j<0UgKk<7%I$i0VgLg}d7=87M z?sd%pQn?l>vVjBy5I$4ZGyc6qDnE3jYj_00O15XB+VtDjQwD_c&_v0Soy?Fm!|e-Vt6srPI_QDv_Juk}-^%f^Zh}%8T5f zr&41pk%?C!X#wMj(8Rq@7YMyCf)6&lQ+`YQRov^a0U8#(zjvG-?YCo6`>oDoX&fw% ztaJ_Bf8$tm9X_p4`ZdQz*8(?>Sq7+e1jtN@2gJFN)Y&iIS7_3h4?e8i`p9ZcuZRq@ zkp3(k_ucez{eUw+mrY^$uMMyFjahc+b1zNy?DYBsq!p%Z|LV5lv;2eUyqh6$jN_^a zUcOp|Z8EAg#Z%V-qtNrNh?^I(A><0z39)^t;O&H>24JD`Nx5SG4#l52gqGsLif%z! zbNFa+MXH2!eWRb?#b)iDW^v}7>zx;F+mxB+9nbq17Jdyi2jl9~DrCl1pImtF5yd`3 zflGVs2(Czi5@ioM8};7OHpJUIP?To8!T8Q^v!`Z1%uXeE#)lwdzg@KKb1mqveKBRp zJXq!)XViRKa(t)mz}2Xn1FS7dPw~W~1bIiIcJwaFjEYxmah-bfhE~N@ zDqVg5bEKoyuYis#q8b(%v21tg8%f3ot% zK7aX%%Ossl&D7aV??Sf&`5uQo*Y)7Qh`19*rmWW()~gKHiw?NOE3e?S7CBK~RLRc< z(h5S3{4zBU4C(UFwDd8Emb^G?ZWg=3c!gyR+4-$(C1z2ql>B59i#nRdZ!3AI_~p;I z=|V8RN7Fm!yvY&7MpuDj9RLmCc##OQEx=A4I)Hh$r**o;q z-BuwpB_S>HgU6z0!`)wUE0tYK-yV>ZYdT+>iR0!vHtX{#wgS1bqQTA&fV&$@hhA{A z7=8`Ud~;pM^y+o{i^#GeN0e3R`N#X&%w~ux;{@afjnWJM853s+g1*r!X9wWfc+Ku) zVt0K#xvsGG>~BJz4ns||@$U0b`3bm^a^8t?q3V~J;ZgwTgEv5oJgf=M&oEF_kItt_ zw35(fc8V>Ay`1dSYWRch0C00O5WS$}7}3a@clAuQx^*6aR0q=L^b*nq$P#jo-DaH& z5iKbJB8S`Xl5Hk&=e?BLv#9G@oa82#{`AV%(^~YD6($N29_0~AE8TZCJMn&SRr60w z*eD~o%)Xn#TPA(Zm7sX{3GxRW)6zcnNwsa;GNFL9oCk_W-y|?aF-WiCFK4b|E|mIa zIU>r-WgaDqrnh{P<26*KXW-m}VQO&YKQK}y_7!AH{?h)!0Fwt9Nbub!?()FP~Pi7wX*QM2+l>G*M!JllbmM6SVpDV0bf(q z8@`2v)pRg3gKTIWWw^3y_)(H_fPm@ANREd}G^HOk)x8RTk^jvl*;(Cv!1;9^-q?)g zdFr$&I*r{}GtOIj0CO$U@5Pxx-Xlc>?7o9TC zIaLf0v`@a1YJP=rPA_bQ??0X`=+lDotPK|ZJN5FPS4Tp$|2(vmKiL#&ssH77@a_Mp z$iM#oS4WLrU`V4*J6KZp!^Qk`q|F==Hc&g6A?6rY340_Oepa9vPG zn)iWkZr{}!gPG6E4hubfNj=^}t{V%gRO2}1H=E2;x73Y<^@zX?-{C9+%YE%Tj)S8; z3%CD_uwcaXSM9O_L^a6Za@L`f`P-Xz%#1uK%@vr|$wp|3T7+}kGU8gB@WEUdoAm22 zuDQhIPp9c~J%%f$CVw8zt zf;pJdh2lX9VGZZEk?{Hv{+yAZn@+Tlz4FN6({0ef1^$#3-v0KM)HNvq>sf&*S@}9Y z{fX{ySUq^JL5to#ik@2>zPGcsXxEFfv>(>kH;RCU7OkiDrKr=&IQ3S%GD$3~QBuJV z1RaO~eGmw0zhlAmVZ}$p^2HV5h}PJFBIrH~Ly}r)9Rua!DRQAL9`t+r&%xEen3SI^ zcxmq%;$l!}a&SFtb@y;xNaqOGLT8hml^4o%m5`T)ax|VHKvG`nwhF$G!=b-y z%I`Z%@h?jGSpU3r)@%+SvC*J4aVZys;H6HulsgU`1cQ4n0sv1&O-J3GowYeT-0-f5 z&Jm}@(W$V0gWUGEdbs-S9d?1+Y{EXmAuf$Txp&9M7m55ZE@{#HC(w3i0@eb8o)@5m z!g|tS38kR7jKyyR17uNNisvIgYtIbTy#d;jr$t`J+0+EbFJrRaAE9xG8U-l*!eqgN zbvJ{e;JGLG;%UMhs-pM&Ee{r;&j@0~Wy4zAh`7~`2;4m<35TFh`*7Gt4$FP2$eq^6 zvrT=Sihro#z`!mTdlCbnlf%jnp6oB1vcYm9!WED4hq%}RVm^o>dR(&!j!#}u&X+l4 zRnh0VT<+8Fl+mlMK`3WuVY!KkE`aoq4(&I45VEh288ZcL?7~wP!NR)kYNJK4|BW??wFj0FJHNTSS8DdnYuSOI86ZU@eTtV zT*Yk`^sa4C6>;$BX9UwyJnqxL9$6WX>43<5MT9jWo;4u?G3j`KbTJ`XDogjGj^EKs z15-NIgaoWL6L~_8?Bq-fOE?O5T9As;Ze71p2Oy=?%q|{>i%P@WDwsoBM9K5p6PgNz zcQ2lM>N~4ba%1XORYcTDhiHL|5c0%nvXlHzr;^-X8Faq+JJF&JV+~*s2csvQf?Ho? zWd|E!6~=YJdPX6{yMFdd%&afaM8)qYVtbU0SMm5x4uBM*L4L_8Su*_u%PCiy4om`& zLExJgsy>p>d}qHKdilE@CyWM)VO5Kgp`I!iV^}=!*v@Zj-R!Y=>G9@E>k}yz!NyJ}NB(w5gl=MlV zJ9}kqK1L{I6_ce&;Odg4rK}vGgtH1i!k?IxP;0$Vd`|?xIs(wQJ|Z|h51gN!_XSRt zkd}?dPs1YRG*g(4bGQp=KL^K3L;CnddkG$@mP4>USo&y7eWhYJ7#Vy5hkqUpnv!lz zolje9&7`xzvD2(aUi-V6$qTWkUr-mr%mZlYweC++%f_K%xveg}^B0Z1Hxq!8#a z%f_9n-CImx04m5$Q9N)Rh_jN@Y9-M`VRb*ff4em!sLE>#kW0x3=ty$XpNR*pT9!N< z@&jbx04O<^f}$g0aroZBZfs? zs+Oet#{sMuHTXQAz`v~}w1f#yk4zgGl-J;KN)21A;hVWC9m$W+4akG#dLdD*EwIwL z<+O1E8w*-A>zra0`NI|GUp<%gxyGqlXk^Y;b7{Kd#20qI^`q)>l2dI=i8Dzbh;;_( z1!WogGm8gdJM@RnBZqsh-Jk$Wth{3mb?an6FebX<-lyreX{ovDUyZ%C0{|Iz5aehj zDa%4rI^J3=3ey)w#KILB8oaXNJI=F=2V~9AuN5UWDWH;v%cVx{(-=!%TC^HDTAgWc zDTYEuoxt{XU2IcZ$oA1=D!RJ?9tv<5o2HjtZBV8}r7tf+uH$Y%tNf)C4jyjnbY9#U zm`HkM7XkfxHB@fuYPmrWf{jHxZ9`U8s$2rDt=}5`TM&cdz~T1 z5LW0e^Kdr$%(Ma}wnT|1IGH(U(=F)ieOHXm$_OTJy}n^X`7=oWWk|bMT>it%&?2JQh~nsY_WO(Km9p-1KVu#yyV|(7oxdlnD zK%0=}nc-}FpY*Z<(mN_+s+l~;2cjpUTv1*u-Wkps`9ssT28`-)XM#nI=yGJnaLPwRT93x z?rnR49>9K)>5d5=*nqZFem<>`7c#5MUwTxW=`qBJ>H3qAs7vUfg8coeM0!U)Y#!ZH z8jWCqM4~g!HbP;&$3jH<0ZSXCq>i>NJKn zc+AHfx{GsZ3g0UcuU^(+iqS`CeRrH?^D5=++n)hi-JJCMlq50JyNb0L6{Y-|cQAM% zC#jm1N&Q@p4J7p>qQ<|<-I9Rnomp@)_H7wjn|O`h%uk$Cz&;fb<@Ie1ekYE)#R(`m z!kju`IT$(D2Jrm;QRuhCp$njm)*CAuS~FeI@|k{g*+ANH6gkeWv}D!)sbx>%{hpTy z^hF*4r`L+es|%77^UbfPNxScR_}wD;m|SkEq}=KpY&GeYPg@jdwE^Vz_{=j2sE=e2 z+oj1zEy7>|k`t#Fgxk4lXtZJ)K~Dm+DM_v|ZjDFe;2q~2!sn{YQ@{idXej|oKK49x z;Gz19h!ejhN`DmDl!8Gu2ekpWqhJe`rILU89_)fw-=AzxjX8eTd8Wy?aqtSp=aBJF z-xP`Afu#Fzv-a0^8+$9K{@4VcS?A%OueV@kmWh9C*1~4vVQhj}z={bU=2g5{0GR7) z)h!0q!8AcLYzZ`)W-2PsAR3D0C_!t56ZG~X(^wX^(uY4DmBal0TvI3GLaROU!%i~S z0(1sw(5T^jBo_2w4=?w8{hsy5beH(f)|W3E-&pM~vTePEoBak*6GRU6`}}fRrs)Tj z_H8M9<%Z|9h_&Az_}>=;u-Aa{yFZ5<>g(s0jcGuWFO=_ADHzhC08YJo(*I9OQ9Y_H z2thtdwD9&zRJUU3I#L;4;9K1xx{pbGK=pQ>qq?v7Igcm3Qsu?dlI_U|&#ZF_@cjv> zm#_2Xc34ja#3;Wqpw@R53%?Vd#1j!=dpS+IaD+5`zRC+kZ5^qY0Z|UFcBmqx_Y%M6 z@cfy59LD?{Ksq{3n8J~@bz2ad!*PFHwgpP>plD@ZB<*EPCGgJOBCZ z-v-Kcn4kFrVcRhtx6YZKTjizbHBOe5+Hd4&D6?z4=VccqBlOT8UD`cv3T4Z2@KkEf{vRb_8~OP2~QIM?$pf8;#``v_GGut+`gLTBPDM zUl6o*prNLo-XbsOc~jSh7U{k`J?QUzS+lp975Cgi*Gad1GH6u^1iz~pRE9V_76=El z%cdt*x(9Yoyuybc6^`={kvbW_+n;gH;Jly)MB%eR(#?y$4<1gg^D2J*9X#_oEs;L( zFn$I*p+sgCP*L2(`K{0+EE|>{BmMLiv(x-1;2t*IHvTi#3Kg01MG(~O(Qo(02~17?AJ0@pVOt)V&gNf`9w=9xC_@b#ob+V&s_gu~O9Ht4t5pz@jX%NFJ-JyHuz zzN$W+EeeyBspjKKh80^O5(bkNY~CtUm|41tIAaGw;cR$JY}ulPTMg#E(Z!=)H&2 z$fsOQvLw>gf1WS2Nq#DiHXLGIdF5!+R!cPdCd5Ct>-ME~-0jR*`;ezgb;!PVe~Qg9<&CzCdE z!YttCzxHwT~fAtZZYjyIcJ(HBc>6t3E5&XKiO7DU+JI35Z3> zBqyDR57jhrvI#xK_kTmQ^qyyJm=a+c#szs4CErq&U4+OibtgTZAfyiqSC4SROTp03 z#^Q8-3xZu#46ar+X0Mnmvolw%g}D5yrP{?1PIzs5m7YZ74KzA$)6S`|7woUH7U zpR8Q?N#N36;}z@G%*@fr9`D0$8DN1&w)ReQi^I7VM3Hke>AjC+{h$28$5ifoH)P_f z*jW2=_siqFpwI#fGc|7Gp3zr9B__GlO=ofmvUdkPly1>m-t*{iUHiUpasEkjzTb)Aj~LmB;$ohvKU;mIQf})Pm%xlw`ZSU zD?-^jW_#vZe>b;)5%DXp%g`V3MtqLVj)|gLcIRHmYfSfa8Hjfr$QhY0oCr8xpmG@adu`~)EzK>k|o z{(ktj1>v3g6FW+noFYiIhWmpN8pFLm=-^D#5M$fZ<6|fM5qiaI`DvBArkM@*$HV9* zQ=s!t>gyDeB^yDgaE36&p7N@`@t4G2ycygnsDo#?H4Pt2gC3WFC6vI-R1~vt%_?Nw zIbpvu7p~oKQAx_$zdoh6)Z6c*9eWhr*`eG=cPs+Ggh=(Do$xl$w9a&z=Va7npkk)1 zAXaHF3+HlBry`~me9UDbrlHJ?Ff4xW)1sqh>p7B2386s#q+R)D=$A0BL9D7+dOhyK^bOGP1&c zPAqcFrt9;vzuqv4%WYZ!);KP4`sX9;rRC!(Ng(aAUXwQ^R%<#}+?yX30b=N}JM)3hA zwSd4U#P%704RZ=$(*QH6qaXxzhYg6vJWU6gY)S5d)Md^KC;~Pdn(c*%)wUY2){s|PT9wAtQNl2Ie zZx%*&rH+MuXZ8K9Jh{VN!N>hbH{rK(kwGhV3W2?EUl_hg;tYucQw~R!>-;9~tR4mi zJf4dx&OBQe)Or3UIw$#t`>h680%yqX891w4X;oR$ArCy`{LFMw`UMsq(_|-Xdpihp zGoV4X2)@F3m}~NIZ*u^7KAxk-w5sVSue|u#$?G&^>);kahmT6wyI7|j^ zWGLRay>#klo91RGow?5F&=SJ3rH>Be&Ih)T%CZK9o7C_ZU@qz+5uVBMVwi zYxf?r$#rbGhnmS5&-u)PFvxE(`HCS{HwgIo^7nCwYDE@R757jf-~FX)HLZ?^>*sjr zMYV)q2mEZ^Z_2D@AhG!G10Xa#9egmVv^us8rMB9=dj{+}0iVx}O!p7rS15bT5_%%1 zlPL$Z!W??n(1IqJiuoVTgHFI8$%G0WM+s`EZvs%eNmCG3j{oBY$y9ls={qi}m%?^B z9YV~^Oq+XpBF9M~m-auzM?ioo9n_rn-$cm2Uj5CV1lSlGiSkkJuB5DJOjNY?fNK2qWsk$@uuN@#E#gk9dUC z9R-IL>+LNj25cSoXXiToKI=ASdzD5-Ll@TVO=^1{%E$)pe9xeisEkbGGDm30UbjOK zqbZ8DKRgc`G?GO7+L@SN94xH#6s6G%@n$Uu-EDYr9+vtt+eTxLr)yrglA*=A`1?cD z_HW)XgO0_`3)Xc9r3@kFFjCA+;P=fAB7SjhaN8|((a1ZkA2t5&;G-W;z^2t?x|5-P8$;X@By95!^=USGOnkRu8^&vi=r~H#2)WPP_d@H1?fE znysnMz6b9FS7BC%SJ>u0L4Lk>&VQLbY#%B*`Zd+kqLH)QsC#+#)EJek;S<7_0bzfYmUGeDN{`UT} zk`@SN&{0gkni|)adU2iN@_$<>1? z$=#rwv+Yu$5(y^Q_{{1vMLQ#-d%PQ=C)yJd;yQ&2EE`ORC!RC_GP6EC&P5_Qhf>FN z%$~3LZUs=mP)xSGNC=As4V?!4zRUvvZ6a+gIp+M{Lls`j?0;u3=_BOAHVCdh-pfqm z@lMNsyp6+frRE9cs*FhTNR~TUm1avVJ}Ebwd$TGC^gV(Y-OkZEVKz-~I0G2P`g(G} zz2kU}63l;DmS)Dr7UVPv;^&6fHR3XQ40}vNy4>8;=MLq=6-tA%&~=Q|!ywP82^~Ry zA)B2-M&3-bNb5tkU2K+GI44{8)yn|=PwWb_A+z!w=mCwWgus?ZEp7Wx_v?5 zUTJvR-j^gh`EORN#)KPg%}t-oTu}!4K7w}tdX7~im!e6X!5PA3f|EsqM`Hpl+=F6G@5I7C)bK+&7|}96ryUme2)$}k5~V&(k%ofay(dCAvS)qvWzH0i?cU^i z>&e6pt_fcpZAn8VWyr4DZhdv{ks9C>#+5YFmNnJI=o%75MzeK*S_^0#H zs+fH>o$;u#C7OIJdMcsuL`n}pGBS`zsIO>EM8*w>d6ZUg!R_t9C2)hn-G{D?x~u5{ zlH-!u?zHMzCzAOck8M^BF6+@43YMp54=#E%m>0XZEmO}*=V_*(oKu3w2nIV72q9zp zhB~=MNZQB^9wGfKlt6;re9`-ez!X~a!E&?Jj?wmyh%1n{=>lFdD>XSlh&}^Z$xF>b zhu&4PB)@g5@a_!IzNzVRG_A~pO&4lDfb~nGvow*8sEz317?1urAzinu86`?AwGJ*A z{Twwx1$uwbOfmO6s| z@{{?!CzObWyT+aFg^%5>i>Y(y<|{{$-K{kbw2#(Wn5vgrZ+%Qt3BlM+eCQw%PYOn! zcaIA-7&Zt@ix-jT#<4RhMS0u{8$I#w6<6M@BD&*Tq`@lC zK}{wDE}2pWd3JCC`WeIMr1M{1Gu$3$*t=HRErHDw?eB1R2k^bl!F$eWVo2?lYs8fw;ES9h+$yqvU6S+jPoeJCA-B71hgm^6(LqtZ@WOnovPnL6D5vAF_vXp)01oV7HAz;)vksENIU78+1E{OW9;>$b= z??}e6wg0NLoKQXd_~rtc&`I16w<6c$zWLD*JWGW0u(~*xW`P%N5S590`$3v%lXbLU zuNa&N;+OF+69`vzg;vsngsH~p<0^GgQRyh*C9AT%1p%@7toNY=?xRpfbGub@B`(UK z+Y&1qXnzV{HCLW8veyghWVKdDTd&WAT$g6D94SR!^}X7X)!-4Hv+QIj-IYwI(s#Gh z#*!HzjlYmhh(Z3m!MoXLi07BWOL%>VlKeeNgzNfV-TqSan*3y9nsh|9PlX38KAZ>Xl;6rp_&S5*XDsu;3gbwpptq}Tv?kw%rHWjzk-&HPjrY3@yQ zoBd?&r66ZZD;$OuePg|t%VB7CuA)pFzw~foP!eOu080RwVBCEZgiW2vRsvMoPyhP{($w+4 zgy`>||KZF0&6@c)Tb%03|LwPffBaYC{{Je^0zmnGGPcbNDh);Cw#jKnBqX`##I~-ZB1(bwrLJ}rn z#@2f*Nn_J*73AWz9$<&%f_)C{9`p4qpA`l$gX5f-8MsnYEe=`*)R+4} z9Cf8TXT?+l_QZ0I@cb<`k`<2ujG$q@EQv`UuhzGfT(X&LcqX5@8MFU$u;gHB@>ear z!%WKVMNW{op@!4io&kg83>bvO!*(chKYt`(#BT7EN$ND1tiOwTTibP%SMJ=HG@~w^ zif_IK$O2y=B)IsNS$hnisMgFNX<=TW*#5>ZG0yCnXc8PssJLy2-k^p13A=m1o`ilAg$$y=rM}& zgP%^QLYps9Y@%9oy(r~^#eo!16D%eQI!NHO=D+?KJe`VK^<@ioz2~Ofj@EJ-ppyAj zTmWi{M11}v7+97nYk2DO^4vRV;@4IKOAf5r}q;`~Og7l_eJ5*l$a0Uv4|tX!Ae^fwAz zV+0TEO3DXz3!tH{fl6K)elfYd!3#V^UQh9pE4-Bc5<^+U_P0{V?pGKNp?O_x2J<)V*ExDRg5WWeCVr+}NHw zh;qXrmT!W{R&H?JC+^)3IRmq-LS4;{$+E%QEstb%*o0jUHe77oy3dBH`MNK?8J%QQ z^QW&PsA>4nQ13HN2$GpzdS-3hk;VdIR|V~m`h(QF2vk-vV<9K%@(Pu$ji}jTqtZv2 z$b{P2(DYsz!BkTlM;JJ5^{N1vYxbnUIwF(~qG)`c{ATc-oWZEylsMM!z zAjh)GdEEJUmtzo?U|IL!!I;_rAAs~3K)cx50p945l@*;( zGR1Igiq`lfMG<+~-a4I7y;Ep4ORPqXN`I6uEE%sHxLe*+XJTDOWHD_#4cFN|M~pp7 zE~pGRP~BwSSN@Cmr+`6K0BI5 zX4@6y-D;|)Yi#aN+!);@SKAc|7JnRzcPuYl%`f|2)?XCPPU4?J@lO99TvQfr;XQlw7Q@PyW#Xpp#?GlgCT_Ts^-1g81=Ud+# zO`1;SvzWn0W_H&Fck1e7KfW31*{NaiW2nne(;x%n2}W{7@m%GNzz{^F$4Qdn(aSBb z9Y0As9hB{`jWC85ymQ;*CN03FcapXl>pJ|hEK}y|g{;AwvSKk)dMm|4EnVCy!xGcy|&Y&H&b1(D_y4vW* z)E9O%|M%CrcErMu^@`e(z8Jr24?94jEOkVoKzs0P7bMO9OdFhrk5l>^$5*HGMm`~> zF0TY^#}wCnHg6iYAL?0rBrn#3U>P5%fO`uJVewCn1Y z$0yQ>p2TLypIo~gT6VmZz>k=#j5s-1)^9X0cQ`6zq4D!b!`^~zo=Df+fiVe69^NLVi-1#8rLDo-9Uax?LSNGm%o%-~*PSu<5QOOblH*SOMExA-- zHy>2=>wqp;c`)`T$tx^b8B@s%BmHKI1iYOrY8U*GmR-@!?jC=H|%W98s?B z&~_2>;Perx*RbB!x;r+J9Z{Ckk`5M0Ke0BizV`mtyOZgF<-E59`%{1~2A;Uh@`o&I zUT*L@HNr(maetRxF=7*Bz=Ap-TvBS{=-i_#MJ%%N5yAezZ5G|BY>-!Gzc=`MdmWPt zvH`;0hyODk;?JetVDjaX&8Q*3imrNHxLfxABbUg1jr9UP1=9VScTfG7zum$CpJCFa zNLz+Q@RagatMTv3?1hRB-YT2v!Ur#LUZASyzqsU)3Arpza|<5>z~4<96$IZ& zIfSaC%)bis;%tSE4j%*FUWEzz<@Fk*s)>q?s6F^`1T+4P>7Urln<$xU>wxp0=M9n8 z;!5ZW>$^Sis|xDoPd;C<09va5258<31KiAvTo4yIH>+9pH2(< zz>8@PV~M*!*%4`LGgoDG54aIX3Z0Suixm1_!6*6sVSI{-k-6mY_+ zUABLsK6|yaYu(&#EiP$Mv`8V#Iu~23Jw}gfu$4}eFsg@EHyIE2LqK6<`bQYmmBSdz z_c`)b-I5&h7jJe_6d27+fKBhEkV@M_o5R zEO81tA78bi&^ZvFNV8EsAf-`v#H$w)pM2cR%P~A9{#t>nar}L5?#8R?-&(BE_}fSR z5y#!FNT$0b7t&LN6w!sYI~IiwJFvkglHV}Wws%6T>U>?tPpXs?0hzrTzon1DV%|$N z7OTZ9>q~BIatwb9{^k>%=#v~|Lo3>+xbt4txE%|2ktYs4;&rum{ zoSYG}QDiBqM4~0N!fGec^sTO{y7Q1G6t!;g2z0jtM~2htLV zXLRhT<78@BLw%51YN9IFo29a1{g<}g%lvZ^l)*MFjJ{df4a*fm$UE9A$S?Cps) zp+2Ng{d16jw(g?*2T}WDutm>H9bW$HUdG=VAY4-L zl7vqM?AwOsIKP007fNWTVyLySQrU5W=3gBuI@|ZeK+2NvCQ?&vO--;fFLt-K=D;QW^s)ZFnWcqOZt1V#; zJ+$-)>@L#R#9DGcy>Bfj5RTPoE88h(GD1UXoGY2!fHK9}z55 zvU2=Fm5lczU!GgK1F&>( z2`5Hr4dFe$`;pFEU@YPzUutNz%eL42LO|{uFD~U4crv?(0aX86$<=1uSu(BO<1#m2 zkZ`p6hj8Rz{ptvOe!qu5_YgQGqvy}AF_L?%d^1Yz+4MzLSZV3{pQ!s3+4V~))vrD=YFT17_+oxnH zMW}=%N+rS&l|uF{dyzd`mciH~%9d=|Bl|LTgTaWT?EBcp3}S3EV;_v+xmBO<>-Tzo z&+qkmo`0VEbq_OV?sMkc*SXGh-q&@m>$|kF;^cRYi$jB)3cmeNQQ+$*IDeS>m4yZjTp^M7O7M{o3{;&qnJJg^s* z0y4$msj<`=C)E@4x1PV5PLh7L>!P#Sg>NxtXxVDk?O`|2AwQ|Ah3>A0Jq2)%p)0w; z^N$gOI&CXXpsTw`MiRt+Rj6TMnY$bC+p^BNF7(^|0&hL?{+G8(sjE+E9Iwl>hFSg1 zDTltBO1%zIsX&}Se`$leUX8cY5zMW(ry|Zd#m3x!!UX)6LmdiB+U7F3jCB;U|; z(wF%H(>Bp9s!%4H?*RMQx-~@k-rnKQxcpC4bTmDrqniAC#Kz4Y$>sqxfbm|qL~k{Z z@41ypPV!D9Khr?RzW8m)IES6Wt^f%L1oyv(OeEd;S$I(>ZeB_lgpcv>TqjX@dFEBH38MtZVdNLj2+K8AfTif053dlD;plxQ*}Q* zBqJ~7l|K&`=D96g7j%(BA5d$76as4?T|o`lO%cL`t(or}+)%h!`Gk~tO&RZP)g%m$ zSJ7z=iGHj?8%-d$jzP2(pLm9m4z93meEpcCd1)>v?q&N@NpX~kY9P;nrkI@%qc>wg z|IrDK#Va*dD(tUp`;)*zD&|-m{(1j5chY}Q{h!i5I0vY7eEw+zU>YDI)SogfTr~?r zbeD|Z?vCGZwI0ol(_+6` z?{ri*E!YSU=QfGdr`qv zdM?fEJC5JoepY2-x zLcPrPB#!%PV{}g6fyeAZhm7BB`-v5+ebKWM=DS{B{57W5?Zj#Tmkg#B*Eb5kBQaHB zfN#dBAqw}=^9ITT1Ghu(BU`{H;A4G*eWzi$^jd3M9zi$#i!KK=6~f>cN3^?z!&&(vgKuP=K+&A0qEM;!o_c4dFNEV-0~ z;bjbvrk551U64HY+iYF;tu^)jYH|vq&)@SPDxdnZ@oRkA2@vNA9>?N7bn!P@m*buH z{*4+pvgy}m|633r8UVxWH&m^pdEw6M$ku6qY?q8iXcNoikoRh>ME`M-7K2a!B-!`m zthZC8*_l)8`q>PVA9~1b?BTio9bK6dQbCc}q)0cWv5 zbhXRX-Ph=k6M|E%xyU)A;S0JjgjMiW!Y3`m) zWE6(uej3@>a(3VB07%tA_jj^>1dLYR_MJZa25h?wb*(H^IW$t>J6IYMU>Ewi>dGRc zre7G%4P{Yl`}WODUk?`U#b>i1r{x^hg$+Y?>Ov2VHJtp@EDEFI2)Gy-abhQWiVv6( zzeNEXKUF03=0$rI)|303Q;%wf3uUx3>j^{dAffw14FJ9cZeYcFWK0G>8I<(PXuOr> z>>}deY|Hls%`Z8LvS5K?!ZW{s;jOE{=>1{W_+b@+(@cHsc@@?$s5q=x&m~v?COudS zluu!zrNDk(4Rq^2Ll^fk!|9Ce-rUGAQ=JW}sgzpEFB343m?Fd80b=bh_ojUSg6P#y;5 z99=0k`Z2tH&30(Vbw!dMJGH(@M!N&u{8t=snif*?dk8Jt^-nq#+23q>d;e-t@!;3= z#Cn*1z-mfPVyz22=e~Gj#^;g>$y*HNw7$|xU@(`YL27efRJuba(Ll2N=+1FU20(H9 z&*^%K^*<*hR zwY~k(F&AhqT*cg%xlQ;->D-FhG0J>o7`pcx_>We`sF|w5t(d&p|JnG zXVfPrv)a}YV?Xfepw~>!D6`vLQ;imC#Xtb@@eK@L0ug{ja-T#N%&b&8{yAj^!i>p) zSvzxd7nGu|-hw!KUF1K8cEGuO8dzVuyTZD2t87vtpd_XSy&HgMo1$ahPpdCI-S361 zXFMXhyB=%2?EVYod6=-L?OFZ{ZGdKeuTTG>PTJ$&!~SRR|LENR*(m!heSh=UpN+OZ z3dDbD?XN8Vf2*uQ+d?rnU(zOTmqE~>r}q`j$v!B@(jO8sK+hzGlVl+N1ri|Cyh8w4 z)5H7oSz2JHz1YcfY#Z zweGY>O>I?Cj1zGRughL_%nPH5#jhS27FPe1;L9G116f3oAbla;g1%FNJsUI`$ZKF* zW8Q|a>wVO9Aw=UBUPF6mN2;eC+7_33G2fppu9u-^rTrEXUO?2RHU_2jP)qF0wukGh z+oP#k`F=ZQolP+p!|x(lrM)J(gW=Pj$q_KKlam5p#A*|Aq&%F8(-RZM=h2Gg1%Bqw zlRRq4BZtrtyF}Bo(bGF8CcDTbVPFE@vp#}()jvDB%daC`*H`rmxilT$gSbxpYR*41 z^IZOzUno@vrqcU%Y*xHr$Pgfww)=Ej^K@jaD!v|88DL(x=o_p}Ut>Ydbt9R6`zl z?#UqzhIIWnEriJFgsHUh4xRI^PWBIQd1a=Mq>=m`>kDU?S8K)AcSRZYNur2@NVP_* zouir^gvR7c_A|LzbGzND9O3grO%DSBpT?jcm zkcA|rLgtfO2IZ1Af{E<`Rvux%0ujzV}F zJT4hJ*Rm(ss(x3zo|48e@{i3}s;Uq|W3Hyzy^@TcFGb$clQ**sYSQvpHxgDK_sdhP z>7U+tOMLTlT9;Cntl_xfiZN!luU8HAH!p+}?2Hj=p-yRHUo$E?^v_67PkWjtOxH#< zITkl=?te~*cvQG6F2)yvb;?!qB6!JFF=oYq6K@y3og3EA3;Kf2av;L9d&+Uy5va>p z8q$*H<MOY`Y)ji!zBPE^w8?N4qR z5A5V}Me`faeeGm0R&Rio+GZ+&(r7C1tk2z>MOoS}U6omIB)y~O?Bzr2Y@GB(Xs`^qBrdwF=X16VL25rkidm z4MSZc$HL3vvWV!9_GIyQvj-hh(4s=uk#}->Z+GMnbsUC7~soisd>>0#8vEwu(5bLdtbmZi@%M!Nlv= zovQz^C{?TIP9)N@2ZvSm*OrAvx7A2(M@ePujE4FM<~>d4n@RTW*?KA^RzB~lRnWTb zUGxIwaigrHjIrkJy(0;FtaWZSqT96o8SgsJj9ABJsXXVia`ZGqi$^8-+`z*?H&Ue9 zSxtCYr>S({B&&3Wi}$oenOol-43TD;0s7AjQ(gqhvHsaBW5%|d^;2(>K=cHiTT7l1 zC@Rms=o+i0=sZp|#F@t6&yEgJnsuMnkMp>R7F+i2h3k^JX_8>t{ak&!SW1JaJVG@7 z-rDQWb1|jMGwCEz*1+nfWRSsmDlV|>6Jvl3PKGuse5m%7=qB+%H=LzwcV+Ih^C|dn zRJmO0$iu)*W0kpR+^5hsslXMEO;fGXaDsoOY%8-vqvg^o;yc2$=i9SV!L~>c4&!A4 zf9VJ$t3pFIwQjz(J2tRv*L_XMV#pOkW!kaH$J-j}<%XHa(!vPQum~j0z zUS8TT3E_LFTcVW1{jgzEy5y{ZS-i})Y1!qFO0jn-Ku^Cr(f8V4S>|*N)vS-pT_fHFL3x~ z6!9UqJ~y#$S9e9{_wvxde+r(1yzykT4J!>Lsf@^1EI7e>=<2d{DIkj24nj_K1S0VY zE-6A9UKOeh{oz5CQ7J0xbYYSUu}Ten8j;HALLfCc^{GL~6xc{s5~LB<^&_NqyRQcZ zNO~d{wD(5&q|xF2@5 zA#WLB(S}>_C39=|pa!FsT%T)Obg3mLm6%HU1~r-SP+_w>AF162&pkMLY!)#p3+`drSuFSoadq`zcgVs=Bh?E}hgO5?RD+8Qusaxv9o{6pblW=OZ zb+8@isj=7dZ?E`%v>%)2qjO2u*=7mfJtQHNP~(=y> z=zM$=&ZCA@5wm)P$XVvQy0o0m4FSuQBddzRNgdj_+IV)_fm7MiXV4PxF~NQ(UX!#+ z$u#XUff6|7hzoJ>tY{{1S#0Mm?js4NOF5VHG5l-|PvKij`PP;AoaM|C=|uZ6^bB@T zzP71wUuZkgr)I+}%SuFNU=Hi^II!&m@mw3yS+&5U_!}=ynE6Gj;-nKpdMaVMlKw%L zSa|*02%T*WFDEz|lU|gWeNpyQ83Np^GcDfHvu9w<9-L}WJeCndFbjrui3Qx8C4m=B zi|Mi)?zJKk`Eq*G&8#Be_`z^YEDNhxU$ae$QQpDp0gk@in;V}EzM~93xVAA!k8k=6 zie+*R7_GqiPOZeM5WPg2&Q78567DXz&-1>-Y1We_G6er0&mX2+PbAXzzw*U% zOWrq#sdAWLmK0TN*h@3w*1DZ2DfwP!{dNWX3KtZwrG5DTf%8U{-1~YTKc!?@c2Oq5 zeggVn4(8|@8~}yuQZBqLJ*h^2s~tf+|NgAP>Aedx@1!US^{(#_k8KSHsbJ8zK_ccL z7?exOS?vBzP3}O|S!ZYUU3N~$Pj(i7GkPDe2kx8_AP8q2iMTp^R90(UGUNH8EFe+; zYh`+0jjFD_a6hRILIS~lOkd=Dc;!GF(d`U?Q8*!zA#ljQxN$yR5y%(ene6`<$M9h( zqbL9!*ZW9=Xi~Sy?w@IIfG~#;xM=F?Fcaun!8)r$hrGP8dBQI9<>#+rO>3{tUTDDR z0Gx4s_z11j=&)c`KtPJXb-vkXfgsK3j@O939oc$Y7Gl~BfMQeQO`Ezn--iWhwv|A@9y}otomuhL;M2L%1Maq(=DOI*pZzJkQ!8g-M4Mw4VY;R zhr;QHC+rgohwE`;EqHB7iRs=}Ll*BP< zdCv~c^CD;^k^**EUGLdsD?LgVS`}{>i07GhMq80a&>8u+r`Ped0gz22E%)isaoTL6 zi*v!E70R!lW+J9Br*7)7={w;_2N89I-~_k^PT|qJv?!a9myq|k=y1fEyV0$pDcz^2 z%s|k@PzJB?zQXEN8U2HX6A~Hpp5Imx2vbxO3FSSgu&0gi%|&A#n;FVs4x75fAoBwX zW3tew(J@Q;xT1jK_W_Y2c=7L4CN|_$%tq&m9ns&V1-NjtTae|48Hqq&vm=Gbs}HF6 zsEO&ri<8PHGnmjA-!&O)zs9NkIX9L9%GE0Jz2`?5es_&EVk~)ez1fOVCo{5^4m$*Q zrdyib(K!7u6_j?=x}aM$BNCHsW`RD}vi&4|GISZ~HPJLV)P&rs(u^3$`}AwUtdW4q zhCqKhM5zI8CkOGRL7Za`N82Zppf&pEuuluDX5AUA5B&7eWX=S zQ)T`gy`z18$f`}_FYjw3Yo=khS6%Cm%Ki~Bu#CCA+`hE(>M|(+vg@NCb`kpc>BlX2 z>Wi2mQ(Q*jBBZZ2i~)JMNHs)qAr$7OW=pwk=Ad2YA$p)v5%cQal0{d4cz^SpY=76A z@&ZR2Z&EP5sLS3w5C>DV>Y4t)Y>I$(^Ze$kp;wTWvnu{Lp=?t$$AdAUU2WPUd_~a% z%#g0wQP;>w`pL^m3ZW)`dRo+MkR7-EEEY}J?5FUr3ItyakEAx4+E1pg!;5!uPX4N% z(s6w15CeUO;5$U{uy}PePdO}&y=3oUMEFIiT{X2Z!uE!+g|8bKrA?h|x;wHKiV|ja z*8)l2poMDvw110g*!5<>GAWkc`TpiB?~Y_?b;mC@XV-7{RNGCUM=AGC<70~gX8d9V zt6Thj)wm~yviU-pkJ5@TOBiB|cz7y^luR``ZTrbjQ%#1eQA|qua z(rD&yK{Mc!m?7;z)poCTQ;Y?)NA4u07C)*Am@M#2SQ7(dt0y{_cZ}_wr(J)pcre?{ z_?-!5`|6oGY(la+hgE-cVI@19;u&LiPwF&{OT^&tH&uL8K$6;B0kc^T#%xG|#Gv!u z2AqeLx-P~Dod0L+2SOVn;_}}NLdwQ!k1ogK+sfKIv2g*oD8O=GAV4D@i_Ih zdsc8&(#rVs)JfSXwS-E>@-ab`qYLhp&vnKD6khA1%Vp2weNzu}5+PZAnEZ*mR<%3* z!8^_Vnj0hKlO+yCFGwSWfSzcAl-TfEgr^f7C;5l9alJqD1VK|A2%=xqm5Xq6xGv?H zGQFE}!260^*UMYRP>I=-^sI%N<566?NEtoMqs87Y+y+Yx-zZ`Y2^sXfPbF3x+)MNQ z4HwT#6VygoBs`(Wv<_4GgmJiHremec$hnrngHYpaT<&s*`+mik!-!i&**g$?IMG}_ z8ZO>)W^84Sg;AJkFYY2k_RpCUV2ujN&bc0t6uLmeXRV(j(Cr;GO6@EVSoCg=hFL+N z_AN#En!i&%{;q5Mm`AUd%~o-b3(=!| zE59px&Ly_i+7QDaK)Ugs{Gh?m7kF=^F8Rz8yYV)#H z%yuB8Ra6LYk0=s z-l6}TeKKB?*(6G>vq}-?rn3mqgOJy;Uek-O=~#XHuw?z(d56KN zh_hbv(|Rq5-+g0>pNNtOTCSuYYot9~VHFOJ&VrivDG^cuk@8R`V)W_v39dEykteSO z{=hdjY8U%lP11y%I`}upd)U?5vy@n>X^_&8=Jg1`T>s5_S}o<1Gn@I$!D&$$W}z

mp}EqSyK+Q*(2>=Ymg=`97$;IcN6!AU#n%*cZr$D*-Nee z+S|EJ+Rx|ZZCR3;dYF~MF_igZM9pO>@k~gx4trPw=|VIJ`@5%$KeEPq!zAczq(Nh5f&nm;?OE#5rE}8U z#ZRH=@X>NGxGAhZ)1X9J@90zqd*NH6d^+_XI6N>w)f-SzZS+H~B2y-P<9Sh4sB9^` z54Hk023h#XXMb<0Pm)6GkiL?{-ABuuprZM)WLsEB2b#q#r(64fNqY$SGt4p`=w;TY2`nt=WNa%XrEo{9qUUnx_ZaXpXSey zBTj+0$7QyXxp9J52is`E@tp=*s29WL*lk(qL%b z{D4U$*vR{OibY3L2BD7Pf0W=s&DhiTDc+ldf?9vn!!thU_np$Lqt?iq96hT`p!p-C%gD~Q#Ul*)6z?5_RdTOI-am3Mb z{mH@`g7r?qEnr(xq2CH#m~Q&DN89Lxm2`%?X@LE}q(wl?^kDW+xQsXMkuzj~+bDW+ z4wW+nZNgMf($uLCCG{p9;a(l$t>o!u&q9CZrDDhlhtVJfx)#x_|N7>G1d6y2t;Rei!KaW>dR9q61#QpP>7?y2sz0 zVF0czxPS39D+6sX5t@%o-?Sc&i_`RRCPFf81c$EJ965j5bSJIC#M^;~bFDqWN-O+Q zp@y8M6@AxT0c+A7OJW1_dDkaub}ubJ?MB=@#iY39FS$V2zIppKGe}Y#ihC7z4xDd! zS6;k~V~e9x#yFph}M}^?QgnN9IF2W!Pai zmf+*_8fQVE=epRZlG}GKC(%09E9J>f87W|$1Z37{wq+bL?xyQvJ(*s=Wc!4;j^S2* zP&mD}X;{I#mmLD%**#yHE=~G{@HjPE_1!1RK4K#1EzT`DK1$ulwu$D! z_vZb$d7t+!d%E}>k@J2`JJ-lg;={K&>rN_b|Dv$d5)vNT>Fn*<4$s_Xn0g21-R_YsTkiAZmYTEKU4c|6VD+zj@%CrY`EeNpYC)=CyNe2ky@p7s zTb>M6f~@P@TdxFN4jWCLM=0Tdb>3yh#4qSkEg~_z#3!y`jAN7QD*7kpiqS#$1wNs-py~lL`>l z_KQyQq(1LSHII9YR>-bH_O)6i4uBm_*R7u5bKWm=e{gt3ScRoU2qthxwHXxMCpkjV{LBVQ+{MvUZe9B3%hng|FWbELG^=%-rJgf z$xN&Fsz7Wm{ zm>1SL_mG>w^ulGxIDK1Y^W=K+KX&`I=Z}&Gi z%!J9KrwdWK;j3fj@2847HF8Rl3I1xNLbI9CQMzeXVP;lKSLkkoG9g9p3uK*=Fbg$C z4kN3Q-P1XiSGK*+cz?ltk{8IbMYzEd#K$P zZW-rmy)|Yl2g(4K+^PDKy8T`bIS}Qk^yRXo!eRs4CrV0e%Ey-ai`8dHx@<31EDP== zCYa00+~(Ql5Lmj&fUdoAjk6A{{2aY$LH>w<4N8CL_uyJ?;1^fERh{Lzazg7o$As1A zN=I7dMwY?51h0}^xuoHtr{7K~PA+VtPX>GN4W?1;plDzdEUE_$$H9#Z=*6PQxZBU|Pr=jhQ7QCB2lo1OMWQ+=66f-jhzsE}ep-HjhL z@oImAu_;ZFPG_{>*qqSen#)^u!mlTPj$j`inG}|r9O+$_RL5?(TaM*3P3haFy6-}l zo)zmAXV`2?`)WSBapdy^sf?X|+b3eV-*m+#b$q+)VtSZiW6g53*N93j%pHv^2$D ze>8Y!Du>_2^_rV#NFQDAquJ}KU$|$Xjo{+E>twp1l>)grrJ32ST;*4_T+0)O?bIY` z6R1p9%RM=t?J&x@^HUdwIx_V-vX(dUXHP!ZJ319a*8NbEQSlidCN`h8_i>4nfTW-u z`PInnr@RXjog#PRTviv|jQ3VY8K%-+E_wXuYX5aL9A#fuYks=U9sl&B_N-1K5jwA9 zfVx5VRhV(AUaxOOjo&3dOHKM38Cc;gQu1y&bLZGRc%8CbStMmMPJE8cGtWO$*TqQJ zoA2VR$h{L!6bwiNh^fI@=U#=3wKWlbb>m69<_yk(mZ14Mjy79|-$l@y>usa@12Z`b z_xyt!TjRM-1H3WnxuMh)ML(ztNqc^y`mA7qLtG2qux8nlD+pTZW4csh!0+N%te*`F zsfLw!_tj_2w$pJ<%MtBqo$hX}w8m3Q-njRa`Nem}H05gW!Mj5=eBHPX=txUQoor+I zfTIW-kHd5cr1_$kns>rrT5Os}Mwa^KN2J|`v&Cq}T?$GoLv7pMu%^sx_7-~sZgsO> z=sW)Dd3dpZ`i#a&prOOerOB8jjA{xnnLyagAm@@5ohH>gfTa1~j{Bm`iZ>mrW<&&7 zj#?Z2CLm{c~_;H{-b-|8q>FX9D54xZqj&@>XaFlC*gnv+T!FC(yK^ zW?;NO9g}4rM)Y$o&lohU-S087Nzf2tmx@7&{u+W0%r&sNT}nR(&nNn_)a@xYdjp2j z$2W44mUTK2#YFS9IG~S#=AjYcnIEu^&+SE%o4NfbvM@0~oCvkkR&yCi%p?E3+u4Ub z0yooLurFXG(h&F0<-8q`r2x~bUC|py*R*7rsX48jeip@Xsq221SClpz%^Ixl9b6|y z>%HYJj-FT9Cb{1T{^38eO)N^vM`ZbATq7DVA-Fc0G`;TTAIo1G8-vS(jBE?q8@Cvq zrYS~kjKr3gENx11gVTJ6ilVIP-;-5ZlVV!-!k&IM6!v7PU=nqJk4xJm615 zPBG74Wt=K{*`F^Xe?;^+O)JJ(B1=F$rS*G1l>fnxw(s#}`6u@Dq5G1IX)&F9_J({F z2>5{TOQ6GnHf_1{jtZTJpR}>oSG3k=D77z(!9gv1SFzqZXdG7%_rzksjLK;#7B`ct zmgxX8shbUs$Y)B6k@9?V&i~_uV-}PZG2XGvxr*OjsC>;QmoMC5_NFB{Wd0f3Twfri zaIKV)7G^U-9dyNtBtZ?~r0tzcrw!WdgMS>nM;1@tyQzfTxfL|2yNefMm`V;Q&)qVa zmOHVBUcmjPXs8Am{lujAipIN>?-C+@RD%80d-B0UZ}xBR`{q}x2Q$FV%r5M7{8y&}_ zz8XcWV2Z{54S%tImXn6&@j@RMAaJ9^NFhb4%Kjw_@EPQP+n1yFG17PWPO0X0Y=f8@ x4N$m7uDtHLX*1$0{{6bzF%|xAkDGKybZkCbuVXd29v;_Gex&{oruaPge*rm~0^tAv literal 0 HcmV?d00001 diff --git a/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image03.png b/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image03.png new file mode 100644 index 0000000000000000000000000000000000000000..443a6f2d671be341becf8e43dd2759dd742e3e1a GIT binary patch literal 28564 zcmagGcRXC}7B)PiccMgZkwkP+M{hwQ7@ZJA2_nG=5>ZD_M2`|}5M_)`qC_1;38J^C zgXp67`tHej&Uv15-uL%?|80Br-PgL;TGzUkcRJeY3%ez~bf@4C-$&a4fbN}=%t&H1ZS&$*}E*-OY?l-n2>hD(aRk`6bCu3_!@{Cti zca{fvh53+`m=q}+MmwT&b=vJ+UEQLeHQeKO6}cSyX)Pfx;cQaJ&TlSqLczcIPWY+z z_B}r9AKD0&aL4>Q|DV6pM?sG-F;%5& z|Ga;gU$yD4uZ1|M$vzxOgC6gsHSHQdpM?lou;V=L-*5N!haC)kSeM}5HyL%A99v=7 zW-O%v3*J{|dAS#F?204LB$20_YkR1l-45NoX+({=Q+R`d&0heYMYZ(0#`C>wpuDuRUTf@9+y57^l1D%_^M_+tywwe=@7Ey1Pfv0d}EFO58KO zhQY~Z4bv9eHJDAiG>S;M_|_H7*4(6 zcu~lu0O31WYy!^I_|*t@(zZZIyOf`v`5$)#vr~ej968|3APNrd45x9Ae#h_GfjC7v zj}~QY>DUU=oQi|cu*s`8NH43`9@!oPyJ0a_Zj(m=ALxq{$$A2eA{l+|VE1u+*U}6z zP-ha8tHQ^YaW#D;Q!o{vvUVQYPFibsvlad{Psnr7)%^I{PqFDjEiem{>Ns*znikx< zrJS@FeHlH;q)5AV&~&*b-%XQ0YeJA2w$-kcVs*ieCWLZQ6#F=v1$oq6t_v0SmCJMd za00$y^U(0glt}`q!}m1vYx2?Ry}rXw&cS4y(kT03cYGA*n>lMGUa{1R~qeP z-Pw182|g6PpQG50WJYu5fA{3%4+}NQQ3KRs?{oiCV(4mvC`d}o;pXiIj~%zdnfF2% z+;5d~9la87-6{kxEp~fIJ=R;eDg?}rDJtc;MN2JkB$N?e2W66Z-6X}{IYCJSzyTMI+e_a`wWDDcnca)ie}2U;x2iz;W0Pl zMyXNb;KIq8+gPsNZDII|NL{i5Zuu!Iet0rG%mA_N9ykunNDkma<7o z<^&MA;{6oa36Q^}ZM@cGW$t+|T6deH!b2O;?sea2+lvb0Bfia~)JB|`R%`Wy1Dya$ zL%dYWRJxVqQEtv(*!@gck^rtjU&J5gF~Br0eglo~#KOY_0o__{cioMe@l={l!hoSt z;51uyO@-vi_rJ_pn9*_MTsV(of;Ab}1VqNP<<#@+dmuSyii(=&1b4(Pg1-d~;gW4< zm{C$QS?A62;5=4lGev(CMQ(NT=1FvYp~dE`F7A8bVVOYD&1_K=yfgR7O9 zol(pU^vR>`IH@RuKKE2cQL#*&zH2!*00EOSF{Y#@;&rA}hk#jvF~ORUQaZ5U9ZCTX zuF&!fZFunAXLh4Z@+vr)Ja842_Q&*%9?Z2tYRURV@%+;4^<3yTyZtzUZz-TuymxDz z`jun9+~t+TXw_mr|OLloJb zK)t+x$%k@1F_%p*E?vLwX3KyZ$AI%;oWMF?YWVF9benm8r*oV}^mPgxLeotKW01}L zSDe&nCC@+#F!_2*u=avW8Cg3ggmrd}{?(&UrR{|SV28}NgHkhc3Tc!;7K+{M2W(fL zz$3KiITtwRDE^nMyTJ!f&AH*C(ctwpXr&$=q=~fAbuZo%pPc5~ZLwfsGD51`j{sHT zwppQnpUxs)jE5y516fN=Bwd+@R-R;+lu|KR5mVk1>(u{9};*ZiKZ`IFzuD z+PH2!z`bflGk3@?rb*6bq^27=?1G^h5tW+u!Y8x%nAV9h2*iW!(~j^%4^DdZKXQx2 z?z!L-V^(+yZXq<>(=>?CR+pmZHHh!e9Q76-SK4%N9vtpa4znv!>E z0hRzI(6liVyj+DJ`L4-cOd z7{BycFqi^Sh)QRlt)DEv-V4;bI~L+*Y~Z?cN8GAwqoyZ+OC27B1eFNA@C@;Qhoj^R zFW#qIcV-~x;W4Byy)2#vO}%#I-9Sa|)6$hf3=3`>v~z2>;bVmTIHbh&(>?cY2;HDF zF19FFdTM(VePY7a1fGft;x5`Oq3ICZuGM!PN?f)yTz&R)t)b8P%Nuy%dwrLFeS`Xi z;r5zusE@cTGhqb!!xrap^idjbExb?O8ZKKuqfh{|$l`kzHYh@M-|gr}6MA>B%%9`I zjM6l|=OFVHJ5V2SSSZL=SB6+Lwcb35+Nf{&n2Wl=fo;>)YC)S+fmR1JBCh2d+6ScQ zN3I2u3$zKIzuzq8cZFM}h4Y{j3=ImL%ntXIb!T!=#?A)Oz2;MSAm^T79>=pK-}=UQ z?r9VQ&Dbc20y^!Sjl2`RKdjF@GR)A1`Uqyx8+>y?xQC;Q;N{|*EqLz)#zduE++SQK zpZCa>9s0tvH~fjNuZj`=dEP*Nfp*a~tt(0^Eu0Ze&SsGpWt6elmL+R=u#OzrzDwtX zg9#6fGV1VCf$Gl4r-$>XS>J`Gv4ct+Op>MBA*yd!krdx^7L{d=_@&&7q;otgqw;dg;%H87Ic=z}{6PH)v`QK~mRbVT)|hgUnRUW@ zDg`6i36k{M;M%8MWG*(jEIQa6=D>Zt3Tfx*Qg?Nnbv@8oe6a-<6z58!58jR3X8PcV z8;(N`+gQswzZv1uepUobm1Rk#vJyf^18=3FtLKQ%2>v=0NCrzzep4S6Um9%8MZk#J z4wf$ETI7RPieP83drH4!t<$JyHSksumjy|gb)M&k8-~Y(f%p=QjAEDPeE++H1zDG| zaypp^nvRmOZTgado9Mq@VoQ9(-7WmV&RxmzQPVr(7 z>OWcpCtRspOk{^Jr30?aL)#!Cgz5Qlfm$&8kbY z@e^`k%tJuk4yHW0TwTSP`z}ZBT)@7`64qo~ZP1UBTQn)jfYUtNSJfzlZs=fSxZxi> z`Vd7+ORECLy}5Ws>32b;*pT0tXrQ6lO>9Nrl~Dh;;$U-n4R_;kt^6_W+2S_=0^m>gOq|PJcRkOErUQ- zI4rUt_GaidL1GfdeSRFDv`69jVVI}x8 znrB13eT73u969+8J2)wtQ#4P~$Q`a?M{d#D6sM)~B=)WpoUZ{KoP`J6f8-)V^Xx^W z{$Cq@;+)~FSb2|AFsZ}kk)U5oJb=U4`y3wRA0szZ$KwH4IR|GxP-BXu1S_1glXE`M zc{^)s{!QLf*~@!d=rVd!ch96OBay;hctH>lD|%6Q>ny|DceG`;KYq1GrphZ8HItXZ zK8|P*ertxp0`?3e928jN%(KHX7w@!J4>-K^LtG1D=2O92Y&e z6~2?;VUChUbG}NZyp>s!jmTc7z8v^$1CsFtoYo`S^IyYSOaf@|%{G1QRyc6XHGp+# z2Z7pc$x^3krfaRX8-~W&eDX@)7o}X@WcjuKC7*0lEM)T*vBl|f9vCYZfZ4fej;e*G zWfHLkAL$@})Cy#LukEDx=%*aSJ0WO*NBe@3JljE570~4qd`v%DNjBEILGk0N4C`Q8 zd(6D3uX%%+;jegG#nCD9Mhu^9Wu#h+tS4AXj$a9A(#C?}m>P}+D<*0>PdP+>TvB|G zzi=&vRWT9V{<0grYO{Vb`-zdom#8vU2DHx7iTM;{&Ku)#66+{|qmrb2H5K5ad(jpfe}4LB(^`T>;O8b|h)h2jGH;FyY!a#|cg z41#z_6y|XLaow8Txs}Yh={H3O1lQ%0>!Ji(0w7xNWzgTXm@~Q~nU|DaDOx0w)Y-_G3E5)zB7*N5sS*yYh_C2nBv^7VwX7)a- zP?Nkrl%W}Ub7RO!SP~HHr2Gf!>1!PF>Jp}X?p$xtG`qv8Viqxx?Yo`#yVIObh4FpO z`Gd-(os0c8^fN-0mW*qP z!Nk0h3dVG_bop`D+6+vdF+N+HIomQc-`XtLtl6XRxWYXuJP)`qY~zZ~4}tO}XUuFG!ORCIY<4V|cjvGLkN_2j%1Ry>^@OU(^BdJPMI zpGg*mckS?^pm8Zu&k@qz6^Wp+C~(QricG=FwQMV>+5xggm~ z9>>;GCtx4~SR%5E&!CyA9rdvTH3dscu~?jhsKVU_Hd&i=<-86J%q*twaWPDoH?%r_ z=fLex`CT+qrg!TWcVR1`_BG4|82x+3qrZ#dOVv!j{w9a<-9=7A9i3m@F8}~Q+qJ+L z>cu6(HnHa-Es?y)BFYtp%Mt}$bkOEG)N@C`Dtm}RZA;Rl- zCm*kz+>qqLYa-a){o&Td{TO4{0$7a8JS|w;dyrPZCje#))5AVZb?*_2_p0(L|12KSbdbfT%6A}BoWLiD-1C$4hp_Db4W+B$0>Xp(SbX=XstHBuZljA44>n^TNg0@P?!Gby<`!@xzMdW^|K%Xw!p&l+@-Gh@d z0Nbmvrb2mgSNo!_+O@zOm!Ee z2M=~~lEyewifCzc+uJ3AfpLMzXF&flQs0I3kRQ8>&w3eR0onDM4<#WK(St*HHP^ku zr;&|^@!~@4*hO?~>SuJIuFi))Lq?pz6he6d?3PM2kjgvS>~Gg!jQ-Gdc5dWectr#g z00eJgm6P4O;EPYN^iKO3UJV?SwulP5-LK*otuJ*U_fG%!b~uTRNw!reP~iVYKR_^ zUHKt2nz2CJA2vnbQE`Up9_8A{gIwWGZChpg>H{}R(or^>?<1|$yB|RGR6uw+{M4)K z$kp-689HxJhYukmyEyhAzP*w6?yKYWmk6>N*{fB?LUI0yG8^;h*W7}Q1DHCS5(SylrnGBn(^|R>f{Y4K#|?1ky#bbo=_6 zbR!?5Va{#s()>MIJNu-&A`BZ5TSg_8b{C|xEYjtDrxcArk^|^K%jq?RKo--Baj0AL zq!6N|0cm@zgY#GsM6o5WHSB$Fj?0teQn9Cbc{}zSGm&55)y?b8l+^Dpiznq0o4&o@ zO+WtOV@g|2G1(&h-dMq+dRnm^McL~~jhqlb=OXPoEwfsi=m5L88Ls29ktY<17vrAKQ;lg#3&Y0_+(u`}`IkpapNXP2=8nd`Q%SlY-E< z<_#4<{Jt~Xc#J-w{&S4S8hsMr-fw27uZaxw`pP2^-y1KYCLj9-D2`CW_dX!wPWOQe z4G%LoR6#A0G=Z@SiJWof_$etjqnPeL^)vA9-bJ056*36moc>!)tD z_k8J)&OV2%`cxR|?4k%i*QR`jk%vn~x*1<%1A?slT%lvNWNC~yp9traS~1~qo%0FY z`ur4^W+mF#=IavK;S1+>!A;T51t8twLkWBIbH|0YnM<3|9!bU`LP+hS2@i5UX%_GR zh4tVhwn`B7FOeA&4U{uXthggEpL0ncmUSQ5n=*oInw+xJ`7PBZ)}Cfq2r* zD5-(Y6pf1`QinQzR?=e5f1z^ZAK=wwx@YC(cvHaQgcVuaYed22c_8gtoq_e>P2GqG zBOUGEr5UCvQJ2G9#5_+t3DMUs$W@G50R+TiM3L>-b;*m!cZ+}@Pd$F z2u#te?(zdf^|T(^uQzloa7#sv8Z#bZdh{z<$`&Nx`n)J-G$hZR`Uy^&Ejqnc zC-;my5wuJXu*WAdUi}HAX-KVZB%xX z8zX$eIF=;ZwS7k7zN=i!^T^&5cUmID&c7tb!B%;Vd`;X3?iJ2m|MaoAb*$7r=zu+A zwVY^uWoW(A)9Iww2d-3A+#!-LwIzOFm?pg)&h1(-jq`XUEqC;0c^cKgn+?P>(>}W> z|5phUWzI5SK@iAT+@;)Qja+V#-}Y8gv568^F#vzdi(Bs35u|eS*&mZob5Yue%KMR` z%~ex5XwKGn|BFUwLjE370mu-700-wJ2XJqCm6P`7))xLUZ9j)rIGZ|9S*@~vOdA#r z?&|8wy7su%_hR>LmALRs&=VE-^DN}c&ntjo?DBfqhpTW6V>*Yz)9h2h!gsmeG}ycC zJB_^G8@jOB;4rRwdC5_@DZaowW4C)EvuJ5m~Pb{b`lmIfLcrd`*KB@=id(FajYXFxFug0jI$E&N!)$u^2 z53qj(ko`x?ON#?Uf_tTNcb%ZzELxkz@{RlUIFI3=&GY1FLuY>qt?g{&_VCQR>RuWQ z4gui*boJ$ioiic5xV^6LaDQ0GOKux!9u--9@rJkR%P-O`Ji|*u`b^D` zGP*3%|0?{<{T#52cr_Q^Guzls1gB-6UoRYimIC23Ev5(psHs<{i>o6B1YIzwBZR!M z61Hel5rs4fLk5-!Xk-)P$&S8gQ(;V3QEB{MUEGL@nR~H=4}E=3W`Tb30k86>)P8)% z{O}~9oOfrhF-S5q^V`q|*oLINR6APLGs*Tw2ZKp-9yE^IZEfXW$SK*K!%_V(XxKV= zN6SgG{zohS#V&iudB0X4xfYat^M-eK_8y%ti8!sX zR33&PpAisRRovUdpWpE=aHuuC82*eH3yUZ^SHyj6XNNdKq{xd}9fTrYvj6&hFfOSJ zB)0*^w1z-juNKsANP2k>mwx zpL3Csfx=ev!oFFO;rCA00D>BM9>&XU+6vTuygh=KK}3<&tD)T+%Gy*E{;(UD9QNIB zhgL*kKfcza*{+AUcdC=5Fomm?pj**#pjc+%5HPLOeUf6eL#=Texo@YBH; zl?#}6invn+2STWXhraVD8~X)4mlYI|(AZ3kawMbK=KFO@t&+6DS1i)k0O)@0r;}rD z#=HUbf9{6-;kOo*GXBQ7qb0C1etQ~)1~ zT&T_Y$Jb`hkgxCUP*e4O*jT&q>*hxnl>5{-G%ibglESzpLi&wTZVs|v-*uN(gd!-6 zuAr-HwK1^z!rO5;fA;~9%IMa=@V$XGte<_WwoBm{E(6~ap^|Tx3sTiCkmJ?7Op!r zK%@oK(*aV11Q>QU>tjquAGw=^ls~5wckA6KLyD}R7`z-W9zHK3YcBa+de*D|%-3dt zM*);ZhYXF_wMF?6M=W!{JH{m12 z;Zg}P+Kb~sr$)WsR_TmtCw@;ou02IayIW^Gz3HCRn{J%jd$q|mYrd@2*HDz#^ElI5 zH|YWd>+helxmZPgpdbFm^P$+;(5v7C0fdB7-TDciZ$F~E;(uIYU@m>d4K$>eX#8}$ z&r9~U$4^RZ{PYcy(Tp(PilnLO8|Jb5KtdGkPopM1*HD@tpJ zdlGv?mn|wZ;}pu8#GCZ|tSlI0-}`0-sNxz#&&Um9vVy1^x8~K7&e-0u( z9;Gi-nE|2GhX)<9$P~VONqFi=rmpkF+q;rv7U?6d#zj;BAT(=3+$s$_GwcRMYvq<8 z3IH#7l#nV1M|{elUgPQ6Vtfb%@L7H+r}m;S5F8Q%5?mgsf0q#A@O#Nv;O*XX(y%25 znU=3O^_8zCs1$I4piZmK(76}n74E0enbQET9@Tcm*u&2RwSQM}L?J#Qsi~2A*6hf6 z99Y~tm6VBS8*+!Js;u9sM~_xlxR&Mh%1fI3fJpQ?Y`h(e$oDtOP|@$Xnfm%z8_xADMY;2OF99Vk2NC_gYs-g)!?LEu1GAs>+b2Po*Bo4 zjV1T9G!K@~rWr;X7niX$2{IX7Pa4&v0+l$2$EIxm$hvy++jl@9`6rs0hG5MVnwO3l*Eag5LA&!$E^#Q1ot_~>b6Eg4y4$BXvYnT;o z0InR+2f)lF4)hMoAQXT;5daHKj1Zuqt#IS8^l`}n+%pFX;4=jP)(l4gL^Ux&0B8L3 zrx$>M4zOV1(hMvj>J_d5LZ_c>`{#EgUYRDuCl&^NvNjZXNlTY|O3sjfd19}iAEM$p z^U2WpDxjduHh7|J{Yff5(9TaI=Vc3m_YNbY8}tNA5%A*OapgTk0LkRJTZcTWz9Vx% zX2Vx|8T9d|mPtIko3-wTbmDFkp5hfR+x@Ufpy(XOSIY11#RG!u%3JADD-GPZS6j0)%LjSX*O7Lzr!h?OUYb3!bfWOoi*Fj@ zu7h|7zx~aBwSAHuFdJbuR8w=*?3p8kr`9=q^>Xhr@e1G76d&mevqHLP$}SQDH+hQ4 z*EGZ@*+~7>Ikh+Zve;DYS!0~n(I=iemLGAGYcg@C2He;Sc=ljzjFA%WGXGV z4GM#d)V+oR{i(JRB||JhQy;@MJPwOl>xJWm#QaB99M3K#0dq-nTmI9GRAc1Whusjn zo{zTVPbfvuk=~x+(yx7Fu*v2h>5m2+p+IJLv*F4wsxQkYo7p(J@IkaTr5IYSzkyj! z^+fIJvZH!LCE+t*ypLWtMI%1>&>?yAdUx3{r<9$`_*p)=fl9c*k3l3aJz04yQI<-& znP6uO+7FvW7RxN_2Q0jlBZCmZB43s^kWy}sWb46Zg;mrdD8$eSiHX}lR(Nnbmg^t% z!2clQ|0Xv64@wS*&;Jdb|NRnZwR6p)ba$<4(Xpp9fLF93%*);S_*>(d>GYAMxlC?* z61ijMcRH1kwWmYFBb0^fiLDzary`V=hj_65%~*q)Us6d{F<#y57>Fq`%%vc0Ke zeI}Ew(y1A~vh&ZadKTK`UpZNrR#QY>4aaIlty@o00m40|XZ5Kom-Kc)%jIf;zjL_Z zvabJhJiOlj5IETi^s1tC{62*Yv89N$(@-<>xs5rj?!LuEn58*$|V^k6?wa zmtjYjwXs`e=Dv(X8L2Zed+mw0qiGIUb_mv=)H&1Kk!dsB!0q7Pp#TCL6Z%b|3Vv`& zI?mLXWbdQ?(Sv1$a$e~`Tuh!y*w%<41<2%>&D!v`0h6w2#^%~6`;;{!VYk(^_SNx` z$LvC067&$saV1}Z`mB;qcVnj3Ej;?B&5Kg2J{WW0ku^j~zfoOt zt+u>;XpX+-|EW265yQ2?%oeqjV4J^ga=qhMRm7Wmh>@r6Xsa*Y5e_`_t6)7P6#qmE zga_GTzPC-ec?Q36>^L67QrO#Yb*TNE5l!cl=}n@DSBe%Lgtsi4`+2Dcjl-YnG(9z= zN>pM^I+b@cLC|%V`ByJ|J2fG&XuI1|_clQLJHb#j#OT|t^V{FF`Gd{~8YRaX{1&yk zy_KA4frK%KfhGg47!`VYaA)VL26MO=3CW1Ks_ zx-9FDR<#ik1q+AI;D~~IWi1R|`9!?{H@05h%v@_Gv!mR7m_ZDiu_NBB-Rl_rG5!LM z=5t_C-6b)d%+DTNd$mhaAKo4z_T*cJT^=)-0?avBj&leyCSuY8rw#3NU8q#dfI8H+ zX($3?ne2hw)Z-7!v%R&+M^A@cJe3F`$eZ}{(fb8xs2A6R+3VDd(&%J_qMg}V-3N@+ zPR$1M%*(aku6qL3tn%tFaPV3(mbThmL3TewCVIgX38V?%P=ndx0pTYJ*OK(ZcNj6sNx|6fJRWW%4`>n2n#dc z8*Jl}d@fn~gz=ee%^OuFCI|EiIX^et&9Py<*i(`I(u2fk0K^jb>G=8)>1W;GrXU0l z2l`EhuiJZt{JOz$S6s+9VMRb*ra=H|cN!Pswu@JFjW|uG@1VrwnC8;6(932R#Ql!I zM-b#tLiv_#R~Vak$f-V@zDcLm9{cWQh=8Phb*gNzScUDaeP>Q0f$K%|s7Y!8Z_ya5 zEA8eV#F&^1+>djfx6qk%xI|(>k?zDaKqB)8-CDLS-VI_4C7pqbU}ljDcRTt5eOC1) zMh})5x3zF36}%3ssC8HUhaieGHDQ&pI5v}gwQHB7a%w;-Puv*CPCN1ja?u^iDHYJe z>Sg$i)EPu*CAAX(fL!Lq$NVW)#HSY^#y7}0Ty0R8%{Tc2O^(At`@w-46_)2~K0vC3 z82!~lC54V0tkm8;ch&iJbzKeMesKQ;oeP*N>PcC#D5gw87?Fy%ZKkIDl6V*%u)in# z3>yC>$uVBTn2JpzABIM@Ylwlu$Wp}YU@D2uY}2^TAa2CHD#c5+AT`+#4!D!rq((FW zCQUX3ldp24eP9hukRkK*7)z&F!g>6q`yCS2)N#T3j<6vL7<`)WnAzewG%E`ydd)m1 zHrVr1^nlx58IM@tzK8AObWp0k3oW>W6_=&fcZ$Ha)+6f^HMn+vROKc-C>iGVnpC4R zhLbA*ZbLx2LBDjjgO1Y^AYVq@LhmR!Cle`Vzo2h!e?}z%+^F=$I{v!R)3yB5wK}>A z1Hyx!9|7!?M<7OSnrHmv&ga|LtGN7L?mCEp2r1uZU( z>b6SligTlf$_Qkk)-~Lq1#!Zu@3m>f_D|5$%_?pEAQdfobSxLz0 zWDd>)9MJv6Yui(`=F{z(5IN4U-Y5Qnw%oU)z&9Pc0aSP7=WRJ=5o#?R-jz~ z!GTke)Q7`^(SvOI?RK~rWC~6+E!SyEY@2MMbkRXGza1$1b7?p(%u)w=P%c)^hP!;5 ztfu_}cUh6G9ZM}S{?=#PiJQd9 z9R`Ui*?2Q<>jTZ@_m_%MFFf2p+IHsXVdL1myPW9C)^|R-<*uJq@s$=;GMj6}Q0}n^ zW*4q7gqBcA6@cF`h~ zt}cIhUoG?UMqaXcM$AwIp2^JP-hISS5ry``L|Xj_3osCTc4PF12K@PQ>7cTz^823x zg^Pr9;~-NftH%k?ib8+r5I1`+=7v(7cWw51cGSVZyUX|k1G=eI00HOpuqfH=&2T3lPD`~1d< zr*Hr2!ZK+%Se;EbTHwl~aQ*Wb(Dcz4Ww}Zp!BT<6XK5*rXUdvbm%Z+MQOnRs7xnUN zv4FH`vh|2fk9g$F-aTdzr>E*0^Ky5O@*Q_0}x zm)1)F1i>OJzBH#XA|zyH4)9;`*3Vac3tWs|{Rs(ZeiurW0-%>+^;w-6)C6<)QFwTg zPKR(qGuO~^VYQ%NiM3%g04~%bHChn0k{hUi5d8X0gU2IHuozw@i|ar@1IB1V?`rER z9UAliq0&SkK((bEx&DhAo}FLC@i(>l52a*>Mejc%gDuhNNV$0Pr{tN$4lkiV|ipy~w-vAEj|wYdASNkVKgl7NEWsI4uRb}_#>D6}vq#~>j| z!NgD#kt?w&n-5TC!$I~AV*%B}MP;R-A-)L@EOm9g95;@6)=&p#BWCmp+*krmNx8P~ zb_g%4UqX+Rzrs&0LSwR$f=VHrDjH@o#mV3 zPNBLj^9O9$j2<+!G^X6Q)cv9VJ49#%8+$)DcG7E8Q9}VBrDOB1Wk+SeJzy{4ps5o+ zf5Q*Q!~wLXL=Pyh_mglAsvn>Rd8x>J9XV0!%zjSZzP%F9YCR{41CPJx{K zNUgXKiqQLZVMrkY&`1Ms{2Ixbv!JyR8LfuxDZY9sJ=Y-sc{F_0gi~1F&j#B3@mir$ z5lN(fk1r57-^sw8ic;Y&azB4(L+`1QGhYH^=Rd`@9tey! zx4VF<*U_#CgGeD?)m!&U8($h6Xm^LBN`XUKw1KzQLPQ;@69KNY_w z+g?G>w`E(+QkOWSX1W7F6tQ9iL1*QT@=0l>%l8Hh8_XMuzebtv4}W%|zz8pqPv`k4 z2J9;D6(Ayhe#BOHozP;sc=HO10a|vR`WuN?gqbvjg6vJ8sqwJ9d;n+JVbVvO6xeTl z`FM=IiRAGh?&(Vh>^;nEi>OhBy*MwQ)f5R_n0lXYK2TJ(GogoYoSsM;w(0iQ!iq5w zEGR4ql|8cT`8iuQgCq-@5dnOydMms5YptgfPpNN0TFL|LhXk;X$9Dlbv!rwvJueSa zuH(#w*fxmJGB--rW55|*xF}$2{9w{l+CAsDK4Skh~``Fa-RfgW>uA#*hfQzUCgsIkh(e=%`e$*D* zZ0-Oa-?dzs<8!N?Ef&}rCnC&CLW;Q`k-!~HPeCe+UR-oDW$Uu!#x!wBp;PzY9* zmrFD&!=%K5AkEH@NU0rMy0tDNsJ4CflbFgg0_3C}k%<6;JW`5!{ z;NDrB?aWK#ACH*yEuTy;i8;DQw>|{8-25JAhOe;MHjuLO{}rSfbBgv^oG=1U;PITF=@& zBY%kx0S#`)iI5gt{zf=QE^RAUfd$-&{MQ4z9=~23Jh*0dNyI|L(MiQY+HX+RJH-Z~ zqEZL!>KlAme)Tqu&#gzcG#HTjqRnm7M}kBLMq7FJjJY$3XWt?5F#8^JUz3Nf*Vq-N zgGzWl%ATK2j$R)0VX5guKm`@H>Jo<#Ho9@yRuX^JeGDqlmmHjJBB+A)uIf_+az7 z_*BXV!;TAZhYHqb09+4s5ceaoRgDoah0Xz%rA=OeTNBHL#<-a%BmF9Nx8-Ak4$1Kgtf#iwwp5Gexf3Nhv z^#zl-eJ1>}wrY&6xJv|aM^Y<(fYYz>o(HzaO+qA#T1) z9&XP~B|}XX?jJa2V7LtuBLp!8%^!J?KMX7 z5`u_$`d=We<_sfE_K?Tfc{s=APR{GrNs1V&_n_ zazJ;$JezI7_5Ou?8%YLurc6+l$;tdR4g~zrM^K;O9Vo@ih%#o3Z3(FS0}e*8AH>ZO zqKK_840__`u(ebBR2a@=jyz^AcDn!*k@+Pm-g-p%WjEEUQ<1-7r; zS0JE-wT!<479+*Y%%s;j)hu~TaoOL%wLb5S42@1z?-yT_xJs43*Ye%?$D142Nn_om z|MGDDr7C|_RRgE<-(=ta!WsXna{Dh1FYv*?+^zripnyHb;@?;_{I9BQ?6`lAbvc&h z+c8pc3tAXX{K3HQDuCA?4KfsYVNz%O%DKb~(@Z!bwApAj{bo76V6x$;Ah4y`asC_1 zaq&YF#jp$;@xMyIaUL@Rtg4&dKLdXv`oTj)0yxBSCz2AsdKF-4&PyN!B=vFf;^}bOie!ac%%|LO4@yj3SM-2a%zMJ19PJ83EQ6|z448{ggM;pz= z5g}(qheH3{uB_{VkJld1TTulk4S7omQcYKnnKkc?k-gO!WS(`x6Vd>Z;$hy7`Vs|}=)nr79>#g>0l^K0!#_t4fyY)7bbr8lFEsb_5Z zrR-1o*=_SZJ#YMDf6uf5lKT#OD_y9>h1@5&04QBCrEy~|lF#7T$y>EqD{Zl&&##8o zfF~SlbjHxxL;MYpe}(g~i*i}?z;jMg6A|}+9@pm##WtEKSArP!%OOhhS=-DY29W@` zhrjO z&r!FyvFPHzs~R5AJ8DeLW$#7HNT%HJ+*#{jR$}5Hn=W?7gjK78#?xwz?^0}@BkkAP z+p_qsXONQJI2)b1>*Uvk&dtgDV}t&6Kh}Kn$g)OAxx12RS~-i$nqcs(JL9Dy-C7}K z&eQ&eNvcClD(&Rv1xqR<083%C;f7{dQ|40)D31jIz5YF!5gtjQJ`W#Le#@>X`WD`iJ~B>Kl&SAf+OD(QDr1891`Ofc9)8U$6di zLHxC@tuI$2lFXVh4@aI4@i7db{c7`KMfo}aL z3(T|sTTm?!CSWZFz|bUtjef{yWOVgUH_}-=SpOm{U!G%&t>XCief0cJ{hjGm^H1?d zLSHPa?8;5g_V@m&MOng)yw&~`fU4C|IPJMdJkiUTSzCDMk1eOeYETq62M zO_m;eybJDlM}zb-;{Ny5oYn_+zCuVEoP2Y|lOW{8T~?)c^RsIFQ|9W7t;Umo6kZc%e@gS3?G;o65^-=|z^^-lN6WzkP<7ipO8Sn_bmWMBgnk2u+=h;j4i(+ZJ=ExQ=M!a5EiqC!C_)~9%&P%(B7m^w*RUoqE_1ry zdIc||6xKEaeS}7$bhsV;wob?iXwGim;y#;a&GZ`rjAGH)^ENkjY=O&^-;8}E79jBQ zobLhV|F(j7?OQo%Fku({MCCzdif(1Zzxpzguhx?Lx+`TlWeZf6mWcb}bC#618^oJ# z-Hz<2dJa_5JZShJwji2-k-?5hFh(HITe9n1WegZ!0y{jR{N1Hq+? z|6(aGS6!2fvzWO0jG>&@fllR^AoWzl&a;!C-69@&>x;~L(Fi$Tu*)c}0OQ5*nSaeS zPk2zNi0B>>WxP;)eEftX6gc26dl2CPGvr=_?|FrbvqWjbxmiN|)TCEB&0Mhs+_c`B z&q)70i{Du$zDuXi>0B-D4Y!vB?cW#xXfA%Nsgue39z0Vv{r@!gopDVy-?|APAkqYp zE+8U`^cFfIiYUEH7bzmW_dpN@k)|R|Iw-w&2!sGiuTlbm7?36<1}Q-ZKI&J*yawVT9L_v)#Bwy331eWa9 zx%jScGXuw^Qw)fLDM7%5Vn1_hGLC{ydNAW8wZFg57#>y|11fxWMhGf2Xxt3UHJxu* zp41ZHlQI%AKZ>oa*gHcSfKO`cKn+CbBz-}J||m_mR8)a`5?YnojPF;yip*s zaTZ|;%6VE-DJ~u)?FN+XI_DgB+FzJlFlb+3X|CF;>H!cznTeZ`P^Pn1XYks3FimpD zDP7xM%Lm!8oogEmrhO z;+Z|L%;x}tBPAJgB)4{!d)OJ`odH+>^5F6+6EJVVq-^V)hp+DkRD_d~M}coXpt)lB zZVSpx$6D|%(O?qekInztx+Cm6>)KfAhWS}LtfO+uQ{wequpYXjgeCuAA2U^Cx|95Q zf+Z9z^P`^ksS&^w#vZDXa`yJmPv{oB-fNAYK$PTUtjtAmpoEsL;8$igUDkL50#;IhtqN-Jmb8M)O$Yy))x1qBdD)TbCOtu z^gy)DbGnrz?^&K~JET*{^nK2iPeSB<=d(kPxdPQcQDT+tz?Vq{LiVM~v<7_&=)JMA zr`9UVF#kmMmcsMFyrhxtA(l`wnE{iOc3st|1S7tCyG%^84@P&0H2StZI(n_aX*&U$%yqj-B4G6V>NHdgb6|Cqa^LBXv>4&Zl_M!8zC%07Z$JMyy zfn*f4`gVS0dI*0V_cAmKiWlG{zCzcms#~;ZL{NIW>iVNo4%Bd`( z1j-MXv)B|@F7C}Gqb9y6LzCXLJOn-nM#8~lYQEq83_Qn0qVFa-SbM{(n1 z>w$z}dxoUc6UQ(qx827AR7^|`rC|pLIuq(ywGPh$`anq^(B?q-U@6~7D}8Nr=rNhc zs?wo;xkbH29J{>2QLw3U5!qY<`D*D2>GtGTDfZcG$V}po_R^%%>^g-nGWWii+umme z3b+!g3xV3{r^>Ab4_{xH_+6v2p1C+X(Rk{sSA6Q5mdB7+S&^x~v#Mj#HeU0D#4{A! zwA$!qAe+{=UcMf;p5ETp=P9Z42ZdwojB% zirS7tAUw5cZU|CKB7O0pA^_p0-{9a}MC-YxvZFg^N(!9@%D@Q2Nr}JAfK*OLPB<{K za8mC;fNJyXu}yd*2oey$DnfP-79;kDOat8YwO8+qBn%84Lc=Bd9N2n*B?u6%4F32? z|I;aDaryVS|HqR(qiy}Mx_=)#_YmLSW`IMt8gkAZ$L_gl9m8*>(3MEIyFAO$cxwGj zvhqzcwUvm&@KIdg&fs!|b)ZCvZEN6hY<-AkicSHC@4AvzeBT&2!trpcov4X=E<`B5`z*LnoSIIrvDpaL-f0M7iubvi>Qo zORFB>rIgOP6W{i0;&X$PwlpTI7qP`dBT80{gJV~O6^iF6*YS651BgBq1M-|Agtq{Z zWq_LKr(}Puc3!Dv3tp`t0R)An9KYl}ER6@0446V-?R=^81;A`knaXauItyth%{P60 zgV&x%Px)!KKW0@Fwc*;z2Lzk8P92|OduGY2EE^x6y$B^jE$-mnl=%J}=AI%zAM%8j z@eiDRO+!paqW*`EN)Zc6!h4F4Tg5+>Xs5?)V?yyzO!Dp-l*R@ zN3T+lyTv+%0&9;*K2Dn)C@`IU2Slj~-7m08fl|!vC2!r*jO_n;nLZ<)IgN&6!?v~u z?ND$i?&vZY=m1j~WUKXJQ||FQTVOUq7k{1x<#%&5@S0jfV2mt@ z0ShZPO|4t_v|x$9Cjn-br=qbWn%*G)z|t+N^JLlkV3tGr#g!XK&K_jFEsXThnh-5S z7JN~FSrhceiE4gS=w^}`NE^RTp?+2VGL4Ll1qt=5Wz6$9^KN>fw6vuBjaY|HHfpf# z77sazg~m(v@^Ko-hjhsL4YR4D6j-HthuUqu7LzLK_0|BYjjnVp%o5m5f7P7C!|~CY z(j8UY!Zr_$I79EK)FkdM;Qch8ry-e8Z2XmU9hSDmFLu9s@ZR>N+ZV4~0t77p#!F-q zAMIzIM|53$RXRR}uT%2(E;Z!R{pzS*S7n@+3J~sH!~%uH^a5&O1S?bN*M?CGzy3uA6MIh?LJJ)BGgSw9#7$S(Ept z$W&r=avA2$Hi{inBwkkNL7OxUvKUT*r>caGxKv55`tDt=K$^1{gSJRwWjm4+3+Yi? zX;~dT)f=iwTbZ-J80XQZ+m4qZCOx#0D(eoz6-Hv&wScZ(v2bT`! zK~rbUycDoC9UFQr2n(RPqegvY3@idng6oUPRzjL-VmPV>koo$v6GZnT`x3LgbRe~( zTK4l~gp6)vt_q2c4e_`3{(C^MEd(d|v9r(MRgwe2s@r8?luYu~H4Sx`a}Q`$`p2X0 za&`1nu?7RSi{p@Y7@#L{C%UmUig}1e-oEnuouQ*3-IjRIBr?OTTpakTHl3&XhWcsS zpG`R{Sygc=`}fCd(%M{@LJ-c>{?TTKl6| zaKSw9v#mZ-+Ox+s_%K`Abj>`%pf`3@7bUJExj@301i;d3fae)|6N|%rbQW0VH5ixX zx}70C29DD+d^zG+`hK@yTEXT; zG4DEn^}BWDio)pecQOyq9ZYb+>R@xpHQpa&7DMNyN!)rv?j|mr#gX#BEYu>S3zYP{ zGnML=k{`F-HkQyY|ZeQ%CN3RtAQ0>9>#B`!_wH1;N5xUwR7T% zeBRkW#()ZGLp<~<8h;C-$~hNyRgK5khTW~Ys5$H1qRToMPymzqe&iR7KxApKW!1E?dE8N34Uni;1>Tt!BWK$f6?@{`p)KEIV*mfK~-}xKx0w) zxyTz#axN&SkzyTAO(%+COhC$S<*hLn^2@!oA5VGqAk$Ais~{fbDws2_5OZcTWx!xR z1ygwr77rM#^CDCWhITJCEH2#)T#TTs7XHAmTuuGtQoPt#RnMWlOYzl0vCuyWmNT5a z`xhnyz5GYOpPc=lAn(6_)A<{TIg9Q5h3EhA)B($%EbhykkWcUOLV*~<_wRSCH2O^h zSR_S9LHBj^LdTJvB<=v+rq1FRe@f&9FdTE|TtJ}gvkrD@oy~ zqWh~t+n48up@&>0{@I3mtCa5Na*FO!RzB|BNF1IFy%GQ`RoV#`V9OZUczDohq8RLF zQmFL%D$ogZrG`!aeGiZa|7<{4cLr=_e)Kjc7-C~5iU7ShyAh3UkF~e0_qE1RjR$fFBmus8oOH_ zDLCv+(}DQW);kq!rfPsH-B^ywv5@fV`obr)|G}^UWQXq6p9A70XT*j-5c

R^R;N zgZ=f;0?e z6BYKKf1_M~b!u~2_G3}xA<7!F@8Ap)mXg4`DCm`Pp0O?c|)m0nuGUi%yTsX_<|;aIf(& zYjbil$B4xs^;gZRGjIf=gVc$r}91E`3iQTrgTW)Bq7B#xd()x^!OI+c3y|{ zf(B7=0LLCevAClxZO3;XB-0#jEdd&K!C~2^Xyo7AYgxM`-_#5Si9-!=dx@O!CWu=o zq(Q$r5&o7Il;R%NFdC`f__aeRp07ciCiSJjCN{A2I550zGedW&;+achI+U8Xe#h9R z(%R;zAXl3D$0})$iNmQfc3P>X*off&Obcf8mXL->cuTvgN-!CvhOs+E1ic*ao7MO1 zSD-@r)>ro3iE!fGd7<;b73BBVi$qA)KjSn(CUZJlg@yskJfgz=2 zf%4oBYg_QlhX`nf{Rb{NmYxzU#jf|Z_7C{C#E?kw%gF>2r!F%_dv0-XMLu+=!i@w- zbxF?`T|oL)xrajP)3e7sA_? z8-X<@2IR3`fPc0kK#6$&&0{K9YY|4?sxF1;u^w9K`pjvHT)M-l8@MK&(ERSu+$PM# zb}l6dO>CMxAr`b*|2km9W&KK8sV-o<7>qk?*Db9zsQ323oM4{1uvprk{uBt#hH$cF z>JLx%RL@%BZ{cL*XR(uxN^pjfk)PZ_j%`>IdK0rL<2rFxMPc zTMMIWqO|U?eX_#Dnsr7_ zmg}8Vs}rpB_dMrf7EfGa1-eZ@;x#s)6vxl$Xu|rfy&@3%%*7^Y;VI+14}N%bc+87v zRf?tfh6-hd>zY17dtMxkzE0l<+I&kGYP>#CHNeY&EdTnvPL{l)l+y(<1^V*rG>u%h z5257Qt6SEX;9mswreTHjW}1Nv(OP1%ow7e1DVha{k-?az=#46g2LtNS+UW2e+&+y| z4Ya=d@UW@CIX4n>{b{T>KZF3csOa+*LRwD}j-$!xOmI2*TwOH8{Si?Tjox840Ie>Q zzo>)2;0yGh2c+mYMTg;3vi>_s@)Najw2$>4<7*>uGw#&46U%UYy5p9i*O6%`ZDi40 zMORRB&k3Ry1DbK=8rOm=S=FSJ)~l4KcO6VShfNI;mbBnJSF89{$#%=?)N59}vgGd` z$jeWMrY{027+}*C4=tz7MWEhdoDOBdmRi%ENG5anaxy7-zz=)dqR_IanU^KXNAxtv z%sL5UHwbhF+eaC$8&#@}MpVdi)p(~f?S?fDN1~M&Xj=B4ZM4|iUVS(zrarw`^I{Z1fDou~R z)p;q7{gWrdf zr=g|RrZi!UTW}jL)o`e$wo1olK_bY)J_9w3R!Ts37{w=mP;#*GV?75{=DzArTmE!X z4@+12<~2|Rei|iiy_4coZ6XT`kpwY|E9hQvI=bC`sM{6AY!_0d6zU#W6l#%Ueq2r? zl@+PpB3_90-7UiH#nXcP;m|T|I@Sk}pN2$#p~jJXcI1P_)pyWVaV!4^7eEy;o?MS? zPfxE15g)OCSEUvd#3?a0&LYw_X{E9_ytH})JA1VWL#4g6n=6kp1ftTPyse%))IGK^ zeM@5VlKiDTEo7#g5a*rb$&05i!C$p>r--3igy%ODM9%emiLFa{TQOuuLwJ2Bt_P1{ zD+#-iBX_A;!%3@X;d38}C%fuiLUPJe;Ln zr+ZPbku>by3v9~DRwL5W97;8LRPJRtr1m`UxPNoQ$TrNsbbv5^XH4;4Mc1fd)QEi4 zI#-P>y;Ev+`76-$JzA7op)tglZj(kTBUF{mT3(f=uzPxKD|l#UY-~X$19TIM$nJyY z))IpK+1lHsmrit5-!5eTG`l?5N93$0KJ;aT87r^#%jSZwQjm1w6Ha0fVP!$s^{w(s#|JRoM zIeCyCE?{dU$}K0WHrr_cwfr7XhT(N-H+bKkuTk_Xv2N%9x?k1*yTAwV3~vI+GNv*{ zlaYrHy-!*rY576ozKH?fH%7m#=&Iwv8)5f9Lc~(fMSQ1YX?N!@jjd$!dR-U}4DL(& zmyB15pj91Mmx9r+!C0WwY4Dk^Ni4V`226S8Hl9INjrZpghHSSV4l*FrNM&GAny+I_ zkMmD(Cc= zH<23kVx9kz6=O;E`$u6kIuy864~}zM8N9~4XS8ZO)|`|}CcI2-Xp|1aOE&<(Z}?616r zHa@~ZvNsIc+;-_0W{I-tsc+6fJ7=3UNPeuZVjhKp&H*dpxT=H=O%zUdG8f zit5k%i3!s%Vb`vBvHsMmM~m3P30qnj6TgjxV!L&Zotp(VZ4m_><23R`PthAcDv2!)r(s6DfdwIL z7kmq$amlk_wx0Q2uWedF^8&`q`{ zEtnG(mS%kigh*xYI}1`i3U!XKLA2p@>acq3C1I{8L*m@^SuB*v>GxE$QSPDtvmm|X z>D6NxR9FtZ+8I)gR(Cz9lzdfLzwx$pVdaPaNm^AX3}vYo@K;4x&0D z%%N!ELjE$7IS>2w!4&;4SBh-m+;03)D7NpAJy2|5mwKFDk{K457Gkiv)v~bY^~Yc|wm`z;%S2~C zhxyoobe>h=c1>R5Rqz4S7WzqLL`r^<8#bjSUtnh2=Dx|z%RSmb3ByjScvL25vO0;B zy01b>CAE;EPjlKYmxSfE(S|B=l32z2(U!PYP3%LpE_7>)C?=43Xk10=_JUsSOH~ck zRi=>d)7HnixslK2PxW-QbdLSgw2Q zVx?3l*3I@nLfFcSt+XiE=NNFe&VWe@Nj#0X57f9^u8k~2DdEF zW-7=zPb;(87@PrQ+auEakjdCL?y6orfR|xR0fS@6e*}x-o3SPqf$=Z<NQJWvy@ zv_cZAX{ko;p&-gq+VFAup^T{ArQM2IZ9hU$At~jYle+<(8r*fOX&_SNI5SE$&L#T1 z^K$pEP-pj^wS6d436};-jg3iiaSga60xXpHo!Wz87mFIsjkTPBbLO9GqGDf?cWfuN zSW=jgcyIzK_HZrE0_I3IrAK0uCp6Ykb6go)RP)!;Cx>7yqyQXQ2KKpWP5?A0?;Tn( zI;BRx_YQy$$d=JaaTJIq{aqk5!XI>dqvDDpw~IM_g##tV?i?Z#zy$yPLU1OfeAgl~S+72XuomQn`l|Y{`&c zL_|XhbnN8h19@`x^lDi@?Kg;IQ#3#FfvE7;ie}j$Rt&e4js7((E%WWzpih_fiPgEEjuG&CO&Q^R52po&`P6{otLurFIN7V;8| zfyhYrLhn@f>~^V!3YOJVvm1yV`kE@BN!I#Qk#=(k1^g)A{h1p{dLTc0yXrG}a=h?t z8>UxnZML)qHRAspVcsj7@1FvVedPWzxw&}~93nSOw0eRc$XHMwI&rfpvXK_Pv=A_4 zj|sJ|X~PvuzxXlWQbwrS*XfkCoFBJ>^U+aeH5{9u?3^!}_Is>qF zr|h^(54!np-TUZ$L+ABK^|7(r#K_N9%RiHRy*n#bBDnko3f=;(BVj1~M7 zU>W{tJjm*^7g}|6io@`@TvEA2K7Wyk>D6nhyXQ#s^uli&a)00!5TK_d%OeTDZER@B zO;33ZxBy(bdzGH@pPRVpnJBLD*E>MXc~hh;I-$!j|_fO_#IY#>A*oI zJ`+Q{-dz20df@o;yJeg7OLbV0<0oAs)2Y&a9SKgP&NC;j&)WUJ$mHQX(+!1RS+1a> zHhO$*nGYg(kdwsE(>jqL=5&(mm3=V;d>K9)Sov*V7e)%YZ298jji(b3ZnzESW~6Nb#WA+9gJ#s{_aT$%q4ZHS>RfIdBqkq!*|Sr+SAsMYTa1_{>fP>ZxpAI&lhUgc2i z<-PoJBN3487Wl!z)4+ls#A1aWeWjk7)2krlRXL||d_>zY zsKE@a(1&Ei_qGkp`?zbvHabch!?JmP{frG3c}jou4ka_Br2OzrP#LfL`g`RThW83o}*h>aH+%%f~{o-Roe5|w17*U~y3Qyb~W?z)7=vV%t(FEUJjHB}W@Va@oDs|wt( zGYs|?4-^$U60RzKVZAGKA5|os5P7=0iNc z{aqu!)QNbmY!NfK<7jAFn0pl4WvDx*La1$tR=E5bbBPf~(m_W;y#5j6Xm|-OizA5! zk>JTm;8$MZ{?8}iWh5^n?7s^BtImxp(V+h-_^&z_RsL7C|Dzzu|E3$D@Bgu#{}|6) zMGwTK`EY#wrHLE;=IxWyWilk@$WoFH&s+1@XK6Oh5(+)t$Zm=nY%^2ECK`FGbG8Lt4OhZ2(qB`*6V=0D4nTo zJ#?DgJ?WNkNKz^Kg$iDE_<4l(<$eqO&TY8)EB$b}f3aw$>*k~nA~3bGGUMx?qQqY>*sd9-95%l;GbN>9SnF{MgKSk9pk)z!KE54?nk4mBD{?b z^Y~MOx}U5!sgmmiEj65<@b@J($+tPAySqotXXSit*6f#!Fp&EtvRHEVYdrmUlx5J2 z4c5RByLFY^E zX$(yj&q}uY7}6hG$kEfEMmVj2j21Xx+#0mcYnS{L{@O*OCvv884DvKB4!)q}=k1VM zO?D1;RPh|{$co8<9j;IHCMoMky`l_NRLMc3`r-VJH14uo&R3baQ<*_p`hze2v~{5& zp8O(r!@yEwyzfYZ$m0X%_{6y1dXhJfgVmKxE6Q@0vcEIJ92FW}C}|E-A1kE^;2EB4 zY{m;7H;{(V)4biApjr}LABhQ#-C*S6=ho}e6M$=%SI8+x>H3@5-yu>hS==h7z*P^f zj?`jnkh)#ry#YuroI&1too#|;*7ROSM1_*Q431e48K?cM{iNF!WH{ukVXAS-X*OT3 zAI)#Lh^+)?RiWes3XgZ)-FyOA)zMr!xPz>vhqN_Ro(w@@{WsuYJgalov~oe;8-%2T zeu$6eHdhlD`PN0OYF^pkdm1+t>ISW)O~x=q%hp2EMujBsum{ksVqKh#I-%tb>sz6P zTu(f>#O1^_6PmF(yd}a>46pBnk?LHzyE)1A3MV5woW;%V8zwp0{bzp_nYBlC(;jwP)L^z;X@D46AuT91= zHt~?j`e|C7SGb&DsInh4A+lVIyQo-K?`9m5Mpq$37}f#F;^4H7|Gwp`iniYE@j=M{ z9BEzQy-V9WtP|x0Rm^oM;P#WTCDu5!@ETey#mWcRkzWrU#=0&Gdwrc+NEaQlc7|2IX+Egdn>?va z;;U8Y-=pn>axucV5d?;dtSguPxdvZ?DP>KQ z10}PPO3fT?G@5gq+x1KAD7VEczufSm4J-|t#iCR78&@QMb(hajfI!J!VXP9l<#P33 zl^FDQ#hR7uZxZ){q|f!tM&pYlc={YJuO{+DQw0VP-f>#A<(5>`=N*Zuqrlsr=@-(=I70E*6H@wOOA0b^#w7@Mh4Yk&I6J_et4lWYrvZYa13|GQc@{QVu|_%kVv9kr{D>+Jp^%?-U>I@! z5=?iwOZPDWX@!DzQnJdWaPuOCDp$9jt&PD1%g#^UFLpqF^?`c=yJ)qeO`ry;Ny(>P zktq*gE-4haW0qH1eQv(iZd)FsRk-SDbE_ppy}olVPkOTq?*8MKhcL^ok;#xd8ZkBw z2Il*c=VB=VXM|$Hj$yAFes#ly2_^zY_b`J8`0LgD);)TQ3HJFF?<=@CIfa$M5~*W- zng#^>gOY+YhVJnC>%;Jqmrn$4lLpDse>_C;q-AVt#H0JdGE-9ns}k5eJ;fNR$P|@O zq(ez1FFLR$&cgnNKeFIk>l~IFtK^HprYyZzqU^$xFuX>Siw_Mvd846vNNYhkv#xah z>1^iN zT#^x+sN2ZuRP+9wFK|~g5v00w`$>##WV2gj|C6Cq9@o2CDJ7g2t(0owN#7@x#CKz- z4-a1Cciy-zeN~3#T2bn1NHK=%52 zPGqGM;w&LHt895qoZAygi(>Xzo|_pbEfw*2ZVTer zhhH+4D;MxP?BAfO2{lrDKE4cIqU&~xk z@41nWv)V@Xjr!%gzkMa-$2W()!kNqsAZc4%pESK!%fw7L`{?F8N9j*WW-Xl@jm`>T#rMgV%RQ&T%|}s-TY!do>@6JDx3JXf z-sBUplMw^L^V+2@^0_$WW#Vd(*c-&OuK8C}Xdl%^YURF;LACaH1dgHPBq1W@+1x=m zaK%fHa>K@sv`emQEwMUu#V|D2y5`wA76Pv!Eq;Iv%#?ZTO-e2aFgE##j()QSQD!C)-HwL9~PiaSU863 z$`SK8-x;7|gnksrJ7J~M+!Q-4FTwG4n6karXVmXDMKD{^WQ*YEr3G44P3g49k zF1q?*LCxQ_)5kEow{w^z|45aKEfd4{s%aK)U{|!u6m5zX=qW5@CyR?RrcTja5lwRm zG%=v!LWSco+vVp+bP@^`I9~zN5!?EmP0$dB4#~x4a96+C(64TXl$2tOP%OZ7P+S$eSo@JhyfB+R)ezirm` z;KOU2pK!wPPWdyyKIDB<4V`Q(;V;q^0j-j7iPz{A@l6=8g$!@$q3nE1^`JmqT0q4W?fjRV|DqQ!THXkxeACo%|tQ%FefyJ7(=~=QezIO&Sv!_@Ml{ac- zyK=)oGHWWkbgw{f1=c7$2;;5kO_-(RznGzgzs8lC;Q|M^^Ld0E%cXh~lZUvy>z<|L z9~nygytbPtcsz}FeRX>5?v;Ct0}5vc@hOK$6Zb83bX*X$MJ;pm1~nW{Cvf2n zpt9Lh+R_Y#))`#2DDCexdsAUREt50C3B9qi=njpZs&ZE?aEQaNYzZ4I@yTrNBL}bC z%68|Cn7zDVPRwsv0BaO-N=AY=>eYE*#nd=^S)G0t#F(X*Z307yoehnwiEYA0 zG+d!?2430y<)ZjyvcPmn*C+?2QWu2hgL)I`L5-?0N^3Di2}bPAYKFcUPTj0si=1Xk zH}%I-N;~2fkTT>)CScVJ3B9Lz4swc(a6)^Abr!!@!^X#ST3x+(8p?YIsUX*{yKjw7 z^v}oCBQ%aFFCW)$a_Oo5;D+HeZ(dv>+QTk)*-ylEx95wwKmvB%pr{ULpgs zGa_lLyd)ye)C3BSbv^|0J|&HjAK88T+x>bJ?Kk88tzBqiByNGAW;o!b=*D~%SlVkL zS9{dMT@YSX${WTk)3h{qH!H{EuiZ)$$P38QyyAX5=J^;QI+JM!p(kjRt;pwkc_N$A zzGZC%H-!&eEWxAdHv&tz{dNa#q~U}C0f$mx`Op;sjT!5?1zFNb+TFrI6X;xPU6?Zi z2R5Y(2seE?6Hd>|UGHBwTrPh9cy!=bfCc&I_m96u5`5w5`S$CcU@45S0(E1d zFlyv8eHMk}qxO`1vjchO+8sb;bYJSZ;U^|#E_%8aXSv;_7bgs@-Ev$x+Msb>#!FVN z)a_Zyw+h9@C7Dt28*e^V$J<+XVOQd)(?p^Z(&Z8j(>x9eZH!0o=0)3mqK%eCZtV}_ z;>5d34GzDph@CzMc7Jc~=OEuO=3RE&^X8h@?ME@?H^$_}%sL?aRmhp;z^v01*Tt4| zA9qENFUTJ8#7$-(b0Mc0`^T=Klcz_pJF!#-7o3c#mLPuZ>|#>JsR;4f39&7N_KY<` zj!s@srU^%t3AF}O2tv^7(!ho~XRlG@uSANgc23OuRE-eotX->8y68$` z&`gYgQakZGEhxM;D7w503Wz!4*vsZo{V(byo;iXpLq3LmzPmLvB2RgCnQZX9a{ACF z#M8sHjr_qi7iw%`9$C-Sjm%d#fwwp{%pjrXE|UY3g`ETD6sFA(C)us_{BT=CBzt5sl<`Z9Q##X=JYIM-dPGal!1T_k z-IF>}K{FPGz>Md3UTIU)^2(1HB)ea~2}unsXn}m{1?fLx+Q2x{u&|EU&la|uu6^I` ztnRr4DE7u9V$iqa(G~|N5v1}a6Iiq3ttu~(Dj#F-vnpq$eE0Gk%`I$0+a!*uW88Zy z&Ru2f&tp7qKC!0SOr2TTxg*M|nNyW;^|U@Ajw6}nvl_61tgx;0)1T%R7JzYOZl`5Y zNJB>?>KSXU^dvk8$gm!?dh{#r5G5{4=L1Ool)PJ%=ABlr-)#g7`!}QHudn(IeZ*Kq zV{At3H_W1C}Wd)}SvIrSDvq5)BzIpB6E6{KewW)@ZV%<*xkG8lR@OI}cwzNl zZ(gc>Xr#s3Gd}C{F3Kjg;VwKZ21CFTqUk9{L9@%@?>~ErHr%4@fL!lD7+3DhpgVLQ z3hF(-1Sj*{=77-t{f+#K?mf7z{}w!loASU zCzWS`Nmn>yFIjm;lkC23m{<5+8~-qh+qBaGJ_9m|$k z{mdZh!T#~voxg8}YaFf+sm$Pz@?FzP(;fDUMkI)=M5+nefX=wdF~&~X0M5rr8x3yB zV-1Ncu;nhFjVlgr+RQGCl8a9#2yrB>rxAlG_&BG+()8v$QvrX*_@*eo{6Dzb|ao{xVW~ zOn1}hKF@t>8p-3z@6D_+=u4JGUl|*{&e;Tr;Ew_pCifkGVtlB-$`-YWG(O4nxT>yO+0TCF;UQ|>Tphq|Etj}oljLWQNCa+ zjxtVk1H00YoiTKkU9=+axaq97q(LxWEHB)KH+56nVciUBrQ&$~A>Skw_x8*B(uCCn zsJdSbU8qhwyShA1z{2*5QXHCbS>#%4St!|S;CwGnMAQ`{&blavGqww|RbcWn4 z4-;^ZqN$U7ncC*sfue!V|>SIy}rDlh@E& zsLHVx!vo?bJu1p*WL1&-rH+fg0nuQE)tgKVe!^8uo4~`gOdXrnfIvkTVn-r*Q6%Sa zZ4#x&4oCbIr40Gy_3%hAPH5HAwvQ5QIGA2uX5^z=#vxpk`*q1xy`i1kY~dF(OgbhZ zJzbRTcqaTHwVm3M~!JfD6%CdBU~Q0+Yp+_P>@4N1R-`0ckm3MV#UZDX&f%!i6MJhz27cwUmQc$nURUH`S~OG z2P9mlRLA_G*fr%w28k#ijKla&+jd~k@K$qgDtaRATQrW`Q&K-Am+yCO zDlSjkDl`)Fm%e?X+O*LY|MYdKl4f|TSidX7h=Up%u9^{uxmFXI#dz9CBWxa$~o>D*4YybzxvsG*Im>QQ4eW?l!Zqk^6531kFl#qoGEfq*cOjnRI z6t8i+o|?5^YMZp71!K&>CylOn{-7slHqX!MYJ~ZU`Be**>ee^O?!AcX4}}7d`^eJC zaHafsQAix>WGG>Vrm}y-$H-!6OnmE$J4Qf+5>DoniDpEFux}5|Ll2_A8ILzeMVzUj zR|+;#tZz=uywFWv_c@Z#ZynuP6TVS#Lv3O_bPcy@e&9AdU3C*4)+PxX^{=8KNZ%(I zBXUJHee5k{V;6hF+{NjYE2`dyf8I%hmeXm?ls#74*ju&wZ!?57WyCyJ}cwWxbMbLql4wN%XGZ+vNlqC$$ zHrB+VFIG-_$GZYwxmYcQW%%mc1@D!O`sb9}>*30CKN-r20$LE@RvIin6t(h5zPtO{ z^h=8)7k`-$pu4}m5L5K@*v{B~&TKDo&9}?z-&;ScUDQW6_BT7wIv|u$Iceodvog4V z`E~4**H)15o7vfafFWR}Tjs)U6Ggr~O+ORX4_!Xew4!Lb+Xi?!2J43~mjx(C!wErg z8Dlfcdr<7cn~QCb5WPzVIde%eeNDMaY?e`R*ZKPRiwDpC=0AS30*NnI=r{d z-=WJYC~_T6mRi3ue8VM_s8KryOa7JT+R1$3UIpYI9_i371Wfw00 zC-4fFIMXmy1%q;cHG3u`l%vsElc&>6vuj9l*Q&oSOBZqkt(_}&dV)|=z!YQAjr^E5 ziQb8ffpydgH4nrb*OM-^3hZPbg{rCP^SV%jc6N4weR*mk)pgN2(U=JycBr*U#EWR*~UlD5{ED-`L zc1hsM{D3U(`K`?#SHfxj6f_+!CxdH`DkI(Nw%E?0wA96(27dpvzd2-46X3y{{yaV* z!5#=8JT?&Ld;(6;B<7!Iey^w~=Q0FTD@YtB8v92t>;wYPkltzt0= zQR$DS%14fhF@uLs)o)6ep;O4Cq#ih+x=LD-&;bEM8WaKRqPF-BWxh)SBbs+zkoAm_ z-QhYrK4FBc+HlV7jq93g8-*#5~<`-7^@6E zV@LiAHQcPF|E;g7KH#AK@Y#pa%|YC{7*@=DRdT$3cu#Fu%;;!HFyC@$L_^AN&-#XV z;{#!McV8a`hcfnnqe3X=#ADn!ak0P^s*sLsd4BD}FAwxXfW8k_MOa!z-8rqLqKf|} ztp1jU=a!V&FB5UA{EPw%bpdj za=-rP&d2obR`Hl3>tI)+g7eNy$WvZMDLxlRuL$#klG>5J+Rjp+KOu?{^<3ZxRU{1? zOqXe~YY2XV>7Q+!=U+>Tm=BFLp%}>4)8#=m?zmeVh+hS$$b)rZd8_bbLWd8b+ z6?Y~$y)RLGD z4bE6%uc@dggVrIjJrZO)1&(2Y6nF(9W*56%=ySxsHlC__-m`P(Lg zw@Ur#mK_J3M`lH^BPva7_gNfjZa_q{EeA}$q+%xH{Bh#PN*((3tvc#O%*q+$lFIFr zqF!?3i=w1qWWDoVn^9kDxxf#&3vP>nHRC`_5`@nP9?*p^gAE{E)+!o0^$Y~`%&E|l zcT)`Qwg{cw4sPb(8}P8Nbap;eu|$wMzVGmn?wJ0nk|0xv477FOyS@$+o`dG%_{4M{r3 zN$01r^JD2HOD3I)aLD1@ks`j!iwbJ0sX3nvV~22cPQ0;l zy@KhLlDRHfRnK&pMn6wrKKM`it;^L&|Mh-glAg#LGJK1iHe;WGde2~=VbX$jNmwk* z76REM^T{sTYEr6eW2f8zg%aI17n+kzLE+&)Ij!6i@7re|Zd%TY2+AS^L$c5ky+r%StF5VlM9+OMrfZ1iseC^_|Ms(cVj$ymDY|H9Q?;InjIvgzPrx zeCsEeSP0%DmvTgv(YJ-$AT7EjD890Sxf0N5+;O^K5?z9;hOw9k`|Gc!{#;M|a-D56%t^W}g;uZsE3}=0UybJgPjKzI!_DU5JTVVb3}z zzw1+=%Iv0)@I7HO%E7*g>?E}pUbma#mS4P9!~Hx1^@+6xXs!*uS{$6N>Ue5Y*Y~w} zLtYp6`qaMnA{6Sqc~=9)psJ6`0emi~#b}v!fO#-5Fgjv?CN2gy3%|;Gv}j#w zYRBmGVNt(sJR!nRTI?bMwiL>s;J0ns<(wb_ue6p5he*`1cQg0jqP2&xe+MRx`>dvnz{1hgFvpK6Oan3M7$N&^4F zrVgDL>q6r&dp)B&c;FouT*Ws4vg+W<#|E0_Fe_|HxKmK>*-3!M5&(j=(y00g1#vxt_P z?=%sQVj$M}W3vup4%4Q6-n&+KWK;_G(-KDQyG4d=y0{L?T{i9W)O0I{4AEcH%?`Pu zM}5s!iI{Zn^8?GHw8KRcg~imAJ@@2-OnB#G38M1O+K!*V6U>3a$BeY|+{3+NKY<$* zX+j6cw^s6z+#g8$5L;(Ai2I`47g16&HuY(YzW0`)z;6sMCG1V z3dznJq+GuNkfMh^f~+?p&Oxa=Ui~qCV?U_7Cmv#nFgcq?SKU&yN3j=hfE}aJ{Z7JR zhSG1?P);%tDH87fg3**@aO}aNxaHq3hR)WrwUF!)ukZy&+!Zq};5AtNdkrw-kSFNkBw4kvk8EQ#Qh(hE%Cvf%ab`exr9PXomK=7>ouXU56+A zyr12rnw-qN(by|Jf>+I*1oZGjZ>FDy1d0n~1D(4Blus*3`?18$My#<}>Rv=G=3QVJ zNOxWk9l9xAlej;ufKC?X!2;DVhSg6&bQv>An#7uVd%?N@Ks)q}u6q-L8C7c@ee4+` zF~j)sf*tCyvFp5GIK;zv-5GZcg{N_`nnV$TrPH;09i#MQtw|s?bnv&qqlE2+5t9GTNAd7#aP7fe33zM7sr4|viS)BqmjPxYl+mcUl*8wRl!c3%!GAG>Hq;* zRTWEdMMfbk8lXM8-f;Y>llfbhsu8D2lt(d=s+1N3s7LXASOCS9mVD@ZFQDQco&Rpz7EqTYtN`HR3hu!c@NKK$3YmvBq{{lq zSi0L)KAcJII{yTs)zkw7E~0f+%fNGYs{x3XxFW5IC9{Y1put$ zg}d-@l)p95zX9 znWZAAT&>FU;33*Oz`c%~Wo_c=xgZoC`)wFzens&YGQqYcKv};WJnRsM1u!41p<^3m zQe#zjjBG*rLDM>Jv~Th|Y3%Gd**{^)sca_#Z%$XB!;`|hcV3^Y+pca?DWwqePX0

@Ig$tMAK}m6u!y&&Z>chzl^`+pCl1defwb*UK_D^YZ-bdx>@gP??b21vva-frJ}@iU&ad5C)pPzZ2>7D+LSnx0U+Shmau>#RV;4fc z)}>+gOF3!argk|o4iu8Gsm^ZNcx&OH>@<6L?ZB&NtiaeMG}`O+t84Ns*oz>)8}j~U z%}N5gX^eZ6tqikQt;a<{>$nq{T3xpGK}^h(p;;5;!%=IMw|n}hx&(DW6!>4036eD# zbI^C{MudLyyveN?%Ok8NtVQ>5k9~w>kATvwY(B;|ZzY0)UiI^Kb^&VdE#->$xs4$s zwYsGvVS}^#?p?ZDvMkpw29S>_`nXy!m76ZP7aE_h9#2k?Kh%nv_FXCY%c;;65gPc7 zXen6Wy}WdR=_q*}`x5gHa(^if9SJt-XiHE6p|gn7d`b$h`}}o=nBTsBCNuD? z{7kPRulgB)c`Q%7&(4H))c4afAT6|?o#4V+vWycp@)YkMS29TVBQ^FoUIL>}e^i zq|=L4W(ps}!~BpHM0PG`6IzuG6MHbrbm~4>q9UEkVt|iJ<4i|<+IDP&>5X2=ZtaOg`eideti&orc6~OoOJqx6T- zxz=^oD8Q8BTxJ%>3S}+hx5e$c-+uuqoUS7-{-Sy#J`@RzL94>zLMsFfEPS)mJt z_;m`KB+yyNi0%P6{cH4Lx<(e3AN1{AfmP7KRVISU9+Z)T35eZe+588NNW@t;5<#aC z2g*j;h5vveTyzp+A_ff~uwk?Mx!g{%GGW1J`!c24t;)97xfHad;K4Qf4GQ3p1~I|* zXQADzhYOIVeJ1dc?{SbaH4S3~XzxyAR2wcVs&-?Y&1e1;U==Il{e zwOD`xck)bgDmc-H4>yl)3J>M~D(+pI1yD5cC!W1H&ofVe(e5ackn5yr8CV$4HHjqmD?>ll)h}jLH1%~{J$#q2X}pv_|Gq$v6}mZS zPYKM-i>jD3(#t1&Y;U=4_wA`ljmH!$&Y1E5n2sCdK7UHRB#><2hjj8=I?yZ8QNUDp zjny@caF>No^2*xX@xrcrA5)ULFexsOp8wad5}fP6Q%HHs2`ILMdVT)>P_dZ2{IeeS@;%DDFtS+6fI${zLr^m(@Ko!1j%4fia1ImwIEeq#k zutyzlyDm1&9-BxwjShGq^vj(RL|y(o0#4td^O<&~^OA9;$E22Et}lDtsxoS^PYDmr z6Lpz;L`=Lz%qQF7Gp^_{x3Eh2f6A4#r`fP`@ME7E*Y~9Pt^w#hak1)3_2<&ZPK3pu z4GO9|IqV$Z2=~4fVQ{rzKC4rLnI6*j+c=pw3rto4r}p?b&!%aOj|1$x@!4>X1zf@) zU}WX{3Dc&Dn;NtKATw~bE9U(Byh;2kT{EJlmqMIrx!-Yc*50FL22Z(|YSFF743m9} zo0{rKFp*595=o79l(SsJ@%s3th4!cZ0;ihlxAu%#xiP_Hb#Qzxr$2;xA<@=SZKqHv zd@)7c>IBf091bu9-gR-PJc}S()G&ORYfsQ!NXzJc6&1!XUXN*eNJX8pP?j!>3kIV3 z4;#E?+Onq9*(=WflCfLuDi*xGy(=o@1SAIm{&NpPfrk;iJe8b&tn)C&qV0>N>-{ml-@5@JhKnW95i z9RN!-FS&+afF=8#Jdfy$WIkc?qV{We^8p89*Ay^%Ht^wLOcy0_QRYebPgUpNSF^0P zWakrC7jl+#vqM6^Gr?@SMpI^4e?}M{Qa%D)qn;0)j++Wpl~x{Eag)Ql4dJ#X=r(=p zeonWKb+p>FDTYiil<*aSwRCJ-quBU_G%(bAXd}@xz+$ zrmvMc&A-O;$`b5{kLbTZ-qzKZlfuJdF~a@L*#8?$V&}0eJJbQ8b*g^HR7VuuQDvE2 z;luDMQzutbNJL^Rk}>HXx!vXwk3wpLQc5oPk{m|ZXNnA`G4i_~GptjU*RBV6Ad&ob z&t1_yzr$Nr{{c#7Dt=AYem`?cYQ&IFTV2H}@~#*t}; zrjeK<5h9f{+zWvEGkv6D^Q`gEp{vgLgiIEgDg8%c=&e3OQKsb(DxY9S!&J!TZTnpy zqGO6;*NNuI9Q3cI8@qZ|4^T_ZdwO`@MPj}tx_ZO5Q!Cy{SLz0w%vK#_v=u>OSYLp^ z^M;R09{=uFHFmgn!8{CSI1m7qgl$VKg@j5QU`a#+; z#|U0JqriT8{Y`dva>Rz=Vo2Sc462bisU-m~@w|#|l3w3a7+6Up2G#y*zTgAg$ya8p zsNu@eC^yV&l=r@JX-OIRsn5uWssKmi>3w)u%D)0VqrI%kn!TeVuThb}#UMR6RMAnV zN5fR>aim0Yqos*fcz3bSp@9baTR7TuD4*#mZe<3Tz(X> z*#A!puGM>sfBU0i@;H~EIDkmweACr_)d^WWMWfvVFcw#qpx3;j)}0*2Q#`~PCz(wv z4s7taQUu2;)ZGSFSuZ`vI0 z-!k0U0ALaX<&-N4sfr(nKi*t^p1IY^kLqs{D={&^FyY}>9}1ajFRbIBx`l$td>5dV z?G)6&+>OWkFT}y*q~FOkLA#&iea)`3xlWTN#W;*v33111o)+SKhztm<>Acmp!8SHQ08n=o(Ua>FsjP>?&dam)Tee`6 z(R3dBueMJX?IK8Xlo{|BJ4Q zo!fNo9Ymo!Ny+TBp(R^8|r0ibuMf% z)UIzaEYPDFH=_NoU$}y$4`JzE&_UROJGl-gxXa#8ekMm~U=IHV3&3GNH1v!U_nC9A zC3OB&BggK~>porIEd=B2DB7tQPf@?lW@gXr%f=&hG%!C_$!JBQUNcJi%syO2AUOZa#Flt-<2)~Wy1t0E6@BKyH^f!p1j@XS9$V*|i=#zj_HyB1d2?LN9 zJvTki{zR4Cfkvl1dEfn9G`;9>eEymJ_{zkf0AP7{cpvhZG@0X7`*W*radW%P_@^7Y z9z-8C1oMWIov_ovo%6{qx`*hgc{=A!dx(R$AGzUs`9w8fxS8Pt!04V>FHG|ad^KDF zq%2Rp&l}esV+}}!>N2hMb4r`bSGqplZTyUBgG~v|Km^%V0}q}$Ry&Tejj}f2Uumb2 z@2obQxAOpSw&;Pg&75>yWgW3AEnOzU0wo^_aFG_K)wESj_!%;8VV|7qtLY-T{jGcf z`&|g%@fMXb%;b0Ym8|M(`y#5t`{4E*r?%zDg`Q@$DmXY{Er@Y4#!XI$LFxrP2maM!-Hny=0xiNy+ zv9j9v&`rale7IF`snFC^VWu7)NK-4)jzQ1u!x0ZVga>sPcYoK@udl)+2DgKzG5TQ6>1bb*VKz$+%tATh>PR+ zy_JkBj!!}j{m#$V4eGuL=JhcF9Eth`M{>QUAAywGe7qt8Yt*#7DDJBjw=UWI^Z@*m zIe}*%P8OLD@0|(b%U;^mco^9os>`E#Tn}g&mc+4{1-bC_uuSDA|MxoU!(41T;L;iOP_6K#~356Z;F#*gYX2Z>m~p{@ndOq3BXDk zQf}T0s{Y!?;C%^w10Z~Dm7K{sHFca5sMS!xrI>53Lzn#@eJ4bzHNCeS5eD`s9>f6- zg5x`^99@%>h=WJ0OSir7yotp8II4PI=ftOS&%t?S002^i5Xqfw5Ti&SI}3&z8f-O= z+j+jfaUr-%5R&PDEn|^G@D7LykXzZ8)S1xl6!`2Qk2~{4U)qa(6-$F7dh|QeK zsg4$=_IN`E*YawdHLS(>xn^tQJ!rJu^2A)45#^g0X`Ghl#ycn1l`l0le{LjQyakFonJa3n*c$f#I-Tj*%so?%MKSE6<-l&4-#Sv@lCa>VT8WJmavMNEkk09K3 zo<#i%)$GE%t}RHgylBCG!v9|YiS#<@lV87=v(ybI&gN^rmlXrH0T&qN_dSG6a#_n= z8g*kN0BZG6D9{2>`&Wxflg;lmyMB2p#{^ETCVLK!iADqdV;OOh_uCQ&2wnSw2bU?P z%DRmU_%^^ffB#am^YCC@($8L0xoJqExO4HU=Tg~=&_Plsg0%QhiT1;hc&CK`QOnka z{=lg_yQdjSL_JBj_tw9NKk1CvVJ?@H@3-{n?$}$(dUe!smjUPnDd`(oiJKKmrT19) z>&!r6kwm;()%xj z#0}-LxH3-&>(olF8Bro%n7-hFPB^P>v1;q1`#0p)Tmbv0CshIb;A;Peaz43=#qETm6z-XZe={WGLO)X|&H>_QAG%Z~ zlNq_0QsPv(Se_Zn(Jyj?mP>I|QnwemqdLP|$-JFH=2MmlWMu;phO#DC+=z|>3wTQM z^=$5ORFh)HP)bPy;z3<1eTw0K!z2$Dx=L7{yF$rSWqsm`GG0!KlEpqd(Ve4R92K{n zyY49=Dxu)hs{Xj>OUoAkV^u3GrEz%#q`K~#XC3tU-Y+-Q{p=~xQkdQQ4@z<@PySbw zugL<)@aUNzyTPpeF1{qRi|bP#5HRV5s~-+_jsmGHs!H20hU=>mUgn8`LzXz7a;xE? z7UoXXjb@oChjIDK9oTLuukrXOWN6Q&ik+_2Q2<<98nL5>95^_73Qq-Am;I9S8*i!u zGCc69`>ymcM`>0g!pV{8W#(ToNbkR$iay)B9ix^`1PO>58OpU0z)3*WtG{(KBbwGl zsmcv|pF`XlV`GRl#BB1I?u0}Jo4B3GboH2mAB(GT?mfkyb5cq!G*HNr-xGTH|1n|n ztLKb%m+z5U$-K06C08bJH^Swb>#^sadY-HMQEc|{?~B~$TXH<-_+?!9u%+Ca1GK25 z?x2a;-FGbx)Ax2AVyb$7v!MCzDTPyz6(!Pby*+0%o&#snwsb$6W^I33G`h>;bqR1p z#45YYBrHBCfAc4yZj;97{oc@ly^+b3Imv-HfhUN6{Fl5-~&I8S0R z+vF9`$xk26XT4gb={zrRvD@tI^?$`b_vY7}jw!u*{mj?v|8H2@0cYmsK3u zqEgsDuUhlUYTcN3#uxU@1Qr=5LgyESiu{a`t$OM5s8(!t@&2FQU!M5Bu`fF(Db^F! z&t}yBY?*7?%Tw;Yt8V3mJoP=ZFSjvrcN+72YnI8Y=P%O>51eWqSRcJPa`&tlM~3Lb zJo2f1^L}fj=9)kKq_*u{RYo@pO$6LD-@mVbNle@pMMnB z?p!td?u<*ISy#K$p{6^VzRU}pBVf*(v(zX&bE3I5({l4Y#kU>p96ThW4jXLUcJEAX zTuRX0w8c94+b)FMH#vM~YeMD<@sKv2vsZOro&+u?dAok+taoo1firwlbAYp7#Y^Xe z^zB$0d+&{uMQp7ja3_4Kv|xw+>}&504sUjwxz#_<{AI@a!0G0vC(XCZ+Eo1MrG%r` zjUPvfL9@=A%O3Y_d7||SG+!tiu6EICk7ciJ^Syc#k;>Qi+@2iSea@~Rie>fXg@TqZ z&MTdNR@psA|7zQ^-E(;tUcT!0SSkO}+4BE~ubj&$ILEQ)`@E?sT)*b7{yG2ot7|6D zwe&!9_Aj4su}#yAo#=AOY-QRk%c^(xeXaIt2~-xxcRswhe4cr5-pte@ck$VOnv9J1 z?KuUUvt)g-Y|ENUBGaeL{&-&KE(l7Jo7fv$oF591fd(-JFK6BrucpcBJ zS+v;2x+$*MRC!0tQO|o-PhM%}uUipXkh$y=_i34|<#)5pY|9HSgsXHe*~92E)8dr0 z!|}Jbqk7<(GRjh@!KG>&?xraI(f54*SREsXLhChIl>eZ5d-gC70QUpAzjKR~@&t;ucLK6T<_H{l0 literal 0 HcmV?d00001 diff --git a/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image05.png b/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image05.png new file mode 100644 index 0000000000000000000000000000000000000000..6d80447d094a3d99f2df7d87fba025d981e88e08 GIT binary patch literal 18311 zcmeIaXIN8Rw>GLMs32kk1e7MdskDFyhzKYMh?E#YQF={)&_Wdy6r$2W2t`Cf4?=(t z2w($gp%{7z2q8$<(4?Q0=Y8IH?`NO0f1UIFJ3qLtFxRYOjXB2{_qgYZxo@P$&dSSr z=+GhdyLWCsICO{!e(2EQyT@685|VVg#-T%cMt5&(nFWq4Wd-}1&tz>nm!+?7SZ65> z2F*O+%)f=Wg_duDa_$+J65T9*@`Qg_au;CE2}qlhP(Gm z_J@&W!%tBf$66ht<4Rrkqy-K@g^yZ;FM?ZrW1m|z&N*XQ^`*PKt%S&Jk}|`qU}i_o zaFreO!L>u__aHMr4}Rm?er_@zn}q*X0H-L~t77AS-D%WW) zql{?W%GXfLmbo=`h1RIbW{9^5C4sPw10gHh0vYvAH>e?5o2*E-XMSoN>3XT9buR=q zyOj_AbWdD`XKsu14AR@t1(||B3AU7gmz&3sD3LOOaO7P~U*P^We81%-T3-Fb;O}j< zCixhAx2yc}!u_Yc3lA&2xmP&pTqv9Mfbav3hz+R|8P80nYCQH%i92tXAH{wsjbse^ zytzbKRbaUUPxS8{6gB0oD7l}6dU#-aVE)1EqnlM*oZ9+U4vB4aqhL3iTS=KzXWsuh zU~=y!W$FpNcb2yAbQAVN=kh9^a$qdZ-Tr)Y;hW}mmI4CP>3V;9FDp3i0E(ViZHM|e zH5GHvqlh~Ej^h0{zb=`#zrcg%Cax@L1U1{_?^dr9IW#Lir#t-G@5JIMem31R@+VrM zBTkKt`}lBor>^kb&x2-f-EM$<7v@5Kx?3!E1q;*`suoJlIV;ldo0QDeHis-Vg^X@B z>WT!FijA6=gmp zztE-niJb_A&tNVw<*|TXK|M(CO+C##E6jE4Bz;QXTSfa{lX=F!DT43>od%r-eO!B+ z0wp5`5u8Gwp|y}A>B(ayV;(;@C7*6L$|DIj`C-a+SdE#@m_{c$pG;Pp>DZ6f`DkA$9Hr*$lYjxdj8}!^&Lt` zTdUS9Ep~}5cgwYq%}%7G-Ue&(K>r<dJV0_f^tbS%HZ1xNkvcDwczt|jFlC; zJjo+V0E^2%;dYW@s=f^YQxf^=(F%AiSDFlRJkBR?IC7&DX-e+(2=vKgqRQ$QQu<4X z1?nkm0m7ejoJ0EJ9;{1U3J*0_H=ZCjjb|3l&bb#EMYu5uZ!Mk|gy-gx-@1tvafP}i z|G3m&AL&oHSvz5B>Wxl7fhmfpw=Maz`ntABt-tw&;3mW=vvi-d3nFf zGl_Ex%O{cYb%O62+$oA3Wggb9>{5d8nq12F1e<*O(ui2whIY=+H3Ki*-hRyhQDuAB z&MO+k&+l9xe>aSymb>cSyPVmwk=8e-eEYf{wS^sh88Bymq z6LUYjm@IewRi1}Pw~zF5OJ{^A(iG9NveEvqcwN=AZS)=ILRKeE19&r2%&ea5Km9iD zG<*xD-NBL47RzW`*L3rc4cl~!h2cM|v@pzIE%i7=Y-7N3I zraoGl`Bp)oNRX7%t4E5Jy}tNOC6RLVJEEzS_(OE3oqII{BZaPk3NzWa`XA{a@5?1~ zkT8U&?>pMim2YpI;?T{PiSmei zoBYOsY@3vj-bne9^}@uvhE6{TfyN2=k1p3bsg&4u4> z1zO{ogacb{%|gOY#RUG6^d~h&<3TyLTjm;sM~9Jl;QVFtAdh03nJnwU?gge3py%yZ z3AY#~;@{TdzkUIQ|7Ah`daV7wRs*Pia-V(n$p@4=` z(&6no*V;`jh01OJB(xr8l1|{=H^*AAB$r6Ek2VvEMZrB{?Pjj7`RNbC;~R#nAB9Nc-8#>X$g?nL^skwYGgYnUOmaR<8uXJ&qbGdwjS*6)7}Y*b!2m zaan9Ck>m-PSG3fXodmIQ%P8q+w`XyT-Ae?KUZ1>Z_DC5!s&nb4gO6i9QI*i%CJvrd zo9)`Cr2mkUD*L4lc1-|fQNAbRY*gTa@1K(RHZm5!9>eBDe1K4VuNNFVu|ll9QXn40 z4_LWAnRLc_q=Ll3kf*Jjx8=Z%9ix479M>^zd@Nc=Zz(W`WzAQZQ_cr6=RiD;%YgGa z8)w=rkfvD0Ln7eQ%~o4da8%ByOUuB(s;<`Cf}ko3@h-Z5$Il9*U&tmQ3Cobqlrp+5 zR`8dVdSYw;)3_l~IB)aMM2KwPv|*%R?})x8_ExnCrH0={$=n?OTSNO7K}uqMM#_wD z#&a~{9L7zA5INa)MP^kL+}Jis4R*@t?*RR#-IM@#xMn$Cobhb^0PV~T6-VX>Wm*}! zy~rn~oGJrmW`wm-wQJdqm$s!E&U#h*KLN3PzO`fS=VyFrl)CgsuL+^dGP4&YG25;T zET;W=g7oogU{&kxlq>X_pbnea`3IEq$JsooC2H5c-lg!{?!Uv$U0%8JEWL!&x--R- zzVTJwhgoR0STdpHRsH8Q{D^lFsSzCa8*|ge<=Y=gcEgH9(9&90iq~m>tk{IQf(2a} zlWG;gOsI2q`a{Ps2NH!&i`C7 zmOY}U_qk6d)eyY%yYbf0+KL_4BMD@k)wRQ#JL`56_J?j^Y0-v0oSVnT^zAOiH%Es8 zKCTYF>}Dqlr?PrHaxnJGf*(OWdk9_e7~h8#SS@bl1CPC$s32e#o73~?)S_zd+@Kj43g_w!t<;X|ZP;1MNC1qXhlK|2Q_sGy1t3~YECx**Bdfkl1%8@DDK)&b+rF&FKu|Y_i9qV=C@>y zOT)Pn`Geyr8Zku2TB4|ibf@Otv?e;~n`UERsQJ4K+|@D*eJi^g_(peS?0A3Cw|Q@{ zwco3)ou-}V{u88k>p!2rHTgoD8Iq-5kh$}A=2t`2@6*m8{F{8^8*s6~3HSZ&@&kUmJq>WjRvc z+zMcC@N&m)nfBW5j0|2pqb~}Vy3LsxOGgiebx4j-=N`XOY206L@@u55d^?h9(g01) z;7WZl7rb4kD@{o-^-=h~FhrPns~~SOUHg3j{^rIPq-<7JI-^_PR&;RegX)!RjrG`M zqji_bTn`DTQosF`-BO=CjzC9UD!Wu&VdMJ6pqF8~O?hR#VbITov-i4!i_wsF7bwuR*RY)*ip5{doPWU*i0!SJwxcK78522Meeh3W#&($67^rqoc#p z23Xz)$?{gaRIR+euZYOCGoE!71q`@B8c|Zf?I_ItE|=tt&U)EyE$%Sjz&Q7-j8!{r zzctQ=q^=baYH`O#Zd$QR_Ule9BgD#)W zv9>`!^wW}gqRQTAiZrmUP@^f@k~syUvGV@8fP5^lW^2}GvF4Z0;2$Q<7{2=CDKF>7 z&%5XHxTfaAo&9Xy)Yu24+fCu?bi=L#?z4&{Y<`ezP}tq~I|oXUKAJDa$Odv0S65)} zI77-Be5OS`G(!enjOY(8{)FOv6()x~S{~I43zg3MOiJ!q(f8BRE>?oKmt?&0nPbgB z1z22UsLp~pEL^Hnz$b<%I_T%4`JkNF7POTZb3|6){>uG<>)%V(aFpyfZn8D#60-mz z!(*9X%4PC5&JpW?(z|P2#BNRu9*YWSh~Qsfxf$1gusIca3HuY-yI`V#K)*l*WHAAI zdRPL!+)w81U-&}d6av3X6ew6(@O=$kXj8CnPlQfvmxpzsi>MLZDFZ~;=ucTQMqMfR z-QEyeQ?>BF@MLzim3PzVW&sD&%YpcM% zORc$CtH6|zIB=|9`VOV{WkzfxM%erU(X?ZknQhrc45?TiULf^wkKZsLc#!52z2d`G z0w@v5A4!&}kcMK97hxLQudgfJ%?`7{`L!8J5E_+&1%=kI`FE>t*2^MIr|g0oqqR0Jmu*4$UKs>vNCV8+*d33a7?V+PV$Ayv6lCi_-0kj*c@MU>nBeXC)g84J> zes0u@R(u~+%;?$VJa4GuZXIEC%=IXhD|g_FD0e<@vc|nN+~@Ig;wkU*>l~onWlsRD zf|||9ZfTEm3caGG@NM2Y5;{~rdaAZSH-*zt*H8pWLbE&wDuwNr9+V%rMPE0+?3DxB zI$vV+NeWJZ90!yG^`P9xxhoMrV`3;R-JUjDVz$70x(F;fdt3F+G9oC`>C3oHzSaY% zx=w-Cdhq&c#`~UbclOLij9)-0pdjC0^G0um5Mxc;506O)nf@S62HQvG$9 zk$k~Q(U0T!3W?hpCS-e^V(CD$k3o%QY2XFq8gIGpk4PJBDEBP@7=gy$`S>6vp)vKw zXnx(`NxT!wZF;|Zd*o50^at8KrCL6r?&`16s-aC~o_@*N>dx{R<77njY$S82a+P!R zDPSU>f0`!}sGjgK!~7IBJXjPyn8%|squX%Do%U>Wwl8h%;L2c0V($|JZu;Hh{!!&G?B*XOE$GAlXz&-N z^#5G)gt*mQlV%HA?QXd0!5ehWzNzfyj6T72TM z58bD8ad8qc3ee5xBC!c($8g(3fDZHo=WmqI1H>`YFlYnaik(UYG$tPu(@5?4s{B$~rbhoc5BND$WcGjYFr_(*9%Xw)p zt*!@Kt<}=D3^5-Hhc1Rr14s!1iKsNY_Rc`*oSwfxXfyRB|4+piUHhjk1`4*!pIr~=h^MO2pjMBqLNHs^UoO>c-sTtIf z?zy^9dogtLZCe}Z8XB~yL$Q;B8>Oe(sX zR5?$njE0S1E}vhD|bW zeE~hrQ&Or+@kqqC%#pfog)n(ttGgvW{%vM$cI8djUgfQvL|sZq`-ABt4wB9Nu#5(y z0Gwxr+83Fy5LG&tJyLCh2AMs1W{T@U3r$46#)X;g^ptpM2=N(sYeI+kecKHdSRw!Y@ce%0%((62K~A*r!#anCEy*y8_t!}5@=!CAtBclB7cNehTc54}n zCN|%v(A3x7xMr^k5-Nr4m8x5zZ|F7qQJ1<>1&@AII9G#sg=^4`@80?Zrzk=85b^jI z?W5b(qvs$Qx594h=**cJ^>jm3gPy5Yt%%UME+cm)*WmXoER+eAqV{=G+N6gq9Z;lB zJ_4J0+Ug}&XtcK#?@H5^s$sy3K|y#;v{D~*9+$BpNc@`Z@4UHZEPfe&4T#+8WW#8Z zK8~g>Vuo6j&m+%^cT;~H6>QFiCE~AU@2nMw8&cj1Q)TVwGzVAeRr<6w-?@)W^EEx= z_Y|Q|i8{6vUuJxlzE?t|BaifjiP5K^8e8>*}l(gD8C7unas~}uDXZVp*ca{Oxqx0b%aDa0aaV}N(=;Q-m zgM_O&;iK70P9uHktpTa8wH@celss*yP3z#(Q@<5c?SDxFIN z*f`!s9A}@Pda-|$FQz3<NYBm(ZRUd5hPn|;&-8lQUP+x)wA!mqfc7`GJDgydQ|RaT#z-LcvgEa^Va*RWfwtT0~u+U ze8~1}MED(Hcvk0wyIMh;`vwlQmSvDib-4_oy8LC)wOZsEH;rZfs5WHpP2H^|ATWvf zf~H?9((MOZBT|xv3uWK?=YtjUTA{u(vd)u_R_6q|@~v<7J*^s#+b{cMWMi@%l`V1? zvHHLi)Se(4x-vSkHxTu*$XL?e5`|fj1TEXUeT(xJJ1;lPCG|Vl7b?9jy`KHr1LR=d zq8q16nX0Ugc;7a9dQFM>OV*h?Tn*vdv*C58lc~D7IR~F!O*Hkq92-_s*VX#1QO=w2 znc8V{X`=r}x+0V*m!sruxrz?udV2n+xdz8L-8BlEaG!*TU%N>#UAXUp@2VSsbZdr~ zvOlY0j-VHk6)vTK@V_D6IyN?^7%GU+I7V*3JKcJxD51YU@;RR^lSet=-KV|nE^X+Q zwG(YnpO)lvF&R4z)Von;4R;#avl7Uw(hDYN7cco#wc~)sRnjY~8q=58e4uO>`yY-$ zo`xNPH3}kZkO;l2Foo~;GWSbZQs!BksBeoT{noPKFa%rH6;1i5E$w*x@m6S^yROps zzzZvaiD^%`Qf1n+qPh2ppqWpe5{aNtTOce->+sQ=Az@mkLI#B32`Qji#8r~gyNe=M zq<_(jC5|QDAoUQOeTj4o1caXrS#r0nkFS7-EsS*7^u3Qr41?2M2k$s~{JBq+m8h)5 zecyI+lNwTs^%^`OlB4WrJY1U>XGW)WwM!laVDS$wB6;bcJ*c5UoGDp96;zhDP)LmO zemYU(M9CyGx1!hSsVPa6jNUtxVDt3)0nx3hBA?_Nc}poEC6=r(zZt`cb3vsn+S^&M zJpHi7u2!^?!qD|o+ojr+ccCMSBqiZ9K56Fz6;eY+%#P$!@17_px>|H)`K5j!@FXot z+ILB|l*`kwm(Asre$M}_dr%^;>~#n@7MR%_=d2ydOkO&*5!qy_H(G*6%oMm28_eh! zo@1bs6sPx2`C@rJk`H;;e{R;s4GymFybJvFxh;!P|5ow}4<_BskFpT1#jm^9hW|izr@pU8AVR(_K?aomFP5m9xxYBX`Y?mJD zlX~BeS*PQBM9VL&x1++cyonQ2Ww95am6o zM1sO0-VavTWwp!jAPqj4Ft$5+qyjLq&t}RzT8|@^@pBVAS_+W53tBv;D_)|V^)$nC ztQnsyLZ#hdEh47vnWITS{?4{3{@P|ha1J=#cPA^LMa`0j4@G1qbVE;X-cAa1_4cDD zf5;xJ*L)RbWJ?YoPl&<1O+uNzYTL`+AGi21zqz2QhC607v>99fVZ5#86~=o+hAMk@ zhiHE6fkOLJ5hc09_RsOlhQLuX}gzR;5(b3{;99yacBBfTtdR2H1qIWInYU z(kUlgQa?pcS3dfY=QNxMtp6z0({kFkGTDygu2-XeXI64n$M^=2+f^3Z#y0@i} zc%W5Bfexy>n-=eJoQp)6T<}nlo0&o$Cz4OMYYE|3Iej)ar)1 zrOL9Ec^py4hSIJt-8p@K#nbLccx)@8os)k2?Wd%D+`iK}r2tC0M6GYTbG!Dq*F!1X!21%+~QT(@Ka*Gw|~8V z;&5o7IH6L~{!4UJYRStqJQ4xDmF4eveFW$3Z|7TNB1Y#@N1``>Mv0i1Y9@#kzk`Y8Bn+=SlQ8I#-J7Y@Yv0F@!-}dwjxa4(?+ky(_QNk6Xu7Jt7-;T zwUasl(Z_w%-{PQQHbxQ#9P#+I2as#+7gc`qGQ3g352sF6B%cORs*fXW7{~P{%0NKq zD1TKz8Vtwz6)_i^TUzRY*r0Of_G@i@D1O+6-p~GsQw$D!q;!t+bwl`{&t<||lq zedkK9WMr7wYlj{vy<3`}15kHaH8ssl8PBn-*6()!=e8S?kuzYb#_Pd(O7iOSjjSr& zvE-73YigbuS?Vfl)0PkKe;&B;*s)Y(_vNL~>6bjFYS%)LWYmWrM+&@yaIP5$0ij<# zD()Gs8ETi+eQGyFoi~47HBO5iAB}rczk(FBpkpvR1I+@jUU7(2Dn8v6$wiO4i>X zYWxlfgw)9<UubHK+xPwQmtIr>L->-5iC@me638Fb4{iI-B3Qb_d z%LS(S3zxjf$Ku&n>gQMb3c`VRxup3!p{R(T50)Bz3WQ3P715?>b-dkgTr%wcGwEvz z@_*+ys3L znfr#Vkh*VXaYe!g+3Xqy(VVKmI({<&=ef8uhB-9s@@pl*m!-b>ssgDG^lAnj5QaPh z;LwkKoV^cf;xsvWBunAPuh}R>3KXGVT2weGgCJ6o6~~Y9?a?X*u-S&jizx;NZUgc z!oRiV<;=;89+drG_>ER{?Rw3LF7q7aOA@m8%4HQq;Td ztrnR~nSN)|0eE_bUmDoErbcL(=i0VE(LNLJ$Lyx{_C^4Azwr-hE@1Vhw3F%;2T2pQ zR~(9%()4@Qc?tkZf-};?9rbjYn^ZQ{%%@PP)byy;G)sk5vIVxTPUi)Q?oS(R??2?; z#V^wBZ-l;1Ufa1FPQFo|{?bp;J|@gubE}|huiCTo&48t{`k%rp1iCqevOkIMB3MBO zw2+W`DIwt`=Qs2pcop!SRIpjb{Cvhs=bpDW$PK|9t63{ygI2*yAd(?yZ%9=m<+85o zHv=+JxiRN@eu0wesIBH1DDqslXP{D_^^dj(JB7u(DW`E(t6yN_rcQSak)xQs0amCF z*4NT|bpKpM3aG-ZA(WsW#!&^QQMX+kN*j1eKB(F6*r?MMul<49O+LyZ#*D+W{V~j* ze7!e!T{4wBIz1tFyT#Vf8NFuOLqQxSq?4AB*UOe%g=!K=yFD0id==;YPF)xQ1#bab$QV%T6QiB3}n&bXFz z3=g7|;Hvsn9BhA%ka2zdz-m|qNWOh8R>=HKQ65*Z0FSfV89` z3|4_)mPn5@nw`&Hqe)58fo&f!Hm7I@sdcCY(y$1PJK!ebplWr(^7hL_A|Z2ox0^P{U6XMQpVOWE znlC+4nkFT*Ujl04x`TZu0_UD}VB5i9P$v4 zrL#Oz`v;BgAGAL2|3T{mNErYs_`gv-{%;h)V@Li6|Kq>&Hm0BaAEO9{RW6hT7<$in zA^vpE{@z!M%f7ptHADMVf6%q_`d_R>sBd#wa5u%NKa!b-v1zcE_BxBFjMt%Oxo)@x zt#6%Sdj6k!OXFE;qysfX3z6VtD8t;viQn{J^xE$N4K%#?_%|Ps%hMYXgZ_wYCNTrB zBOsurf$@_({5u@v2E8z3Sm>F&Fe*vj8-@N@EeZobMlQ21{pgb&FS0GZT7K_L25}w4%XdiD=!-*l{RT zksV0Zc%zCx`k9T%tD^uQHYfwXFP~o^rKXkMw?~bmg(*(IVQ$w4^Pl*7#fBC zU1wO%D=Y>o=5z*`SCC&);8^*w*@$x8l4>Hm@tR8&koT}0tcEpnVk*@Ya+~tgb#Bo$ zUCOH>5#Pmy?2B!{>AVJnU4uefZU%SOv$+#r133yHlyfykwvt6fRaS zXA8qNZu7eD8|7wPh=&54j0sP!@(~B4(0ylWSysA~Ovz6lj9gl^``KzApN`a<&%{(w z<6*y!C@iM-M)Xbe+~%qaJ=lqef!>Fllm?rm;NSY_7_Wkyq1l#pjo$tJ5xZH%F*y#i z>7!!zuEohfI13e7gy9TgClAQ6ZmaF1l|t@5KW@1hO!}d{l5VWAo5Wz>_-8QO=j`#I zjDUdm-s6Vd6bz8Tw+_m(o|#;pj_JLNUn{GJ)OW4T^@G-$R+$9$dqe2GIh_>sZ=^45 zsc#~lvSvoF4(uGn5JRJQS3(h7*99*6CGmDh!+Ap=4AvhGW5 zQ*oIxVetba!IysrY@G0Fk!_U;qnl$l7LlW!&|hYc2(gJo>(>68Gj7EYTv(cFW^4bq zm}$&(+H$u>P=>9lWln3aA+Xx^zE67vo#%{88Du3x6W1t6O_*NQ%u*+J__a-qKQC5= zDt&2``XgTOs>_b6%c?{eFhW6+dVuC5pJUwUG=G6t*+kcE zulr#!Nc!(tVJP)6ckq23e$EKBfQ?OBc62%|)dXKKlWcsRy0o0W+WBTwJbg24OW?3_ z@~>vuaVBR}ZB#-t8-X_~+e$}^(lzU5_lWSWfVrRi`HTv9N=mQq&0SMxm2;4Uc#v$( zqNd>B;;5etU5DSI;+Qqn(vA`c<}6 z25VE%mM-f8n4XsamNegpLFR^L_mZciz3fana2S_6gcSnanxZ%@=56pTg0-aesochg z*cTf6QdEMa+~CUE8e}M$O{ArRi^D)fa{1GCl&7nN3gq5esB6a^hN&?ZfEW zEg7#G6!Z;KK{`{Dk7EguIZHaoa!6e^B!b+0GHj+DjI3YHPIqcnxYAtHO156CIgd;} z3j48}kNF+JT#<_3KZ3|wKlcJ1&cw~>%_fav(6Pv9?yr^<-)M_l+?x#{g8XFYq!L`OwQpyR6e|a-_0g` z7F>~xFF4Z4sZOfN=E8oQ;ZEL4l%AlLZ4Y=mZEjrVF`c1txgEZt zHBZ=Uc=%~Okrd%c#|$sF$M(KJ8#8hHd9z(c)kzeV5GoBRr*i)4WR%fK0V=XC17J{j zuG0oP_g*0su&wo$izbqEiQ`rbZ>o5`yhWc9wz0;GD|FBu5YfBu3~ifn)8R(Uposmi>&c73>koCgkj^M|Hyv30N6*o!iF>XtK;ZJK zDC^C}^w?z~*bZ1zfGyY6U~)zuwer`ssSys@-Z_ zK_LXWy5O@=$c5BHsTb?Oa35Xw+JF5p2j;L3dCEix*~4Uqc9wJSzs&y#gb@ms2CjU+tdO?&=!Y)ZIPuliA^qvoeyk<_MwOk&HU@ac*x{h?nQv5)gPv{q!oRi6^s%BjvCQGfPwiQAVneDPP*&vt=c1>v-@abHtLk7ozP20-H^t=|ZW37DZfT_Gj=bE*Pb5^J@7>fri zwl}~eNdyG}XOTVim0dw=0!WR@9-$391IpNuc|(#uj09EmMwWb)vOV_P1rM5zE&#*^y+yh1dW~KPA5%9-5_?Xg=Q_;j;@=w=R zzGkBYAO({KIx2?)7LZraOO6M{W(n&tGEc{?XfOEay2g10Lh$oyI_5sn z0MB%CiXq_t5=^QPAcW@sA-|_o*(7E;x&K-*zpyyo)KBQ|)|X2*<&X6lZxyBEA2kj)EC>RGoa(k3&)}@Q+L;?JEO=cKlbbOb`cl9VU(M{mnSoM)@cae#qh8I_3`JH;)5-!*lC(Z(t!KOw8(@p5$!ci`Q= zsMgp~8itJG(VRJzl=NrvjXIE4+uA4xTy;{>k$!CpBa8O!-<4a{>@-K!M0)HNO$m(tmReo4^QKVp z3WK%KG4DLkRLhC%xQ}GmW~Y$`g?nuu>~LYT8Pc;7PnqS+jq5$I128?xJ7Ivsk)tqk zS@#Wq<7Ltki<*~ZeMmJaV0MJA?|hLmmfq7*ScF5yhb^lQnbGhf@S*Qm>HCYhUpIgKf&7}Py2{akmU}-?_1!4 z6FvdNQKqM<2sv`>jps3&uAg?BT*w7IxGK(*GW{L$x-qyXJ%d7g%t22*Odr@DI3^~o zR${Qe+7i=%3D|_u8ZN2Xr4vAdrQRC$$<um4*Bl)+IsAqAC31~ zwyk9k{IHstg{A=fY6i^#UqczYC+QDQa9uQ##YmWlFY1j7tB3tpVo;TCx z#h0gO1s`2Eugtbw;O-Me6fNV4hm^cgAPhC= zU^$|R@5ZG0)3B^#0C773f1w?nBz+=?dtTi1E6F&59Q3(8;c^20P5bCPC%R4smOetR zi%cqk7RQ6o)H3hwBVD(4H?Z|Z5;89wb4%`umDjswDwU0Y%g1Hz?_MI8+aB~3yidR@ zQr%iQ<@${=G3XqoLB)V*$nIBME3}ikG=z2rP{WAE7wC?2-3~^^3sOc{e%sf?VL|w@ zjcl(0_9}e(T3fsyh_@*Dq_loXEul2r@l{cM=vfA_K<(GaXjeb{1yqHpfQBsz@;l5$ z=Mq3lOP6`oRR3DQZBC8`-^+oOiZ0#9R^l?*KE&hWXUaYlwnA>^%uUf`H?+2fm#)i& znSl0B;Q&94Dl0~(S(%KrZMXS)ua^A&$&>)#)MZ8O|>-m1$3Lwc;+W7!sS5iFXqNm za+B)8){9z*kXK5c?i=m$112Qf!l7jF%d6ignlEda?=LRpR?Ic_I8DTZ1Q1H^reX=V z#vf^owI$ufr5o&wGSMJ%s&M>m2 zx{$E=Q99<=#$qI+r1mY(5GwHbMw@giM=dFR9Cx3tp+Ra;zdMDR=oU??u-R zi+W9q8_Cz>1+*x_Qt(%sO4iE28h$~neo=4W0)HzojF9Jy0$(P&^D@kTT~Qn?WZj$9 zOHWNwJMN9UKUuRh?1VAQiXrNlQG91lekEaLuH$P;N^df{`-}RZJ0`Q>YJ`>26@+VD z+4pb{KK)hJDne~@C!B4jPm)g4#&+$3pVu4%9R3bFo5%cgE)!%&8~@8%$OzdNU_-FQ zldddzE5FqlTRdO;Z|=iZe2HN>rjv7uD~!v1UYBv4X;Xy7042)2>gRXvG{_*>k~DN1 z%b-Ir*bf7u^>UYC8^^~M39FqW=FkNEi#90v2x)1AbkUnl1BJ@=yk?Mw1!gSr$bZrdRVA$~zEKfhSEZ{VL5?2`f z&<2)vye5@M#u75E{^mYZ3cWx#GvQZ$X^^iXSs0C_C8f2-WJvFp{jW8K z3IEj{a8aTwY+r85$<-J@=)3`~A1e!HJp)29FAvS-9NQO)Ap%QJWco__E;HX=JD&j% zlkDiJ3SJ+!);MMv%g#tD>CFR33V4N^V=`Q|U!R-*O_NDgP~r2&si3-)=V%aLEYF6Q3bYS&GPUU5@_kmjtM7E7Yo)fpB$xn7XyP@buUj6{@Tm zlB~lP%+Uxa+z^>%79i!k;A0Zc5D025wP^$xFHeZgkg=eRMJF!xQ9IZ?`5b_G-Ach@ zg3*TMeDL=LkT-cS%|BX`250Offz!2$d3h|n3GP$5%HR{~QG^BI>UEp)JK45;2Ht8t zb%RB1q;k&}`5((3_SosiMhn4HJ4Qc^e>2Pxke_b3DbWJF3LV=?3#|2=l{IIJq9T33 zo00O`UaM;h3Ho_QrkNxPV+wGar92DVR0g)}O^Qq^NN-HVJoaNVgfb-sa})bAT?cp? zA33?W&_GU82!6(Lm5V#V-C%4=%u6el4;aDG%$V)|q@57ln+u=a&}bPzu6JH!hE2a_ z|0}tuJvnk2=6$C2Z8JL{aCvM2vxt{P>nIT9SVIHIWogL0Ep9sqmAkAy=5dAQ4o(kn zK7%_SiFxiD?n|jJ6(T@6G!A0v&vT>>r4r z``zbh;HWEbX6Aei#aE3qoc42jpnIiP7dUs+cKp-%8|u}fiEGOfAj(}_iLNGx9NJ6<72m9GRQth}R!)8l44~yLcFb2GxF&8LH zu8c=X*~}YY5f01cP$~>5mAEg%;Sy2|)DM;MF-j8F-rqVOn59fQApr!qU&~})H+r|c zEXumjNSxETI1(T~joQ=K;ZFm4!;^xQuh&0+j;u3dTmc(XFH`+@Ca{Lh3fwF!#l(#P zl5cK5|GG!RPLFH{f-!G{=522OH!bNL&#%CZ%PAfJfAFC$cW^N3#(ZOCaq>{aiC>g{CI+Dcv8B2W2Vpb zFPM_Q+Ag5kbKPaBQ7JRMeSV8#HkNGBJ9_Lh`UkwSx zg%`;)R>NZOF86j04TgXXJs6p`KXZz~)TQd2CV2aE3rDkxfa=z~2a9L%%P~!ejmtPg zBO@#Xxc9>OohIK1tAx~Vtv_ssb|iJD50hkb1*Sh3=VG8^9%q0tmO`+YH%d_3xO`&u zjSBf>Ac6&=#oJvUKhc&r!ky!YF;I8$3{Uii^X-Zqb7~FuPA-X$WDd4<+}_wrK#Z1r z;OenmcB{q093SC`S&R$wz(u*TH!~*y`Uljwzc-oF&fa~2)Yk%OS;?q| zP{wpkLl*)O2QLX-MP;?DnX*%v++y=rKxHLk2uUy zcQme6YE62a!~34dG@Pn&+v>mocN}qn{g^6hyFU^q1YWBOTvr@VzrER$^}VNWW=~H$ z0nax2;$rZ`@G&FQBR}zIiE(}DQelp|Ax}<_EZu_`kh+?C9XWEOE4pW{m|WP34qVtf zP^_L7R|6l_SbKyjf13BoxL3;Bq5-VZhfVFiwji;-=SOU(OxLzv{NeH&NS8#QC{%W2N>mN=ku*CY&@lx3Mln zN7((~V*3Qr1lw{ftwf@2REH4s30+cra~_q=m6eUTH^ZH(+DGv&fb7vJauW$(^^pe0 z7X10;8@6{_L$)zZc_{$_%ZlUY@}6458{A0~!}zp=1(?yI`lGt_Mc{uPF_UD_Lgmor zH(JscJ+;hge)S+749j}J#@smm3uL!>Ig}^8TB4l+n>eW@q~U$f*LyMmRK2lyU~9{{ zO$|UII?VnJ8p+1n;j3Hs_x?`(TpN-$2xN^F@;@^bIaG0OT3I zpEn+~5fjSp)IJgOFOUl=(H!P9TT&rGm*!-^SimPoey_NCp8-%d`hZh~UMMOOX#1}R z=>U)}0t3*pr9``l&CeqbW6}5_TWfp*0Er!n$G_RE8a%5m`x<~DwJGwxvR!W-cddaQon}-tjB<&!Il&0w35pbXUjdHulz|$o~tLmn*9P literal 0 HcmV?d00001 diff --git a/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image06.png b/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/image06.png new file mode 100644 index 0000000000000000000000000000000000000000..d40b2eb0b6838ef8701a4dcfe2e14fccb4ad98ec GIT binary patch literal 19689 zcmeFY_g7O*+xN|>VgV^4MXDgZs`QRXmtG?zfQo?B2%&|hSWtQm2%#f25~PL_Kt(B` z_Z}1ydeKlq=iQuFx$o;*>v{ixXFWe;tz>6r_Uzd+a~$(MK1YO!kq!+N8x;iw1&yAr zrWpmrIVc6iUwW4>0#|xOajFy)2A}mb)hz-h*E0|Otwx&4$v4*JvmUoMR~I=?Iov+1 zF7lh2;qq|2uB+RDxS;!cRJk|@WnP}mk)7VY!;l3CtanGQRSKpk zslyU{;Z8EET1DwRG;wdX7<;#cQ1{KG=(+noduO+$o!5j`tmswWN>UWYP>iKh^$^f)xKhw*l_`zuWnb z{``#W25;x=k9Bj{`*AK`K002aE~_S4sj?HqYdL}zXRkZCx~^yDHpdOTbujE&unjiq zV6Snd&p6$?y|BTL>Q+1bd2ws@QniBK$=22!J6`cBwGnq?<4n5WX`X*hU z^yzQJsgs@3;p)BFt|(}R@2i|Kyw?(6HXVssUr{0?(7Mnfp!xTY+v&@&g-g4tv@OS? zLpy&IwAz~Km~J%1?M&_dvF3rgn4(U0H&0aiZTQub?mU>b!C(ml12z8V`}~f?y;k|awQB( zC$IehiGfL8#p>%o$Vr#wY0VhLUnFK0z6WEW^WfOzi58dPd%PF5<^>fe2G(oGi;GvG zvq#ypUV(eKZ=VhtgM7S`nS6bGZW0GKePXh)CHGvu|7?E8HD9HUe-h;y<%-Zo%<$sb zBC2X0>{r%TSes-`*WjEq`iicu_&HW$YzhKp>kCK8vc#yqOK@t&h(xL|GPM@WXPWn- zD?vnHrD^=0nBB1^=A|&BtO?bt#--v%%Q8oH_A2~uJDX#(-kp1m{lU32X!&#+=FR7Y zix2vKuim_OZBvBL@9CqF>&VQ-&qc8o$?li*;HDL3wG5reNQAge;3p~$7%UzmZ>(<; z^1C<2s;F(I)}zeK$(`BV@Xx4-W1lU`=OWHFZdwRAEI<&KECQBj+lLqRzY4noX+^Gz z+}mhz8QjXGPTk*KV-o5?C0t#Ro$2c}jwdWbsSsq9C55-)WpA@|e$8#EsRR?(3#ADgGZ1Ap?4!?B`j_PrqLjH=--9;KWwNKb9?JGx~ zW6R7jS@oxd*Y55-52Svhz2#Hd9^$H-@3m495EV`p7ibu&BGzO36LudzS9ec+eQdKj z%4lAQeZ$m~XtL#w=7WmR26~o9@AvfS@j=~2pXUk^H~i)xm3p7_(}_2V)>b5YnA7h@gR2 zlBoUSL_Hd(rJ6m11k4xR>gC+eD%akspISML2%9&G^m?9KNfC|7o5*#GQ5-jwq14dm zvAZ?|TUIy<|0*MygJ(oW-hz7NVR|&zbt{?0b#s!bV?Ndk-dp{%F_a_gygO@ilrxt% zq#5{0`y4}N!%lNE2^C!V=r4G_)&7`>%4oS2TxZPpg?RjD1&i=brZbE1FXIsY?{C0G zo_`yRfBgM_EC~Gl9|q%p7yR#b{-YoT>HppE-y;qT#hY7DXSJg$xYJaq`E0+th)AiS zkzX#WTJyJk&M#)FxwxlKqb27bi1uVCA-jkAHl>`^4x~s6t^0AOPh>Y0-B%W8oCU1# zPL;3@#_cTBpX|j_@f^qxQ+(h;X*xvxesam&oVOHeSE9=E*lO#b?{+~Pwq{e=T_72h zhMj&gG+g(6Z5B425u861{2PDsF9vV)yhc^fA*ygcizpx^H8$Lx?ndi>L&x_CBX@S2TlH!Uaje0Gcn~(5& z@Y|}WaMDdu^6`V{aF8v>s5Zf$aj&>|gYAS0+N9pA_L1cxrKoAj4g{TkKkMCb{e$$v!C$?Pw zAOgF*of4k0)3#5+!?ZRX*#Fco(cekJ6wOZaygxa9I$< zn%}|nT>_++imBh)gc&5!U43==jW$)HZ>eA@sql;FUi1@w?1 z_W|`0H#J#=Nh=wt2{xf$D&guG(Q}43!bui_d%<{mM$x1XsA3#@{i`pqokt+_M$jD_ zQlVXRO1Ens*G+~C5errV4ot3$M31oqT60q`(QK&;*(mJX$4~cT^04cw-jfyvd?0$| z`h9-APRl_;*#`Qp)4ciA{&Vi+5$|;8v{;g?({#_mQm#~RFTD}kX{@LK%M>Rr2m*fC zDSH+Q@PPCZ_Pao@UqR%`>kzp@6J8WjS2SU5BEvLyvq*ko!Cz3WBJxSa-hB-;!4`p6|H|24;vXq zpga!0rD9f=eHZ$>1out2rK=r|G7bu>6Xn*odmqSORs#9@OBjg4k!FTy?sN4GZjbj! zg;xTCx#5N~B`DrPRxTlMN?PFs5UOoHKB(alWKQeM-?2|iZKP>ck5}NL@et2>Fp~?oz{#a+r|HUCW zq&Z!yJ%V~cX|}l+-gkBzSsECNV*Q{obZT_=5-9^WcW)9CV%Wr@KiV;1)Rv6IbD@q9 z(P?*nlA{50pgtl39X&8dT{K(d^TZ`^wba22T;NZWN>G{3&A;E?-gQATdzj{*W`~XH z0p2}~EuJl>`C~aBl*%xVtI;ZToVXlHDx5-Fh`Db*Xv*ERKW$ZwX|6%L`JX#(y?JyQ zI4#`bh2mZ|chp3^fRYMtqVF&bqdWN6&b;h=8ji5hT}@#qih zH`%rX*%IH!1KuZ3>DLm|(Dih;Ozl-JE~~it6;uo1C}ccNN4_a=N=Qab?AnmWL1UmO zJ}as5#&XD7$S>a_=e%!T1!Q}B%oq6W^PFkG5ej3`fmG2dsf8M62WmYi3LO4pBAZ-R ziYu8RTY7F&mUq9;Fr`$P#Mo)X4TNlSLr;oN&&TVX4)Xlt#Pkm=AZtruvh*Nz z(v~(oTnUySGzcn)D8s9;T(1T^sfx)@7CTrk8XlDrz41ejOFj%Lv7IJGvpt zU<`85GEyuFen};fCm)!7vc>m`D@p~Qu%p0uiyQ6<6~zI?v+*7g0cVq7?GORzhTl3` zr_@r)bwz?*zJL3#5n9JGwVDUyol(t}`f*uMCxhI5fRmrS*L-v*^r&GEJ6i476zq44D95t7IUCW&kcQ$JFQy zuLCa8WA>or5H3aB*n_zABDHU<31O5#_-}D%)jnAsl&Di4HbLFuH|9CRYHPZCi*_5! zFg8U06^s3$%a8I#7D}xHKlLCs&dLi@zu~;rA79-(Ud9a%k`fU)K(dv5`^jljOU>*K zZJR-kZHCfV^_}^)(;P9scVsKrfW?+40cGQ_t#s7V^_WyDGJlaoSUzDZgR$`VAC4}C zz3Ep?a>JU})@#r24i{JEbr-*{Tf~;| z7PPO-^&MbBUEfTW(~pn&WiQNkI>yD9yeKCnHM}^Q&5YhO>jjh z3F5*UdzZb~XfQPoGCyj{XcejNU>jO43j4h12^*S~-i%cMHWHla*WX!jActWHMPr^0 zjeSy)<(=Un)7O4|?E}Yrum(d)o$+sZ^e&o)aZI720mCnM0ztz#b(YZNr}ig9bUsA*>|a%e`Cb0+b`^f8?&Isf|nE&c4>`Hv!i z9`xUp=>C>}&MN&~0ch#Jn)vq>3b;OVqd$ji7gs>XFg~Un8Up?7Z+}eQ#&rI*lvl}kIkzABt4p^T(ya zEy-_Tn7=AufGX*(_nVTkY?n!Y=p7wJ+H`WLKR)<(5w%8&REw%3bGf@LYkv44S8DHU zmdrb&bt!iLPjXT#g=wEM#Hs@RcrOOrf@+xKdovoAs>7nYuT~P~2#xIq^LZBq^>_UH zmSyxuqzXTLS~GPT!RZ(Rj&6b+q3n`ioNsy?C3R->eht6mXk4^Pwd^3P20k#?as8s; zg|a@h6wB#mqejD@Mwf~0;_I(YI9O)N*Y~ZGlCm9A#I4_AY3{<^;A<{P30f)Gv}X?= zLL=LlK8Od&k@vkslCxL}A{d#$(4t@}V&k#cx-mpOG>Fj0)3_OkD zT4sD7rut5sTKa*Bxs=o(?}ZMq>%{5Y-6R>;Wb2`ZNcVzU4nxqpGUm=&5)K{6cd^%5 z4BFl&IFS=LFMQEzKZGjgdvq#F2;$*0PaU1pGQo7Wpe`a%qZI8}ZhbE4gW?1V-|)mg z!HOeEQi^hwfHGMSJL-!xG}SX5oMd3tkFQwwux0IvvS^E!V>x)l=c&kIL=m{F%IDds zDiMg!m>x*DCQlIWv|eG5tMq}J4lMar>hNIJgGL!+g#C=Nd7v5^cs@@X>Gt=2Cagid zj7$hk0idI9y)U~17e&EWUM@;I8>#!@V!NErrMm4l|5hZW2#^+@maIzg>!-%W7vvTD zu$1jGn}@>qNwOCR9%m-Vvg1AYGOK90CO(f38ncDWjM%%7BWRPGv@-9#k&o&5{FpVD zPLCI=hclaRdfMq+gVZiJw{=IRNZfI|8A=7$cYrJHYZt-7FMCl7JLoq^);g(>m?_~( z-ao5_*}$3<%1gr3$ea9rr`+f6{-k&^Y+Tms&ALr33jAA$bsFS7_Nix&eSu7$?_Mwhsue-N0XZ|5or zk0;U(Gnq!!o3fbSTNu_e!SyxZV82t>AuK`Fo9S(|r6n))F>Wfw+0MK60uM!2!sjMr z<~rxA;2yFny#49bzWewmB2e%o*~ig^cK^>BOM$t9dW+{i;mX+=q65sf0$JpI^y50|f8`S~sCiHX; ze)l4@E6EAGyfPfoKVl$l1IT*z`07_+Xa0vD=_{g%F|^_i8a8;g#o1NJd^A0z`I~h2 zyrhFu*+k2tJc*eX?gr`COi^C)e%^2beOTTyH{j^B&T9vAaxEssumCwELkh zs_|Vlb~*9Zg`eI&dI@*zUy#F83LkIWCx~m4QV>a6e##d3z$&Ro&K2UCKr-+k+|a}+n3Y411|cvB{fOmSD9 zo_w(Sru*J?)!9$3`dH9TnudC{ao}01c<72=9Ta9i4G!N7jTX>9i0o^2&Kz?K@v}WO z28Aon_INLi^O)OX03j|6OX=mJP~%$@|#ta%&9vo2K(b79@iy+?2W@;`B)|d#(h|c@@T=Qe+(J1 zn97jivz_o7`V37lEw&2ob?}rR#bWfOzvez`;auH^Q^6uP^Kj>R%RLbZNYK zjP5l8wm5&o#E%nLixC5F@7$^8lODH5sY1nqXcvie&%+h9(3-=$fbEh$PZi->u##aX z=o!V-ASDZzB&A4z*>%&gl14KkV`}C{M=XB%E>$Gi z*YZ81fb;gsaC2zfM=gH(gG#EvAHpQrFJdu9>-<4{rg+M0B8-WO#NylVYa#{>0W}CY za%#D~jxM~0H~64QEh*pQSJd}NY=#&?yp6OFOjj5P?U7(LFX}kPSc;2gT$5Gme{|YR zUP5mu^1xxv2G+^N6I0W#fj%clidC$ZW3?P}zIHy`6(WcWJ$RsRcJO%e7g6&%hvmby z;;)~t$@z9=*wfjo+yF-pYYZ4O3AHeVZse2*?U2)Le#rF0`YWPQ>tm_k9 zx3av5=H8C-ai$tu+BJ91OCe)C&_Ajk>2tETu95tV+}oy$3`b18=^g|S4fDPIhONIj zNeN7tw`G_|XFI!h;d_jVbO(!jlN7`JJ}UXKvMZc}Q@ek?ujeXgjZ!at94Pp(^m2eP zvUK3V?h(O|msa*F{>jHD1-J71g&(f$EWy|2cgQEZPI;A&esv#0r543yshQ0h)ytd5 zo7Nxly5l|^R+lK=V`KU}N9>8Je7rbQXN;s$>5a_j-&{EoYTeM%@M32&x%=r;sV06- zm9*PVHV^gk_kA^eo`#LXWbuazH+L?qk8=ly%xa~z0V+>Q=?1DI?-Iu%Gh8#WFltfE zw-6PbN%6pDc8yTbESDetNxQ@@>bqgf6qCCr+#IS&1LiT&7!t;6HJbO_CqQN@8rTZ1uv2 z-d9J4H=E4B2aK;|+vbYHtKMpGGPn4Z&*ij_A5IKagk*-&zm0mos#Fl@Dnnv+fQzz9 zeT5v^uJ~*B>!vXC3OST=T7AR9@X|Rs*W7EMjy+BWaMJ~MLm*BE@^@}m_5W6ud-3_C zv<)jV5=&X%2c{p>ObT%Eu4yEr$96W1^ADGy2QEPZY_I&}jF<$1kfFxI&v%Xjd&1Vj zuJ6{&HMC-bkS^{I-(Y_{$;ROBO-7TrO<{dKrtIYA+Dab1t%V<8v1wk4=CSePV9lu~ zN~R%`zD+0-t;cjC$7-MZz*u5gsduS@*FwOfpp+87I?RztBRQ+rqH%C`n)S~@YbGao zi=VA&#kl!aY6Uz7nC;Tt&^2=Lu*p4MR#SNiQ7e_FHe)rs(7W-N@V0%xS?YDm(_&W7 zGw*fdf?tJ4RbXAJNW1In1Q8r7xQZ4|9l2|$l=18F{r>B3d8pb8s;j3n6nw9oy@47G zlviIh|ILPi=HuLvFdbUp`~#SvAp3xs;hDRs5G@6Va_n0y<&S!d+WX$x8`ti)jsaaz znArcy!b?T9pWn+B%oE8@O8E#cP=G%bDP`@tBIuxDg@5(onIZQ@dE?*1 zkEQYpY2i^3SOsfbpMa9;_0m>saGXG_5^5y@Gu{Q(^GaJj+G8PzB(k!<#!?#gY%d>Y z@hMnH?6EI+x!6^9xCgr`ojDz-w7W54`|d4w;#a8!VN{x1d4~xY>3EDIxm>o49o%Wj zDCIZHKoEcCw<(|eJJ3yo)lijgweA_Ehm}+8nOc43b<~o7fI1WV7~k9>=MDPZ7mPb) zfa{-!D~HYRk!l9;@gdkV4F-81bndFwLoWIOCha`aCXAZ zD=DB6p;~`rVva-#XB&S|JccpW6VxYr7`G0%KDhBZuUw*QN7qzkfv5(jpQHR_)m>N6 zrdg8#K|GXHyB7AYBe734uF1nF9p}L)>p32YEl9v}Dm0*c zn-R<`u}7nGspV*%rMOiU#>aK*e6eVF1v6(j}D~69sGY0An zj4!J=_qpC+1AGK$aQ3v4*)rpu$dYI#~ zyw}&K(H&1u!2PVqP?U9}Q^->NB&l29>Fc*kfT}MjyWtc5D*v~mc}SP^P^Fi+dflfx z23`_hkZYFrANRqkq-7-TBC}_+tw^;`d{KaoY#w0UP$R03>`27aU1j%5+LB7^Lm4>_ z&5(5-OuM7ACPINxU;k?PYXK+zyfvK0I1qfx;fiE!ou~sfv(7D$%{XRpWawAd)Ku!p z5MePk;=B4lMrLB7S=B;BHp7L!=M@rKl?$B+Jw?lgAJ^nU{?hsd105cs`p{8Aox6Z*4ABJ+ zzPW2K*^iQ=9A(jtS8vJ`%VtQ!VOAL_R@zSJ@JOQ>V>SavOUL3d!>GJ3BRweJg)cPQ zbxR7an;$$%1!kEeuE|Zk7SA@3S-JxR6xN>Pkb6TIyi+zL5#}NtiO#S4^1LW}?Mz?8 zV~@TCSM4=l;uZG9jl3ZVzwWghCiK9K>w(eeNi$D1F#Yv#2)kxiiAaoQ`tYNNPD=nZ zHAzlOtMS*;!Q1UyI~VJJzMcuPDlhciniuQwt8mk|(iv{@-SzspOh_>_>}17-Pv zWCc3V5=_3ncra<&{b9jIc7|+X=8dp`2dy^EDlB^EOVZ)=55py{m4F{TXrEpC6fY(& zDu+N=YGj$_dw1`Qy_gN2N6t!*LAGRI^D%0EvBvvv^m_jc-hncz8D|a-Wn`$lGcGE_ zMigP1IabiWpO!!^EDTl{s@%7lUNqz7^hI!um=-qc$FRi*MNIxJfr=hPL-%opCP=;7 z`E{fcG8&f$`5BVz%|Ye5iG8 zOT6YfXN=SOima;tWg$?Upg71B0mLq09ZVOhWx9Wh!H%YN^xPWtQspXq$J}DSX!%~C zoipB2>FTLYgBeOrc_b4Ji;UY5mfBCE&g;%YWPFLPR^BisN4Pn`Vt?nL$dW$ zZO_NNCT&~1n7)7PsJafYKe}*cgVD~L^0+4%t(#XXRqtwJwupHv08NRF%2rGr9IP>^xoXQE|6s+Z zOo2jQ&#PWoj1B6&rJr$oFh+@1u}IczMs=PKno@Q1ctZK4TSAIh+b3BtuU+^vvVMi( zG)Bq(3LnTT5tCIP7zX*uB*h=sxjt8$K9#B8NwXWtmyj&?Qs}x4{QP@GFW_tO>wkj- z|BYC1fc`B2{{z(fhhFMnr=hs6fgZw+^9u5ltARe-$#y`D=y%q_)MOOH#Lm^2Y*TJYM0`futb2p@O zxW#GV1K7FuE&v%mif!83T;~5fWS*w#+`K=QFyZ91Zo4qCXeZkqdop-*@GZOh(&q8C z96^?oXQ9U@+1+2y7j>T(9ZgHfCuO|aT4+2C!-m9CZO-UhDcEz!RITKi<5H=NGz5^cT=dn=%vm)ID2= z#@~(c(!uf~m=5KG-$TJU@r)9FCts&6Tl%M!mur(VND;5GGxg8Y(!8hKx4P_)Qe^+? z>=_{p6GUi9yVhu@1X116?+D{!$*M((=NBuV@IVjo!R=RXCV0@UD|NoRtmh2KvW9*} zxyyBX%khbFnR7P%+Y}xYW=W`>smy^_z?!BN1~#V+PaAFam&u=h)+elZhU`Nbh=pt^N`BONb-C9Izi@-qQIHS3H4Tsc)p? z6ZYeRNC~Ns$G-;(=(f@~Z(Lw_|1Iy29(!VJDRy1nXOOUv`a2DPJqC5vE4`U4;k+RF z0CZ$mV#*oqvFhVY-E32C0Yn+m<}&WGju$$2bHS0~G5HY<+(;mMYIlZZ;Uh7FnFsiHcV z-h4n!>e)6@pwC0D&EO*<^D`AHYKw+k`=9%Ljm7)?)x zXc^+G6*B?oLmNEuMgscd2Ql~ty<++spoo>3av1PO-^iO%fHVQ>KYF6&yGODb*b&&f z!|g62fKRs~6`tPw8xnafCTW_4!67@DxS=k$p{%V{!61R2;u0x<_@G%*&~G>5_?;EN zqICMmTbt=a!z4T;>xQ+Y)2pr1+-%?&$_dxN-`9ehvF~nF6&Ms}(h?L9T8`e_K@!U{ zGeX%oLulMtT%aUNvbDbD#NLK$;tded$sH>Nbl9CT%k#FjD6y;6y}nud%>&(Mb( zI}590p+iT%FR772Uf|oMWyMx{pP0`x6fK-#5G~695dyM5=7-JIY=tB?H0Ok4%R**f za!u`ix7sqEJ*cf;DMg_JTvGGj^~!ICOdO*!N4`)c&Yn{L9kray^(Knv;oh96n(%PE z-6vu<0>C}OB{AH zq4tZ|T7t3lV8PXvBRc!LJHFI`h#!yDxPJL$B^#>ftak?jfqV9c+@U_LpS!4DgYd&j zpJ{rHONU#>Ja(gI#i1)6OS28n%RD#Nj~SVwVXunE#_&!ck;MIahrlDl)7w!<&@JF; zivc8RkEQvyR@I-9^(GuryKdXR<(dQ2<(a}KL_sKn=uDRGx4`Rd0BNF8G`30pAl`>1 zF!GS!zod%Ru08AjnhpQ7$B-yAq|CBZ-wwX&R%XT}J-5Iq<7PXy;p4Nd9GdTWVDvm2 zF-UG5L)S9{uk#}FWhUAX>qf^;aezi$;VI_ULl4W3=z5q8BTdc^r#5Q$oNPc(o56U- zb1E1*_!l%8R+z_5sH8{Md8=~;axDAn$2#Xuvr;!jsg4lAN=MQ}fY&pX(a_$v> z)o+{D7z89R2fr6Q&ptdPBivmiqN&2f6>A?Z6|q%%!rtk?CK#^*#K@gukYkW=;`fto zoqm|8#qkw7V8RqUzz?5TYP$PP-zvC8=tXXzAmeb4gZut0mmK?X$mZXc0qzUQ8cdu_ z*_wbOH?B*MK%FoKgvb?}Bhc&!Ug)24ODjB|l<*45vKAx@X zyoaby*pjlqf(M+Oj;O+h-AcD+5jor&@0Bu3T*S!&Cgw9u5-EjfBET7ibEUX$ojTLCccf$Lf9hr?T1s(*1vn)4n=8O68PRS(?F-}lAg~x zMMY@elx9TdjZID8JnOXveywFBWn>FODr_m42?QmVdWgm~WCvZawyq=Qbejfn?;KZPvdpwA-TyS;1V&+_&bw!>mRarhAkF<4dOEE< zEy~x1FXobe_SSnNp7jc!1=^M9H?nGjZWRSy-Y7cSMCFsPV?_kQf0Wdt6Q<2HpJ- zJ_HL|%offLo!a6{lw+dZTn#GX{&=V>OG;6#!Hr%%-pJbeB<5m=e4|JHlXbCXD9|E* z`)K1YiYBYPGPPt&@-XEl<7>^al#$E94RKF-p*)n|X!WMd#do9ZXe@td#(*{Y{0d^Y z+>F02`R}+72duxM%)}=^O62&q8~wk3?S*blMc(5v{c;qJ-f3pM;K4MfDlXlxvH$=M z;!LCk)eu)LoCI5cagBHWTwcP3DZN2qu80h-qG{n5R`_jbO;Akra)s*_fMSpqdf(Yq zVX|7X?Bh&RX5#e6&O+2DH8>oy%rbo;-=@GQw#<@2+P}=~l2%%^uhDDzQe#|#qWFQz z0F~Q_SmS%+TZI`espnN%X16Jk@W#uXnW!+&&bQbKy-mla3pCeJ@8(V_Q@CBW?|n7l zo{k$xZOYQYEK}RRZD(eX@y;9rX|Np3Oo2^XQwjUx(k4H*r$fQQOZ8axcv`0yiom4N z9~Ec{ee&_PKUrChi6zKYD{p~o#;U^9s{&vUMK=dCAGaf1y*p!Zco-Hu<AoSO25P-#JMCab>>s?{msorGF(G{Z|wJ>;J?b8@88vDw#wL zJZ6jy^jso@Gv)CXc(c2NPEnkU9Ns6te&b-Zd#nZSF}5l9VGyZrxSo;i!&y#rI&B_1 zvjbjezneaj5tG#Q2cr4ZI!N}=;Me;bH0A- zyV~LI;!HjCK_aRi*5F+;$f5Y01FnAwKJ*sOa@*QTQc}vm*pjSVZ+_<&y zTFv%GWyb!Fa8-a~Rp$+vX>y&<$?hiwAJ^=OI)|pTyUyvIxK3#x@GRwwKVSk@pThdR zbspX*NWH@T#@(U1;;)^S$1||N9?P9*VcU9~B+5!{dX=&{0h7xM1ytZcX*?`0Nwj5G z1AUNyvW)xCTh#(2lL$e@S0^**t5q9&AxABnw99Rqg^ok{Mwbs@5TBOXMX;e!Xsvav zI{-YqA(j=qh3pgaA3tsqW&=H{U7ML+Y%kgS1otjrO}X3c4)wtV**D;l5&H`{fR|-SFazsWsSC>^k$rysME_n^ir>DxL0W`vyZ_+VE zpC}jeB-KcW-Qw_n!6#8?@CmK-6BDVBK!P?kpaxf-7B~oqD!G{eH?idb4LNCg`mn>d z`n~2}b>2|;wx(M7nxbwg;MCB$THLyw_+6=7Nn;3b>+j*iUt)c+`&m*uFCjac`EhJa zChbD3eMLj63h;bh%V$8_1Cx~#j4|Q{HitZ*CW45ZoLT*SJY?y0LftY%{;#Ep!}vP> z!@4E7<+Hq7&pW`8-oCqXwsYF(Bfx*COj4n$_n56JEDnf zM0H34oJy z04R$8*+f=x4ft6OR;};m2-)!105qD0s7=uHbAa$z8tK)0@y4d zMr3$!b-qqoc7}6u2?*$XhZqX+f>iU*yG@N=IB8(xFK#;aJ8P!U6jM{?)@hdPZK-rd zni$L3ZpKhRnv0MCd^e^_{?!NMUI1xr4)CEY&w}gi3H+PNX%qtHg7-nP106IZW@GqJ z>3Z}pYcaF;HfWOf{jQPt6ii#&+g_R8%U_A22Cd2xQcgXxhhz=_ix7dv_{$}T(ltnD zpeZ>&5l;r9>0kzL-;>kND!LbxG_x}mdw@(k5vX-qey6Dg43P@Nt2%oZ>Ew$p0WY-r zdMIP8zUi;=FLLWz_{4bB`t2mq?BjpoCNfFgo%1a~m`wnxLz^KhBO}#mW&u0X@XjEV ze=sMgGuS4`=ZrZi_$PDH{Wo*sO_aK=4TJrQIk6c9qJT;NWKKS4uq{JWb^-Kdoa0qz z(gcqCE5|DUeDP@X{{S2?|1OCu)g#~<_kBEk`D8^$ivwGa_Rmmoq*%}7pE~GdE5Ea#KUYqr;j{_KklLjhS zuk>vDUd8G6D5JQX*&?a_^J1J4qK<^6iPjmFNB-z! zl^~>&(&WYV8Hcf!W3Ks`#2in%vQFU+zrds889vMw##y5;nQA6_()#Z{V%;m3kCrm; z?TVXcC5w{pQ}`PWa!5IL;um^jx#qcijkj-XzImb2o9Esx39549g?_bd5L6>xKP_)O zX`BHI6muU9VOofnGb0UJza4Dk<)B!XWR*w-UBSib<8DzR%Cc80gJ%k}&j^j?@+PnL zz^xj$^5xK&6FUY`1{PLTa@Cg>z61;(p;YKLF^Il&W-2x+R7B~30ThJcWCkD;|H;g; zovJgt;5S^sDmy2zINPwkI*T3MZ;T(_Umr!ogK-6<(sM;eKU~aw{d3O(^1w8(=G8&c zooqdERq86*RoKD#K`b|GGUtT)(#F29Q+x6--SIBAA1t*6Mbzb`+T2Q|K)!*^J3eNteumHIq6;M;4jzTTD$KtA%OKSSfR6e~L~T7F9(biZ zAZ1c;)-QO?Bajv|UT-XZ;Bf>{#H3HtyUxSn56;sVp{v(#keILX7w`+;mW(heFU~D} zJoVU-i8?5780f<#2kQ9HF^AKQ&C}X3H=RJrit^$+TDR!4o1p-5&V4rR6D#MES<*Dw zDNs!)jrm?g;4Y9Ik@qwzD%1vjGB~1AC{mZe{ouRwtz08Zj;QFZrgzvM5AYeAUl}pf zMBW5tVVLWdEQqbf>Rl(GwRt-$Y1!}1u>=xuw=rx#`=@0bdsSRn8X++^qksjW?WFAr z(nq^D8=!|fMqZ~rbn!7bt=;ljdtL#;TRd$(Lfp2OB^53XOkarM9*1Ar-ClVFY=r*< zoKz&90VfL&>i_t8THIOdKxTU9;IWNGn?Szk=Lu5<^5rn2u9evXmnZ~z$34_RF1>6% zXHx};6BikpH^~guz3S3V;s?;>QawLhn30$3Mp0872#?M8-dG&`^4i-OMnotCQOTs# zvjKpKerm*sYyV1FouEbO82aK0ljx4J``zC-Wa!v;gL3S|7k;+4H;MuH=j*pL@~l%Y zn1e;^W5B%IPWMiMhwj?2VRC92#**U8sSd~yB{ zG&!^{5C3xL1smw#RgWznOocDJYgqhPQl?wG_UasxlW4gAnL70E+6iv{=xupJ8j{4F z{^NC_+FpyDA}1{oP&b_VIhVTKN|2Omw1}8%j^bN~AhA$@-dMKL7-%S0*~xD&Hkq(g z+=U*LP%JY#=TVbrE%14gYKu$D`GtOG5U3O!=ErXAH5IQr!Q_Pt6VL$jz`Bru`+kGf zJ<*|)mZi1vbwziC%0t;-h#&(qLe@{Z`4 z=I1UP$=D$?V8OlptAV}Xq%eHbwj!@(**Om(7uXVFi~dDU4>+mqo_o^0&QJkW}% z#WKnG-TYdQBA&X_h4qQmrX}dcT0qNhet3lEmeYf`C^gZ!HEfp9nhyV8j@g*KPOv3$ z_{%Q5YNtJu_qbe9m-2QZ6CavoOrlVBz5NN@D$Ck_0oypW;Tjr}{n zL5$&m`4}AZh5;z}-}Uj$nGkq?-YqiU=I4IwB=0+;TW1Tg={DALW#fZ>N?tmu0S)0) zjyWSnV(HAA%hWjr==~ULsXIG+>6$yZp|AT!`T&x|PwLt&DwtlT%HBCox(;ySLZZ`R zQhxD*h+qbU#u`rTI&d!R#us9o5vMGWQxcE4fdi!SBMxtZRJ~%i{{FMj#Hw!qLR5ft z8Mwa)?M)~US||;;N@A9l8FJbV0xjlxf1SM(r@wVfM*i(p0mfQps3=L4&gRCgBp1XaFz_`vPYyIbF!4l<8a+~0euoMWEOb8&0xT{ zH_*8Zvo9TtnE$6G7lEcPBxT!crrb(J{aGMX7!ky;`WRLUtubAfnP$(us0R*0RyBwu z-+GPZ-v)+fbejA2Ir+iU&rvLo+Y3EEHD1eIwzb5D70konL{>G%L%7m zrO;)3HO{0O+d80r8#2B-IQpf$6v(y{0zqGV`9^uur=*d4@x1H(8YwEaZ_)r`yALFn zO6uShHB<89MKf!t?}8HIF@NSo?<-L}`4d8yZYfU3aE@-Wyvwdgf(Xjn+hY;nMhw z9#8_H#lh(nAo)-yUNl?yin{yL;O(`?=F$Swn^p;#<{zv`%zo%^VE7R7^5LWRZE$j0;SVzX|0YMyPi4%swkq3-0MP}{4fkh&=5Ic5)$NZ? zA4KL1GfCoS;oNLlj&?07?YA&)8Tn*erMlf`S6>Q9|9Jw?6~fz06p%8I;Ub`8)N()T zRrg5sGlFZE)a|skw{*Y|#zCi-uTs7Xxu?04yjnE#^ z9|56**QmS%(JRvctY0|)t*^tJzP`b}-i9Fp;_`TQ17!T}Hk30}RR&)FBSBs$y~x}Q z;xww;ZN|n zB0^_XPZ*E@Tw`qMuoY|$oBE_1yl{VZ6-d^G0i8fWZSPnj209S6bOYq26NlRgMHUMy z_%<}8C)NNh86L-G!ETg}jqoZ!B*^=^QXATOye`R5p0K9WyKy4&+;_`0Q{nmfrmT#t z{Mrq{SPRX^-+Oi+2_}PR6t4mqxs5lLnqb+QVjx7WUECelXH|bAB+aJhLu2)!X-BWl zRn_h1b}-%`mVOGx<(%ci!tmyvKHk2-CTVUV-z$CFL%_JR*K!O7WQq6@T^*l#*OY~1 zr|l<&Fa3Wzaa-HI`udc|H$9(vb#><58>cSih(~|RE2}cS)v|T{ao6wJcduk^ z+O!E+Xn*slJqIlQe14xhoT-_wEnjOD6mMf&w6!y)GW>Mrp{?tt-|>)xxL?3m#^^pC$lWO!8^b z%KROdIUDt=MO!()+`C%PeD{>XsZVA99`BzqyREn9jK=fSov*UQdwt96r)h5!DSY4w#2ezgJWgTK)U&xzdJk-Tclo8Ub2GqOQPM#>h9&SJEde##$>KbyG2i!5xA?4Sys`PcAIZ;u086;CzUgh1i+@zU zGMVRB&r|j&9k?)Ki|zjNAuT(!YxWn1dact^^D8^@ruzQwd*IGuYhYvcHc{1X!(Ekeiwh>B9h0?=O!Lp z@ijx?Z$?f;%CvPgcOZ*Mj=ZrJo3SLSD$b(-H=NA zp;7$i4{RYx>iO(*8&X5uA1M4YG1oP}oOagqWX^WrB9FPxB*V>4Zn4?bd0swf*6LX| zzj~exo$~bU=9th)+8%Ga9_bZcJ`iS9JXNT2vvNVzVc=lS6XupB3oUtqf%VLtW3Fm9 zbIneDO5+ADqBA~Y%RQ~F$}!dBa?IUnvtnE$@BN##`sF#fgeP2+JZ}p}&((gaQhY@B zDQF$Z%U9e{tx{8ST@?1^#O%Mzb6z6#n%!RbN|L%?J5HWCwKSQ zz12J!dgUo_H@Mb1pGB1wz{yI;dXj5oKH3H74`{u=UO2$Ves)dCxmjuTI<#Ba; z`Q|xxesxrwz_hJH9KltSH^x1Ta5dYnGbM6!tTnJa`T(XDJWv0a`X@@JFi-Am8#AZK2%S9CP z(M}3MIpO0tc*h}P=}B)hBXH^oxMBtCi6ey$@V$yy4yHnL33O8<(yl~=HAthzU_q26 zEGT{(L>69(y_Y9r_UJm71n?}cj6X;CCr75VrT6}`mkF16^+aUKp4n$&dQZuIb_bpQ g)t3IO2qy85}Sb4q9e0C>ep2N1cZ98s)ij=V%^1d|+_y z90~N?x$}=MkpWKzg)j=|&goS?dZ29NH@Vpa^D;KhI+%4bu0#Zv`tR$F`O3(%jZptp(SihnUcLP<}0zN*V(qx!gf-lhCk zzJK}Q>Dh7PaCed{YFa5$V#9N5(JWgPO_29hv=2G(`|bMN#@W*bGKzTlQexE_|Nd;K z{Vb0`EwFu2qdjve;rq5(dg;qA17d!VM@WX0cOHA&^rPZu$IIJim2~t&A8g}}TTD#E z{p2~o^jkT>RpQ|9uq0sYw+o^9=qvYOJTLKTmvC?CFl=!`xoCatrQH8``p-|?$)NlE zP`P?w?0@_Lc*;S2AND`f{F&>oKfKf>3~J`egDG{gWvnJTWMB`Sj{YW&BK|Y*=YRor77C%6x=$Z_Sw$ohev5vC#4z9 zzf$tEahtxCC0uh&ha4@vv#;>WkKVVO{EpSiT{!BSJ!{fRzcW=e?7q-3t1-7?m=d!q zqt`a)={z~pOPupf!y4z=YBqa$Dc5s4wb$mGu_}W0Kd+Lcy-V#Q{(jjBv7vwKu;FyO zwt-zdg83e035ssdh@!0+2g$yBhmP{xhb)r-|FL@kpsE<3@7h*nHt4Z+T}O+WmtTs z9?g~fiu-C|>w+gurK|1o>w-&_<%dBI`+VblbSLk+4_%9fJrP>;7`ThPmE!TMkocpN z%KGU@lIZA<>f6C(doq{+@O$BGDje?F;RR`YVTT34;ODx4Ce9{NRZ8F4Ou=_$!RDOX!F#p zZ`$PTbsJI|b~!Q>wIqZ=1FNT;+cVddHnEGyMZ=iCh!mB6E_L48RnyJT2XkAgxyA@{ z=`J^5ddVzlSvyaAmuA)kzt}HQM&HN23fw)+Maxh=pkPwop&<428jvUBUnMqSwsx5nBHDXo@=1|E-_)u5-L8SZWpipRXZ8v66u{sulBIzR(3-^?nU%@ruZW% zE&t%)-_`LV0T(F=j$GkL+Bk{jTS|C0w);#ctUK?|&3rvq8SX~h8jR_#+wGXJXf8iT z62Zv1Tn@Rf@gUDG*QJ4?oX?(iS%=}%Ifxv2PpsZ*4rm&pe+2_iQ-Y~mFv)F1L0H%+ z$XIrjgBVLH+IM?`iU@9;zok6FWN8r**GN>!U&6ei^{|i&9XUl>_qBgL5aK}^LoZFv zkUX7!rO{OsLmh^rX}VN|+_AKCV|x(Was@Z|Mo1??z&bjVb%_FZ&+jsv`?+rtXxeoz z9^MxA`d|pAA_l7Vu9PWyi7#X;GM6;~&$Hy`J~Otkz4X-FQ*A_VAp?Yg=Tk9$)}&ht zrbgr(4g|9KcYbb1nR9)Hzsltxe5UhX{QQif;;!Cq&NyR9L6C*9^sxz&qkTTbM7+-)OGTGY)~eWM5j_74{%jJ?k*{795T+jcc`6Xm zKpBESREXoPvl^ak$@c`*8m9p_zaZyx9`6*sbjsB1N_WW4VZq;)d|A;wAkUYxxU?)e^pxDsa*oSYcWR|a5FAbaw2Y#$n+Lk(%8Ru1{doZY%L|ZD(t$vt@1D5VOi6i zP|{k*>&hto&j~hP1yxc^H+8-xS*b=_oGy#um$&!?1j^$xG6JLCK1$u&yS@+NCi`v* zqrY-RBwyUawwr*%cUP#Per;OuL%ET^XRK_eLKzIi*Hu}Q?&&{!mM-9N2q`#wS2}nZ zhk1klDhodH#|Z{x>;;|d21Li2`uQvVdS^ox?91M7`x_ZG+M*tJIVih_6ZSyu?dam6 zQlWuijjh=TRdw)~jtpTW?RNs=SJ17SLicp(7Yqx~&QW*S<;1SeHVIgT99-ab@hCrH zbNJ?IAh>L-VPk`4)Pf7#dLN<*Q|Uh*ZR!8{XzT(_&P@R!3;tJ!*-r}}_IMcowyr27 z_t>9@3P9B=_;kjk!1nJ&>q=hZ5P@@)Dql&zRx*=n5 zmo_MLy#xtUo@>1dI{V;{OfrxV8BP(wN6w3Q$t;EwK0MrbGCO2V&ni7{#(F6eN7Esr z@~W#hVr=5*n8DmLf-EcrHEIgXcO$QED8+c8@J*{JudC%1=|&G*6nZe@G*4VR>rxa$ zsFH4|v5I^HhK(d{uI4ISI<@qRR=-CPg~srynS|0b1(Z4~+`^;J)Dzjhwi(9@EJhL5qXc%M~*V#!ta+al0x(- z+)3)!BkZR$#t`!bp9(eaJK%;s^Ott0QPt@(dTEPJZTnC|6lTEN3Y%y+3d`fE2v4fc zUZN>I{n<#5V4eIU-s4Oi_Zsy%F9uL1>1B9DqbRi4;k#Vlm5Dae(9@exgDgdl~>H`vGxO}6H*vywK5Z}>HKMHoVO(>}G$(mQ)c#|nG+a2(}4Rds0xlTXJ9TLb5sQ2Z2?oO4hFx6=< z25Ag@@Zt~?o)B^r0YUBAt{)kzxOZ z^M8nwpEL}z0}RQai-!FW7}eg=X3K`~U6xGf8cK#P%I}&|=SB7u$IPrR#hw(r?Oofm zFGNRVqhZ?9TfA!^y#V@}=E7!XvHm9MLcP1UHti7YE|z1CdL(NP-iZ47%It(Sfe78j}kkC)IsM8Kdvnha@J61)ttn$z>C9GRmq;UEx-9db0 z(s@DJ{D`<{5+-tgDjziL;i(Hmz0z*qWdD66I@crg32O?OrI7W~yZCHUd6(y#Y)yeb zP%nDF%alC;Jecpi&|dOu_qunAO+Un6O@=P@{6MLF2XVYni@h^J{q~yYu=oes`}TWY z))(CGX5DwW>5Bdc8)Czfvr=azO_&UG0{4vBmE_Q-63Ynqz@R0XTX<#N%MPpxlKpIg zWI!CEgbPi*$7g3vMMVfI`lRQOBi^W%gzmF^#IW=g)(%aw zqR+(m8Bon3JRqW2SiK>Atcs*1mxo^lY-D&c1#XT3iBraCokyD#k<#QYqq!@eyK$#Q z=CEEoj5Y*f^GqgWLX|sS5nSnS@B$qzx}XO0)WgQ)UbFuBMHsr=!;*9B+~MMbD{^<( zh9w1=JpNG2>$_3K6}mH*6jzAHk5E9qDSO zpu-q$O|_%$7C(qv;Q&o`z#vQoiX7>888UY3(gn`cJ5_tV9`mjCE+vE|8u)mg!X*4J z-VTgrXykslY|=176*+Y~FuaSj?G1YjDOJ2Ox)~)I*P>GXplkg}5x<}7W&fXBQdRGX z5?EkAYdZI)a^L44Yx9(KXS+!orw+{ooL@-uoh1tHyNXxGsP2pKIcj24Ma+s77+z@$ zKpCZpi<0B*sI%V(Ah=ABH1bc7oGA>EYIn#lcPO)%NWP>d%ntyumGZnzSPuzx1esep%f1uF+?%`zGbMXzD+Z?#aa6=OHK1xpae6-9tL2B!T8kn`NGw+i!H5J`+ ze7gDVN^xw0R|tXEB1Y4)xq)zux= zNwZ7Jz_H3uTog`bnV0f}Ud71!BS*$)KEWzbh|46ew3KT<(R( zZ{hqd3UvQoB@OhVG`dsuR`2SsO-4}Mn|~aB#O-)s{SaWfugcdBvf^#UnuJw{6@(mC zd3bs5sd)6Pyp*TtqY&RI4jrxW)rI|-e`PZ_7n+!mQXI<=3m%*I1#ArBtLfyS&bshh zyHq8JL57^n&qu2xr9HFN$(aIO!}7O``@xvq?nB^PMfg-feUpSO@rjH&*;qmA?0HOG@Ia4h5jW@d%-`=HxD_(wonI-WCu{7u=^Y zUos-xIohC|z^yCJQkqu;dOu$&#xPzy~GaxjU^b z0GF_`6*e*zM;>gx5*PL;f;h=tH(5A%jBpiqn0$F)yMe1SvyZ|1Ty^~Fs?S|C(`?!N zQ!zWzo7B3{ZvC3^h}RNw&K>SMuHpQwOxV0S49{$bH>ug8iF*AkHB3TZw&j6=8gE~0 z$JFGhoRM^?Wo0V2%B$X37jmNQuH(wxi$Eoci=$?2i;oD0?P@@96BM8z`caINpxw<6 zb=j-8wXxCc%UF3la&f=jb}7a{q+y8Ts$6AWHH1DX5!b%Do(#(Fhhq%vOwuqhoDK~; z^$)sez)TP9tu8c?{@~^3e^=s7dmcAv`5voqOMhgfy2MBIRllC}rHuEBUqAXbc5TMS zXv54X`LxGGt&4uu={;M(6x&@(ac9{X_Qqk*exlp0BE zof@XJ&Er4ynWcJR|MnLKwyTxpfa|i6?{g~k=#l2CfvNb#Ex4z>fUAqG^YF4#H+?OJ z1t;>H_i`tV^?aF)8A5@})r9jZ+SNHQLyANlRwJ!>-rYKNixISEX+A@RYIJY>5cANu z!yb6C@u1gi%!8)-squy_6dA?~2Z)#^UI77zNt+nF-Fu01HQ2);9YEZUjH*X>>eb4-2nxSLX}ol7r-fUasIaqp(dEW(%-cF(MQ;&f|O-_+`A$+7H`Dtm*9< zd=E6KJv}r0D%r_r69JzN1Mk6Y`lKeNXLF5K8;qM=)Y(h6jzH^}4efN-zTIqR_7xRz`cWYA8sE?$iX*fumtk~J~bh|d^!J9o&yb^NuxUivpncseh6r! zE@4|+aZPUjnXj&vxSz*)_BlV&pJCu}OEgWcPN1?H$n*kzK5p;8e|C!i#014L+S$r5 zPbbcjn32^ooBLk5D%feiZ6_k2MiOs!66L<^aHT+N=-QP>8WVz-xIxe)M%YC@GY?Qc{25kL)s@fgR2Fb9PTtf^T zh$aNZhYZ}OntZ&!MZqmdUJ;*$Z%o0AXlSbw9cX;ICgzbJZpL{9j#*;NZ`IU(OfaRa zQh%nb-@Km9108*g^4sFW4R+uon;57l3k|04GD)XY`9ck_8F}cy+)3^COoN&CYS-N$ z%wnc|`{tK{k^~nNMqxQG?@ zu_e<1F%~P1DGva0{NJvJxi2EimDvbhUecnCv>OT0u#{vFZLhg2_OYFSU&m@*poo-^ zny&xq#&_U(KU;;I=X^eug&_G@mPouYpQV;gTbWEU=;Omj?DM@Rcgm!~>6lWq zTx8Ng7JlX$D`~Yau%h{R6{nfN?4t$j?LdO(ZPV)V^|AR=M?~fJPq%`8!VGn6_B~PF zE+B=<5f8d0D)Op2)+0{%Dd9PUc7lI>8O;U#M#3#E#`0CtDyyV?6Xao8ggi-woX7_TAc`)32VUpAY{vyW32sBDb|M z&QLFs=~ONey|pxVPGr}qV-LjovMBeK0`4T z7)X{TC)(u$!oOuxhY|X}lEoL!QJzQS;_vuh9LPH)Se>9%u>&a=InEvrtD6h*n4X)b!L_p}&Ws`-|E>(N-jXj>m)#xk6{Bg-)Xr6+Q791OG4w0)T+ee#A<@C&74zWQ)c zvaG*_YQBeO=C)#5=g%v|8wQ`TC9`cPr+JaUc2{pltdLTv-Q`xZZhLJ-76Z4(X=joPxSCNx%zixt+}H;X)V}$*mlX+v<;mJS z=cr*4H~U$t?}!G_YhYt6WsL5=yYPyVq9gwYtYfyQc1O<0%nsHe*AR<=vt1o=EnU&3 zxvGb)O+&oq59rqlp8t8z#Pu4XZ=j>FHvy%7?=klFNz^=81?$Gy>N&#F?sP-3)lbp6 z`pv}Zj}v_t|4;7M-750Yuz+v17g`Q6bt#OXSEQnV!-RobQ!$TjWZJyt)~x*+e(O#? z{Ur`5)nQT_v1D{^Pa8`ZMMaFBX>Ou&+&Mw64Uve6J6Um4yZ)AtPi{B@t<1`x1Qqkf zOwQG&XKgqZdFS4Duy2esTm$TqokG%Ly=2#9+d2x*4NE+@JO{lS9RHM%$6dLPe){-N3!}`Po?N{U3M1 zD;u~PgS&Mv@yq97Z?s?61?|#e%`ksoCt>!KLXxOzf0FJbar1$Y}$ zcOTzR3An_PWi2#kP}TW8e#w_W#G$|x}n+p^Fo(4IJ7ad>QOT2)*;Mu zp&^`3Oshf)f!%Fx3s9PON79^KD?jV7r>!kHr+0_-aDKZUsKzK@Yb1`fP(kwDshc|2 zd^Am0?_=P%4q*M>9|pK+=_CoMocxPz+i#tfM#Bj7=*-yAqkS_A>%$%nmkaq<#w#o) zsJb1ihS{1g9Ks0oXdF%_kqSICyYGvwcjD<9CRp&j>u>-q{u15cUQE{2+OT=Uh?Fk<{`D)YK5 z;5*tkKP=&9F}Yi=9FgDQ-q+ik3i!z%h;yy2`vPpW?9FrvimcNUJK($n+$nH_4%ZGipx-@S)LP0fesyo7oGj{ne6+Bf4Oogq zLca2h#z*-r1q9RE6z2o??DIO#Y^CzNZZ1)9FzMylk0IHX;(onPz!HTK=z@Oc!)_QqE8%RuWst+Du28Cu(CYON>@lOrxPSEw?(FKhjObobH(%`M;qRehEucuw_ z^4qC8I?xM3WA>7W^%BcOEblV7tGlbenP*C#+wG7ZsLy2lQV0sr44%LE{p6SV*0LZ^ zPY_J=;Y06zuGTD`NLp}{cA2x87)R?qcc!#xgsP#1>C;Ka#y9V7TJ^Ct#|fE6U+)%< zco#X>sn%^@nH8V>#mJ?Trn8gpSOYuVYrKOQ>oR_`)H;$0X#W6W7Tf-{d5}uxhZr|S z>)j}at$w!l&4bWy2*SH1h0KmNTiwPMU4c`Km zWUC0zc()MTEt=6Rx=8ql5`+Gvlg)4g!jp$biKw#YVf^Ng1#y}y-*{g2_!Q4{%v={G z)g~YACx{8}q@Z(0y_|N{O}~dJr7quAo1Z9Ec41GLFOmDcIHyiYuP5 z>qs5x>ZZPLs4H{cDq`s_rP?uTq95Lbxsu^*HEpIU_^kTO$1!HbrcL8b!rGT?9E55Z zh22yl?qk|>0}Ce2 z((zR?Z|ZuPm=DBrhaJ1LU)VMK>mD08L0d1Z08KU~Cy=L17hsh{& z&5GvJn#!fkF9qfm%YuH#@jw)8Z0cb?S4I!AxHu&2YRlwrEBx%aR~qJ%Exyns!*0n@ z0(>DwXIG*i5uUcbR!8B@h+HsLb-WC*kE628|AAUf1i9uh%e$&kN!=5w?0@=M8ynN5 zM67M~oBAsQ$(P%j%J3hBF&YNPRo*yB`XmP1-8cPpjG!e!p@6_N&jL8Qc$jh9wPFBB z)E5BWd~&oc6@)?hPen>y*C|^s&UzrmYuyP8o5N&gHg0Pmq zpLD5oU-4tOcNuCZPyQ{wuBnGKuERYhIyQB3f2#IZCKXk5LGY}*6~=u3J&5F1mg8Yf z?dB$DjZud%Y5D!G`(zNFDxPCx`Qt3Y@6mA~!SsmLt#!y&doGr`Fucf8>aF-`_Fq=nv zh1Q+zB`0XN>nnM@wD5B!M9_}A@^I^X4fzKflc@I)bN%0m>kL6ETX4oCVUuJlcHHJK z-;fk;U7Cr!v>IN`&}zN<9ATSuiV2uo0YUQ%M0&5YF1Wj&jzgB)MWeQ!i;wp$~RG9qq272>?NMZ?KyM#Qb( zIhp=m=uce&%5}$cHHt-55Q}AHQo|Nrt{YvRH+h0;&A8JO(nU}x*i&6Eud=<>F)+v0 zSM9BqGqAYZ+!OD>>YDD7#RykR_7Gj_)u%c`Z47BaLeROlnd*=krYuuOP8k{N3(uH& zn*0wb(s_+AGyyt}Le9⩔n@VmuzP-Y~QL?S|I5m;k*PPT$JSjMMlGeFFbL*y|wy7 zHaDGOs5e};4`JwIp6X!l%+!|EU7oAs9N{1m8uHC0n!8N_+TK)aU-P(s=a+fq3YS}o znWR`);Aj}-!9XMnl)!baW5%6QaT;KlA?kguZ^h+}=ZS5nzsyDDN_s>-_euxtRp-xs zs z3)EC})oqs@tGdqbx>sN>px)cLRCuL=mMGtBdJUzFldPm7zw^2^yn&nPU#A0kIh&>n znJ;bn&`$R_UNT0=xOGlFxvZiboRB==uU{rwBij$xABkaCRK=_ak1XfmIu%jx8GFYE zzJFcOu!j*eDuD7GqHEAGbj)H}3i_?M;)nazB2;)d#RYFS5ZZBrtnB{yYNA*td~UM% z%9W97AA)ODK6*_QN~URoE)>n|io8;F7YzNDBs7B?Jg3qnyHZk0^6?GQl-Eu64Vww_ zS@4u6FQEZ_RwRVC!>Zksmsi&g>+*OWeSNj}rtUyn+oQUlM@OS4xWoDs!^&PZzwNQJ z#1nxoAR|*|@p7S7$-J9rC$o`ef)|x}#aNT4g)*gstCV;2R zQf5qaZd#J4|2vOu9!e-d*73RlrJ}!Knr0@Xp|^JyGvY~T$6@Zjlk(-Q0wcRfWIAaq zP`&v#@cI8|>IL9J|G%Q6#O<4#XEg3|N`GCmQVh%nfX9bwTNfPw%Hnr(GH5v(l}D^i z5UfZgy!>L&mZ#BsA=0MuyZZb&SBjV(x;44c8WPRu0lc`^3%h5!# zN1NQ8@V<3MbDG~R8N}W>=tSZx=APf`zy&4Ok?b#v=(mL^C#;cmt+BjJpu3P9_4H1Z zc<~RIX`^i%j4U1f?mxiRp&UW!)OLzxbcUTho|tbDF3q zW_&NC1Ipk_mFF?&1c+O1dM-WxUgvMosM9MV@3udMi~6mr0eE?4DSd|OVwx@3Q(Sj$ z2m3FD%4Bfwm#}9d%^hIH<+UFpv^J*WvOOL+UYJwgxZ9Frq4U%T{|X7}m$=)s+lg1- z_|~}7y?3STp%9uccfqH!8Kq1(s{KCW9On!fn6XJE_67h&@d`*9I{IG6*Q0ZtJior_ zAAj_0#r$nD{iuVF3pBa6$PZ@QQU56oq20)qQd@2Y{%Cul=wJK~Bl4aHle8EuLI!M^ z07@x+0gN#J7*Pb^Hw}~!`z~$uPzg`mXd1qqKy{N()YM1PVkZlodwg3~LG>&87a1=6 zu@Bxq*QPm!X(d6oHV|_cLk?mlStqI5q3w)%{K94cwLJWdhZ-m^_0fPsyPy z2uvC4y5ji$E9zQO!juEi0c{X;wF@1S1ji#c%H+}&JYz*X_nZ?zS_;=?h1Fs~mLI(6 z`irNK>d&4f6&$_U?$E&A?v(s^!do5!cOV_cypN8skmX*#;bsyAZ=*{32p|e+`-9_! z@+FAYwbNR!G|-Zx>yh}N=YC9Cx!*`01SRxmD8aDMA+ywYyi#-YHFduyz#A3QT)41M zIQ30-_bO0@N$TzO)4Y&dgC495G+rJuFKj}V3tBztqxk-ZG@`cC$td#%GGR=%MB9rv z5+n7H1c$hr8!OB%Ku|nxCU4+vF;RxK!{a+e7d1U?i_y9L?1ZVE3;MTTGlV|Wd4wp_ zGy}t?0#5P(o8xe5E@vn`=J7X?RMXm2`@G;Q>OR0dp+=3d==f55s%#)zKTR*)*f}Wd zHn}1wIaUoZ6@(5q-?ox+`KDUM6SWvCt_ zu}2_TV|0g;Cnlg{Ah5Bdcw-)B0v~zhMy6-oT{la(g!lVFl!w~f1~Vuey(e7mY3%Z} zLO2OToz~rX(~$r5;?2&Fm_AxX02>?!5*yll6QMj!UvB(?nC3z%EK{ay_07O{ z0bI=kpxl2MU@gbwz;uYjsHE$dlqQmuWI%sm9%)X)*s{_4bXME>0Ghl z9w6A7mKBCAva&)lgaJrzBU)tyh&|0(L=K70WGWp z0xJ8R|Bw#xIwocvFGbz}Fl#k65thq_$y@w+k)MYv7>WXGb(z`{|{IdwB3uYE=az#aE*x| zXxksl0|ZlG%PGFn5+}e}uX5lSrx<;!(XA2cX*f+CjP!bxnE$M{?71LD$d*u{X4N-^ zd0%d}Ot~N>B{GPEnDV%}M#E*mkFKpa8ea7Th%cNj%p{g`KFhUJ{@OuCGAl0*SYY>P ztai#no!q?!Z~^H+Go+VMg2BzxV7ydtSTJf-nFv*}cWV0rP?i7F=3{)}v4_(_$n6kb zdHEh-(A^tmrPhH@)RSUj-j3ykt(LT|-gI4#=CkY7lPMoD(d=canD}uE_U5xNnC4#W zbHHPw$j~9~d=GkKuiw~C6fhVs{sy$X=n=_9&%JMa!F`xECAw79!M@8eJ|q+4M5OF- zWdT!8bZ6Rs6ymP9!|TpkDY!96bmIJB3T0gLU<|E*=3 zdpIIAr3(O10hW_EARVz*BL>t2%gIDDWfYfuiLEauT&^w@8CScsZvn_`1cK*UsGM&89;T!%2yEH6F2GIRoG` zn^k_0XD6>s5c7?~6-9->5?h!T*r273pkp~-11T!Vc2I2F?rbmaZ2AV2P6{n`Q^?UTgZ>`c zvS>Jrd000Xe^}BLPF1~F#m?^0weq;pLjoXSe88W?M(31N7rQt}!VylEN#xsSDR;NO zFMi*C!9nu67M@fl0G+Sc6o4wEf~Y0#ci%R0IQa$? z2Cm;FP@MOi-+A0?GPqXmF&ork)Z~Pu9gUpmY>5|`w%=;&fJi-rn1in<4X2NolRw(% zMc+e9z1+5J3LsK7Ru_l*e{cbi3T1|(C$0i;maiv+PTpoo^fG+t7lzVF?&XjUJB1^0 zabiaAw%5Ps$0dUHe$4NerdH@zlHUFjg{{-eCT$8pa%Pj~q|wePTw=8xr`4lnQ<6p-JHQ~ z>L<#&fV6ZsUo?xdrf!p&RZ8T9?pC3{-P5jQ0nh>l7_^hryq$lIk(9N z`o+~RBb6CnQF9cE_Ot~7pw}PLNjn>&Ki6&uWS>QQ;dcU~r)Xe8V&-|wH*$Qb@e!H7 z@7$$?wR>`V(21YCo!8t;Wu;=iZFSirqFnCWZ#CWYqtlopmv4MGe-ctsM2*B>A5u2c zW>e)wmEVtfYWn%R{4zguUWiBo0Wk~Qlcb0GWgPL~CqIDvezQdCRu#3PAD;{Rf*3x> z>;8jRLXq6y)kIrRJRf`CG5GKj02@L7 zYnEit?K{wD=knl)@4M;$IZHN%?O=Q0x{R4mxn&Ra(Zm0o=RcvPzokh9)wHr>f09Yy zF8tU0X`n?%Irot$kA`6KuEE8>L%h&@V5xQ`K&;;YdSy=TAnm4=YHa*Se^(+gHGz-S zdX)EYHRIDQZeB|=1xY>sgH-`q?||Dohe?TdWL2W=*XvkCBWr zjAF=G!>oF5eS~M@;$^0R#hFIU+227Q)GK?;aV5wlnc@;l?w+{JkAPOX@3|iE9kKmM z*s|V;@=akq#`xfyFhEC<<9fR%It->cU_ZE5XAp;(sP{5F@uiM3!FzJJL0Wv|n_e-? zYONbLcs>-_lzag>Cm0U)EY&DN(kjmag`83Nab8o11^1N^6%~#&_!-PN*2*!tp$Y!M zt=lFl`fYNTW?EkgZLlVw>We*I;OVY-Zv)x3dPB0q?WKAP=0DLRwrCajj|{V2ttw2) zQsLkbpx&E@9xt0MyRX+6)D*ZIqCn$hDq&dT{Wh^a_WD&hS3-qZly*#lZGVXX^rqSi3igPN-i@sH=NZ@9M+1O@wf z@5np?a^5;HDjuNQ%16z_?qh%4EUC_5*Xmf~%z_=6Jo%41{O`n78?hu9c+*{W*<1Q| z^fjbp&0O1+=Zq?T9k?Qp5d-5(_c#3!0#N06SCqpoR#{xldsdkctj82ndg7V9uff8k8!rHZw)O6wOE?DpN;*7Nd4ROk4iQn=Z+kKZ}Se245kjfX@*qYIoh~Cbe0mHGRSlIQHhHkhep*=+&E0 z+nTEY$HZ9wHCaTs?iBe1Hx|#WVzHfAi2fd5DnoD)Qgm`E;T7U;8%r5TY6|Gbs_fTa z&&C&c+H9^(02V6=@n##F3}nGw(&OG@3-2=T+olP7A6ET zekb4hPJnZh!CT(LV);lJJ{n>JZ$dv}kCe)TYx2<(kJO*fCu|fE&<$=JMp| z0wzXK8mSJ>@#G=~4#(G9Pbt@VpSKk$y0x(*)e}c`@HOi7>kmW+!^au=so>G5{<6sFuvE%xQU{lEP$@31hHITJnAbBNZoFTspvocI>xd(tY*6Dx z9bCzCGGI3O8Mh`7W-`;_M?46GJ)Q({K62Kg|HJ6W&xm)&TR8)%lYaJw_4xN%R2%eD6|1^VY{{j?9rCl0`0Spn|N*NSE)SkS2 zgZwVwX6%&OH(AF96gN{4gKRz}ZwAa|RCyttgF1l6?%|;7`?%lSNb9bx$VGkk4vV0( z$b6c=h^Bmeq>#Pd^d7ymw?pHG76z`4quKs`vPzy>o;rZx5O^hpW;RK$Rsp`le_*Bq zu7AT!x@TLM&jPr?Fo?z3Y^n<_eFd@Gql>TG04pa5)lYCwjh@OHFYORF^tp6BQbz!K zxf(j5FDdu%sS}M)`+p!!a8lHyXJ;awVQazeRV$7uCgshFBG62#h1Fqi5+)@z6mWe{ z3Bi6)su-I2fR<5(9o?Vud2%5BP2TL)Vzu9@c=0TtUzhK|gsk*NaCjABV~0tTrHG^? z95|FDL`i{@4dH9WFn6Z7q*c9bK^J>}9k9yX9jLktg{F5?CT z3`W(yiErDyk2 z{4j;;SOmiOO-@Hgis-Pfgmmy05^%%*Y~NtifFIcU^$H*T$9DmK8xRU;(E_zJDZ7su z0dJ*H8_2);u4X-$y7l{TV=Ujc|78tWx0ff*2YjErSTNISRGjuaSfVvZZ5XU-ixQ;k zu2bdq0$fwF{+^(phgDf|k%8NQ#aaT>VrTIj>`gaQ0kCoRZ%m1KNsu>`2t+-#g}7RZ z61UGRDW}u?ds|F4r4&YG8ILO{7>IpK+`g+Y&}}=#S}S=umZH6_>FLkhLA;%Fs^6^G zwo?MgGme$xObCD?-c9mx z2=I(``{1&)J`2|y$~;2l6y0w~EWT(hcIg4!srb|cyV5|Vj8CCf=FiBvB_fr`X<*g1 zes>>Z&-sr~1JsV+mf|Tv5xYN`&=&U1^0rZF1Ul#pb+bDzhj^_<#epkzjVeQSTOTXO z3tf|Y=sspPH#({g5OX(fh__?M6UUi+dzt(PD}s)5>4o-U=g)RQAE-OZa+hd2N)*q! zhPMGWX#I&O`*PE~feCV$#d0$mJ@4(c3N!2=C5mqT!02L^wsolCiabF0MQYy@U#lrh zTv-0ps!GkN1|zh0t{vz++qjn#cMa?OeLze=ZBU(xxil;)9qRM)QsW)PM~vJl%LQxy=G3iDfwqXsx2Iby4D zonAUcXb9%%#-V&aW0NH8siCmhi}- z*NzrC6>9f-@7#qU4BJIRa@f6qqcTQqkw2I5i|ZmINQCqC2XC zv3t1=1gzYrVvp4vk9I7!umUvVJ9J9wpli*E-t;sR@_o6J&G?!(QARc?p~_j~*<}=d zljokzgTGN4l-a*f8dXxjk6?y$FpI=$s;SijwOQUj-?>%GEgPaZVs7ui0c$^1iAd_^ z&Tk2Wlj(uR=qcJX(W;Zin{E+Zp%C^)EdcRx8l3g=GY@w=r&2EKe3hOp=|>=u4e_r~ z`1LCmP$Oe1b6+?DFQ<_M=&|P`Yx+Mr&8X}iiqahB={OR0)jeROy;$?shfg{0@XN|T zEl(q+0O`Qz_Kv62TudrXH=G`735`^LvNqt>q`~5<4ZW^T%?NO>m>8J%FHD{EO?>;ouG@^Q*c3 zSIxtBaff>qyUAT_Ru7PjU(dhbueAsNbc1-W?X^eDyz-F^HYUZuwNbxzoLGN;QDXg( z8(k3RP3?TCIuvDg*)8}m32hs5eQ~l1{c}q@>aAwH{97pO{@fPOjmaR*>)Jb>Oi_*cii6lL zA;q9T9<_qw;y2IEPxF}#8Ohmg86b%Icog7s1icp$(lXyJNL~W^G!Nb7!5y#q;K#F{ z&E_VBh#6Cr={2^so3<|-S4`*_;2T0P&wJpaI zSIg51OXrH9?QG6e=k*P|Tp;o~XnVs5KyCt%ccB|M!66~F&l_dY`EazVTK9TF=|@i^ znNj^YS)lonDudg#M@&-VnMN4kwI!?rx&8IZr(^sy9w{t}_jN23D#}~Eji$Y>0#X@O zBr*^aVHLlBU)8Zn1CpH6X`sMM2wF0J_$vM2Gvz+CzMe=% zV*mAU8WE+@b7-jhneSa8_#v_r8he~v6;~c9wP?NjM+yd~k#AEz{*^I(C)5gL1^GAyx9}Y5C zDA4c$tt<`aDht2{muj!iWUbigS=K+mPLBhpT?#Q3k}O560Y`94Q+vkDtTjt-V0R1fgPci2nmQeMndq1rWoeRuHuEHCmWZGxB|6%A37b(-yy7rwR}n}}B*5F|oh&Pv z7)52ghL_SznY_-6)$TU4f9~__|A)hS&Uqd<@9+EheguSDucvj*i4N;k)8aFq42~n> zXPA`71i01h2-Xv!|9u*Nx2qCrmTuRrIUNSVk_# zop*<({jd~0rhCs;vtzQ|5NuFWxe=d$LqFSz`509y_D#0QLfAnen6zS_(h@6MC{qzJ z)D1n<(L3-bUW{L6f!2lD1N`U(IGqkU!o{fc!pDi79SIhg+?uuMer7n5ceF-srp~Z|*wIhEAb~cjl@~t#b zWtV`Af#WbWurB|8Uc4GZ4Q(TZUEF(_BCC11PBkYl6|nQB3_!aa;D3v#E$zyKs2~k( zQ|lZ(?CB0l;K@$#!(v=j^Xr zHPyz*Pc2g*$G_Uk;JkK@V?UQk1urR6%7dzTC8}q1{MXF1go|*0-s%hfLc39jV|>5| z>`ffH94Z!d80D=fjQz!-Rf78Fx}w&guj|+6u=7qla(;;tYER|K)_ zmDgqAfFc)u>nZ_=oDeZI&q{UX`Ymh7_DZ$3qLN@qhV<;*_+;JN-yjh}F#e2kkQ*r8J z;q&IuDVPidN@#@$N)pilskzvS+kcM2lYAa-1Fk2W=V(n5UBQB{bdNyYAi3!s>Xl2{ z$uAb-Q;PyeQYHEPrs}PNrEW-!318IdWIy5m~ zUz)sU(v}^_Kxj?Iovxbtb{Jj2gCz~+n1)!YruVh9TyGmncY5+-TUAAwJsj>OCFir8 z%1|8d8JcOF^59%yNG``^Y%Q{9auAm(*MS|$j18?dqm`pZwsH!itWp}UdUj5BL4C`i zGyo@@ouOsi{8ZDlwZ6e%lgPiMM%Q6a9u63cK=)$+7IwQ_Zv+G+Pde=C=7A1LI_ zsi_lPhKAks@#4Cp^>xeFHOLR!`U_wS`q5Z-^1zP)BX{E2aXq>Bi^AEVm@Nu0!jYNA zydyiL8^-iC{sGNc+EJT@Y2wztM}eNYDkVFKYCR1sgx-`eTOjQ7S{qUWM5X{7+RU|C zn*~R1b>P#n*#G$05t$6U$t8kcpcGB38>{rzt=&az+;D+B;rEt20)HVlU0a6+2|Ne? zM(_Se%apiKXJ_TYyh#J@edYHZPxOED-~5kApbvaRzq__S=zn5xI$&P>&YK4~qCZ&b zh9b;C$n?QEXM}p1?B*@b_1_lVa>ncTvb&+i?e9+m3P4&Ze_i}&J!A*V!^3R$J0|l% z*Dc{{r$z%PzjpU1_rZzCrBpMG2JlOJnBdLorhoJgnrt`DNCyVPbslag2aH7hyp4d<0zfdse~xfLpP%2AUQPBT_X(L zGBgbJUY_{Y`mOc;!#bRM&)$3P*=NUR?-Q=0{g8^Bl^hQbk4jzb!DBo;0vIrEASDL= zz9$R3j)y0iqW(Zh-+gK;)yLUjH1V=F{_A&*j>6GFL;H@Ysj0$S=BAx&9@lty_~xW& z!f427h-gt*Ru6S<0@n9_=^z>%#q?Y0q&FCa7=@?}O)4uPa(a1e&1zq0AHXIZlS2ziv^1pPfZyXSpaj;QZ9`bcb<#`)>y)lXI`j zxctdy&WkL>t@W2K6Z7F|xV84=hMKrp9+h(~TbYwmpPRM$`_U`!E)fx#`4m5vlkATU zB?kte3@+bg9llrQ`TjT=n~uWDW#>1lyM-{@+={@c>Vm)#H;}pvs1KQ>u>Tx0sKB#s z1+e`&|Mysh7EKEK_xSJS0c^nhze)Y)`2Qx$`wzQ+llot>f3p5BvV+inzx_8eV%C34 z9$sPzeXT#t`5aTI*LY?$+i%@{@yg#v8ubA)#+K3R=|QGIF*Uy7#*T5hfee0R>YG%% z*rnKKeH1%vH$U=F|6<^+RM`*1O2_GrjR){OGl>-uJti zP1YHLss}pP1W0%0ydcN1+baZ5&T4Nr6#8$48*E55q4bWs>{Z|t`m4I>V#I@4GVbe4 zvYq%-c+qv7pz3e--doD+xOYhPdXGbiSrkk_2DD^ zz7{P1`q{2$$I`*MHz{mHg(Wb#@xbv{k(k*#8(7xwrF4IS{2m@Aher64MCx{)#p3D$ zrrycyOhqg41WBy4`tY1M{|hx@|IFKhaHx!8WDRk8YY+wae8-kIxC5{g(O})UW99*6Z3%OpZLLS}_REPxTs7 z_VffHXZG-r0v?j?e+h<^8z(>P!7o?CDrG$+XZsd%WF=x}SUuzFWnG0|f761?T)Miy zaV@!ewb+lDs70<$8dNPx&cOfzRe0>VID6CF!-%=_-+mny@5gz@=TF8Rddb_=#D%4k z1s`*q&PZ@~IVBKd__4$<uwI)Do!Sa%K4#JhUT zYnXAqa5>+lRZG3*GpH2sjZ0tGV0cX>k7hiDgC_#Rh=jii6-$w)9_hks>KQj@u$Tj( zd)^a-gz&uzZI9YAeYb6t+HB3uEdwzt!zcJ4%Av{lAeG}vW2d6dBLdZH*~ z9}rmk2_5(1Q%q6JlQ<`|Y7Egv$MF3*O(CBmnrvSK=oQ>5C*ya1_`xtSf9lv5H&V|wcj-{xnKKEefs0XcH6{SM23X# zcFZSiVXySVf?EN}uj6RzV9T9J86myiRBINAsf=W3a{?9|L(O&DmKZ;2khFxH0I-$X zz)2ugmg=mkv5cU-lfr^`jL+HJuZAIhogOvfeGSztEQcY2eSBlS?1y2@?II0>hUvlH zD9g$(Z!p)ONVWOk^s5p+A`BtZJeJM+Wc*bi9P=X|XJw#LdGgDT?qtEt?5stQQ#-`v-a!X-RF$%k&q?{sMH! z7iK-Ju|9)NAE*AXHiYs^B6ITV$yEgdk{#`}Jv`J2NYlxD@!&5q3HVq7)i73L{x8kk ziB%^090FO=Q&#+%7JAb3Kwy*LCv<`eJipV=Bcm}C?i#ZE&;8jBgF`LM+;0!v7@gou zy(74Wf*ubDv#HUd=lS>VpgqN{+Ix!y{CH9%?&qw$I@C;Q0q5iUh1YrB{3FEZ1K#0| z7u6l$yp-gzIEaWOIx;(Q5RLY+Dby{o7ryaqL4$|*2-!QjyBSczl+E>!$KK-8kTX29 zgi_S)z6pG@1kImiH7SFgwS`M5>v9t@Brr+f@F~pFZZ0jQHRRN(O-!fWsjAL=Ctj78L zxyU4Se!_ZB0n|W6<#W}J3 zpv;Upi2QH3E`GQ&w{QV-5u>p0$MMvNqNhoS(U!dLUj;tMAm@xN)acV7r$i#`*WK#R z=9NCDq;T$;zoJ08;MOS59|Vs>rTy7{QpMjfZrRW}Sr#0LYp0ueNe=r%OjGfXH~Z`& z%u7XLySt(7k~bX*ueLDrxQh`!U9l0vYA78sp1Aus$)8u4>e>UvmGe2KxeUfT)^v}ksqDXR$0^-pCa zOohq zYm|E4i%_P5O+gd)=`F(%FTXud8^9bcC-&>NVZYbq>SG9QAB^dV;e(4A?!7aW5Fx*g zWaTu;9IMXUSE0ze2t~+1^}u1SEPy--#`9&gNjQm3d0EH@Ys6p=*h4qJ6q(FZVLIC zDbSHBVXqr~6#Om5VsteLwjJ7db1>4G40cFjNEbQ z?yW9NK@t7hWjJ)4MJ5AwXQRfof~!gE;jfESIp;vhS>>$FH7z+A!IF;C=4_*9Z-Q~{ zTHuGjnrLqo71R3xjE!k^MdW!iEyL{i6h(&pnn5 zbW6TPr+Z9Ve%Ux*6$mh)xj(Hu?RMdV>^NFBogMc1-n7$nA-Ep3{i|Sst&Xg;MX%hd zC%TXq1ik5L9fnz^N6ry%_mCp}r@N~AHgecgScuk$y1ZZ*;w)~jfl(RZ=XFnijlWJW zEcMbqvdZjIGxuV?GNTl%=z%%KjuwXv7$zi&?ri=uPx}S-6C0Ap&wTc488M7gRhr#j zV92-g?K8Kn@q^j>fORG!gV_Z7r2?iv6$EbOaBttZh#rsTP*@;`O@Kc#sf4Lt9&c?w z+YKVOK*OUOY0X4*Y;~udq-II_5+2X-QHD#q7=v$ z^zzNIitHcS@RpYaX0>SFsz*s z#|_G(=IT|yKS=~6S17qFg=nT?LZ0w_Cxgu0_P=#3Bq49)MYK(ro^pC4?FH9nq+>lN zN61m?q%(e_+8dIUfL7AJMsOD3y8@|e@)@_vJ;0pHn63|Ho-^uG_=6Dbj1v|Nf+ zgeOK}S^4~lx93ihI+xY+$WEIz{A5IcB~SY(Ok3?gdW7XJ`v0|o7(zbK;E5vVp*AA)134 zOmJn16K>Qh&~D;o}hNQV2_#xr&h;@WJKFRNs}SZckO0 z`;NRfhH;7>sf0(Hc)yk7Y87}d?V+`dkM089qy-{&MmM-bs3tA-QMN<>?~HYQ79N*b7fJBQ0UfF_x2<%G)Y( zJp5jTx$BJyrw0EPQYqCtZQS?jT%l1~A)39iQWn&B(8ugT@>~fj>oC4xN<4|9Heaiq z%9_%Xnu+$rnn0RXc%6+^HXU$yr2UiENbn^<#30tDB+5%(X7zA_btT;|#Enh7*kE`4 z^@VJHl8*ZV-4tK3iK|b#L}}`R7Etd@i6#J!$t4&o>cpS*oSaH>9q*xd%u`ZRe>?(x zlee42HfX+8cAYZj5^!YixL>#HNk??3)J!m2-OA!l&iVdu?fR9(r8ku`VTz&SmSJ>M z>{RslBvc$MQWB9N+7jw`BBwWyO=@K#tTl=CaXlcbK@Z`njZG<)rx)o(#`#xP z)twBxR5frHw(lqA#4kA|S2l$uDnk!#e90kf6~Pl3&g!IVvYud40;R7=6)_;feY8*= zrYy2~aL&Qv6IH;HwJFTw&I>ARYhTZ>cJ z^VoPIC3IZk49%hcO4b@_cpjhh)dy@Km8V+~8q>zxSZiQFm6Qs8G~-)fv^5hk&mx8S z=!S`yrlB@sF+xKPrjZQ-xK-+ZfEPd|fHwdH#veF|f5pE5lmck^hfKtO!Xv;KP&iew z0h<2?U2x(5EW1KoFsgrIHH1|E87cq&Ny$}Qeg=;WE#21N`XpFrvr1#2|2SLdp^*;9 zPr**zbCN?Nw=)d2OLsL)*X^j*dryv}(!L;IV@K5))&g7F(6cITjXRl5*~R zcsT&w2RN!W2Tq$HJhgKyvx^Fo#D4VFdA<}mXUIWdpQE6kUxgO+Y-*1FaIMF!q8n+@ z&6Kc`61I`1Mf}30N&bVuFDtk@TFpv@#-~)8Ycp<6xG&rJGLc*cT?K;cSbqc!8pn*R ztopj`nw)|7fgR3lJ)%eTJ{M^`PGU`PZnSeSPUi_ySWiV@Ip%BG6Yl9aPX9>8FiOL{ zF85#S8>`e5CL0$ioHTL`kw&#YmoBR?n(ghn7G2bnqB&ajQW#Zo&2Rd2`yAK&4RpS^ zp7$~0C9tPs!o402{z5{+eBau56nJ>Sc4wpp5*}rrCxP=88O82xM1RyBYMM>UF8daj z{=2PpzSh5B-5P2jC3TGsO~;ImV$Vc)?+s^#uL%T9&j!8N`S?+M6#14%p5Y-xiTSA( z=ci2V#ywgfb%(bQJ>vXStnCf|qzY$=SJ#F{oVZE6g4NsEJkf+}D8jQ41iQm%)c})# z027x3!or-AM9$qVXue=?Pv1~w4G2tu+PWX3J~*Pyi%h;@I@_DS!|UQNj1qp+w6z}| zEmbl2=O($fWR)-XXNP(p(u=z%2A1zXPzgx3#KgxXcXKafq%@=6oWn$W;`CxlqBsb_b4WY(wewcVXAbK~R&kML8U_#)>wmv1w+8R!ZIw31eyQl3q^(_u#MTkuG z-l#Ke3@-n5&#Gw2>iFYLk$`jR&ZLi*{^JIgqMO#ocH)^ZXe!Eb2L3I$ssaN#SAR2q_6ni+ck9G|( zAw_KkAXJASRVTJBz`ts!lJ9S7OeYbXWi8Mjxpze#mL5EUQ`p%Z9INAEnIr?c-F+Pm zxMzD4`?U+sG6}8-eDEzBfd&(Ss$&A!tgOm6n>ZnB2fs`m^r)QDxRFE$&Y%0>6fn;qHw&*ysvF6|~?K_()rb@qpE8-rcj2Az%y0kiG5} z@xH43@)mgr=aOG>8Y4hf!G}D_(fzzI8h$MbS7pu>A=ujI+C48}vNe!zA>v7NbJ z#_S;(=MQ(|CZjYViP2Qz=RwxAs!v_%#NB=YzM!1+{8wnObrg zhO$*vyQERrbuS)_tr(dxy!zI7!pT|7xHgHHXg})_JyE};I;}1+mRP1od*9B!d*>i1 z?a9}tY4M*6LvIble7BP|^lbN%SRUIT4jbPomSQk5jNHWxaE_^wQ+;`7SL ztB-1?4%9#{whwELs5bMWBSW|6C4QJ3vutnkv!YTA7CPwB_wiu9$LbJRZdQE@z0EN8 zqkH>4z2{=Se?cM3)|vpBv^K)nJqW(l}ze*(ruK+@iPZ5GOWWv zoTg5`PkI_=dD{G|D}%Ckr>3+&2TBLJmXSsZedb z(9SY-HaFZF8+dk+b42?l2H(B5BS#5?Fw3EcfxD><*j;)*ZO+hz z<-FTpk@IvAo+cy_OV>-eK)S2*b3{)+|9nw|3?KXpzCiV(S2;iW!AHDPq(9q725gMP z0&!=A{#QbG_5|^C6R6_1E-21h{4Egs99Wg@E%++!MLO{kv(`l;I>UI()qFmfr2B{S z4VdS~Qhsmd6a6@{p8mBr(FcB*^23|jBtyPCdvS4z?n)D6WOmG|@RYb&0eSG+Z=9@^ zb&J%tLXXKHJiK>(#pO)piNIGrvHZP>x12JbQ1xTB!SSy(KO~g=j-8H2{QG#^R(zRv z8Q_FrT{O2tbOtlT?Po2XFc`maR~Gkvu^*>^Kmq3O0jrP-IrF55bp$i9=p1?5kQGO= z#6WrmFLMpmRuh922Z5&F?9Sve+>SZaHQ~*IPJvTCaq9Iwsgds}u3UsDA1Op#WM)lZ zBuDMUZy5SGS_qI$@h{n|UbRyhTYMr;ICvSRCH~&l^_bQOlz?ucI+#{t{X_o7O^S(! zWpM0GMe50hw0q}G{E)RhmQO11Jx3b>-i|LxbRe4dds%ajLMRjQtaTLoIfGN&uTgQS z#u|f3#fO?+FxQ0~VObB~4^8-`90H@w-SzZWK}1BReVO@oJCa0yYBBXAb&RFk?~A1ONZ2`94SpT7Lyluf*? zekU*#L!x<4G4xSg$ar=(zPN^83ic+8Y`&a?h9j#`n+M6DH12otP{0e?yo(O;iS!rU z#nQ$RcppZ|p5Bl2VxXS}OrJmxMGVKS(1QXR`i` z8?+kWkFg9v;K6n$*uapCVFFSoTo<};El;gd`q+WJNTBlT*l|H&5{5C}I4AI&g%0$d z$B^60u@BFM`bDz_mf>ZBJMn!q9amDKlt(|yJM23rwyx&jUMNoPWRkW|=)mPe3N`Ok z8RL7$`#KeKwfLX<5>PJaW;_62TUix2J(mPRvv?P@>if+@R_pz^{te`omu_!@!WYc) zmn&Fp%4|xL7fGrzC0(rfAI@&iKY9<+M5+Ft#08nov^9wjc+_Xe^}&E4HY zSDp6Hb&I)+O8)MJ{Q=1g`iRT<70JMd`1uSe#5~@vzDhiQI<&PsylKkwk{p z>wC04Wv@Kxe%bwPPD80t7eMMt=N-Gz9~qxj;cT^Lzw+&02H?)Lsx&VL%cthGh zkx308_%tbYKJE|z5b&M-7)#%w=ylc@cD3ZyJq+;+s(6mm>Oso8&CT_u(aaG?o_dy+ zpZzPz0@%(U0I(bYE7Yf%7)oo<+}VvYz5HIOB6atPI-FviqUn81=6r@^Ku6&KtjM&( z#N`@PS8nPWATlY8=}ceq^2t)(kAc$ykw6m-z2v7q3S&9TTA`kq(5E4|)$`dSNBHf# zWM9Gg8>EGHqq$pbw!}UG%whii!}H5tTUxwB775aYSL`5>&`046>$jcwH}?8b2tiT!GZ-+54n z?~=vJ#!@u!exOri07>=8{-$Ch$XKz$;)!4{<~!zvy2@E-!2?R<=|~ zsPH}&3^+W+K^J5rPCt4@xOQ!nNElJ-@*&g1TYt6zU9 zyM&lKoK4ENOxE>S6Vslc3whXU=N@DQkG&Tp=W9RDPF@GY^E~)mJsRjz4$#k96Tq$Q zE6GR1-0~%7MTbzA3{cDypFDqQ2!H!X2w}$Rhrn|*pl@IIY)RiPnl_!tma-L@=tEkjX`*EP=cyZoLjFaaS~X`!ijUlVkp{r}u-&Q7|hyN$zZ4X3ybp6hI1eSBfxJ-3bCQA#0=SMp8( zEj2rrY!ZT`UMxa0NUD_~GNpy8<4<-{Z$u`hBsH@><~rL4vPAtZY(`;;OS#n1aQ5PR z(^Ely4Doe_YuCItCq|M4#tRmey4FYOy=+NCucE}RHTC)n7^~4;{lvt{v1e`;w{~|! z4yPED0+SDiX>bMGC$_rHIADJQKgJCaa(On8&OCl>U?PXmrxSs^_<;0RCp0+CeLjYM zs4MqO>U$q2eA;KR!gRYMUPO)DUgJ@yZ9qqbXVUzUn%Sr+XZS8V-@Q%x9w7TEbrS1Xc<}Z{yctC z%#0&D$oTx~r-6Zi3&!Pxwxz{#!BzVMCp_?5KKkPM!xCJkvzYnm?ZV>BXO_!W`SI4t z`=89Sb!=mzN3XJ($wxD3d;=aK>@JB19T*ap{L1_pzEV=2sLe*^MNK z*&&*BRe~djeX2H{*b9+X zxnrHC6HWzVIA>rC#z)`s6uNT*ImiGYbiP1y1%o`$WMxAR)T$u>;^zspGyVDKPr&c5 zM?gj9>QO`*(4!?u^cR5lf4sTjKXZabjMgnd3nB_x4er%F{v6HuP$i@Jl}5Dcedb7GeFPoUdvmC-zQhca3la60Dys$U z&+#%(I3`X5aF>^^ss)#BQJM3F(Ecqw5rxM4IXQWSNd*$Gs_-(YFs>-5@jm?$Q2A~{ zL96_x^^#rli;JCI;Ipa+W|tS7r83vu&d(O9rS|5!>_(95z`3`=NPFp)7beRZpC7$D zOJRy6f6!kktjjX#L52^*4v*Nzja;5}7@L|1(KyskBuze{A%`+O-)903b zYo7YE=VusMT^k6EefD+n6CY~;`7`0$%SAwU6yTwNB5I_ew8;B#L;!Jh3q-zjNbeL_ zh{1;RBwxoEJ~t`VZm0=n3L$^Se8HTOOm7EI#$ud-YG^yuSf&Or|AKk~MF`GcJ@$`? zzRHx_9XyC`LT#maZClpkS$^2vEdzL*|K55C(H*-5Ccbil#D|TMX_>_XTo6cMuDrMa z;7}hw>!i4EoJF<}63U8>2pxick}u>m;`D^y7U^BC%r4e_V{41WNLy{HnNt2_)nYed zw1XEF7B0GE)BS`h1x^z#gzh|jJZ3YJF!- zo8G@?BekETyqRvlxsFPD>$oe`TRvje;GMU3K6}2K{#3m2H{I6s_w~$R4zpheBP!cq z;jc!aM_=m~b#M1A6#MLoowGbo6{xZ`mR06DT9EL%S1ot>yZb9*=OmP5|8#<>v__tQ z_}#Uc)7@b(0Bl!tp4#sHXiN3IKP_>-IHvIH3k z;~(#*>2G-VwpIaL?Q^*oowtAZ#61r96&nTc{xt9@{(1GiXW*yR>U%!!JzHt7+sQ;q z|9BN`;^h|k%JhwX)alAB#}RsL%bOOmB!O+%d(BYqfibT1+8_@wF(U?}b+#`C-6|R7 zO^Z;sq}DhON=#sz4g)rd97i;cta`J^HP6pts||haA>$2hrzNS|(RccXr!f=DAJ{rr zKO)9zp1Uq99vm4xFYrA)H0<9y+ea(7Y)Ki}5BC*v3L1uQ;}vF9Mm5Fk{h~_O{r>NhTq6wcB=HW#G)AIss`ePR+1VU6 z5YpeV^9{l%-!4`stMiAM!)=8Bs|5+ZwE5Sq+pyF5G(1s0@Z9Fi>}*s3MQg>uK;KRJQ2J*It`(Pp3}Y$QwR^#i;? z$&V(4hve_s#_z6rb1W-1iHGLmW&QzWd3+NngZz+7S#WXcu%DMGJq)jMu=)xh00Fb` zJ=N(00`Mji8Ty;NtccA9Oo@*b-mMFk12+ypw<>INp29(HcYQwl#? zo}@tIX*2JHgJ3kW`%YHcScmOn_RWp!Y;esLQfgW0F#ExPg@yFdq_%awasu1nV1- zo7O$4Fn1HgO!+*Cs2AvSJ6kkd;P?Hg>3*k)YUS2SB%thKAWK|VqEtr}f9F-z?AP@v z9m#`d6Vy7dX13=DhY10RzbncL^s$01atFIeCR8LIgo8kb(IC%x-W`VDB-n(L>iKeP z66M?t=|t{_@Qo}Czha0dQ#C7dji6lUBcNr0rp#!0AdCqqvq6Xsag90oIH%7}I30%O z)(ZJtCl0exB}`PPHg**M6lflvM8G`DF8ikz@hXx}Wt*_w_mUD2Nbn2oyC!bYm!u&A zZ~5?Ss$pD5kN^*c!-_@mn!Y9MwrQdY9)Es9wsI2@zSVrMD->fDIv^9nqghS;zCvV0 zN6;>PkVRae2WUQQ6=(VIrdzaS_@hhQLRe3K8(eT+&B*wEib&MWwEGTDwXf58`6_>{ zrp#^MKpwn-D=RB4s78#HaB3>Hm$Xxfh9p-^#?&=Y3EJ;JxuK;U<0*&75apO#XUYFz z((4QN93yjPueTcfL5y-$QxWG?wL4N3kFi3%`VPH!0B4oa>8FhAg-W>Ok_f; zTa#@sOw8Y`_8dzaL)MTPJF-)(a4f4UfWUG=RiS+TdkP{scf*8DrC_V1i8=R7F~qaY z$#f+3Q*u$Eo5`&YV%ec~(B9qTG^-jdn$}srK8`4kF-sRxm>6RO*Pw*->(yfpDr0iq zdVYZ>NgK__8Vew>McF`DDtwhv(&l|xU6@fjMg3i;!=mhOUJ@2Jr<=2ny?9Hg9{#Dr zP2^KzvfRs>qV9^aGNxPfiXmIsXH8@w6n%`62lWUK;b`=2_am zWtWcjlCT@#lg0?x-JX;17YD;zye5p+MN_Z(R`mkkvN#7V9`_waZSlof-DR6k@dlaw z9OC^>0G=G{A-yUm|Iod0J#t2&le2ldQ=v<1mI94c2+_%ol?(lYhrK^>#sx;0VYF05 z{mJ&eH)B-`RMM(c#jBPO_82SJ9V80Wh&?w1+&k6;oO%VX3{lvju*;Wan!GiEy^wA8 zD%uSBhfkTrOfmc}GA|H|%JA}st04U10TxA*Ht5;xCc8(k&}TAtEBSmucX~2>iFnK( zeOm*$_|c{uJQfRR@704}ZY1a!MX@ixZU9E_?vJ@g>*F=^<#*&Tm532mb4Wq0f1P2J zbhUrx^EhIJzd5KWQa>_e#LX?9TQTIukkI&5)&KR`qQh+L6d+VZ_t&$aEzfm<^7g)x zzR?l|k*APgk5r()HT5IUyXxSa!I1i?6!(ta+c0i^PRZ+9$!@>t1&LjkWU7zZ4n1}M ziE-MkKR*U2v$ZKI|7Tn1zayWkn+<>6X82dB9KgN*ch;M@dhWU;k!7?{C{qwCT1e=T z2S))=#~Z*%yIRne-n9G>5+4t`23z7)#lF-rB(*2J&O}8G2C8MBRD4+-r;2V-$`C zxN^HzthcF=5FARyK4HdjiK#{fvPlA=_S5g)cSWeLC-86cXS>$LMb zR!Z%}KmwWn;0my?^0Zq-k`;2vtF#%n<>VB;bpD(qzPFR$DYOhUK!kIfG=0dVQv$k2 zRf3=YD>%N&wXW{7050t+oBG#<7l!}3WAazy#Q(eiSb)E;vHX1j1+R58|7lGs&7kspV08T1^vtlLGDLTzZT(wYx%|QK!6kel`HWg{ j{q-Z(Pae2;_;*yo%LiUeB>>lz@YGebAAG%U9`OGFbqQNa literal 0 HcmV?d00001 diff --git a/content/en/blog/_posts/image02.png b/content/en/blog/_posts/image02.png new file mode 100644 index 0000000000000000000000000000000000000000..dfd14d7cdc9943c158cf5b380dd5d07b1beb4409 GIT binary patch literal 30770 zcmb@tc|4Tu|2KS&HH6BRy@hNc>rjJG$~rWbVo(VoV;Hh8QB*?N#@5I>hKwSNeM*tN ztYsb9$-eK;IbGlHbzQ&bx$o!x=YGA;!JLl$_#B_@{XU)<8(m{%=3@o`fK~VUl^Xy+ zg9ZS|=OYZ@n~FC))&StWt$Rh&)TjSLXRdH^Duv_~hH7@{7@Km^JP)0|t;iJj^3@cR zo6y)zB~!Ipw_EF5jefgT){!|if5JcofRX2-kztk$}ufbxn3;aBXku;Ae; zp5gS`lksQf<05WcQt;m`?&zbd%wEjsxe1;^p7!;Pt*PDc?_uh^Be;r{`LIN zk`VNf|M>s{TK{_fM@_Jm|J#*s^(5kL6)kLoU9ul8sHLrssRsNi`sh7JBB=w&+L(G7JI{H_7WOx+@#^R68AQ!+;YFx z_n^FExmev|LVTc+mYl)BXD&aywuN0}JT(R7nNt|rsyf)$NTP?zT&glC_1m9MlroXf zeOzuf+FPdIH;64;*HYq5)-Fv!uV_-&buvMNMe;0sLG{O*GAtccsruE3AdUwG9ioN&7T=%Ks0c>Xc5OmwC@Z=Ovgte@LTWtMG}?o5 zn`=YbeRYOX+Ig^TR-Ai<4G?Vo-mqwSp+|ff*NZQKv8Eqd4x9IEJh%Lulr2= z?Lo)cfj-vYdDNme2Hu4#gRz2OovhQ=is)=>3)Z?U~#Ga2jn}FXN<~7^ee;!RXQg^R?$sXU=%{4cr zx^G+Cd1$TPRkreUcL1B%6p7L}5~BZt&P+bs`S`)q?36|9l17|~KsFO)k1jJ?bjd@f zf;2+DeY-r)@@RK6PtSRxWrD53jm(yflZ*gcNXui-5({5$#V3uc;y<^nrJcDDcaObn zQW#xMw>)R-WaVp`AU-7~s)&7&BF|vdn5}n08Vzn!Q>l>4VDe#wqzH}jp~A%R1g|OD z;5|aX*j}#d#Bq&lO<~T3k$#tT2bRe+0G9NqPfs$a?|vofq$umh1X`84rd!W+o(#Gc z>^ocAnuJyK=uK7L9`fr~eqcaH7PSsl&`h%I{bVg!>%G?;*<7nHv|`FhuIP<;m;Py2 zf6Dq%>Ir_Xvw%!`wz={ILn-pwy1)}Pj&|)@c7dm=bxh3lK{x8P5r{G9yBk#!ti-Bv6l%nm?p+7`?<-kNWv_Lee}C-DU2ojjVPrI|L1! z-EjWixK6^B>Z`i}}0rVw< zdzBcX!UjNgifVk`Zc1=36>qr~s$3eR&$b1&e^4Zs?|1C_K>is~_?M5Fd;IDQu2OaG zg#anwRRG77#1vOlBm!q*_qf*r=dOBIkX#|>iL!c>S)Cv=lDBg9FkgNm+HkBgIfXH# zrE*WE<=q|);heqbaf|8wUWK}fTh&P1{N%cg+#<$su!|7la)wT{tH{&}dz$d?`MH+T~xG4o|U z<%oCdXM)48?psG*XPJzhqsMSL$?LV5jl)GDsIma34$`cO3%WY@*_=cofPZ3AB|Ua3VYwz2Ph(fi6?ERM+J}e;I+YPb6)xzB{3H29{7#uW&RHR(>p@!}3q$Je zV$o=5=8L(n85|BP#ekz%nSFj|?V+*QA+ap(E-@Kk8(BY5dm1d}Qa zH|zG;c#hhe!PUzKjtZ-(+qHG;Lcr+^B+&rI$ijU}nZwa9XNO zhF|-@DO`p3O4; z5SA5FCST?W6*y~$0j~KZ*-5KvsFblnMI4{M|0PJl^`Ti6Kq{8Nrl{3@Mu?Zg@y^d* z8MJa>=|T{=er=pqMLVKOJ`OKWgT4k2I?Sxyi zrIMng^i6^*wyCv*q5!2W6xHA->}*OMg>ezDPrD_|B(|I72A18k z3Y_{nYDa5(UGL(GE+Q7YYU)yb6dXulLi4-kx@J3-j<0UgKk<7%I$i0VgLg}d7=87M z?sd%pQn?l>vVjBy5I$4ZGyc6qDnE3jYj_00O15XB+VtDjQwD_c&_v0Soy?Fm!|e-Vt6srPI_QDv_Juk}-^%f^Zh}%8T5f zr&41pk%?C!X#wMj(8Rq@7YMyCf)6&lQ+`YQRov^a0U8#(zjvG-?YCo6`>oDoX&fw% ztaJ_Bf8$tm9X_p4`ZdQz*8(?>Sq7+e1jtN@2gJFN)Y&iIS7_3h4?e8i`p9ZcuZRq@ zkp3(k_ucez{eUw+mrY^$uMMyFjahc+b1zNy?DYBsq!p%Z|LV5lv;2eUyqh6$jN_^a zUcOp|Z8EAg#Z%V-qtNrNh?^I(A><0z39)^t;O&H>24JD`Nx5SG4#l52gqGsLif%z! zbNFa+MXH2!eWRb?#b)iDW^v}7>zx;F+mxB+9nbq17Jdyi2jl9~DrCl1pImtF5yd`3 zflGVs2(Czi5@ioM8};7OHpJUIP?To8!T8Q^v!`Z1%uXeE#)lwdzg@KKb1mqveKBRp zJXq!)XViRKa(t)mz}2Xn1FS7dPw~W~1bIiIcJwaFjEYxmah-bfhE~N@ zDqVg5bEKoyuYis#q8b(%v21tg8%f3ot% zK7aX%%Ossl&D7aV??Sf&`5uQo*Y)7Qh`19*rmWW()~gKHiw?NOE3e?S7CBK~RLRc< z(h5S3{4zBU4C(UFwDd8Emb^G?ZWg=3c!gyR+4-$(C1z2ql>B59i#nRdZ!3AI_~p;I z=|V8RN7Fm!yvY&7MpuDj9RLmCc##OQEx=A4I)Hh$r**o;q z-BuwpB_S>HgU6z0!`)wUE0tYK-yV>ZYdT+>iR0!vHtX{#wgS1bqQTA&fV&$@hhA{A z7=8`Ud~;pM^y+o{i^#GeN0e3R`N#X&%w~ux;{@afjnWJM853s+g1*r!X9wWfc+Ku) zVt0K#xvsGG>~BJz4ns||@$U0b`3bm^a^8t?q3V~J;ZgwTgEv5oJgf=M&oEF_kItt_ zw35(fc8V>Ay`1dSYWRch0C00O5WS$}7}3a@clAuQx^*6aR0q=L^b*nq$P#jo-DaH& z5iKbJB8S`Xl5Hk&=e?BLv#9G@oa82#{`AV%(^~YD6($N29_0~AE8TZCJMn&SRr60w z*eD~o%)Xn#TPA(Zm7sX{3GxRW)6zcnNwsa;GNFL9oCk_W-y|?aF-WiCFK4b|E|mIa zIU>r-WgaDqrnh{P<26*KXW-m}VQO&YKQK}y_7!AH{?h)!0Fwt9Nbub!?()FP~Pi7wX*QM2+l>G*M!JllbmM6SVpDV0bf(q z8@`2v)pRg3gKTIWWw^3y_)(H_fPm@ANREd}G^HOk)x8RTk^jvl*;(Cv!1;9^-q?)g zdFr$&I*r{}GtOIj0CO$U@5Pxx-Xlc>?7o9TC zIaLf0v`@a1YJP=rPA_bQ??0X`=+lDotPK|ZJN5FPS4Tp$|2(vmKiL#&ssH77@a_Mp z$iM#oS4WLrU`V4*J6KZp!^Qk`q|F==Hc&g6A?6rY340_Oepa9vPG zn)iWkZr{}!gPG6E4hubfNj=^}t{V%gRO2}1H=E2;x73Y<^@zX?-{C9+%YE%Tj)S8; z3%CD_uwcaXSM9O_L^a6Za@L`f`P-Xz%#1uK%@vr|$wp|3T7+}kGU8gB@WEUdoAm22 zuDQhIPp9c~J%%f$CVw8zt zf;pJdh2lX9VGZZEk?{Hv{+yAZn@+Tlz4FN6({0ef1^$#3-v0KM)HNvq>sf&*S@}9Y z{fX{ySUq^JL5to#ik@2>zPGcsXxEFfv>(>kH;RCU7OkiDrKr=&IQ3S%GD$3~QBuJV z1RaO~eGmw0zhlAmVZ}$p^2HV5h}PJFBIrH~Ly}r)9Rua!DRQAL9`t+r&%xEen3SI^ zcxmq%;$l!}a&SFtb@y;xNaqOGLT8hml^4o%m5`T)ax|VHKvG`nwhF$G!=b-y z%I`Z%@h?jGSpU3r)@%+SvC*J4aVZys;H6HulsgU`1cQ4n0sv1&O-J3GowYeT-0-f5 z&Jm}@(W$V0gWUGEdbs-S9d?1+Y{EXmAuf$Txp&9M7m55ZE@{#HC(w3i0@eb8o)@5m z!g|tS38kR7jKyyR17uNNisvIgYtIbTy#d;jr$t`J+0+EbFJrRaAE9xG8U-l*!eqgN zbvJ{e;JGLG;%UMhs-pM&Ee{r;&j@0~Wy4zAh`7~`2;4m<35TFh`*7Gt4$FP2$eq^6 zvrT=Sihro#z`!mTdlCbnlf%jnp6oB1vcYm9!WED4hq%}RVm^o>dR(&!j!#}u&X+l4 zRnh0VT<+8Fl+mlMK`3WuVY!KkE`aoq4(&I45VEh288ZcL?7~wP!NR)kYNJK4|BW??wFj0FJHNTSS8DdnYuSOI86ZU@eTtV zT*Yk`^sa4C6>;$BX9UwyJnqxL9$6WX>43<5MT9jWo;4u?G3j`KbTJ`XDogjGj^EKs z15-NIgaoWL6L~_8?Bq-fOE?O5T9As;Ze71p2Oy=?%q|{>i%P@WDwsoBM9K5p6PgNz zcQ2lM>N~4ba%1XORYcTDhiHL|5c0%nvXlHzr;^-X8Faq+JJF&JV+~*s2csvQf?Ho? zWd|E!6~=YJdPX6{yMFdd%&afaM8)qYVtbU0SMm5x4uBM*L4L_8Su*_u%PCiy4om`& zLExJgsy>p>d}qHKdilE@CyWM)VO5Kgp`I!iV^}=!*v@Zj-R!Y=>G9@E>k}yz!NyJ}NB(w5gl=MlV zJ9}kqK1L{I6_ce&;Odg4rK}vGgtH1i!k?IxP;0$Vd`|?xIs(wQJ|Z|h51gN!_XSRt zkd}?dPs1YRG*g(4bGQp=KL^K3L;CnddkG$@mP4>USo&y7eWhYJ7#Vy5hkqUpnv!lz zolje9&7`xzvD2(aUi-V6$qTWkUr-mr%mZlYweC++%f_K%xveg}^B0Z1Hxq!8#a z%f_9n-CImx04m5$Q9N)Rh_jN@Y9-M`VRb*ff4em!sLE>#kW0x3=ty$XpNR*pT9!N< z@&jbx04O<^f}$g0aroZBZfs? zs+Oet#{sMuHTXQAz`v~}w1f#yk4zgGl-J;KN)21A;hVWC9m$W+4akG#dLdD*EwIwL z<+O1E8w*-A>zra0`NI|GUp<%gxyGqlXk^Y;b7{Kd#20qI^`q)>l2dI=i8Dzbh;;_( z1!WogGm8gdJM@RnBZqsh-Jk$Wth{3mb?an6FebX<-lyreX{ovDUyZ%C0{|Iz5aehj zDa%4rI^J3=3ey)w#KILB8oaXNJI=F=2V~9AuN5UWDWH;v%cVx{(-=!%TC^HDTAgWc zDTYEuoxt{XU2IcZ$oA1=D!RJ?9tv<5o2HjtZBV8}r7tf+uH$Y%tNf)C4jyjnbY9#U zm`HkM7XkfxHB@fuYPmrWf{jHxZ9`U8s$2rDt=}5`TM&cdz~T1 z5LW0e^Kdr$%(Ma}wnT|1IGH(U(=F)ieOHXm$_OTJy}n^X`7=oWWk|bMT>it%&?2JQh~nsY_WO(Km9p-1KVu#yyV|(7oxdlnD zK%0=}nc-}FpY*Z<(mN_+s+l~;2cjpUTv1*u-Wkps`9ssT28`-)XM#nI=yGJnaLPwRT93x z?rnR49>9K)>5d5=*nqZFem<>`7c#5MUwTxW=`qBJ>H3qAs7vUfg8coeM0!U)Y#!ZH z8jWCqM4~g!HbP;&$3jH<0ZSXCq>i>NJKn zc+AHfx{GsZ3g0UcuU^(+iqS`CeRrH?^D5=++n)hi-JJCMlq50JyNb0L6{Y-|cQAM% zC#jm1N&Q@p4J7p>qQ<|<-I9Rnomp@)_H7wjn|O`h%uk$Cz&;fb<@Ie1ekYE)#R(`m z!kju`IT$(D2Jrm;QRuhCp$njm)*CAuS~FeI@|k{g*+ANH6gkeWv}D!)sbx>%{hpTy z^hF*4r`L+es|%77^UbfPNxScR_}wD;m|SkEq}=KpY&GeYPg@jdwE^Vz_{=j2sE=e2 z+oj1zEy7>|k`t#Fgxk4lXtZJ)K~Dm+DM_v|ZjDFe;2q~2!sn{YQ@{idXej|oKK49x z;Gz19h!ejhN`DmDl!8Gu2ekpWqhJe`rILU89_)fw-=AzxjX8eTd8Wy?aqtSp=aBJF z-xP`Afu#Fzv-a0^8+$9K{@4VcS?A%OueV@kmWh9C*1~4vVQhj}z={bU=2g5{0GR7) z)h!0q!8AcLYzZ`)W-2PsAR3D0C_!t56ZG~X(^wX^(uY4DmBal0TvI3GLaROU!%i~S z0(1sw(5T^jBo_2w4=?w8{hsy5beH(f)|W3E-&pM~vTePEoBak*6GRU6`}}fRrs)Tj z_H8M9<%Z|9h_&Az_}>=;u-Aa{yFZ5<>g(s0jcGuWFO=_ADHzhC08YJo(*I9OQ9Y_H z2thtdwD9&zRJUU3I#L;4;9K1xx{pbGK=pQ>qq?v7Igcm3Qsu?dlI_U|&#ZF_@cjv> zm#_2Xc34ja#3;Wqpw@R53%?Vd#1j!=dpS+IaD+5`zRC+kZ5^qY0Z|UFcBmqx_Y%M6 z@cfy59LD?{Ksq{3n8J~@bz2ad!*PFHwgpP>plD@ZB<*EPCGgJOBCZ z-v-Kcn4kFrVcRhtx6YZKTjizbHBOe5+Hd4&D6?z4=VccqBlOT8UD`cv3T4Z2@KkEf{vRb_8~OP2~QIM?$pf8;#``v_GGut+`gLTBPDM zUl6o*prNLo-XbsOc~jSh7U{k`J?QUzS+lp975Cgi*Gad1GH6u^1iz~pRE9V_76=El z%cdt*x(9Yoyuybc6^`={kvbW_+n;gH;Jly)MB%eR(#?y$4<1gg^D2J*9X#_oEs;L( zFn$I*p+sgCP*L2(`K{0+EE|>{BmMLiv(x-1;2t*IHvTi#3Kg01MG(~O(Qo(02~17?AJ0@pVOt)V&gNf`9w=9xC_@b#ob+V&s_gu~O9Ht4t5pz@jX%NFJ-JyHuz zzN$W+EeeyBspjKKh80^O5(bkNY~CtUm|41tIAaGw;cR$JY}ulPTMg#E(Z!=)H&2 z$fsOQvLw>gf1WS2Nq#DiHXLGIdF5!+R!cPdCd5Ct>-ME~-0jR*`;ezgb;!PVe~Qg9<&CzCdE z!YttCzxHwT~fAtZZYjyIcJ(HBc>6t3E5&XKiO7DU+JI35Z3> zBqyDR57jhrvI#xK_kTmQ^qyyJm=a+c#szs4CErq&U4+OibtgTZAfyiqSC4SROTp03 z#^Q8-3xZu#46ar+X0Mnmvolw%g}D5yrP{?1PIzs5m7YZ74KzA$)6S`|7woUH7U zpR8Q?N#N36;}z@G%*@fr9`D0$8DN1&w)ReQi^I7VM3Hke>AjC+{h$28$5ifoH)P_f z*jW2=_siqFpwI#fGc|7Gp3zr9B__GlO=ofmvUdkPly1>m-t*{iUHiUpasEkjzTb)Aj~LmB;$ohvKU;mIQf})Pm%xlw`ZSU zD?-^jW_#vZe>b;)5%DXp%g`V3MtqLVj)|gLcIRHmYfSfa8Hjfr$QhY0oCr8xpmG@adu`~)EzK>k|o z{(ktj1>v3g6FW+noFYiIhWmpN8pFLm=-^D#5M$fZ<6|fM5qiaI`DvBArkM@*$HV9* zQ=s!t>gyDeB^yDgaE36&p7N@`@t4G2ycygnsDo#?H4Pt2gC3WFC6vI-R1~vt%_?Nw zIbpvu7p~oKQAx_$zdoh6)Z6c*9eWhr*`eG=cPs+Ggh=(Do$xl$w9a&z=Va7npkk)1 zAXaHF3+HlBry`~me9UDbrlHJ?Ff4xW)1sqh>p7B2386s#q+R)D=$A0BL9D7+dOhyK^bOGP1&c zPAqcFrt9;vzuqv4%WYZ!);KP4`sX9;rRC!(Ng(aAUXwQ^R%<#}+?yX30b=N}JM)3hA zwSd4U#P%704RZ=$(*QH6qaXxzhYg6vJWU6gY)S5d)Md^KC;~Pdn(c*%)wUY2){s|PT9wAtQNl2Ie zZx%*&rH+MuXZ8K9Jh{VN!N>hbH{rK(kwGhV3W2?EUl_hg;tYucQw~R!>-;9~tR4mi zJf4dx&OBQe)Or3UIw$#t`>h680%yqX891w4X;oR$ArCy`{LFMw`UMsq(_|-Xdpihp zGoV4X2)@F3m}~NIZ*u^7KAxk-w5sVSue|u#$?G&^>);kahmT6wyI7|j^ zWGLRay>#klo91RGow?5F&=SJ3rH>Be&Ih)T%CZK9o7C_ZU@qz+5uVBMVwi zYxf?r$#rbGhnmS5&-u)PFvxE(`HCS{HwgIo^7nCwYDE@R757jf-~FX)HLZ?^>*sjr zMYV)q2mEZ^Z_2D@AhG!G10Xa#9egmVv^us8rMB9=dj{+}0iVx}O!p7rS15bT5_%%1 zlPL$Z!W??n(1IqJiuoVTgHFI8$%G0WM+s`EZvs%eNmCG3j{oBY$y9ls={qi}m%?^B z9YV~^Oq+XpBF9M~m-auzM?ioo9n_rn-$cm2Uj5CV1lSlGiSkkJuB5DJOjNY?fNK2qWsk$@uuN@#E#gk9dUC z9R-IL>+LNj25cSoXXiToKI=ASdzD5-Ll@TVO=^1{%E$)pe9xeisEkbGGDm30UbjOK zqbZ8DKRgc`G?GO7+L@SN94xH#6s6G%@n$Uu-EDYr9+vtt+eTxLr)yrglA*=A`1?cD z_HW)XgO0_`3)Xc9r3@kFFjCA+;P=fAB7SjhaN8|((a1ZkA2t5&;G-W;z^2t?x|5-P8$;X@By95!^=USGOnkRu8^&vi=r~H#2)WPP_d@H1?fE znysnMz6b9FS7BC%SJ>u0L4Lk>&VQLbY#%B*`Zd+kqLH)QsC#+#)EJek;S<7_0bzfYmUGeDN{`UT} zk`@SN&{0gkni|)adU2iN@_$<>1? z$=#rwv+Yu$5(y^Q_{{1vMLQ#-d%PQ=C)yJd;yQ&2EE`ORC!RC_GP6EC&P5_Qhf>FN z%$~3LZUs=mP)xSGNC=As4V?!4zRUvvZ6a+gIp+M{Lls`j?0;u3=_BOAHVCdh-pfqm z@lMNsyp6+frRE9cs*FhTNR~TUm1avVJ}Ebwd$TGC^gV(Y-OkZEVKz-~I0G2P`g(G} zz2kU}63l;DmS)Dr7UVPv;^&6fHR3XQ40}vNy4>8;=MLq=6-tA%&~=Q|!ywP82^~Ry zA)B2-M&3-bNb5tkU2K+GI44{8)yn|=PwWb_A+z!w=mCwWgus?ZEp7Wx_v?5 zUTJvR-j^gh`EORN#)KPg%}t-oTu}!4K7w}tdX7~im!e6X!5PA3f|EsqM`Hpl+=F6G@5I7C)bK+&7|}96ryUme2)$}k5~V&(k%ofay(dCAvS)qvWzH0i?cU^i z>&e6pt_fcpZAn8VWyr4DZhdv{ks9C>#+5YFmNnJI=o%75MzeK*S_^0#H zs+fH>o$;u#C7OIJdMcsuL`n}pGBS`zsIO>EM8*w>d6ZUg!R_t9C2)hn-G{D?x~u5{ zlH-!u?zHMzCzAOck8M^BF6+@43YMp54=#E%m>0XZEmO}*=V_*(oKu3w2nIV72q9zp zhB~=MNZQB^9wGfKlt6;re9`-ez!X~a!E&?Jj?wmyh%1n{=>lFdD>XSlh&}^Z$xF>b zhu&4PB)@g5@a_!IzNzVRG_A~pO&4lDfb~nGvow*8sEz317?1urAzinu86`?AwGJ*A z{Twwx1$uwbOfmO6s| z@{{?!CzObWyT+aFg^%5>i>Y(y<|{{$-K{kbw2#(Wn5vgrZ+%Qt3BlM+eCQw%PYOn! zcaIA-7&Zt@ix-jT#<4RhMS0u{8$I#w6<6M@BD&*Tq`@lC zK}{wDE}2pWd3JCC`WeIMr1M{1Gu$3$*t=HRErHDw?eB1R2k^bl!F$eWVo2?lYs8fw;ES9h+$yqvU6S+jPoeJCA-B71hgm^6(LqtZ@WOnovPnL6D5vAF_vXp)01oV7HAz;)vksENIU78+1E{OW9;>$b= z??}e6wg0NLoKQXd_~rtc&`I16w<6c$zWLD*JWGW0u(~*xW`P%N5S590`$3v%lXbLU zuNa&N;+OF+69`vzg;vsngsH~p<0^GgQRyh*C9AT%1p%@7toNY=?xRpfbGub@B`(UK z+Y&1qXnzV{HCLW8veyghWVKdDTd&WAT$g6D94SR!^}X7X)!-4Hv+QIj-IYwI(s#Gh z#*!HzjlYmhh(Z3m!MoXLi07BWOL%>VlKeeNgzNfV-TqSan*3y9nsh|9PlX38KAZ>Xl;6rp_&S5*XDsu;3gbwpptq}Tv?kw%rHWjzk-&HPjrY3@yQ zoBd?&r66ZZD;$OuePg|t%VB7CuA)pFzw~foP!eOu080RwVBCEZgiW2vRsvMoPyhP{($w+4 zgy`>||KZF0&6@c)Tb%03|LwPffBaYC{{Je^0zmnGGPcbNDh);Cw#jKnBqX`##I~-ZB1(bwrLJ}rn z#@2f*Nn_J*73AWz9$<&%f_)C{9`p4qpA`l$gX5f-8MsnYEe=`*)R+4} z9Cf8TXT?+l_QZ0I@cb<`k`<2ujG$q@EQv`UuhzGfT(X&LcqX5@8MFU$u;gHB@>ear z!%WKVMNW{op@!4io&kg83>bvO!*(chKYt`(#BT7EN$ND1tiOwTTibP%SMJ=HG@~w^ zif_IK$O2y=B)IsNS$hnisMgFNX<=TW*#5>ZG0yCnXc8PssJLy2-k^p13A=m1o`ilAg$$y=rM}& zgP%^QLYps9Y@%9oy(r~^#eo!16D%eQI!NHO=D+?KJe`VK^<@ioz2~Ofj@EJ-ppyAj zTmWi{M11}v7+97nYk2DO^4vRV;@4IKOAf5r}q;`~Og7l_eJ5*l$a0Uv4|tX!Ae^fwAz zV+0TEO3DXz3!tH{fl6K)elfYd!3#V^UQh9pE4-Bc5<^+U_P0{V?pGKNp?O_x2J<)V*ExDRg5WWeCVr+}NHw zh;qXrmT!W{R&H?JC+^)3IRmq-LS4;{$+E%QEstb%*o0jUHe77oy3dBH`MNK?8J%QQ z^QW&PsA>4nQ13HN2$GpzdS-3hk;VdIR|V~m`h(QF2vk-vV<9K%@(Pu$ji}jTqtZv2 z$b{P2(DYsz!BkTlM;JJ5^{N1vYxbnUIwF(~qG)`c{ATc-oWZEylsMM!z zAjh)GdEEJUmtzo?U|IL!!I;_rAAs~3K)cx50p945l@*;( zGR1Igiq`lfMG<+~-a4I7y;Ep4ORPqXN`I6uEE%sHxLe*+XJTDOWHD_#4cFN|M~pp7 zE~pGRP~BwSSN@Cmr+`6K0BI5 zX4@6y-D;|)Yi#aN+!);@SKAc|7JnRzcPuYl%`f|2)?XCPPU4?J@lO99TvQfr;XQlw7Q@PyW#Xpp#?GlgCT_Ts^-1g81=Ud+# zO`1;SvzWn0W_H&Fck1e7KfW31*{NaiW2nne(;x%n2}W{7@m%GNzz{^F$4Qdn(aSBb z9Y0As9hB{`jWC85ymQ;*CN03FcapXl>pJ|hEK}y|g{;AwvSKk)dMm|4EnVCy!xGcy|&Y&H&b1(D_y4vW* z)E9O%|M%CrcErMu^@`e(z8Jr24?94jEOkVoKzs0P7bMO9OdFhrk5l>^$5*HGMm`~> zF0TY^#}wCnHg6iYAL?0rBrn#3U>P5%fO`uJVewCn1Y z$0yQ>p2TLypIo~gT6VmZz>k=#j5s-1)^9X0cQ`6zq4D!b!`^~zo=Df+fiVe69^NLVi-1#8rLDo-9Uax?LSNGm%o%-~*PSu<5QOOblH*SOMExA-- zHy>2=>wqp;c`)`T$tx^b8B@s%BmHKI1iYOrY8U*GmR-@!?jC=H|%W98s?B z&~_2>;Perx*RbB!x;r+J9Z{Ckk`5M0Ke0BizV`mtyOZgF<-E59`%{1~2A;Uh@`o&I zUT*L@HNr(maetRxF=7*Bz=Ap-TvBS{=-i_#MJ%%N5yAezZ5G|BY>-!Gzc=`MdmWPt zvH`;0hyODk;?JetVDjaX&8Q*3imrNHxLfxABbUg1jr9UP1=9VScTfG7zum$CpJCFa zNLz+Q@RagatMTv3?1hRB-YT2v!Ur#LUZASyzqsU)3Arpza|<5>z~4<96$IZ& zIfSaC%)bis;%tSE4j%*FUWEzz<@Fk*s)>q?s6F^`1T+4P>7Urln<$xU>wxp0=M9n8 z;!5ZW>$^Sis|xDoPd;C<09va5258<31KiAvTo4yIH>+9pH2(< zz>8@PV~M*!*%4`LGgoDG54aIX3Z0Suixm1_!6*6sVSI{-k-6mY_+ zUABLsK6|yaYu(&#EiP$Mv`8V#Iu~23Jw}gfu$4}eFsg@EHyIE2LqK6<`bQYmmBSdz z_c`)b-I5&h7jJe_6d27+fKBhEkV@M_o5R zEO81tA78bi&^ZvFNV8EsAf-`v#H$w)pM2cR%P~A9{#t>nar}L5?#8R?-&(BE_}fSR z5y#!FNT$0b7t&LN6w!sYI~IiwJFvkglHV}Wws%6T>U>?tPpXs?0hzrTzon1DV%|$N z7OTZ9>q~BIatwb9{^k>%=#v~|Lo3>+xbt4txE%|2ktYs4;&rum{ zoSYG}QDiBqM4~0N!fGec^sTO{y7Q1G6t!;g2z0jtM~2htLV zXLRhT<78@BLw%51YN9IFo29a1{g<}g%lvZ^l)*MFjJ{df4a*fm$UE9A$S?Cps) zp+2Ng{d16jw(g?*2T}WDutm>H9bW$HUdG=VAY4-L zl7vqM?AwOsIKP007fNWTVyLySQrU5W=3gBuI@|ZeK+2NvCQ?&vO--;fFLt-K=D;QW^s)ZFnWcqOZt1V#; zJ+$-)>@L#R#9DGcy>Bfj5RTPoE88h(GD1UXoGY2!fHK9}z55 zvU2=Fm5lczU!GgK1F&>( z2`5Hr4dFe$`;pFEU@YPzUutNz%eL42LO|{uFD~U4crv?(0aX86$<=1uSu(BO<1#m2 zkZ`p6hj8Rz{ptvOe!qu5_YgQGqvy}AF_L?%d^1Yz+4MzLSZV3{pQ!s3+4V~))vrD=YFT17_+oxnH zMW}=%N+rS&l|uF{dyzd`mciH~%9d=|Bl|LTgTaWT?EBcp3}S3EV;_v+xmBO<>-Tzo z&+qkmo`0VEbq_OV?sMkc*SXGh-q&@m>$|kF;^cRYi$jB)3cmeNQQ+$*IDeS>m4yZjTp^M7O7M{o3{;&qnJJg^s* z0y4$msj<`=C)E@4x1PV5PLh7L>!P#Sg>NxtXxVDk?O`|2AwQ|Ah3>A0Jq2)%p)0w; z^N$gOI&CXXpsTw`MiRt+Rj6TMnY$bC+p^BNF7(^|0&hL?{+G8(sjE+E9Iwl>hFSg1 zDTltBO1%zIsX&}Se`$leUX8cY5zMW(ry|Zd#m3x!!UX)6LmdiB+U7F3jCB;U|; z(wF%H(>Bp9s!%4H?*RMQx-~@k-rnKQxcpC4bTmDrqniAC#Kz4Y$>sqxfbm|qL~k{Z z@41ypPV!D9Khr?RzW8m)IES6Wt^f%L1oyv(OeEd;S$I(>ZeB_lgpcv>TqjX@dFEBH38MtZVdNLj2+K8AfTif053dlD;plxQ*}Q* zBqJ~7l|K&`=D96g7j%(BA5d$76as4?T|o`lO%cL`t(or}+)%h!`Gk~tO&RZP)g%m$ zSJ7z=iGHj?8%-d$jzP2(pLm9m4z93meEpcCd1)>v?q&N@NpX~kY9P;nrkI@%qc>wg z|IrDK#Va*dD(tUp`;)*zD&|-m{(1j5chY}Q{h!i5I0vY7eEw+zU>YDI)SogfTr~?r zbeD|Z?vCGZwI0ol(_+6` z?{ri*E!YSU=QfGdr`qv zdM?fEJC5JoepY2-x zLcPrPB#!%PV{}g6fyeAZhm7BB`-v5+ebKWM=DS{B{57W5?Zj#Tmkg#B*Eb5kBQaHB zfN#dBAqw}=^9ITT1Ghu(BU`{H;A4G*eWzi$^jd3M9zi$#i!KK=6~f>cN3^?z!&&(vgKuP=K+&A0qEM;!o_c4dFNEV-0~ z;bjbvrk551U64HY+iYF;tu^)jYH|vq&)@SPDxdnZ@oRkA2@vNA9>?N7bn!P@m*buH z{*4+pvgy}m|633r8UVxWH&m^pdEw6M$ku6qY?q8iXcNoikoRh>ME`M-7K2a!B-!`m zthZC8*_l)8`q>PVA9~1b?BTio9bK6dQbCc}q)0cWv5 zbhXRX-Ph=k6M|E%xyU)A;S0JjgjMiW!Y3`m) zWE6(uej3@>a(3VB07%tA_jj^>1dLYR_MJZa25h?wb*(H^IW$t>J6IYMU>Ewi>dGRc zre7G%4P{Yl`}WODUk?`U#b>i1r{x^hg$+Y?>Ov2VHJtp@EDEFI2)Gy-abhQWiVv6( zzeNEXKUF03=0$rI)|303Q;%wf3uUx3>j^{dAffw14FJ9cZeYcFWK0G>8I<(PXuOr> z>>}deY|Hls%`Z8LvS5K?!ZW{s;jOE{=>1{W_+b@+(@cHsc@@?$s5q=x&m~v?COudS zluu!zrNDk(4Rq^2Ll^fk!|9Ce-rUGAQ=JW}sgzpEFB343m?Fd80b=bh_ojUSg6P#y;5 z99=0k`Z2tH&30(Vbw!dMJGH(@M!N&u{8t=snif*?dk8Jt^-nq#+23q>d;e-t@!;3= z#Cn*1z-mfPVyz22=e~Gj#^;g>$y*HNw7$|xU@(`YL27efRJuba(Ll2N=+1FU20(H9 z&*^%K^*<*hR zwY~k(F&AhqT*cg%xlQ;->D-FhG0J>o7`pcx_>We`sF|w5t(d&p|JnG zXVfPrv)a}YV?Xfepw~>!D6`vLQ;imC#Xtb@@eK@L0ug{ja-T#N%&b&8{yAj^!i>p) zSvzxd7nGu|-hw!KUF1K8cEGuO8dzVuyTZD2t87vtpd_XSy&HgMo1$ahPpdCI-S361 zXFMXhyB=%2?EVYod6=-L?OFZ{ZGdKeuTTG>PTJ$&!~SRR|LENR*(m!heSh=UpN+OZ z3dDbD?XN8Vf2*uQ+d?rnU(zOTmqE~>r}q`j$v!B@(jO8sK+hzGlVl+N1ri|Cyh8w4 z)5H7oSz2JHz1YcfY#Z zweGY>O>I?Cj1zGRughL_%nPH5#jhS27FPe1;L9G116f3oAbla;g1%FNJsUI`$ZKF* zW8Q|a>wVO9Aw=UBUPF6mN2;eC+7_33G2fppu9u-^rTrEXUO?2RHU_2jP)qF0wukGh z+oP#k`F=ZQolP+p!|x(lrM)J(gW=Pj$q_KKlam5p#A*|Aq&%F8(-RZM=h2Gg1%Bqw zlRRq4BZtrtyF}Bo(bGF8CcDTbVPFE@vp#}()jvDB%daC`*H`rmxilT$gSbxpYR*41 z^IZOzUno@vrqcU%Y*xHr$Pgfww)=Ej^K@jaD!v|88DL(x=o_p}Ut>Ydbt9R6`zl z?#UqzhIIWnEriJFgsHUh4xRI^PWBIQd1a=Mq>=m`>kDU?S8K)AcSRZYNur2@NVP_* zouir^gvR7c_A|LzbGzND9O3grO%DSBpT?jcm zkcA|rLgtfO2IZ1Af{E<`Rvux%0ujzV}F zJT4hJ*Rm(ss(x3zo|48e@{i3}s;Uq|W3Hyzy^@TcFGb$clQ**sYSQvpHxgDK_sdhP z>7U+tOMLTlT9;Cntl_xfiZN!luU8HAH!p+}?2Hj=p-yRHUo$E?^v_67PkWjtOxH#< zITkl=?te~*cvQG6F2)yvb;?!qB6!JFF=oYq6K@y3og3EA3;Kf2av;L9d&+Uy5va>p z8q$*H<MOY`Y)ji!zBPE^w8?N4qR z5A5V}Me`faeeGm0R&Rio+GZ+&(r7C1tk2z>MOoS}U6omIB)y~O?Bzr2Y@GB(Xs`^qBrdwF=X16VL25rkidm z4MSZc$HL3vvWV!9_GIyQvj-hh(4s=uk#}->Z+GMnbsUC7~soisd>>0#8vEwu(5bLdtbmZi@%M!Nlv= zovQz^C{?TIP9)N@2ZvSm*OrAvx7A2(M@ePujE4FM<~>d4n@RTW*?KA^RzB~lRnWTb zUGxIwaigrHjIrkJy(0;FtaWZSqT96o8SgsJj9ABJsXXVia`ZGqi$^8-+`z*?H&Ue9 zSxtCYr>S({B&&3Wi}$oenOol-43TD;0s7AjQ(gqhvHsaBW5%|d^;2(>K=cHiTT7l1 zC@Rms=o+i0=sZp|#F@t6&yEgJnsuMnkMp>R7F+i2h3k^JX_8>t{ak&!SW1JaJVG@7 z-rDQWb1|jMGwCEz*1+nfWRSsmDlV|>6Jvl3PKGuse5m%7=qB+%H=LzwcV+Ih^C|dn zRJmO0$iu)*W0kpR+^5hsslXMEO;fGXaDsoOY%8-vqvg^o;yc2$=i9SV!L~>c4&!A4 zf9VJ$t3pFIwQjz(J2tRv*L_XMV#pOkW!kaH$J-j}<%XHa(!vPQum~j0z zUS8TT3E_LFTcVW1{jgzEy5y{ZS-i})Y1!qFO0jn-Ku^Cr(f8V4S>|*N)vS-pT_fHFL3x~ z6!9UqJ~y#$S9e9{_wvxde+r(1yzykT4J!>Lsf@^1EI7e>=<2d{DIkj24nj_K1S0VY zE-6A9UKOeh{oz5CQ7J0xbYYSUu}Ten8j;HALLfCc^{GL~6xc{s5~LB<^&_NqyRQcZ zNO~d{wD(5&q|xF2@5 zA#WLB(S}>_C39=|pa!FsT%T)Obg3mLm6%HU1~r-SP+_w>AF162&pkMLY!)#p3+`drSuFSoadq`zcgVs=Bh?E}hgO5?RD+8Qusaxv9o{6pblW=OZ zb+8@isj=7dZ?E`%v>%)2qjO2u*=7mfJtQHNP~(=y> z=zM$=&ZCA@5wm)P$XVvQy0o0m4FSuQBddzRNgdj_+IV)_fm7MiXV4PxF~NQ(UX!#+ z$u#XUff6|7hzoJ>tY{{1S#0Mm?js4NOF5VHG5l-|PvKij`PP;AoaM|C=|uZ6^bB@T zzP71wUuZkgr)I+}%SuFNU=Hi^II!&m@mw3yS+&5U_!}=ynE6Gj;-nKpdMaVMlKw%L zSa|*02%T*WFDEz|lU|gWeNpyQ83Np^GcDfHvu9w<9-L}WJeCndFbjrui3Qx8C4m=B zi|Mi)?zJKk`Eq*G&8#Be_`z^YEDNhxU$ae$QQpDp0gk@in;V}EzM~93xVAA!k8k=6 zie+*R7_GqiPOZeM5WPg2&Q78567DXz&-1>-Y1We_G6er0&mX2+PbAXzzw*U% zOWrq#sdAWLmK0TN*h@3w*1DZ2DfwP!{dNWX3KtZwrG5DTf%8U{-1~YTKc!?@c2Oq5 zeggVn4(8|@8~}yuQZBqLJ*h^2s~tf+|NgAP>Aedx@1!US^{(#_k8KSHsbJ8zK_ccL z7?exOS?vBzP3}O|S!ZYUU3N~$Pj(i7GkPDe2kx8_AP8q2iMTp^R90(UGUNH8EFe+; zYh`+0jjFD_a6hRILIS~lOkd=Dc;!GF(d`U?Q8*!zA#ljQxN$yR5y%(ene6`<$M9h( zqbL9!*ZW9=Xi~Sy?w@IIfG~#;xM=F?Fcaun!8)r$hrGP8dBQI9<>#+rO>3{tUTDDR z0Gx4s_z11j=&)c`KtPJXb-vkXfgsK3j@O939oc$Y7Gl~BfMQeQO`Ezn--iWhwv|A@9y}otomuhL;M2L%1Maq(=DOI*pZzJkQ!8g-M4Mw4VY;R zhr;QHC+rgohwE`;EqHB7iRs=}Ll*BP< zdCv~c^CD;^k^**EUGLdsD?LgVS`}{>i07GhMq80a&>8u+r`Ped0gz22E%)isaoTL6 zi*v!E70R!lW+J9Br*7)7={w;_2N89I-~_k^PT|qJv?!a9myq|k=y1fEyV0$pDcz^2 z%s|k@PzJB?zQXEN8U2HX6A~Hpp5Imx2vbxO3FSSgu&0gi%|&A#n;FVs4x75fAoBwX zW3tew(J@Q;xT1jK_W_Y2c=7L4CN|_$%tq&m9ns&V1-NjtTae|48Hqq&vm=Gbs}HF6 zsEO&ri<8PHGnmjA-!&O)zs9NkIX9L9%GE0Jz2`?5es_&EVk~)ez1fOVCo{5^4m$*Q zrdyib(K!7u6_j?=x}aM$BNCHsW`RD}vi&4|GISZ~HPJLV)P&rs(u^3$`}AwUtdW4q zhCqKhM5zI8CkOGRL7Za`N82Zppf&pEuuluDX5AUA5B&7eWX=S zQ)T`gy`z18$f`}_FYjw3Yo=khS6%Cm%Ki~Bu#CCA+`hE(>M|(+vg@NCb`kpc>BlX2 z>Wi2mQ(Q*jBBZZ2i~)JMNHs)qAr$7OW=pwk=Ad2YA$p)v5%cQal0{d4cz^SpY=76A z@&ZR2Z&EP5sLS3w5C>DV>Y4t)Y>I$(^Ze$kp;wTWvnu{Lp=?t$$AdAUU2WPUd_~a% z%#g0wQP;>w`pL^m3ZW)`dRo+MkR7-EEEY}J?5FUr3ItyakEAx4+E1pg!;5!uPX4N% z(s6w15CeUO;5$U{uy}PePdO}&y=3oUMEFIiT{X2Z!uE!+g|8bKrA?h|x;wHKiV|ja z*8)l2poMDvw110g*!5<>GAWkc`TpiB?~Y_?b;mC@XV-7{RNGCUM=AGC<70~gX8d9V zt6Thj)wm~yviU-pkJ5@TOBiB|cz7y^luR``ZTrbjQ%#1eQA|qua z(rD&yK{Mc!m?7;z)poCTQ;Y?)NA4u07C)*Am@M#2SQ7(dt0y{_cZ}_wr(J)pcre?{ z_?-!5`|6oGY(la+hgE-cVI@19;u&LiPwF&{OT^&tH&uL8K$6;B0kc^T#%xG|#Gv!u z2AqeLx-P~Dod0L+2SOVn;_}}NLdwQ!k1ogK+sfKIv2g*oD8O=GAV4D@i_Ih zdsc8&(#rVs)JfSXwS-E>@-ab`qYLhp&vnKD6khA1%Vp2weNzu}5+PZAnEZ*mR<%3* z!8^_Vnj0hKlO+yCFGwSWfSzcAl-TfEgr^f7C;5l9alJqD1VK|A2%=xqm5Xq6xGv?H zGQFE}!260^*UMYRP>I=-^sI%N<566?NEtoMqs87Y+y+Yx-zZ`Y2^sXfPbF3x+)MNQ z4HwT#6VygoBs`(Wv<_4GgmJiHremec$hnrngHYpaT<&s*`+mik!-!i&**g$?IMG}_ z8ZO>)W^84Sg;AJkFYY2k_RpCUV2ujN&bc0t6uLmeXRV(j(Cr;GO6@EVSoCg=hFL+N z_AN#En!i&%{;q5Mm`AUd%~o-b3(=!| zE59px&Ly_i+7QDaK)Ugs{Gh?m7kF=^F8Rz8yYV)#H z%yuB8Ra6LYk0=s z-l6}TeKKB?*(6G>vq}-?rn3mqgOJy;Uek-O=~#XHuw?z(d56KN zh_hbv(|Rq5-+g0>pNNtOTCSuYYot9~VHFOJ&VrivDG^cuk@8R`V)W_v39dEykteSO z{=hdjY8U%lP11y%I`}upd)U?5vy@n>X^_&8=Jg1`T>s5_S}o<1Gn@I$!D&$$W}z

mp}EqSyK+Q*(2>=Ymg=`97$;IcN6!AU#n%*cZr$D*-Nee z+S|EJ+Rx|ZZCR3;dYF~MF_igZM9pO>@k~gx4trPw=|VIJ`@5%$KeEPq!zAczq(Nh5f&nm;?OE#5rE}8U z#ZRH=@X>NGxGAhZ)1X9J@90zqd*NH6d^+_XI6N>w)f-SzZS+H~B2y-P<9Sh4sB9^` z54Hk023h#XXMb<0Pm)6GkiL?{-ABuuprZM)WLsEB2b#q#r(64fNqY$SGt4p`=w;TY2`nt=WNa%XrEo{9qUUnx_ZaXpXSey zBTj+0$7QyXxp9J52is`E@tp=*s29WL*lk(qL%b z{D4U$*vR{OibY3L2BD7Pf0W=s&DhiTDc+ldf?9vn!!thU_np$Lqt?iq96hT`p!p-C%gD~Q#Ul*)6z?5_RdTOI-am3Mb z{mH@`g7r?qEnr(xq2CH#m~Q&DN89Lxm2`%?X@LE}q(wl?^kDW+xQsXMkuzj~+bDW+ z4wW+nZNgMf($uLCCG{p9;a(l$t>o!u&q9CZrDDhlhtVJfx)#x_|N7>G1d6y2t;Rei!KaW>dR9q61#QpP>7?y2sz0 zVF0czxPS39D+6sX5t@%o-?Sc&i_`RRCPFf81c$EJ965j5bSJIC#M^;~bFDqWN-O+Q zp@y8M6@AxT0c+A7OJW1_dDkaub}ubJ?MB=@#iY39FS$V2zIppKGe}Y#ihC7z4xDd! zS6;k~V~e9x#yFph}M}^?QgnN9IF2W!Pai zmf+*_8fQVE=epRZlG}GKC(%09E9J>f87W|$1Z37{wq+bL?xyQvJ(*s=Wc!4;j^S2* zP&mD}X;{I#mmLD%**#yHE=~G{@HjPE_1!1RK4K#1EzT`DK1$ulwu$D! z_vZb$d7t+!d%E}>k@J2`JJ-lg;={K&>rN_b|Dv$d5)vNT>Fn*<4$s_Xn0g21-R_YsTkiAZmYTEKU4c|6VD+zj@%CrY`EeNpYC)=CyNe2ky@p7s zTb>M6f~@P@TdxFN4jWCLM=0Tdb>3yh#4qSkEg~_z#3!y`jAN7QD*7kpiqS#$1wNs-py~lL`>l z_KQyQq(1LSHII9YR>-bH_O)6i4uBm_*R7u5bKWm=e{gt3ScRoU2qthxwHXxMCpkjV{LBVQ+{MvUZe9B3%hng|FWbELG^=%-rJgf z$xN&Fsz7Wm{ zm>1SL_mG>w^ulGxIDK1Y^W=K+KX&`I=Z}&Gi z%!J9KrwdWK;j3fj@2847HF8Rl3I1xNLbI9CQMzeXVP;lKSLkkoG9g9p3uK*=Fbg$C z4kN3Q-P1XiSGK*+cz?ltk{8IbMYzEd#K$P zZW-rmy)|Yl2g(4K+^PDKy8T`bIS}Qk^yRXo!eRs4CrV0e%Ey-ai`8dHx@<31EDP== zCYa00+~(Ql5Lmj&fUdoAjk6A{{2aY$LH>w<4N8CL_uyJ?;1^fERh{Lzazg7o$As1A zN=I7dMwY?51h0}^xuoHtr{7K~PA+VtPX>GN4W?1;plDzdEUE_$$H9#Z=*6PQxZBU|Pr=jhQ7QCB2lo1OMWQ+=66f-jhzsE}ep-HjhL z@oImAu_;ZFPG_{>*qqSen#)^u!mlTPj$j`inG}|r9O+$_RL5?(TaM*3P3haFy6-}l zo)zmAXV`2?`)WSBapdy^sf?X|+b3eV-*m+#b$q+)VtSZiW6g53*N93j%pHv^2$D ze>8Y!Du>_2^_rV#NFQDAquJ}KU$|$Xjo{+E>twp1l>)grrJ32ST;*4_T+0)O?bIY` z6R1p9%RM=t?J&x@^HUdwIx_V-vX(dUXHP!ZJ319a*8NbEQSlidCN`h8_i>4nfTW-u z`PInnr@RXjog#PRTviv|jQ3VY8K%-+E_wXuYX5aL9A#fuYks=U9sl&B_N-1K5jwA9 zfVx5VRhV(AUaxOOjo&3dOHKM38Cc;gQu1y&bLZGRc%8CbStMmMPJE8cGtWO$*TqQJ zoA2VR$h{L!6bwiNh^fI@=U#=3wKWlbb>m69<_yk(mZ14Mjy79|-$l@y>usa@12Z`b z_xyt!TjRM-1H3WnxuMh)ML(ztNqc^y`mA7qLtG2qux8nlD+pTZW4csh!0+N%te*`F zsfLw!_tj_2w$pJ<%MtBqo$hX}w8m3Q-njRa`Nem}H05gW!Mj5=eBHPX=txUQoor+I zfTIW-kHd5cr1_$kns>rrT5Os}Mwa^KN2J|`v&Cq}T?$GoLv7pMu%^sx_7-~sZgsO> z=sW)Dd3dpZ`i#a&prOOerOB8jjA{xnnLyagAm@@5ohH>gfTa1~j{Bm`iZ>mrW<&&7 zj#?Z2CLm{c~_;H{-b-|8q>FX9D54xZqj&@>XaFlC*gnv+T!FC(yK^ zW?;NO9g}4rM)Y$o&lohU-S087Nzf2tmx@7&{u+W0%r&sNT}nR(&nNn_)a@xYdjp2j z$2W44mUTK2#YFS9IG~S#=AjYcnIEu^&+SE%o4NfbvM@0~oCvkkR&yCi%p?E3+u4Ub z0yooLurFXG(h&F0<-8q`r2x~bUC|py*R*7rsX48jeip@Xsq221SClpz%^Ixl9b6|y z>%HYJj-FT9Cb{1T{^38eO)N^vM`ZbATq7DVA-Fc0G`;TTAIo1G8-vS(jBE?q8@Cvq zrYS~kjKr3gENx11gVTJ6ilVIP-;-5ZlVV!-!k&IM6!v7PU=nqJk4xJm615 zPBG74Wt=K{*`F^Xe?;^+O)JJ(B1=F$rS*G1l>fnxw(s#}`6u@Dq5G1IX)&F9_J({F z2>5{TOQ6GnHf_1{jtZTJpR}>oSG3k=D77z(!9gv1SFzqZXdG7%_rzksjLK;#7B`ct zmgxX8shbUs$Y)B6k@9?V&i~_uV-}PZG2XGvxr*OjsC>;QmoMC5_NFB{Wd0f3Twfri zaIKV)7G^U-9dyNtBtZ?~r0tzcrw!WdgMS>nM;1@tyQzfTxfL|2yNefMm`V;Q&)qVa zmOHVBUcmjPXs8Am{lujAipIN>?-C+@RD%80d-B0UZ}xBR`{q}x2Q$FV%r5M7{8y&}_ zz8XcWV2Z{54S%tImXn6&@j@RMAaJ9^NFhb4%Kjw_@EPQP+n1yFG17PWPO0X0Y=f8@ x4N$m7uDtHLX*1$0{{6bzF%|xAkDGKybZkCbuVXd29v;_Gex&{oruaPge*rm~0^tAv literal 0 HcmV?d00001 diff --git a/content/en/blog/_posts/image03.png b/content/en/blog/_posts/image03.png new file mode 100644 index 0000000000000000000000000000000000000000..443a6f2d671be341becf8e43dd2759dd742e3e1a GIT binary patch literal 28564 zcmagGcRXC}7B)PiccMgZkwkP+M{hwQ7@ZJA2_nG=5>ZD_M2`|}5M_)`qC_1;38J^C zgXp67`tHej&Uv15-uL%?|80Br-PgL;TGzUkcRJeY3%ez~bf@4C-$&a4fbN}=%t&H1ZS&$*}E*-OY?l-n2>hD(aRk`6bCu3_!@{Cti zca{fvh53+`m=q}+MmwT&b=vJ+UEQLeHQeKO6}cSyX)Pfx;cQaJ&TlSqLczcIPWY+z z_B}r9AKD0&aL4>Q|DV6pM?sG-F;%5& z|Ga;gU$yD4uZ1|M$vzxOgC6gsHSHQdpM?lou;V=L-*5N!haC)kSeM}5HyL%A99v=7 zW-O%v3*J{|dAS#F?204LB$20_YkR1l-45NoX+({=Q+R`d&0heYMYZ(0#`C>wpuDuRUTf@9+y57^l1D%_^M_+tywwe=@7Ey1Pfv0d}EFO58KO zhQY~Z4bv9eHJDAiG>S;M_|_H7*4(6 zcu~lu0O31WYy!^I_|*t@(zZZIyOf`v`5$)#vr~ej968|3APNrd45x9Ae#h_GfjC7v zj}~QY>DUU=oQi|cu*s`8NH43`9@!oPyJ0a_Zj(m=ALxq{$$A2eA{l+|VE1u+*U}6z zP-ha8tHQ^YaW#D;Q!o{vvUVQYPFibsvlad{Psnr7)%^I{PqFDjEiem{>Ns*znikx< zrJS@FeHlH;q)5AV&~&*b-%XQ0YeJA2w$-kcVs*ieCWLZQ6#F=v1$oq6t_v0SmCJMd za00$y^U(0glt}`q!}m1vYx2?Ry}rXw&cS4y(kT03cYGA*n>lMGUa{1R~qeP z-Pw182|g6PpQG50WJYu5fA{3%4+}NQQ3KRs?{oiCV(4mvC`d}o;pXiIj~%zdnfF2% z+;5d~9la87-6{kxEp~fIJ=R;eDg?}rDJtc;MN2JkB$N?e2W66Z-6X}{IYCJSzyTMI+e_a`wWDDcnca)ie}2U;x2iz;W0Pl zMyXNb;KIq8+gPsNZDII|NL{i5Zuu!Iet0rG%mA_N9ykunNDkma<7o z<^&MA;{6oa36Q^}ZM@cGW$t+|T6deH!b2O;?sea2+lvb0Bfia~)JB|`R%`Wy1Dya$ zL%dYWRJxVqQEtv(*!@gck^rtjU&J5gF~Br0eglo~#KOY_0o__{cioMe@l={l!hoSt z;51uyO@-vi_rJ_pn9*_MTsV(of;Ab}1VqNP<<#@+dmuSyii(=&1b4(Pg1-d~;gW4< zm{C$QS?A62;5=4lGev(CMQ(NT=1FvYp~dE`F7A8bVVOYD&1_K=yfgR7O9 zol(pU^vR>`IH@RuKKE2cQL#*&zH2!*00EOSF{Y#@;&rA}hk#jvF~ORUQaZ5U9ZCTX zuF&!fZFunAXLh4Z@+vr)Ja842_Q&*%9?Z2tYRURV@%+;4^<3yTyZtzUZz-TuymxDz z`jun9+~t+TXw_mr|OLloJb zK)t+x$%k@1F_%p*E?vLwX3KyZ$AI%;oWMF?YWVF9benm8r*oV}^mPgxLeotKW01}L zSDe&nCC@+#F!_2*u=avW8Cg3ggmrd}{?(&UrR{|SV28}NgHkhc3Tc!;7K+{M2W(fL zz$3KiITtwRDE^nMyTJ!f&AH*C(ctwpXr&$=q=~fAbuZo%pPc5~ZLwfsGD51`j{sHT zwppQnpUxs)jE5y516fN=Bwd+@R-R;+lu|KR5mVk1>(u{9};*ZiKZ`IFzuD z+PH2!z`bflGk3@?rb*6bq^27=?1G^h5tW+u!Y8x%nAV9h2*iW!(~j^%4^DdZKXQx2 z?z!L-V^(+yZXq<>(=>?CR+pmZHHh!e9Q76-SK4%N9vtpa4znv!>E z0hRzI(6liVyj+DJ`L4-cOd z7{BycFqi^Sh)QRlt)DEv-V4;bI~L+*Y~Z?cN8GAwqoyZ+OC27B1eFNA@C@;Qhoj^R zFW#qIcV-~x;W4Byy)2#vO}%#I-9Sa|)6$hf3=3`>v~z2>;bVmTIHbh&(>?cY2;HDF zF19FFdTM(VePY7a1fGft;x5`Oq3ICZuGM!PN?f)yTz&R)t)b8P%Nuy%dwrLFeS`Xi z;r5zusE@cTGhqb!!xrap^idjbExb?O8ZKKuqfh{|$l`kzHYh@M-|gr}6MA>B%%9`I zjM6l|=OFVHJ5V2SSSZL=SB6+Lwcb35+Nf{&n2Wl=fo;>)YC)S+fmR1JBCh2d+6ScQ zN3I2u3$zKIzuzq8cZFM}h4Y{j3=ImL%ntXIb!T!=#?A)Oz2;MSAm^T79>=pK-}=UQ z?r9VQ&Dbc20y^!Sjl2`RKdjF@GR)A1`Uqyx8+>y?xQC;Q;N{|*EqLz)#zduE++SQK zpZCa>9s0tvH~fjNuZj`=dEP*Nfp*a~tt(0^Eu0Ze&SsGpWt6elmL+R=u#OzrzDwtX zg9#6fGV1VCf$Gl4r-$>XS>J`Gv4ct+Op>MBA*yd!krdx^7L{d=_@&&7q;otgqw;dg;%H87Ic=z}{6PH)v`QK~mRbVT)|hgUnRUW@ zDg`6i36k{M;M%8MWG*(jEIQa6=D>Zt3Tfx*Qg?Nnbv@8oe6a-<6z58!58jR3X8PcV z8;(N`+gQswzZv1uepUobm1Rk#vJyf^18=3FtLKQ%2>v=0NCrzzep4S6Um9%8MZk#J z4wf$ETI7RPieP83drH4!t<$JyHSksumjy|gb)M&k8-~Y(f%p=QjAEDPeE++H1zDG| zaypp^nvRmOZTgado9Mq@VoQ9(-7WmV&RxmzQPVr(7 z>OWcpCtRspOk{^Jr30?aL)#!Cgz5Qlfm$&8kbY z@e^`k%tJuk4yHW0TwTSP`z}ZBT)@7`64qo~ZP1UBTQn)jfYUtNSJfzlZs=fSxZxi> z`Vd7+ORECLy}5Ws>32b;*pT0tXrQ6lO>9Nrl~Dh;;$U-n4R_;kt^6_W+2S_=0^m>gOq|PJcRkOErUQ- zI4rUt_GaidL1GfdeSRFDv`69jVVI}x8 znrB13eT73u969+8J2)wtQ#4P~$Q`a?M{d#D6sM)~B=)WpoUZ{KoP`J6f8-)V^Xx^W z{$Cq@;+)~FSb2|AFsZ}kk)U5oJb=U4`y3wRA0szZ$KwH4IR|GxP-BXu1S_1glXE`M zc{^)s{!QLf*~@!d=rVd!ch96OBay;hctH>lD|%6Q>ny|DceG`;KYq1GrphZ8HItXZ zK8|P*ertxp0`?3e928jN%(KHX7w@!J4>-K^LtG1D=2O92Y&e z6~2?;VUChUbG}NZyp>s!jmTc7z8v^$1CsFtoYo`S^IyYSOaf@|%{G1QRyc6XHGp+# z2Z7pc$x^3krfaRX8-~W&eDX@)7o}X@WcjuKC7*0lEM)T*vBl|f9vCYZfZ4fej;e*G zWfHLkAL$@})Cy#LukEDx=%*aSJ0WO*NBe@3JljE570~4qd`v%DNjBEILGk0N4C`Q8 zd(6D3uX%%+;jegG#nCD9Mhu^9Wu#h+tS4AXj$a9A(#C?}m>P}+D<*0>PdP+>TvB|G zzi=&vRWT9V{<0grYO{Vb`-zdom#8vU2DHx7iTM;{&Ku)#66+{|qmrb2H5K5ad(jpfe}4LB(^`T>;O8b|h)h2jGH;FyY!a#|cg z41#z_6y|XLaow8Txs}Yh={H3O1lQ%0>!Ji(0w7xNWzgTXm@~Q~nU|DaDOx0w)Y-_G3E5)zB7*N5sS*yYh_C2nBv^7VwX7)a- zP?Nkrl%W}Ub7RO!SP~HHr2Gf!>1!PF>Jp}X?p$xtG`qv8Viqxx?Yo`#yVIObh4FpO z`Gd-(os0c8^fN-0mW*qP z!Nk0h3dVG_bop`D+6+vdF+N+HIomQc-`XtLtl6XRxWYXuJP)`qY~zZ~4}tO}XUuFG!ORCIY<4V|cjvGLkN_2j%1Ry>^@OU(^BdJPMI zpGg*mckS?^pm8Zu&k@qz6^Wp+C~(QricG=FwQMV>+5xggm~ z9>>;GCtx4~SR%5E&!CyA9rdvTH3dscu~?jhsKVU_Hd&i=<-86J%q*twaWPDoH?%r_ z=fLex`CT+qrg!TWcVR1`_BG4|82x+3qrZ#dOVv!j{w9a<-9=7A9i3m@F8}~Q+qJ+L z>cu6(HnHa-Es?y)BFYtp%Mt}$bkOEG)N@C`Dtm}RZA;Rl- zCm*kz+>qqLYa-a){o&Td{TO4{0$7a8JS|w;dyrPZCje#))5AVZb?*_2_p0(L|12KSbdbfT%6A}BoWLiD-1C$4hp_Db4W+B$0>Xp(SbX=XstHBuZljA44>n^TNg0@P?!Gby<`!@xzMdW^|K%Xw!p&l+@-Gh@d z0Nbmvrb2mgSNo!_+O@zOm!Ee z2M=~~lEyewifCzc+uJ3AfpLMzXF&flQs0I3kRQ8>&w3eR0onDM4<#WK(St*HHP^ku zr;&|^@!~@4*hO?~>SuJIuFi))Lq?pz6he6d?3PM2kjgvS>~Gg!jQ-Gdc5dWectr#g z00eJgm6P4O;EPYN^iKO3UJV?SwulP5-LK*otuJ*U_fG%!b~uTRNw!reP~iVYKR_^ zUHKt2nz2CJA2vnbQE`Up9_8A{gIwWGZChpg>H{}R(or^>?<1|$yB|RGR6uw+{M4)K z$kp-689HxJhYukmyEyhAzP*w6?yKYWmk6>N*{fB?LUI0yG8^;h*W7}Q1DHCS5(SylrnGBn(^|R>f{Y4K#|?1ky#bbo=_6 zbR!?5Va{#s()>MIJNu-&A`BZ5TSg_8b{C|xEYjtDrxcArk^|^K%jq?RKo--Baj0AL zq!6N|0cm@zgY#GsM6o5WHSB$Fj?0teQn9Cbc{}zSGm&55)y?b8l+^Dpiznq0o4&o@ zO+WtOV@g|2G1(&h-dMq+dRnm^McL~~jhqlb=OXPoEwfsi=m5L88Ls29ktY<17vrAKQ;lg#3&Y0_+(u`}`IkpapNXP2=8nd`Q%SlY-E< z<_#4<{Jt~Xc#J-w{&S4S8hsMr-fw27uZaxw`pP2^-y1KYCLj9-D2`CW_dX!wPWOQe z4G%LoR6#A0G=Z@SiJWof_$etjqnPeL^)vA9-bJ056*36moc>!)tD z_k8J)&OV2%`cxR|?4k%i*QR`jk%vn~x*1<%1A?slT%lvNWNC~yp9traS~1~qo%0FY z`ur4^W+mF#=IavK;S1+>!A;T51t8twLkWBIbH|0YnM<3|9!bU`LP+hS2@i5UX%_GR zh4tVhwn`B7FOeA&4U{uXthggEpL0ncmUSQ5n=*oInw+xJ`7PBZ)}Cfq2r* zD5-(Y6pf1`QinQzR?=e5f1z^ZAK=wwx@YC(cvHaQgcVuaYed22c_8gtoq_e>P2GqG zBOUGEr5UCvQJ2G9#5_+t3DMUs$W@G50R+TiM3L>-b;*m!cZ+}@Pd$F z2u#te?(zdf^|T(^uQzloa7#sv8Z#bZdh{z<$`&Nx`n)J-G$hZR`Uy^&Ejqnc zC-;my5wuJXu*WAdUi}HAX-KVZB%xX z8zX$eIF=;ZwS7k7zN=i!^T^&5cUmID&c7tb!B%;Vd`;X3?iJ2m|MaoAb*$7r=zu+A zwVY^uWoW(A)9Iww2d-3A+#!-LwIzOFm?pg)&h1(-jq`XUEqC;0c^cKgn+?P>(>}W> z|5phUWzI5SK@iAT+@;)Qja+V#-}Y8gv568^F#vzdi(Bs35u|eS*&mZob5Yue%KMR` z%~ex5XwKGn|BFUwLjE370mu-700-wJ2XJqCm6P`7))xLUZ9j)rIGZ|9S*@~vOdA#r z?&|8wy7su%_hR>LmALRs&=VE-^DN}c&ntjo?DBfqhpTW6V>*Yz)9h2h!gsmeG}ycC zJB_^G8@jOB;4rRwdC5_@DZaowW4C)EvuJ5m~Pb{b`lmIfLcrd`*KB@=id(FajYXFxFug0jI$E&N!)$u^2 z53qj(ko`x?ON#?Uf_tTNcb%ZzELxkz@{RlUIFI3=&GY1FLuY>qt?g{&_VCQR>RuWQ z4gui*boJ$ioiic5xV^6LaDQ0GOKux!9u--9@rJkR%P-O`Ji|*u`b^D` zGP*3%|0?{<{T#52cr_Q^Guzls1gB-6UoRYimIC23Ev5(psHs<{i>o6B1YIzwBZR!M z61Hel5rs4fLk5-!Xk-)P$&S8gQ(;V3QEB{MUEGL@nR~H=4}E=3W`Tb30k86>)P8)% z{O}~9oOfrhF-S5q^V`q|*oLINR6APLGs*Tw2ZKp-9yE^IZEfXW$SK*K!%_V(XxKV= zN6SgG{zohS#V&iudB0X4xfYat^M-eK_8y%ti8!sX zR33&PpAisRRovUdpWpE=aHuuC82*eH3yUZ^SHyj6XNNdKq{xd}9fTrYvj6&hFfOSJ zB)0*^w1z-juNKsANP2k>mwx zpL3Csfx=ev!oFFO;rCA00D>BM9>&XU+6vTuygh=KK}3<&tD)T+%Gy*E{;(UD9QNIB zhgL*kKfcza*{+AUcdC=5Fomm?pj**#pjc+%5HPLOeUf6eL#=Texo@YBH; zl?#}6invn+2STWXhraVD8~X)4mlYI|(AZ3kawMbK=KFO@t&+6DS1i)k0O)@0r;}rD z#=HUbf9{6-;kOo*GXBQ7qb0C1etQ~)1~ zT&T_Y$Jb`hkgxCUP*e4O*jT&q>*hxnl>5{-G%ibglESzpLi&wTZVs|v-*uN(gd!-6 zuAr-HwK1^z!rO5;fA;~9%IMa=@V$XGte<_WwoBm{E(6~ap^|Tx3sTiCkmJ?7Op!r zK%@oK(*aV11Q>QU>tjquAGw=^ls~5wckA6KLyD}R7`z-W9zHK3YcBa+de*D|%-3dt zM*);ZhYXF_wMF?6M=W!{JH{m12 z;Zg}P+Kb~sr$)WsR_TmtCw@;ou02IayIW^Gz3HCRn{J%jd$q|mYrd@2*HDz#^ElI5 zH|YWd>+helxmZPgpdbFm^P$+;(5v7C0fdB7-TDciZ$F~E;(uIYU@m>d4K$>eX#8}$ z&r9~U$4^RZ{PYcy(Tp(PilnLO8|Jb5KtdGkPopM1*HD@tpJ zdlGv?mn|wZ;}pu8#GCZ|tSlI0-}`0-sNxz#&&Um9vVy1^x8~K7&e-0u( z9;Gi-nE|2GhX)<9$P~VONqFi=rmpkF+q;rv7U?6d#zj;BAT(=3+$s$_GwcRMYvq<8 z3IH#7l#nV1M|{elUgPQ6Vtfb%@L7H+r}m;S5F8Q%5?mgsf0q#A@O#Nv;O*XX(y%25 znU=3O^_8zCs1$I4piZmK(76}n74E0enbQET9@Tcm*u&2RwSQM}L?J#Qsi~2A*6hf6 z99Y~tm6VBS8*+!Js;u9sM~_xlxR&Mh%1fI3fJpQ?Y`h(e$oDtOP|@$Xnfm%z8_xADMY;2OF99Vk2NC_gYs-g)!?LEu1GAs>+b2Po*Bo4 zjV1T9G!K@~rWr;X7niX$2{IX7Pa4&v0+l$2$EIxm$hvy++jl@9`6rs0hG5MVnwO3l*Eag5LA&!$E^#Q1ot_~>b6Eg4y4$BXvYnT;o z0InR+2f)lF4)hMoAQXT;5daHKj1Zuqt#IS8^l`}n+%pFX;4=jP)(l4gL^Ux&0B8L3 zrx$>M4zOV1(hMvj>J_d5LZ_c>`{#EgUYRDuCl&^NvNjZXNlTY|O3sjfd19}iAEM$p z^U2WpDxjduHh7|J{Yff5(9TaI=Vc3m_YNbY8}tNA5%A*OapgTk0LkRJTZcTWz9Vx% zX2Vx|8T9d|mPtIko3-wTbmDFkp5hfR+x@Ufpy(XOSIY11#RG!u%3JADD-GPZS6j0)%LjSX*O7Lzr!h?OUYb3!bfWOoi*Fj@ zu7h|7zx~aBwSAHuFdJbuR8w=*?3p8kr`9=q^>Xhr@e1G76d&mevqHLP$}SQDH+hQ4 z*EGZ@*+~7>Ikh+Zve;DYS!0~n(I=iemLGAGYcg@C2He;Sc=ljzjFA%WGXGV z4GM#d)V+oR{i(JRB||JhQy;@MJPwOl>xJWm#QaB99M3K#0dq-nTmI9GRAc1Whusjn zo{zTVPbfvuk=~x+(yx7Fu*v2h>5m2+p+IJLv*F4wsxQkYo7p(J@IkaTr5IYSzkyj! z^+fIJvZH!LCE+t*ypLWtMI%1>&>?yAdUx3{r<9$`_*p)=fl9c*k3l3aJz04yQI<-& znP6uO+7FvW7RxN_2Q0jlBZCmZB43s^kWy}sWb46Zg;mrdD8$eSiHX}lR(Nnbmg^t% z!2clQ|0Xv64@wS*&;Jdb|NRnZwR6p)ba$<4(Xpp9fLF93%*);S_*>(d>GYAMxlC?* z61ijMcRH1kwWmYFBb0^fiLDzary`V=hj_65%~*q)Us6d{F<#y57>Fq`%%vc0Ke zeI}Ew(y1A~vh&ZadKTK`UpZNrR#QY>4aaIlty@o00m40|XZ5Kom-Kc)%jIf;zjL_Z zvabJhJiOlj5IETi^s1tC{62*Yv89N$(@-<>xs5rj?!LuEn58*$|V^k6?wa zmtjYjwXs`e=Dv(X8L2Zed+mw0qiGIUb_mv=)H&1Kk!dsB!0q7Pp#TCL6Z%b|3Vv`& zI?mLXWbdQ?(Sv1$a$e~`Tuh!y*w%<41<2%>&D!v`0h6w2#^%~6`;;{!VYk(^_SNx` z$LvC067&$saV1}Z`mB;qcVnj3Ej;?B&5Kg2J{WW0ku^j~zfoOt zt+u>;XpX+-|EW265yQ2?%oeqjV4J^ga=qhMRm7Wmh>@r6Xsa*Y5e_`_t6)7P6#qmE zga_GTzPC-ec?Q36>^L67QrO#Yb*TNE5l!cl=}n@DSBe%Lgtsi4`+2Dcjl-YnG(9z= zN>pM^I+b@cLC|%V`ByJ|J2fG&XuI1|_clQLJHb#j#OT|t^V{FF`Gd{~8YRaX{1&yk zy_KA4frK%KfhGg47!`VYaA)VL26MO=3CW1Ks_ zx-9FDR<#ik1q+AI;D~~IWi1R|`9!?{H@05h%v@_Gv!mR7m_ZDiu_NBB-Rl_rG5!LM z=5t_C-6b)d%+DTNd$mhaAKo4z_T*cJT^=)-0?avBj&leyCSuY8rw#3NU8q#dfI8H+ zX($3?ne2hw)Z-7!v%R&+M^A@cJe3F`$eZ}{(fb8xs2A6R+3VDd(&%J_qMg}V-3N@+ zPR$1M%*(aku6qL3tn%tFaPV3(mbThmL3TewCVIgX38V?%P=ndx0pTYJ*OK(ZcNj6sNx|6fJRWW%4`>n2n#dc z8*Jl}d@fn~gz=ee%^OuFCI|EiIX^et&9Py<*i(`I(u2fk0K^jb>G=8)>1W;GrXU0l z2l`EhuiJZt{JOz$S6s+9VMRb*ra=H|cN!Pswu@JFjW|uG@1VrwnC8;6(932R#Ql!I zM-b#tLiv_#R~Vak$f-V@zDcLm9{cWQh=8Phb*gNzScUDaeP>Q0f$K%|s7Y!8Z_ya5 zEA8eV#F&^1+>djfx6qk%xI|(>k?zDaKqB)8-CDLS-VI_4C7pqbU}ljDcRTt5eOC1) zMh})5x3zF36}%3ssC8HUhaieGHDQ&pI5v}gwQHB7a%w;-Puv*CPCN1ja?u^iDHYJe z>Sg$i)EPu*CAAX(fL!Lq$NVW)#HSY^#y7}0Ty0R8%{Tc2O^(At`@w-46_)2~K0vC3 z82!~lC54V0tkm8;ch&iJbzKeMesKQ;oeP*N>PcC#D5gw87?Fy%ZKkIDl6V*%u)in# z3>yC>$uVBTn2JpzABIM@Ylwlu$Wp}YU@D2uY}2^TAa2CHD#c5+AT`+#4!D!rq((FW zCQUX3ldp24eP9hukRkK*7)z&F!g>6q`yCS2)N#T3j<6vL7<`)WnAzewG%E`ydd)m1 zHrVr1^nlx58IM@tzK8AObWp0k3oW>W6_=&fcZ$Ha)+6f^HMn+vROKc-C>iGVnpC4R zhLbA*ZbLx2LBDjjgO1Y^AYVq@LhmR!Cle`Vzo2h!e?}z%+^F=$I{v!R)3yB5wK}>A z1Hyx!9|7!?M<7OSnrHmv&ga|LtGN7L?mCEp2r1uZU( z>b6SligTlf$_Qkk)-~Lq1#!Zu@3m>f_D|5$%_?pEAQdfobSxLz0 zWDd>)9MJv6Yui(`=F{z(5IN4U-Y5Qnw%oU)z&9Pc0aSP7=WRJ=5o#?R-jz~ z!GTke)Q7`^(SvOI?RK~rWC~6+E!SyEY@2MMbkRXGza1$1b7?p(%u)w=P%c)^hP!;5 ztfu_}cUh6G9ZM}S{?=#PiJQd9 z9R`Ui*?2Q<>jTZ@_m_%MFFf2p+IHsXVdL1myPW9C)^|R-<*uJq@s$=;GMj6}Q0}n^ zW*4q7gqBcA6@cF`h~ zt}cIhUoG?UMqaXcM$AwIp2^JP-hISS5ry``L|Xj_3osCTc4PF12K@PQ>7cTz^823x zg^Pr9;~-NftH%k?ib8+r5I1`+=7v(7cWw51cGSVZyUX|k1G=eI00HOpuqfH=&2T3lPD`~1d< zr*Hr2!ZK+%Se;EbTHwl~aQ*Wb(Dcz4Ww}Zp!BT<6XK5*rXUdvbm%Z+MQOnRs7xnUN zv4FH`vh|2fk9g$F-aTdzr>E*0^Ky5O@*Q_0}x zm)1)F1i>OJzBH#XA|zyH4)9;`*3Vac3tWs|{Rs(ZeiurW0-%>+^;w-6)C6<)QFwTg zPKR(qGuO~^VYQ%NiM3%g04~%bHChn0k{hUi5d8X0gU2IHuozw@i|ar@1IB1V?`rER z9UAliq0&SkK((bEx&DhAo}FLC@i(>l52a*>Mejc%gDuhNNV$0Pr{tN$4lkiV|ipy~w-vAEj|wYdASNkVKgl7NEWsI4uRb}_#>D6}vq#~>j| z!NgD#kt?w&n-5TC!$I~AV*%B}MP;R-A-)L@EOm9g95;@6)=&p#BWCmp+*krmNx8P~ zb_g%4UqX+Rzrs&0LSwR$f=VHrDjH@o#mV3 zPNBLj^9O9$j2<+!G^X6Q)cv9VJ49#%8+$)DcG7E8Q9}VBrDOB1Wk+SeJzy{4ps5o+ zf5Q*Q!~wLXL=Pyh_mglAsvn>Rd8x>J9XV0!%zjSZzP%F9YCR{41CPJx{K zNUgXKiqQLZVMrkY&`1Ms{2Ixbv!JyR8LfuxDZY9sJ=Y-sc{F_0gi~1F&j#B3@mir$ z5lN(fk1r57-^sw8ic;Y&azB4(L+`1QGhYH^=Rd`@9tey! zx4VF<*U_#CgGeD?)m!&U8($h6Xm^LBN`XUKw1KzQLPQ;@69KNY_w z+g?G>w`E(+QkOWSX1W7F6tQ9iL1*QT@=0l>%l8Hh8_XMuzebtv4}W%|zz8pqPv`k4 z2J9;D6(Ayhe#BOHozP;sc=HO10a|vR`WuN?gqbvjg6vJ8sqwJ9d;n+JVbVvO6xeTl z`FM=IiRAGh?&(Vh>^;nEi>OhBy*MwQ)f5R_n0lXYK2TJ(GogoYoSsM;w(0iQ!iq5w zEGR4ql|8cT`8iuQgCq-@5dnOydMms5YptgfPpNN0TFL|LhXk;X$9Dlbv!rwvJueSa zuH(#w*fxmJGB--rW55|*xF}$2{9w{l+CAsDK4Skh~``Fa-RfgW>uA#*hfQzUCgsIkh(e=%`e$*D* zZ0-Oa-?dzs<8!N?Ef&}rCnC&CLW;Q`k-!~HPeCe+UR-oDW$Uu!#x!wBp;PzY9* zmrFD&!=%K5AkEH@NU0rMy0tDNsJ4CflbFgg0_3C}k%<6;JW`5!{ z;NDrB?aWK#ACH*yEuTy;i8;DQw>|{8-25JAhOe;MHjuLO{}rSfbBgv^oG=1U;PITF=@& zBY%kx0S#`)iI5gt{zf=QE^RAUfd$-&{MQ4z9=~23Jh*0dNyI|L(MiQY+HX+RJH-Z~ zqEZL!>KlAme)Tqu&#gzcG#HTjqRnm7M}kBLMq7FJjJY$3XWt?5F#8^JUz3Nf*Vq-N zgGzWl%ATK2j$R)0VX5guKm`@H>Jo<#Ho9@yRuX^JeGDqlmmHjJBB+A)uIf_+az7 z_*BXV!;TAZhYHqb09+4s5ceaoRgDoah0Xz%rA=OeTNBHL#<-a%BmF9Nx8-Ak4$1Kgtf#iwwp5Gexf3Nhv z^#zl-eJ1>}wrY&6xJv|aM^Y<(fYYz>o(HzaO+qA#T1) z9&XP~B|}XX?jJa2V7LtuBLp!8%^!J?KMX7 z5`u_$`d=We<_sfE_K?Tfc{s=APR{GrNs1V&_n_ zazJ;$JezI7_5Ou?8%YLurc6+l$;tdR4g~zrM^K;O9Vo@ih%#o3Z3(FS0}e*8AH>ZO zqKK_840__`u(ebBR2a@=jyz^AcDn!*k@+Pm-g-p%WjEEUQ<1-7r; zS0JE-wT!<479+*Y%%s;j)hu~TaoOL%wLb5S42@1z?-yT_xJs43*Ye%?$D142Nn_om z|MGDDr7C|_RRgE<-(=ta!WsXna{Dh1FYv*?+^zripnyHb;@?;_{I9BQ?6`lAbvc&h z+c8pc3tAXX{K3HQDuCA?4KfsYVNz%O%DKb~(@Z!bwApAj{bo76V6x$;Ah4y`asC_1 zaq&YF#jp$;@xMyIaUL@Rtg4&dKLdXv`oTj)0yxBSCz2AsdKF-4&PyN!B=vFf;^}bOie!ac%%|LO4@yj3SM-2a%zMJ19PJ83EQ6|z448{ggM;pz= z5g}(qheH3{uB_{VkJld1TTulk4S7omQcYKnnKkc?k-gO!WS(`x6Vd>Z;$hy7`Vs|}=)nr79>#g>0l^K0!#_t4fyY)7bbr8lFEsb_5Z zrR-1o*=_SZJ#YMDf6uf5lKT#OD_y9>h1@5&04QBCrEy~|lF#7T$y>EqD{Zl&&##8o zfF~SlbjHxxL;MYpe}(g~i*i}?z;jMg6A|}+9@pm##WtEKSArP!%OOhhS=-DY29W@` zhrjO z&r!FyvFPHzs~R5AJ8DeLW$#7HNT%HJ+*#{jR$}5Hn=W?7gjK78#?xwz?^0}@BkkAP z+p_qsXONQJI2)b1>*Uvk&dtgDV}t&6Kh}Kn$g)OAxx12RS~-i$nqcs(JL9Dy-C7}K z&eQ&eNvcClD(&Rv1xqR<083%C;f7{dQ|40)D31jIz5YF!5gtjQJ`W#Le#@>X`WD`iJ~B>Kl&SAf+OD(QDr1891`Ofc9)8U$6di zLHxC@tuI$2lFXVh4@aI4@i7db{c7`KMfo}aL z3(T|sTTm?!CSWZFz|bUtjef{yWOVgUH_}-=SpOm{U!G%&t>XCief0cJ{hjGm^H1?d zLSHPa?8;5g_V@m&MOng)yw&~`fU4C|IPJMdJkiUTSzCDMk1eOeYETq62M zO_m;eybJDlM}zb-;{Ny5oYn_+zCuVEoP2Y|lOW{8T~?)c^RsIFQ|9W7t;Umo6kZc%e@gS3?G;o65^-=|z^^-lN6WzkP<7ipO8Sn_bmWMBgnk2u+=h;j4i(+ZJ=ExQ=M!a5EiqC!C_)~9%&P%(B7m^w*RUoqE_1ry zdIc||6xKEaeS}7$bhsV;wob?iXwGim;y#;a&GZ`rjAGH)^ENkjY=O&^-;8}E79jBQ zobLhV|F(j7?OQo%Fku({MCCzdif(1Zzxpzguhx?Lx+`TlWeZf6mWcb}bC#618^oJ# z-Hz<2dJa_5JZShJwji2-k-?5hFh(HITe9n1WegZ!0y{jR{N1Hq+? z|6(aGS6!2fvzWO0jG>&@fllR^AoWzl&a;!C-69@&>x;~L(Fi$Tu*)c}0OQ5*nSaeS zPk2zNi0B>>WxP;)eEftX6gc26dl2CPGvr=_?|FrbvqWjbxmiN|)TCEB&0Mhs+_c`B z&q)70i{Du$zDuXi>0B-D4Y!vB?cW#xXfA%Nsgue39z0Vv{r@!gopDVy-?|APAkqYp zE+8U`^cFfIiYUEH7bzmW_dpN@k)|R|Iw-w&2!sGiuTlbm7?36<1}Q-ZKI&J*yawVT9L_v)#Bwy331eWa9 zx%jScGXuw^Qw)fLDM7%5Vn1_hGLC{ydNAW8wZFg57#>y|11fxWMhGf2Xxt3UHJxu* zp41ZHlQI%AKZ>oa*gHcSfKO`cKn+CbBz-}J||m_mR8)a`5?YnojPF;yip*s zaTZ|;%6VE-DJ~u)?FN+XI_DgB+FzJlFlb+3X|CF;>H!cznTeZ`P^Pn1XYks3FimpD zDP7xM%Lm!8oogEmrhO z;+Z|L%;x}tBPAJgB)4{!d)OJ`odH+>^5F6+6EJVVq-^V)hp+DkRD_d~M}coXpt)lB zZVSpx$6D|%(O?qekInztx+Cm6>)KfAhWS}LtfO+uQ{wequpYXjgeCuAA2U^Cx|95Q zf+Z9z^P`^ksS&^w#vZDXa`yJmPv{oB-fNAYK$PTUtjtAmpoEsL;8$igUDkL50#;IhtqN-Jmb8M)O$Yy))x1qBdD)TbCOtu z^gy)DbGnrz?^&K~JET*{^nK2iPeSB<=d(kPxdPQcQDT+tz?Vq{LiVM~v<7_&=)JMA zr`9UVF#kmMmcsMFyrhxtA(l`wnE{iOc3st|1S7tCyG%^84@P&0H2StZI(n_aX*&U$%yqj-B4G6V>NHdgb6|Cqa^LBXv>4&Zl_M!8zC%07Z$JMyy zfn*f4`gVS0dI*0V_cAmKiWlG{zCzcms#~;ZL{NIW>iVNo4%Bd`( z1j-MXv)B|@F7C}Gqb9y6LzCXLJOn-nM#8~lYQEq83_Qn0qVFa-SbM{(n1 z>w$z}dxoUc6UQ(qx827AR7^|`rC|pLIuq(ywGPh$`anq^(B?q-U@6~7D}8Nr=rNhc zs?wo;xkbH29J{>2QLw3U5!qY<`D*D2>GtGTDfZcG$V}po_R^%%>^g-nGWWii+umme z3b+!g3xV3{r^>Ab4_{xH_+6v2p1C+X(Rk{sSA6Q5mdB7+S&^x~v#Mj#HeU0D#4{A! zwA$!qAe+{=UcMf;p5ETp=P9Z42ZdwojB% zirS7tAUw5cZU|CKB7O0pA^_p0-{9a}MC-YxvZFg^N(!9@%D@Q2Nr}JAfK*OLPB<{K za8mC;fNJyXu}yd*2oey$DnfP-79;kDOat8YwO8+qBn%84Lc=Bd9N2n*B?u6%4F32? z|I;aDaryVS|HqR(qiy}Mx_=)#_YmLSW`IMt8gkAZ$L_gl9m8*>(3MEIyFAO$cxwGj zvhqzcwUvm&@KIdg&fs!|b)ZCvZEN6hY<-AkicSHC@4AvzeBT&2!trpcov4X=E<`B5`z*LnoSIIrvDpaL-f0M7iubvi>Qo zORFB>rIgOP6W{i0;&X$PwlpTI7qP`dBT80{gJV~O6^iF6*YS651BgBq1M-|Agtq{Z zWq_LKr(}Puc3!Dv3tp`t0R)An9KYl}ER6@0446V-?R=^81;A`knaXauItyth%{P60 zgV&x%Px)!KKW0@Fwc*;z2Lzk8P92|OduGY2EE^x6y$B^jE$-mnl=%J}=AI%zAM%8j z@eiDRO+!paqW*`EN)Zc6!h4F4Tg5+>Xs5?)V?yyzO!Dp-l*R@ zN3T+lyTv+%0&9;*K2Dn)C@`IU2Slj~-7m08fl|!vC2!r*jO_n;nLZ<)IgN&6!?v~u z?ND$i?&vZY=m1j~WUKXJQ||FQTVOUq7k{1x<#%&5@S0jfV2mt@ z0ShZPO|4t_v|x$9Cjn-br=qbWn%*G)z|t+N^JLlkV3tGr#g!XK&K_jFEsXThnh-5S z7JN~FSrhceiE4gS=w^}`NE^RTp?+2VGL4Ll1qt=5Wz6$9^KN>fw6vuBjaY|HHfpf# z77sazg~m(v@^Ko-hjhsL4YR4D6j-HthuUqu7LzLK_0|BYjjnVp%o5m5f7P7C!|~CY z(j8UY!Zr_$I79EK)FkdM;Qch8ry-e8Z2XmU9hSDmFLu9s@ZR>N+ZV4~0t77p#!F-q zAMIzIM|53$RXRR}uT%2(E;Z!R{pzS*S7n@+3J~sH!~%uH^a5&O1S?bN*M?CGzy3uA6MIh?LJJ)BGgSw9#7$S(Ept z$W&r=avA2$Hi{inBwkkNL7OxUvKUT*r>caGxKv55`tDt=K$^1{gSJRwWjm4+3+Yi? zX;~dT)f=iwTbZ-J80XQZ+m4qZCOx#0D(eoz6-Hv&wScZ(v2bT`! zK~rbUycDoC9UFQr2n(RPqegvY3@idng6oUPRzjL-VmPV>koo$v6GZnT`x3LgbRe~( zTK4l~gp6)vt_q2c4e_`3{(C^MEd(d|v9r(MRgwe2s@r8?luYu~H4Sx`a}Q`$`p2X0 za&`1nu?7RSi{p@Y7@#L{C%UmUig}1e-oEnuouQ*3-IjRIBr?OTTpakTHl3&XhWcsS zpG`R{Sygc=`}fCd(%M{@LJ-c>{?TTKl6| zaKSw9v#mZ-+Ox+s_%K`Abj>`%pf`3@7bUJExj@301i;d3fae)|6N|%rbQW0VH5ixX zx}70C29DD+d^zG+`hK@yTEXT; zG4DEn^}BWDio)pecQOyq9ZYb+>R@xpHQpa&7DMNyN!)rv?j|mr#gX#BEYu>S3zYP{ zGnML=k{`F-HkQyY|ZeQ%CN3RtAQ0>9>#B`!_wH1;N5xUwR7T% zeBRkW#()ZGLp<~<8h;C-$~hNyRgK5khTW~Ys5$H1qRToMPymzqe&iR7KxApKW!1E?dE8N34Uni;1>Tt!BWK$f6?@{`p)KEIV*mfK~-}xKx0w) zxyTz#axN&SkzyTAO(%+COhC$S<*hLn^2@!oA5VGqAk$Ais~{fbDws2_5OZcTWx!xR z1ygwr77rM#^CDCWhITJCEH2#)T#TTs7XHAmTuuGtQoPt#RnMWlOYzl0vCuyWmNT5a z`xhnyz5GYOpPc=lAn(6_)A<{TIg9Q5h3EhA)B($%EbhykkWcUOLV*~<_wRSCH2O^h zSR_S9LHBj^LdTJvB<=v+rq1FRe@f&9FdTE|TtJ}gvkrD@oy~ zqWh~t+n48up@&>0{@I3mtCa5Na*FO!RzB|BNF1IFy%GQ`RoV#`V9OZUczDohq8RLF zQmFL%D$ogZrG`!aeGiZa|7<{4cLr=_e)Kjc7-C~5iU7ShyAh3UkF~e0_qE1RjR$fFBmus8oOH_ zDLCv+(}DQW);kq!rfPsH-B^ywv5@fV`obr)|G}^UWQXq6p9A70XT*j-5c

R^R;N zgZ=f;0?e z6BYKKf1_M~b!u~2_G3}xA<7!F@8Ap)mXg4`DCm`Pp0O?c|)m0nuGUi%yTsX_<|;aIf(& zYjbil$B4xs^;gZRGjIf=gVc$r}91E`3iQTrgTW)Bq7B#xd()x^!OI+c3y|{ zf(B7=0LLCevAClxZO3;XB-0#jEdd&K!C~2^Xyo7AYgxM`-_#5Si9-!=dx@O!CWu=o zq(Q$r5&o7Il;R%NFdC`f__aeRp07ciCiSJjCN{A2I550zGedW&;+achI+U8Xe#h9R z(%R;zAXl3D$0})$iNmQfc3P>X*off&Obcf8mXL->cuTvgN-!CvhOs+E1ic*ao7MO1 zSD-@r)>ro3iE!fGd7<;b73BBVi$qA)KjSn(CUZJlg@yskJfgz=2 zf%4oBYg_QlhX`nf{Rb{NmYxzU#jf|Z_7C{C#E?kw%gF>2r!F%_dv0-XMLu+=!i@w- zbxF?`T|oL)xrajP)3e7sA_? z8-X<@2IR3`fPc0kK#6$&&0{K9YY|4?sxF1;u^w9K`pjvHT)M-l8@MK&(ERSu+$PM# zb}l6dO>CMxAr`b*|2km9W&KK8sV-o<7>qk?*Db9zsQ323oM4{1uvprk{uBt#hH$cF z>JLx%RL@%BZ{cL*XR(uxN^pjfk)PZ_j%`>IdK0rL<2rFxMPc zTMMIWqO|U?eX_#Dnsr7_ zmg}8Vs}rpB_dMrf7EfGa1-eZ@;x#s)6vxl$Xu|rfy&@3%%*7^Y;VI+14}N%bc+87v zRf?tfh6-hd>zY17dtMxkzE0l<+I&kGYP>#CHNeY&EdTnvPL{l)l+y(<1^V*rG>u%h z5257Qt6SEX;9mswreTHjW}1Nv(OP1%ow7e1DVha{k-?az=#46g2LtNS+UW2e+&+y| z4Ya=d@UW@CIX4n>{b{T>KZF3csOa+*LRwD}j-$!xOmI2*TwOH8{Si?Tjox840Ie>Q zzo>)2;0yGh2c+mYMTg;3vi>_s@)Najw2$>4<7*>uGw#&46U%UYy5p9i*O6%`ZDi40 zMORRB&k3Ry1DbK=8rOm=S=FSJ)~l4KcO6VShfNI;mbBnJSF89{$#%=?)N59}vgGd` z$jeWMrY{027+}*C4=tz7MWEhdoDOBdmRi%ENG5anaxy7-zz=)dqR_IanU^KXNAxtv z%sL5UHwbhF+eaC$8&#@}MpVdi)p(~f?S?fDN1~M&Xj=B4ZM4|iUVS(zrarw`^I{Z1fDou~R z)p;q7{gWrdf zr=g|RrZi!UTW}jL)o`e$wo1olK_bY)J_9w3R!Ts37{w=mP;#*GV?75{=DzArTmE!X z4@+12<~2|Rei|iiy_4coZ6XT`kpwY|E9hQvI=bC`sM{6AY!_0d6zU#W6l#%Ueq2r? zl@+PpB3_90-7UiH#nXcP;m|T|I@Sk}pN2$#p~jJXcI1P_)pyWVaV!4^7eEy;o?MS? zPfxE15g)OCSEUvd#3?a0&LYw_X{E9_ytH})JA1VWL#4g6n=6kp1ftTPyse%))IGK^ zeM@5VlKiDTEo7#g5a*rb$&05i!C$p>r--3igy%ODM9%emiLFa{TQOuuLwJ2Bt_P1{ zD+#-iBX_A;!%3@X;d38}C%fuiLUPJe;Ln zr+ZPbku>by3v9~DRwL5W97;8LRPJRtr1m`UxPNoQ$TrNsbbv5^XH4;4Mc1fd)QEi4 zI#-P>y;Ev+`76-$JzA7op)tglZj(kTBUF{mT3(f=uzPxKD|l#UY-~X$19TIM$nJyY z))IpK+1lHsmrit5-!5eTG`l?5N93$0KJ;aT87r^#%jSZwQjm1w6Ha0fVP!$s^{w(s#|JRoM zIeCyCE?{dU$}K0WHrr_cwfr7XhT(N-H+bKkuTk_Xv2N%9x?k1*yTAwV3~vI+GNv*{ zlaYrHy-!*rY576ozKH?fH%7m#=&Iwv8)5f9Lc~(fMSQ1YX?N!@jjd$!dR-U}4DL(& zmyB15pj91Mmx9r+!C0WwY4Dk^Ni4V`226S8Hl9INjrZpghHSSV4l*FrNM&GAny+I_ zkMmD(Cc= zH<23kVx9kz6=O;E`$u6kIuy864~}zM8N9~4XS8ZO)|`|}CcI2-Xp|1aOE&<(Z}?616r zHa@~ZvNsIc+;-_0W{I-tsc+6fJ7=3UNPeuZVjhKp&H*dpxT=H=O%zUdG8f zit5k%i3!s%Vb`vBvHsMmM~m3P30qnj6TgjxV!L&Zotp(VZ4m_><23R`PthAcDv2!)r(s6DfdwIL z7kmq$amlk_wx0Q2uWedF^8&`q`{ zEtnG(mS%kigh*xYI}1`i3U!XKLA2p@>acq3C1I{8L*m@^SuB*v>GxE$QSPDtvmm|X z>D6NxR9FtZ+8I)gR(Cz9lzdfLzwx$pVdaPaNm^AX3}vYo@K;4x&0D z%%N!ELjE$7IS>2w!4&;4SBh-m+;03)D7NpAJy2|5mwKFDk{K457Gkiv)v~bY^~Yc|wm`z;%S2~C zhxyoobe>h=c1>R5Rqz4S7WzqLL`r^<8#bjSUtnh2=Dx|z%RSmb3ByjScvL25vO0;B zy01b>CAE;EPjlKYmxSfE(S|B=l32z2(U!PYP3%LpE_7>)C?=43Xk10=_JUsSOH~ck zRi=>d)7HnixslK2PxW-QbdLSgw2Q zVx?3l*3I@nLfFcSt+XiE=NNFe&VWe@Nj#0X57f9^u8k~2DdEF zW-7=zPb;(87@PrQ+auEakjdCL?y6orfR|xR0fS@6e*}x-o3SPqf$=Z<NQJWvy@ zv_cZAX{ko;p&-gq+VFAup^T{ArQM2IZ9hU$At~jYle+<(8r*fOX&_SNI5SE$&L#T1 z^K$pEP-pj^wS6d436};-jg3iiaSga60xXpHo!Wz87mFIsjkTPBbLO9GqGDf?cWfuN zSW=jgcyIzK_HZrE0_I3IrAK0uCp6Ykb6go)RP)!;Cx>7yqyQXQ2KKpWP5?A0?;Tn( zI;BRx_YQy$$d=JaaTJIq{aqk5!XI>dqvDDpw~IM_g##tV?i?Z#zy$yPLU1OfeAgl~S+72XuomQn`l|Y{`&c zL_|XhbnN8h19@`x^lDi@?Kg;IQ#3#FfvE7;ie}j$Rt&e4js7((E%WWzpih_fiPgEEjuG&CO&Q^R52po&`P6{otLurFIN7V;8| zfyhYrLhn@f>~^V!3YOJVvm1yV`kE@BN!I#Qk#=(k1^g)A{h1p{dLTc0yXrG}a=h?t z8>UxnZML)qHRAspVcsj7@1FvVedPWzxw&}~93nSOw0eRc$XHMwI&rfpvXK_Pv=A_4 zj|sJ|X~PvuzxXlWQbwrS*XfkCoFBJ>^U+aeH5{9u?3^!}_Is>qF zr|h^(54!np-TUZ$L+ABK^|7(r#K_N9%RiHRy*n#bBDnko3f=;(BVj1~M7 zU>W{tJjm*^7g}|6io@`@TvEA2K7Wyk>D6nhyXQ#s^uli&a)00!5TK_d%OeTDZER@B zO;33ZxBy(bdzGH@pPRVpnJBLD*E>MXc~hh;I-$!j|_fO_#IY#>A*oI zJ`+Q{-dz20df@o;yJeg7OLbV0<0oAs)2Y&a9SKgP&NC;j&)WUJ$mHQX(+!1RS+1a> zHhO$*nGYg(kdwsE(>jqL=5&(mm3=V;d>K9)Sov*V7e)%YZ298jji(b3ZnzESW~6Nb#WA+9gJ#s{_aT$%q4ZHS>RfIdBqkq!*|Sr+SAsMYTa1_{>fP>ZxpAI&lhUgc2i z<-PoJBN3487Wl!z)4+ls#A1aWeWjk7)2krlRXL||d_>zY zsKE@a(1&Ei_qGkp`?zbvHabch!?JmP{frG3c}jou4ka_Br2OzrP#LfL`g`RThW83o}*h>aH+%%f~{o-Roe5|w17*U~y3Qyb~W?z)7=vV%t(FEUJjHB}W@Va@oDs|wt( zGYs|?4-^$U60RzKVZAGKA5|os5P7=0iNc z{aqu!)QNbmY!NfK<7jAFn0pl4WvDx*La1$tR=E5bbBPf~(m_W;y#5j6Xm|-OizA5! zk>JTm;8$MZ{?8}iWh5^n?7s^BtImxp(V+h-_^&z_RsL7C|Dzzu|E3$D@Bgu#{}|6) zMGwTK`EY#wrHLE;=IxWyWilk@$WoFH&s+1@XK6Oh5(+)t$Zm=nY%^2ECK`FGbG8Lt4OhZ2(qB`*6V=0D4nTo zJ#?DgJ?WNkNKz^Kg$iDE_<4l(<$eqO&TY8)EB$b}f3aw$>*k~nA~3bGGUMx?qQqY>*sd9-95%l;GbN>9SnF{MgKSk9pk)z!KE54?nk4mBD{?b z^Y~MOx}U5!sgmmiEj65<@b@J($+tPAySqotXXSit*6f#!Fp&EtvRHEVYdrmUlx5J2 z4c5RByLFY^E zX$(yj&q}uY7}6hG$kEfEMmVj2j21Xx+#0mcYnS{L{@O*OCvv884DvKB4!)q}=k1VM zO?D1;RPh|{$co8<9j;IHCMoMky`l_NRLMc3`r-VJH14uo&R3baQ<*_p`hze2v~{5& zp8O(r!@yEwyzfYZ$m0X%_{6y1dXhJfgVmKxE6Q@0vcEIJ92FW}C}|E-A1kE^;2EB4 zY{m;7H;{(V)4biApjr}LABhQ#-C*S6=ho}e6M$=%SI8+x>H3@5-yu>hS==h7z*P^f zj?`jnkh)#ry#YuroI&1too#|;*7ROSM1_*Q431e48K?cM{iNF!WH{ukVXAS-X*OT3 zAI)#Lh^+)?RiWes3XgZ)-FyOA)zMr!xPz>vhqN_Ro(w@@{WsuYJgalov~oe;8-%2T zeu$6eHdhlD`PN0OYF^pkdm1+t>ISW)O~x=q%hp2EMujBsum{ksVqKh#I-%tb>sz6P zTu(f>#O1^_6PmF(yd}a>46pBnk?LHzyE)1A3MV5woW;%V8zwp0{bzp_nYBlC(;jwP)L^z;X@D46AuT91= zHt~?j`e|C7SGb&DsInh4A+lVIyQo-K?`9m5Mpq$37}f#F;^4H7|Gwp`iniYE@j=M{ z9BEzQy-V9WtP|x0Rm^oM;P#WTCDu5!@ETey#mWcRkzWrU#=0&Gdwrc+NEaQlc7|2IX+Egdn>?va z;;U8Y-=pn>axucV5d?;dtSguPxdvZ?DP>KQ z10}PPO3fT?G@5gq+x1KAD7VEczufSm4J-|t#iCR78&@QMb(hajfI!J!VXP9l<#P33 zl^FDQ#hR7uZxZ){q|f!tM&pYlc={YJuO{+DQw0VP-f>#A<(5>`=N*Zuqrlsr=@-(=I70E*6H@wOOA0b^#w7@Mh4Yk&I6J_et4lWYrvZYa13|GQc@{QVu|_%kVv9kr{D>+Jp^%?-U>I@! z5=?iwOZPDWX@!DzQnJdWaPuOCDp$9jt&PD1%g#^UFLpqF^?`c=yJ)qeO`ry;Ny(>P zktq*gE-4haW0qH1eQv(iZd)FsRk-SDbE_ppy}olVPkOTq?*8MKhcL^ok;#xd8ZkBw z2Il*c=VB=VXM|$Hj$yAFes#ly2_^zY_b`J8`0LgD);)TQ3HJFF?<=@CIfa$M5~*W- zng#^>gOY+YhVJnC>%;Jqmrn$4lLpDse>_C;q-AVt#H0JdGE-9ns}k5eJ;fNR$P|@O zq(ez1FFLR$&cgnNKeFIk>l~IFtK^HprYyZzqU^$xFuX>Siw_Mvd846vNNYhkv#xah z>1^iN zT#^x+sN2ZuRP+9wFK|~g5v00w`$>##WV2gj|C6Cq9@o2CDJ7g2t(0owN#7@x#CKz- z4-a1Cciy-zeN~3#T2bn1NHK=%52 zPGqGM;w&LHt895qoZAygi(>Xzo|_pbEfw*2ZVTer zhhH+4D;MxP?BAfO2{lrDKE4cIqU&~xk z@41nWv)V@Xjr!%gzkMa-$2W()!kNqsAZc4%pESK!%fw7L`{?F8N9j*WW-Xl@jm`>T#rMgV%RQ&T%|}s-TY!do>@6JDx3JXf z-sBUplMw^L^V+2@^0_$WW#Vd(*c-&OuK8C}Xdl%^YURF;LACaH1dgHPBq1W@+1x=m zaK%fHa>K@sv`emQEwMUu#V|D2y5`wA76Pv!Eq;Iv%#?ZTO-e2aFgE##j()QSQD!C)-HwL9~PiaSU863 z$`SK8-x;7|gnksrJ7J~M+!Q-4FTwG4n6karXVmXDMKD{^WQ*YEr3G44P3g49k zF1q?*LCxQ_)5kEow{w^z|45aKEfd4{s%aK)U{|!u6m5zX=qW5@CyR?RrcTja5lwRm zG%=v!LWSco+vVp+bP@^`I9~zN5!?EmP0$dB4#~x4a96+C(64TXl$2tOP%OZ7P+S$eSo@JhyfB+R)ezirm` z;KOU2pK!wPPWdyyKIDB<4V`Q(;V;q^0j-j7iPz{A@l6=8g$!@$q3nE1^`JmqT0q4W?fjRV|DqQ!THXkxeACo%|tQ%FefyJ7(=~=QezIO&Sv!_@Ml{ac- zyK=)oGHWWkbgw{f1=c7$2;;5kO_-(RznGzgzs8lC;Q|M^^Ld0E%cXh~lZUvy>z<|L z9~nygytbPtcsz}FeRX>5?v;Ct0}5vc@hOK$6Zb83bX*X$MJ;pm1~nW{Cvf2n zpt9Lh+R_Y#))`#2DDCexdsAUREt50C3B9qi=njpZs&ZE?aEQaNYzZ4I@yTrNBL}bC z%68|Cn7zDVPRwsv0BaO-N=AY=>eYE*#nd=^S)G0t#F(X*Z307yoehnwiEYA0 zG+d!?2430y<)ZjyvcPmn*C+?2QWu2hgL)I`L5-?0N^3Di2}bPAYKFcUPTj0si=1Xk zH}%I-N;~2fkTT>)CScVJ3B9Lz4swc(a6)^Abr!!@!^X#ST3x+(8p?YIsUX*{yKjw7 z^v}oCBQ%aFFCW)$a_Oo5;D+HeZ(dv>+QTk)*-ylEx95wwKmvB%pr{ULpgs zGa_lLyd)ye)C3BSbv^|0J|&HjAK88T+x>bJ?Kk88tzBqiByNGAW;o!b=*D~%SlVkL zS9{dMT@YSX${WTk)3h{qH!H{EuiZ)$$P38QyyAX5=J^;QI+JM!p(kjRt;pwkc_N$A zzGZC%H-!&eEWxAdHv&tz{dNa#q~U}C0f$mx`Op;sjT!5?1zFNb+TFrI6X;xPU6?Zi z2R5Y(2seE?6Hd>|UGHBwTrPh9cy!=bfCc&I_m96u5`5w5`S$CcU@45S0(E1d zFlyv8eHMk}qxO`1vjchO+8sb;bYJSZ;U^|#E_%8aXSv;_7bgs@-Ev$x+Msb>#!FVN z)a_Zyw+h9@C7Dt28*e^V$J<+XVOQd)(?p^Z(&Z8j(>x9eZH!0o=0)3mqK%eCZtV}_ z;>5d34GzDph@CzMc7Jc~=OEuO=3RE&^X8h@?ME@?H^$_}%sL?aRmhp;z^v01*Tt4| zA9qENFUTJ8#7$-(b0Mc0`^T=Klcz_pJF!#-7o3c#mLPuZ>|#>JsR;4f39&7N_KY<` zj!s@srU^%t3AF}O2tv^7(!ho~XRlG@uSANgc23OuRE-eotX->8y68$` z&`gYgQakZGEhxM;D7w503Wz!4*vsZo{V(byo;iXpLq3LmzPmLvB2RgCnQZX9a{ACF z#M8sHjr_qi7iw%`9$C-Sjm%d#fwwp{%pjrXE|UY3g`ETD6sFA(C)us_{BT=CBzt5sl<`Z9Q##X=JYIM-dPGal!1T_k z-IF>}K{FPGz>Md3UTIU)^2(1HB)ea~2}unsXn}m{1?fLx+Q2x{u&|EU&la|uu6^I` ztnRr4DE7u9V$iqa(G~|N5v1}a6Iiq3ttu~(Dj#F-vnpq$eE0Gk%`I$0+a!*uW88Zy z&Ru2f&tp7qKC!0SOr2TTxg*M|nNyW;^|U@Ajw6}nvl_61tgx;0)1T%R7JzYOZl`5Y zNJB>?>KSXU^dvk8$gm!?dh{#r5G5{4=L1Ool)PJ%=ABlr-)#g7`!}QHudn(IeZ*Kq zV{At3H_W1C}Wd)}SvIrSDvq5)BzIpB6E6{KewW)@ZV%<*xkG8lR@OI}cwzNl zZ(gc>Xr#s3Gd}C{F3Kjg;VwKZ21CFTqUk9{L9@%@?>~ErHr%4@fL!lD7+3DhpgVLQ z3hF(-1Sj*{=77-t{f+#K?mf7z{}w!loASU zCzWS`Nmn>yFIjm;lkC23m{<5+8~-qh+qBaGJ_9m|$k z{mdZh!T#~voxg8}YaFf+sm$Pz@?FzP(;fDUMkI)=M5+nefX=wdF~&~X0M5rr8x3yB zV-1Ncu;nhFjVlgr+RQGCl8a9#2yrB>rxAlG_&BG+()8v$QvrX*_@*eo{6Dzb|ao{xVW~ zOn1}hKF@t>8p-3z@6D_+=u4JGUl|*{&e;Tr;Ew_pCifkGVtlB-$`-YWG(O4nxT>yO+0TCF;UQ|>Tphq|Etj}oljLWQNCa+ zjxtVk1H00YoiTKkU9=+axaq97q(LxWEHB)KH+56nVciUBrQ&$~A>Skw_x8*B(uCCn zsJdSbU8qhwyShA1z{2*5QXHCbS>#%4St!|S;CwGnMAQ`{&blavGqww|RbcWn4 z4-;^ZqN$U7ncC*sfue!V|>SIy}rDlh@E& zsLHVx!vo?bJu1p*WL1&-rH+fg0nuQE)tgKVe!^8uo4~`gOdXrnfIvkTVn-r*Q6%Sa zZ4#x&4oCbIr40Gy_3%hAPH5HAwvQ5QIGA2uX5^z=#vxpk`*q1xy`i1kY~dF(OgbhZ zJzbRTcqaTHwVm3M~!JfD6%CdBU~Q0+Yp+_P>@4N1R-`0ckm3MV#UZDX&f%!i6MJhz27cwUmQc$nURUH`S~OG z2P9mlRLA_G*fr%w28k#ijKla&+jd~k@K$qgDtaRATQrW`Q&K-Am+yCO zDlSjkDl`)Fm%e?X+O*LY|MYdKl4f|TSidX7h=Up%u9^{uxmFXI#dz9CBWxa$~o>D*4YybzxvsG*Im>QQ4eW?l!Zqk^6531kFl#qoGEfq*cOjnRI z6t8i+o|?5^YMZp71!K&>CylOn{-7slHqX!MYJ~ZU`Be**>ee^O?!AcX4}}7d`^eJC zaHafsQAix>WGG>Vrm}y-$H-!6OnmE$J4Qf+5>DoniDpEFux}5|Ll2_A8ILzeMVzUj zR|+;#tZz=uywFWv_c@Z#ZynuP6TVS#Lv3O_bPcy@e&9AdU3C*4)+PxX^{=8KNZ%(I zBXUJHee5k{V;6hF+{NjYE2`dyf8I%hmeXm?ls#74*ju&wZ!?57WyCyJ}cwWxbMbLql4wN%XGZ+vNlqC$$ zHrB+VFIG-_$GZYwxmYcQW%%mc1@D!O`sb9}>*30CKN-r20$LE@RvIin6t(h5zPtO{ z^h=8)7k`-$pu4}m5L5K@*v{B~&TKDo&9}?z-&;ScUDQW6_BT7wIv|u$Iceodvog4V z`E~4**H)15o7vfafFWR}Tjs)U6Ggr~O+ORX4_!Xew4!Lb+Xi?!2J43~mjx(C!wErg z8Dlfcdr<7cn~QCb5WPzVIde%eeNDMaY?e`R*ZKPRiwDpC=0AS30*NnI=r{d z-=WJYC~_T6mRi3ue8VM_s8KryOa7JT+R1$3UIpYI9_i371Wfw00 zC-4fFIMXmy1%q;cHG3u`l%vsElc&>6vuj9l*Q&oSOBZqkt(_}&dV)|=z!YQAjr^E5 ziQb8ffpydgH4nrb*OM-^3hZPbg{rCP^SV%jc6N4weR*mk)pgN2(U=JycBr*U#EWR*~UlD5{ED-`L zc1hsM{D3U(`K`?#SHfxj6f_+!CxdH`DkI(Nw%E?0wA96(27dpvzd2-46X3y{{yaV* z!5#=8JT?&Ld;(6;B<7!Iey^w~=Q0FTD@YtB8v92t>;wYPkltzt0= zQR$DS%14fhF@uLs)o)6ep;O4Cq#ih+x=LD-&;bEM8WaKRqPF-BWxh)SBbs+zkoAm_ z-QhYrK4FBc+HlV7jq93g8-*#5~<`-7^@6E zV@LiAHQcPF|E;g7KH#AK@Y#pa%|YC{7*@=DRdT$3cu#Fu%;;!HFyC@$L_^AN&-#XV z;{#!McV8a`hcfnnqe3X=#ADn!ak0P^s*sLsd4BD}FAwxXfW8k_MOa!z-8rqLqKf|} ztp1jU=a!V&FB5UA{EPw%bpdj za=-rP&d2obR`Hl3>tI)+g7eNy$WvZMDLxlRuL$#klG>5J+Rjp+KOu?{^<3ZxRU{1? zOqXe~YY2XV>7Q+!=U+>Tm=BFLp%}>4)8#=m?zmeVh+hS$$b)rZd8_bbLWd8b+ z6?Y~$y)RLGD z4bE6%uc@dggVrIjJrZO)1&(2Y6nF(9W*56%=ySxsHlC__-m`P(Lg zw@Ur#mK_J3M`lH^BPva7_gNfjZa_q{EeA}$q+%xH{Bh#PN*((3tvc#O%*q+$lFIFr zqF!?3i=w1qWWDoVn^9kDxxf#&3vP>nHRC`_5`@nP9?*p^gAE{E)+!o0^$Y~`%&E|l zcT)`Qwg{cw4sPb(8}P8Nbap;eu|$wMzVGmn?wJ0nk|0xv477FOyS@$+o`dG%_{4M{r3 zN$01r^JD2HOD3I)aLD1@ks`j!iwbJ0sX3nvV~22cPQ0;l zy@KhLlDRHfRnK&pMn6wrKKM`it;^L&|Mh-glAg#LGJK1iHe;WGde2~=VbX$jNmwk* z76REM^T{sTYEr6eW2f8zg%aI17n+kzLE+&)Ij!6i@7re|Zd%TY2+AS^L$c5ky+r%StF5VlM9+OMrfZ1iseC^_|Ms(cVj$ymDY|H9Q?;InjIvgzPrx zeCsEeSP0%DmvTgv(YJ-$AT7EjD890Sxf0N5+;O^K5?z9;hOw9k`|Gc!{#;M|a-D56%t^W}g;uZsE3}=0UybJgPjKzI!_DU5JTVVb3}z zzw1+=%Iv0)@I7HO%E7*g>?E}pUbma#mS4P9!~Hx1^@+6xXs!*uS{$6N>Ue5Y*Y~w} zLtYp6`qaMnA{6Sqc~=9)psJ6`0emi~#b}v!fO#-5Fgjv?CN2gy3%|;Gv}j#w zYRBmGVNt(sJR!nRTI?bMwiL>s;J0ns<(wb_ue6p5he*`1cQg0jqP2&xe+MRx`>dvnz{1hgFvpK6Oan3M7$N&^4F zrVgDL>q6r&dp)B&c;FouT*Ws4vg+W<#|E0_Fe_|HxKmK>*-3!M5&(j=(y00g1#vxt_P z?=%sQVj$M}W3vup4%4Q6-n&+KWK;_G(-KDQyG4d=y0{L?T{i9W)O0I{4AEcH%?`Pu zM}5s!iI{Zn^8?GHw8KRcg~imAJ@@2-OnB#G38M1O+K!*V6U>3a$BeY|+{3+NKY<$* zX+j6cw^s6z+#g8$5L;(Ai2I`47g16&HuY(YzW0`)z;6sMCG1V z3dznJq+GuNkfMh^f~+?p&Oxa=Ui~qCV?U_7Cmv#nFgcq?SKU&yN3j=hfE}aJ{Z7JR zhSG1?P);%tDH87fg3**@aO}aNxaHq3hR)WrwUF!)ukZy&+!Zq};5AtNdkrw-kSFNkBw4kvk8EQ#Qh(hE%Cvf%ab`exr9PXomK=7>ouXU56+A zyr12rnw-qN(by|Jf>+I*1oZGjZ>FDy1d0n~1D(4Blus*3`?18$My#<}>Rv=G=3QVJ zNOxWk9l9xAlej;ufKC?X!2;DVhSg6&bQv>An#7uVd%?N@Ks)q}u6q-L8C7c@ee4+` zF~j)sf*tCyvFp5GIK;zv-5GZcg{N_`nnV$TrPH;09i#MQtw|s?bnv&qqlE2+5t9GTNAd7#aP7fe33zM7sr4|viS)BqmjPxYl+mcUl*8wRl!c3%!GAG>Hq;* zRTWEdMMfbk8lXM8-f;Y>llfbhsu8D2lt(d=s+1N3s7LXASOCS9mVD@ZFQDQco&Rpz7EqTYtN`HR3hu!c@NKK$3YmvBq{{lq zSi0L)KAcJII{yTs)zkw7E~0f+%fNGYs{x3XxFW5IC9{Y1put$ zg}d-@l)p95zX9 znWZAAT&>FU;33*Oz`c%~Wo_c=xgZoC`)wFzens&YGQqYcKv};WJnRsM1u!41p<^3m zQe#zjjBG*rLDM>Jv~Th|Y3%Gd**{^)sca_#Z%$XB!;`|hcV3^Y+pca?DWwqePX0

@Ig$tMAK}m6u!y&&Z>chzl^`+pCl1defwb*UK_D^YZ-bdx>@gP??b21vva-frJ}@iU&ad5C)pPzZ2>7D+LSnx0U+Shmau>#RV;4fc z)}>+gOF3!argk|o4iu8Gsm^ZNcx&OH>@<6L?ZB&NtiaeMG}`O+t84Ns*oz>)8}j~U z%}N5gX^eZ6tqikQt;a<{>$nq{T3xpGK}^h(p;;5;!%=IMw|n}hx&(DW6!>4036eD# zbI^C{MudLyyveN?%Ok8NtVQ>5k9~w>kATvwY(B;|ZzY0)UiI^Kb^&VdE#->$xs4$s zwYsGvVS}^#?p?ZDvMkpw29S>_`nXy!m76ZP7aE_h9#2k?Kh%nv_FXCY%c;;65gPc7 zXen6Wy}WdR=_q*}`x5gHa(^if9SJt-XiHE6p|gn7d`b$h`}}o=nBTsBCNuD? z{7kPRulgB)c`Q%7&(4H))c4afAT6|?o#4V+vWycp@)YkMS29TVBQ^FoUIL>}e^i zq|=L4W(ps}!~BpHM0PG`6IzuG6MHbrbm~4>q9UEkVt|iJ<4i|<+IDP&>5X2=ZtaOg`eideti&orc6~OoOJqx6T- zxz=^oD8Q8BTxJ%>3S}+hx5e$c-+uuqoUS7-{-Sy#J`@RzL94>zLMsFfEPS)mJt z_;m`KB+yyNi0%P6{cH4Lx<(e3AN1{AfmP7KRVISU9+Z)T35eZe+588NNW@t;5<#aC z2g*j;h5vveTyzp+A_ff~uwk?Mx!g{%GGW1J`!c24t;)97xfHad;K4Qf4GQ3p1~I|* zXQADzhYOIVeJ1dc?{SbaH4S3~XzxyAR2wcVs&-?Y&1e1;U==Il{e zwOD`xck)bgDmc-H4>yl)3J>M~D(+pI1yD5cC!W1H&ofVe(e5ackn5yr8CV$4HHjqmD?>ll)h}jLH1%~{J$#q2X}pv_|Gq$v6}mZS zPYKM-i>jD3(#t1&Y;U=4_wA`ljmH!$&Y1E5n2sCdK7UHRB#><2hjj8=I?yZ8QNUDp zjny@caF>No^2*xX@xrcrA5)ULFexsOp8wad5}fP6Q%HHs2`ILMdVT)>P_dZ2{IeeS@;%DDFtS+6fI${zLr^m(@Ko!1j%4fia1ImwIEeq#k zutyzlyDm1&9-BxwjShGq^vj(RL|y(o0#4td^O<&~^OA9;$E22Et}lDtsxoS^PYDmr z6Lpz;L`=Lz%qQF7Gp^_{x3Eh2f6A4#r`fP`@ME7E*Y~9Pt^w#hak1)3_2<&ZPK3pu z4GO9|IqV$Z2=~4fVQ{rzKC4rLnI6*j+c=pw3rto4r}p?b&!%aOj|1$x@!4>X1zf@) zU}WX{3Dc&Dn;NtKATw~bE9U(Byh;2kT{EJlmqMIrx!-Yc*50FL22Z(|YSFF743m9} zo0{rKFp*595=o79l(SsJ@%s3th4!cZ0;ihlxAu%#xiP_Hb#Qzxr$2;xA<@=SZKqHv zd@)7c>IBf091bu9-gR-PJc}S()G&ORYfsQ!NXzJc6&1!XUXN*eNJX8pP?j!>3kIV3 z4;#E?+Onq9*(=WflCfLuDi*xGy(=o@1SAIm{&NpPfrk;iJe8b&tn)C&qV0>N>-{ml-@5@JhKnW95i z9RN!-FS&+afF=8#Jdfy$WIkc?qV{We^8p89*Ay^%Ht^wLOcy0_QRYebPgUpNSF^0P zWakrC7jl+#vqM6^Gr?@SMpI^4e?}M{Qa%D)qn;0)j++Wpl~x{Eag)Ql4dJ#X=r(=p zeonWKb+p>FDTYiil<*aSwRCJ-quBU_G%(bAXd}@xz+$ zrmvMc&A-O;$`b5{kLbTZ-qzKZlfuJdF~a@L*#8?$V&}0eJJbQ8b*g^HR7VuuQDvE2 z;luDMQzutbNJL^Rk}>HXx!vXwk3wpLQc5oPk{m|ZXNnA`G4i_~GptjU*RBV6Ad&ob z&t1_yzr$Nr{{c#7Dt=AYem`?cYQ&IFTV2H}@~#*t}; zrjeK<5h9f{+zWvEGkv6D^Q`gEp{vgLgiIEgDg8%c=&e3OQKsb(DxY9S!&J!TZTnpy zqGO6;*NNuI9Q3cI8@qZ|4^T_ZdwO`@MPj}tx_ZO5Q!Cy{SLz0w%vK#_v=u>OSYLp^ z^M;R09{=uFHFmgn!8{CSI1m7qgl$VKg@j5QU`a#+; z#|U0JqriT8{Y`dva>Rz=Vo2Sc462bisU-m~@w|#|l3w3a7+6Up2G#y*zTgAg$ya8p zsNu@eC^yV&l=r@JX-OIRsn5uWssKmi>3w)u%D)0VqrI%kn!TeVuThb}#UMR6RMAnV zN5fR>aim0Yqos*fcz3bSp@9baTR7TuD4*#mZe<3Tz(X> z*#A!puGM>sfBU0i@;H~EIDkmweACr_)d^WWMWfvVFcw#qpx3;j)}0*2Q#`~PCz(wv z4s7taQUu2;)ZGSFSuZ`vI0 z-!k0U0ALaX<&-N4sfr(nKi*t^p1IY^kLqs{D={&^FyY}>9}1ajFRbIBx`l$td>5dV z?G)6&+>OWkFT}y*q~FOkLA#&iea)`3xlWTN#W;*v33111o)+SKhztm<>Acmp!8SHQ08n=o(Ua>FsjP>?&dam)Tee`6 z(R3dBueMJX?IK8Xlo{|BJ4Q zo!fNo9Ymo!Ny+TBp(R^8|r0ibuMf% z)UIzaEYPDFH=_NoU$}y$4`JzE&_UROJGl-gxXa#8ekMm~U=IHV3&3GNH1v!U_nC9A zC3OB&BggK~>porIEd=B2DB7tQPf@?lW@gXr%f=&hG%!C_$!JBQUNcJi%syO2AUOZa#Flt-<2)~Wy1t0E6@BKyH^f!p1j@XS9$V*|i=#zj_HyB1d2?LN9 zJvTki{zR4Cfkvl1dEfn9G`;9>eEymJ_{zkf0AP7{cpvhZG@0X7`*W*radW%P_@^7Y z9z-8C1oMWIov_ovo%6{qx`*hgc{=A!dx(R$AGzUs`9w8fxS8Pt!04V>FHG|ad^KDF zq%2Rp&l}esV+}}!>N2hMb4r`bSGqplZTyUBgG~v|Km^%V0}q}$Ry&Tejj}f2Uumb2 z@2obQxAOpSw&;Pg&75>yWgW3AEnOzU0wo^_aFG_K)wESj_!%;8VV|7qtLY-T{jGcf z`&|g%@fMXb%;b0Ym8|M(`y#5t`{4E*r?%zDg`Q@$DmXY{Er@Y4#!XI$LFxrP2maM!-Hny=0xiNy+ zv9j9v&`rale7IF`snFC^VWu7)NK-4)jzQ1u!x0ZVga>sPcYoK@udl)+2DgKzG5TQ6>1bb*VKz$+%tATh>PR+ zy_JkBj!!}j{m#$V4eGuL=JhcF9Eth`M{>QUAAywGe7qt8Yt*#7DDJBjw=UWI^Z@*m zIe}*%P8OLD@0|(b%U;^mco^9os>`E#Tn}g&mc+4{1-bC_uuSDA|MxoU!(41T;L;iOP_6K#~356Z;F#*gYX2Z>m~p{@ndOq3BXDk zQf}T0s{Y!?;C%^w10Z~Dm7K{sHFca5sMS!xrI>53Lzn#@eJ4bzHNCeS5eD`s9>f6- zg5x`^99@%>h=WJ0OSir7yotp8II4PI=ftOS&%t?S002^i5Xqfw5Ti&SI}3&z8f-O= z+j+jfaUr-%5R&PDEn|^G@D7LykXzZ8)S1xl6!`2Qk2~{4U)qa(6-$F7dh|QeK zsg4$=_IN`E*YawdHLS(>xn^tQJ!rJu^2A)45#^g0X`Ghl#ycn1l`l0le{LjQyakFonJa3n*c$f#I-Tj*%so?%MKSE6<-l&4-#Sv@lCa>VT8WJmavMNEkk09K3 zo<#i%)$GE%t}RHgylBCG!v9|YiS#<@lV87=v(ybI&gN^rmlXrH0T&qN_dSG6a#_n= z8g*kN0BZG6D9{2>`&Wxflg;lmyMB2p#{^ETCVLK!iADqdV;OOh_uCQ&2wnSw2bU?P z%DRmU_%^^ffB#am^YCC@($8L0xoJqExO4HU=Tg~=&_Plsg0%QhiT1;hc&CK`QOnka z{=lg_yQdjSL_JBj_tw9NKk1CvVJ?@H@3-{n?$}$(dUe!smjUPnDd`(oiJKKmrT19) z>&!r6kwm;()%xj z#0}-LxH3-&>(olF8Bro%n7-hFPB^P>v1;q1`#0p)Tmbv0CshIb;A;Peaz43=#qETm6z-XZe={WGLO)X|&H>_QAG%Z~ zlNq_0QsPv(Se_Zn(Jyj?mP>I|QnwemqdLP|$-JFH=2MmlWMu;phO#DC+=z|>3wTQM z^=$5ORFh)HP)bPy;z3<1eTw0K!z2$Dx=L7{yF$rSWqsm`GG0!KlEpqd(Ve4R92K{n zyY49=Dxu)hs{Xj>OUoAkV^u3GrEz%#q`K~#XC3tU-Y+-Q{p=~xQkdQQ4@z<@PySbw zugL<)@aUNzyTPpeF1{qRi|bP#5HRV5s~-+_jsmGHs!H20hU=>mUgn8`LzXz7a;xE? z7UoXXjb@oChjIDK9oTLuukrXOWN6Q&ik+_2Q2<<98nL5>95^_73Qq-Am;I9S8*i!u zGCc69`>ymcM`>0g!pV{8W#(ToNbkR$iay)B9ix^`1PO>58OpU0z)3*WtG{(KBbwGl zsmcv|pF`XlV`GRl#BB1I?u0}Jo4B3GboH2mAB(GT?mfkyb5cq!G*HNr-xGTH|1n|n ztLKb%m+z5U$-K06C08bJH^Swb>#^sadY-HMQEc|{?~B~$TXH<-_+?!9u%+Ca1GK25 z?x2a;-FGbx)Ax2AVyb$7v!MCzDTPyz6(!Pby*+0%o&#snwsb$6W^I33G`h>;bqR1p z#45YYBrHBCfAc4yZj;97{oc@ly^+b3Imv-HfhUN6{Fl5-~&I8S0R z+vF9`$xk26XT4gb={zrRvD@tI^?$`b_vY7}jw!u*{mj?v|8H2@0cYmsK3u zqEgsDuUhlUYTcN3#uxU@1Qr=5LgyESiu{a`t$OM5s8(!t@&2FQU!M5Bu`fF(Db^F! z&t}yBY?*7?%Tw;Yt8V3mJoP=ZFSjvrcN+72YnI8Y=P%O>51eWqSRcJPa`&tlM~3Lb zJo2f1^L}fj=9)kKq_*u{RYo@pO$6LD-@mVbNle@pMMnB z?p!td?u<*ISy#K$p{6^VzRU}pBVf*(v(zX&bE3I5({l4Y#kU>p96ThW4jXLUcJEAX zTuRX0w8c94+b)FMH#vM~YeMD<@sKv2vsZOro&+u?dAok+taoo1firwlbAYp7#Y^Xe z^zB$0d+&{uMQp7ja3_4Kv|xw+>}&504sUjwxz#_<{AI@a!0G0vC(XCZ+Eo1MrG%r` zjUPvfL9@=A%O3Y_d7||SG+!tiu6EICk7ciJ^Syc#k;>Qi+@2iSea@~Rie>fXg@TqZ z&MTdNR@psA|7zQ^-E(;tUcT!0SSkO}+4BE~ubj&$ILEQ)`@E?sT)*b7{yG2ot7|6D zwe&!9_Aj4su}#yAo#=AOY-QRk%c^(xeXaIt2~-xxcRswhe4cr5-pte@ck$VOnv9J1 z?KuUUvt)g-Y|ENUBGaeL{&-&KE(l7Jo7fv$oF591fd(-JFK6BrucpcBJ zS+v;2x+$*MRC!0tQO|o-PhM%}uUipXkh$y=_i34|<#)5pY|9HSgsXHe*~92E)8dr0 z!|}Jbqk7<(GRjh@!KG>&?xraI(f54*SREsXLhChIl>eZ5d-gC70QUpAzjKR~@&t;ucLK6T<_H{l0 literal 0 HcmV?d00001 diff --git a/content/en/blog/_posts/image05.png b/content/en/blog/_posts/image05.png new file mode 100644 index 0000000000000000000000000000000000000000..6d80447d094a3d99f2df7d87fba025d981e88e08 GIT binary patch literal 18311 zcmeIaXIN8Rw>GLMs32kk1e7MdskDFyhzKYMh?E#YQF={)&_Wdy6r$2W2t`Cf4?=(t z2w($gp%{7z2q8$<(4?Q0=Y8IH?`NO0f1UIFJ3qLtFxRYOjXB2{_qgYZxo@P$&dSSr z=+GhdyLWCsICO{!e(2EQyT@685|VVg#-T%cMt5&(nFWq4Wd-}1&tz>nm!+?7SZ65> z2F*O+%)f=Wg_duDa_$+J65T9*@`Qg_au;CE2}qlhP(Gm z_J@&W!%tBf$66ht<4Rrkqy-K@g^yZ;FM?ZrW1m|z&N*XQ^`*PKt%S&Jk}|`qU}i_o zaFreO!L>u__aHMr4}Rm?er_@zn}q*X0H-L~t77AS-D%WW) zql{?W%GXfLmbo=`h1RIbW{9^5C4sPw10gHh0vYvAH>e?5o2*E-XMSoN>3XT9buR=q zyOj_AbWdD`XKsu14AR@t1(||B3AU7gmz&3sD3LOOaO7P~U*P^We81%-T3-Fb;O}j< zCixhAx2yc}!u_Yc3lA&2xmP&pTqv9Mfbav3hz+R|8P80nYCQH%i92tXAH{wsjbse^ zytzbKRbaUUPxS8{6gB0oD7l}6dU#-aVE)1EqnlM*oZ9+U4vB4aqhL3iTS=KzXWsuh zU~=y!W$FpNcb2yAbQAVN=kh9^a$qdZ-Tr)Y;hW}mmI4CP>3V;9FDp3i0E(ViZHM|e zH5GHvqlh~Ej^h0{zb=`#zrcg%Cax@L1U1{_?^dr9IW#Lir#t-G@5JIMem31R@+VrM zBTkKt`}lBor>^kb&x2-f-EM$<7v@5Kx?3!E1q;*`suoJlIV;ldo0QDeHis-Vg^X@B z>WT!FijA6=gmp zztE-niJb_A&tNVw<*|TXK|M(CO+C##E6jE4Bz;QXTSfa{lX=F!DT43>od%r-eO!B+ z0wp5`5u8Gwp|y}A>B(ayV;(;@C7*6L$|DIj`C-a+SdE#@m_{c$pG;Pp>DZ6f`DkA$9Hr*$lYjxdj8}!^&Lt` zTdUS9Ep~}5cgwYq%}%7G-Ue&(K>r<dJV0_f^tbS%HZ1xNkvcDwczt|jFlC; zJjo+V0E^2%;dYW@s=f^YQxf^=(F%AiSDFlRJkBR?IC7&DX-e+(2=vKgqRQ$QQu<4X z1?nkm0m7ejoJ0EJ9;{1U3J*0_H=ZCjjb|3l&bb#EMYu5uZ!Mk|gy-gx-@1tvafP}i z|G3m&AL&oHSvz5B>Wxl7fhmfpw=Maz`ntABt-tw&;3mW=vvi-d3nFf zGl_Ex%O{cYb%O62+$oA3Wggb9>{5d8nq12F1e<*O(ui2whIY=+H3Ki*-hRyhQDuAB z&MO+k&+l9xe>aSymb>cSyPVmwk=8e-eEYf{wS^sh88Bymq z6LUYjm@IewRi1}Pw~zF5OJ{^A(iG9NveEvqcwN=AZS)=ILRKeE19&r2%&ea5Km9iD zG<*xD-NBL47RzW`*L3rc4cl~!h2cM|v@pzIE%i7=Y-7N3I zraoGl`Bp)oNRX7%t4E5Jy}tNOC6RLVJEEzS_(OE3oqII{BZaPk3NzWa`XA{a@5?1~ zkT8U&?>pMim2YpI;?T{PiSmei zoBYOsY@3vj-bne9^}@uvhE6{TfyN2=k1p3bsg&4u4> z1zO{ogacb{%|gOY#RUG6^d~h&<3TyLTjm;sM~9Jl;QVFtAdh03nJnwU?gge3py%yZ z3AY#~;@{TdzkUIQ|7Ah`daV7wRs*Pia-V(n$p@4=` z(&6no*V;`jh01OJB(xr8l1|{=H^*AAB$r6Ek2VvEMZrB{?Pjj7`RNbC;~R#nAB9Nc-8#>X$g?nL^skwYGgYnUOmaR<8uXJ&qbGdwjS*6)7}Y*b!2m zaan9Ck>m-PSG3fXodmIQ%P8q+w`XyT-Ae?KUZ1>Z_DC5!s&nb4gO6i9QI*i%CJvrd zo9)`Cr2mkUD*L4lc1-|fQNAbRY*gTa@1K(RHZm5!9>eBDe1K4VuNNFVu|ll9QXn40 z4_LWAnRLc_q=Ll3kf*Jjx8=Z%9ix479M>^zd@Nc=Zz(W`WzAQZQ_cr6=RiD;%YgGa z8)w=rkfvD0Ln7eQ%~o4da8%ByOUuB(s;<`Cf}ko3@h-Z5$Il9*U&tmQ3Cobqlrp+5 zR`8dVdSYw;)3_l~IB)aMM2KwPv|*%R?})x8_ExnCrH0={$=n?OTSNO7K}uqMM#_wD z#&a~{9L7zA5INa)MP^kL+}Jis4R*@t?*RR#-IM@#xMn$Cobhb^0PV~T6-VX>Wm*}! zy~rn~oGJrmW`wm-wQJdqm$s!E&U#h*KLN3PzO`fS=VyFrl)CgsuL+^dGP4&YG25;T zET;W=g7oogU{&kxlq>X_pbnea`3IEq$JsooC2H5c-lg!{?!Uv$U0%8JEWL!&x--R- zzVTJwhgoR0STdpHRsH8Q{D^lFsSzCa8*|ge<=Y=gcEgH9(9&90iq~m>tk{IQf(2a} zlWG;gOsI2q`a{Ps2NH!&i`C7 zmOY}U_qk6d)eyY%yYbf0+KL_4BMD@k)wRQ#JL`56_J?j^Y0-v0oSVnT^zAOiH%Es8 zKCTYF>}Dqlr?PrHaxnJGf*(OWdk9_e7~h8#SS@bl1CPC$s32e#o73~?)S_zd+@Kj43g_w!t<;X|ZP;1MNC1qXhlK|2Q_sGy1t3~YECx**Bdfkl1%8@DDK)&b+rF&FKu|Y_i9qV=C@>y zOT)Pn`Geyr8Zku2TB4|ibf@Otv?e;~n`UERsQJ4K+|@D*eJi^g_(peS?0A3Cw|Q@{ zwco3)ou-}V{u88k>p!2rHTgoD8Iq-5kh$}A=2t`2@6*m8{F{8^8*s6~3HSZ&@&kUmJq>WjRvc z+zMcC@N&m)nfBW5j0|2pqb~}Vy3LsxOGgiebx4j-=N`XOY206L@@u55d^?h9(g01) z;7WZl7rb4kD@{o-^-=h~FhrPns~~SOUHg3j{^rIPq-<7JI-^_PR&;RegX)!RjrG`M zqji_bTn`DTQosF`-BO=CjzC9UD!Wu&VdMJ6pqF8~O?hR#VbITov-i4!i_wsF7bwuR*RY)*ip5{doPWU*i0!SJwxcK78522Meeh3W#&($67^rqoc#p z23Xz)$?{gaRIR+euZYOCGoE!71q`@B8c|Zf?I_ItE|=tt&U)EyE$%Sjz&Q7-j8!{r zzctQ=q^=baYH`O#Zd$QR_Ule9BgD#)W zv9>`!^wW}gqRQTAiZrmUP@^f@k~syUvGV@8fP5^lW^2}GvF4Z0;2$Q<7{2=CDKF>7 z&%5XHxTfaAo&9Xy)Yu24+fCu?bi=L#?z4&{Y<`ezP}tq~I|oXUKAJDa$Odv0S65)} zI77-Be5OS`G(!enjOY(8{)FOv6()x~S{~I43zg3MOiJ!q(f8BRE>?oKmt?&0nPbgB z1z22UsLp~pEL^Hnz$b<%I_T%4`JkNF7POTZb3|6){>uG<>)%V(aFpyfZn8D#60-mz z!(*9X%4PC5&JpW?(z|P2#BNRu9*YWSh~Qsfxf$1gusIca3HuY-yI`V#K)*l*WHAAI zdRPL!+)w81U-&}d6av3X6ew6(@O=$kXj8CnPlQfvmxpzsi>MLZDFZ~;=ucTQMqMfR z-QEyeQ?>BF@MLzim3PzVW&sD&%YpcM% zORc$CtH6|zIB=|9`VOV{WkzfxM%erU(X?ZknQhrc45?TiULf^wkKZsLc#!52z2d`G z0w@v5A4!&}kcMK97hxLQudgfJ%?`7{`L!8J5E_+&1%=kI`FE>t*2^MIr|g0oqqR0Jmu*4$UKs>vNCV8+*d33a7?V+PV$Ayv6lCi_-0kj*c@MU>nBeXC)g84J> zes0u@R(u~+%;?$VJa4GuZXIEC%=IXhD|g_FD0e<@vc|nN+~@Ig;wkU*>l~onWlsRD zf|||9ZfTEm3caGG@NM2Y5;{~rdaAZSH-*zt*H8pWLbE&wDuwNr9+V%rMPE0+?3DxB zI$vV+NeWJZ90!yG^`P9xxhoMrV`3;R-JUjDVz$70x(F;fdt3F+G9oC`>C3oHzSaY% zx=w-Cdhq&c#`~UbclOLij9)-0pdjC0^G0um5Mxc;506O)nf@S62HQvG$9 zk$k~Q(U0T!3W?hpCS-e^V(CD$k3o%QY2XFq8gIGpk4PJBDEBP@7=gy$`S>6vp)vKw zXnx(`NxT!wZF;|Zd*o50^at8KrCL6r?&`16s-aC~o_@*N>dx{R<77njY$S82a+P!R zDPSU>f0`!}sGjgK!~7IBJXjPyn8%|squX%Do%U>Wwl8h%;L2c0V($|JZu;Hh{!!&G?B*XOE$GAlXz&-N z^#5G)gt*mQlV%HA?QXd0!5ehWzNzfyj6T72TM z58bD8ad8qc3ee5xBC!c($8g(3fDZHo=WmqI1H>`YFlYnaik(UYG$tPu(@5?4s{B$~rbhoc5BND$WcGjYFr_(*9%Xw)p zt*!@Kt<}=D3^5-Hhc1Rr14s!1iKsNY_Rc`*oSwfxXfyRB|4+piUHhjk1`4*!pIr~=h^MO2pjMBqLNHs^UoO>c-sTtIf z?zy^9dogtLZCe}Z8XB~yL$Q;B8>Oe(sX zR5?$njE0S1E}vhD|bW zeE~hrQ&Or+@kqqC%#pfog)n(ttGgvW{%vM$cI8djUgfQvL|sZq`-ABt4wB9Nu#5(y z0Gwxr+83Fy5LG&tJyLCh2AMs1W{T@U3r$46#)X;g^ptpM2=N(sYeI+kecKHdSRw!Y@ce%0%((62K~A*r!#anCEy*y8_t!}5@=!CAtBclB7cNehTc54}n zCN|%v(A3x7xMr^k5-Nr4m8x5zZ|F7qQJ1<>1&@AII9G#sg=^4`@80?Zrzk=85b^jI z?W5b(qvs$Qx594h=**cJ^>jm3gPy5Yt%%UME+cm)*WmXoER+eAqV{=G+N6gq9Z;lB zJ_4J0+Ug}&XtcK#?@H5^s$sy3K|y#;v{D~*9+$BpNc@`Z@4UHZEPfe&4T#+8WW#8Z zK8~g>Vuo6j&m+%^cT;~H6>QFiCE~AU@2nMw8&cj1Q)TVwGzVAeRr<6w-?@)W^EEx= z_Y|Q|i8{6vUuJxlzE?t|BaifjiP5K^8e8>*}l(gD8C7unas~}uDXZVp*ca{Oxqx0b%aDa0aaV}N(=;Q-m zgM_O&;iK70P9uHktpTa8wH@celss*yP3z#(Q@<5c?SDxFIN z*f`!s9A}@Pda-|$FQz3<NYBm(ZRUd5hPn|;&-8lQUP+x)wA!mqfc7`GJDgydQ|RaT#z-LcvgEa^Va*RWfwtT0~u+U ze8~1}MED(Hcvk0wyIMh;`vwlQmSvDib-4_oy8LC)wOZsEH;rZfs5WHpP2H^|ATWvf zf~H?9((MOZBT|xv3uWK?=YtjUTA{u(vd)u_R_6q|@~v<7J*^s#+b{cMWMi@%l`V1? zvHHLi)Se(4x-vSkHxTu*$XL?e5`|fj1TEXUeT(xJJ1;lPCG|Vl7b?9jy`KHr1LR=d zq8q16nX0Ugc;7a9dQFM>OV*h?Tn*vdv*C58lc~D7IR~F!O*Hkq92-_s*VX#1QO=w2 znc8V{X`=r}x+0V*m!sruxrz?udV2n+xdz8L-8BlEaG!*TU%N>#UAXUp@2VSsbZdr~ zvOlY0j-VHk6)vTK@V_D6IyN?^7%GU+I7V*3JKcJxD51YU@;RR^lSet=-KV|nE^X+Q zwG(YnpO)lvF&R4z)Von;4R;#avl7Uw(hDYN7cco#wc~)sRnjY~8q=58e4uO>`yY-$ zo`xNPH3}kZkO;l2Foo~;GWSbZQs!BksBeoT{noPKFa%rH6;1i5E$w*x@m6S^yROps zzzZvaiD^%`Qf1n+qPh2ppqWpe5{aNtTOce->+sQ=Az@mkLI#B32`Qji#8r~gyNe=M zq<_(jC5|QDAoUQOeTj4o1caXrS#r0nkFS7-EsS*7^u3Qr41?2M2k$s~{JBq+m8h)5 zecyI+lNwTs^%^`OlB4WrJY1U>XGW)WwM!laVDS$wB6;bcJ*c5UoGDp96;zhDP)LmO zemYU(M9CyGx1!hSsVPa6jNUtxVDt3)0nx3hBA?_Nc}poEC6=r(zZt`cb3vsn+S^&M zJpHi7u2!^?!qD|o+ojr+ccCMSBqiZ9K56Fz6;eY+%#P$!@17_px>|H)`K5j!@FXot z+ILB|l*`kwm(Asre$M}_dr%^;>~#n@7MR%_=d2ydOkO&*5!qy_H(G*6%oMm28_eh! zo@1bs6sPx2`C@rJk`H;;e{R;s4GymFybJvFxh;!P|5ow}4<_BskFpT1#jm^9hW|izr@pU8AVR(_K?aomFP5m9xxYBX`Y?mJD zlX~BeS*PQBM9VL&x1++cyonQ2Ww95am6o zM1sO0-VavTWwp!jAPqj4Ft$5+qyjLq&t}RzT8|@^@pBVAS_+W53tBv;D_)|V^)$nC ztQnsyLZ#hdEh47vnWITS{?4{3{@P|ha1J=#cPA^LMa`0j4@G1qbVE;X-cAa1_4cDD zf5;xJ*L)RbWJ?YoPl&<1O+uNzYTL`+AGi21zqz2QhC607v>99fVZ5#86~=o+hAMk@ zhiHE6fkOLJ5hc09_RsOlhQLuX}gzR;5(b3{;99yacBBfTtdR2H1qIWInYU z(kUlgQa?pcS3dfY=QNxMtp6z0({kFkGTDygu2-XeXI64n$M^=2+f^3Z#y0@i} zc%W5Bfexy>n-=eJoQp)6T<}nlo0&o$Cz4OMYYE|3Iej)ar)1 zrOL9Ec^py4hSIJt-8p@K#nbLccx)@8os)k2?Wd%D+`iK}r2tC0M6GYTbG!Dq*F!1X!21%+~QT(@Ka*Gw|~8V z;&5o7IH6L~{!4UJYRStqJQ4xDmF4eveFW$3Z|7TNB1Y#@N1``>Mv0i1Y9@#kzk`Y8Bn+=SlQ8I#-J7Y@Yv0F@!-}dwjxa4(?+ky(_QNk6Xu7Jt7-;T zwUasl(Z_w%-{PQQHbxQ#9P#+I2as#+7gc`qGQ3g352sF6B%cORs*fXW7{~P{%0NKq zD1TKz8Vtwz6)_i^TUzRY*r0Of_G@i@D1O+6-p~GsQw$D!q;!t+bwl`{&t<||lq zedkK9WMr7wYlj{vy<3`}15kHaH8ssl8PBn-*6()!=e8S?kuzYb#_Pd(O7iOSjjSr& zvE-73YigbuS?Vfl)0PkKe;&B;*s)Y(_vNL~>6bjFYS%)LWYmWrM+&@yaIP5$0ij<# zD()Gs8ETi+eQGyFoi~47HBO5iAB}rczk(FBpkpvR1I+@jUU7(2Dn8v6$wiO4i>X zYWxlfgw)9<UubHK+xPwQmtIr>L->-5iC@me638Fb4{iI-B3Qb_d z%LS(S3zxjf$Ku&n>gQMb3c`VRxup3!p{R(T50)Bz3WQ3P715?>b-dkgTr%wcGwEvz z@_*+ys3L znfr#Vkh*VXaYe!g+3Xqy(VVKmI({<&=ef8uhB-9s@@pl*m!-b>ssgDG^lAnj5QaPh z;LwkKoV^cf;xsvWBunAPuh}R>3KXGVT2weGgCJ6o6~~Y9?a?X*u-S&jizx;NZUgc z!oRiV<;=;89+drG_>ER{?Rw3LF7q7aOA@m8%4HQq;Td ztrnR~nSN)|0eE_bUmDoErbcL(=i0VE(LNLJ$Lyx{_C^4Azwr-hE@1Vhw3F%;2T2pQ zR~(9%()4@Qc?tkZf-};?9rbjYn^ZQ{%%@PP)byy;G)sk5vIVxTPUi)Q?oS(R??2?; z#V^wBZ-l;1Ufa1FPQFo|{?bp;J|@gubE}|huiCTo&48t{`k%rp1iCqevOkIMB3MBO zw2+W`DIwt`=Qs2pcop!SRIpjb{Cvhs=bpDW$PK|9t63{ygI2*yAd(?yZ%9=m<+85o zHv=+JxiRN@eu0wesIBH1DDqslXP{D_^^dj(JB7u(DW`E(t6yN_rcQSak)xQs0amCF z*4NT|bpKpM3aG-ZA(WsW#!&^QQMX+kN*j1eKB(F6*r?MMul<49O+LyZ#*D+W{V~j* ze7!e!T{4wBIz1tFyT#Vf8NFuOLqQxSq?4AB*UOe%g=!K=yFD0id==;YPF)xQ1#bab$QV%T6QiB3}n&bXFz z3=g7|;Hvsn9BhA%ka2zdz-m|qNWOh8R>=HKQ65*Z0FSfV89` z3|4_)mPn5@nw`&Hqe)58fo&f!Hm7I@sdcCY(y$1PJK!ebplWr(^7hL_A|Z2ox0^P{U6XMQpVOWE znlC+4nkFT*Ujl04x`TZu0_UD}VB5i9P$v4 zrL#Oz`v;BgAGAL2|3T{mNErYs_`gv-{%;h)V@Li6|Kq>&Hm0BaAEO9{RW6hT7<$in zA^vpE{@z!M%f7ptHADMVf6%q_`d_R>sBd#wa5u%NKa!b-v1zcE_BxBFjMt%Oxo)@x zt#6%Sdj6k!OXFE;qysfX3z6VtD8t;viQn{J^xE$N4K%#?_%|Ps%hMYXgZ_wYCNTrB zBOsurf$@_({5u@v2E8z3Sm>F&Fe*vj8-@N@EeZobMlQ21{pgb&FS0GZT7K_L25}w4%XdiD=!-*l{RT zksV0Zc%zCx`k9T%tD^uQHYfwXFP~o^rKXkMw?~bmg(*(IVQ$w4^Pl*7#fBC zU1wO%D=Y>o=5z*`SCC&);8^*w*@$x8l4>Hm@tR8&koT}0tcEpnVk*@Ya+~tgb#Bo$ zUCOH>5#Pmy?2B!{>AVJnU4uefZU%SOv$+#r133yHlyfykwvt6fRaS zXA8qNZu7eD8|7wPh=&54j0sP!@(~B4(0ylWSysA~Ovz6lj9gl^``KzApN`a<&%{(w z<6*y!C@iM-M)Xbe+~%qaJ=lqef!>Fllm?rm;NSY_7_Wkyq1l#pjo$tJ5xZH%F*y#i z>7!!zuEohfI13e7gy9TgClAQ6ZmaF1l|t@5KW@1hO!}d{l5VWAo5Wz>_-8QO=j`#I zjDUdm-s6Vd6bz8Tw+_m(o|#;pj_JLNUn{GJ)OW4T^@G-$R+$9$dqe2GIh_>sZ=^45 zsc#~lvSvoF4(uGn5JRJQS3(h7*99*6CGmDh!+Ap=4AvhGW5 zQ*oIxVetba!IysrY@G0Fk!_U;qnl$l7LlW!&|hYc2(gJo>(>68Gj7EYTv(cFW^4bq zm}$&(+H$u>P=>9lWln3aA+Xx^zE67vo#%{88Du3x6W1t6O_*NQ%u*+J__a-qKQC5= zDt&2``XgTOs>_b6%c?{eFhW6+dVuC5pJUwUG=G6t*+kcE zulr#!Nc!(tVJP)6ckq23e$EKBfQ?OBc62%|)dXKKlWcsRy0o0W+WBTwJbg24OW?3_ z@~>vuaVBR}ZB#-t8-X_~+e$}^(lzU5_lWSWfVrRi`HTv9N=mQq&0SMxm2;4Uc#v$( zqNd>B;;5etU5DSI;+Qqn(vA`c<}6 z25VE%mM-f8n4XsamNegpLFR^L_mZciz3fana2S_6gcSnanxZ%@=56pTg0-aesochg z*cTf6QdEMa+~CUE8e}M$O{ArRi^D)fa{1GCl&7nN3gq5esB6a^hN&?ZfEW zEg7#G6!Z;KK{`{Dk7EguIZHaoa!6e^B!b+0GHj+DjI3YHPIqcnxYAtHO156CIgd;} z3j48}kNF+JT#<_3KZ3|wKlcJ1&cw~>%_fav(6Pv9?yr^<-)M_l+?x#{g8XFYq!L`OwQpyR6e|a-_0g` z7F>~xFF4Z4sZOfN=E8oQ;ZEL4l%AlLZ4Y=mZEjrVF`c1txgEZt zHBZ=Uc=%~Okrd%c#|$sF$M(KJ8#8hHd9z(c)kzeV5GoBRr*i)4WR%fK0V=XC17J{j zuG0oP_g*0su&wo$izbqEiQ`rbZ>o5`yhWc9wz0;GD|FBu5YfBu3~ifn)8R(Uposmi>&c73>koCgkj^M|Hyv30N6*o!iF>XtK;ZJK zDC^C}^w?z~*bZ1zfGyY6U~)zuwer`ssSys@-Z_ zK_LXWy5O@=$c5BHsTb?Oa35Xw+JF5p2j;L3dCEix*~4Uqc9wJSzs&y#gb@ms2CjU+tdO?&=!Y)ZIPuliA^qvoeyk<_MwOk&HU@ac*x{h?nQv5)gPv{q!oRi6^s%BjvCQGfPwiQAVneDPP*&vt=c1>v-@abHtLk7ozP20-H^t=|ZW37DZfT_Gj=bE*Pb5^J@7>fri zwl}~eNdyG}XOTVim0dw=0!WR@9-$391IpNuc|(#uj09EmMwWb)vOV_P1rM5zE&#*^y+yh1dW~KPA5%9-5_?Xg=Q_;j;@=w=R zzGkBYAO({KIx2?)7LZraOO6M{W(n&tGEc{?XfOEay2g10Lh$oyI_5sn z0MB%CiXq_t5=^QPAcW@sA-|_o*(7E;x&K-*zpyyo)KBQ|)|X2*<&X6lZxyBEA2kj)EC>RGoa(k3&)}@Q+L;?JEO=cKlbbOb`cl9VU(M{mnSoM)@cae#qh8I_3`JH;)5-!*lC(Z(t!KOw8(@p5$!ci`Q= zsMgp~8itJG(VRJzl=NrvjXIE4+uA4xTy;{>k$!CpBa8O!-<4a{>@-K!M0)HNO$m(tmReo4^QKVp z3WK%KG4DLkRLhC%xQ}GmW~Y$`g?nuu>~LYT8Pc;7PnqS+jq5$I128?xJ7Ivsk)tqk zS@#Wq<7Ltki<*~ZeMmJaV0MJA?|hLmmfq7*ScF5yhb^lQnbGhf@S*Qm>HCYhUpIgKf&7}Py2{akmU}-?_1!4 z6FvdNQKqM<2sv`>jps3&uAg?BT*w7IxGK(*GW{L$x-qyXJ%d7g%t22*Odr@DI3^~o zR${Qe+7i=%3D|_u8ZN2Xr4vAdrQRC$$<um4*Bl)+IsAqAC31~ zwyk9k{IHstg{A=fY6i^#UqczYC+QDQa9uQ##YmWlFY1j7tB3tpVo;TCx z#h0gO1s`2Eugtbw;O-Me6fNV4hm^cgAPhC= zU^$|R@5ZG0)3B^#0C773f1w?nBz+=?dtTi1E6F&59Q3(8;c^20P5bCPC%R4smOetR zi%cqk7RQ6o)H3hwBVD(4H?Z|Z5;89wb4%`umDjswDwU0Y%g1Hz?_MI8+aB~3yidR@ zQr%iQ<@${=G3XqoLB)V*$nIBME3}ikG=z2rP{WAE7wC?2-3~^^3sOc{e%sf?VL|w@ zjcl(0_9}e(T3fsyh_@*Dq_loXEul2r@l{cM=vfA_K<(GaXjeb{1yqHpfQBsz@;l5$ z=Mq3lOP6`oRR3DQZBC8`-^+oOiZ0#9R^l?*KE&hWXUaYlwnA>^%uUf`H?+2fm#)i& znSl0B;Q&94Dl0~(S(%KrZMXS)ua^A&$&>)#)MZ8O|>-m1$3Lwc;+W7!sS5iFXqNm za+B)8){9z*kXK5c?i=m$112Qf!l7jF%d6ignlEda?=LRpR?Ic_I8DTZ1Q1H^reX=V z#vf^owI$ufr5o&wGSMJ%s&M>m2 zx{$E=Q99<=#$qI+r1mY(5GwHbMw@giM=dFR9Cx3tp+Ra;zdMDR=oU??u-R zi+W9q8_Cz>1+*x_Qt(%sO4iE28h$~neo=4W0)HzojF9Jy0$(P&^D@kTT~Qn?WZj$9 zOHWNwJMN9UKUuRh?1VAQiXrNlQG91lekEaLuH$P;N^df{`-}RZJ0`Q>YJ`>26@+VD z+4pb{KK)hJDne~@C!B4jPm)g4#&+$3pVu4%9R3bFo5%cgE)!%&8~@8%$OzdNU_-FQ zldddzE5FqlTRdO;Z|=iZe2HN>rjv7uD~!v1UYBv4X;Xy7042)2>gRXvG{_*>k~DN1 z%b-Ir*bf7u^>UYC8^^~M39FqW=FkNEi#90v2x)1AbkUnl1BJ@=yk?Mw1!gSr$bZrdRVA$~zEKfhSEZ{VL5?2`f z&<2)vye5@M#u75E{^mYZ3cWx#GvQZ$X^^iXSs0C_C8f2-WJvFp{jW8K z3IEj{a8aTwY+r85$<-J@=)3`~A1e!HJp)29FAvS-9NQO)Ap%QJWco__E;HX=JD&j% zlkDiJ3SJ+!);MMv%g#tD>CFR33V4N^V=`Q|U!R-*O_NDgP~r2&si3-)=V%aLEYF6Q3bYS&GPUU5@_kmjtM7E7Yo)fpB$xn7XyP@buUj6{@Tm zlB~lP%+Uxa+z^>%79i!k;A0Zc5D025wP^$xFHeZgkg=eRMJF!xQ9IZ?`5b_G-Ach@ zg3*TMeDL=LkT-cS%|BX`250Offz!2$d3h|n3GP$5%HR{~QG^BI>UEp)JK45;2Ht8t zb%RB1q;k&}`5((3_SosiMhn4HJ4Qc^e>2Pxke_b3DbWJF3LV=?3#|2=l{IIJq9T33 zo00O`UaM;h3Ho_QrkNxPV+wGar92DVR0g)}O^Qq^NN-HVJoaNVgfb-sa})bAT?cp? zA33?W&_GU82!6(Lm5V#V-C%4=%u6el4;aDG%$V)|q@57ln+u=a&}bPzu6JH!hE2a_ z|0}tuJvnk2=6$C2Z8JL{aCvM2vxt{P>nIT9SVIHIWogL0Ep9sqmAkAy=5dAQ4o(kn zK7%_SiFxiD?n|jJ6(T@6G!A0v&vT>>r4r z``zbh;HWEbX6Aei#aE3qoc42jpnIiP7dUs+cKp-%8|u}fiEGOfAj(}_iLNGx9NJ6<72m9GRQth}R!)8l44~yLcFb2GxF&8LH zu8c=X*~}YY5f01cP$~>5mAEg%;Sy2|)DM;MF-j8F-rqVOn59fQApr!qU&~})H+r|c zEXumjNSxETI1(T~joQ=K;ZFm4!;^xQuh&0+j;u3dTmc(XFH`+@Ca{Lh3fwF!#l(#P zl5cK5|GG!RPLFH{f-!G{=522OH!bNL&#%CZ%PAfJfAFC$cW^N3#(ZOCaq>{aiC>g{CI+Dcv8B2W2Vpb zFPM_Q+Ag5kbKPaBQ7JRMeSV8#HkNGBJ9_Lh`UkwSx zg%`;)R>NZOF86j04TgXXJs6p`KXZz~)TQd2CV2aE3rDkxfa=z~2a9L%%P~!ejmtPg zBO@#Xxc9>OohIK1tAx~Vtv_ssb|iJD50hkb1*Sh3=VG8^9%q0tmO`+YH%d_3xO`&u zjSBf>Ac6&=#oJvUKhc&r!ky!YF;I8$3{Uii^X-Zqb7~FuPA-X$WDd4<+}_wrK#Z1r z;OenmcB{q093SC`S&R$wz(u*TH!~*y`Uljwzc-oF&fa~2)Yk%OS;?q| zP{wpkLl*)O2QLX-MP;?DnX*%v++y=rKxHLk2uUy zcQme6YE62a!~34dG@Pn&+v>mocN}qn{g^6hyFU^q1YWBOTvr@VzrER$^}VNWW=~H$ z0nax2;$rZ`@G&FQBR}zIiE(}DQelp|Ax}<_EZu_`kh+?C9XWEOE4pW{m|WP34qVtf zP^_L7R|6l_SbKyjf13BoxL3;Bq5-VZhfVFiwji;-=SOU(OxLzv{NeH&NS8#QC{%W2N>mN=ku*CY&@lx3Mln zN7((~V*3Qr1lw{ftwf@2REH4s30+cra~_q=m6eUTH^ZH(+DGv&fb7vJauW$(^^pe0 z7X10;8@6{_L$)zZc_{$_%ZlUY@}6458{A0~!}zp=1(?yI`lGt_Mc{uPF_UD_Lgmor zH(JscJ+;hge)S+749j}J#@smm3uL!>Ig}^8TB4l+n>eW@q~U$f*LyMmRK2lyU~9{{ zO$|UII?VnJ8p+1n;j3Hs_x?`(TpN-$2xN^F@;@^bIaG0OT3I zpEn+~5fjSp)IJgOFOUl=(H!P9TT&rGm*!-^SimPoey_NCp8-%d`hZh~UMMOOX#1}R z=>U)}0t3*pr9``l&CeqbW6}5_TWfp*0Er!n$G_RE8a%5m`x<~DwJGwxvR!W-cddaQon}-tjB<&!Il&0w35pbXUjdHulz|$o~tLmn*9P literal 0 HcmV?d00001 diff --git a/content/en/blog/_posts/image06.png b/content/en/blog/_posts/image06.png new file mode 100644 index 0000000000000000000000000000000000000000..d40b2eb0b6838ef8701a4dcfe2e14fccb4ad98ec GIT binary patch literal 19689 zcmeFY_g7O*+xN|>VgV^4MXDgZs`QRXmtG?zfQo?B2%&|hSWtQm2%#f25~PL_Kt(B` z_Z}1ydeKlq=iQuFx$o;*>v{ixXFWe;tz>6r_Uzd+a~$(MK1YO!kq!+N8x;iw1&yAr zrWpmrIVc6iUwW4>0#|xOajFy)2A}mb)hz-h*E0|Otwx&4$v4*JvmUoMR~I=?Iov+1 zF7lh2;qq|2uB+RDxS;!cRJk|@WnP}mk)7VY!;l3CtanGQRSKpk zslyU{;Z8EET1DwRG;wdX7<;#cQ1{KG=(+noduO+$o!5j`tmswWN>UWYP>iKh^$^f)xKhw*l_`zuWnb z{``#W25;x=k9Bj{`*AK`K002aE~_S4sj?HqYdL}zXRkZCx~^yDHpdOTbujE&unjiq zV6Snd&p6$?y|BTL>Q+1bd2ws@QniBK$=22!J6`cBwGnq?<4n5WX`X*hU z^yzQJsgs@3;p)BFt|(}R@2i|Kyw?(6HXVssUr{0?(7Mnfp!xTY+v&@&g-g4tv@OS? zLpy&IwAz~Km~J%1?M&_dvF3rgn4(U0H&0aiZTQub?mU>b!C(ml12z8V`}~f?y;k|awQB( zC$IehiGfL8#p>%o$Vr#wY0VhLUnFK0z6WEW^WfOzi58dPd%PF5<^>fe2G(oGi;GvG zvq#ypUV(eKZ=VhtgM7S`nS6bGZW0GKePXh)CHGvu|7?E8HD9HUe-h;y<%-Zo%<$sb zBC2X0>{r%TSes-`*WjEq`iicu_&HW$YzhKp>kCK8vc#yqOK@t&h(xL|GPM@WXPWn- zD?vnHrD^=0nBB1^=A|&BtO?bt#--v%%Q8oH_A2~uJDX#(-kp1m{lU32X!&#+=FR7Y zix2vKuim_OZBvBL@9CqF>&VQ-&qc8o$?li*;HDL3wG5reNQAge;3p~$7%UzmZ>(<; z^1C<2s;F(I)}zeK$(`BV@Xx4-W1lU`=OWHFZdwRAEI<&KECQBj+lLqRzY4noX+^Gz z+}mhz8QjXGPTk*KV-o5?C0t#Ro$2c}jwdWbsSsq9C55-)WpA@|e$8#EsRR?(3#ADgGZ1Ap?4!?B`j_PrqLjH=--9;KWwNKb9?JGx~ zW6R7jS@oxd*Y55-52Svhz2#Hd9^$H-@3m495EV`p7ibu&BGzO36LudzS9ec+eQdKj z%4lAQeZ$m~XtL#w=7WmR26~o9@AvfS@j=~2pXUk^H~i)xm3p7_(}_2V)>b5YnA7h@gR2 zlBoUSL_Hd(rJ6m11k4xR>gC+eD%akspISML2%9&G^m?9KNfC|7o5*#GQ5-jwq14dm zvAZ?|TUIy<|0*MygJ(oW-hz7NVR|&zbt{?0b#s!bV?Ndk-dp{%F_a_gygO@ilrxt% zq#5{0`y4}N!%lNE2^C!V=r4G_)&7`>%4oS2TxZPpg?RjD1&i=brZbE1FXIsY?{C0G zo_`yRfBgM_EC~Gl9|q%p7yR#b{-YoT>HppE-y;qT#hY7DXSJg$xYJaq`E0+th)AiS zkzX#WTJyJk&M#)FxwxlKqb27bi1uVCA-jkAHl>`^4x~s6t^0AOPh>Y0-B%W8oCU1# zPL;3@#_cTBpX|j_@f^qxQ+(h;X*xvxesam&oVOHeSE9=E*lO#b?{+~Pwq{e=T_72h zhMj&gG+g(6Z5B425u861{2PDsF9vV)yhc^fA*ygcizpx^H8$Lx?ndi>L&x_CBX@S2TlH!Uaje0Gcn~(5& z@Y|}WaMDdu^6`V{aF8v>s5Zf$aj&>|gYAS0+N9pA_L1cxrKoAj4g{TkKkMCb{e$$v!C$?Pw zAOgF*of4k0)3#5+!?ZRX*#Fco(cekJ6wOZaygxa9I$< zn%}|nT>_++imBh)gc&5!U43==jW$)HZ>eA@sql;FUi1@w?1 z_W|`0H#J#=Nh=wt2{xf$D&guG(Q}43!bui_d%<{mM$x1XsA3#@{i`pqokt+_M$jD_ zQlVXRO1Ens*G+~C5errV4ot3$M31oqT60q`(QK&;*(mJX$4~cT^04cw-jfyvd?0$| z`h9-APRl_;*#`Qp)4ciA{&Vi+5$|;8v{;g?({#_mQm#~RFTD}kX{@LK%M>Rr2m*fC zDSH+Q@PPCZ_Pao@UqR%`>kzp@6J8WjS2SU5BEvLyvq*ko!Cz3WBJxSa-hB-;!4`p6|H|24;vXq zpga!0rD9f=eHZ$>1out2rK=r|G7bu>6Xn*odmqSORs#9@OBjg4k!FTy?sN4GZjbj! zg;xTCx#5N~B`DrPRxTlMN?PFs5UOoHKB(alWKQeM-?2|iZKP>ck5}NL@et2>Fp~?oz{#a+r|HUCW zq&Z!yJ%V~cX|}l+-gkBzSsECNV*Q{obZT_=5-9^WcW)9CV%Wr@KiV;1)Rv6IbD@q9 z(P?*nlA{50pgtl39X&8dT{K(d^TZ`^wba22T;NZWN>G{3&A;E?-gQATdzj{*W`~XH z0p2}~EuJl>`C~aBl*%xVtI;ZToVXlHDx5-Fh`Db*Xv*ERKW$ZwX|6%L`JX#(y?JyQ zI4#`bh2mZ|chp3^fRYMtqVF&bqdWN6&b;h=8ji5hT}@#qih zH`%rX*%IH!1KuZ3>DLm|(Dih;Ozl-JE~~it6;uo1C}ccNN4_a=N=Qab?AnmWL1UmO zJ}as5#&XD7$S>a_=e%!T1!Q}B%oq6W^PFkG5ej3`fmG2dsf8M62WmYi3LO4pBAZ-R ziYu8RTY7F&mUq9;Fr`$P#Mo)X4TNlSLr;oN&&TVX4)Xlt#Pkm=AZtruvh*Nz z(v~(oTnUySGzcn)D8s9;T(1T^sfx)@7CTrk8XlDrz41ejOFj%Lv7IJGvpt zU<`85GEyuFen};fCm)!7vc>m`D@p~Qu%p0uiyQ6<6~zI?v+*7g0cVq7?GORzhTl3` zr_@r)bwz?*zJL3#5n9JGwVDUyol(t}`f*uMCxhI5fRmrS*L-v*^r&GEJ6i476zq44D95t7IUCW&kcQ$JFQy zuLCa8WA>or5H3aB*n_zABDHU<31O5#_-}D%)jnAsl&Di4HbLFuH|9CRYHPZCi*_5! zFg8U06^s3$%a8I#7D}xHKlLCs&dLi@zu~;rA79-(Ud9a%k`fU)K(dv5`^jljOU>*K zZJR-kZHCfV^_}^)(;P9scVsKrfW?+40cGQ_t#s7V^_WyDGJlaoSUzDZgR$`VAC4}C zz3Ep?a>JU})@#r24i{JEbr-*{Tf~;| z7PPO-^&MbBUEfTW(~pn&WiQNkI>yD9yeKCnHM}^Q&5YhO>jjh z3F5*UdzZb~XfQPoGCyj{XcejNU>jO43j4h12^*S~-i%cMHWHla*WX!jActWHMPr^0 zjeSy)<(=Un)7O4|?E}Yrum(d)o$+sZ^e&o)aZI720mCnM0ztz#b(YZNr}ig9bUsA*>|a%e`Cb0+b`^f8?&Isf|nE&c4>`Hv!i z9`xUp=>C>}&MN&~0ch#Jn)vq>3b;OVqd$ji7gs>XFg~Un8Up?7Z+}eQ#&rI*lvl}kIkzABt4p^T(ya zEy-_Tn7=AufGX*(_nVTkY?n!Y=p7wJ+H`WLKR)<(5w%8&REw%3bGf@LYkv44S8DHU zmdrb&bt!iLPjXT#g=wEM#Hs@RcrOOrf@+xKdovoAs>7nYuT~P~2#xIq^LZBq^>_UH zmSyxuqzXTLS~GPT!RZ(Rj&6b+q3n`ioNsy?C3R->eht6mXk4^Pwd^3P20k#?as8s; zg|a@h6wB#mqejD@Mwf~0;_I(YI9O)N*Y~ZGlCm9A#I4_AY3{<^;A<{P30f)Gv}X?= zLL=LlK8Od&k@vkslCxL}A{d#$(4t@}V&k#cx-mpOG>Fj0)3_OkD zT4sD7rut5sTKa*Bxs=o(?}ZMq>%{5Y-6R>;Wb2`ZNcVzU4nxqpGUm=&5)K{6cd^%5 z4BFl&IFS=LFMQEzKZGjgdvq#F2;$*0PaU1pGQo7Wpe`a%qZI8}ZhbE4gW?1V-|)mg z!HOeEQi^hwfHGMSJL-!xG}SX5oMd3tkFQwwux0IvvS^E!V>x)l=c&kIL=m{F%IDds zDiMg!m>x*DCQlIWv|eG5tMq}J4lMar>hNIJgGL!+g#C=Nd7v5^cs@@X>Gt=2Cagid zj7$hk0idI9y)U~17e&EWUM@;I8>#!@V!NErrMm4l|5hZW2#^+@maIzg>!-%W7vvTD zu$1jGn}@>qNwOCR9%m-Vvg1AYGOK90CO(f38ncDWjM%%7BWRPGv@-9#k&o&5{FpVD zPLCI=hclaRdfMq+gVZiJw{=IRNZfI|8A=7$cYrJHYZt-7FMCl7JLoq^);g(>m?_~( z-ao5_*}$3<%1gr3$ea9rr`+f6{-k&^Y+Tms&ALr33jAA$bsFS7_Nix&eSu7$?_Mwhsue-N0XZ|5or zk0;U(Gnq!!o3fbSTNu_e!SyxZV82t>AuK`Fo9S(|r6n))F>Wfw+0MK60uM!2!sjMr z<~rxA;2yFny#49bzWewmB2e%o*~ig^cK^>BOM$t9dW+{i;mX+=q65sf0$JpI^y50|f8`S~sCiHX; ze)l4@E6EAGyfPfoKVl$l1IT*z`07_+Xa0vD=_{g%F|^_i8a8;g#o1NJd^A0z`I~h2 zyrhFu*+k2tJc*eX?gr`COi^C)e%^2beOTTyH{j^B&T9vAaxEssumCwELkh zs_|Vlb~*9Zg`eI&dI@*zUy#F83LkIWCx~m4QV>a6e##d3z$&Ro&K2UCKr-+k+|a}+n3Y411|cvB{fOmSD9 zo_w(Sru*J?)!9$3`dH9TnudC{ao}01c<72=9Ta9i4G!N7jTX>9i0o^2&Kz?K@v}WO z28Aon_INLi^O)OX03j|6OX=mJP~%$@|#ta%&9vo2K(b79@iy+?2W@;`B)|d#(h|c@@T=Qe+(J1 zn97jivz_o7`V37lEw&2ob?}rR#bWfOzvez`;auH^Q^6uP^Kj>R%RLbZNYK zjP5l8wm5&o#E%nLixC5F@7$^8lODH5sY1nqXcvie&%+h9(3-=$fbEh$PZi->u##aX z=o!V-ASDZzB&A4z*>%&gl14KkV`}C{M=XB%E>$Gi z*YZ81fb;gsaC2zfM=gH(gG#EvAHpQrFJdu9>-<4{rg+M0B8-WO#NylVYa#{>0W}CY za%#D~jxM~0H~64QEh*pQSJd}NY=#&?yp6OFOjj5P?U7(LFX}kPSc;2gT$5Gme{|YR zUP5mu^1xxv2G+^N6I0W#fj%clidC$ZW3?P}zIHy`6(WcWJ$RsRcJO%e7g6&%hvmby z;;)~t$@z9=*wfjo+yF-pYYZ4O3AHeVZse2*?U2)Le#rF0`YWPQ>tm_k9 zx3av5=H8C-ai$tu+BJ91OCe)C&_Ajk>2tETu95tV+}oy$3`b18=^g|S4fDPIhONIj zNeN7tw`G_|XFI!h;d_jVbO(!jlN7`JJ}UXKvMZc}Q@ek?ujeXgjZ!at94Pp(^m2eP zvUK3V?h(O|msa*F{>jHD1-J71g&(f$EWy|2cgQEZPI;A&esv#0r543yshQ0h)ytd5 zo7Nxly5l|^R+lK=V`KU}N9>8Je7rbQXN;s$>5a_j-&{EoYTeM%@M32&x%=r;sV06- zm9*PVHV^gk_kA^eo`#LXWbuazH+L?qk8=ly%xa~z0V+>Q=?1DI?-Iu%Gh8#WFltfE zw-6PbN%6pDc8yTbESDetNxQ@@>bqgf6qCCr+#IS&1LiT&7!t;6HJbO_CqQN@8rTZ1uv2 z-d9J4H=E4B2aK;|+vbYHtKMpGGPn4Z&*ij_A5IKagk*-&zm0mos#Fl@Dnnv+fQzz9 zeT5v^uJ~*B>!vXC3OST=T7AR9@X|Rs*W7EMjy+BWaMJ~MLm*BE@^@}m_5W6ud-3_C zv<)jV5=&X%2c{p>ObT%Eu4yEr$96W1^ADGy2QEPZY_I&}jF<$1kfFxI&v%Xjd&1Vj zuJ6{&HMC-bkS^{I-(Y_{$;ROBO-7TrO<{dKrtIYA+Dab1t%V<8v1wk4=CSePV9lu~ zN~R%`zD+0-t;cjC$7-MZz*u5gsduS@*FwOfpp+87I?RztBRQ+rqH%C`n)S~@YbGao zi=VA&#kl!aY6Uz7nC;Tt&^2=Lu*p4MR#SNiQ7e_FHe)rs(7W-N@V0%xS?YDm(_&W7 zGw*fdf?tJ4RbXAJNW1In1Q8r7xQZ4|9l2|$l=18F{r>B3d8pb8s;j3n6nw9oy@47G zlviIh|ILPi=HuLvFdbUp`~#SvAp3xs;hDRs5G@6Va_n0y<&S!d+WX$x8`ti)jsaaz znArcy!b?T9pWn+B%oE8@O8E#cP=G%bDP`@tBIuxDg@5(onIZQ@dE?*1 zkEQYpY2i^3SOsfbpMa9;_0m>saGXG_5^5y@Gu{Q(^GaJj+G8PzB(k!<#!?#gY%d>Y z@hMnH?6EI+x!6^9xCgr`ojDz-w7W54`|d4w;#a8!VN{x1d4~xY>3EDIxm>o49o%Wj zDCIZHKoEcCw<(|eJJ3yo)lijgweA_Ehm}+8nOc43b<~o7fI1WV7~k9>=MDPZ7mPb) zfa{-!D~HYRk!l9;@gdkV4F-81bndFwLoWIOCha`aCXAZ zD=DB6p;~`rVva-#XB&S|JccpW6VxYr7`G0%KDhBZuUw*QN7qzkfv5(jpQHR_)m>N6 zrdg8#K|GXHyB7AYBe734uF1nF9p}L)>p32YEl9v}Dm0*c zn-R<`u}7nGspV*%rMOiU#>aK*e6eVF1v6(j}D~69sGY0An zj4!J=_qpC+1AGK$aQ3v4*)rpu$dYI#~ zyw}&K(H&1u!2PVqP?U9}Q^->NB&l29>Fc*kfT}MjyWtc5D*v~mc}SP^P^Fi+dflfx z23`_hkZYFrANRqkq-7-TBC}_+tw^;`d{KaoY#w0UP$R03>`27aU1j%5+LB7^Lm4>_ z&5(5-OuM7ACPINxU;k?PYXK+zyfvK0I1qfx;fiE!ou~sfv(7D$%{XRpWawAd)Ku!p z5MePk;=B4lMrLB7S=B;BHp7L!=M@rKl?$B+Jw?lgAJ^nU{?hsd105cs`p{8Aox6Z*4ABJ+ zzPW2K*^iQ=9A(jtS8vJ`%VtQ!VOAL_R@zSJ@JOQ>V>SavOUL3d!>GJ3BRweJg)cPQ zbxR7an;$$%1!kEeuE|Zk7SA@3S-JxR6xN>Pkb6TIyi+zL5#}NtiO#S4^1LW}?Mz?8 zV~@TCSM4=l;uZG9jl3ZVzwWghCiK9K>w(eeNi$D1F#Yv#2)kxiiAaoQ`tYNNPD=nZ zHAzlOtMS*;!Q1UyI~VJJzMcuPDlhciniuQwt8mk|(iv{@-SzspOh_>_>}17-Pv zWCc3V5=_3ncra<&{b9jIc7|+X=8dp`2dy^EDlB^EOVZ)=55py{m4F{TXrEpC6fY(& zDu+N=YGj$_dw1`Qy_gN2N6t!*LAGRI^D%0EvBvvv^m_jc-hncz8D|a-Wn`$lGcGE_ zMigP1IabiWpO!!^EDTl{s@%7lUNqz7^hI!um=-qc$FRi*MNIxJfr=hPL-%opCP=;7 z`E{fcG8&f$`5BVz%|Ye5iG8 zOT6YfXN=SOima;tWg$?Upg71B0mLq09ZVOhWx9Wh!H%YN^xPWtQspXq$J}DSX!%~C zoipB2>FTLYgBeOrc_b4Ji;UY5mfBCE&g;%YWPFLPR^BisN4Pn`Vt?nL$dW$ zZO_NNCT&~1n7)7PsJafYKe}*cgVD~L^0+4%t(#XXRqtwJwupHv08NRF%2rGr9IP>^xoXQE|6s+Z zOo2jQ&#PWoj1B6&rJr$oFh+@1u}IczMs=PKno@Q1ctZK4TSAIh+b3BtuU+^vvVMi( zG)Bq(3LnTT5tCIP7zX*uB*h=sxjt8$K9#B8NwXWtmyj&?Qs}x4{QP@GFW_tO>wkj- z|BYC1fc`B2{{z(fhhFMnr=hs6fgZw+^9u5ltARe-$#y`D=y%q_)MOOH#Lm^2Y*TJYM0`futb2p@O zxW#GV1K7FuE&v%mif!83T;~5fWS*w#+`K=QFyZ91Zo4qCXeZkqdop-*@GZOh(&q8C z96^?oXQ9U@+1+2y7j>T(9ZgHfCuO|aT4+2C!-m9CZO-UhDcEz!RITKi<5H=NGz5^cT=dn=%vm)ID2= z#@~(c(!uf~m=5KG-$TJU@r)9FCts&6Tl%M!mur(VND;5GGxg8Y(!8hKx4P_)Qe^+? z>=_{p6GUi9yVhu@1X116?+D{!$*M((=NBuV@IVjo!R=RXCV0@UD|NoRtmh2KvW9*} zxyyBX%khbFnR7P%+Y}xYW=W`>smy^_z?!BN1~#V+PaAFam&u=h)+elZhU`Nbh=pt^N`BONb-C9Izi@-qQIHS3H4Tsc)p? z6ZYeRNC~Ns$G-;(=(f@~Z(Lw_|1Iy29(!VJDRy1nXOOUv`a2DPJqC5vE4`U4;k+RF z0CZ$mV#*oqvFhVY-E32C0Yn+m<}&WGju$$2bHS0~G5HY<+(;mMYIlZZ;Uh7FnFsiHcV z-h4n!>e)6@pwC0D&EO*<^D`AHYKw+k`=9%Ljm7)?)x zXc^+G6*B?oLmNEuMgscd2Ql~ty<++spoo>3av1PO-^iO%fHVQ>KYF6&yGODb*b&&f z!|g62fKRs~6`tPw8xnafCTW_4!67@DxS=k$p{%V{!61R2;u0x<_@G%*&~G>5_?;EN zqICMmTbt=a!z4T;>xQ+Y)2pr1+-%?&$_dxN-`9ehvF~nF6&Ms}(h?L9T8`e_K@!U{ zGeX%oLulMtT%aUNvbDbD#NLK$;tded$sH>Nbl9CT%k#FjD6y;6y}nud%>&(Mb( zI}590p+iT%FR772Uf|oMWyMx{pP0`x6fK-#5G~695dyM5=7-JIY=tB?H0Ok4%R**f za!u`ix7sqEJ*cf;DMg_JTvGGj^~!ICOdO*!N4`)c&Yn{L9kray^(Knv;oh96n(%PE z-6vu<0>C}OB{AH zq4tZ|T7t3lV8PXvBRc!LJHFI`h#!yDxPJL$B^#>ftak?jfqV9c+@U_LpS!4DgYd&j zpJ{rHONU#>Ja(gI#i1)6OS28n%RD#Nj~SVwVXunE#_&!ck;MIahrlDl)7w!<&@JF; zivc8RkEQvyR@I-9^(GuryKdXR<(dQ2<(a}KL_sKn=uDRGx4`Rd0BNF8G`30pAl`>1 zF!GS!zod%Ru08AjnhpQ7$B-yAq|CBZ-wwX&R%XT}J-5Iq<7PXy;p4Nd9GdTWVDvm2 zF-UG5L)S9{uk#}FWhUAX>qf^;aezi$;VI_ULl4W3=z5q8BTdc^r#5Q$oNPc(o56U- zb1E1*_!l%8R+z_5sH8{Md8=~;axDAn$2#Xuvr;!jsg4lAN=MQ}fY&pX(a_$v> z)o+{D7z89R2fr6Q&ptdPBivmiqN&2f6>A?Z6|q%%!rtk?CK#^*#K@gukYkW=;`fto zoqm|8#qkw7V8RqUzz?5TYP$PP-zvC8=tXXzAmeb4gZut0mmK?X$mZXc0qzUQ8cdu_ z*_wbOH?B*MK%FoKgvb?}Bhc&!Ug)24ODjB|l<*45vKAx@X zyoaby*pjlqf(M+Oj;O+h-AcD+5jor&@0Bu3T*S!&Cgw9u5-EjfBET7ibEUX$ojTLCccf$Lf9hr?T1s(*1vn)4n=8O68PRS(?F-}lAg~x zMMY@elx9TdjZID8JnOXveywFBWn>FODr_m42?QmVdWgm~WCvZawyq=Qbejfn?;KZPvdpwA-TyS;1V&+_&bw!>mRarhAkF<4dOEE< zEy~x1FXobe_SSnNp7jc!1=^M9H?nGjZWRSy-Y7cSMCFsPV?_kQf0Wdt6Q<2HpJ- zJ_HL|%offLo!a6{lw+dZTn#GX{&=V>OG;6#!Hr%%-pJbeB<5m=e4|JHlXbCXD9|E* z`)K1YiYBYPGPPt&@-XEl<7>^al#$E94RKF-p*)n|X!WMd#do9ZXe@td#(*{Y{0d^Y z+>F02`R}+72duxM%)}=^O62&q8~wk3?S*blMc(5v{c;qJ-f3pM;K4MfDlXlxvH$=M z;!LCk)eu)LoCI5cagBHWTwcP3DZN2qu80h-qG{n5R`_jbO;Akra)s*_fMSpqdf(Yq zVX|7X?Bh&RX5#e6&O+2DH8>oy%rbo;-=@GQw#<@2+P}=~l2%%^uhDDzQe#|#qWFQz z0F~Q_SmS%+TZI`espnN%X16Jk@W#uXnW!+&&bQbKy-mla3pCeJ@8(V_Q@CBW?|n7l zo{k$xZOYQYEK}RRZD(eX@y;9rX|Np3Oo2^XQwjUx(k4H*r$fQQOZ8axcv`0yiom4N z9~Ec{ee&_PKUrChi6zKYD{p~o#;U^9s{&vUMK=dCAGaf1y*p!Zco-Hu<AoSO25P-#JMCab>>s?{msorGF(G{Z|wJ>;J?b8@88vDw#wL zJZ6jy^jso@Gv)CXc(c2NPEnkU9Ns6te&b-Zd#nZSF}5l9VGyZrxSo;i!&y#rI&B_1 zvjbjezneaj5tG#Q2cr4ZI!N}=;Me;bH0A- zyV~LI;!HjCK_aRi*5F+;$f5Y01FnAwKJ*sOa@*QTQc}vm*pjSVZ+_<&y zTFv%GWyb!Fa8-a~Rp$+vX>y&<$?hiwAJ^=OI)|pTyUyvIxK3#x@GRwwKVSk@pThdR zbspX*NWH@T#@(U1;;)^S$1||N9?P9*VcU9~B+5!{dX=&{0h7xM1ytZcX*?`0Nwj5G z1AUNyvW)xCTh#(2lL$e@S0^**t5q9&AxABnw99Rqg^ok{Mwbs@5TBOXMX;e!Xsvav zI{-YqA(j=qh3pgaA3tsqW&=H{U7ML+Y%kgS1otjrO}X3c4)wtV**D;l5&H`{fR|-SFazsWsSC>^k$rysME_n^ir>DxL0W`vyZ_+VE zpC}jeB-KcW-Qw_n!6#8?@CmK-6BDVBK!P?kpaxf-7B~oqD!G{eH?idb4LNCg`mn>d z`n~2}b>2|;wx(M7nxbwg;MCB$THLyw_+6=7Nn;3b>+j*iUt)c+`&m*uFCjac`EhJa zChbD3eMLj63h;bh%V$8_1Cx~#j4|Q{HitZ*CW45ZoLT*SJY?y0LftY%{;#Ep!}vP> z!@4E7<+Hq7&pW`8-oCqXwsYF(Bfx*COj4n$_n56JEDnf zM0H34oJy z04R$8*+f=x4ft6OR;};m2-)!105qD0s7=uHbAa$z8tK)0@y4d zMr3$!b-qqoc7}6u2?*$XhZqX+f>iU*yG@N=IB8(xFK#;aJ8P!U6jM{?)@hdPZK-rd zni$L3ZpKhRnv0MCd^e^_{?!NMUI1xr4)CEY&w}gi3H+PNX%qtHg7-nP106IZW@GqJ z>3Z}pYcaF;HfWOf{jQPt6ii#&+g_R8%U_A22Cd2xQcgXxhhz=_ix7dv_{$}T(ltnD zpeZ>&5l;r9>0kzL-;>kND!LbxG_x}mdw@(k5vX-qey6Dg43P@Nt2%oZ>Ew$p0WY-r zdMIP8zUi;=FLLWz_{4bB`t2mq?BjpoCNfFgo%1a~m`wnxLz^KhBO}#mW&u0X@XjEV ze=sMgGuS4`=ZrZi_$PDH{Wo*sO_aK=4TJrQIk6c9qJT;NWKKS4uq{JWb^-Kdoa0qz z(gcqCE5|DUeDP@X{{S2?|1OCu)g#~<_kBEk`D8^$ivwGa_Rmmoq*%}7pE~GdE5Ea#KUYqr;j{_KklLjhS zuk>vDUd8G6D5JQX*&?a_^J1J4qK<^6iPjmFNB-z! zl^~>&(&WYV8Hcf!W3Ks`#2in%vQFU+zrds889vMw##y5;nQA6_()#Z{V%;m3kCrm; z?TVXcC5w{pQ}`PWa!5IL;um^jx#qcijkj-XzImb2o9Esx39549g?_bd5L6>xKP_)O zX`BHI6muU9VOofnGb0UJza4Dk<)B!XWR*w-UBSib<8DzR%Cc80gJ%k}&j^j?@+PnL zz^xj$^5xK&6FUY`1{PLTa@Cg>z61;(p;YKLF^Il&W-2x+R7B~30ThJcWCkD;|H;g; zovJgt;5S^sDmy2zINPwkI*T3MZ;T(_Umr!ogK-6<(sM;eKU~aw{d3O(^1w8(=G8&c zooqdERq86*RoKD#K`b|GGUtT)(#F29Q+x6--SIBAA1t*6Mbzb`+T2Q|K)!*^J3eNteumHIq6;M;4jzTTD$KtA%OKSSfR6e~L~T7F9(biZ zAZ1c;)-QO?Bajv|UT-XZ;Bf>{#H3HtyUxSn56;sVp{v(#keILX7w`+;mW(heFU~D} zJoVU-i8?5780f<#2kQ9HF^AKQ&C}X3H=RJrit^$+TDR!4o1p-5&V4rR6D#MES<*Dw zDNs!)jrm?g;4Y9Ik@qwzD%1vjGB~1AC{mZe{ouRwtz08Zj;QFZrgzvM5AYeAUl}pf zMBW5tVVLWdEQqbf>Rl(GwRt-$Y1!}1u>=xuw=rx#`=@0bdsSRn8X++^qksjW?WFAr z(nq^D8=!|fMqZ~rbn!7bt=;ljdtL#;TRd$(Lfp2OB^53XOkarM9*1Ar-ClVFY=r*< zoKz&90VfL&>i_t8THIOdKxTU9;IWNGn?Szk=Lu5<^5rn2u9evXmnZ~z$34_RF1>6% zXHx};6BikpH^~guz3S3V;s?;>QawLhn30$3Mp0872#?M8-dG&`^4i-OMnotCQOTs# zvjKpKerm*sYyV1FouEbO82aK0ljx4J``zC-Wa!v;gL3S|7k;+4H;MuH=j*pL@~l%Y zn1e;^W5B%IPWMiMhwj?2VRC92#**U8sSd~yB{ zG&!^{5C3xL1smw#RgWznOocDJYgqhPQl?wG_UasxlW4gAnL70E+6iv{=xupJ8j{4F z{^NC_+FpyDA}1{oP&b_VIhVTKN|2Omw1}8%j^bN~AhA$@-dMKL7-%S0*~xD&Hkq(g z+=U*LP%JY#=TVbrE%14gYKu$D`GtOG5U3O!=ErXAH5IQr!Q_Pt6VL$jz`Bru`+kGf zJ<*|)mZi1vbwziC%0t;-h#&(qLe@{Z`4 z=I1UP$=D$?V8OlptAV}Xq%eHbwj!@(**Om(7uXVFi~dDU4>+mqo_o^0&QJkW}% z#WKnG-TYdQBA&X_h4qQmrX}dcT0qNhet3lEmeYf`C^gZ!HEfp9nhyV8j@g*KPOv3$ z_{%Q5YNtJu_qbe9m-2QZ6CavoOrlVBz5NN@D$Ck_0oypW;Tjr}{n zL5$&m`4}AZh5;z}-}Uj$nGkq?-YqiU=I4IwB=0+;TW1Tg={DALW#fZ>N?tmu0S)0) zjyWSnV(HAA%hWjr==~ULsXIG+>6$yZp|AT!`T&x|PwLt&DwtlT%HBCox(;ySLZZ`R zQhxD*h+qbU#u`rTI&d!R#us9o5vMGWQxcE4fdi!SBMxtZRJ~%i{{FMj#Hw!qLR5ft z8Mwa)?M)~US||;;N@A9l8FJbV0xjlxf1SM(r@wVfM*i(p0mfQps3=L4&gRCgBp1XaFz_`vPYyIbF!4l<8a+~0euoMWEOb8&0xT{ zH_*8Zvo9TtnE$6G7lEcPBxT!crrb(J{aGMX7!ky;`WRLUtubAfnP$(us0R*0RyBwu z-+GPZ-v)+fbejA2Ir+iU&rvLo+Y3EEHD1eIwzb5D70konL{>G%L%7m zrO;)3HO{0O+d80r8#2B-IQpf$6v(y{0zqGV`9^uur=*d4@x1H(8YwEaZ_)r`yALFn zO6uShHB<89MKf!t?}8HIF@NSo?<-L}`4d8yZYfU3aE@-Wyvwdgf(Xjn+hY;nMhw z9#8_H#lh(nAo)-yUNl?yin{yL;O(`?=F$Swn^p;#<{zv`%zo%^VE7R7^5LWRZE$j0;SVzX|0YMyPi4%swkq3-0MP}{4fkh&=5Ic5)$NZ? zA4KL1GfCoS;oNLlj&?07?YA&)8Tn*erMlf`S6>Q9|9Jw?6~fz06p%8I;Ub`8)N()T zRrg5sGlFZE)a|skw{*Y|#zCi-uTs7Xxu?04yjnE#^ z9|56**QmS%(JRvctY0|)t*^tJzP`b}-i9Fp;_`TQ17!T}Hk30}RR&)FBSBs$y~x}Q z;xww;ZN|n zB0^_XPZ*E@Tw`qMuoY|$oBE_1yl{VZ6-d^G0i8fWZSPnj209S6bOYq26NlRgMHUMy z_%<}8C)NNh86L-G!ETg}jqoZ!B*^=^QXATOye`R5p0K9WyKy4&+;_`0Q{nmfrmT#t z{Mrq{SPRX^-+Oi+2_}PR6t4mqxs5lLnqb+QVjx7WUECelXH|bAB+aJhLu2)!X-BWl zRn_h1b}-%`mVOGx<(%ci!tmyvKHk2-CTVUV-z$CFL%_JR*K!O7WQq6@T^*l#*OY~1 zr|l<&Fa3Wzaa-HI`udc|H$9(vb#><58>cSih(~|RE2}cS)v|T{ao6wJcduk^ z+O!E+Xn*slJqIlQe14xhoT-_wEnjOD6mMf&w6!y)GW>Mrp{?tt-|>)xxL?3m#^^pC$lWO!8^b z%KROdIUDt=MO!()+`C%PeD{>XsZVA99`BzqyREn9jK=fSov*UQdwt96r)h5!DSY4w#2ezgJWgTK)U&xzdJk-Tclo8Ub2GqOQPM#>h9&SJEde##$>KbyG2i!5xA?4Sys`PcAIZ;u086;CzUgh1i+@zU zGMVRB&r|j&9k?)Ki|zjNAuT(!YxWn1dact^^D8^@ruzQwd*IGuYhYvcHc{1X!(Ekeiwh>B9h0?=O!Lp z@ijx?Z$?f;%CvPgcOZ*Mj=ZrJo3SLSD$b(-H=NA zp;7$i4{RYx>iO(*8&X5uA1M4YG1oP}oOagqWX^WrB9FPxB*V>4Zn4?bd0swf*6LX| zzj~exo$~bU=9th)+8%Ga9_bZcJ`iS9JXNT2vvNVzVc=lS6XupB3oUtqf%VLtW3Fm9 zbIneDO5+ADqBA~Y%RQ~F$}!dBa?IUnvtnE$@BN##`sF#fgeP2+JZ}p}&((gaQhY@B zDQF$Z%U9e{tx{8ST@?1^#O%Mzb6z6#n%!RbN|L%?J5HWCwKSQ zz12J!dgUo_H@Mb1pGB1wz{yI;dXj5oKH3H74`{u=UO2$Ves)dCxmjuTI<#Ba; z`Q|xxesxrwz_hJH9KltSH^x1Ta5dYnGbM6!tTnJa`T(XDJWv0a`X@@JFi-Am8#AZK2%S9CP z(M}3MIpO0tc*h}P=}B)hBXH^oxMBtCi6ey$@V$yy4yHnL33O8<(yl~=HAthzU_q26 zEGT{(L>69(y_Y9r_UJm71n?}cj6X;CCr75VrT6}`mkF16^+aUKp4n$&dQZuIb_bpQ g)t3IO2qy85}Sb4q9e0C>ep2N1cZ98s)ij=V%^1d|+_y z90~N?x$}=MkpWKzg)j=|&goS?dZ29NH@Vpa^D;KhI+%4bu0#Zv`tR$F`O3(%jZptp(SihnUcLP<}0zN*V(qx!gf-lhCk zzJK}Q>Dh7PaCed{YFa5$V#9N5(JWgPO_29hv=2G(`|bMN#@W*bGKzTlQexE_|Nd;K z{Vb0`EwFu2qdjve;rq5(dg;qA17d!VM@WX0cOHA&^rPZu$IIJim2~t&A8g}}TTD#E z{p2~o^jkT>RpQ|9uq0sYw+o^9=qvYOJTLKTmvC?CFl=!`xoCatrQH8``p-|?$)NlE zP`P?w?0@_Lc*;S2AND`f{F&>oKfKf>3~J`egDG{gWvnJTWMB`Sj{YW&BK|Y*=YRor77C%6x=$Z_Sw$ohev5vC#4z9 zzf$tEahtxCC0uh&ha4@vv#;>WkKVVO{EpSiT{!BSJ!{fRzcW=e?7q-3t1-7?m=d!q zqt`a)={z~pOPupf!y4z=YBqa$Dc5s4wb$mGu_}W0Kd+Lcy-V#Q{(jjBv7vwKu;FyO zwt-zdg83e035ssdh@!0+2g$yBhmP{xhb)r-|FL@kpsE<3@7h*nHt4Z+T}O+WmtTs z9?g~fiu-C|>w+gurK|1o>w-&_<%dBI`+VblbSLk+4_%9fJrP>;7`ThPmE!TMkocpN z%KGU@lIZA<>f6C(doq{+@O$BGDje?F;RR`YVTT34;ODx4Ce9{NRZ8F4Ou=_$!RDOX!F#p zZ`$PTbsJI|b~!Q>wIqZ=1FNT;+cVddHnEGyMZ=iCh!mB6E_L48RnyJT2XkAgxyA@{ z=`J^5ddVzlSvyaAmuA)kzt}HQM&HN23fw)+Maxh=pkPwop&<428jvUBUnMqSwsx5nBHDXo@=1|E-_)u5-L8SZWpipRXZ8v66u{sulBIzR(3-^?nU%@ruZW% zE&t%)-_`LV0T(F=j$GkL+Bk{jTS|C0w);#ctUK?|&3rvq8SX~h8jR_#+wGXJXf8iT z62Zv1Tn@Rf@gUDG*QJ4?oX?(iS%=}%Ifxv2PpsZ*4rm&pe+2_iQ-Y~mFv)F1L0H%+ z$XIrjgBVLH+IM?`iU@9;zok6FWN8r**GN>!U&6ei^{|i&9XUl>_qBgL5aK}^LoZFv zkUX7!rO{OsLmh^rX}VN|+_AKCV|x(Was@Z|Mo1??z&bjVb%_FZ&+jsv`?+rtXxeoz z9^MxA`d|pAA_l7Vu9PWyi7#X;GM6;~&$Hy`J~Otkz4X-FQ*A_VAp?Yg=Tk9$)}&ht zrbgr(4g|9KcYbb1nR9)Hzsltxe5UhX{QQif;;!Cq&NyR9L6C*9^sxz&qkTTbM7+-)OGTGY)~eWM5j_74{%jJ?k*{795T+jcc`6Xm zKpBESREXoPvl^ak$@c`*8m9p_zaZyx9`6*sbjsB1N_WW4VZq;)d|A;wAkUYxxU?)e^pxDsa*oSYcWR|a5FAbaw2Y#$n+Lk(%8Ru1{doZY%L|ZD(t$vt@1D5VOi6i zP|{k*>&hto&j~hP1yxc^H+8-xS*b=_oGy#um$&!?1j^$xG6JLCK1$u&yS@+NCi`v* zqrY-RBwyUawwr*%cUP#Per;OuL%ET^XRK_eLKzIi*Hu}Q?&&{!mM-9N2q`#wS2}nZ zhk1klDhodH#|Z{x>;;|d21Li2`uQvVdS^ox?91M7`x_ZG+M*tJIVih_6ZSyu?dam6 zQlWuijjh=TRdw)~jtpTW?RNs=SJ17SLicp(7Yqx~&QW*S<;1SeHVIgT99-ab@hCrH zbNJ?IAh>L-VPk`4)Pf7#dLN<*Q|Uh*ZR!8{XzT(_&P@R!3;tJ!*-r}}_IMcowyr27 z_t>9@3P9B=_;kjk!1nJ&>q=hZ5P@@)Dql&zRx*=n5 zmo_MLy#xtUo@>1dI{V;{OfrxV8BP(wN6w3Q$t;EwK0MrbGCO2V&ni7{#(F6eN7Esr z@~W#hVr=5*n8DmLf-EcrHEIgXcO$QED8+c8@J*{JudC%1=|&G*6nZe@G*4VR>rxa$ zsFH4|v5I^HhK(d{uI4ISI<@qRR=-CPg~srynS|0b1(Z4~+`^;J)Dzjhwi(9@EJhL5qXc%M~*V#!ta+al0x(- z+)3)!BkZR$#t`!bp9(eaJK%;s^Ott0QPt@(dTEPJZTnC|6lTEN3Y%y+3d`fE2v4fc zUZN>I{n<#5V4eIU-s4Oi_Zsy%F9uL1>1B9DqbRi4;k#Vlm5Dae(9@exgDgdl~>H`vGxO}6H*vywK5Z}>HKMHoVO(>}G$(mQ)c#|nG+a2(}4Rds0xlTXJ9TLb5sQ2Z2?oO4hFx6=< z25Ag@@Zt~?o)B^r0YUBAt{)kzxOZ z^M8nwpEL}z0}RQai-!FW7}eg=X3K`~U6xGf8cK#P%I}&|=SB7u$IPrR#hw(r?Oofm zFGNRVqhZ?9TfA!^y#V@}=E7!XvHm9MLcP1UHti7YE|z1CdL(NP-iZ47%It(Sfe78j}kkC)IsM8Kdvnha@J61)ttn$z>C9GRmq;UEx-9db0 z(s@DJ{D`<{5+-tgDjziL;i(Hmz0z*qWdD66I@crg32O?OrI7W~yZCHUd6(y#Y)yeb zP%nDF%alC;Jecpi&|dOu_qunAO+Un6O@=P@{6MLF2XVYni@h^J{q~yYu=oes`}TWY z))(CGX5DwW>5Bdc8)Czfvr=azO_&UG0{4vBmE_Q-63Ynqz@R0XTX<#N%MPpxlKpIg zWI!CEgbPi*$7g3vMMVfI`lRQOBi^W%gzmF^#IW=g)(%aw zqR+(m8Bon3JRqW2SiK>Atcs*1mxo^lY-D&c1#XT3iBraCokyD#k<#QYqq!@eyK$#Q z=CEEoj5Y*f^GqgWLX|sS5nSnS@B$qzx}XO0)WgQ)UbFuBMHsr=!;*9B+~MMbD{^<( zh9w1=JpNG2>$_3K6}mH*6jzAHk5E9qDSO zpu-q$O|_%$7C(qv;Q&o`z#vQoiX7>888UY3(gn`cJ5_tV9`mjCE+vE|8u)mg!X*4J z-VTgrXykslY|=176*+Y~FuaSj?G1YjDOJ2Ox)~)I*P>GXplkg}5x<}7W&fXBQdRGX z5?EkAYdZI)a^L44Yx9(KXS+!orw+{ooL@-uoh1tHyNXxGsP2pKIcj24Ma+s77+z@$ zKpCZpi<0B*sI%V(Ah=ABH1bc7oGA>EYIn#lcPO)%NWP>d%ntyumGZnzSPuzx1esep%f1uF+?%`zGbMXzD+Z?#aa6=OHK1xpae6-9tL2B!T8kn`NGw+i!H5J`+ ze7gDVN^xw0R|tXEB1Y4)xq)zux= zNwZ7Jz_H3uTog`bnV0f}Ud71!BS*$)KEWzbh|46ew3KT<(R( zZ{hqd3UvQoB@OhVG`dsuR`2SsO-4}Mn|~aB#O-)s{SaWfugcdBvf^#UnuJw{6@(mC zd3bs5sd)6Pyp*TtqY&RI4jrxW)rI|-e`PZ_7n+!mQXI<=3m%*I1#ArBtLfyS&bshh zyHq8JL57^n&qu2xr9HFN$(aIO!}7O``@xvq?nB^PMfg-feUpSO@rjH&*;qmA?0HOG@Ia4h5jW@d%-`=HxD_(wonI-WCu{7u=^Y zUos-xIohC|z^yCJQkqu;dOu$&#xPzy~GaxjU^b z0GF_`6*e*zM;>gx5*PL;f;h=tH(5A%jBpiqn0$F)yMe1SvyZ|1Ty^~Fs?S|C(`?!N zQ!zWzo7B3{ZvC3^h}RNw&K>SMuHpQwOxV0S49{$bH>ug8iF*AkHB3TZw&j6=8gE~0 z$JFGhoRM^?Wo0V2%B$X37jmNQuH(wxi$Eoci=$?2i;oD0?P@@96BM8z`caINpxw<6 zb=j-8wXxCc%UF3la&f=jb}7a{q+y8Ts$6AWHH1DX5!b%Do(#(Fhhq%vOwuqhoDK~; z^$)sez)TP9tu8c?{@~^3e^=s7dmcAv`5voqOMhgfy2MBIRllC}rHuEBUqAXbc5TMS zXv54X`LxGGt&4uu={;M(6x&@(ac9{X_Qqk*exlp0BE zof@XJ&Er4ynWcJR|MnLKwyTxpfa|i6?{g~k=#l2CfvNb#Ex4z>fUAqG^YF4#H+?OJ z1t;>H_i`tV^?aF)8A5@})r9jZ+SNHQLyANlRwJ!>-rYKNixISEX+A@RYIJY>5cANu z!yb6C@u1gi%!8)-squy_6dA?~2Z)#^UI77zNt+nF-Fu01HQ2);9YEZUjH*X>>eb4-2nxSLX}ol7r-fUasIaqp(dEW(%-cF(MQ;&f|O-_+`A$+7H`Dtm*9< zd=E6KJv}r0D%r_r69JzN1Mk6Y`lKeNXLF5K8;qM=)Y(h6jzH^}4efN-zTIqR_7xRz`cWYA8sE?$iX*fumtk~J~bh|d^!J9o&yb^NuxUivpncseh6r! zE@4|+aZPUjnXj&vxSz*)_BlV&pJCu}OEgWcPN1?H$n*kzK5p;8e|C!i#014L+S$r5 zPbbcjn32^ooBLk5D%feiZ6_k2MiOs!66L<^aHT+N=-QP>8WVz-xIxe)M%YC@GY?Qc{25kL)s@fgR2Fb9PTtf^T zh$aNZhYZ}OntZ&!MZqmdUJ;*$Z%o0AXlSbw9cX;ICgzbJZpL{9j#*;NZ`IU(OfaRa zQh%nb-@Km9108*g^4sFW4R+uon;57l3k|04GD)XY`9ck_8F}cy+)3^COoN&CYS-N$ z%wnc|`{tK{k^~nNMqxQG?@ zu_e<1F%~P1DGva0{NJvJxi2EimDvbhUecnCv>OT0u#{vFZLhg2_OYFSU&m@*poo-^ zny&xq#&_U(KU;;I=X^eug&_G@mPouYpQV;gTbWEU=;Omj?DM@Rcgm!~>6lWq zTx8Ng7JlX$D`~Yau%h{R6{nfN?4t$j?LdO(ZPV)V^|AR=M?~fJPq%`8!VGn6_B~PF zE+B=<5f8d0D)Op2)+0{%Dd9PUc7lI>8O;U#M#3#E#`0CtDyyV?6Xao8ggi-woX7_TAc`)32VUpAY{vyW32sBDb|M z&QLFs=~ONey|pxVPGr}qV-LjovMBeK0`4T z7)X{TC)(u$!oOuxhY|X}lEoL!QJzQS;_vuh9LPH)Se>9%u>&a=InEvrtD6h*n4X)b!L_p}&Ws`-|E>(N-jXj>m)#xk6{Bg-)Xr6+Q791OG4w0)T+ee#A<@C&74zWQ)c zvaG*_YQBeO=C)#5=g%v|8wQ`TC9`cPr+JaUc2{pltdLTv-Q`xZZhLJ-76Z4(X=joPxSCNx%zixt+}H;X)V}$*mlX+v<;mJS z=cr*4H~U$t?}!G_YhYt6WsL5=yYPyVq9gwYtYfyQc1O<0%nsHe*AR<=vt1o=EnU&3 zxvGb)O+&oq59rqlp8t8z#Pu4XZ=j>FHvy%7?=klFNz^=81?$Gy>N&#F?sP-3)lbp6 z`pv}Zj}v_t|4;7M-750Yuz+v17g`Q6bt#OXSEQnV!-RobQ!$TjWZJyt)~x*+e(O#? z{Ur`5)nQT_v1D{^Pa8`ZMMaFBX>Ou&+&Mw64Uve6J6Um4yZ)AtPi{B@t<1`x1Qqkf zOwQG&XKgqZdFS4Duy2esTm$TqokG%Ly=2#9+d2x*4NE+@JO{lS9RHM%$6dLPe){-N3!}`Po?N{U3M1 zD;u~PgS&Mv@yq97Z?s?61?|#e%`ksoCt>!KLXxOzf0FJbar1$Y}$ zcOTzR3An_PWi2#kP}TW8e#w_W#G$|x}n+p^Fo(4IJ7ad>QOT2)*;Mu zp&^`3Oshf)f!%Fx3s9PON79^KD?jV7r>!kHr+0_-aDKZUsKzK@Yb1`fP(kwDshc|2 zd^Am0?_=P%4q*M>9|pK+=_CoMocxPz+i#tfM#Bj7=*-yAqkS_A>%$%nmkaq<#w#o) zsJb1ihS{1g9Ks0oXdF%_kqSICyYGvwcjD<9CRp&j>u>-q{u15cUQE{2+OT=Uh?Fk<{`D)YK5 z;5*tkKP=&9F}Yi=9FgDQ-q+ik3i!z%h;yy2`vPpW?9FrvimcNUJK($n+$nH_4%ZGipx-@S)LP0fesyo7oGj{ne6+Bf4Oogq zLca2h#z*-r1q9RE6z2o??DIO#Y^CzNZZ1)9FzMylk0IHX;(onPz!HTK=z@Oc!)_QqE8%RuWst+Du28Cu(CYON>@lOrxPSEw?(FKhjObobH(%`M;qRehEucuw_ z^4qC8I?xM3WA>7W^%BcOEblV7tGlbenP*C#+wG7ZsLy2lQV0sr44%LE{p6SV*0LZ^ zPY_J=;Y06zuGTD`NLp}{cA2x87)R?qcc!#xgsP#1>C;Ka#y9V7TJ^Ct#|fE6U+)%< zco#X>sn%^@nH8V>#mJ?Trn8gpSOYuVYrKOQ>oR_`)H;$0X#W6W7Tf-{d5}uxhZr|S z>)j}at$w!l&4bWy2*SH1h0KmNTiwPMU4c`Km zWUC0zc()MTEt=6Rx=8ql5`+Gvlg)4g!jp$biKw#YVf^Ng1#y}y-*{g2_!Q4{%v={G z)g~YACx{8}q@Z(0y_|N{O}~dJr7quAo1Z9Ec41GLFOmDcIHyiYuP5 z>qs5x>ZZPLs4H{cDq`s_rP?uTq95Lbxsu^*HEpIU_^kTO$1!HbrcL8b!rGT?9E55Z zh22yl?qk|>0}Ce2 z((zR?Z|ZuPm=DBrhaJ1LU)VMK>mD08L0d1Z08KU~Cy=L17hsh{& z&5GvJn#!fkF9qfm%YuH#@jw)8Z0cb?S4I!AxHu&2YRlwrEBx%aR~qJ%Exyns!*0n@ z0(>DwXIG*i5uUcbR!8B@h+HsLb-WC*kE628|AAUf1i9uh%e$&kN!=5w?0@=M8ynN5 zM67M~oBAsQ$(P%j%J3hBF&YNPRo*yB`XmP1-8cPpjG!e!p@6_N&jL8Qc$jh9wPFBB z)E5BWd~&oc6@)?hPen>y*C|^s&UzrmYuyP8o5N&gHg0Pmq zpLD5oU-4tOcNuCZPyQ{wuBnGKuERYhIyQB3f2#IZCKXk5LGY}*6~=u3J&5F1mg8Yf z?dB$DjZud%Y5D!G`(zNFDxPCx`Qt3Y@6mA~!SsmLt#!y&doGr`Fucf8>aF-`_Fq=nv zh1Q+zB`0XN>nnM@wD5B!M9_}A@^I^X4fzKflc@I)bN%0m>kL6ETX4oCVUuJlcHHJK z-;fk;U7Cr!v>IN`&}zN<9ATSuiV2uo0YUQ%M0&5YF1Wj&jzgB)MWeQ!i;wp$~RG9qq272>?NMZ?KyM#Qb( zIhp=m=uce&%5}$cHHt-55Q}AHQo|Nrt{YvRH+h0;&A8JO(nU}x*i&6Eud=<>F)+v0 zSM9BqGqAYZ+!OD>>YDD7#RykR_7Gj_)u%c`Z47BaLeROlnd*=krYuuOP8k{N3(uH& zn*0wb(s_+AGyyt}Le9⩔n@VmuzP-Y~QL?S|I5m;k*PPT$JSjMMlGeFFbL*y|wy7 zHaDGOs5e};4`JwIp6X!l%+!|EU7oAs9N{1m8uHC0n!8N_+TK)aU-P(s=a+fq3YS}o znWR`);Aj}-!9XMnl)!baW5%6QaT;KlA?kguZ^h+}=ZS5nzsyDDN_s>-_euxtRp-xs zs z3)EC})oqs@tGdqbx>sN>px)cLRCuL=mMGtBdJUzFldPm7zw^2^yn&nPU#A0kIh&>n znJ;bn&`$R_UNT0=xOGlFxvZiboRB==uU{rwBij$xABkaCRK=_ak1XfmIu%jx8GFYE zzJFcOu!j*eDuD7GqHEAGbj)H}3i_?M;)nazB2;)d#RYFS5ZZBrtnB{yYNA*td~UM% z%9W97AA)ODK6*_QN~URoE)>n|io8;F7YzNDBs7B?Jg3qnyHZk0^6?GQl-Eu64Vww_ zS@4u6FQEZ_RwRVC!>Zksmsi&g>+*OWeSNj}rtUyn+oQUlM@OS4xWoDs!^&PZzwNQJ z#1nxoAR|*|@p7S7$-J9rC$o`ef)|x}#aNT4g)*gstCV;2R zQf5qaZd#J4|2vOu9!e-d*73RlrJ}!Knr0@Xp|^JyGvY~T$6@Zjlk(-Q0wcRfWIAaq zP`&v#@cI8|>IL9J|G%Q6#O<4#XEg3|N`GCmQVh%nfX9bwTNfPw%Hnr(GH5v(l}D^i z5UfZgy!>L&mZ#BsA=0MuyZZb&SBjV(x;44c8WPRu0lc`^3%h5!# zN1NQ8@V<3MbDG~R8N}W>=tSZx=APf`zy&4Ok?b#v=(mL^C#;cmt+BjJpu3P9_4H1Z zc<~RIX`^i%j4U1f?mxiRp&UW!)OLzxbcUTho|tbDF3q zW_&NC1Ipk_mFF?&1c+O1dM-WxUgvMosM9MV@3udMi~6mr0eE?4DSd|OVwx@3Q(Sj$ z2m3FD%4Bfwm#}9d%^hIH<+UFpv^J*WvOOL+UYJwgxZ9Frq4U%T{|X7}m$=)s+lg1- z_|~}7y?3STp%9uccfqH!8Kq1(s{KCW9On!fn6XJE_67h&@d`*9I{IG6*Q0ZtJior_ zAAj_0#r$nD{iuVF3pBa6$PZ@QQU56oq20)qQd@2Y{%Cul=wJK~Bl4aHle8EuLI!M^ z07@x+0gN#J7*Pb^Hw}~!`z~$uPzg`mXd1qqKy{N()YM1PVkZlodwg3~LG>&87a1=6 zu@Bxq*QPm!X(d6oHV|_cLk?mlStqI5q3w)%{K94cwLJWdhZ-m^_0fPsyPy z2uvC4y5ji$E9zQO!juEi0c{X;wF@1S1ji#c%H+}&JYz*X_nZ?zS_;=?h1Fs~mLI(6 z`irNK>d&4f6&$_U?$E&A?v(s^!do5!cOV_cypN8skmX*#;bsyAZ=*{32p|e+`-9_! z@+FAYwbNR!G|-Zx>yh}N=YC9Cx!*`01SRxmD8aDMA+ywYyi#-YHFduyz#A3QT)41M zIQ30-_bO0@N$TzO)4Y&dgC495G+rJuFKj}V3tBztqxk-ZG@`cC$td#%GGR=%MB9rv z5+n7H1c$hr8!OB%Ku|nxCU4+vF;RxK!{a+e7d1U?i_y9L?1ZVE3;MTTGlV|Wd4wp_ zGy}t?0#5P(o8xe5E@vn`=J7X?RMXm2`@G;Q>OR0dp+=3d==f55s%#)zKTR*)*f}Wd zHn}1wIaUoZ6@(5q-?ox+`KDUM6SWvCt_ zu}2_TV|0g;Cnlg{Ah5Bdcw-)B0v~zhMy6-oT{la(g!lVFl!w~f1~Vuey(e7mY3%Z} zLO2OToz~rX(~$r5;?2&Fm_AxX02>?!5*yll6QMj!UvB(?nC3z%EK{ay_07O{ z0bI=kpxl2MU@gbwz;uYjsHE$dlqQmuWI%sm9%)X)*s{_4bXME>0Ghl z9w6A7mKBCAva&)lgaJrzBU)tyh&|0(L=K70WGWp z0xJ8R|Bw#xIwocvFGbz}Fl#k65thq_$y@w+k)MYv7>WXGb(z`{|{IdwB3uYE=az#aE*x| zXxksl0|ZlG%PGFn5+}e}uX5lSrx<;!(XA2cX*f+CjP!bxnE$M{?71LD$d*u{X4N-^ zd0%d}Ot~N>B{GPEnDV%}M#E*mkFKpa8ea7Th%cNj%p{g`KFhUJ{@OuCGAl0*SYY>P ztai#no!q?!Z~^H+Go+VMg2BzxV7ydtSTJf-nFv*}cWV0rP?i7F=3{)}v4_(_$n6kb zdHEh-(A^tmrPhH@)RSUj-j3ykt(LT|-gI4#=CkY7lPMoD(d=canD}uE_U5xNnC4#W zbHHPw$j~9~d=GkKuiw~C6fhVs{sy$X=n=_9&%JMa!F`xECAw79!M@8eJ|q+4M5OF- zWdT!8bZ6Rs6ymP9!|TpkDY!96bmIJB3T0gLU<|E*=3 zdpIIAr3(O10hW_EARVz*BL>t2%gIDDWfYfuiLEauT&^w@8CScsZvn_`1cK*UsGM&89;T!%2yEH6F2GIRoG` zn^k_0XD6>s5c7?~6-9->5?h!T*r273pkp~-11T!Vc2I2F?rbmaZ2AV2P6{n`Q^?UTgZ>`c zvS>Jrd000Xe^}BLPF1~F#m?^0weq;pLjoXSe88W?M(31N7rQt}!VylEN#xsSDR;NO zFMi*C!9nu67M@fl0G+Sc6o4wEf~Y0#ci%R0IQa$? z2Cm;FP@MOi-+A0?GPqXmF&ork)Z~Pu9gUpmY>5|`w%=;&fJi-rn1in<4X2NolRw(% zMc+e9z1+5J3LsK7Ru_l*e{cbi3T1|(C$0i;maiv+PTpoo^fG+t7lzVF?&XjUJB1^0 zabiaAw%5Ps$0dUHe$4NerdH@zlHUFjg{{-eCT$8pa%Pj~q|wePTw=8xr`4lnQ<6p-JHQ~ z>L<#&fV6ZsUo?xdrf!p&RZ8T9?pC3{-P5jQ0nh>l7_^hryq$lIk(9N z`o+~RBb6CnQF9cE_Ot~7pw}PLNjn>&Ki6&uWS>QQ;dcU~r)Xe8V&-|wH*$Qb@e!H7 z@7$$?wR>`V(21YCo!8t;Wu;=iZFSirqFnCWZ#CWYqtlopmv4MGe-ctsM2*B>A5u2c zW>e)wmEVtfYWn%R{4zguUWiBo0Wk~Qlcb0GWgPL~CqIDvezQdCRu#3PAD;{Rf*3x> z>;8jRLXq6y)kIrRJRf`CG5GKj02@L7 zYnEit?K{wD=knl)@4M;$IZHN%?O=Q0x{R4mxn&Ra(Zm0o=RcvPzokh9)wHr>f09Yy zF8tU0X`n?%Irot$kA`6KuEE8>L%h&@V5xQ`K&;;YdSy=TAnm4=YHa*Se^(+gHGz-S zdX)EYHRIDQZeB|=1xY>sgH-`q?||Dohe?TdWL2W=*XvkCBWr zjAF=G!>oF5eS~M@;$^0R#hFIU+227Q)GK?;aV5wlnc@;l?w+{JkAPOX@3|iE9kKmM z*s|V;@=akq#`xfyFhEC<<9fR%It->cU_ZE5XAp;(sP{5F@uiM3!FzJJL0Wv|n_e-? zYONbLcs>-_lzag>Cm0U)EY&DN(kjmag`83Nab8o11^1N^6%~#&_!-PN*2*!tp$Y!M zt=lFl`fYNTW?EkgZLlVw>We*I;OVY-Zv)x3dPB0q?WKAP=0DLRwrCajj|{V2ttw2) zQsLkbpx&E@9xt0MyRX+6)D*ZIqCn$hDq&dT{Wh^a_WD&hS3-qZly*#lZGVXX^rqSi3igPN-i@sH=NZ@9M+1O@wf z@5np?a^5;HDjuNQ%16z_?qh%4EUC_5*Xmf~%z_=6Jo%41{O`n78?hu9c+*{W*<1Q| z^fjbp&0O1+=Zq?T9k?Qp5d-5(_c#3!0#N06SCqpoR#{xldsdkctj82ndg7V9uff8k8!rHZw)O6wOE?DpN;*7Nd4ROk4iQn=Z+kKZ}Se245kjfX@*qYIoh~Cbe0mHGRSlIQHhHkhep*=+&E0 z+nTEY$HZ9wHCaTs?iBe1Hx|#WVzHfAi2fd5DnoD)Qgm`E;T7U;8%r5TY6|Gbs_fTa z&&C&c+H9^(02V6=@n##F3}nGw(&OG@3-2=T+olP7A6ET zekb4hPJnZh!CT(LV);lJJ{n>JZ$dv}kCe)TYx2<(kJO*fCu|fE&<$=JMp| z0wzXK8mSJ>@#G=~4#(G9Pbt@VpSKk$y0x(*)e}c`@HOi7>kmW+!^au=so>G5{<6sFuvE%xQU{lEP$@31hHITJnAbBNZoFTspvocI>xd(tY*6Dx z9bCzCGGI3O8Mh`7W-`;_M?46GJ)Q({K62Kg|HJ6W&xm)&TR8)%lYaJw_4xN%R2%eD6|1^VY{{j?9rCl0`0Spn|N*NSE)SkS2 zgZwVwX6%&OH(AF96gN{4gKRz}ZwAa|RCyttgF1l6?%|;7`?%lSNb9bx$VGkk4vV0( z$b6c=h^Bmeq>#Pd^d7ymw?pHG76z`4quKs`vPzy>o;rZx5O^hpW;RK$Rsp`le_*Bq zu7AT!x@TLM&jPr?Fo?z3Y^n<_eFd@Gql>TG04pa5)lYCwjh@OHFYORF^tp6BQbz!K zxf(j5FDdu%sS}M)`+p!!a8lHyXJ;awVQazeRV$7uCgshFBG62#h1Fqi5+)@z6mWe{ z3Bi6)su-I2fR<5(9o?Vud2%5BP2TL)Vzu9@c=0TtUzhK|gsk*NaCjABV~0tTrHG^? z95|FDL`i{@4dH9WFn6Z7q*c9bK^J>}9k9yX9jLktg{F5?CT z3`W(yiErDyk2 z{4j;;SOmiOO-@Hgis-Pfgmmy05^%%*Y~NtifFIcU^$H*T$9DmK8xRU;(E_zJDZ7su z0dJ*H8_2);u4X-$y7l{TV=Ujc|78tWx0ff*2YjErSTNISRGjuaSfVvZZ5XU-ixQ;k zu2bdq0$fwF{+^(phgDf|k%8NQ#aaT>VrTIj>`gaQ0kCoRZ%m1KNsu>`2t+-#g}7RZ z61UGRDW}u?ds|F4r4&YG8ILO{7>IpK+`g+Y&}}=#S}S=umZH6_>FLkhLA;%Fs^6^G zwo?MgGme$xObCD?-c9mx z2=I(``{1&)J`2|y$~;2l6y0w~EWT(hcIg4!srb|cyV5|Vj8CCf=FiBvB_fr`X<*g1 zes>>Z&-sr~1JsV+mf|Tv5xYN`&=&U1^0rZF1Ul#pb+bDzhj^_<#epkzjVeQSTOTXO z3tf|Y=sspPH#({g5OX(fh__?M6UUi+dzt(PD}s)5>4o-U=g)RQAE-OZa+hd2N)*q! zhPMGWX#I&O`*PE~feCV$#d0$mJ@4(c3N!2=C5mqT!02L^wsolCiabF0MQYy@U#lrh zTv-0ps!GkN1|zh0t{vz++qjn#cMa?OeLze=ZBU(xxil;)9qRM)QsW)PM~vJl%LQxy=G3iDfwqXsx2Iby4D zonAUcXb9%%#-V&aW0NH8siCmhi}- z*NzrC6>9f-@7#qU4BJIRa@f6qqcTQqkw2I5i|ZmINQCqC2XC zv3t1=1gzYrVvp4vk9I7!umUvVJ9J9wpli*E-t;sR@_o6J&G?!(QARc?p~_j~*<}=d zljokzgTGN4l-a*f8dXxjk6?y$FpI=$s;SijwOQUj-?>%GEgPaZVs7ui0c$^1iAd_^ z&Tk2Wlj(uR=qcJX(W;Zin{E+Zp%C^)EdcRx8l3g=GY@w=r&2EKe3hOp=|>=u4e_r~ z`1LCmP$Oe1b6+?DFQ<_M=&|P`Yx+Mr&8X}iiqahB={OR0)jeROy;$?shfg{0@XN|T zEl(q+0O`Qz_Kv62TudrXH=G`735`^LvNqt>q`~5<4ZW^T%?NO>m>8J%FHD{EO?>;ouG@^Q*c3 zSIxtBaff>qyUAT_Ru7PjU(dhbueAsNbc1-W?X^eDyz-F^HYUZuwNbxzoLGN;QDXg( z8(k3RP3?TCIuvDg*)8}m32hs5eQ~l1{c}q@>aAwH{97pO{@fPOjmaR*>)Jb>Oi_*cii6lL zA;q9T9<_qw;y2IEPxF}#8Ohmg86b%Icog7s1icp$(lXyJNL~W^G!Nb7!5y#q;K#F{ z&E_VBh#6Cr={2^so3<|-S4`*_;2T0P&wJpaI zSIg51OXrH9?QG6e=k*P|Tp;o~XnVs5KyCt%ccB|M!66~F&l_dY`EazVTK9TF=|@i^ znNj^YS)lonDudg#M@&-VnMN4kwI!?rx&8IZr(^sy9w{t}_jN23D#}~Eji$Y>0#X@O zBr*^aVHLlBU)8Zn1CpH6X`sMM2wF0J_$vM2Gvz+CzMe=% zV*mAU8WE+@b7-jhneSa8_#v_r8he~v6;~c9wP?NjM+yd~k#AEz{*^I(C)5gL1^GAyx9}Y5C zDA4c$tt<`aDht2{muj!iWUbigS=K+mPLBhpT?#Q3k}O560Y`94Q+vkDtTjt-V0R1fgPci2nmQeMndq1rWoeRuHuEHCmWZGxB|6%A37b(-yy7rwR}n}}B*5F|oh&Pv z7)52ghL_SznY_-6)$TU4f9~__|A)hS&Uqd<@9+EheguSDucvj*i4N;k)8aFq42~n> zXPA`71i01h2-Xv!|9u*Nx2qCrmTuRrIUNSVk_# zop*<({jd~0rhCs;vtzQ|5NuFWxe=d$LqFSz`509y_D#0QLfAnen6zS_(h@6MC{qzJ z)D1n<(L3-bUW{L6f!2lD1N`U(IGqkU!o{fc!pDi79SIhg+?uuMer7n5ceF-srp~Z|*wIhEAb~cjl@~t#b zWtV`Af#WbWurB|8Uc4GZ4Q(TZUEF(_BCC11PBkYl6|nQB3_!aa;D3v#E$zyKs2~k( zQ|lZ(?CB0l;K@$#!(v=j^Xr zHPyz*Pc2g*$G_Uk;JkK@V?UQk1urR6%7dzTC8}q1{MXF1go|*0-s%hfLc39jV|>5| z>`ffH94Z!d80D=fjQz!-Rf78Fx}w&guj|+6u=7qla(;;tYER|K)_ zmDgqAfFc)u>nZ_=oDeZI&q{UX`Ymh7_DZ$3qLN@qhV<;*_+;JN-yjh}F#e2kkQ*r8J z;q&IuDVPidN@#@$N)pilskzvS+kcM2lYAa-1Fk2W=V(n5UBQB{bdNyYAi3!s>Xl2{ z$uAb-Q;PyeQYHEPrs}PNrEW-!318IdWIy5m~ zUz)sU(v}^_Kxj?Iovxbtb{Jj2gCz~+n1)!YruVh9TyGmncY5+-TUAAwJsj>OCFir8 z%1|8d8JcOF^59%yNG``^Y%Q{9auAm(*MS|$j18?dqm`pZwsH!itWp}UdUj5BL4C`i zGyo@@ouOsi{8ZDlwZ6e%lgPiMM%Q6a9u63cK=)$+7IwQ_Zv+G+Pde=C=7A1LI_ zsi_lPhKAks@#4Cp^>xeFHOLR!`U_wS`q5Z-^1zP)BX{E2aXq>Bi^AEVm@Nu0!jYNA zydyiL8^-iC{sGNc+EJT@Y2wztM}eNYDkVFKYCR1sgx-`eTOjQ7S{qUWM5X{7+RU|C zn*~R1b>P#n*#G$05t$6U$t8kcpcGB38>{rzt=&az+;D+B;rEt20)HVlU0a6+2|Ne? zM(_Se%apiKXJ_TYyh#J@edYHZPxOED-~5kApbvaRzq__S=zn5xI$&P>&YK4~qCZ&b zh9b;C$n?QEXM}p1?B*@b_1_lVa>ncTvb&+i?e9+m3P4&Ze_i}&J!A*V!^3R$J0|l% z*Dc{{r$z%PzjpU1_rZzCrBpMG2JlOJnBdLorhoJgnrt`DNCyVPbsla Date: Tue, 27 Oct 2020 13:11:00 +0100 Subject: [PATCH 005/258] Update container-runtimes.md --keyring option to apt-key must come before the "add" command. Otherwise this step will fail (verified on Ubuntu 20.04.1 LTS). --- .../en/docs/setup/production-environment/container-runtimes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/setup/production-environment/container-runtimes.md b/content/en/docs/setup/production-environment/container-runtimes.md index ae67726b8e..ffc5d12293 100644 --- a/content/en/docs/setup/production-environment/container-runtimes.md +++ b/content/en/docs/setup/production-environment/container-runtimes.md @@ -102,7 +102,7 @@ sudo apt-get update && sudo apt-get install -y apt-transport-https ca-certificat ```shell ## Add Docker's official GPG key -curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add --keyring /etc/apt/trusted.gpg.d/docker.gpg - +curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key --keyring /etc/apt/trusted.gpg.d/docker.gpg add - ``` ```shell From 4adea80ff8df94163796e80f68bcd1ec1b61334c Mon Sep 17 00:00:00 2001 From: Michael Hofer Date: Thu, 29 Oct 2020 10:58:05 +0100 Subject: [PATCH 006/258] Docs: Add containerd setup instructions for Ubuntu 18.04/20.04 --- .../container-runtimes.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/content/en/docs/setup/production-environment/container-runtimes.md b/content/en/docs/setup/production-environment/container-runtimes.md index ffc5d12293..5f408161fc 100644 --- a/content/en/docs/setup/production-environment/container-runtimes.md +++ b/content/en/docs/setup/production-environment/container-runtimes.md @@ -124,6 +124,24 @@ sudo mkdir -p /etc/containerd sudo containerd config default > /etc/containerd/config.toml ``` +```shell +# Restart containerd +sudo systemctl restart containerd +``` +{{% /tab %}} +{{% tab name="Ubuntu 18.04/20.04" %}} + +```shell +# (Install containerd) +sudo apt-get update && sudo apt-get install -y containerd +``` + +```shell +# Configure containerd +sudo mkdir -p /etc/containerd +sudo containerd config default > /etc/containerd/config.toml +``` + ```shell # Restart containerd sudo systemctl restart containerd From 1890273af0200b60cefd3c4f06a2369f4c107f45 Mon Sep 17 00:00:00 2001 From: "Anna Jung (VMware)" Date: Mon, 23 Nov 2020 15:45:01 -0600 Subject: [PATCH 007/258] Update documenting a feature for a release doc Signed-off-by: Anna Jung (VMware) --- .../contribute/new-content/new-features.md | 31 +++++++++++-------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/content/en/docs/contribute/new-content/new-features.md b/content/en/docs/contribute/new-content/new-features.md index 4e70f6c9ec..a0e3600562 100644 --- a/content/en/docs/contribute/new-content/new-features.md +++ b/content/en/docs/contribute/new-content/new-features.md @@ -95,14 +95,16 @@ deadlines. ### Open a placeholder PR -1. Open a pull request against the +1. Open a **draft** pull request against the `dev-{{< skew nextMinorVersion >}}` branch in the `kubernetes/website` repository, with a small -commit that you will amend later. +commit that you will amend later. To create a draft pull request, use the +Create Pull Request drop-down and select **Create Draft Pull Request**, +then click **Draft Pull Request**. 2. Edit the pull request description to include links to [kubernetes/kubernetes](https://github.com/kubernetes/kubernetes) PR(s) and [kubernetes/enhancements](https://github.com/kubernetes/enhancements) issue(s). -3. Use the Prow command `/milestone {{< skew nextMinorVersion >}}` to -assign the PR to the relevant milestone. This alerts the docs person managing -this release that the feature docs are coming. +3. Leave a comment on the related [kubernetes/enhancements](https://github.com/kubernetes/enhancements) +issue with a link to the PR to notify the docs person managing this release that +the feature docs are coming and should be tracked for the release. If your feature does not need any documentation changes, make sure the sig-release team knows this, by @@ -112,7 +114,9 @@ milestone. ### PR ready for review -When ready, populate your placeholder PR with feature documentation. +When ready, populate your placeholder PR with feature documentation and change +the state of the PR from draft to **ready for review**. To mark a pull request +as ready for review, navigate to the merge box and click **Ready for review**. Do your best to describe your feature and how to use it. If you need help structuring your documentation, ask in the `#sig-docs` slack channel. @@ -120,6 +124,13 @@ When you complete your content, the documentation person assigned to your featur To ensure technical accuracy, the content may also require a technical review from corresponding SIG(s). Use their suggestions to get the content to a release ready state. +If your feature is an Alpha or Beta feature and is behind a feature gate, +make sure you add it to [Alpha/Beta Feature gates](/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features) +table as part of your pull request. With new feature gates, a description of +the feature gate is also required. If your feature is GA'ed or deprecated, +make sure to move it from that table to [Feature gates for graduated or deprecated features](/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-graduated-or-deprecated-features) +table with Alpha and Beta history intact. + If your feature needs documentation and the first draft content is not received, the feature may be removed from the milestone. @@ -128,10 +139,4 @@ content is not received, the feature may be removed from the milestone. If your PR has not yet been merged into the `dev-{{< skew nextMinorVersion >}}` branch by the release deadline, work with the docs person managing the release to get it in by the deadline. If your feature needs documentation and the docs are not ready, the feature may be removed from the -milestone. - -If your feature is an Alpha feature and is behind a feature gate, make sure you -add it to [Alpha/Beta Feature gates](/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-alpha-or-beta-features) table -as part of your pull request. If your feature is moving out of Alpha, make sure to -remove it from that table. - +milestone. \ No newline at end of file From 2abce40d0886e0c48028b4588b2292d475f1a4ac Mon Sep 17 00:00:00 2001 From: RA489 Date: Tue, 17 Nov 2020 17:01:05 +0530 Subject: [PATCH 008/258] add code formatting to commands in expose-external-ip-address tutorial --- .../expose-external-ip-address.md | 124 +++++++++--------- 1 file changed, 65 insertions(+), 59 deletions(-) diff --git a/content/en/docs/tutorials/stateless-application/expose-external-ip-address.md b/content/en/docs/tutorials/stateless-application/expose-external-ip-address.md index 5babc2c0b0..958d892485 100644 --- a/content/en/docs/tutorials/stateless-application/expose-external-ip-address.md +++ b/content/en/docs/tutorials/stateless-application/expose-external-ip-address.md @@ -9,12 +9,8 @@ weight: 10 This page shows how to create a Kubernetes Service object that exposes an external IP address. - - - ## {{% heading "prerequisites" %}} - * Install [kubectl](/docs/tasks/tools/install-kubectl/). * Use a cloud provider like Google Kubernetes Engine or Amazon Web Services to @@ -25,19 +21,12 @@ external IP address. * Configure `kubectl` to communicate with your Kubernetes API server. For instructions, see the documentation for your cloud provider. - - - ## {{% heading "objectives" %}} - * Run five instances of a Hello World application. * Create a Service object that exposes an external IP address. * Use the Service object to access the running application. - - - ## Creating a service for an application running in five pods @@ -50,37 +39,46 @@ external IP address. kubectl apply -f https://k8s.io/examples/service/load-balancer-example.yaml ``` - The preceding command creates a - {{< glossary_tooltip text="Deployment" term_id="deployment" >}} - and an associated - {{< glossary_tooltip term_id="replica-set" text="ReplicaSet" >}}. - The ReplicaSet has five - {{< glossary_tooltip text="Pods" term_id="pod" >}} - each of which runs the Hello World application. +{{< glossary_tooltip text="Deployment" term_id="deployment" >}} +and an associated +{{< glossary_tooltip term_id="replica-set" text="ReplicaSet" >}}. +The ReplicaSet has five +{{< glossary_tooltip text="Pods" term_id="pod" >}} +each of which runs the Hello World application. 1. Display information about the Deployment: - kubectl get deployments hello-world - kubectl describe deployments hello-world + ```shell + kubectl get deployments hello-world + kubectl describe deployments hello-world + ``` 1. Display information about your ReplicaSet objects: - kubectl get replicasets - kubectl describe replicasets + ```shell + kubectl get replicasets + kubectl describe replicasets + ``` 1. Create a Service object that exposes the deployment: - kubectl expose deployment hello-world --type=LoadBalancer --name=my-service + ```shell + kubectl expose deployment hello-world --type=LoadBalancer --name=my-service + ``` 1. Display information about the Service: - kubectl get services my-service + ```shell + kubectl get services my-service + ``` The output is similar to this: - NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE - my-service LoadBalancer 10.3.245.137 104.198.205.71 8080/TCP 54s + ``` + NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE + my-service LoadBalancer 10.3.245.137 104.198.205.71 8080/TCP 54s + ``` {{< note >}} @@ -96,23 +94,27 @@ The preceding command creates a 1. Display detailed information about the Service: - kubectl describe services my-service + ```shell + kubectl describe services my-service + ``` The output is similar to this: - Name: my-service - Namespace: default - Labels: app.kubernetes.io/name=load-balancer-example - Annotations: - Selector: app.kubernetes.io/name=load-balancer-example - Type: LoadBalancer - IP: 10.3.245.137 - LoadBalancer Ingress: 104.198.205.71 - Port: 8080/TCP - NodePort: 32377/TCP - Endpoints: 10.0.0.6:8080,10.0.1.6:8080,10.0.1.7:8080 + 2 more... - Session Affinity: None - Events: + ``` + Name: my-service + Namespace: default + Labels: app.kubernetes.io/name=load-balancer-example + Annotations: + Selector: app.kubernetes.io/name=load-balancer-example + Type: LoadBalancer + IP: 10.3.245.137 + LoadBalancer Ingress: 104.198.205.71 + Port: 8080/TCP + NodePort: 32377/TCP + Endpoints: 10.0.0.6:8080,10.0.1.6:8080,10.0.1.7:8080 + 2 more... + Session Affinity: None + Events: + ``` Make a note of the external IP address (`LoadBalancer Ingress`) exposed by your service. In this example, the external IP address is 104.198.205.71. @@ -124,21 +126,27 @@ The preceding command creates a addresses of the pods that are running the Hello World application. To verify these are pod addresses, enter this command: - kubectl get pods --output=wide + ```shell + kubectl get pods --output=wide + ``` The output is similar to this: - NAME ... IP NODE - hello-world-2895499144-1jaz9 ... 10.0.1.6 gke-cluster-1-default-pool-e0b8d269-1afc - hello-world-2895499144-2e5uh ... 10.0.1.8 gke-cluster-1-default-pool-e0b8d269-1afc - hello-world-2895499144-9m4h1 ... 10.0.0.6 gke-cluster-1-default-pool-e0b8d269-5v7a - hello-world-2895499144-o4z13 ... 10.0.1.7 gke-cluster-1-default-pool-e0b8d269-1afc - hello-world-2895499144-segjf ... 10.0.2.5 gke-cluster-1-default-pool-e0b8d269-cpuc + ``` + NAME ... IP NODE + hello-world-2895499144-1jaz9 ... 10.0.1.6 gke-cluster-1-default-pool-e0b8d269-1afc + hello-world-2895499144-2e5uh ... 10.0.1.8 gke-cluster-1-default-pool-e0b8d269-1afc + hello-world-2895499144-9m4h1 ... 10.0.0.6 gke-cluster-1-default-pool-e0b8d269-5v7a + hello-world-2895499144-o4z13 ... 10.0.1.7 gke-cluster-1-default-pool-e0b8d269-1afc + hello-world-2895499144-segjf ... 10.0.2.5 gke-cluster-1-default-pool-e0b8d269-cpuc + ``` 1. Use the external IP address (`LoadBalancer Ingress`) to access the Hello World application: - curl http://: + ```shell + curl http://: + ``` where `` is the external IP address (`LoadBalancer Ingress`) of your Service, and `` is the value of `Port` in your Service @@ -148,29 +156,27 @@ The preceding command creates a The response to a successful request is a hello message: - Hello Kubernetes! - - - + ```shell + Hello Kubernetes! + ``` ## {{% heading "cleanup" %}} - To delete the Service, enter this command: - kubectl delete services my-service +```shell +kubectl delete services my-service +``` To delete the Deployment, the ReplicaSet, and the Pods that are running the Hello World application, enter this command: - kubectl delete deployment hello-world - - - +```shell +kubectl delete deployment hello-world +``` ## {{% heading "whatsnext" %}} - Learn more about [connecting applications with services](/docs/concepts/services-networking/connect-applications-service/). From df69d3c35448a7a3a186a7960f7991523df6d0f1 Mon Sep 17 00:00:00 2001 From: Shekhar Prasad Rajak Date: Thu, 26 Nov 2020 12:09:55 +0530 Subject: [PATCH 009/258] Cron schedule syntax and examples added removed the reboot entry, since it is non standard scheudle syntax and not related to cron syntax for scheduling --- .../workloads/controllers/cron-jobs.md | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/content/en/docs/concepts/workloads/controllers/cron-jobs.md b/content/en/docs/concepts/workloads/controllers/cron-jobs.md index af12bcba25..8e5b9fb4e3 100644 --- a/content/en/docs/concepts/workloads/controllers/cron-jobs.md +++ b/content/en/docs/concepts/workloads/controllers/cron-jobs.md @@ -51,6 +51,37 @@ This example CronJob manifest prints the current time and a hello message every ([Running Automated Tasks with a CronJob](/docs/tasks/job/automated-tasks-with-cron-jobs/) takes you through this example in more detail). +### Cron schedule syntax + +``` +# ┌───────────── minute (0 - 59) +# │ ┌───────────── hour (0 - 23) +# │ │ ┌───────────── day of the month (1 - 31) +# │ │ │ ┌───────────── month (1 - 12) +# │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday; +# │ │ │ │ │ 7 is also Sunday on some systems) +# │ │ │ │ │ +# │ │ │ │ │ +# * * * * * +``` + + +| Entry | Description | Equivalent to | +| ------------- | ------------- |------------- | +| @yearly (or @annually) | Run once a year at midnight of 1 January | 0 0 1 1 * | +| @monthly | Run once a month at midnight of the first day of the month | 0 0 1 * * | +| @weekly | Run once a week at midnight on Sunday morning | 0 0 * * 0 | +| @daily (or @midnight) | Run once a day at midnight | 0 0 * * * | +| @hourly | Run once an hour at the beginning of the hour | 0 * * * * | + + + +For example, the line below states that the task must be started every Friday at midnight, as well as on the 13th of each month at midnight: + +`0 0 13 * 5` + +To generate CronJob schedule expressions, you can also use web tools like [crontab.guru](https://crontab.guru/). + ## CronJob limitations {#cron-job-limitations} A cron job creates a job object _about_ once per execution time of its schedule. We say "about" because there From e651788efd11c9cc708ea6809f7b7367dabef15c Mon Sep 17 00:00:00 2001 From: Charle Demers Date: Thu, 3 Dec 2020 14:30:43 -0500 Subject: [PATCH 010/258] Update port-forward-access-application-cluster.md Add documentation about the simplified port mapping notation --- ...port-forward-access-application-cluster.md | 20 +++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md b/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md index 3eceb4f6d2..53dd3f3ce8 100644 --- a/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md +++ b/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md @@ -158,8 +158,8 @@ for database debugging. Any of the above commands works. The output is similar to this: ``` - I0710 14:43:38.274550 3655 portforward.go:225] Forwarding from 127.0.0.1:7000 -> 6379 - I0710 14:43:38.274797 3655 portforward.go:225] Forwarding from [::1]:7000 -> 6379 + Forwarding from 127.0.0.1:7000 -> 6379 + Forwarding from [::1]:7000 -> 6379 ``` 2. Start the Redis command line interface: @@ -180,7 +180,23 @@ for database debugging. PONG ``` +### Optionaly let _kubectl_ choose the local port +If you don't need a specific local port, you can let `kubectl` choose and allocate +the local port and thus relieve you from having to manage local port conflicts, with +the slightly simpler syntax: + +```shell +kubectl port-forward deployment/redis-master :6379 +``` + +An allocated local port in the upper range will be displayed as a result, the output +will be similar to this: + +``` +Forwarding from 127.0.0.1:62162 -> 6379 +Forwarding from [::1]:62162 -> 6379 +``` From 619eb0057549c444c5b6b09aef2cbe50e2b0f887 Mon Sep 17 00:00:00 2001 From: Sangam Biradar Date: Fri, 4 Dec 2020 05:00:46 +0530 Subject: [PATCH 011/258] Update cheatsheet.md --- content/en/docs/reference/kubectl/cheatsheet.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/docs/reference/kubectl/cheatsheet.md b/content/en/docs/reference/kubectl/cheatsheet.md index 8ff32aa54e..f8fb721ed4 100644 --- a/content/en/docs/reference/kubectl/cheatsheet.md +++ b/content/en/docs/reference/kubectl/cheatsheet.md @@ -390,6 +390,7 @@ Verbosity | Description `--v=2` | Useful steady state information about the service and important log messages that may correlate to significant changes in the system. This is the recommended default log level for most systems. `--v=3` | Extended information about changes. `--v=4` | Debug level verbosity. +`--v=5` | Trace level verbosity. `--v=6` | Display requested resources. `--v=7` | Display HTTP request headers. `--v=8` | Display HTTP request contents. From 36ab3f3faecbc3f5431629df8a17392e5e67150f Mon Sep 17 00:00:00 2001 From: Charle Demers Date: Fri, 4 Dec 2020 10:33:56 -0500 Subject: [PATCH 012/258] Update content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md Co-authored-by: Tim Bannister --- .../port-forward-access-application-cluster.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md b/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md index 53dd3f3ce8..eb37432feb 100644 --- a/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md +++ b/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md @@ -180,7 +180,7 @@ for database debugging. PONG ``` -### Optionaly let _kubectl_ choose the local port +### Optionally let _kubectl_ choose the local port {#let-kubectl-choose-local-port} If you don't need a specific local port, you can let `kubectl` choose and allocate the local port and thus relieve you from having to manage local port conflicts, with @@ -219,4 +219,3 @@ The support for UDP protocol is tracked in ## {{% heading "whatsnext" %}} Learn more about [kubectl port-forward](/docs/reference/generated/kubectl/kubectl-commands/#port-forward). - From 590cac5fb53d10a3cf6e2e1e32f801a53db4b211 Mon Sep 17 00:00:00 2001 From: Charle Demers Date: Fri, 4 Dec 2020 10:35:39 -0500 Subject: [PATCH 013/258] Update content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md Co-authored-by: Tim Bannister --- .../port-forward-access-application-cluster.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md b/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md index eb37432feb..1a6cb26711 100644 --- a/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md +++ b/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md @@ -190,8 +190,8 @@ the slightly simpler syntax: kubectl port-forward deployment/redis-master :6379 ``` -An allocated local port in the upper range will be displayed as a result, the output -will be similar to this: +The `kubectl` tool finds a local port number that is not in use (avoiding low ports numbers, +because these might be used by other applications). The output is similar to: ``` Forwarding from 127.0.0.1:62162 -> 6379 From f6b254cf17fc1c58cfe198b7a41fce82dc6ff1ea Mon Sep 17 00:00:00 2001 From: jiazxjason <52809535+jiazxjason@users.noreply.github.com> Date: Tue, 8 Dec 2020 14:49:57 +0800 Subject: [PATCH 014/258] Update configure-pod-configmap.md --- .../tasks/configure-pod-container/configure-pod-configmap.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/tasks/configure-pod-container/configure-pod-configmap.md b/content/zh/docs/tasks/configure-pod-container/configure-pod-configmap.md index 4e8a745908..2399e89ad7 100644 --- a/content/zh/docs/tasks/configure-pod-container/configure-pod-configmap.md +++ b/content/zh/docs/tasks/configure-pod-container/configure-pod-configmap.md @@ -814,9 +814,9 @@ Kubernetes v1.6 和更高版本支持此功能。 ## 在 Pod 命令中使用 ConfigMap 定义的环境变量 -你可以使用 `$(VAR_NAME)` Kubernetes 替换语法在 Pod 规约的 `command` 部分中使用 ConfigMap 定义的环境变量。 +你可以使用 `$(VAR_NAME)` Kubernetes 替换语法在容器的 `command` 和 `args` 部分中使用 ConfigMap 定义的环境变量。 ## 恢复 etcd 集群 @@ -404,6 +417,18 @@ etcd 支持从 [major.minor](http://semver.org/) 或其他不同 patch 版本的 如果大多数 etcd 成员永久失败，则认为 etcd 集群失败。在这种情况下，Kubernetes 不能对其当前状态进行任何更改。 虽然已调度的 pod 可能继续运行，但新的 pod 无法调度。在这种情况下，恢复 etcd 集群并可能需要重新配置 Kubernetes API 服务器以修复问题。 +{{< note >}} +如果集群中正在运行任何 API 服务器，则不应尝试还原 etcd 的实例。相反，请按照以下步骤还原 etcd： + +- 停止 *所有* kube-apiserver 实例 +- 在所有 etcd 实例中恢复状态 +- 重启所有 kube-apiserver 实例 + +我们还建议任何组件（例如 kube-scheduler，kube-controller-manager，kubelet），以确保它们不会 +依赖一些过时的数据。请注意，实际中还原会花费一些时间。 +在还原过程中，关键组件将丢失领导锁并自行重启。 +{{< note >}} + -4. 超出终止宽限期线时，`kubelet` 会触发强制关闭过程。容器运行时会向 Pod 中所有容器内 +4. 超出终止宽限期限时，`kubelet` 会触发强制关闭过程。容器运行时会向 Pod 中所有容器内 仍在运行的进程发送 `SIGKILL` 信号。 `kubelet` 也会清理隐藏的 `pause` 容器，如果容器运行时使用了这种容器的话。 From 0c36d6b6b54f3102df9958f6846858c62f817b19 Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Wed, 9 Dec 2020 14:56:49 +0800 Subject: [PATCH 025/258] Create 2019-10-29-2019-sig-docs-survey.md --- .../_posts/2019-10-29-2019-sig-docs-survey.md | 283 ++++++++++++++++++ 1 file changed, 283 insertions(+) create mode 100644 content/zh/blog/_posts/2019-10-29-2019-sig-docs-survey.md diff --git a/content/zh/blog/_posts/2019-10-29-2019-sig-docs-survey.md b/content/zh/blog/_posts/2019-10-29-2019-sig-docs-survey.md new file mode 100644 index 0000000000..3fc5bfa360 --- /dev/null +++ b/content/zh/blog/_posts/2019-10-29-2019-sig-docs-survey.md @@ -0,0 +1,283 @@ +--- +layout: blog +title: "Kubernetes 文献调查" +date: 2019-10-29 +slug: kubernetes-documentation-end-user-survey +--- + + +**Author:** [Aimee Ukasick](https://www.linkedin.com/in/aimee-ukasick/) and SIG Docs + + +9月，SIG Docs 进行了第一次关于 [Kubernetes 调查文件](https://kubernetes.io/docs/) 。我们要感谢 CNCF +的 Kim McMahon 帮助我们创建调查并获取结果。 + + +# 主要收获 + + +受访者希望能在概念、任务和参考部分得到更多示例代码、更详细的内容和更多图表。 + + +74% 的受访者希望教程部分包含高级内容。 + + +69.70% 的受访者认为 Kubernetes 文档是他们首要寻找关于 Kubernetes 资料的地方。 + + +# 调查方法和受访者 + + +我们用英语进行了调查。由于时间限制，调查的有效期只有 4 天。 +我们在 Kubernetes 邮件列表、Kubernetes Slack 频道、Twitter、Kube Weekly 上发布了我们的调查问卷。 +这份调查有 23 个问题， 受访者平均用 4 分钟完成这个调查。 + + +## 关于受访者的简要情况 + + +- 48.48% 是经验丰富的 Kubernetes 用户，26.26% 是专家，25.25% 是初学者 +- 57.58% 的人同时使用 Kubernetes 作为管理员和开发人员 +- 64.65% 的人使用 Kubernetes 文档超过 12 个月 +- 95.96% 的人阅读英文文档 + + +# 问题和回答要点 + + +## 人们为什么访问 Kubernetes 文档 + + +大多数受访者表示，他们访问文档是为了了解概念。 + +{{< figure + src="/images/blog/2019-sig-docs-survey/Q9-k8s-docs-use.png" + alt="受访者为什么访问 Kubernetes 文档" +>}} + + +这与我们在 Google Analytics 上看到的略有不同：在今年浏览量最多的10个页面中，第一是在参考部分的 kubectl +的备忘单，其次是概念部分的页面。 + + +## 对文档的满意程度 + + +我们要求受访者从概念、任务、参考和教程部分记录他们对细节的满意度： + + +- 概念：47.96% 中等满意 +- 任务：50.54% 中等满意 +- 参考：40.86% 非常满意 +- 教程：47.25% 中等满意 + + +## SIG Docs 如何改进文档的各个部分 + + +我们询问如何改进每个部分，为受访者提供可选答案以及文本输入框。绝大多数人想要更多 +示例代码、更详细的内容、更多图表和更高级的教程： + + +```text +- 就个人而言，希望看到更多的类比，以帮助进一步理解。 +- 如果代码的相应部分也能解释一下就好了 +- 通过扩展概念把它们融合在一起 - 它们现在宛如在一桶水内朝各个方向游动的一条条鳗鱼。 +- 更多的图表，更多的示例代码 +``` + + +受访者使用“其他”文本框记录引发阻碍的区域： + + +```text +- 使概念保持最新和准确 +- 保持任务主题的最新性和准确性。亲身试验。 +- 彻底检查示例。很多时候显示的命令输出不是实际情况。 +- 我从来都不知道如何导航或解释参考部分 +- 使教程保持最新，或将其删除 +``` + + +## SIG Docs 如何全面改进文档 + + +我们询问受访者如何从整体上改进 Kubernetes 文档。一些人抓住这次机会告诉我们我们正在做一个很棒的 +工作： + + +```text +- 对我而言，这是我见过的文档最好的开源项目。 +- 继续努力！ +- 我觉得文件很好。 +- 你们做得真好。真的。 +``` + + +其它受访者提供关于内容的反馈： + + +```text +- ...但既然我们谈论的是文档，多多益善。更多的高级配置示例对我来说将是最好的选择。比如每个配置主题的用例页面，从初学者到高级示例场景。像这样的东西真的是令人惊叹...... + + +- 更深入的例子和用例将是很好的。我经常感觉 Kubernetes 文档只是触及了一个主题的表面，这可能对新用户很好，但是它没有让更有经验的用户获取多少关于如何实现某些东西的“官方”指导。 + + +- 资源节（特别是 secrets）希望有更多类似于产品的示例或指向类似产品的示例的链接 + + +- 如果能像很多其它技术项目那样有非常清晰的“快速启动” 逐步教学完成搭建就更好了。 + 现有的快速入门内容屈指可数，也没有统一的指南。结果是信息泛滥。 +``` + + +少数受访者提供的技术建议： +```text +- 使用 ReactJS 或者 Angular component 使表的列可排序和可筛选。 + + +- 对于大多数人来说，我认为用 Hugo - 一个静态站点生成系统 - 创建文档是不合适的。有更好的系统来记录大型软件项目。 + + +具体来说，我希望看到 k8s 切换到 Sphinx 来获取文档。Sphinx 有一个很好的内置搜索。 +如果你了解 markdown，学习起来也很容易。 +Sphinx 被其他项目广泛采用（例如，在 readthedocs.io、linux kernel、docs.python.org 等等）。 +``` + + +总体而言，受访者提供了建设性的批评，其关注点是高级用例以及更深入的示例、指南和演练。 + + +# 哪里可以看到更多 + + +调查结果摘要、图表和原始数据可在 `kubernetes/community` sig-docs +[survey](https://github.com/kubernetes/community/tree/master/sig-docs/survey) +目录下。 From e491bb3ff533daccd22c7e5a6c96e0c341fb53bc Mon Sep 17 00:00:00 2001 From: jiazxjason <52809535+jiazxjason@users.noreply.github.com> Date: Wed, 9 Dec 2020 15:49:31 +0800 Subject: [PATCH 026/258] Update enabling-endpointslices.md --- .../enabling-endpointslices.md | 53 +++++++++++++++---- 1 file changed, 42 insertions(+), 11 deletions(-) diff --git a/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md b/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md index cf36557dd6..e5cd748723 100644 --- a/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md +++ b/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md @@ -50,13 +50,15 @@ EndpointSlice （端点切片）为 Kubernetes Endpoints 提供了可伸缩和 {{< note >}} -尽管 EndpointSlice 最终可能会取代 Endpoints，但许多 Kubernetes 组件仍然依赖于 -Endpoints。目前，启用 EndpointSlice 应该被视为集群中 Endpoints 的补充，而不是 -替代它们。 +EndpointSlice 资源旨在解决较早资源：Endpoints 中的缺点。一些 Kubernetes 组件和第三方应用程序 +继续使用并依赖 Endpoints。虽然仍然如此，应该将 EndpointSlices 视为集群中 Endpoints 的补充，而不是 +彻底替代。 {{< /note >}} +## API 字段 + +EndpointSlice API 中的某些字段具有特征门控。 + +- `EndpointSliceNodeName` 特征门控控制对 `nodeName` 字段的访问。这是默认情况下禁用的 Alpha 功能。 +- `EndpointSliceTerminating` 特征门控控制对 `serving` 和 `terminating` 条件字段的访问。这是默认情况下禁用的 Alpha 功能。 + ## 使用 EndpointSlice 在集群中完全启用 EndpointSlice 的情况下，你应该看到对应于每个 Endpoints 资源的 EndpointSlice 资源。除了支持现有的 Endpoints 功能外， -EndpointSlice 还引入了拓扑结构等新的信息。它们将使集群中网络端点具有更强的 -可伸缩性和可扩展性。 +EndpointSlices 将允许集群中网络端点更大的的可伸缩性和可扩展性。 + +## {{% heading "whatsnext" %}} + + +* 参阅 [EndpointSlices](/docs/concepts/services-networking/endpoint-slices/) +* 参阅 [Connecting Applications with Services](/docs/concepts/services-networking/connect-applications-service/) From 1dcdd6a406b53b6789295e9dbdaafed218bde1d2 Mon Sep 17 00:00:00 2001 From: jiajie Date: Tue, 8 Dec 2020 13:03:29 +0800 Subject: [PATCH 027/258] Update kubernetes-api.md --- .../generate-ref-docs/kubernetes-api.md | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/content/zh/docs/contribute/generate-ref-docs/kubernetes-api.md b/content/zh/docs/contribute/generate-ref-docs/kubernetes-api.md index c000bff384..b0eb61a197 100644 --- a/content/zh/docs/contribute/generate-ref-docs/kubernetes-api.md +++ b/content/zh/docs/contribute/generate-ref-docs/kubernetes-api.md @@ -123,7 +123,7 @@ Go to ``, and open the `Makefile` for editing: * Set `K8S_ROOT` to ``. * Set `K8S_WEBROOT` to ``. * Set `K8S_RELEASE` to the minor version of the docs you want to build. - For example, if you want to build docs for Kubernetes 1.17, set `K8S_RELEASE` to 1.17. +For example, if you want to build docs for Kubernetes 1.17, set `K8S_RELEASE` to 1.17. --> * 设置 `K8S_ROOT` 为 ``. * 设置 `K8S_WEBROOT` 为 ``. @@ -155,7 +155,13 @@ The versioned directory name follows the pattern of `v_`. 这些步骤确保配置文件的版本和 Kubernetes OpenAPI 规范的版本与发行版本匹配。 版本化目录的名称形式为 `v_`。 + +在 '' 目录中，运行以下命令来构建： + ```shell +cd make updateapispec ``` @@ -257,16 +263,17 @@ version number. ## Locally test the API reference Publish a local version of the API reference. -Verify the [local preview](http://localhost:1313/docs/reference/generated/kubernetes-api/v1.15/). +Verify the [local preview](http://localhost:1313/docs/reference/generated/kubernetes-api/{{< param "version">}}/). --> ## 在本地测试 API 参考 发布 API 参考的本地版本。 -检查[本地预览](http://localhost:1313/docs/reference/generated/kubernetes-api/v1.15/)。 +检查[本地预览](http://localhost:1313/docs/reference/generated/kubernetes-api/{{< param "version">}}/)。 ```shell cd -make docker-serve +git submodule update --init --recursive --depth 1 # if not already done +make container-serve ``` ([#96443](https://github.com/kubernetes/kubernetes/pull/96443), [@alaypatel07](https://github.com/alaypatel07)) [SIG Apps] +- Handle slow cronjob lister in cronjob controller v2 and improve memory footprint. ([#96443](https://github.com/kubernetes/kubernetes/pull/96443), [@alaypatel07](https://github.com/alaypatel07)) [SIG Apps] - --redirect-container-streaming is no longer functional. The flag will be removed in v1.22 ([#95935](https://github.com/kubernetes/kubernetes/pull/95935), [@tallclair](https://github.com/tallclair)) [SIG Node] - A new metric `requestAbortsTotal` has been introduced that counts aborted requests for each `group`, `version`, `verb`, `resource`, `subresource` and `scope`. ([#95002](https://github.com/kubernetes/kubernetes/pull/95002), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery, Cloud Provider, Instrumentation and Scheduling] - API priority and fairness metrics use snake_case in label names ([#96236](https://github.com/kubernetes/kubernetes/pull/96236), [@adtac](https://github.com/adtac)) [SIG API Machinery, Cluster Lifecycle, Instrumentation and Testing] @@ -1350,23 +1334,7 @@ filename | sha512 hash ### Deprecation -- **Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.**: - - ([#95856](https://github.com/kubernetes/kubernetes/pull/95856), [@knight42](https://github.com/knight42)) [SIG API Machinery, Node and Testing] +- ACTION REQUIRED: The kube-apiserver ability to serve on an insecure port, deprecated since v1.10, has been removed. The insecure address flags `--address` and `--insecure-bind-address` have no effect in kube-apiserver and will be removed in v1.24. The insecure port flags `--port` and `--insecure-port` may only be set to 0 and will be removed in v1.24. ([#95856](https://github.com/kubernetes/kubernetes/pull/95856), [@knight42](https://github.com/knight42)) [SIG API Machinery, Node and Testing] ### API Change @@ -1510,23 +1478,7 @@ filename | sha512 hash ### Bug or Regression -- **Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.**: - - ([#95725](https://github.com/kubernetes/kubernetes/pull/95725), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery and Cloud Provider] +- Exposes and sets a default timeout for the SubjectAccessReview client for DelegatingAuthorizationOptions. ([#95725](https://github.com/kubernetes/kubernetes/pull/95725), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery and Cloud Provider] - Alter wording to describe pods using a pvc ([#95635](https://github.com/kubernetes/kubernetes/pull/95635), [@RaunakShah](https://github.com/RaunakShah)) [SIG CLI] - If we set SelectPolicy MinPolicySelect on scaleUp behavior or scaleDown behavior,Horizontal Pod Autoscaler doesn`t automatically scale the number of pods correctly ([#95647](https://github.com/kubernetes/kubernetes/pull/95647), [@JoshuaAndrew](https://github.com/JoshuaAndrew)) [SIG Apps and Autoscaling] - Ignore apparmor for non-linux operating systems ([#93220](https://github.com/kubernetes/kubernetes/pull/93220), [@wawa0210](https://github.com/wawa0210)) [SIG Node and Windows] From 1f8df8bee8cb419c3821fcb24c436d1a9bfe8f39 Mon Sep 17 00:00:00 2001 From: Arhell Date: Thu, 10 Dec 2020 01:25:08 +0200 Subject: [PATCH 030/258] sync install-kubeadm.md --- .../production-environment/tools/kubeadm/install-kubeadm.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index cc33bbbdeb..69d3467d11 100644 --- a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -246,8 +246,8 @@ n'est pas `cgroupfs`, car c'est déjà la valeur par défaut dans la kubelet. Il est nécessaire de redémarrer la kubelet: ```bash -systemctl daemon-reload -systemctl restart kubelet +sudo systemctl daemon-reload +sudo systemctl restart kubelet ``` ## Dépannage From 96167bf99625ac9628cf3d3ea5225d8bb491b625 Mon Sep 17 00:00:00 2001 From: jiazxjason <52809535+jiazxjason@users.noreply.github.com> Date: Thu, 10 Dec 2020 08:51:13 +0800 Subject: [PATCH 031/258] Update content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md Co-authored-by: Qiming Teng --- .../zh/docs/tasks/administer-cluster/enabling-endpointslices.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md b/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md index e5cd748723..d130d920df 100644 --- a/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md +++ b/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md @@ -57,7 +57,7 @@ EndpointSlices should be seen as an addition to Endpoints in a cluster, not as an outright replacement. --> EndpointSlice 资源旨在解决较早资源：Endpoints 中的缺点。一些 Kubernetes 组件和第三方应用程序 -继续使用并依赖 Endpoints。虽然仍然如此，应该将 EndpointSlices 视为集群中 Endpoints 的补充，而不是 +继续使用并依赖 Endpoints。既然情况如此，应该将 EndpointSlices 视为集群中 Endpoints 的补充，而不是 彻底替代。 {{< /note >}} From 2cb9a3319e6c8c1e323982694670be9cf60be73d Mon Sep 17 00:00:00 2001 From: jiazxjason <52809535+jiazxjason@users.noreply.github.com> Date: Thu, 10 Dec 2020 08:51:26 +0800 Subject: [PATCH 032/258] Update content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md Co-authored-by: Qiming Teng --- .../zh/docs/tasks/administer-cluster/enabling-endpointslices.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md b/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md index d130d920df..dc14c1efbb 100644 --- a/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md +++ b/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md @@ -128,7 +128,7 @@ Some fields in the EndpointSlice API are feature-gated. --> ## API 字段 -EndpointSlice API 中的某些字段具有特征门控。 +EndpointSlice API 中的某些字段有对应的特征门控控制。 - `EndpointSliceNodeName` 特征门控控制对 `nodeName` 字段的访问。这是默认情况下禁用的 Alpha 功能。 - `EndpointSliceTerminating` 特征门控控制对 `serving` 和 `terminating` 条件字段的访问。这是默认情况下禁用的 Alpha 功能。 From 3d72f73b5f6b5a54ba8f7be635a7df42b831a814 Mon Sep 17 00:00:00 2001 From: jiazxjason <52809535+jiazxjason@users.noreply.github.com> Date: Thu, 10 Dec 2020 08:53:32 +0800 Subject: [PATCH 033/258] Update enabling-endpointslices.md --- .../tasks/administer-cluster/enabling-endpointslices.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md b/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md index dc14c1efbb..58d77ccaf7 100644 --- a/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md +++ b/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md @@ -128,10 +128,10 @@ Some fields in the EndpointSlice API are feature-gated. --> ## API 字段 -EndpointSlice API 中的某些字段有对应的特征门控控制。 +EndpointSlice API 中的某些字段有对应的特性门控控制。 - `EndpointSliceNodeName` 特征门控控制对 `nodeName` 字段的访问。这是默认情况下禁用的 Alpha 功能。 -- `EndpointSliceTerminating` 特征门控控制对 `serving` 和 `terminating` 条件字段的访问。这是默认情况下禁用的 Alpha 功能。 +- `EndpointSliceTerminating` 特征门控控制对 `serving` 和 `terminating` 状况字段的访问。这是默认情况下禁用的 Alpha 功能。 -9月，SIG Docs 进行了第一次关于 [Kubernetes 调查文件](https://kubernetes.io/docs/) 。我们要感谢 CNCF +9月，SIG Docs 进行了第一次关于 [Kubernetes 文档](https://kubernetes.io/docs/) 。我们要感谢 CNCF 的 Kim McMahon 帮助我们创建调查并获取结果。 -```text -- ...但既然我们谈论的是文档，多多益善。更多的高级配置示例对我来说将是最好的选择。比如每个配置主题的用例页面，从初学者到高级示例场景。像这样的东西真的是令人惊叹...... - -- 更深入的例子和用例将是很好的。我经常感觉 Kubernetes 文档只是触及了一个主题的表面，这可能对新用户很好，但是它没有让更有经验的用户获取多少关于如何实现某些东西的“官方”指导。 - -- 资源节（特别是 secrets）希望有更多类似于产品的示例或指向类似产品的示例的链接 - -- 如果能像很多其它技术项目那样有非常清晰的“快速启动” 逐步教学完成搭建就更好了。 - 现有的快速入门内容屈指可数，也没有统一的指南。结果是信息泛滥。 + +```text +- ...但既然我们谈论的是文档，多多益善。更多的高级配置示例对我来说将是最好的选择。比如每个配置主题的用例页面， +从初学者到高级示例场景。像这样的东西真的是令人惊叹...... +- 更深入的例子和用例将是很好的。我经常感觉 Kubernetes 文档只是触及了一个主题的表面，这可能对新用户很好， +但是它没有让更有经验的用户获取多少关于如何实现某些东西的“官方”指导。 +- 资源节（特别是 secrets）希望有更多类似于产品的示例或指向类似产品的示例的链接 +- 如果能像很多其它技术项目那样有非常清晰的“快速启动” 逐步教学完成搭建就更好了。现有的快速入门内容屈指可数， +也没有统一的指南。结果是信息泛滥。 ``` -少数受访者提供的技术建议： -```text -- 使用 ReactJS 或者 Angular component 使表的列可排序和可筛选。 - -- 对于大多数人来说，我认为用 Hugo - 一个静态站点生成系统 - 创建文档是不合适的。有更好的系统来记录大型软件项目。 - -具体来说，我希望看到 k8s 切换到 Sphinx 来获取文档。Sphinx 有一个很好的内置搜索。 -如果你了解 markdown，学习起来也很容易。 + +少数受访者提供的技术建议： +```text +- 使用 ReactJS 或者 Angular component 使表的列可排序和可筛选。 +- 对于大多数人来说，我认为用 Hugo - 一个静态站点生成系统 - 创建文档是不合适的。有更好的系统来记录大型软件项目。 +具体来说，我希望看到 k8s 切换到 Sphinx 来获取文档。Sphinx 有一个很好的内置搜索。如果你了解 markdown，学习起来也很容易。 Sphinx 被其他项目广泛采用（例如，在 readthedocs.io、linux kernel、docs.python.org 等等）。 ``` From ffa156fd755d81f987ab3cad0f208a84d7b59a76 Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Tue, 8 Dec 2020 10:22:54 +0800 Subject: [PATCH 036/258] Update expose-external-ip-address.md adjust the format to rearrange the numbered list which is not continue Update expose-external-ip-address.md Update expose-external-ip-address.md Update expose-external-ip-address.md indent by 3 spaces from line 51 to 57 --- .../expose-external-ip-address.md | 25 ++++++++----------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/content/en/docs/tutorials/stateless-application/expose-external-ip-address.md b/content/en/docs/tutorials/stateless-application/expose-external-ip-address.md index 5babc2c0b0..01bdd185a1 100644 --- a/content/en/docs/tutorials/stateless-application/expose-external-ip-address.md +++ b/content/en/docs/tutorials/stateless-application/expose-external-ip-address.md @@ -44,20 +44,17 @@ external IP address. 1. Run a Hello World application in your cluster: -{{< codenew file="service/load-balancer-example.yaml" >}} - -```shell -kubectl apply -f https://k8s.io/examples/service/load-balancer-example.yaml -``` - - -The preceding command creates a - {{< glossary_tooltip text="Deployment" term_id="deployment" >}} - and an associated - {{< glossary_tooltip term_id="replica-set" text="ReplicaSet" >}}. - The ReplicaSet has five - {{< glossary_tooltip text="Pods" term_id="pod" >}} - each of which runs the Hello World application. + {{< codenew file="service/load-balancer-example.yaml" >}} + ```shell + kubectl apply -f https://k8s.io/examples/service/load-balancer-example.yaml + ``` + The preceding command creates a + {{< glossary_tooltip text="Deployment" term_id="deployment" >}} + and an associated + {{< glossary_tooltip term_id="replica-set" text="ReplicaSet" >}}. + The ReplicaSet has five + {{< glossary_tooltip text="Pods" term_id="pod" >}} + each of which runs the Hello World application. 1. Display information about the Deployment: From f6ebf084a9ea2cf3d9898fe0c7e9a7f0a4bcb05a Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Thu, 10 Dec 2020 15:33:16 +0800 Subject: [PATCH 037/258] Create 2016-02-00-kubernetes-community-meeting-notes_23.md --- ...0-kubernetes-community-meeting-notes_23.md | 136 ++++++++++++++++++ 1 file changed, 136 insertions(+) create mode 100644 content/zh/blog/_posts/2016-02-00-kubernetes-community-meeting-notes_23.md diff --git a/content/zh/blog/_posts/2016-02-00-kubernetes-community-meeting-notes_23.md b/content/zh/blog/_posts/2016-02-00-kubernetes-community-meeting-notes_23.md new file mode 100644 index 0000000000..4b1f80917c --- /dev/null +++ b/content/zh/blog/_posts/2016-02-00-kubernetes-community-meeting-notes_23.md @@ -0,0 +1,136 @@ +--- +title: " Kubernetes 社区会议记录 - 20160218 " +date: 2016-02-23 +slug: kubernetes-community-meeting-notes_23 +url: /blog/2016/02/kubernetes-community-meeting-notes_23 +--- + + + + +##### 2月18号 - kmachine 示例，SIG 形成的 clusterops，新的 k8s.io 网站概述，更新1.2版本并且计划准备1.3版本 + + + +* 记录员: Rob Hirschfeld +* 示例 (10 min): [kmachine][1] [Sebastien Goasguen] + * 开始 :01 视频介绍 + * 为 Kubernetes 创建 Docker tools 的镜像 （例如 machine,compose 等等） + * kmachine （ 它是 Docker Machine的一个分叉, 因此两者有相同的 endpoints） + + + +* 演示案例 (10 min): 开始时间 :15 + + +* SIG 汇报启动会 + * 周五进行 Cluster Ops 启动会 ([doc][2]). [Rob Hirschfeld] + + +* 时区讨论 [:22] + * 这个时区不是为亚洲服务的时区。 + * 考虑轮转时间 - 每一个月一次 + * 大约 5 或者 6 PT + * Rob 建议把例会时间上调一些 + + +* k8s.io 网站 概述 [John Mulhausen] [:27] + * 使用 github 进行文档操作。你可以通过网站进行 fork 操作并且做一个 pull request 请求 + * Google 将会提供一个 "doc bounty"，"doc bounty" 是一个让你得到 GCP 积分来为你的文档使用的地方 + * 使用 Jekyll 创建网站 (例如 the ToC) + * 100% 使用 GitHub 页面原则; 没有脚本或者插件外挂, 仅仅只有 fork/clone，edit，和 push 操作 + * 希望能在 Kubecon EU 启动 + * 主页唯一概述地址: http://kub.unitedcreations.xyz + + +* 1.2 版本观看 [T.J. Goltermann] [:38] +* 1.3 版本更新计划 [T.J. Goltermann] +* GSoC 分享会 -- 截止日期 2月19号 [Sarah Novotny] +* 3月10号 会议? [Sarah Novotny] + + +想要加入Kubernetes社区的人，考虑加入 [Slack channel] [3]频道，在 GitHub 上看看[Kubernetes project][4]，或者加入[Kubernetes-dev Google group][5] 组。 + + + +如果你对此真的充满激情，你可以做完上述所有事情并加入我们的下一次社区对话 - 在2016年2月25日。 + + +请将您自己或您想了解的主题添加到[agenda][6]，加入[this group][7]组即可获得日历邀请。 + + + +"https://youtu.be/L5BgX2VJhlY?list=PL69nYSiGNLP1pkHsbPjzAewvMgGUpkCnJ" + + +_\-- Kubernetes 社区 _ + +[1]: https://github.com/skippbox/kmachine +[2]: https://docs.google.com/document/d/1IhN5v6MjcAUrvLd9dAWtKcGWBWSaRU8DNyPiof3gYMY/edit# +[3]: http://slack.k8s.io/ +[4]: https://github.com/kubernetes/ +[5]: https://groups.google.com/forum/#!forum/kubernetes-dev +[6]: https://docs.google.com/document/d/1VQDIAB0OqiSjIHI8AWMvSdceWhnz56jNpZrLs6o7NJY/edit# +[7]: https://groups.google.com/forum/#!forum/kubernetes-community-video-chat + + From c0493466e5eea44e000a1b5d2e3b6148ad7ed55d Mon Sep 17 00:00:00 2001 From: Christophe Gasmi Date: Thu, 10 Dec 2020 09:30:06 +0100 Subject: [PATCH 038/258] Update Homepage French --- content/fr/_index.html | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/content/fr/_index.html b/content/fr/_index.html index db8c749aeb..53c11593db 100644 --- a/content/fr/_index.html +++ b/content/fr/_index.html @@ -2,6 +2,8 @@ title: "Solution professionnelle d’orchestration de conteneurs" abstract: "Déploiement, mise à l'échelle et gestion automatisée des conteneurs" cid: home +sitemap: + priority: 1.0 --- {{< blocks/section id="oceanNodes" >}} @@ -41,12 +43,12 @@ Kubernetes est une solution open-source qui vous permet de tirer parti de vos in

- Venez au KubeCon Amsterdam du 13 au 16 Aout 2020 + Venez au KubeCon NA Virtuel du 17 au 20 Novembre 2020



- Venez au KubeCon Boston du 17 au 20 Novembre 2020 + Venez au KubeCon EU Virtuel du 4 au 7 Mai 2021

@@ -56,4 +58,4 @@ Kubernetes est une solution open-source qui vous permet de tirer parti de vos in {{< blocks/kubernetes-features >}} -{{< blocks/case-studies >}} +{{< blocks/case-studies >}} \ No newline at end of file From 4a5bce92ce596d01e15d487588b98fe7b13b53e6 Mon Sep 17 00:00:00 2001 From: jiajie Date: Thu, 10 Dec 2020 17:18:03 +0800 Subject: [PATCH 039/258] Update _index.html --- .../tutorials/kubernetes-basics/_index.html | 96 +++++++++++-------- 1 file changed, 54 insertions(+), 42 deletions(-) diff --git a/content/zh/docs/tutorials/kubernetes-basics/_index.html b/content/zh/docs/tutorials/kubernetes-basics/_index.html index 39b52b2ce1..a53858ca02 100644 --- a/content/zh/docs/tutorials/kubernetes-basics/_index.html +++ b/content/zh/docs/tutorials/kubernetes-basics/_index.html @@ -1,6 +1,7 @@ --- title: 学习 Kubernetes 基础知识 linkTitle: 学习 Kubernetes 基础知识 +no_list: true weight: 10 card: name: tutorials @@ -14,7 +15,7 @@ card: - +
@@ -44,59 +45,70 @@ card:
+
+ +

Kubernetes 基础模块

-
-
- -
-
1. 创建一个 Kubernetes 集群
 +
+
+
+
+ +
+
1. 创建一个 Kubernetes 集群
 +
+
+
+
+
+ +
+
2. 部署应用程序
 +
+
+
+
+
+ +
+
3. 应用程序探索
 +
+
-
-
- -
-
2. 部署应用程序
 +
+
+
+
+ +
+
4. 应用外部可见
 +
+
-
-
-
-
- -
-
3. 应用程序探索
 +
+
+ +
+
5. 应用可扩展
 +
+
-
-
-
-
- -
-
4. 应用外部可见
 -
-
-
-
-
- -
-
5. 应用可扩展
 -
-
-
-
-
- -
-
6. 应用更新
 +
+
+ +
+
6. 应用更新
 +
+
-
+
From ed649646d2d71fe86664aeacdfc75dfc32c78ea3 Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Thu, 10 Dec 2020 19:32:54 +0800 Subject: [PATCH 040/258] Update guestbook-logs-metrics-with-elk.md (#25463) sync with english version Apply suggestions from code review Co-authored-by: Qiming Teng Co-authored-by: Qiming Teng --- .../stateless-application/guestbook-logs-metrics-with-elk.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/tutorials/stateless-application/guestbook-logs-metrics-with-elk.md b/content/zh/docs/tutorials/stateless-application/guestbook-logs-metrics-with-elk.md index d1f888475e..fb264dbeba 100644 --- a/content/zh/docs/tutorials/stateless-application/guestbook-logs-metrics-with-elk.md +++ b/content/zh/docs/tutorials/stateless-application/guestbook-logs-metrics-with-elk.md @@ -35,7 +35,8 @@ This tutorial builds upon the [PHP Guestbook with Redis](/docs/tutorials/statele 将和 Guestbook 一同部署在 Kubernetes 集群中。 Beats 收集、分析、索引数据到 Elasticsearch，使你可以用 Kibana 查看并分析得到的运营信息。 本示例由以下内容组成： - +* [带 Redis 的 PHP Guestbook 教程](/zh/docs/tutorials/stateless-application/guestbook) + 的一个实例部署 * Elasticsearch 和 Kibana * Filebeat * Metricbeat @@ -719,4 +720,4 @@ Deleting the Deployments and Services also deletes any running Pods. Use labels * 了解[监控资源的工具](/zh/docs/tasks/debug-application-cluster/resource-usage-monitoring/) * 进一步阅读[日志体系架构](/zh/docs/concepts/cluster-administration/logging/) * 进一步阅读[应用内省和调试](/zh/docs/tasks/debug-application-cluster/) -* 进一步阅读[应用程序的故障排除](/zh/docs/tasks/debug-application-cluster/resource-usage-monitoring/) \ No newline at end of file +* 进一步阅读[应用程序的故障排除](/zh/docs/tasks/debug-application-cluster/resource-usage-monitoring/) From c1f0328e6b42a3f176d332a907a9bff0337fdff2 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Tue, 8 Dec 2020 11:54:35 +0530 Subject: [PATCH 041/258] Squashing & Minor markdown changes --- ...-and-Short-lived-Volumes-in-CSI-Drivers.md | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 content/en/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md diff --git a/content/en/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md b/content/en/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md new file mode 100644 index 0000000000..ef20ad5210 --- /dev/null +++ b/content/en/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md @@ -0,0 +1,53 @@ +--- +layout: blog +title: 'Kubernetes 1.20: Pod Impersonation and Short-lived Volumes in CSI Drivers' +date: 2020-12-18 +slug: kubernetes-1.20-pod-impersonation-short-lived-volumes-in-csi +--- + +**Author**: Shihang Zhang (Google) + +Typically when a [CSI](https://github.com/container-storage-interface/spec/blob/baa71a34651e5ee6cb983b39c03097d7aa384278/spec.md) driver mounts credentials such as secrets and certificates, it has to authenticate against storage providers to access the credentials. However, the access to those credentials are controlled on the basis of the pods' identities rather than the CSI driver's identity. CSI drivers, therefore, need some way to retrieve pod's service account token. + +Currently there are two suboptimal approaches to achieve this, either by granting CSI drivers the permission to use TokenRequest API or by reading tokens directly from the host filesystem. + +Both of them exhibit the following drawbacks: + +- Violating the principle of least privilege +- Every CSI driver needs to re-implement the logic of getting the pod’s service account token + +The second approach is more problematic due to: + +- The audience of the token defaults to the kube-apiserver +- The token is not guaranteed to be available (e.g. `AutomountServiceAccountToken=false`) +- The approach does not work for CSI drivers that run as a different (non-root) user from the pods. See [file permission section for service account token](https://github.com/kubernetes/enhancements/blob/f40c24a5da09390bd521be535b38a4dbab09380c/keps/sig-storage/20180515-svcacct-token-volumes.md#file-permission) +- The token might be legacy Kubernetes service account token which doesn’t expire if `BoundServiceAccountTokenVolume=false` + +Kubernetes 1.20 introduces an alpha feature, `CSIServiceAccountToken`, to improve the security posture. The new feature allows CSI drivers to receive pods' [bound service account tokens](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/1205-bound-service-account-tokens/README.md). + +This feature also provides a knob to re-publish volumes so that short-lived volumes can be refreshed. + +## Pod Impersonation + +### Using GCP APIs + +Using [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity), a Kubernetes service account can authenticate as a Google service account when accessing Google Cloud APIs. If a CSI driver needs to access GCP APIs on behalf of the pods that it is mounting volumes for, it can use the pod's service account token to [exchange for GCP tokens](https://cloud.google.com/iam/docs/reference/sts/rest). The pod's service account token is plumbed through the volume context in `NodePublishVolume` RPC calls when the feature `CSIServiceAccountToken` is enabled. For example: accessing [Google Secret Manager](https://cloud.google.com/secret-manager/) via a [secret store CSI driver](https://github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp). + +### Using Vault + +If users configure [Kubernetes as an auth method](https://www.vaultproject.io/docs/auth/kubernetes), Vault uses the `TokenReview` API to validate the Kubernetes service account token. For CSI drivers using Vault as resources provider, they need to present the pod's service account to Vault. For example, [secrets store CSI driver](https://github.com/hashicorp/secrets-store-csi-driver-provider-vault) and [cert manager CSI driver](https://github.com/jetstack/cert-manager-csi). + +## Short-lived Volumes + +To keep short-lived volumes such as certificates effective, CSI drivers can specify `RequiresRepublish=true` in their`CSIDriver` object to have the kubelet periodically call `NodePublishVolume` on mounted volumes. These republishes allow CSI drivers to ensure that the volume content is up-to-date. + +## Next steps + +This feature is alpha and projected to move to beta in 1.21. See more in the following KEP and CSI documentation: + +- [KEP-1855: Service Account Token for CSI Driver](https://github.com/kubernetes/enhancements/blob/master/keps/sig-storage/1855-csi-driver-service-account-token/README.md) +- [Token Requests](https://kubernetes-csi.github.io/docs/token-requests.html) + +Your feedback is always welcome! +- SIG-Auth [meets regularly](https://github.com/kubernetes/community/tree/master/sig-auth#meetings) and can be reached via [Slack and the mailing list](https://github.com/kubernetes/community/tree/master/sig-auth#contact) +- SIG-Storage [meets regularly](https://github.com/kubernetes/community/tree/master/sig-storage#meetings) and can be reached via [Slack and the mailing list](https://github.com/kubernetes/community/tree/master/sig-storage#contact). From cc7c0155d7a2dd603ae286d69e4f5c8e5abd802f Mon Sep 17 00:00:00 2001 From: Rey Lejano Date: Thu, 10 Dec 2020 07:29:32 -0800 Subject: [PATCH 042/258] Edit redundant 'warn' in Note box in crictl tasks page --- content/en/docs/tasks/debug-application-cluster/crictl.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/debug-application-cluster/crictl.md b/content/en/docs/tasks/debug-application-cluster/crictl.md index 92c397987d..343e3b1cb0 100644 --- a/content/en/docs/tasks/debug-application-cluster/crictl.md +++ b/content/en/docs/tasks/debug-application-cluster/crictl.md @@ -361,7 +361,7 @@ for more information. The exact versions for below mapping table are for docker cli v1.40 and crictl v1.19.0. Please note that the list is not exhaustive. For example, it doesn't include experimental commands of docker cli. {{< note >}} -Warn: the output format of CRICTL is similar to Docker CLI, despite some missing columns for some CLI. Make sure to check output for the specific command if your script output parsing. +The output format of CRICTL is similar to Docker CLI, despite some missing columns for some CLI. Make sure to check output for the specific command if your script output parsing. {{< /note >}} ### Retrieve Debugging Information From e436cf704f816bf6e12423bc2b009eed39f524ac Mon Sep 17 00:00:00 2001 From: Evgeny Shmarnev Date: Thu, 10 Dec 2020 16:27:17 +0100 Subject: [PATCH 043/258] State that no more than one handler is allowed per lifecycle event --- .../configure-pod-container/attach-handler-lifecycle-event.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/configure-pod-container/attach-handler-lifecycle-event.md b/content/en/docs/tasks/configure-pod-container/attach-handler-lifecycle-event.md index 00b9251be8..4576b0f02b 100644 --- a/content/en/docs/tasks/configure-pod-container/attach-handler-lifecycle-event.md +++ b/content/en/docs/tasks/configure-pod-container/attach-handler-lifecycle-event.md @@ -9,7 +9,7 @@ weight: 140 This page shows how to attach handlers to Container lifecycle events. Kubernetes supports the postStart and preStop events. Kubernetes sends the postStart event immediately after a Container is started, and it sends the preStop event immediately before the -Container is terminated. +Container is terminated. A Container may specify one handler per event. From a79b491d0fb96ca108a97e887aa28892efc0c388 Mon Sep 17 00:00:00 2001 From: gosselin Date: Mon, 7 Dec 2020 16:08:17 -0500 Subject: [PATCH 044/258] feature blog for Kubernetes 1.20: Granular Control of Volume Permission Changes --- ...ar-Control-of-Volume-Permission-Changes.md | 59 +++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 content/en/blog/_posts/2020-12-14-Granular-Control-of-Volume-Permission-Changes.md diff --git a/content/en/blog/_posts/2020-12-14-Granular-Control-of-Volume-Permission-Changes.md b/content/en/blog/_posts/2020-12-14-Granular-Control-of-Volume-Permission-Changes.md new file mode 100644 index 0000000000..0a0ad0879c --- /dev/null +++ b/content/en/blog/_posts/2020-12-14-Granular-Control-of-Volume-Permission-Changes.md @@ -0,0 +1,59 @@ +--- +layout: blog +title: 'Kubernetes 1.20: Granular Control of Volume Permission Changes' +date: 2020-12-14 +slug: kubernetes-release-1.20-fsGroupChangePolicy-fsGroupPolicy +--- + +**Authors**: Hemant Kumar, Red Hat & Christian Huffman, Red Hat + +Kubernetes 1.20 brings two important beta features, allowing Kubernetes admins and users alike to have more adequate control over how volume permissions are applied when a volume is mounted inside a Pod. + +### Allow users to skip recursive permission changes on mount +Traditionally if your pod is running as a non-root user ([which you should](https://twitter.com/thockin/status/1333892204490735617)), you must specify a `fsGroup` inside the pod’s security context so that the volume can be readable and writable by the Pod. This requirement is covered in more detail in [here](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). + +But one side-effect of setting `fsGroup` is that, each time a volume is mounted, Kubernetes must recursively `chown()` and `chmod()` all the files and directories inside the volume - with a few exceptions noted below. This happens even if group ownership of the volume already matches the requested `fsGroup`, and can be pretty expensive for larger volumes with lots of small files, which causes pod startup to take a long time. This scenario has been a [known problem](https://github.com/kubernetes/kubernetes/issues/69699) for a while, and in Kubernetes 1.20 we are providing knobs to opt-out of recursive permission changes if the volume already has the correct permissions. + +When configuring a pod’s security context, set `fsGroupChangePolicy` to "OnRootMismatch" so if the root of the volume already has the correct permissions, the recursive permission change can be skipped. Kubernetes ensures that permissions of the top-level directory are changed last the first time it applies permissions. + +```yaml +securityContext: + runAsUser: 1000 + runAsGroup: 3000 + fsGroup: 2000 + fsGroupChangePolicy: "OnRootMismatch" +``` +You can learn more about this in [Configure volume permission and ownership change policy for Pods](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods). + +### Allow CSI Drivers to declare support for fsGroup based permissions + +Although the previous section implied that Kubernetes _always_ recursively changes permissions of a volume if a Pod has a `fsGroup`, this is not strictly true. For certain multi-writer volume types, such as NFS or Gluster, the cluster doesn’t perform recursive permission changes even if the pod has a `fsGroup`. Other volume types may not even support `chown()`/`chmod()`, which rely on Unix-style permission control primitives. + +So how do we know when to apply recursive permission changes and when we shouldn't? For in-tree storage drivers, this was relatively simple. For [CSI](https://kubernetes-csi.github.io/docs/introduction.html#introduction) drivers that could span a multitude of platforms and storage types, this problem can be a bigger challenge. + +Previously, whenever a CSI volume was mounted to a Pod, Kubernetes would attempt to automatically determine if the permissions and ownership should be modified. These methods were imprecise and could cause issues as we already mentioned, depending on the storage type. + +The CSIDriver custom resource now has a `.spec.fsGroupPolicy` field, allowing storage drivers to explicitly opt in or out of these recursive modifications. By having the CSI driver specify a policy for the backing volumes, Kubernetes can avoid needless modification attempts. This optimization helps to reduce volume mount time and also cuts own reporting errors about modifications that would never succeed. + +#### CSIDriver FSGroupPolicy API + +Three FSGroupPolicy values are available as of Kubernetes 1.20, with more planned for future releases. + +- **ReadWriteOnceWithFSType** - This is the default policy, applied if no `fsGroupPolicy` is defined; this preserves the behavior from previous Kubernetes releases. Each volume is examined at mount time to determine if permissions should be recursively applied. +- **File** - Always attempt to apply permission modifications, regardless of the filesystem type or PersistentVolumeClaim’s access mode. +- **None** - Never apply permission modifications. + +#### How do I use it? +The only configuration needed is defining `fsGroupPolicy` inside of the `.spec` for a CSIDriver. Once that element is defined, any subsequently mounted volumes will automatically use the defined policy. There’s no additional deployment required! + +#### What’s next? + +Depending on feedback and adoption, the Kubernetes team plans to push these implementations to GA in either 1.21 or 1.22. + +### How can I learn more? +This feature is explained in more detail in Kubernetes project documentation: [CSI Driver fsGroup Support](https://kubernetes-csi.github.io/docs/support-fsgroup.html) and [Configure volume permission and ownership change policy for Pods ](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods). + +### How do I get involved? +The [Kubernetes Slack channel #csi](https://kubernetes.slack.com/messages/csi) and any of the [standard SIG Storage communication channels](https://github.com/kubernetes/community/blob/master/sig-storage/README.md#contact) are great mediums to reach out to the SIG Storage and the CSI team. + +Those interested in getting involved with the design and development of CSI or any part of the Kubernetes Storage system, join the [Kubernetes Storage Special Interest Group (SIG)](https://github.com/kubernetes/community/tree/master/sig-storage). We’re rapidly growing and always welcome new contributors. From e201e635dc502da9fc88c886fa832927a6f756cc Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Thu, 10 Dec 2020 23:58:15 +0530 Subject: [PATCH 045/258] Fixing links to users & squashing previous commits (#25445) --- ...-Kubernetes-Volume-Snapshot-Moves-to-GA.md | 221 ++++++++++++++++++ 1 file changed, 221 insertions(+) create mode 100644 content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md diff --git a/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md b/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md new file mode 100644 index 0000000000..de55f9c91a --- /dev/null +++ b/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md @@ -0,0 +1,221 @@ +--- +layout: blog +title: 'Kubernetes 1.20: Kubernetes Volume Snapshot Moves to GA' +date: 2020-12-10 +slug: kubernetes-1.20-volume-snapshot-moves-to-ga +--- + +**Authors**: Xing Yang, VMware & Xiangqian Yu, Google + +The Kubernetes Volume Snapshot feature is now GA in Kubernetes v1.20. It was introduced as [alpha](https://kubernetes.io/blog/2018/10/09/introducing-volume-snapshot-alpha-for-kubernetes/) in Kubernetes v1.12, followed by a [second alpha](https://kubernetes.io/blog/2019/01/17/update-on-volume-snapshot-alpha-for-kubernetes/) with breaking changes in Kubernetes v1.13, and promotion to [beta](https://kubernetes.io/blog/2019/12/09/kubernetes-1-17-feature-cis-volume-snapshot-beta/) in Kubernetes 1.17. This blog post summarizes the changes releasing the feature from beta to GA. + +## What is a volume snapshot? + +Many storage systems (like Google Cloud Persistent Disks, Amazon Elastic Block Storage, and many on-premise storage systems) provide the ability to create a “snapshot” of a persistent volume. A snapshot represents a point-in-time copy of a volume. A snapshot can be used either to rehydrate a new volume (pre-populated with the snapshot data) or to restore an existing volume to a previous state (represented by the snapshot). + +## Why add volume snapshots to Kubernetes? + +Kubernetes aims to create an abstraction layer between distributed applications and underlying clusters so that applications can be agnostic to the specifics of the cluster they run on and application deployment requires no “cluster-specific” knowledge. + +The Kubernetes Storage SIG identified snapshot operations as critical functionality for many stateful workloads. For example, a database administrator may want to snapshot a database’s volumes before starting a database operation. + +By providing a standard way to trigger volume snapshot operations in Kubernetes, this feature allows Kubernetes users to incorporate snapshot operations in a portable manner on any Kubernetes environment regardless of the underlying storage. + +Additionally, these Kubernetes snapshot primitives act as basic building blocks that unlock the ability to develop advanced enterprise-grade storage administration features for Kubernetes, including application or cluster level backup solutions. + +## What’s new since beta? + +With the promotion of Volume Snapshot to GA, the feature is enabled by default on standard Kubernetes deployments and cannot be turned off. + +Many enhancements have been made to improve the quality of this feature and to make it production-grade. + +- The Volume Snapshot APIs and client library were moved to a separate Go module. + +- A snapshot validation webhook has been added to perform necessary validation on volume snapshot objects. More details can be found in the [Volume Snapshot Validation Webhook Kubernetes Enhancement Proposal](https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1900-volume-snapshot-validation-webhook). + +- Along with the validation webhook, the volume snapshot controller will start labeling invalid snapshot objects that already existed. This allows users to identify, remove any invalid objects, and correct their workflows. Once the API is switched to the v1 type, those invalid objects will not be deletable from the system. + +- To provide better insights into how the snapshot feature is performing, an initial set of operation metrics has been added to the volume snapshot controller. + +- There are more end-to-end tests, running on GCP, that validate the feature in a real Kubernetes cluster. Stress tests (based on Google Persistent Disk and `hostPath` CSI Drivers) have been introduced to test the robustness of the system. + +Other than introducing tightening validation, there is no difference between the v1beta1 and v1 Kubernetes volume snapshot API. In this release (with Kubernetes 1.20), both v1 and v1beta1 are served while the stored API version is still v1beta1. Future releases will switch the stored version to v1 and gradually remove v1beta1 support. + +## Which CSI drivers support volume snapshots? + +Snapshots are only supported for CSI drivers, not for in-tree or FlexVolume drivers. Ensure the deployed CSI driver on your cluster has implemented the snapshot interfaces. For more information, see [Container Storage Interface (CSI) for Kubernetes GA](https://kubernetes.io/blog/2019/01/15/container-storage-interface-ga/). + +Currently more than [50 CSI drivers](https://kubernetes-csi.github.io/docs/drivers.html) support the Volume Snapshot feature. The [GCE Persistent Disk CSI Driver](https://github.com/kubernetes-sigs/gcp-compute-persistent-disk-csi-driver) has gone through the tests for upgrading from volume snapshots beta to GA. GA level support for other CSI drivers should be available soon. + +## Who builds products using volume snapshots? + +As of the publishing of this blog, the following participants from the [Kubernetes Data Protection Working Group](https://github.com/kubernetes/community/tree/master/wg-data-protection) are building products or have already built products using Kubernetes volume snapshots. + +- [Dell-EMC: PowerProtect](https://www.delltechnologies.com/en-us/data-protection/powerprotect-data-manager.htm) +- Druva +- [Kasten K10](https://www.kasten.io/) +- Pure Storage (Pure Service Orchestrator) +- Red Hat OpenShift Container Storage +- [TrilioVault for Kubernetes](https://docs.trilio.io/kubernetes/) +- [Velero plugin for CSI](https://github.com/vmware-tanzu/velero-plugin-for-csi) + +## How to deploy volume snapshots? + +Volume Snapshot feature contains the following components: + +- [Kubernetes Volume Snapshot CRDs](https://github.com/kubernetes-csi/external-snapshotter/tree/master/client/config/crd) +- [Volume snapshot controller](https://github.com/kubernetes-csi/external-snapshotter/tree/master/pkg/common-controller) +- [Snapshot validation webhook](https://github.com/kubernetes-csi/external-snapshotter/tree/master/pkg/validation-webhook) +- CSI Driver along with [CSI Snapshotter sidecar](https://github.com/kubernetes-csi/external-snapshotter/tree/master/pkg/sidecar-controller) + +It is strongly recommended that Kubernetes distributors bundle and deploy the volume snapshot controller, CRDs, and validation webhook as part of their Kubernetes cluster management process (independent of any CSI Driver). + +{{< warning >}} + +The snapshot validation webhook serves as a critical component to transition smoothly from using v1beta1 to v1 API. Not installing the snapshot validation webhook makes prevention of invalid volume snapshot objects from creation/updating impossible, which in turn will block deletion of invalid volume snapshot objects in coming upgrades. + +{{< /warning >}} + +If your cluster does not come pre-installed with the correct components, you may manually install them. See the [CSI Snapshotter](https://github.com/kubernetes-csi/external-snapshotter#readme) README for details. + +## How to use volume snapshots? + +Assuming all the required components (including CSI driver) have been already deployed and running on your cluster, you can create volume snapshots using the `VolumeSnapshot` API object, or use an existing `VolumeSnapshot` to restore a PVC by specifying the VolumeSnapshot data source on it. For more details, see the [volume snapshot documentation](/docs/concepts/storage/volume-snapshots/). + +{{< note >}} The Kubernetes Snapshot API does not provide any application consistency guarantees. You have to prepare your application (pause application, freeze filesystem etc.) before taking the snapshot for data consistency either manually or using higher level APIs/controllers. {{< /note >}} + +### Dynamically provision a volume snapshot + +To dynamically provision a volume snapshot, create a `VolumeSnapshotClass` API object first. + +```yaml +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshotClass +metadata: + name: test-snapclass +driver: testdriver.csi.k8s.io +deletionPolicy: Delete +parameters: + csi.storage.k8s.io/snapshotter-secret-name: mysecret + csi.storage.k8s.io/snapshotter-secret-namespace: mysecretnamespace +``` + +Then create a `VolumeSnapshot` API object from a PVC by specifying the volume snapshot class. + +```yaml +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshot +metadata: + name: test-snapshot + namespace: ns1 +spec: + volumeSnapshotClassName: test-snapclass + source: + persistentVolumeClaimName: test-pvc +``` + +### Importing an existing volume snapshot with Kubernetes + +To import a pre-existing volume snapshot into Kubernetes, manually create a `VolumeSnapshotContent` object first. + +```yaml +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshotContent +metadata: + name: test-content +spec: + deletionPolicy: Delete + driver: testdriver.csi.k8s.io + source: + snapshotHandle: 7bdd0de3-xxx + volumeSnapshotRef: + name: test-snapshot + namespace: default +``` + +Then create a `VolumeSnapshot` object pointing to the `VolumeSnapshotContent` object. + +```yaml +apiVersion: snapshot.storage.k8s.io/v1 +kind: VolumeSnapshot +metadata: + name: test-snapshot +spec: + source: + volumeSnapshotContentName: test-content +``` + +### Rehydrate volume from snapshot + +A bound and ready `VolumeSnapshot` object can be used to rehydrate a new volume with data pre-populated from snapshotted data as shown here: + +```yaml +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: pvc-restore + namespace: demo-namespace +spec: + storageClassName: test-storageclass + dataSource: + name: test-snapshot + kind: VolumeSnapshot + apiGroup: snapshot.storage.k8s.io + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi +``` + +## How to add support for snapshots in a CSI driver? + +See the [CSI spec](https://github.com/container-storage-interface/spec/blob/master/spec.md) and the [Kubernetes-CSI Driver Developer Guide](https://kubernetes-csi.github.io/docs/snapshot-restore-feature.html) for more details on how to implement the snapshot feature in a CSI driver. + +## What are the limitations? + +The GA implementation of volume snapshots for Kubernetes has the following limitations: + +- Does not support reverting an existing PVC to an earlier state represented by a snapshot (only supports provisioning a new volume from a snapshot). + +### How to learn more? + +The code repository for snapshot APIs and controller is here: https://github.com/kubernetes-csi/external-snapshotter + +Check out additional documentation on the snapshot feature here: http://k8s.io/docs/concepts/storage/volume-snapshots and https://kubernetes-csi.github.io/docs/ + +## How to get involved? + +This project, like all of Kubernetes, is the result of hard work by many contributors from diverse backgrounds working together. + +We offer a huge thank you to the contributors who stepped up these last few quarters to help the project reach GA. We want to thank Saad Ali, Michelle Au, Tim Hockin, and Jordan Liggitt for their insightful reviews and thorough consideration with the design, thank Andi Li for his work on adding the support of the snapshot validation webhook, thank Grant Griffiths on implementing metrics support in the snapshot controller and handling password rotation in the validation webhook, thank Chris Henzie, Raunak Shah, and Manohar Reddy for writing critical e2e tests to meet the scalability and stability requirements for graduation, thank Kartik Sharma for moving snapshot APIs and client lib to a separate go module, and thank Raunak Shah and Prafull Ladha for their help with upgrade testing from beta to GA. + +There are many more people who have helped to move the snapshot feature from beta to GA. We want to thank everyone who has contributed to this effort: +- [Andi Li](https://github.com/AndiLi99) +- [Ben Swartzlander](https://github.com/bswartz) +- [Chris Henzie](https://github.com/chrishenzie) +- [Christian Huffman](https://github.com/huffmanca) +- [Grant Griffiths](https://github.com/ggriffiths) +- [Humble Devassy Chirammal](https://github.com/humblec) +- [Jan Šafránek](https://github.com/jsafrane) +- [Jiawei Wang](https://github.com/jiawei0277) +- [Jing Xu](https://github.com/jingxu97) +- [Jordan Liggitt](https://github.com/liggitt) +- [Kartik Sharma](https://github.com/Kartik494) +- [Madhu Rajanna](https://github.com/Madhu-1) +- [Manohar Reddy](https://github.com/boddumanohar) +- [Michelle Au](https://github.com/msau42) +- [Patrick Ohly](https://github.com/pohly) +- [Prafull Ladha](https://github.com/prafull01) +- [Prateek Pandey](https://github.com/prateekpandey14) +- [Raunak Shah](https://github.com/RaunakShah) +- [Saad Ali](https://github.com/saadali) +- [Saikat Roychowdhury](https://github.com/saikat-royc) +- [Tim Hockin](https://github.com/thockin) +- [Xiangqian Yu](https://github.com/yuxiangqian) +- [Xing Yang](https://github.com/xing-yang) +- [Zhu Can](https://github.com/zhucan) + +For those interested in getting involved with the design and development of CSI or any part of the Kubernetes Storage system, join the [Kubernetes Storage Special Interest Group](https://github.com/kubernetes/community/tree/master/sig-storage) (SIG). We’re rapidly growing and always welcome new contributors. + +We also hold regular [Data Protection Working Group meetings](https://docs.google.com/document/d/15tLCV3csvjHbKb16DVk-mfUmFry_Rlwo-2uG6KNGsfw/edit#). New attendees are welcome to join in discussions. From 3d4b57248b827e8d25553fdcaa380ace1df9d2b0 Mon Sep 17 00:00:00 2001 From: bl-ue <54780737+bl-ue@users.noreply.github.com> Date: Thu, 10 Dec 2020 16:31:27 -0500 Subject: [PATCH 046/258] Fix typo in AppDirect case study --- content/en/case-studies/appdirect/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/case-studies/appdirect/index.html b/content/en/case-studies/appdirect/index.html index ffb06c67b9..dbb902d06b 100644 --- a/content/en/case-studies/appdirect/index.html +++ b/content/en/case-studies/appdirect/index.html @@ -13,7 +13,7 @@ new_case_study_styles: true heading_background: /images/case-studies/appdirect/banner1.jpg heading_title_logo: /images/appdirect_logo.png subheading: > - AppDirect: How AppDirect Supported the 10x Growth of Its Engineering Staff with Kubernetess + AppDirect: How AppDirect Supported the 10x Growth of Its Engineering Staff with Kubernetes case_study_details: - Company: AppDirect - Location: San Francisco, California From 33f330ab01f4ed091061c5f2fe68de176dd0e242 Mon Sep 17 00:00:00 2001 From: Arhell Date: Fri, 11 Dec 2020 01:10:21 +0200 Subject: [PATCH 047/258] sync install-kubeadm.md --- .../production-environment/tools/kubeadm/install-kubeadm.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/id/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/id/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index adcf73db77..fa0b0ce7f0 100644 --- a/content/id/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/id/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -289,8 +289,8 @@ atau `/etc/default/kubelet`(`/etc/sysconfig/kubelet` untuk RPM), silakan hapus d Kamu harus melakukan _restart_ pada kubelet: ```bash -systemctl daemon-reload -systemctl restart kubelet +sudo systemctl daemon-reload +sudo systemctl restart kubelet ``` Deteksi _driver_ cgroup secara otomatis untuk _runtime_ Container lainnya From 99965e6b55fc2a09421cc76ee5dcd1448b4b74a4 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Thu, 10 Dec 2020 23:20:33 +0000 Subject: [PATCH 048/258] Match API reference to version of Kubernetes we're documenting --- content/en/docs/reference/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/_index.md b/content/en/docs/reference/_index.md index bc95e7efeb..4f022db2ec 100644 --- a/content/en/docs/reference/_index.md +++ b/content/en/docs/reference/_index.md @@ -18,7 +18,7 @@ This section of the Kubernetes documentation contains references. ## API Reference -* [Kubernetes API Reference {{< latest-version >}}](/docs/reference/generated/kubernetes-api/{{< latest-version >}}/) +* [API Reference for Kubernetes v{{< param "version" >}}](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/) * [Using The Kubernetes API](/docs/reference/using-api/) - overview of the API for Kubernetes. ## API Client Libraries From 59e11f5ca801b179168982c8ec0b4afc8c2f751b Mon Sep 17 00:00:00 2001 From: jiazxjason <52809535+jiazxjason@users.noreply.github.com> Date: Fri, 11 Dec 2020 09:05:11 +0800 Subject: [PATCH 049/258] Update enabling-endpointslices.md --- .../docs/tasks/administer-cluster/enabling-endpointslices.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md b/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md index b8519879b3..80ac9f50ce 100644 --- a/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md +++ b/content/zh/docs/tasks/administer-cluster/enabling-endpointslices.md @@ -157,5 +157,5 @@ EndpointSlices 将允许集群中网络端点更好的可伸缩性和可扩展 ## {{% heading "whatsnext" %}} -* 参阅 [EndpointSlices](/docs/concepts/services-networking/endpoint-slices/) -* 参阅[将应用程序与服务连接](/docs/concepts/services-networking/connect-applications-service/) +* 参阅 [EndpointSlices](/zh/docs/concepts/services-networking/endpoint-slices/) +* 参阅[将应用程序与服务连接](/zh/docs/concepts/services-networking/connect-applications-service/) From 6ec0d664d94aa125873f688f8ee084d8b657c160 Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Thu, 10 Dec 2020 17:55:33 +0800 Subject: [PATCH 050/258] Update kubeadm-certs.md sync wit english version. Apply suggestions from code review Co-authored-by: Qiming Teng Update kubeadm-certs.md --- .../docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index fb66b92b9b..62c98eb990 100644 --- a/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -80,6 +80,12 @@ point to the CA certificate and key. 否则, kubeadm 将独立运行 controller-manager，附加一个 `--controllers=csrsigner` 的参数，并且指明 CA 证书和密钥。 + +[PKI 证书和要求](/zh/docs/setup/best-practices/certificates/)包括关于用外部 CA 设置集群的指南。 + +## 清理 + +删除你的命名空间： + +```shell +kubectl delete namespace constraints-cpu-example +``` + ## {{% heading "whatsnext" %}} 这个页面将演示如何为容器的生命周期事件挂接处理函数。Kubernetes 支持 postStart 和 preStop 事件。 当一个容器启动后，Kubernetes 将立即发送 postStart 事件；在容器被终结之前， -Kubernetes 将发送一个 preStop 事件。 +Kubernetes 将发送一个 preStop 事件。容器可以为每个事件指定一个处理程序。 ## {{% heading "prerequisites" %}} From 2b216a342b305754bf9158feafc4a058b76ce1c4 Mon Sep 17 00:00:00 2001 From: jiajie Date: Mon, 7 Dec 2020 09:59:14 +0800 Subject: [PATCH 053/258] Update validate-dual-stack.md --- content/zh/docs/tasks/network/validate-dual-stack.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/content/zh/docs/tasks/network/validate-dual-stack.md b/content/zh/docs/tasks/network/validate-dual-stack.md index 14a4594e44..bdef90aa1b 100644 --- a/content/zh/docs/tasks/network/validate-dual-stack.md +++ b/content/zh/docs/tasks/network/validate-dual-stack.md @@ -19,12 +19,10 @@ This document shares how to validate IPv4/IPv6 dual-stack enabled Kubernetes clu ## {{% heading "prerequisites" %}} -* Kubernetes 1.16 或更高版本 * 提供程序对双协议栈网络的支持 (云供应商或其他方式必须能够为 Kubernetes 节点 提供可路由的 IPv4/IPv6 网络接口) * 一个能够支持双协议栈的 @@ -87,7 +85,7 @@ Validate that a Pod has an IPv4 and IPv6 address assigned. (replace the Pod name ### 验证 Pod 寻址 验证 Pod 已分配了 IPv4 和 IPv6 地址。（用集群中的有效 Pod 替换 Pod 名称。 -在此示例中， Pod 名称为 pod01） +在此示例中，Pod 名称为 pod01） ```shell kubectl get pods pod01 -o go-template --template='{{range .status.podIPs}}{{printf "%s \n" .ip}}{{end}}' From 71fef4c3fc3d3b7b26ade464cdfd3ea250322650 Mon Sep 17 00:00:00 2001 From: Grant Griffiths Date: Thu, 10 Dec 2020 18:01:38 -0800 Subject: [PATCH 054/258] Add links to other vendors and add PX-Backup Signed-off-by: Grant Griffiths --- .../2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md b/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md index de55f9c91a..19f7ae5e77 100644 --- a/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md +++ b/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md @@ -52,10 +52,11 @@ Currently more than [50 CSI drivers](https://kubernetes-csi.github.io/docs/drive As of the publishing of this blog, the following participants from the [Kubernetes Data Protection Working Group](https://github.com/kubernetes/community/tree/master/wg-data-protection) are building products or have already built products using Kubernetes volume snapshots. - [Dell-EMC: PowerProtect](https://www.delltechnologies.com/en-us/data-protection/powerprotect-data-manager.htm) -- Druva +- [Druva](https://www.druva.com/) - [Kasten K10](https://www.kasten.io/) -- Pure Storage (Pure Service Orchestrator) -- Red Hat OpenShift Container Storage +- [Portworx (PX-Backup)](https://portworx.com/products/px-backup/) +- [Pure Storage (Pure Service Orchestrator)](https://github.com/purestorage/pso-csi) +- [Red Hat OpenShift Container Storage](https://www.redhat.com/en/technologies/cloud-computing/openshift-container-storage) - [TrilioVault for Kubernetes](https://docs.trilio.io/kubernetes/) - [Velero plugin for CSI](https://github.com/vmware-tanzu/velero-plugin-for-csi) From 8b0503dfac9f6b6309719882b7f551e83e4c8c2c Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Fri, 11 Dec 2020 11:16:29 +0800 Subject: [PATCH 055/258] Create 2019-05-14-expanding-our-contributor-workshops.md --- ...-14-expanding-our-contributor-workshops.md | 136 ++++++++++++++++++ 1 file changed, 136 insertions(+) create mode 100644 content/zh/blog/_posts/2019-05-14-expanding-our-contributor-workshops.md diff --git a/content/zh/blog/_posts/2019-05-14-expanding-our-contributor-workshops.md b/content/zh/blog/_posts/2019-05-14-expanding-our-contributor-workshops.md new file mode 100644 index 0000000000..4008f7aaec --- /dev/null +++ b/content/zh/blog/_posts/2019-05-14-expanding-our-contributor-workshops.md @@ -0,0 +1,136 @@ +--- +layout: blog +title: "壮大我们的发展着研讨会" +date: 2019-05-14 +slug: expanding-our-contributor-workshops +--- + + + + +**作者:** Guinevere Saenger (GitHub) 和 Paris Pittman (Google)（谷歌） + + +**tl;dr** - 与我们一起了解贡献者社区，并获得您的第一份 PR ! 我们在[巴塞罗那][欧洲]有空位（登记 在5月15号周三**结束**，所以抓住这次机会！）并且在[上海][中国]有即将到来的峰会。 + + +巴塞罗那的活动将是我们迄今为止最大的一次，登记的参与者比以往任何时候都多！ + + +你是否曾经想为 Kubernetes 做贡献，但不知道从哪里开始？你有没有曾经看过我们社区的许多代码库并认为需要改进的地方？我们为你准备了一个工作室！ + + +KubeCon + CloudNativeCon 巴塞罗那的研讨会[新贡献者研讨会][ncw]将是第四个这样的研讨会，我们真的很期待！ + + +这个研讨会去年在哥本哈根的 KubeConEU 启动，到目前为止，我们已经把它带到了上海和西雅图，现在是巴塞罗那，以及一些非 KubeConEU 的地方。 + + +我们根据以往课程的反馈，不断更新和改进研讨会的内容。 + + +这一次，我们将根据参与者对开源和 Kubernetes 的经验和适应程度来进行划分。 + + +作为101课程的一部分，我们将为完全不熟悉开源和Kubernetes的人提供开发人员设置和项目工作流支持，并希望为每个参与者开展他们自己的第一期工作。 + + +在201课程中，我们将为那些在开源方面有更多经验但可能不熟悉我们社区开发工具的人进行代码库演练和本地开发和测试演示。 + + +对于这两门课程，你将有机会亲自动手并体会到其中的乐趣。因为不是每个贡献者都使用代码，也不是每项贡献都包含技术性的，所以我们将在研讨会开始时学习如何构建和组织项目，以及如何进行找到合适的人，以及遇到困难时在哪里寻求帮助。 + + +## 辅导机会 + + +我们还将回归 SIG Meet-and-Greet，在这里新入门的菜鸟贡献者将有机会与当值的贡献者交流，这也许会让他们找到他们梦想的SIG，了解他们可以帮助哪些激动人心的领域，获得导师，结交朋友。 + + +PS - 5月23日星期四，在 KubeCon+CloudNativeCon 会议期间会有两次导师会议。[在这里注册][导师]。在西雅图活动期间，60% 的与会者会向贡献者提问。 + + +## 曾经与会者的故事 - Vallery Lancy，Lyft 的工程师 + + +在一系列采访中，我们与一些过去的参与者进行了交谈，这些采访将在今年全年公布。 + + +在我们的前两个片段中，我们会提到 Vallery Lancy，Lyft 公司的工程师，也是我们最近西雅图版研讨会的75名与会者之一。她在社区里闲逛了一段时间，想看看能不能投身到某个领域当中。 + + +在这里观看 Vallery 讲述她的经历：
+ + +Vallery 和那些对研讨会感兴趣的人或者参加巴塞罗那会议的人说了些什么？ +
+ + +想变得和 Vallery 还有数百名参与之前的新贡献者研讨会的与会者一样的话：在巴塞罗那（或者上海-或者圣地亚哥！）加入我们！你会有一个与众不同的体验，而不再是死读我们的文档！ + +Have the opportunity to meet with the experts and go step by step into your journey with your peers around you. We’re looking forward to seeing you there! [Register here][ncw] +--> +你将有机会与专家见面，并与周围的同龄人一步步走上属于你的道路。我们期待着在那里与你见面！[ 在这里注册][ncw] + +[eu]: https://events.linuxfoundation.org/events/contributor-summit-europe-2019/ +[cn]: https://www.lfasiallc.com/events/contributors-summit-china-2019/ +[ncw]: https://events.linuxfoundation.org/events/contributor-summit-europe-2019/ +[mentor]: http://bit.ly/mentor-bcn From 3ce08d2545b94c6747ca9c4b5c2dfff8fea17910 Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Fri, 11 Dec 2020 15:16:39 +0800 Subject: [PATCH 056/258] Update 2016-02-00-kubernetes-community-meeting-notes_23.md --- ...16-02-00-kubernetes-community-meeting-notes_23.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/content/zh/blog/_posts/2016-02-00-kubernetes-community-meeting-notes_23.md b/content/zh/blog/_posts/2016-02-00-kubernetes-community-meeting-notes_23.md index 4b1f80917c..2c73751c6b 100644 --- a/content/zh/blog/_posts/2016-02-00-kubernetes-community-meeting-notes_23.md +++ b/content/zh/blog/_posts/2016-02-00-kubernetes-community-meeting-notes_23.md @@ -1,5 +1,5 @@ --- -title: " Kubernetes 社区会议记录 - 20160218 " +title: "Kubernetes 社区会议记录 - 20160218" date: 2016-02-23 slug: kubernetes-community-meeting-notes_23 url: /blog/2016/02/kubernetes-community-meeting-notes_23 @@ -19,8 +19,8 @@ url: /blog/2016/02/kubernetes-community-meeting-notes_23 ##### February 18th - kmachine demo, clusterops SIG formed, new k8s.io website preview, 1.2 update and planning 1.3 The Kubernetes contributing community meets most Thursdays at 10:00PT to discuss the project's status via videoconference. Here are the notes from the latest meeting. --> -##### 2月18号 - kmachine 示例，SIG 形成的 clusterops，新的 k8s.io 网站概述，更新1.2版本并且计划准备1.3版本 - +##### 2月18号 - kmachine 演示、SIG clusterops 成立、新的 k8s.io 网站预览、1.2 版本更新和 1.3 版本计划 +Kubernetes 贡献社区会议大多在星期四的 10:00 召开，通过视频会议讨论项目现有情况。这里是最近一次会议的笔记。 * 时区讨论 [:22] - * 这个时区不是为亚洲服务的时区。 + * 当前时区不适合亚洲。 * 考虑轮转时间 - 每一个月一次 * 大约 5 或者 6 PT * Rob 建议把例会时间上调一些 @@ -93,7 +93,9 @@ The Kubernetes contributing community meets most Thursdays at 10:00PT to discuss -想要加入Kubernetes社区的人，考虑加入 [Slack channel] [3]频道，在 GitHub 上看看[Kubernetes project][4]，或者加入[Kubernetes-dev Google group][5] 组。 +想要加入 Kubernetes 社区的人，考虑加入 [Slack channel] [3]频道， +在 GitHub 上看看[Kubernetes project][4]， +或者加入[Kubernetes-dev Google group][5]。 -9月，SIG Docs 进行了第一次关于 [Kubernetes 文档](https://kubernetes.io/docs/) 。我们要感谢 CNCF +9月，SIG Docs 进行了第一次关于 [Kubernetes 文档](https://kubernetes.io/docs/)的用户调研。我们要感谢 CNCF 的 Kim McMahon 帮助我们创建调查并获取结果。 -**tl;dr** - 与我们一起了解贡献者社区，并获得您的第一份 PR ! 我们在[巴塞罗那][欧洲]有空位（登记 在5月15号周三**结束**，所以抓住这次机会！）并且在[上海][中国]有即将到来的峰会。 +**tl;dr** - 与我们一起了解贡献者社区，并获得你的第一份 PR ! 我们在[巴塞罗那][欧洲]有空位（登记 在5月15号周三**结束**，所以抓住这次机会！）并且在[上海][中国]有即将到来的峰会。 -作为101课程的一部分，我们将为完全不熟悉开源和Kubernetes的人提供开发人员设置和项目工作流支持，并希望为每个参与者开展他们自己的第一期工作。 +作为101课程的一部分，我们将为完全不熟悉开源和 Kubernetes 的人提供开发人员设置和项目工作流支持，并希望为每个参与者开展他们自己的第一期工作。 -我们还将回归 SIG Meet-and-Greet，在这里新入门的菜鸟贡献者将有机会与当值的贡献者交流，这也许会让他们找到他们梦想的SIG，了解他们可以帮助哪些激动人心的领域，获得导师，结交朋友。 +我们还将回归 SIG Meet-and-Greet，在这里新入门的菜鸟贡献者将有机会与当值的贡献者交流，这也许会让他们找到他们梦想的 SIG，了解他们可以帮助哪些激动人心的领域，获得导师，结交朋友。 -有关配置选项的完整列表，请参见[配置文件文档](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/#config-file)。 +要使用配置文件配置 `kubeadm init` 命令，请参见[带配置文件使用 kubeadm init](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/#config-file)。 `kubeadm init` 首先运行一系列预检查以确保机器 准备运行 Kubernetes。这些预检查会显示警告并在错误时退出。然后 `kubeadm init` 下载并安装集群控制平面组件。这可能会需要几分钟。 -输出应如下所示： +完成之后你应该看到： ```none -[init] Using Kubernetes version: vX.Y.Z -[preflight] Running pre-flight checks -[preflight] Pulling images required for setting up a Kubernetes cluster -[preflight] This might take a minute or two, depending on the speed of your internet connection -[preflight] You can also perform this action in beforehand using 'kubeadm config images pull' -[kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env" -[kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml" -[kubelet-start] Activating the kubelet service -[certs] Using certificateDir folder "/etc/kubernetes/pki" -[certs] Generating "etcd/ca" certificate and key -[certs] Generating "etcd/server" certificate and key -[certs] etcd/server serving cert is signed for DNS names [kubeadm-cp localhost] and IPs [10.138.0.4 127.0.0.1 ::1] -[certs] Generating "etcd/healthcheck-client" certificate and key -[certs] Generating "etcd/peer" certificate and key -[certs] etcd/peer serving cert is signed for DNS names [kubeadm-cp localhost] and IPs [10.138.0.4 127.0.0.1 ::1] -[certs] Generating "apiserver-etcd-client" certificate and key -[certs] Generating "ca" certificate and key -[certs] Generating "apiserver" certificate and key -[certs] apiserver serving cert is signed for DNS names [kubeadm-cp kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local] and IPs [10.96.0.1 10.138.0.4] -[certs] Generating "apiserver-kubelet-client" certificate and key -[certs] Generating "front-proxy-ca" certificate and key -[certs] Generating "front-proxy-client" certificate and key -[certs] Generating "sa" key and public key -[kubeconfig] Using kubeconfig folder "/etc/kubernetes" -[kubeconfig] Writing "admin.conf" kubeconfig file -[kubeconfig] Writing "kubelet.conf" kubeconfig file -[kubeconfig] Writing "controller-manager.conf" kubeconfig file -[kubeconfig] Writing "scheduler.conf" kubeconfig file -[control-plane] Using manifest folder "/etc/kubernetes/manifests" -[control-plane] Creating static Pod manifest for "kube-apiserver" -[control-plane] Creating static Pod manifest for "kube-controller-manager" -[control-plane] Creating static Pod manifest for "kube-scheduler" -[etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests" -[wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s -[apiclient] All control plane components are healthy after 31.501735 seconds -[uploadconfig] storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace -[kubelet] Creating a ConfigMap "kubelet-config-X.Y" in namespace kube-system with the configuration for the kubelets in the cluster -[patchnode] Uploading the CRI Socket information "/var/run/dockershim.sock" to the Node API object "kubeadm-cp" as an annotation -[mark-control-plane] Marking the node kubeadm-cp as control-plane by adding the label "node-role.kubernetes.io/master=''" -[mark-control-plane] Marking the node kubeadm-cp as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule] -[bootstrap-token] Using token: -[bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles -[bootstraptoken] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials -[bootstraptoken] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token -[bootstraptoken] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster -[bootstraptoken] creating the "cluster-info" ConfigMap in the "kube-public" namespace -[addons] Applied essential addon: CoreDNS -[addons] Applied essential addon: kube-proxy - Your Kubernetes control-plane has initialized successfully! To start using your cluster, you need to run the following as a regular user: @@ -955,7 +906,7 @@ Workarounds: * Regularly [back up etcd](https://coreos.com/etcd/docs/latest/admin_guide.html). The etcd data directory configured by kubeadm is at `/var/lib/etcd` on the control-plane node. --> -* 定期[备份etcd](https://coreos.com/etcd/docs/latest/admin_guide.html)。 +* 定期[备份 etcd](https://coreos.com/etcd/docs/latest/admin_guide.html)。 kubeadm 配置的 etcd 数据目录位于控制平面节点上的 `/var/lib/etcd` 中。 -如果你在使用kubeadm时遇到困难，请查阅我们的[故障排除文档](/zh/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/)。 +如果你在使用 kubeadm 时遇到困难，请查阅我们的[故障排除文档](/zh/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/)。 From d49ff2b85f362670738a1e266310a2189181b17f Mon Sep 17 00:00:00 2001 From: jiajie Date: Mon, 7 Dec 2020 15:51:44 +0800 Subject: [PATCH 061/258] update --- .../contribute/style/hugo-shortcodes/index.md | 45 +++++++++++++++++-- 1 file changed, 41 insertions(+), 4 deletions(-) diff --git a/content/zh/docs/contribute/style/hugo-shortcodes/index.md b/content/zh/docs/contribute/style/hugo-shortcodes/index.md index dc3400c611..b2567f0771 100644 --- a/content/zh/docs/contribute/style/hugo-shortcodes/index.md +++ b/content/zh/docs/contribute/style/hugo-shortcodes/index.md @@ -125,18 +125,25 @@ parameter. ## 词汇 +有两种词汇表提示。 + 你可以通过加入术语词汇的短代码，来自动更新和替换相应链接中的内容 （[我们的词汇库](/zh/docs/reference/glossary/)） 这样，在浏览在线文档，鼠标移到术语上时，术语解释就会显示在提示框中。 +除了包含工具提示外，你还可以重用页面内容中词汇表中的定义。 @@ -144,7 +151,7 @@ The raw data for glossary terms is stored at [https://github.com/kubernetes/webs 词汇术语的原始数据保存在 [https://github.com/kubernetes/website/tree/master/content/en/docs/reference/glossary](https://github.com/kubernetes/website/tree/master/content/en/docs/reference/glossary)，每个内容文件对应相应的术语解释。 +这是一个简短的词汇表定义： + +``` +{{}} +``` + + +呈现为： +{{< glossary_definition prepend="A cluster is" term_id="cluster" length="short" >}} + + +你也可以包括完整的定义： + +``` +{{}} +``` + + +呈现为： +{{< glossary_definition term_id="cluster" length="all" >}} -```go-html-template +​```go-html-template {{}} 参数 | 描述 | 默认值 :---------|:------------|:------- From 32063d9c9d872ad2dfa831e5f3688df2a6ac5220 Mon Sep 17 00:00:00 2001 From: jiajie Date: Fri, 11 Dec 2020 10:52:39 +0800 Subject: [PATCH 062/258] zh-trans Update kubeadm-certs.md --- .../kubeadm/kubeadm-certs.md | 115 ++++++++++-------- 1 file changed, 66 insertions(+), 49 deletions(-) diff --git a/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index fb66b92b9b..1735730733 100644 --- a/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -3,11 +3,13 @@ title: 使用 kubeadm 进行证书管理 content_type: task weight: 10 --- + @@ -30,27 +32,28 @@ You should be familiar with [PKI certificates and requirements in Kubernetes](/d -### 使用自定义的证书 {#custom-certificates} + +## 使用自定义的证书 {#custom-certificates} 默认情况下, kubeadm 会生成运行一个集群所需的全部证书。 你可以通过提供你自己的证书来改变这个行为策略。 -如果要这样做, 你必须将证书文件放置在通过 `--cert-dir` 命令行参数或者配置文件里的 +如果要这样做, 你必须将证书文件放置在通过 `--cert-dir` 命令行参数或者 kubeadm 配置中的 `CertificatesDir` 配置项指明的目录中。默认的值是 `/etc/kubernetes/pki`。 @@ -59,17 +62,18 @@ and kubeadm will use this CA for signing the rest of the certificates. `/etc/kubernetes/pki/ca.key` 中，而 kubeadm 将使用此 CA 对其余证书进行签名。 -#### 外部 CA 模式 {#external-ca-mode} -只提供了 `ca.crt` 文件但是不提供 `ca.key` 文件也是可以的 (这只对 CA 根证书可用，其它证书不可用)。 +## 外部 CA 模式 {#external-ca-mode} + +只提供了 `ca.crt` 文件但是不提供 `ca.key` 文件也是可以的（这只对 CA 根证书可用，其它证书不可用）。 如果所有的其它证书和 kubeconfig 文件已就绪， kubeadm 检测到满足以上条件就会激活 "外部 CA" 模式。kubeadm 将会在没有 CA 密钥文件的情况下继续执行。 @@ -77,23 +81,30 @@ CA key on disk. Instead, run the controller-manager standalone with `--controllers=csrsigner` and point to the CA certificate and key. --> -否则, kubeadm 将独立运行 controller-manager，附加一个 `--controllers=csrsigner` -的参数，并且指明 CA 证书和密钥。 +否则, kubeadm 将独立运行 controller-manager，附加一个 `--controllers=csrsigner` 的参数，并且指明 CA 证书和密钥。 + + +[PKI证书和要求](/zh/docs/setup/best-practices/certificates/)包括集群使用外部CA的设置指南。 ## 检查证书是否过期 -你可以使用 `check-expiration` 子命令来检查证书是否过期 +你可以使用 `check-expiration` 子命令来检查证书何时过期 ```shell kubeadm alpha certs check-expiration -``` +``` - + 输出类似于以下内容： ``` @@ -118,8 +129,9 @@ front-proxy-ca Dec 28, 2029 23:36 UTC 9y no -该命令显示 `/etc/kubernetes/pki` 文件夹中的客户端证书以及 kubeadm 使用的 KUBECONFIG -文件中嵌入的客户端证书的到期时间/剩余时间。 +该命令显示 `/etc/kubernetes/pki` 文件夹中的客户端证书以及 +kubeadm（`admin.conf`, `controller-manager.conf` 和 `scheduler.conf`） +使用的 KUBECONFIG 文件中嵌入的客户端证书的到期时间/剩余时间。 ` + --> {{< warning >}} -kubeadm` 不能管理由外部 CA 签名的证书 +`kubeadm` 不能管理由外部 CA 签名的证书 {{< /warning >}} + ## 自动更新证书 `kubeadm` 会在控制面 @@ -224,24 +237,29 @@ If you are running an HA cluster, this command needs to be executed on all the c 如果你运行了一个 HA 集群，这个命令需要在所有控制面板节点上执行。 {{< /warning >}} - + {{< note >}} -`alpha certs renew` 使用现有的证书作为属性 (Common Name、Organization、SAN 等) 的权威来源， +`certs renew` 使用现有的证书作为属性 (Common Name、Organization、SAN 等) 的权威来源， 而不是 kubeadm-config ConfigMap 。强烈建议使它们保持同步。 {{< /note >}} + +`kubeadm certs renew`提供以下选项： + Kubernetes 证书通常在一年后到期。 -`kubeadm alpha certs renew` 提供下列选项 - `--csr-only` 可用于经过一个外部 CA 生成的证书签名请求来更新证书（无需实际替换更新证书）； 更多信息请参见下节。 @@ -268,10 +286,11 @@ These are advanced topics for users who need to integrate their organization's c ### Set up a signer The Kubernetes Certificate Authority does not work out of the box. -You can configure an external signer such as [cert-manager][cert-manager-issuer], or you can use the build-in signer. -The built-in signer is part of [`kube-controller-manager`][kcm]. -To activate the build-in signer, you pass the `--cluster-signing-cert-file` and `--cluster-signing-key-file` arguments. +You can configure an external signer such as [cert-manager](https://docs.cert-manager.io/en/latest/tasks/issuers/setup-ca.html), or you can use the build-in signer. +The built-in signer is part of [`kube-controller-manager`](/docs/reference/command-line-tools-reference/kube-controller-manager/). +To activate the build-in signer, you must pass the `--cluster-signing-cert-file` and `--cluster-signing-key-file` flags. --> + ### 设置一个签名者（Signer） Kubernetes 证书颁发机构不是开箱即用。 @@ -281,19 +300,12 @@ Kubernetes 证书颁发机构不是开箱即用。 内置签名者是 [`kube-controller-manager`](/zh/docs/reference/command-line-tools-reference/kube-controller-manager/) 的一部分。 -要激活内置签名者，请传递`--cluster-signing-cert-file` 和 `--cluster-signing-key-file`参数。 +要激活内置签名者，请传递 `--cluster-signing-cert-file` 和 `--cluster-signing-key-file` 参数。 -这个内置签名者是 [`kube-controller-manager`][kcm] 的一部分。 -要激活内置签名者，必须传递 `--cluster-signing-cert-file` 和 `--cluster-signing-key-file` 参数。 - - -如果你正在正在创建一个新的集群，你可以使用 kubeadm 的 +如果你正在创建一个新的集群，你可以使用 kubeadm 的 [配置文件](https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta2)。 ```yaml @@ -315,8 +327,8 @@ You can create the certificate signing requests for the Kubernetes certificates 你可以用 `kubeadm alpha certs renew --use-api` 为 Kubernetes 证书 API 创建一个证书签名请求。 如果你设置例如 [cert-manager](https://github.com/jetstack/cert-manager) @@ -329,7 +341,9 @@ The following kubeadm command outputs the name of the certificate to approve, th sudo kubeadm alpha certs renew apiserver --use-api & ``` - + 输出类似于以下内容： ``` [1] 2890 @@ -341,8 +355,9 @@ sudo kubeadm alpha certs renew apiserver --use-api & If you set up an external signer, certificate signing requests (CSRs) are automatically approved. -Otherwise, you must manually approve certificates with the [`kubectl certificate`][certs] command. e.g. +Otherwise, you must manually approve certificates with the [`kubectl certificate`](/docs/setup/best-practices/certificates/) command. e.g. --> + ### 批准证书签名请求 (CSR) 如果你设置了一个外部签名者， 证书签名请求 (CSRs) 会自动被批准。 @@ -355,7 +370,8 @@ kubectl certificate approve kubeadm-cert-kube-apiserver-ld526 ``` +The output is similar to this: +--> 输出类似于以下内容： ``` @@ -400,13 +416,13 @@ If `--csr-dir` is not specified, the default certificate directory (`/etc/kubern CSR 和随附的私钥都在输出中给出。 你可以传入一个带有 `--csr-dir` 的目录，将 CRS 输出到指定位置。 -如果未指定 `--csr-dir` ，则使用默认证书目录( `/etc/kubernetes/pki` )。 +如果未指定 `--csr-dir` ，则使用默认证书目录（`/etc/kubernetes/pki`）。 -证书可以通过 `kubeadm alpha certs renew --csr-only` 来续订。 +证书可以通过 `kubeadm certs renew --csr-only` 来续订。 和 `kubeadm init` 一样，可以使用 `--csr-dir` 标志指定一个输出目录。 CSR 签署证书后，必须将证书和私钥复制到 PKI 目录（默认情况下为 `/etc/kubernetes/pki`）。 @@ -420,8 +436,10 @@ CSR 中包含一个证书的名字，域和 IP，但是未指定用法。 颁发证书时，CA 有责任指定[正确的证书用法](/zh/docs/setup/best-practices/certificates/#all-certificates) * 在 `openssl` 中，这是通过 [`openssl ca` 命令](https://superuser.com/questions/738612/openssl-ca-keyusage-extension) @@ -447,5 +465,4 @@ For more information about manual rotation or replacement of CA, see [manual rot kubeadm 并不直接支持对 CA 证书的轮换或者替换。 关于手动轮换或者置换 CA 的更多信息，可参阅 -[手动轮换 CA 证书](/zh/docs/tasks/tls/manual-rotation-of-ca-certificates/)。 - +[手动轮换 CA 证书](/zh/docs/tasks/tls/manual-rotation-of-ca-certificates/)。 \ No newline at end of file From 653d4b69bae997ddb8fb1ca6f64c52cfa4ebc071 Mon Sep 17 00:00:00 2001 From: jiajie Date: Sun, 6 Dec 2020 23:00:07 +0800 Subject: [PATCH 063/258] zh-trans Update manual-rotation-of-ca-certificates.md --- .../tls/manual-rotation-of-ca-certificates.md | 49 +++++++++++++------ 1 file changed, 34 insertions(+), 15 deletions(-) diff --git a/content/zh/docs/tasks/tls/manual-rotation-of-ca-certificates.md b/content/zh/docs/tasks/tls/manual-rotation-of-ca-certificates.md index 6816bdd6fc..ca9601eeb3 100644 --- a/content/zh/docs/tasks/tls/manual-rotation-of-ca-certificates.md +++ b/content/zh/docs/tasks/tls/manual-rotation-of-ca-certificates.md @@ -61,27 +61,34 @@ Configurations with a single API server will experience unavailability while the `front-proxy-client.key`）分发到所有控制面节点，放在其 Kubernetes 证书目录下。 -2. 更新控制器管理器的 `--root-ca-file` 标志，使之同时包含老的和新的 CA，之后重启控制器管理器。 +2. 更新 {{< glossary_tooltip text="kube-controller-manager" term_id="kube-controller-manager" >}} 的 + `--root-ca-file` 标志，使之同时包含老的和新的 CA，之后重启组件。 自此刻起，所创建的所有服务账号都会获得同时包含老的 CA 和新的 CA 的 Secret。 {{< note >}} - 去掉控制器管理器的 `-client-ca-file` 标志。 - 你也可以替换客户端 CA 文件或者将此配置条目指向新的、更新过的 CA。 - [Issue 1350](https://github.com/kubernetes/kubeadm/issues/1350) 用来跟踪 - 控制器管理器无法接受 CA 包的问题。 + kube-controller-manager 标志 `--client-ca-file` 和 `--cluster-signing-cert-file` 所引用的文件 + 不能是 CA 证书包。如果这些标志和 `--root-ca-file` 指向同一个 `ca.crt` 包文件（包含老的和新的 CA 证书）， + 你将会收到出错信息。 + 要解决这个问题，可以将新的 CA 证书复制到单独的文件中，并将 `--client-ca-file` 和 `--cluster-signing-cert-file` + 标志指向该副本。一旦 `ca.crt` 不再是证书包文件，就可以恢复有问题的标志指向 `ca.crt` 并删除该副本。 {{< /note >}} @@ -89,6 +96,19 @@ Configurations with a single API server will experience unavailability while the 如果在 API 服务器使用新的 CA 之前启动了新的 Pod，这些 Pod 也会获得此更新并且同时信任老的和新的 CA 证书。 + ```shell base64_encoded_ca="$(base64 )" @@ -111,7 +131,7 @@ Configurations with a single API server will experience unavailability while the 1. Append the both old and new CA to the file against `-client-ca-file` flag in the `kube-scheduler` configuration. --> 4. 重启所有使用集群内配置的 Pods（例如：`kube-proxy`、`coredns` 等），以便这些 Pod 能够使用 - 来自服务账号 Secret 中的、已更新的证书机构数据。 + 来自 *ServiceAccount* Secret 中的、已更新的证书机构数据。 * 确保 `coredns`、`kube-proxy` 和其他使用集群内配置的 Pod 都正按预期方式工作。 @@ -151,7 +171,7 @@ Configurations with a single API server will experience unavailability while the --> 8. 遵循下列步骤执行滚动更新 - 1. 重新启动所有其他[被聚合的 API 服务器](/zh/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) + 1. 重新启动所有其他 *[被聚合的 API 服务器](/zh/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/)* 或者 *Webhook 处理程序*，使之信任新的 CA 证书。 2. 在所有节点上更新 kubelet 配置中的 `clientCAFile` 所指文件以及 kubelet.conf 中的 @@ -168,7 +188,7 @@ Configurations with a single API server will experience unavailability while the If you changed the private keys then update these in the Kubernetes certificates directory as well. --> 3. 使用用新的 CA 签名的证书 - （`apiserver.crt`、`apiserver-kubelet-client.crt` 和 `front-proxy-client.crt`） + （`apiserver.crt`、`apiserver-kubelet-client.crt` 和 `front-proxy-client.crt`） 来重启 API 服务器。 你可以使用现有的私钥，也可以使用新的私钥。 如果你改变了私钥，则要将更新的私钥也放到 Kubernetes 证书目录下。 @@ -275,4 +295,3 @@ Configurations with a single API server will experience unavailability while the 1. 重启 kubelet，移除 `clientCAFile` 标志所指向的文件以及 kubelet kubeconfig 文件中 的老的 CA 数据。 - From 909459880eec38fa3c8e6532b6d27a0fd1f26243 Mon Sep 17 00:00:00 2001 From: thinkmo Date: Fri, 11 Dec 2020 17:28:50 +0800 Subject: [PATCH 064/258] change zh link for page support doc versions --- .../zh/docs/home/supported-doc-versions.md | 20 ++----------------- i18n/zh.toml | 11 +++++++++- 2 files changed, 12 insertions(+), 19 deletions(-) diff --git a/content/zh/docs/home/supported-doc-versions.md b/content/zh/docs/home/supported-doc-versions.md index 31c3831690..1556a62497 100644 --- a/content/zh/docs/home/supported-doc-versions.md +++ b/content/zh/docs/home/supported-doc-versions.md @@ -1,6 +1,7 @@ --- title: Kubernetes 文档支持的版本 -content_type: concept +content_type: custom +layout: supported-versions card: name: about weight: 10 @@ -10,20 +11,3 @@ card: 本网站包含当前版本和之前四个版本的 Kubernetes 文档。 - - - - - -## 当前版本 - -当前版本是 -[{{< param "version" >}}](/)。 - -## 往期版本 - -{{< versions-other >}} - - - - diff --git a/i18n/zh.toml b/i18n/zh.toml index 4980f8d7fa..f067727cf5 100644 --- a/i18n/zh.toml +++ b/i18n/zh.toml @@ -215,4 +215,13 @@ other = "要获知版本信息，请输入 " other = "警告：" [whatsnext_heading] -other = "接下来" \ No newline at end of file +other = "接下来" + +[docs_version_latest_heading] +other = "当前版本" + +[docs_version_other_heading] +other = "往期版本" + +[docs_version_current] +other = "(此文档)" From 7727cce87a564a1cc8ce35b831cd05f3fa65c0f5 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Fri, 11 Dec 2020 10:13:05 +0000 Subject: [PATCH 065/258] =?UTF-8?q?Fix=20duplicated=20=E2=80=9Cv=E2=80=9D?= =?UTF-8?q?=20prefix=20for=20version?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- content/en/docs/reference/_index.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/en/docs/reference/_index.md b/content/en/docs/reference/_index.md index 4f022db2ec..5b22271c86 100644 --- a/content/en/docs/reference/_index.md +++ b/content/en/docs/reference/_index.md @@ -18,7 +18,7 @@ This section of the Kubernetes documentation contains references. ## API Reference -* [API Reference for Kubernetes v{{< param "version" >}}](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/) +* [API Reference for Kubernetes {{< param "version" >}}](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/) * [Using The Kubernetes API](/docs/reference/using-api/) - overview of the API for Kubernetes. ## API Client Libraries @@ -54,4 +54,3 @@ An archive of the design docs for Kubernetes functionality. Good starting points [Kubernetes Architecture](https://git.k8s.io/community/contributors/design-proposals/architecture/architecture.md) and [Kubernetes Design Overview](https://git.k8s.io/community/contributors/design-proposals). - From 415286ff1bb27c6909337d2cf806f67249045b8d Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Fri, 11 Dec 2020 18:26:34 +0800 Subject: [PATCH 066/258] Update cpu-constraint-namespace.md update translation --- .../manage-resources/cpu-constraint-namespace.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/administer-cluster/manage-resources/cpu-constraint-namespace.md b/content/zh/docs/tasks/administer-cluster/manage-resources/cpu-constraint-namespace.md index 25c24ab519..d05a5f6b33 100644 --- a/content/zh/docs/tasks/administer-cluster/manage-resources/cpu-constraint-namespace.md +++ b/content/zh/docs/tasks/administer-cluster/manage-resources/cpu-constraint-namespace.md @@ -415,5 +415,5 @@ kubectl delete namespace constraints-cpu-example * [为容器和 Pod 分配内存资源](/zh/docs/tasks/configure-pod-container/assign-memory-resource/) * [为容器和 Pod 分配 CPU 资源](/zh/docs/tasks/configure-pod-container/assign-cpu-resource/) -* [为 Pod 配置 Service 数量](/zh/docs/tasks/configure-pod-container/quality-service-pod/) +* [为 Pod 配置服务质量](/zh/docs/tasks/configure-pod-container/quality-service-pod/) From 4e2959c82ed36048fedbee7e45a2c50552bee824 Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Thu, 10 Dec 2020 18:26:13 +0800 Subject: [PATCH 067/258] Update adding-windows-nodes.md sync with the english version with same format. Update adding-windows-nodes.md --- .../tasks/administer-cluster/kubeadm/adding-windows-nodes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md b/content/zh/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md index 5e9fc9690e..d7b9f4c68e 100644 --- a/content/zh/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md +++ b/content/zh/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md @@ -269,7 +269,7 @@ to do so are available at [Install Docker Engine - Enterprise on Windows Servers All code snippets in Windows sections are to be run in a PowerShell environment with elevated permissions (Administrator) on the Windows worker node. --> -### 加入 Windows 工作节点 {joiniing-a-windows-worker-node} +### 加入 Windows 工作节点 {joining-a-windows-worker-node} 你必须安装 `Containers` 功能特性并安装 Docker 工具。相关的指令可以在 [Install Docker Engine - Enterprise on Windows Servers](https://docs.mirantis.com/docker-enterprise/v3.1/dockeree-products/docker-engine-enterprise/dee-windows.html) From 17996f907b32938013bcf6a8f83a08c61406671a Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Sat, 12 Dec 2020 00:48:53 +0800 Subject: [PATCH 068/258] Update memory-default-namespace.md sync with English version --- .../manage-resources/memory-default-namespace.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/administer-cluster/manage-resources/memory-default-namespace.md b/content/zh/docs/tasks/administer-cluster/manage-resources/memory-default-namespace.md index eaecd09ee0..c3fa12783f 100644 --- a/content/zh/docs/tasks/administer-cluster/manage-resources/memory-default-namespace.md +++ b/content/zh/docs/tasks/administer-cluster/manage-resources/memory-default-namespace.md @@ -246,6 +246,19 @@ it can be allowed to run in a namespace that is restricted by a quota. --> 如果一个容器没有声明自己的内存限制，会被指定默认限制，然后它才会被允许在限定了配额的命名空间中运行。 + +## 清理 + +删除你的命名空间： + +```shell +kubectl delete namespace default-mem-example +``` + ## {{% heading "whatsnext" %}} ## API 参考 -* [Kubernetes API 参考 {{< latest-version >}}](/docs/reference/generated/kubernetes-api/{{< latest-version >}}/)。 +* [Kubernetes API 参考 {{< param "version" >}}](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/)。 * [使用 Kubernetes API ](/zh/docs/reference/using-api/) - Kubernetes 的 API 概述 ``` # 这里再次假定你的节点使用 "sudo" 来以超级用户角色执行命令 -echo 'Hello from Kubernetes storage' > /mnt/data/index.html +sudo sh -c "echo 'Hello from Kubernetes storage' > /mnt/data/index.html" ``` - 创建 Secrets: + 创建 Secret: ```shell # 创建包含用户名和密码的文件: @@ -73,7 +73,7 @@ Here is the configuration file for the Pod: kubectl create -f https://k8s.io/examples/pods/storage/projected.yaml ``` - @@ -91,20 +91,34 @@ Here is the configuration file for the Pod: test-projected-volume 1/1 Running 0 14s ``` -3. +4. 在另外一个终端中，打开容器的 shell： ```shell kubectl exec -it test-projected-volume -- /bin/sh ``` -4. +5. 在 shell 中，确认 `projected-volume` 目录包含你的投射源： ```shell ls /projected-volume/ ``` + +## 清理 + +删除 Pod 和 Secret: + +```shell +kubectl delete pod test-projected-volume +kubectl delete secret user pass +``` + ## {{% heading "whatsnext" %}} ## 为 Pod 配置卷访问权限和属主变更策略 -{{< feature-state for_k8s_version="v1.18" state="alpha" >}} +{{< feature-state for_k8s_version="v1.20" state="beta" >}} -Cette page vous -apprend comment installer la boîte à outils `kubeadm`. -Pour plus d'informations sur la création d'un cluster avec kubeadm, une fois que vous avez -effectué ce processus d'installation, voir la page: [Utiliser kubeadm pour créer un cluster](/fr/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/). +Cette page vous apprend comment installer la boîte à outils `kubeadm`. +Pour plus d'informations sur la création d'un cluster avec kubeadm, une fois que vous avez effectué ce processus d'installation, voir la page: [Utiliser kubeadm pour créer un cluster](/fr/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/). @@ -19,39 +20,53 @@ effectué ce processus d'installation, voir la page: [Utiliser kubeadm pour cré * Une ou plusieurs machines exécutant: - Ubuntu 16.04+ - - Debian 9 + - Debian 9+ - CentOS 7 - - RHEL 7 - - Fedora 25/26 (best-effort) + - Red Hat Enterprise Linux (RHEL) 7 + - Fedora 25+ - HypriotOS v1.0.1+ - - Container Linux (testé avec 1800.6.0) + - Flatcar Container Linux (testé avec 2512.3.0) * 2 Go ou plus de RAM par machine (toute quantité inférieure laissera peu de place à vos applications) * 2 processeurs ou plus * Connectivité réseau complète entre toutes les machines du cluster (réseau public ou privé) * Nom d'hôte, adresse MAC et product_uuid uniques pour chaque nœud. Voir [ici](#verify-the-mac-address-and-product-uuid-are-unique-for-every-node) pour plus de détails. * Certains ports doivent êtres ouverts sur vos machines. Voir [ici](#check-required-ports) pour plus de détails. -* Swap désactivé. Vous devez impérativement désactiver le swap pour que la kubelet fonctionne correctement. +* Swap désactivé. Vous **devez** impérativement désactiver le swap pour que la kubelet fonctionne correctement. -## Vérifiez que les adresses MAC et product_uuid sont uniques pour chaque nœud {#verify-the-mac-address-and-product-uuid-are-unique-for-every-node} +## Vérifiez que les adresses MAC et product_uuid sont uniques pour chaque nœud {#verify-mac-address} * Vous pouvez obtenir l'adresse MAC des interfaces réseau en utilisant la commande `ip link` ou` ifconfig -a` * Le product_uuid peut être vérifié en utilisant la commande `sudo cat/sys/class/dmi/id/product_uuid` Il est très probable que les périphériques matériels aient des adresses uniques, bien que -certaines machines virtuelles puissent avoir des valeurs identiques. Kubernetes utilise -ces valeurs pour identifier de manière unique les nœuds du cluster. +certaines machines virtuelles puissent avoir des valeurs identiques. Kubernetes utilise ces valeurs pour identifier de manière unique les nœuds du cluster. Si ces valeurs ne sont pas uniques à chaque nœud, le processus d'installation peut [échouer](https://github.com/kubernetes/kubeadm/issues/31). ## Vérifiez les cartes réseaux -Si vous avez plusieurs cartes réseaux et que vos composants Kubernetes ne sont pas accessibles par la -route par défaut, nous vous recommandons d’ajouter une ou plusieurs routes IP afin que les adresses -de cluster Kubernetes soient acheminées via la carte approprié. +Si vous avez plusieurs cartes réseaux et que vos composants Kubernetes ne sont pas accessibles par la route par défaut, +nous vous recommandons d’ajouter une ou plusieurs routes IP afin que les adresses de cluster Kubernetes soient acheminées via la carte approprié. + +## Permettre à iptables de voir le trafic ponté + +Assurez-vous que le module `br_netfilter` est chargé. Cela peut être fait en exécutant `lsmod | grep br_netfilter`. Pour le charger explicitement, appelez `sudo modprobe br_netfilter`. + +Pour que les iptables de votre nœud Linux voient correctement le trafic ponté, vous devez vous assurer que `net.bridge.bridge-nf-call-iptables` est défini sur 1 dans votre configuration` sysctl`, par ex. + +```bash +cat <}}. -Les autres runtimes basés sur la CRI incluent: +{{< tabs name="container_runtime" >}} +{{% tab name="Linux nodes" %}} -- [containerd](https://github.com/containerd/cri) (plugin CRI construit dans containerd) -- [cri-o](https://cri-o.io/) -- [frakti](https://github.com/kubernetes/frakti) +Par défaut, Kubernetes utilise le +{{< glossary_tooltip term_id="cri" text="Container Runtime Interface">}} (CRI) +pour s'interfacer avec votre environnement d'exécution de conteneur choisi. + +Si vous ne spécifiez pas de runtime, kubeadm essaie automatiquement de détecter un +Runtime de conteneur en parcourant une liste de sockets de domaine Unix bien connus. +Le tableau suivant répertorie les environnements d'exécution des conteneurs et leurs chemins de socket associés: + +{{< table caption = "Les environnements d'exécution des conteneurs et leurs chemins de socket" >}} +| Runtime | Chemin vers le socket de domaine Unix | +|------------|---------------------------------------| +| Docker | `/var/run/docker.sock` | +| containerd | `/run/containerd/containerd.sock` | +| CRI-O | `/var/run/crio/crio.sock` | +{{< /table >}} + +
+Si Docker et containerd sont détectés, Docker est prioritaire. C'est +nécessaire car Docker 18.09 est livré avec containerd et les deux sont détectables même si vous +installé Docker. +Si deux autres environnements d'exécution ou plus sont détectés, kubeadm se ferme avec une erreur. + +Le kubelet s'intègre à Docker via l'implémentation CRI intégrée de `dockershim`. + +Voir [runtimes de conteneur](/docs/setup/production-environment/container-runtimes/) +pour plus d'informations. +{{% /tab %}} +{{% tab name="autres systèmes d'exploitation" %}} +Par défaut, kubeadm utilise {{< glossary_tooltip term_id="docker" >}} comme environnement d'exécution du conteneur. +Le kubelet s'intègre à Docker via l'implémentation CRI intégrée de `dockershim`. + +Voir [runtimes de conteneur](/docs/setup/production-environment/container-runtimes/) +pour plus d'informations. +{{% /tab %}} +{{< /tabs >}} -Reportez-vous aux [instructions d'installation de la CRI](/docs/setup/cri) pour plus d'informations. ## Installation de kubeadm, des kubelets et de kubectl @@ -108,17 +156,17 @@ Vous installerez ces paquets sur toutes vos machines: * `kubectl`: la ligne de commande utilisée pour parler à votre cluster. kubeadm **n'installera pas** ni ne gèrera les `kubelet` ou` kubectl` pour vous. -Vous devez vous assurer qu'ils correspondent à la version du control plane de Kubernetes que vous - souhaitez que kubeadm installe pour vous. Si vous ne le faites pas, vous risquez qu' - une erreur de version se produise, qui pourrait conduire à un comportement inattendu. - Cependant, une version mineure entre les kubelets et le control plane est pris en charge, - mais la version de la kubelet ne doit jamais dépasser la version de l'API server. Par exemple, - les kubelets exécutant la version 1.7.0 devraient être entièrement compatibles avec un API - server en 1.8.0, mais pas l'inverse. +Vous devez vous assurer qu'ils correspondent à la version du control plane de Kubernetes que vous souhaitez que kubeadm installe pour vous. Si vous ne le faites pas, vous risquez qu'une +erreur de version se produise, qui pourrait conduire à un comportement inattendu. +Cependant, une version mineure entre les kubelets et le control plane est pris en charge, +mais la version de la kubelet ne doit jamais dépasser la version de l'API server. +Par exemple, les kubelets exécutant la version 1.7.0 devraient être entièrement compatiblesavec un API server en 1.8.0, +mais pas l'inverse. + +For information about installing `kubectl`, see [Install and set up kubectl](/fr/docs/tasks/tools/install-kubectl/). {{< warning >}} -Ces instructions excluent tous les packages Kubernetes de toutes les mises à niveau du système -d'exploitation. +Ces instructions excluent tous les packages Kubernetes de toutes les mises à niveau du système d'exploitation. C’est parce que kubeadm et Kubernetes ont besoin d'une [attention particulière lors de la mise à niveau](/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade-1-11/). {{}} @@ -131,118 +179,131 @@ Pour plus d'informations sur les compatibilités de version, voir: {{< tabs name="k8s_install" >}} {{% tab name="Ubuntu, Debian or HypriotOS" %}} ```bash -apt-get update && apt-get install -y apt-transport-https curl -curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add - -cat </etc/apt/sources.list.d/kubernetes.list +sudo apt-get update && sudo apt-get install -y apt-transport-https curl +curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add - +cat < /etc/yum.repos.d/kubernetes.repo +cat < /etc/sysctl.d/k8s.conf - net.bridge.bridge-nf-call-ip6tables = 1 - net.bridge.bridge-nf-call-iptables = 1 - EOF - sysctl --system - ``` - - Assurez-vous que le module `br_netfilter` est chargé avant cette étape. Cela peut être fait en exécutant `lsmod | grep br_netfilter`. Pour le charger explicitement, lancez `modprobe br_netfilter`. + - Vous pouvez laisser SELinux activé si vous savez comment le configurer, mais il peut nécessiter des paramètres qui ne sont pas pris en charge par kubeadm. + {{% /tab %}} -{{% tab name="Container Linux" %}} -Installez les plugins CNI (requis pour la plupart des réseaux de pod): +{{% tab name="Fedora CoreOS ou Flatcar Container Linux" %}} +Installez les plugins CNI (requis pour la plupart des réseaux de pods) : ```bash -CNI_VERSION="v0.6.0" -mkdir -p /opt/cni/bin -curl -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-amd64-${CNI_VERSION}.tgz" | tar -C /opt/cni/bin -xz +CNI_VERSION="v0.8.2" +sudo mkdir -p /opt/cni/bin +curl -L "https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-linux-amd64-${CNI_VERSION}.tgz" | sudo tar -C /opt/cni/bin -xz ``` -Installez crictl (obligatoire pour kubeadm / Kubelet Container Runtime Interface (CRI)) +Définissez le répertoire pour télécharger les fichiers de commande + +{{< note >}} +La variable DOWNLOAD_DIR doit être définie sur un répertoire accessible en écriture. +Si vous exécutez Flatcar Container Linux, définissez DOWNLOAD_DIR=/opt/bin +{{< /note >}} ```bash -CRICTL_VERSION="v1.11.1" -mkdir -p /opt/bin -curl -L "https://github.com/kubernetes-incubator/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-amd64.tar.gz" | tar -C /opt/bin -xz +DOWNLOAD_DIR=/usr/local/bin +sudo mkdir -p $DOWNLOAD_DIR ``` -Installez `kubeadm`, `kubelet`, `kubectl` et ajouter un service systemd `kubelet`: +Installer crictl (requis pour Kubeadm / Kubelet Container Runtime Interface (CRI)) + +```bash +CRICTL_VERSION="v1.17.0" +curl -L "https://github.com/kubernetes-sigs/cri-tools/releases/download/${CRICTL_VERSION}/crictl-${CRICTL_VERSION}-linux-amd64.tar.gz" | sudo tar -C $DOWNLOAD_DIR -xz +``` + +Installez `kubeadm`,` kubelet`, `kubectl` et ajoutez un service systemd` kubelet`: ```bash RELEASE="$(curl -sSL https://dl.k8s.io/release/stable.txt)" +cd $DOWNLOAD_DIR +sudo curl -L --remote-name-all https://storage.googleapis.com/kubernetes-release/release/${RELEASE}/bin/linux/amd64/{kubeadm,kubelet,kubectl} +sudo chmod +x {kubeadm,kubelet,kubectl} -mkdir -p /opt/bin -cd /opt/bin -curl -L --remote-name-all https://storage.googleapis.com/kubernetes-release/release/${RELEASE}/bin/linux/amd64/{kubeadm,kubelet,kubectl} -chmod +x {kubeadm,kubelet,kubectl} - -curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/kubelet.service" | sed "s:/usr/bin:/opt/bin:g" > /etc/systemd/system/kubelet.service -mkdir -p /etc/systemd/system/kubelet.service.d -curl -sSL "https://raw.githubusercontent.com/kubernetes/kubernetes/${RELEASE}/build/debs/10-kubeadm.conf" | sed "s:/usr/bin:/opt/bin:g" > /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +RELEASE_VERSION="v0.4.0" +curl -sSL "https://raw.githubusercontent.com/kubernetes/release/${RELEASE_VERSION}/cmd/kubepkg/templates/latest/deb/kubelet/lib/systemd/system/kubelet.service" | sed "s:/usr/bin:${DOWNLOAD_DIR}:g" | sudo tee /etc/systemd/system/kubelet.service +sudo mkdir -p /etc/systemd/system/kubelet.service.d +curl -sSL "https://raw.githubusercontent.com/kubernetes/release/${RELEASE_VERSION}/cmd/kubepkg/templates/latest/deb/kubeadm/10-kubeadm.conf" | sed "s:/usr/bin:${DOWNLOAD_DIR}:g" | sudo tee /etc/systemd/system/kubelet.service.d/10-kubeadm.conf ``` -Activez et démarrez la `kubelet`: +Activez et démarrez `kubelet` : ```bash -systemctl enable --now kubelet +sudo systemctl enable --now kubelet ``` + +{{< note >}} +La distribution Linux Flatcar Container monte le répertoire `/usr` comme un système de fichiers en lecture seule. +Avant de démarrer votre cluster, vous devez effectuer des étapes supplémentaires pour configurer un répertoire accessible en écriture. +Consultez le [Guide de dépannage de Kubeadm](/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/#usr-mounted-read-only/) pour savoir comment configurer un répertoire accessible en écriture. +{{< /note >}} {{% /tab %}} {{< /tabs >}} -La kubelet redémarre maintenant toutes les secondes et quelques, car elle attend dans une boucle -kubeadm, pour lui dire quoi faire. +Le kubelet redémarre maintenant toutes les quelques secondes, +car il attend dans une boucle de crash que kubeadm lui dise quoi faire. ## Configurer le driver de cgroup utilisé par la kubelet sur un nœud master Lorsque vous utilisez Docker, kubeadm détecte automatiquement le pilote ( driver ) de cgroup pour la kubelet -et le configure dans le fichier `/var/lib/kubelet/kubeadm-flags.env` lors de son éxecution. +et le configure dans le fichier `/var/lib/kubelet/config.yaml` lors de son éxecution. -Si vous utilisez un autre CRI, vous devez modifier le fichier `/etc/default/kubelet` avec votre -valeur de `cgroup-driver` comme ceci: +Si vous utilisez un autre CRI, vous devez passer votre valeur `cgroupDriver` avec `kubeadm init`, comme ceci : -```bash -KUBELET_EXTRA_ARGS=--cgroup-driver= +```yaml +apiVersion: kubelet.config.k8s.io/v1beta1 +kind: KubeletConfiguration +cgroupDriver: ``` -Ce fichier sera utilisé par `kubeadm init` et` kubeadm join` pour sourcer des arguments supplémentaires définis par l'utilisateur pour la kubelet. +Pour plus de détails, veuillez lire [Utilisation de kubeadm init avec un fichier de configuration](/docs/reference/setup-tools/kubeadm/kubeadm-init/#config-file). Veuillez noter que vous devez **seulement** le faire si le driver de cgroupe de votre CRI n'est pas `cgroupfs`, car c'est déjà la valeur par défaut dans la kubelet. +{{< note >}} +Depuis que le paramettre `--cgroup-driver` est obsolète par kubelet, si vous l'avez dans`/var/lib/kubelet/kubeadm-flags.env` +ou `/etc/default/kubelet`(`/etc/sysconfig/kubelet` pour les RPM), veuillez le supprimer et utiliser à la place KubeletConfiguration +(stocké dans`/var/lib/kubelet/config.yaml` par défaut). +{{< /note >}} + Il est nécessaire de redémarrer la kubelet: ```bash @@ -250,6 +311,10 @@ sudo systemctl daemon-reload sudo systemctl restart kubelet ``` +La détection automatique du pilote cgroup pour d'autres runtimes de conteneur +comme CRI-O et containerd est un travail en cours. + + ## Dépannage Si vous rencontrez des difficultés avec kubeadm, veuillez consulter notre [documentation de dépannage](/fr/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/). @@ -258,5 +323,3 @@ Si vous rencontrez des difficultés avec kubeadm, veuillez consulter notre [docu * [Utiliser kubeadm pour créer un cluster](/fr/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/) - - From 04664781a06b96a76c5e07e3ece27a89da193970 Mon Sep 17 00:00:00 2001 From: Philippe Martin Date: Sun, 13 Dec 2020 20:24:35 +0100 Subject: [PATCH 078/258] Remove broken link to CSIStorageCapacity in API reference --- content/en/docs/concepts/storage/storage-capacity.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/storage/storage-capacity.md b/content/en/docs/concepts/storage/storage-capacity.md index 836d5d2c36..d5993d4f59 100644 --- a/content/en/docs/concepts/storage/storage-capacity.md +++ b/content/en/docs/concepts/storage/storage-capacity.md @@ -34,7 +34,7 @@ text="Container Storage Interface" term_id="csi" >}} (CSI) drivers and ## API There are two API extensions for this feature: -- [CSIStorageCapacity](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#csistoragecapacity-v1alpha1-storage-k8s-io) objects: +- CSIStorageCapacity objects: these get produced by a CSI driver in the namespace where the driver is installed. Each object contains capacity information for one storage class and defines which nodes have From 7a57ae213661b53dcc50005a7c5a1c2f3395f9d4 Mon Sep 17 00:00:00 2001 From: Arhell Date: Mon, 14 Dec 2020 01:35:35 +0200 Subject: [PATCH 079/258] [zh] fix typo --- content/zh/case-studies/appdirect/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/case-studies/appdirect/index.html b/content/zh/case-studies/appdirect/index.html index ca6b0b8fe9..3a13acaa1c 100644 --- a/content/zh/case-studies/appdirect/index.html +++ b/content/zh/case-studies/appdirect/index.html @@ -13,7 +13,7 @@ quote: > ---
-

CASE STUDY:
AppDirect: How AppDirect Supported the 10x Growth of Its Engineering Staff with Kubernetess +

CASE STUDY:
AppDirect: How AppDirect Supported the 10x Growth of Its Engineering Staff with Kubernetes

From 92e3d73e6574d261dd0071732b1b87d50839becf Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Mon, 14 Dec 2020 14:06:57 +0800 Subject: [PATCH 080/258] [zh] Drop cloud-controller-manager reference We no longer generate reference for CCM. --- .../cloud-controller-manager.md | 892 ------------------ 1 file changed, 892 deletions(-) delete mode 100644 content/zh/docs/reference/command-line-tools-reference/cloud-controller-manager.md diff --git a/content/zh/docs/reference/command-line-tools-reference/cloud-controller-manager.md b/content/zh/docs/reference/command-line-tools-reference/cloud-controller-manager.md deleted file mode 100644 index 7dc7a128ee..0000000000 --- a/content/zh/docs/reference/command-line-tools-reference/cloud-controller-manager.md +++ /dev/null @@ -1,892 +0,0 @@ ---- -title: cloud-controller-manager -content_type: tool-reference -weight: 30 ---- - -## {{% heading "synopsis" %}} - - -云控制器管理器是一个守护进程，其中包含与 Kubernetes 一起发布的特定于云平台的控制回路。 - -``` -cloud-controller-manager [flags] -``` - -## {{% heading "options" %}} - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -对来自 Webhook 鉴权组件的“authorized”响应的缓存时长。 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
--add-dir-header
- -若为 true，则将文件目录名添加到日志消息头部。 -
--allocate-node-cidrs
- -是否基于云供应商来为 Pods 分配 CIDR 并进行设置。 -
--alsologtostderr
- -在将日志输出到文件的同时也输出到标准错误输出。 -
--authentication-kubeconfig string
- -指向“核心”Kubernetes 服务器的 kubeconfig 文件，其中包含创建 -tokenreviews.authentication.k8s.io 的足够权限。此标志为可选。 -如果取值为空，则所有令牌请求都被视为匿名请求，并且不会在集群中寻找客户端的证书机构。 -
--authentication-skip-lookup
- -如果为 false，则 authentication-kubeconfig 所指的 kubeconfig -文件会被用来寻找集群中缺失的身份认证配置信息。 -
--authentication-token-webhook-cache-ttl duration     默认值：10s
- -对来自 Webhook 令牌身份认证组件的响应的缓存时长。 -
--authentication-tolerate-lookup-failure
- -如果为 true，则在集群中未找到缺失的认证配置信息也不会被认为是致命错误。 -注意，这一设置可能导致身份认证组件将所有请求都视为匿名请求。 -
--authorization-always-allow-paths stringSlice     默认值：[/healthz]
- -在鉴权期间会忽略的一组 HTTP 路径。这些路径在不与 “核心” Kubernetes -服务器沟通的前提下就会被授权。 -
--authorization-kubeconfig string
- -指向“核心” Kubernetes 服务器的 kubeconfig 文件，其中包含创建 -subjectaccessreviews.authorization.k8s.io 的足够权限。此标志为可选。 -如果取值为空，则所有未被鉴权组件忽略的请求都会被拒绝。 -
--authorization-webhook-cache-authorized-ttl duration     默认值：10s
-
--authorization-webhook-cache-unauthorized-ttl duration     默认值：10s
- -对来自 Webhook 鉴权组件的“Unauthorized”响应的缓存时长。 -
--azure-container-registry-config string
- -包含 Azure 容器仓库配置信息的文件路径。 -
--bind-address ip     默认值：0.0.0.0
- -在 --secure-port 所给端口上监听时所使用 IP 地址。所关联的网络接口必须从集群中其他部分可达， -且可被命令行和 Web 客户端访问。如果此值为空或者为未设定地址（0.0.0.0 或 ::）， -则所有接口都会被使用。 -
--cert-dir string
- -TLS 证书所在的目录。如果 --tls-cert-file 和 --tls-private-key-file -都已指定，则此标志值被忽略。 -
--cidr-allocator-type string     默认值："RangeAllocator"
- -要使用的 CIDR 分配器类型。 -
--client-ca-file string
- -若此标志被设置，所有能够提供由 client-ca-file 文件中所包含的机构之一签名的 -客户端证书的请求都会通过身份认证，且其身份标识对应客户证书中的 CommonName。 -
--cloud-config string
- -云供应商配置文件的路径。空字符串表示没有配置文件。 -
--cloud-provider string
- -云服务的供应商。空字符串表示没有供应商。 -
--cloud-provider-gce-l7lb-src-cidrs cidrs     默认值：130.211.0.0/22,35.191.0.0/16
- -在 GCE 防火墙上为第七层负载均衡器流量代理和健康检查所打开的 CIDR。 -
--cloud-provider-gce-lb-src-cidrs cidrs     默认值：130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16
- -在 GCE 防火墙上为第四层负载均衡器流量代理和健康检查所打开的 CIDR。 -
--cluster-cidr string
- -集群中 Pod 的 CIDR 范围。要求 --allocate-node-cidrs 为 true。 -
--cluster-name string     默认值： "kubernetes"
- -集群的实例前缀。 -
--concurrent-service-syncs int32     默认值： 1
- -可并发同步的服务个数。较大数值意味着服务管理的响应能力更高，不过也意味着更多的 -CPU （和网络）压力。 -
--configure-cloud-routes     默认值： true
- -是否要在云供应商平台上配置由 allocate-node-cidrs 所分配的 CIDRs。 -
--contention-profiling
- -启用锁竞争分析，前提是 profiling 被弃用。 -
--controller-start-interval duration
- -启动控制器管理器之间的时间间隔。 -
--controllers stringSlice     默认值：[*]
- -一组要启用的控制器列表。'*' 意味着要启用所有默认打开的控制器，'foo' -意味着要启用名为 'foo' 的控制器；'-foo' 意味着要禁用名为 'foo' 的控制器。
-控制器全集：cloud-node、cloud-node-lifecycle、 -route、service。 -默认禁用的控制器：<无>。 -
--external-cloud-volume-plugin string
- -当云驱动被设置为 external 时要使用的插件。可以为空，只有当 cloud-provider 为 -external 时才应设置。当前用来保证内置的云驱动的节点控制器和卷控制器能够正常工作。 -
--feature-gates mapStringBool
-一组 key=value 偶对，描述 alpha/试验性功能的特性门控。可选项包括：
-APIListChunking=true|false (BETA - 默认值=true)
-APIPriorityAndFairness=true|false (ALPHA - 默认值=false)
-APIResponseCompression=true|false (BETA - 默认值=true)
-AllAlpha=true|false (ALPHA - 默认值=false)
-AllBeta=true|false (BETA - 默认值=false)
-AllowInsecureBackendProxy=true|false (BETA - 默认值=true)
-AnyVolumeDataSource=true|false (ALPHA - 默认值=false)
-AppArmor=true|false (BETA - 默认值=true)
-BalanceAttachedNodeVolumes=true|false (ALPHA - 默认值=false)
-BoundServiceAccountTokenVolume=true|false (ALPHA - 默认值=false)
-CPUManager=true|false (BETA - 默认值=true)
-CRIContainerLogRotation=true|false (BETA - 默认值=true)
-CSIInlineVolume=true|false (BETA - 默认值=true)
-CSIMigration=true|false (BETA - 默认值=true)
-CSIMigrationAWS=true|false (BETA - 默认值=false)
-CSIMigrationAWSComplete=true|false (ALPHA - 默认值=false)
-CSIMigrationAzureDisk=true|false (BETA - 默认值=false)
-CSIMigrationAzureDiskComplete=true|false (ALPHA - 默认值=false)
-CSIMigrationAzureFile=true|false (ALPHA - 默认值=false)
-CSIMigrationAzureFileComplete=true|false (ALPHA - 默认值=false)
-CSIMigrationGCE=true|false (BETA - 默认值=false)
-CSIMigrationGCEComplete=true|false (ALPHA - 默认值=false)
-CSIMigrationOpenStack=true|false (BETA - 默认值=false)
-CSIMigrationOpenStackComplete=true|false (ALPHA - 默认值=false)
-CSIMigrationvSphere=true|false (BETA - 默认值=false)
-CSIMigrationvSphereComplete=true|false (BETA - 默认值=false)
-CSIStorageCapacity=true|false (ALPHA - 默认值=false)
-CSIVolumeFSGroupPolicy=true|false (ALPHA - 默认值=false)
-ConfigurableFSGroupPolicy=true|false (ALPHA - 默认值=false)
-CustomCPUCFSQuotaPeriod=true|false (ALPHA - 默认值=false)
-DefaultPodTopologySpread=true|false (ALPHA - 默认值=false)
-DevicePlugins=true|false (BETA - 默认值=true)
-DisableAcceleratorUsageMetrics=true|false (ALPHA - 默认值=false)
-DynamicKubeletConfig=true|false (BETA - 默认值=true)
-EndpointSlice=true|false (BETA - 默认值=true)
-EndpointSliceProxying=true|false (BETA - 默认值=true)
-EphemeralContainers=true|false (ALPHA - 默认值=false)
-ExpandCSIVolumes=true|false (BETA - 默认值=true)
-ExpandInUsePersistentVolumes=true|false (BETA - 默认值=true)
-ExpandPersistentVolumes=true|false (BETA - 默认值=true)
-ExperimentalHostUserNamespaceDefaulting=true|false (BETA - 默认值=false)
-GenericEphemeralVolume=true|false (ALPHA - 默认值=false)
-HPAScaleToZero=true|false (ALPHA - 默认值=false)
-HugePageStorageMediumSize=true|false (BETA - 默认值=true)
-HyperVContainer=true|false (ALPHA - 默认值=false)
-IPv6DualStack=true|false (ALPHA - 默认值=false)
-ImmutableEphemeralVolumes=true|false (BETA - 默认值=true)
-KubeletPodResources=true|false (BETA - 默认值=true)
-LegacyNodeRoleBehavior=true|false (BETA - 默认值=true)
-LocalStorageCapacityIsolation=true|false (BETA - 默认值=true)
-LocalStorageCapacityIsolationFSQuotaMonitoring=true|false (ALPHA - 默认值=false)
-NodeDisruptionExclusion=true|false (BETA - 默认值=true)
-NonPreemptingPriority=true|false (BETA - 默认值=true)
-PodDisruptionBudget=true|false (BETA - 默认值=true)
-PodOverhead=true|false (BETA - 默认值=true)
-ProcMountType=true|false (ALPHA - 默认值=false)
-QOSReserved=true|false (ALPHA - 默认值=false)
-RemainingItemCount=true|false (BETA - 默认值=true)
-RemoveSelfLink=true|false (ALPHA - 默认值=false)
-RotateKubeletServerCertificate=true|false (BETA - 默认值=true)
-RunAsGroup=true|false (BETA - 默认值=true)
-RuntimeClass=true|false (BETA - 默认值=true)
-SCTPSupport=true|false (BETA - 默认值=true)
-SelectorIndex=true|false (BETA - 默认值=true)
-ServerSideApply=true|false (BETA - 默认值=true)
-ServiceAccountIssuerDiscovery=true|false (ALPHA - 默认值=false)
-ServiceAppProtocol=true|false (BETA - 默认值=true)
-ServiceNodeExclusion=true|false (BETA - 默认值=true)
-ServiceTopology=true|false (ALPHA - 默认值=false)
-SetHostnameAsFQDN=true|false (ALPHA - 默认值=false)
-StartupProbe=true|false (BETA - 默认值=true)
-StorageVersionHash=true|false (BETA - 默认值=true)
-SupportNodePidsLimit=true|false (BETA - 默认值=true)
-SupportPodPidsLimit=true|false (BETA - 默认值=true)
-Sysctls=true|false (BETA - 默认值=true)
-TTLAfterFinished=true|false (ALPHA - 默认值=false)
-TokenRequest=true|false (BETA - 默认值=true)
-TokenRequestProjection=true|false (BETA - 默认值=true)
-TopologyManager=true|false (BETA - 默认值=true)
-ValidateProxyRedirects=true|false (BETA - 默认值=true)
-VolumeSnapshotDataSource=true|false (BETA - 默认值=true)
-WarningHeaders=true|false (BETA - 默认值=true)
-WinDSR=true|false (ALPHA - 默认值=false)
-WinOverlay=true|false (ALPHA - 默认值=false)
-WindowsEndpointSliceProxying=true|false (ALPHA - 默认值=false) -
-h, --help
- -cloud-controller-manager 的帮助信息。 -
--http2-max-streams-per-connection int
- -在 HTTP/2 连接中，服务器为客户端提供的最大流式连接个数。0 意味着使用 Go -语言库中的默认值。 -
--kube-api-burst int32     默认值：30
- -在与 Kubernetes API 服务器通信时可使用的突发性请求速率。 -
--kube-api-content-type string     默认值："application/vnd.kubernetes.protobuf"
- -向 API 服务器发送请求时使用的内容类型（Content-Type）。 -
--kube-api-qps float32     默认值：20
- -与 Kubernetes API 服务器通信时要遵循的 QPS（每秒查询数）约束。 -
--kubeconfig string
- -指向 kubeconfig 文件的路径；该文件中包含鉴权信息以及主控节点位置信息。 -
--leader-elect     默认值：true
- -启动领导者选举客户端，并在开始执行主循环之前尝试获得领导者角色。 -在运行多副本组件时启用此标志以达到高可用性。 -
--leader-elect-lease-duration duration     默认值：15s
- -当观察到领导者需要续约时，当前处于非领导者角色的候选组件要等待这里设置的时长， -之后才能尝试去获得曾经处于领导者角色但未能成功续约的席位。 -此标志值本质上是当前领导者在被其他候选者替代之前可以停止的最长时长。 -只有启用了领导者选举时此标志值才有意义。 -
--leader-elect-renew-deadline duration     默认值： 10s
- -当前领导者身份的组件在停止领导角色前需要对领导者席位续约，此标志值设置续约操作时间间隔。 -此值必须小于等于租期时长。只有启用了领导者选举时此标志值才有意义。 -
--leader-elect-resource-lock string     默认值："endpointsleases"
- -在领导者选举期间用来锁定的资源对象类型。支持的选项包括 -'endpoints'、'configmaps'、'leases'、 -'endpointsleases' 和 'configmapsleases'。 -
--leader-elect-resource-name string     默认值："cloud-controller-manager"
- -在领导者选举期间用来锁定的资源对象名称。 -
--leader-elect-resource-namespace string     默认值："kube-system"
- -在领导者选举期间用来锁定的资源对象的名字空间。 -
--leader-elect-retry-period duration     默认值：2s
- -客户端在尝试抢占或者续约领导者席位时连续两次尝试之间的时间间隔。 -仅在启用了领导者选举时可用。 -
--log-backtrace-at traceLocation     默认值：:0
- -当日志机制执行到文件行 file:N 时打印调用堆栈。 -
--log-dir string
- -若此标志值非空，则将日志写入到所指定的目录中。 -
--log-file string
- -当此标志值非空时，表示使用该字符串值作为日志文件名。 -
--log-file-max-size uint     默认值：1800
- -定义日志文件可增长到的最大尺寸。单位为 MB 字节。如果此值为 -0，则不限制文件的最大尺寸。 -
--log-flush-frequency duration     默认值：5s
- -相邻两次日志清洗操作之间的最大间隔秒数。 -
--logtostderr     默认值：true
- -将日支输出到标准错误输出而不是日志文件中。 -
--master string
- -Kubernetes API 服务器的地址（覆盖 kubeconfig 文件中的设置值。 -
--min-resync-period duration     默认值：12h0m0s
- -反射器（Reflectors）的再同步周期将介于 min-resync-period 和 -2*min-resync-period 之间。 -
--node-monitor-period duration     默认值：5s
- -在节点控制器中对节点状态进行同步的周期。 -
--node-status-update-frequency duration     默认值：5m0s
- -设置控制器更新节点状态的频率。 -
--permit-port-sharing
- -此标志值为 true 时，在绑定端口时将使用 SO_REUSEPORT -标志，允许多个实例绑定到同一地址和端口。默认值为 false。 -
--profiling     默认值：true
- -通过 Web 接口 host:port/debug/pprof/ 提供性能观测。 -
--requestheader-allowed-names stringSlice
- -客户证书中 CommonName 的列表，用于允许通过 --requestheader-allowed-names -标识所设置的头部中提供用户名。此标志值为空时，通过 ---requestheader-client-ca-file 中的机构验证的所有客户端证书都可使用。 -
--requestheader-client-ca-file string
- -用来对所收到的请求中客户端证书进行验证的根证书包。在此验证之前，不能信任 ---requestheader-username-headers 所指定的头部中的用户名。 -警告：此操作一般不会理会是否已经对所收到的请求执行了鉴权。 -
--requestheader-extra-headers-prefix stringSlice     默认值：[x-remote-extra-]
- -要检查的请求头部前缀列表。建议使用 X-Remote-Extra-。 -
--requestheader-group-headers stringSlice     默认值：[x-remote-group]
- -为获取组名而要检查的请求头部列表。建议使用 X-Remote-Group。 -
--requestheader-username-headers stringSlice     默认值：[x-remote-user]
- -为获取用户名而要检查的请求头部列表。常用的是 X-Remote-User。 -
--route-reconciliation-period duration     默认值：10s
- -对云供应商为节点所创建的路由进行协商的周期。 -
--secure-port int     默认值：10258
- -此标志值给出的是一个端口号，云控制器管理器在此端口上提供 HTTPS 服务以供身份认证和鉴权。 -如果此值为 0，则云控制器管理器不提供 HTTPS 服务。 -
--skip-headers
- -此值为 true 时，不在日志消息中添加头部前缀。 -
--skip-log-headers
- -此标志值为 true 时，不在打开日志文件时使用头部。 -
--stderrthreshold severity     默认值：2
- -处于或者高于此阈值的日志消息会被输出到标准错误输出。 -
--tls-cert-file string
- -为 HTTPS 通信所给出的默认 x509 证书文件。如果有机构证书，要串接在服务器证书之后。 -当启用 HTTPS 服务时，如果 --tls-cert-file 和 --tls-private-key-file 未设置， -则组件会自动生成一个自签名的证书和密钥，用于公开的网络地址，并将其保存在 ---cert-dir 所指定的目录下。 -
--tls-cipher-suites stringSlice
- -为服务器设定的逗号分隔的加密包列表。如果忽略此标志，则使用默认的 Go 语言加密包。
-优选的设置：TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384.
-不安全的配置值：TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_RC4_128_SHA. -
--tls-min-version string
- -所支持的 TLS 最低版本。可选值为：VersionTLS10、VersionTLS11、 -VersionTLS12、VersionTLS13。 -
--tls-private-key-file string
- -包含与 --tls-cert-file 所设定证书匹配的默认 x509 私钥文件。 -
--tls-sni-cert-key namedCertKey     默认值：[]
- -一组 x509 证书和私钥文件路径偶对。可选地，可以在路径名之后添加域名模式的后缀， -每个后缀都是一个全限定的域名，也可带有前置的通配符部分。 -域名模式也允许使用 IP 地址，不过只有 API 服务器可以在客户请求的 IP 地址上访问 -时才可使用 IP 地址。如果未指定域名模式，则从证书中抽取名字。 -非通配符的匹配要优先于通配符匹配；显式的域名模式匹配也优先于抽取名字匹配。 -对于多个密钥/证书偶对，可多次使用 --tls-sni-cert-key 标志。 -例如："example.crt,example.key" 或 -"foo.crt,foo.key:*.foo.com,foo.com"。 -
--use-service-account-credentials
- -此标志值为 true 时，为每个控制器使用独立的服务账号凭据。 -
-v, --v Level
- -日志级别详细程度值。 -
--version version[=true]
- -打印版本信息并退出。 -
--vmodule moduleSpec
- -逗号分隔的 pattern=N 字符串列表，用来基于文件来执行日志操作。 -
- - - From 5526f4abd1b64970b74a7533f1a012545a74567e Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Sat, 12 Dec 2020 23:45:55 +0800 Subject: [PATCH 081/258] Update configure-runasusername.md Apply suggestions from code review Co-authored-by: Qiming Teng Update configure-runasusername.md apply suggestions --- .../configure-runasusername.md | 29 ++++++++----------- 1 file changed, 12 insertions(+), 17 deletions(-) diff --git a/content/zh/docs/tasks/configure-pod-container/configure-runasusername.md b/content/zh/docs/tasks/configure-pod-container/configure-runasusername.md index b64a51b2ab..19a9e4e71e 100644 --- a/content/zh/docs/tasks/configure-pod-container/configure-runasusername.md +++ b/content/zh/docs/tasks/configure-pod-container/configure-runasusername.md @@ -12,22 +12,13 @@ weight: 20 -{{< feature-state for_k8s_version="v1.17" state="beta" >}} +{{< feature-state for_k8s_version="v1.18" state="stable" >}} -本页展示如何为运行在 Windows 节点上的 pod 和容器启用并使用 `RunAsUserName` 功能。 -此功能旨在成为 Windows 版的 `runAsUser`（Linux），允许用户使用与默认用户名不同的 -用户名运行容器 entrypoint。 - - -{{< note >}} -此功能目前处于 Beta 状态。`RunAsUserName` 的整体功能不会出现变更， -但是关于用户名验证的部分可能会有所更改。 -{{< /note >}} +本页展示如何为运行为在 Windows 节点上运行的 Pod 和容器配置 `RunAsUserName` 。 +大致相当于 Linux 上的 `runAsUser`，允许在容器中以与默认值不同的用户名运行应用。 ## {{% heading "prerequisites" %}} @@ -45,9 +36,9 @@ To specify the username with which to execute the Pod's container processes, inc ## 为 Pod 设置 Username 要指定运行 Pod 容器时所使用的用户名，请在 Pod 声明中包含 `securityContext` -（[PodSecurityContext](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritycontext-v1-core)）字段， +（[PodSecurityContext](/zh/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#podsecuritycontext-v1-core)）字段， 并在其内部包含 `windowsOptions` -（[WindowsSecurityContextOptions](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#windowssecuritycontextoptions-v1-core)） +（[WindowsSecurityContextOptions](/zh/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#windowssecuritycontextoptions-v1-core)） 字段的 `runAsUserName` 字段。 在前述示例中，`create service nodeport` 命令也称作 `create service` -命令的子命令： +命令的子命令。 +可以使用 `-h` 标志找到一个子命令所支持的参数和标志。 ```shell kubectl create service nodeport -h From 36f4b20a539a629a973db80441737c76c0b1c977 Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Mon, 14 Dec 2020 15:37:59 +0800 Subject: [PATCH 084/258] Create 2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md --- ...dding-Support-For-Kubernetes-In-Rancher.md | 89 +++++++++++++++++++ 1 file changed, 89 insertions(+) create mode 100644 content/zh/blog/_posts/2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md diff --git a/content/zh/blog/_posts/2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md b/content/zh/blog/_posts/2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md new file mode 100644 index 0000000000..c018c0c9da --- /dev/null +++ b/content/zh/blog/_posts/2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md @@ -0,0 +1,89 @@ +--- +title: " 在 Rancher 中添加对 Kuernetes 的支持 " +date: 2016-04-08 +slug: adding-support-for-kubernetes-in-rancher +url: /blog/2016/04/Adding-Support-For-Kubernetes-In-Rancher +--- + + +_今天的来宾帖子由 Rancher Labs（用于管理容器的开源软件平台）的首席架构师 Darren Shepherd 撰写。_ + + + +在过去的一年中，我们看到希望在其软件开发和IT组织中利用容器的公司数量激增。 +为了实现这一目标，组织一直在研究如何构建集中式的容器管理功能，该功能将使用户可以轻松访问容器，同时集中管理IT组织的可见性和控制力。 +2014年，我们启动了开源 Rancher 项目，通过构建容器管理平台来解决此问题。 + + +最近，我们发布了 Rancher v1.0。 +在此最新版本中，用于管理容器的开源软件平台 [Rancher](http://www.rancher.com/) 现在在创建环境时支持 Kubernetes 作为容器编排框架。 +现在，使用 Rancher 启动 Kubernetes 环境是完全自动化的，只需 5 至 10 分钟即可交付运行正常的集群。 + + +我们创建 Rancher 的目的是为组织提供完整的容器管理平台。 +作为其中的一部分，我们始终支持使用 Docker API 和 Docker Compose 在本地部署 Docker 环境。 +自成立以来， Kubernetes 的运营成熟度给我们留下了深刻的印象，而在此版本中，我们使得其可以在同一管理平台上部署各种容器编排和调度框架。 + + +添加 Kubernetes 使用户可以访问增长最快的平台之一，用于在生产中部署和管理容器。 +我们将在 Rancher 中提供一流的 Kubernetes 支持，并将继续支持本机 Docker 部署。 + + +**将 Kubernetes 带到 Rancher** + + ![Kubernetes deployment-3.PNG](https://lh6.googleusercontent.com/bhmC1-XO5T-itFN3ZsCQmrxUSSEcnezaL-qch6ILWvJRnbhEBZZlAMEj-RcNgkM9XVEUzsRMsvDGc7u8f-M19Jdk_J0GCoO-gZTCZDtgkokgqNkCgP98o8W29xD0kmKiMPeLN-Tt) + + +我们的平台已经可以扩展为各种不同的包装格式，因此我们对拥抱 Kubernetes 感到乐观。 +没错，作为开发人员，与 Kubernetes 项目一起工作是一次很棒的经历。 +该项目的设计使这一操作变得异常简单，并且我们能够利用插件和扩展来构建 Kubernetes 发行版，从而利用我们的基础架构和应用程序服务。 +例如，我们能够将 Rancher 的软件定义的网络，存储管理，负载平衡，DNS 和基础结构管理功能直接插入 Kubernetes，而无需更改代码库。 + + + +更好的是，我们已经能够围绕 Kubernetes 核心功能添加许多服务。 +例如，我们在 Kubernetes 上实现了常用的 [应用程序目录](https://github.com/rancher/community-catalog/tree/master/kubernetes-templates) 。 +过去，我们曾使用Docker Compose定义应用程序模板，但是在此版本中，我们现在支持 Kubernetes 服务，复制控制器和 Pod 来部署应用程序。使用目录，用户可以连接到 git repo 并自动部署和升级作为 Kubernetes 服务部署到应用程序。 +然后，用户只需单击一下按钮，即可配置和部署复杂的多节点企业应用程序。 +升级也是完全自动化的，并集中向用户推出。 + + + +**回馈** + + +与 Kubernetes 一样，Rancher 是一个开源软件项目，任何人均可免费使用，并且不受任何限制地分发给社区。 +您可以在 [GitHub](http://www.github.com/rancher/rancher) 上找到 Rancher 的所有源代码，即将发布的版本和问题。 +我们很高兴加入 Kubernetes 社区，并期待与所有其他贡献者合作。 +在Rancher [here](http://rancher.com/kubernetes/) 中查看有关 Kubernetes 新支持的演示。  + + +_-- Rancher Labs 首席架构师 Darren Shepherd_ From e944fb1476837433827c06e2c56d2f5c0df863be Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Mon, 14 Dec 2020 16:10:04 +0800 Subject: [PATCH 085/258] [zh] Sync changes to kubeadm reference This PR syncs changes made to kubeadm reference in 1.20. --- .../kubeadm_alpha_kubeconfig_user.md | 78 +- .../kubeadm_init_phase_control-plane_all.md | 56 +- ...eadm_init_phase_control-plane_apiserver.md | 20 +- ..._phase_control-plane_controller-manager.md | 29 +- ...eadm_init_phase_control-plane_scheduler.md | 23 +- .../kubeadm_init_phase_upload-certs.md | 16 +- .../kubeadm/implementation-details.md | 725 +++++++++++------- .../setup-tools/kubeadm/kubeadm-alpha.md | 99 +-- .../setup-tools/kubeadm/kubeadm-init.md | 58 +- .../setup-tools/kubeadm/kubeadm-version.md | 18 +- 10 files changed, 623 insertions(+), 499 deletions(-) diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md index 29dbd3e895..daa5b679e2 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_kubeconfig_user.md @@ -2,19 +2,16 @@ - ### 概要 - 为其他用户输出 kubeconfig 文件。 - Alpha 免责声明：此命令当前为 Alpha 功能。 ``` @@ -23,19 +20,22 @@ kubeadm alpha kubeconfig user [flags] +``` + # Output a kubeconfig file for an additional user named foo using a kubeadm config file bar + kubeadm alpha kubeconfig user --client-name=foo --config=bar +``` +--> ### 示例 ``` -# 为名为 foo 的其他用户输出 kubeconfig 文件 -kubeadm alpha kubeconfig user --client-name=foo +# 使用名为 bar 的 kubeadm 配置文件为名为 foo 的另一用户输出 kubeconfig 文件 +kubeadm alpha kubeconfig user --client-name=foo --config=bar ``` - ### 选项 @@ -45,52 +45,6 @@ kubeadm alpha kubeconfig user --client-name=foo - - - - - - - - - - - - - - - - - - - - - @@ -99,7 +53,19 @@ The path where certificates are stored -用户名。如果创建了客户端证书，它将用作 CN。 +用户名。如果生成客户端证书，则用作其 CN。 + + + + + + + + @@ -123,13 +89,14 @@ user 操作的帮助命令 -客户端证书的组织。如果创建了客户端证书，它将用作 O。 +客户端证书的组织。如果创建客户端证书，此值将用作其 O 字段值。 +
--apiserver-advertise-address string
- -可通过以下网址访问 API 服务器的 IP 地址 -
- ---apiserver-bind-port int32     默认值: 6443 -
- -可通过其访问 API 服务器的端口 -
- ---cert-dir string     默认值: "/etc/kubernetes/pki" -
- -证书存储的路径 -
--client-name string
--config string
+ +指向 kubeadm 配置文件的路径
--token string
- ### 从父命令继承的选项 diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md index fe02e3d078..c4eb30e987 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_all.md @@ -2,13 +2,11 @@ - ### 概要 - 生成所有的静态 Pod 清单文件 ``` @@ -17,27 +15,27 @@ kubeadm init phase control-plane all [flags] - - ### 示例 ``` -# 为 etcd 生成静态 Pod 清单文件，其功能等效于 kubeadm init 生成的文件。 +# 为控制平面组件生成静态 Pod 清单文件，其功能等效于 kubeadm init 生成的文件。 kubeadm init phase control-plane all -# 使用从配置文件读取的选项为 etcd 生成静态 Pod 清单文件。 +# 使用从某配置文件中读取的选项为生成静态 Pod 清单文件。 kubeadm init phase control-plane all --config config.yaml ``` - ### 选项
@@ -60,19 +58,15 @@ API 服务器所公布的其正在监听的 IP 地址。如果未设置，将使 - + + @@ -84,7 +78,8 @@ Port for the API Server to bind to. -传递给 API 服务器一组额外的参数或者以 <flagname>=<value> 的形式覆盖默认值。 +形式为 <flagname>=<value> 的一组额外参数，用来传递给 API 服务器， +或者覆盖其默认配置值 @@ -137,7 +132,25 @@ Specify a stable IP address or DNS name for the control plane. -传递给控制管理器（Controller Manager）一组额外的标志或者以 <flagname>=<value> 的形式覆盖默认值。 +一组形式为 <flagname>=<value> 的额外参数，用来传递给控制管理器（Controller Manager） +或覆盖其默认设置值 + + + + + + + + @@ -149,7 +162,7 @@ A set of extra flags to pass to the Controller Manager or override default ones -一组用来描述各种功能特性的键值（key=value）对。选项是： +一组用来描述各种特性门控的键值（key=value）对。选项是：
IPv6DualStack=true|false (ALPHA - 默认=false)
PublicKeysECDSA=true|false (ALPHA - 默认=false) @@ -209,7 +222,7 @@ Choose a specific Kubernetes version for the control plane. -指定 Pod 网络的 IP 地址范围。如果已设置，控制平面将自动地为每个节点分配 CIDR。 +指定 Pod 网络的 IP 地址范围。如果设置了此标志，控制平面将自动地为每个节点分配 CIDR。 @@ -221,6 +234,9 @@ Specify range of IP addresses for the pod network. If set, the control plane wil +一组形式为 <flagname>=<value> 的额外参数，用来传递给调度器（Scheduler） +或覆盖其默认设置值 + 传递给调度器（scheduler）一组额外的参数或者以 <flagname>=<value> 形式覆盖其默认值。 @@ -248,7 +264,6 @@ Use alternative range of IP address for service VIPs. - ### 从父指令继承的选项
- ---apiserver-bind-port int32     默认值：6443 ---apiserver-bind-port int32     默认值：6443
-要绑定到 API 服务器的端口。 +API 服务器要绑定的端口。
--experimental-patches string
+ +包含名为 "target[suffix][+patchtype].extension" 的文件的目录。 +例如，"kube-apiserver0+merge.yaml" 或者 "etcd.json"。 +"patchtype" 可以是 "strategic"、"merge" 或 "json" 之一，分别与 kubectl +所支持的 patch 格式相匹配。默认的 "patchtype" 是 "strategic"。 +"extension" 必须是 "json" 或 "yaml"。 +"suffix" 是一个可选的字符串，用来确定按字母顺序排序时首先应用哪些 patch。
@@ -272,3 +287,4 @@ Use alternative range of IP address for service VIPs.
+ diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md index e480efd952..39d9316717 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_apiserver.md @@ -1,13 +1,11 @@ - ### 概要 - 生成 kube-apiserver 静态 Pod 清单 ``` @@ -17,7 +15,6 @@ kubeadm init phase control-plane apiserver [flags] - ### 选项 @@ -64,7 +61,8 @@ Port for the API Server to bind to. -一组额外的参数以 <flagname>=<value> 形式传递给 API 服务器或者覆盖默认参数 +一组 <flagname>=<value> 形式的额外参数，用来传递给 API 服务器 +或者覆盖其默认参数配置 @@ -109,6 +107,18 @@ Specify a stable IP address or DNS name for the control plane. + + + + @@ -117,7 +127,7 @@ Specify a stable IP address or DNS name for the control plane. -一组键值对，用于描述各种特征的特征事项。选项是： +一组键值对，用于描述各种功能特性的特性门控。选项是：
IPv6DualStack=true|false (ALPHA - 默认=false)
PublicKeysECDSA=true|false (ALPHA - 默认=false) diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_controller-manager.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_controller-manager.md index f13f966676..d35b86f363 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_controller-manager.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_controller-manager.md @@ -2,13 +2,11 @@ - ### 概要 - 生成 kube-controller-manager 静态 Pod 清单 ``` @@ -18,7 +16,6 @@ kubeadm init phase control-plane controller-manager [flags] - ### 选项
+ +包含名为 "target[suffix][+patchtype].extension" 的文件的目录。 +例如，"kube-apiserver0+merge.yaml" 或者 "etcd.json"。 +"patchtype" 可以是 "strategic"、"merge" 或 "json" 之一，分别与 kubectl +所支持的 patch 格式相匹配。默认的 "patchtype" 是 "strategic"。 +"extension" 必须是 "json" 或 "yaml"。 +"suffix" 是一个可选的字符串，用来确定按字母顺序排序时首先应用哪些 patch。 +
--feature-gates string
@@ -29,12 +26,8 @@ kubeadm init phase control-plane controller-manager [flags] - + + + + + + @@ -123,7 +129,7 @@ Choose a specific Kubernetes version for the control plane. -指定 Pod 网络的 IP 地址范围。如果已设置，控制平面将自动为每个节点分配 CIDR。 +指定 Pod 网络的 IP 地址范围。如果设置，控制平面将自动为每个节点分配 CIDR。 @@ -133,7 +139,6 @@ Specify range of IP addresses for the pod network. If set, the control plane wil - ### 从父命令继承的选项
- ---cert-dir string     默认值："/etc/kubernetes/pki" ---cert-dir string     默认值："/etc/kubernetes/pki"
@@ -65,7 +58,20 @@ kubeadm 配置文件的路径。 -一组额外的参数以 <flagname>=< 形式传递给 Controller Manager 或者覆盖默认参数 +一组 <flagname>=< 形式的额外参数，传递给控制器管理器（Controller Manager） +或者覆盖其默认配置值 +
+ +包含名为 "target[suffix][+patchtype].extension" 的文件的目录。 +例如，"kube-apiserver0+merge.yaml" 或者 "etcd.json"。 +"patchtype" 可以是 "strategic"、"merge" 或 "json" 之一，分别与 kubectl +所支持的 patch 格式相匹配。默认的 "patchtype" 是 "strategic"。 +"extension" 必须是 "json" 或 "yaml"。 +"suffix" 是一个可选的字符串，用来确定按字母顺序排序时首先应用哪些 patch。
diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_scheduler.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_scheduler.md index fea8bf741a..ce801ff399 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_scheduler.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_control-plane_scheduler.md @@ -2,13 +2,11 @@ - ### 概要 - 生成 kube-scheduler 静态 Pod 清单 ``` @@ -18,7 +16,6 @@ kubeadm init phase control-plane scheduler [flags] - ### 选项
@@ -57,6 +54,22 @@ kubeadm 配置文件的路径。 + + + + + + + + @@ -111,7 +124,8 @@ Choose a specific Kubernetes version for the control plane. -一组额外的参数以 <flagname>=<value> 形式传递给 Scheduler 或者覆盖默认参数 +一组 <flagname>=<value> 形式的额外参数，用来传递给调度器 +或者覆盖其默认参数配置 @@ -121,7 +135,6 @@ A set of extra flags to pass to the Scheduler or override default ones in form o - ### 继承于父命令的选项
--experimental-patches string
+ +包含名为 "target[suffix][+patchtype].extension" 的文件的目录。 +例如，"kube-apiserver0+merge.yaml" 或者 "etcd.json"。 +"patchtype" 可以是 "strategic"、"merge" 或 "json" 之一，分别与 kubectl +所支持的 patch 格式相匹配。默认的 "patchtype" 是 "strategic"。 +"extension" 必须是 "json" 或 "yaml"。 +"suffix" 是一个可选的字符串，用来确定按字母顺序排序时首先应用哪些 patch。 +
-h, --help
diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-certs.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-certs.md index b6c1567677..bf88802947 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-certs.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init_phase_upload-certs.md @@ -2,13 +2,11 @@ - ### 概要 - 此命令并非设计用来单独运行。请参阅可用子命令列表。 ``` @@ -18,7 +16,6 @@ kubeadm init phase upload-certs [flags] - ### 选项
@@ -64,6 +61,18 @@ upload-certs 操作的帮助命令 + + + + + + + + + @@ -94,7 +103,6 @@ Upload control-plane certificates to the kubeadm-certs Secret. - ### 从父命令继承的选项
--kubeconfig string     默认值："/etc/kubernetes/admin.conf"
+用来与集群通信的 kubeconfig 文件。 +如果此标志未设置，则可以在一组标准的位置搜索现有的 kubeconfig 文件。 +
--skip-certificate-key-print
diff --git a/content/zh/docs/reference/setup-tools/kubeadm/implementation-details.md b/content/zh/docs/reference/setup-tools/kubeadm/implementation-details.md index 4d8ea53fa3..ee17bb699a 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/implementation-details.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/implementation-details.md @@ -4,14 +4,12 @@ content_type: concept weight: 100 --- @@ -31,11 +29,13 @@ with the aim of sharing knowledge on Kubernetes cluster best practices. 本文档提供了更多幕后的详细信息，旨在分享有关 Kubernetes 集群最佳实践的知识。 - + ## 核心设计原则 {#core-design-principles} -`kubeadm init` 和 `kubeadm join` 设置的集群应为： +`kubeadm init` 和 `kubeadm join` 设置的集群该是： - - **安全**：它应采用最新的最佳实践，例如： - - 应用 RBAC - - 使用节点鉴权机制（Node Authorizer） - - 在控制平面组件之间使用安全通信 - - 在 API 服务器和 kubelet 之间使用安全通信 - - 锁定 kubelet API - - 锁定对系统组件（例如 kube-proxy 和 CoreDNS）的 API 的访问 - - 锁定启动引导令牌（Bootstrap Token）可以访问的内容 - - **易用**：用户只需要运行几个命令即可： - - `kubeadm init` - - `export KUBECONFIG=/etc/kubernetes/admin.conf` - - `kubectl apply -f ` - - `kubeadm join --token :` - - **可扩展**： - - _不_ 应偏向任何特定的网络提供商。不涉及配置集群网络 - - 应该可以使用配置文件来自定义各种参数 +--> +- **安全的**：它应采用最新的最佳实践，例如： + - 实施 RBAC 访问控制 + - 使用节点鉴权机制（Node Authorizer） + - 在控制平面组件之间使用安全通信 + - 在 API 服务器和 kubelet 之间使用安全通信 + - 锁定 kubelet API + - 锁定对系统组件（例如 kube-proxy 和 CoreDNS）的 API 的访问 + - 锁定启动引导令牌（Bootstrap Token）可以访问的内容 +- **易用的**：用户只需要运行几个命令即可： + - `kubeadm init` + - `export KUBECONFIG=/etc/kubernetes/admin.conf` + - `kubectl apply -f <所选网络.yaml>` + - `kubeadm join --token <令牌> <端点>:<端口>` +- **可扩展的**： + - _不_ 应偏向任何特定的网络提供商。不涉及配置集群网络 + - 应该可以使用配置文件来自定义各种参数 - + ## 常量以及众所周知的值和路径 {#constants-and-well-known-values-and-paths} -为了降低复杂性并简化基于 kubeadm 的高级工具的开发，对于众所周知的路径和文件名，它使用了一组有限的常量值。 +为了降低复杂性并简化基于 kubeadm 的高级工具的开发，对于众所周知的路径和文件名， +kubeadm 使用了一组有限的常量值。 -Kubernetes 目录 `/etc/kubernetes` 在应用程序中是一个常量，因为在大多数情况下它显然是给定的路径，并且是最直观的位置； -其他路径常量和文件名有： +Kubernetes 目录 `/etc/kubernetes` 在应用程序中是一个常量，因为在大多数情况下 +它显然是给定的路径，并且是最直观的位置；其他路径常量和文件名有： - `/etc/kubernetes/manifests` 作为 kubelet 查找静态 Pod 清单的路径。静态 Pod 清单的名称为： - - `etcd.yaml` - - `kube-apiserver.yaml` - - `kube-controller-manager.yaml` - - `kube-scheduler.yaml` + - `etcd.yaml` + - `kube-apiserver.yaml` + - `kube-controller-manager.yaml` + - `kube-scheduler.yaml` - `/etc/kubernetes/` 作为带有控制平面组件身份标识的 kubeconfig 文件的路径。kubeconfig 文件的名称为： - - `kubelet.conf` (在 TLS 引导时名称为 `bootstrap-kubelet.conf` ) - - `controller-manager.conf` - - `scheduler.conf` - - `admin.conf` 用于集群管理员和 kubeadm 本身 + - `kubelet.conf` (在 TLS 引导时名称为 `bootstrap-kubelet.conf` ) + - `controller-manager.conf` + - `scheduler.conf` + - `admin.conf` 用于集群管理员和 kubeadm 本身 - 证书和密钥文件的名称： - - `ca.crt`, `ca.key` 用于 Kubernetes 证书颁发机构 - - `apiserver.crt`, `apiserver.key` 用于 API 服务器证书 - - `apiserver-kubelet-client.crt`, `apiserver-kubelet-client.key` 用于 API 服务器安全地连接到 kubelet 的客户端证书 - - `sa.pub`, `sa.key` 用于签署 ServiceAccount 时 控制器管理器使用的密钥 - - `front-proxy-ca.crt`, `front-proxy-ca.key` 用于前端代理证书颁发机构 - - `front-proxy-client.crt`, `front-proxy-client.key` 用于前端代理客户端 + - `ca.crt`, `ca.key` 用于 Kubernetes 证书颁发机构 + - `apiserver.crt`, `apiserver.key` 用于 API 服务器证书 + - `apiserver-kubelet-client.crt`, `apiserver-kubelet-client.key` + 用于 API 服务器安全地连接到 kubelet 的客户端证书 + - `sa.pub`, `sa.key` 用于控制器管理器签署 ServiceAccount 时使用的密钥 + - `front-proxy-ca.crt`, `front-proxy-ca.key` 用于前端代理证书颁发机构 + - `front-proxy-client.crt`, `front-proxy-client.key` 用于前端代理客户端 - + ## kubeadm init 工作流程内部设计 {#kubeadm-init-workflow-internal-design} -`kubeadm init` [内部工作流程](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/#init-workflow)包含一系列要执行的原子工作任务， -如 `kubeadm init` 中所述。 +`kubeadm init` [内部工作流程](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/#init-workflow) +包含一系列要执行的原子性工作任务，如 `kubeadm init` 中所述。 -[`kubeadm init phase`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/) 命令允许用户分别调用每个任务， -并最终提供可重用且可组合的 API 或工具箱，其他 Kubernetes 引导工具、任何 IT 自动化工具和高级用户都可以使用它用来创建的自定义集群。 +[`kubeadm init phase`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/) +命令允许用户分别调用每个任务，并最终提供可重用且可组合的 API 或工具箱， +其他 Kubernetes 引导工具、任何 IT 自动化工具和高级用户都可以使用它来 +创建自定义集群。 - + ### 预检 {#preflight-checks} -- [警告] 如果要使用的 Kubernetes 版本（由 `--kubernetes-version` 标志指定）比 kubeadm CLI 版本至少高一个小版本。 +- [警告] 如果要使用的 Kubernetes 版本（由 `--kubernetes-version` 标志指定）比 kubeadm CLI + 版本至少高一个小版本。 - Kubernetes 系统要求： - 如果在 linux上运行： - [错误] 如果内核早于最低要求的版本 @@ -242,16 +253,18 @@ Kubeadm 在启动 init 之前执行一组预检，目的是验证先决条件并 -1. 可以使用 [`kubeadm init phase preflight`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-preflight) 命令单独触发预检。 +1. 可以使用 [`kubeadm init phase preflight`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-preflight) + 命令单独触发预检。 - - + ### 生成必要的证书 {#generate-the-necessary-certificate} Kubeadm 生成用于不同目的的证书和私钥对： - - - Kubernetes 集群的自签名证书颁发机构已保存到 `ca.crt` 文件和 `ca.key` 私钥文件中 - - 用于 API 服务器的服务证书，使用 `ca.crt` 作为 CA 生成，并将证书保存到 `apiserver.crt` 文件中，私钥保存到 `apiserver.key` 文件中 - 该证书应包含以下备用名称： - - Kubernetes 服务的内部 clusterIP（服务 CIDR 的第一个地址，例如：如果服务的子网是 `10.96.0.0/12`，则为 `10.96.0.1`） - - Kubernetes DNS 名称，例如：如果 `--service-dns-domain` 标志值是 `cluster.local`，则为 `kubernetes.default.svc.cluster.local`； - 加上默认的 DNS 名称 `kubernetes.default.svc`、`kubernetes.default` 和 `kubernetes`， - - 节点名称 - - `--apiserver-advertise-address` - - 用户指定的其他备用名称 - - API 服务器用于安全连接到 kubelet 的客户端证书，使用 `ca.crt` 作为 CA 生成，并保存到 `apiserver-kubelet-client.key`， - 私钥保存到 `apiserver-kubelet-client.crt` 文件中。该证书应该在 `system:masters` 组织中 - - 用于签名 ServiceAccount 令牌的私钥保存到 `sa.key` 文件中，公钥保存到 `sa.pub` 文件中 - - 用于前端代理的证书颁发机构保存到 `front-proxy-ca.crt` 文件中，私钥保存到 `front-proxy-ca.key` 文件中 - - 前端代理客户端的客户端证书，使用 `front-proxy-ca.crt` 作为 CA 生成，并保存到 `front-proxy-client.crt` 文件中， - 私钥保存到 `front-proxy-client.key` 文件中 +- Kubernetes 集群的自签名证书颁发机构会保存到 `ca.crt` 文件和 `ca.key` 私钥文件中 +- 用于 API 服务器的服务证书，使用 `ca.crt` 作为 CA 生成，并将证书保存到 `apiserver.crt` + 文件中，私钥保存到 `apiserver.key` 文件中 + 该证书应包含以下备用名称： + + - Kubernetes 服务的内部 clusterIP（服务 CIDR 的第一个地址。 + 例如：如果服务的子网是 `10.96.0.0/12`，则为 `10.96.0.1`） + - Kubernetes DNS 名称，例如：如果 `--service-dns-domain` 标志值是 `cluster.local`， + 则为 `kubernetes.default.svc.cluster.local`； + 加上默认的 DNS 名称 `kubernetes.default.svc`、`kubernetes.default` 和 `kubernetes`， + - 节点名称 + - `--apiserver-advertise-address` + - 用户指定的其他备用名称 + +- 用于 API 服务器安全连接到 kubelet 的客户端证书，使用 `ca.crt` 作为 CA 生成， + 并保存到 `apiserver-kubelet-client.crt`，私钥保存到 `apiserver-kubelet-client.key` + 文件中。该证书应该在 `system:masters` 组织中。 +- 用于签名 ServiceAccount 令牌的私钥保存到 `sa.key` 文件中，公钥保存到 `sa.pub` 文件中 +- 用于前端代理的证书颁发机构保存到 `front-proxy-ca.crt` 文件中，私钥保存到 + `front-proxy-ca.key` 文件中 +- 前端代理客户端的客户端证书，使用 `front-proxy-ca.crt` 作为 CA 生成，并保存到 + `front-proxy-client.crt` 文件中，私钥保存到 `front-proxy-client.key` 文件中 证书默认情况下存储在 `/etc/kubernetes/pki` 中，但是该目录可以使用 `--cert-dir` 标志进行配置。 - - 请注意： + +请注意： -1. 如果证书和私钥对都存在，并且其内容经过评估符合上述规范，将使用现有文件，并且跳过给定证书的生成阶段。 - 这意味着用户可以将现有的 CA 复制到 `/etc/kubernetes/pki/ca.{crt,key}`，kubeadm 将使用这些文件对其余证书进行签名。 - 请参阅[使用自定义证书](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs#custom-certificates) -2. 仅对 CA 来说，如果所有其他证书和 kubeconfig 文件都已就位，则可以只提供 `ca.crt` 文件，而不提供 `ca.key` 文件。 - kubeadm 已经识别出这种情况并启用 ExternalCA，这也意味着了控制器管理器中的 `csrsigner` 控制器将不会启动 -3. 如果 kubeadm 在[外部 CA 模式](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs#external-ca-mode)下运行； - 所有证书必须由用户提供，因为 kubeadm 无法自行生成它们 +1. 如果证书和私钥对都存在，并且其内容经过评估符合上述规范，将使用现有文件， + 并且跳过给定证书的生成阶段。 + 这意味着用户可以将现有的 CA 复制到 `/etc/kubernetes/pki/ca.{crt,key}`， + kubeadm 将使用这些文件对其余证书进行签名。 + 请参阅[使用自定义证书](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs#custom-certificates)。 +2. 仅对 CA 来说，如果所有其他证书和 kubeconfig 文件都已就位，则可以只提供 `ca.crt` 文件， + 而不提供 `ca.key` 文件。 + kubeadm 能够识别出这种情况并启用 ExternalCA，这也意味着了控制器管理器中的 + `csrsigner` 控制器将不会启动 +3. 如果 kubeadm 在 + [外部 CA 模式](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs#external-ca-mode) + 下运行，所有证书必须由用户提供，因为 kubeadm 无法自行生成它们。 4. 如果在 `--dry-run` 模式下执行 kubeadm，证书文件将写入一个临时文件夹中 5. 可以使用 [`kubeadm init phase certs all`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-certs) 命令单独生成证书。 - + ### 为控制平面组件生成 kubeconfig 文件 {#generate-kubeconfig-files-for-control-plane-components} -- 供 kubelet 在 TLS 引导期间使用的 kubeconfig 文件——`/etc/kubernetes/bootstrap-kubelet.conf`。在此文件中， - 有一个引导令牌或内嵌的客户端证书，向集群表明此节点身份。 +- 供 kubelet 在 TLS 引导期间使用的 kubeconfig 文件 —— `/etc/kubernetes/bootstrap-kubelet.conf`。 + 在此文件中，有一个引导令牌或内嵌的客户端证书，向集群表明此节点身份。 此客户端证书应： - - 根据[节点鉴权](/zh/docs/reference/access-authn-authz/node/)模块的要求，属于 `system:nodes` 组织 - - 具有通用名称（CN）：`system:node:` -- 控制器管理器的 kubeconfig 文件——`/etc/kubernetes/controller-manager.conf`； + + - 根据[节点鉴权](/zh/docs/reference/access-authn-authz/node/)模块的要求，属于 `system:nodes` 组织 + - 具有通用名称（CN）：`system:node:<小写主机名>` + +- 控制器管理器的 kubeconfig 文件 —— `/etc/kubernetes/controller-manager.conf`； 在此文件中嵌入了一个具有控制器管理器身份标识的客户端证书。 此客户端证书应具有 CN：`system:kube-controller-manager`， - 这是由 [RBAC 核心组件角色](/zh/docs/reference/access-authn-authz/rbac/#core-component-roles)默认定义的。 -- 调度器的 kubeconfig 文件——`/etc/kubernetes/scheduler.conf`；在此文件中嵌入了具有调度器身份标识的客户端证书。 - 此客户端证书应具有 CN：`system:kube-scheduler`， - 这是由 [RBAC 核心组件角色](/zh/docs/reference/access-authn-authz/rbac/#core-component-roles)默认定义的。 + 该 CN 由 [RBAC 核心组件角色](/zh/docs/reference/access-authn-authz/rbac/#core-component-roles) + 默认定义的。 + +- 调度器的 kubeconfig 文件 —— `/etc/kubernetes/scheduler.conf`； + 此文件中嵌入了具有调度器身份标识的客户端证书。此客户端证书应具有 CN：`system:kube-scheduler`， + 该 CN 由 [RBAC 核心组件角色](/zh/docs/reference/access-authn-authz/rbac/#core-component-roles) + 默认定义的。 -另外，一个用于 kubeadm 本身和 admin 的 kubeconfig 文件也被生成并保存到 `/etc/kubernetes/admin.conf` 文件中。 +另外，用于 kubeadm 本身和 admin 的 kubeconfig 文件也被生成并保存到 +`/etc/kubernetes/admin.conf` 文件中。 此处的 admin 定义为正在管理集群并希望完全控制集群（**root**）的实际人员。 内嵌的 admin 客户端证书应是 `system:masters` 组织的成员， -这是由默认的 [RBAC 面向用户的角色绑定](/zh/docs/reference/access-authn-authz/rbac/#user-facing-roles)定义的。 -它还应包括一个 CN。 Kubeadm 使用 `kubernetes-admin` CN。 +这一组织名由默认的 [RBAC 面向用户的角色绑定](/zh/docs/reference/access-authn-authz/rbac/#user-facing-roles) +定义。它还应包括一个 CN。kubeadm 使用 `kubernetes-admin` CN。 请注意： @@ -372,14 +407,18 @@ CN. Kubeadm uses the `kubernetes-admin` CN. 5. Kubeconfig files generation can be invoked individually with the [`kubeadm init phase kubeconfig all`](/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-kubeconfig) command --> 1. `ca.crt` 证书内嵌在所有 kubeconfig 文件中。 -2. 如果给定的 kubeconfig 文件存在且其内容经过评估符合上述规范，则 kubeadm 将使用现有文件，并跳过给定 kubeconfig 的生成阶段 -3. 如果 kubeadm 以 [ExternalCA 模式](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/#external-ca-mode)运行， - 则所有必需的 kubeconfig 也必须由用户提供，因为 kubeadm 不能自己生成 +2. 如果给定的 kubeconfig 文件存在且其内容经过评估符合上述规范，则 kubeadm 将使用现有文件， + 并跳过给定 kubeconfig 的生成阶段 +3. 如果 kubeadm 以 [ExternalCA 模式](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/#external-ca-mode) + 运行，则所有必需的 kubeconfig 也必须由用户提供，因为 kubeadm 不能自己生成 4. 如果在 `--dry-run` 模式下执行 kubeadm，则 kubeconfig 文件将写入一个临时文件夹中 -5. 可以使用 [`kubeadm init phase kubeconfig all`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-kubeconfig) - 命令分别生成 Kubeconfig 文件。 +5. 可以使用 + [`kubeadm init phase kubeconfig all`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-kubeconfig) + 命令分别生成 kubeconfig 文件。 - + ### 为控制平面组件生成静态 Pod 清单 {#generate-static-pod-manifests-for-control-plane-components} -- 所有静态 Pod 都部署在 `kube-system` 命名空间 -- 所有静态 Pod 都打上 `tier:ontrol-plane` 和 `component:{component-name}` 标签 +- 所有静态 Pod 都部署在 `kube-system` 名字空间 +- 所有静态 Pod 都打上 `tier:ontrol-plane` 和 `component:{组件名称}` 标签 - 所有静态 Pod 均使用 `system-node-critical` 优先级 - 所有静态 Pod 都设置了 `hostNetwork:true`，使得控制平面在配置网络之前启动；结果导致： - * 控制器管理器和调度器用来调用 API 服务器的地址为 127.0.0.1。 - * 如果使用本地 etcd 服务器，则 `etcd-servers` 地址将设置为 `127.0.0.1:2379` + + * 控制器管理器和调度器用来调用 API 服务器的地址为 127.0.0.1。 + * 如果使用本地 etcd 服务器，则 `etcd-servers` 地址将设置为 `127.0.0.1:2379` + - 同时为控制器管理器和调度器启用了领导者选举 - 控制器管理器和调度器将引用 kubeconfig 文件及其各自的唯一标识 -- 如[将自定义参数传递给控制平面组件](/zh/docs/setup/production-environment/tools/kubeadm/control-plane-flags/)中所述， - 所有静态 Pod 都会获得用户指定的额外标志 +- 如[将自定义参数传递给控制平面组件](/zh/docs/setup/production-environment/tools/kubeadm/control-plane-flags/) + 中所述，所有静态 Pod 都会获得用户指定的额外标志 - 所有静态 Pod 都会获得用户指定的额外卷（主机路径） @@ -420,21 +461,23 @@ Kubelet 启动后会监视这个目录以便创建 Pod。 1. 所有镜像默认从 k8s.gcr.io 拉取。 - 关于自定义镜像仓库，请参阅[使用自定义镜像](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/#custom-images) -2. 如果在 `--dry-run` 模式下执行 kubeadm，则静态 Pod 文件写入一个临时文件夹中 + 关于自定义镜像仓库，请参阅 + [使用自定义镜像](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/#custom-images)。 +2. 如果在 `--dry-run` 模式下执行 kubeadm，则静态 Pod 文件写入一个临时文件夹中。 3. 可以使用 [`kubeadm init phase control-plane all`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-control-plane) 命令分别生成主控组件的静态 Pod 清单。 - -#### API 服务器 {#api-server} + +#### API 服务器 {#api-server} + API 服务器的静态 Pod 清单会受到用户提供的以下参数的影响: -- 要绑定的 `apiserver-advertise-address` 和 `apiserver-bind-port`；如果未提供，则这些值默认为机器上默认网络接口的 IP 地址和 6443 端口。 - - `service-cluster-ip-range` 给 service 使用 - - 如果指定了外部 etcd 服务器，则应指定 `etcd-servers` 地址和相关的 TLS 设置（`etcd-cafile`，`etcd-certfile`，`etcd-keyfile`）； - 如果未提供外部 etcd 服务器，则将使用本地 etcd（通过主机网络） - - 如果指定了云提供商，则配置相应的 `--cloud-provider`，如果该路径存在，则配置 `--cloud-config` - （这是实验性的，是 Alpha 版本，将在以后的版本中删除） +- 要绑定的 `apiserver-advertise-address` 和 `apiserver-bind-port`； + 如果未提供，则这些值默认为机器上默认网络接口的 IP 地址和 6443 端口。 +- `service-cluster-ip-range` 给 service 使用 +- 如果指定了外部 etcd 服务器，则应指定 `etcd-servers` 地址和相关的 TLS 设置 + （`etcd-cafile`，`etcd-certfile`，`etcd-keyfile`）； + 如果未提供外部 etcd 服务器，则将使用本地 etcd（通过主机网络） +- 如果指定了云提供商，则配置相应的 `--cloud-provider`，如果该路径存在，则配置 `--cloud-config` + （这是实验性的，是 Alpha 版本，将在以后的版本中删除） 无条件设置的其他 API 服务器标志有： @@ -462,6 +507,14 @@ API 服务器的静态 Pod 清单会受到用户提供的以下参数的影响: See [TLS Bootstrapping](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) for more details - `--allow-privileged` to `true` (required e.g. by kube proxy) - `--requestheader-client-ca-file` to `front-proxy-ca.crt` +--> +- `--insecure-port=0` 禁止到 API 服务器不安全的连接 +- `--enable-bootstrap-token-auth=true` 启用 `BootstrapTokenAuthenticator` 身份验证模块。 + 更多细节请参见 [TLS 引导](/zh/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/)。 +- `--allow-privileged` 设为 `true`（诸如 kube-proxy 这些组件有此要求） +- `--requestheader-client-ca-file` 设为 `front-proxy-ca.crt` + + +- `--enable-admission-plugins` 设为： + - [`NamespaceLifecycle`](/zh/docs/reference/access-authn-authz/admission-controllers/#namespacelifecycle) + 例如，避免删除系统保留的名字空间 + - [`LimitRanger`](/zh/docs/reference/access-authn-authz/admission-controllers/#limitranger) 和 + [`ResourceQuota`](/zh/docs/reference/access-authn-authz/admission-controllers/#resourcequota) + 对名字空间实施限制 + - [`ServiceAccount`](/zh/docs/reference/access-authn-authz/admission-controllers/#serviceaccount) + 实施服务账户自动化 + - [`PersistentVolumeLabel`](/zh/docs/reference/access-authn-authz/admission-controllers/#persistentvolumelabel) + 将区域（Region）或区（Zone）标签附加到由云提供商定义的 PersistentVolumes + （此准入控制器已被弃用并将在以后的版本中删除）。 + 如果未明确选择使用 `gce` 或 `aws` 作为云提供商，则默认情况下，v1.9 以后的版本 kubeadm 都不会部署。 + - [`DefaultStorageClass`](/zh/docs/reference/access-authn-authz/admission-controllers/#defaultstorageclass) + 在 `PersistentVolumeClaim` 对象上强制使用默认存储类型 + - [`DefaultTolerationSeconds`](/zh/docs/reference/access-authn-authz/admission-controllers/#defaulttolerationseconds) + - [`NodeRestriction`](/zh/docs/reference/access-authn-authz/admission-controllers/#noderestriction) + 限制 kubelet 可以修改的内容（例如，仅此节点上的 pod） + - - `--insecure-port=0` 禁止到 API 服务器不安全的连接 - - `--enable-bootstrap-token-auth=true` 启用 `BootstrapTokenAuthenticator` 身份验证模块 - 更多细节请参见 [TLS 引导](/zh/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) - - `--allow-privileged` 设为 `true`（必要，例如 kube-proxy） - - `--requestheader-client-ca-file` 设为 `front-proxy-ca.crt` - - `--enable-admission-plugins` 设为： - - [`NamespaceLifecycle`](/zh/docs/reference/access-authn-authz/admission-controllers/#namespacelifecycle) - 例如，避免删除系统保留的命名空间 - - [`LimitRanger`](/zh/docs/reference/access-authn-authz/admission-controllers/#limitranger) 和 - [`ResourceQuota`](/zh/docs/reference/access-authn-authz/admission-controllers/#resourcequota) 对命名空间实施限制 - - [`ServiceAccount`](/zh/docs/reference/access-authn-authz/admission-controllers/#serviceaccount) 实施服务账户自动化 - - [`PersistentVolumeLabel`](/zh/docs/reference/access-authn-authz/admission-controllers/#persistentvolumelabel) - 将区域（Region）或区（Zone）标签附加到由云提供商定义的 PersistentVolumes（此准入控制器已被弃用并将在以后的版本中删除）。 - 如果未明确选择使用 `gce` 或 `aws` 作为云提供商，则默认情况下，v1.9 以后的版本 kubeadm 都不会部署。 - - [`DefaultStorageClass`](/zh/docs/reference/access-authn-authz/admission-controllers/#defaultstorageclass) - 在 `PersistentVolumeClaim` 对象上强制使用默认存储类型 - - [`DefaultTolerationSeconds`](/zh/docs/reference/access-authn-authz/admission-controllers/#defaulttolerationseconds) - - [`NodeRestriction`](/zh/docs/reference/access-authn-authz/admission-controllers/#noderestriction) - 限制 kubelet 可以修改的内容（例如，仅此节点上的 pod） - - `--kubelet-preferred-address-types` 设为 `InternalIP,ExternalIP,Hostname;` - 这使得在节点的主机名无法解析的环境中，`kubectl log` 和 API 服务器与 kubelet 的其他通信可以工作 - - 使用在前面步骤中生成的证书的标志： - - `--client-ca-file` 设为 `ca.crt` - - `--tls-cert-file` 设为 `apiserver.crt` - - `--tls-private-key-file` 设为 `apiserver.key` - - `--kubelet-client-certificate` 设为 `apiserver-kubelet-client.crt` - - `--kubelet-client-key` 设为 `apiserver-kubelet-client.key` - - `--service-account-key-file` 设为 `sa.pub` - - `--requestheader-client-ca-file` 设为 `front-proxy-ca.crt` - - `--proxy-client-cert-file` 设为 `front-proxy-client.crt` - - `--proxy-client-key-file` 设为 `front-proxy-client.key` - - 其他用于保护前端代理（[API 聚合](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/aggregated-api-servers.md)）通信的标志: - - `--requestheader-username-headers=X-Remote-User` - - `--requestheader-group-headers=X-Remote-Group` - - `--requestheader-extra-headers-prefix=X-Remote-Extra-` - - `--requestheader-allowed-names=front-proxy-client` +- `--kubelet-preferred-address-types` 设为 `InternalIP,ExternalIP,Hostname;` + 这使得在节点的主机名无法解析的环境中，`kubectl log` 和 API 服务器与 kubelet + 的其他通信可以工作 +- 使用在前面步骤中生成的证书的标志： - + - `--client-ca-file` 设为 `ca.crt` + - `--tls-cert-file` 设为 `apiserver.crt` + - `--tls-private-key-file` 设为 `apiserver.key` + - `--kubelet-client-certificate` 设为 `apiserver-kubelet-client.crt` + - `--kubelet-client-key` 设为 `apiserver-kubelet-client.key` + - `--service-account-key-file` 设为 `sa.pub` + - `--requestheader-client-ca-file` 设为 `front-proxy-ca.crt` + - `--proxy-client-cert-file` 设为 `front-proxy-client.crt` + - `--proxy-client-key-file` 设为 `front-proxy-client.key` + +- 其他用于保护前端代理（ + [API 聚合层](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/aggregated-api-servers.md)） + 通信的标志: + + - `--requestheader-username-headers=X-Remote-User` + - `--requestheader-group-headers=X-Remote-Group` + - `--requestheader-extra-headers-prefix=X-Remote-Extra-` + - `--requestheader-allowed-names=front-proxy-client` + + #### 控制器管理器 {#controller-manager} -- 如果调用 kubeadm 时指定了 `--pod-network-cidr` 参数，则可以通过以下方式启用某些 CNI 网络插件所需的子网管理器功能： - - 设置 `--allocate-node-cidrs=true` - - 根据给定 CIDR 设置 `--cluster-cidr` 和 `--node-cidr-mask-size` 标志 - - 如果指定了云提供商，则指定相应的 `--cloud-provider`，如果存在这样的配置文件，则指定 `--cloud-config` 路径 - （这是试验性的，是Alpha 版本，将在以后的版本中删除） +- 如果调用 kubeadm 时指定了 `--pod-network-cidr` 参数，则可以通过以下方式启用 + 某些 CNI 网络插件所需的子网管理器功能： + - 设置 `--allocate-node-cidrs=true` + - 根据给定 CIDR 设置 `--cluster-cidr` 和 `--node-cidr-mask-size` 标志 +- 如果指定了云提供商，则指定相应的 `--cloud-provider`，如果存在这样的配置文件， + 则指定 `--cloud-config` 路径（此为试验性功能，是 Alpha 版本，将在以后的版本中删除）。 其他无条件设置的标志包括： @@ -564,31 +626,37 @@ The static Pod manifest for the controller-manager is affected by following para - `--cluster-signing-key-file` to `ca.key`, if External CA mode is disabled, otherwise to `""` - `--service-account-private-key-file` to `sa.key` --> -- `--controllers` 为 TLS 引导程序启用所有默认控制器以及 `BootstrapSigner` 和 `TokenCleaner` 控制器。 - 详细信息请参阅 [TLS 引导](/zh/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) - - `--use-service-account-credentials` 设为 `true` - - 使用先前步骤中生成的证书的标志： - -`--root-ca-file` 设为 `ca.crt` - - 如果禁用了 External CA 模式，则 `--cluster-signing-cert-file` 设为 `ca.crt`，否则设为 `""` - - 如果禁用了 External CA 模式，则 `--cluster-signing-key-file` 设为 `ca.key`，否则设为 `""` - - `--service-account-private-key-file` 设为 `sa.key` +- `--controllers` 为 TLS 引导程序启用所有默认控制器以及 `BootstrapSigner` 和 + `TokenCleaner` 控制器。详细信息请参阅 + [TLS 引导](/zh/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/) +- `--use-service-account-credentials` 设为 `true` +- 使用先前步骤中生成的证书的标志： - -#### 调度器 {#scheduler} + -`--root-ca-file` 设为 `ca.crt` + - 如果禁用了 External CA 模式，则 `--cluster-signing-cert-file` 设为 `ca.crt`，否则设为 `""` + - 如果禁用了 External CA 模式，则 `--cluster-signing-key-file` 设为 `ca.key`，否则设为 `""` + - `--service-account-private-key-file` 设为 `sa.key` + + +#### 调度器 {#scheduler} + 调度器的静态 Pod 清单不受用户提供的参数的影响。 - + ### 为本地 etcd 生成静态 Pod 清单 {#generate-static-pod-manifest-for-local-etcd} -如果用户指定了外部 etcd，则将跳过此步骤，否则 kubeadm 会生成静态 Pod 清单文件，以创建在 Pod 中运行的具有以下属性的本地 etcd 实例： +如果用户指定了外部 etcd，则将跳过此步骤，否则 kubeadm 会生成静态 Pod 清单文件， +以创建在 Pod 中运行的具有以下属性的本地 etcd 实例： -1. etcd 镜像默认从 `k8s.gcr.io` 拉取。有关自定义镜像仓库，请参阅[使用自定义镜像](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/#custom-images) -2. 如果 kubeadm 以 `--dry-run` 模式执行，etcd 静态 Pod 清单将写入一个临时文件夹 -3. 可以使用 ['kubeadm init phase etcd local'](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-etcd) 命令 - 单独为本地 etcd 生成静态 Pod 清单 +1. etcd 镜像默认从 `k8s.gcr.io` 拉取。有关自定义镜像仓库，请参阅 + [使用自定义镜像](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/#custom-images)。 +2. 如果 kubeadm 以 `--dry-run` 模式执行，etcd 静态 Pod 清单将写入一个临时文件夹。 +3. 可以使用 + ['kubeadm init phase etcd local'](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-etcd) + 命令单独为本地 etcd 生成静态 Pod 清单 - + ### 可选的动态 Kubelet 配置 {#optional-dynamic-kubelet-configuration} -要使用这个功能，请调用 `kubeadm alpha kubelet config enable-dynamic`。 -它将 kubelet 的 init 配置写入 `/var/lib/kubelet/config/init/kubelet` 文件。 +要使用这个功能，请执行 `kubeadm alpha kubelet config enable-dynamic`。 +它将 kubelet 的初始化配置写入 `/var/lib/kubelet/config/init/kubelet` 文件。 -init 配置用于在这个特定节点上启动 kubelet，从而为 kubelet 插件文件提供了一种替代方法。 -如以下步骤中所述，这种配置将由 kubelet 基本配置所替代。 -请参阅[通过配置文件设置 Kubelet 参数](/zh/docs/tasks/administer-cluster/kubelet-config-file)了解更多信息。 +初始化配置用于在这个特定节点上启动 kubelet，从而为 kubelet 插件文件提供了 +一种替代方法。如以下步骤中所述，这种配置将由 kubelet 基本配置所替代。 +请参阅[通过配置文件设置 Kubelet 参数](/zh/docs/tasks/administer-cluster/kubelet-config-file) +了解更多信息。 请注意： @@ -642,12 +715,15 @@ init 配置用于在这个特定节点上启动 kubelet，从而为 kubelet 插 as `InitConfiguration` using the `---` separator. For more details have a look at the `kubeadm config print-default` command. --> 1. 要使动态 kubelet 配置生效，应在 `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` - 中指定 `--dynamic-config-dir=/var/lib/kubelet/config/dynamic` 标志 -2. 通过使用配置文件 `--config some-file.yaml` 将 `KubeletConfiguration` 对象传递给 `kubeadm init` 或 `kubeadm join` - 来更改 kubelet 配置。可以使用 `---` 分隔符将 `KubeletConfiguration` 对象与其他对象（例如 `InitConfiguration`）分开。 - 有关更多详细信息，请查看 `kubeadm config print-default` 命令。 + 中指定 `--dynamic-config-dir=/var/lib/kubelet/config/dynamic` 标志。 +2. 通过使用配置文件 `--config some-file.yaml` 将 `KubeletConfiguration` 对象传递给 + `kubeadm init` 或 `kubeadm join` 来更改 kubelet 配置。 + 可以使用 `---` 分隔符将 `KubeletConfiguration` 对象与其他对象（例如 `InitConfiguration`） + 分开。更多的详细信息，请查看 `kubeadm config print-default` 命令。 - + ### 等待控制平面启动 {#wait-for-the-control-plane-to-come-up} kubeadm 等待（最多 4m0s），直到 `localhost:6443/healthz`（kube-apiserver 存活）返回 `ok`。 但是为了检测死锁条件，如果 `localhost:10255/healthz`（kubelet 存活）或 -`localhost:10255/healthz/syncloop`（kubelet 就绪）未能在 40s 和 60s 内未返回 `ok`，则 kubeadm 会快速失败。 +`localhost:10255/healthz/syncloop`（kubelet 就绪）未能在 40s 和 60s 内未返回 `ok`， +则 kubeadm 会快速失败。 + ### （可选）编写基本 kubelet 配置 {#write-base-kubelet-configuration} {{< feature-state for_k8s_version="v1.9" state="alpha" >}} - -如果带 `--feature-gates=DynamicKubeletConfig` 参数调用 kubeadm： + +如果带 `--feature-gates=DynamicKubeletConfig` 参数调用 kubeadm，则 kubeadm： -1. 将 kubelet 基本配置写入 `kube-system` 命名空间的 `kubelet-base-config-v1.9` ConfigMap 中。 +1. 将 kubelet 基本配置写入 `kube-system` 名字空间的 `kubelet-base-config-v1.9` ConfigMap 中。 2. 创建 RBAC 规则，以授予对所有引导令牌和所有 kubelet 实例对该 ConfigMap 的读取访问权限 （即 `system:bootstrappers:kubeadm:default-node-token` 组和 `system:nodes` 组） -3. 通过将 `Node.spec.configSource` 指向新创建的 ConfigMap，为初始控制平面节点启用动态 kubelet 配置功能。 +3. 通过将 `Node.spec.configSource` 指向新创建的 ConfigMap，为初始控制平面节点启用动态 + kubelet 配置功能。 - + ### 将 kubeadm ClusterConfiguration 保存在 ConfigMap 中以供以后参考 {#save-the-kubeadm-clusterConfiguration-in-a-configMap-for-later-reference} -kubeadm 将传递给 `kubeadm init` 的配置保存在 `kube-system` 命名空间下名为 `kubeadm-config` 的 ConfigMap 中。 +kubeadm 将传递给 `kubeadm init` 的配置保存在 `kube-system` 名字空间下名为 +`kubeadm-config` 的 ConfigMap 中。 -这将确保将来执行的 kubeadm 操作（例如 `kubeadm upgrade`）将能够确定实际/当前集群状态，并根据该数据做出新的决策。 +这将确保将来执行的 kubeadm 操作（例如 `kubeadm upgrade`）将能够确定实际/当前集群状态， +并根据该数据做出新的决策。 请注意： 1. 在保存 ClusterConfiguration 之前，从配置中删除令牌等敏感信息。 -2. 可以使用 [`kubeadm init phase upload-config`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-upload-config) +2. 可以使用 + [`kubeadm init phase upload-config`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-upload-config) 命令单独上传主控节点配置。 - + ### 将节点标记为控制平面 {#mark-the-node-as-control-plane} - + 一旦控制平面可用，kubeadm 将执行以下操作： -- 给节点打上 `node-role.kubernetes.io/master=""` 标签，标记为控制平面 +- 给节点打上 `node-role.kubernetes.io/master=""` 标签，标记其为控制平面 - 给节点打上 `node-role.kubernetes.io/master:NoSchedule` 污点 请注意： -1. 可以使用 [`kubeadm init phase mark-control-plane`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-mark-master) +1. 可以使用 [`kubeadm init phase mark-control-plane`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-mark-control-plane) 命令单独触发控制平面标记 -c + ### 为即将加入的节点加入 TLS 启动引导 {#configure-tls-bootstrapping-for-node-joining} -Kubeadm 使用[引导令牌认证](/zh/docs/reference/access-authn-authz/bootstrap-tokens/)将新节点连接到现有集群； -有关更多详细信息，请参见[设计方案](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/cluster-lifecycle/bootstrap-discovery.md)。 +Kubeadm 使用[引导令牌认证](/zh/docs/reference/access-authn-authz/bootstrap-tokens/) +将新节点连接到现有集群； +更多的详细信息，请参见 +[设计提案](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/cluster-lifecycle/bootstrap-discovery.md)。 -`kubeadm init` 确保为该过程正确配置了所有内容，这包括以下步骤以及设置 API 服务器和控制器标志，如前几段所述。 +`kubeadm init` 确保为该过程正确配置了所有内容，这包括以下步骤以及设置 API 服务器 +和控制器标志，如前几段所述。 请注意： @@ -756,20 +852,28 @@ setting API server and controller flags as already described in previous paragra 1. TLS bootstrapping for nodes can be configured with the [`kubeadm init phase bootstrap-token`](/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-bootstrap-token) command, executing all the configuration steps described in following paragraphs; alternatively, each step can be invoked individually --> -1. 可以使用 [`kubeadm init phase bootstrap-token`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-bootstrap-token) - 命令配置节点的 TLS 引导，执行以下段落中描述的所有配置步骤；或者每个步骤都单独触发。 +1. 可以使用 + [`kubeadm init phase bootstrap-token`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-bootstrap-token) + 命令配置节点的 TLS 引导，执行以下段落中描述的所有配置步骤； + 或者每个步骤都单独触发。 - + #### 创建引导令牌 {#create-a-bootstrap-token} -`kubeadm init` 创建第一个引导令牌，该令牌是自动生成的或由用户提供的 `--token` 标志的值；如引导令牌规范中记录的那样， -令牌应保存在 `kube-system` 命名空间下名为 `bootstrap-token-` 的 secret 中。 +`kubeadm init` 创建第一个引导令牌，该令牌是自动生成的或由用户提供的 `--token` +标志的值；如引导令牌规范中记录的那样， +令牌应保存在 `kube-system` 名字空间下名为 `bootstrap-token-<令牌-id>` +的 Secret 中。 - + 请注意： 1. 由 `kubeadm init` 创建的默认令牌将用于在 TLS 引导过程中验证临时用户； - 这些用户会成为 `system:bootstrappers:kubeadm:default-node-token` 组的成员 + 这些用户会成为 `system:bootstrappers:kubeadm:default-node-token` 组的成员。 2. 令牌的有效期有限，默认为 24 小时（间隔可以通过 `-token-ttl` 标志进行更改） -3. 可以使用 [`kubeadm token`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-token/) 命令创建其他令牌， - 这些令牌还提供其他有用的令牌管理功能 +3. 可以使用 [`kubeadm token`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-token/) + 命令创建其他令牌，这些令牌还提供其他有用的令牌管理功能 - + #### 允许加入的节点调用 CSR API {#allow-joining-nodes-to-call-csr-api} - -Kubeadm 确保 `system:bootstrappers:kubeadm:default-node-token` 组中的用户能够访问证书签名 API。 + +Kubeadm 确保 `system:bootstrappers:kubeadm:default-node-token` 组中的用户 +能够访问证书签名 API。 -这是通过在上述组与默认 RBAC 角色 `system:node-bootstrapper` 之间创建名为 `kubeadm:kubelet-bootstrap` 的 ClusterRoleBinding 来实现的。 +这是通过在上述组与默认 RBAC 角色 `system:node-bootstrapper` 之间创建名为 +`kubeadm:kubelet-bootstrap` 的 ClusterRoleBinding 来实现的。 - - + #### 为新的引导令牌设置自动批准 {#setup-auto-approval-for-new-bootstrap-tokens} - + Kubeadm 确保 csrapprover 控制器自动批准引导令牌的 CSR 请求。 -这是通过在 `system:bootstrappers:kubeadm:default-node-token` 组和 `system:certificates.k8s.io:certificatesigningrequests:nodeclient` 默认角色之间 +这是通过在 `system:bootstrappers:kubeadm:default-node-token` 用户组和 +`system:certificates.k8s.io:certificatesigningrequests:nodeclient` 默认角色之间 创建名为 `kubeadm:node-autoapprove-bootstrap` 的 ClusterRoleBinding 来实现的。 还应创建 `system:certificates.k8s.io:certificatesigningrequests:nodeclient` 角色， -对 `/apis/certificates.k8s.io/certificatesigningrequests/nodeclient` 授予的 POST 权限。 +授予对 `/apis/certificates.k8s.io/certificatesigningrequests/nodeclient` +执行 POST 的权限。 - + #### 通过自动批准设置节点证书轮换 {#setup-nodes-certificate-rotation-with-auto-approval} -Kubeadm 确保节点启用了证书轮换，csrapprover 控制器将自动批准节点的新证书的 CSR 请求。 +Kubeadm 确保节点启用了证书轮换，csrapprover 控制器将自动批准节点的 +新证书的 CSR 请求。 -这是通过在 `system:nodes` 组和 `system:certificates.k8s.io:certificatesigningrequests:selfnodeclient` 默认角色之间创建名叫 -`kubeadm:node-autoapprove-certificate-rotation` 的 ClusterRoleBinding 实现的。 +这是通过在 `system:nodes` 组和 +`system:certificates.k8s.io:certificatesigningrequests:selfnodeclient` +默认角色之间创建名为 `kubeadm:node-autoapprove-certificate-rotation` 的 +ClusterRoleBinding 来实现的。 - + #### 创建公共 cluster-info ConfigMap - -本步骤在 `kube-public` 命名空间中创建名为 `cluster-info` 的 ConfigMap。 + +本步骤在 `kube-public` 名字空间中创建名为 `cluster-info` 的 ConfigMap。 -另外，它创建一个 Role 和一个 RoleBinding，为未经身份验证的用户授予对 ConfigMap 的访问权限 -（即 RBAC 组 `system:unauthenticated` 中的用户）。 +另外，它创建一个 Role 和一个 RoleBinding，为未经身份验证的用户授予对 ConfigMap +的访问权限（即 RBAC 组 `system:unauthenticated` 中的用户）。 - + 请注意： -1. 对 `cluster-info` ConfigMap 的访问 _不受_ 速率限制。如果你把主控节点暴露到外网，这可能是一个问题，也可能不是； -这里最坏的情况是 DoS 攻击，攻击者使用 kube-apiserver 能够处理的所有动态请求来为 `cluster-info` ConfigMap 提供服务。 +1. 对 `cluster-info` ConfigMap 的访问 _不受_ 速率限制。 + 如果你把 API 服务器暴露到外网，这可能是一个问题，也可能不是； + 这里最坏的情况是 DoS 攻击，攻击者使用 kube-apiserver 能够处理的所有动态请求 + 来为 `cluster-info` ConfigMap 提供服务。 - + ### 安装插件 {##install-addons} - + Kubeadm 通过 API 服务器安装内部 DNS 服务器和 kube-proxy 插件。 - + 请注意： +1. 此步骤可以调用 + ['kubeadm init phase addon all'](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-addon) + 命令单独执行。 -1. 此步骤可以调用 ['kubeadm init phase addon all'](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-addon) 命令单独调用。 + -#### 代理 {#proxy} - - -在 `kube-system` 命名空间中创建一个用于 `kube-proxy` 的 ServiceAccount；然后以 DaemonSet 的方式部署 kube-proxy： +#### 代理 {#proxy} + +在 `kube-system` 名字空间中创建一个用于 `kube-proxy` 的 ServiceAccount； +然后以 DaemonSet 的方式部署 kube-proxy： - 主控节点凭据（`ca.crt` 和 `token`）来自 ServiceAccount -- 主控节点的位置来自 ConfigMap -- `kube-proxy` 的 ServiceAccount 绑定了 `system:node-proxier` ClusterRole 中的特权 +- API 服务器节点的位置（URL）来自 ConfigMap +- `kube-proxy` 的 ServiceAccount 绑定了 `system:node-proxier` ClusterRole + 中的特权 #### DNS {#dns} @@ -900,13 +1038,18 @@ the `--config` method described [here](/docs/reference/setup-tools/kubeadm/kubea - A ServiceAccount for CoreDNS/kube-dns is created in the `kube-system` namespace. - The `kube-dns` ServiceAccount is bound to the privileges in the `system:kube-dns` ClusterRole --> -- 在 Kubernetes 1.18 版本中，通过 kubeadm 部署 kube-dns 这一操作已经弃用，将在未来的版本中删除 -- CoreDNS 服务的名称为 `kube-dns`。这样做是为了防止当用户将集群 DNS 从 kube-dns 切换到 CoreDNS 或者反过来时，出现服务中断。 - `--config` 方法在[这里](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-addon)有描述 -- 在 `kube-system` 命名空间中创建 CoreDNS/kube-dns 的 ServiceAccount +- 在 Kubernetes 1.18 版本中，通过 kubeadm 部署 kube-dns 这一操作已经弃用， + 将在未来的版本中删除。 +- CoreDNS 服务的名称为 `kube-dns`。这样做是为了防止当用户将集群 DNS 从 kube-dns + 切换到 CoreDNS 或者反过来时，出现服务中断。`--config` 方法在 + [这里](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/#cmd-phase-addon) + 有描述。 +- 在 `kube-system` 名字空间中创建 CoreDNS/kube-dns 的 ServiceAccount - `kube-dns` 的 ServiceAccount 绑定了 `system:kube-dns` ClusterRole 中的特权 - + ## kubeadm join 步骤内部设计 {#kubeadm-join-phases-internal-design} -这分为发现（让该节点信任 Kubernetes 的主控节点）和 TLS 引导（让 Kubernetes 的主控节点信任该节点）。 +这分为发现（让该节点信任 Kubernetes 的主控节点）和 TLS 引导 +（让 Kubernetes 的主控节点信任该节点）。 + ### 预检 {#preflight-checks} 1. `kubeadm join` 预检基本上是 `kubeadm init` 预检的一个子集 -2. 从 1.9 开始，kubeadm 为 CRI 通用的功能提供了更好的支持；在这种情况下，docker 特定的控制参数将跳过或替换为 crictl 中与之相似的控制参数。 -3. 从 1.9 开始，kubeadm 支持加入在 Windows 上运行的节点；在这种情况下，将跳过 linux 特定的控制参数。 -4. 在任何情况下，用户都可以通过 `--ignore-preflight-errors` 选项跳过特定的预检（或者进而跳过所有预检）。 +2. 从 1.9 开始，kubeadm 为 CRI 通用的功能提供了更好的支持；在这种情况下， + Docker 特定的控制参数将跳过或替换为 crictl 中与之相似的控制参数。 +3. 从 1.9 开始，kubeadm 支持加入在 Windows 上运行的节点；在这种情况下， + 将跳过 Linux 特定的控制参数。 +4. 在任何情况下，用户都可以通过 `--ignore-preflight-errors` 选项跳过 + 特定的预检（或者进而跳过所有预检）。 - + ### 发现 cluster-info {#discovery-cluster-info} + #### 共享令牌发现 {#shared-token-discovery} 如果带 `--discovery-token` 参数调用 `kubeadm join`，则使用了令牌发现功能； -在这种情况下，节点基本上从 `kube-public` 命名空间中的 `cluster-info` ConfigMap 中检索集群 CA 证书。 +在这种情况下，节点基本上从 `kube-public` 名字空间中的 `cluster-info` ConfigMap +中检索集群 CA 证书。 为了防止“中间人”攻击，采取了以下步骤： @@ -981,7 +1135,8 @@ the cluster CA certificates from the `cluster-info` ConfigMap in the `kube-publ The `--discovery-token-ca-cert-hash flag` may be repeated multiple times to allow more than one public key. - As a additional validation, the CA certificate is retrieved via secure connection and then compared with the CA retrieved initially --> -- 首先，通过不安全连接检索 CA 证书（这是可能的，因为 `kubeadm init` 授予 `system:unauthenticated` 的用户对 `cluster-info` 访问权限） +- 首先，通过不安全连接检索 CA 证书（这是可能的，因为 `kubeadm init` 授予 + `system:unauthenticated` 的用户对 `cluster-info` 访问权限） - 然后 CA 证书通过以下验证步骤： - 基本验证：使用令牌 ID 而不是 JWT 签名 - 公钥验证：使用提供的 `--discovery-token-ca-cert-hash`。这个值来自 `kubeadm init` 的输出， @@ -999,44 +1154,54 @@ the cluster CA certificates from the `cluster-info` ConfigMap in the `kube-publ 1. 通过 `--discovery-token-unsafe-skip-ca-verification` 标志可以跳过公钥验证； 这削弱了 kubeadm 安全模型，因为其他人可能冒充 Kubernetes 主控节点。 - + #### 文件/HTTPS 发现 {#file-or-https-discovery} 如果带 `--discovery-file` 参数调用 `kubeadm join`，则使用文件发现功能； -该文件可以是本地文件或通过 HTTPS URL 下载；对于 HTTPS，主机安装的 CA 包用于验证连接。 +该文件可以是本地文件或通过 HTTPS URL 下载；对于 HTTPS，主机安装的 CA 包 +用于验证连接。 -通过文件发现，集群 CA 证书是文件本身提供；事实上，这个发现文件是一个 kubeconfig 文件，只设置了 `server` 和 `certificate-authority-data` 属性， -如 [`kubeadm join`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-join/#file-or-https-based-discovery) 参考文档中所述; -当与集群建立连接时，kubeadm 尝试访问 `cluster-info` ConfigMap，如果可用，就使用它。 +通过文件发现，集群 CA 证书是文件本身提供；事实上，这个发现文件是一个 kubeconfig 文件， +只设置了 `server` 和 `certificate-authority-data` 属性， +如 [`kubeadm join`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-join/#file-or-https-based-discovery) +参考文档中所述，当与集群建立连接时，kubeadm 尝试访问 `cluster-info` ConfigMap， +如果可用，就使用它。 - + ## TLS 引导 {#tls-boostrap} -知道集群信息后，将写入文件 `bootstrap-kubelet.conf`，从而允许 kubelet 执行 TLS 引导（相反，在 v1.7 之前 TLS 引导都是由 kubeadm 管理）。 +知道集群信息后，将写入文件 `bootstrap-kubelet.conf`，从而允许 kubelet 执行 +TLS 引导（相反，在 v1.7 之前 TLS 引导都是由 kubeadm 管理）。 -TLS 引导机制使用共享令牌对 Kubernetes 主控节点进行临时身份验证，以便为本地创建的密钥对提交证书签名请求（CSR）。 +TLS 引导机制使用共享令牌对 Kubernetes 主控节点进行临时身份验证，以便 +为本地创建的密钥对提交证书签名请求（CSR）。 -该请求会被自动批准，并且该操作保存 `ca.crt` 文件和 `kubelet.conf` 文件，用于 kubelet 加入集群，同时删除 `bootstrap-kubelet.conf`。 +该请求会被自动批准，并且该操作保存 `ca.crt` 文件和 `kubelet.conf` 文件，用于 +kubelet 加入集群，同时删除 `bootstrap-kubelet.conf`。 请注意： @@ -1048,18 +1213,23 @@ by kubelet for joining the cluster, while`bootstrap-kubelet.conf` is deleted. access to CSR api during the `kubeadm init` process - The automatic CSR approval is managed by the csrapprover controller, according with configuration done the `kubeadm init` process --> -- 临时身份验证根据 `kubeadm init` 过程中保存的令牌进行验证（或者使用 `kubeadm token` 创建的其他令牌） +- 临时身份验证根据 `kubeadm init` 过程中保存的令牌进行验证（或者使用 `kubeadm token` + 创建的其他令牌） - 临时身份验证解析到 `system:bootstrappers:kubeadm:default-node-token` 组的一个用户成员， 该成员在 `kubeadm init` 过程中被授予对 CSR API 的访问权 - 根据 `kubeadm init` 过程的配置，自动 CSR 审批由 csrapprover 控制器管理 - + ### （可选）编写 init kubelet 配置 {#write-init-kubelet-configuration} {{< feature-state for_k8s_version="v1.9" state="alpha" >}} - -如果带 `--feature-gates=DynamicKubeletConfig` 参数调用 kubeadm： + +如果带 `--feature-gates=DynamicKubeletConfig` 参数调用 kubeadm，则 kubeadm： -1. 使用引导令牌凭证从 `kube-system` 命名空间中 `kubelet-base-config-v1.9` ConfigMap 中读取 kubelet 基本配置， +1. 使用引导令牌凭证从 `kube-system` 名字空间中 ConfigMap `kubelet-base-config-v1.9` + 中读取 kubelet 基本配置， 并将其作为 kubelet init 配置文件 `/var/lib/kubelet/config/init/kubelet` 写入磁盘。 2. 一旦 kubelet 开始使用节点自己的凭据（`/etc/kubernetes/kubelet.conf`）， 就更新当前节点配置，指定该节点或 kubelet 配置来自上述 ConfigMap。 @@ -1078,4 +1249,6 @@ by kubelet for joining the cluster, while`bootstrap-kubelet.conf` is deleted. -1. 要使动态 kubelet 配置生效，应在 `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` 中指定 `--dynamic-config-dir=/var/lib/kubelet/config/dynamic` 标志。 +1. 要使动态 kubelet 配置生效，应在 `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` + 中指定 `--dynamic-config-dir=/var/lib/kubelet/config/dynamic` 标志。 + diff --git a/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-alpha.md b/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-alpha.md index 1d8dcad951..82d4f88024 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-alpha.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-alpha.md @@ -4,11 +4,6 @@ content_type: concept weight: 90 --- -`kubeadm alpha` 提供了一组可用于收集社区反馈的功能的预览。 -请尝试一下这些功能并给我们反馈！ +`kubeadm alpha` 提供了一组可用于收集社区反馈的预览性质功能。 +请试用这些功能并给我们提供反馈！ {{< /caution >}} -## kubeadm alpha certs {#cmd-certs} - - -Kubernetes 证书的操作集合。 - -{{< tabs name="tab-certs" >}} -{{< tab name="overview" include="generated/kubeadm_alpha_certs.md" />}} -{{< /tabs >}} - -## kubeadm alpha certs renew {#cmd-certs-renew} - - -使用 `all` 子命令来更新所有 Kubernetes 证书或有选择性地更新它们。 -有关证书到期和续订的更多详细信息， -请参见[证书管理文档](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/)。 - -{{< tabs name="tab-certs-renew" >}} -{{< tab name="renew" include="generated/kubeadm_alpha_certs_renew.md" />}} -{{< tab name="all" include="generated/kubeadm_alpha_certs_renew_all.md" />}} -{{< tab name="admin.conf" include="generated/kubeadm_alpha_certs_renew_admin.conf.md" />}} -{{< tab name="apiserver-etcd-client" include="generated/kubeadm_alpha_certs_renew_apiserver-etcd-client.md" />}} -{{< tab name="apiserver-kubelet-client" include="generated/kubeadm_alpha_certs_renew_apiserver-kubelet-client.md" />}} -{{< tab name="apiserver" include="generated/kubeadm_alpha_certs_renew_apiserver.md" />}} -{{< tab name="controller-manager.conf" include="generated/kubeadm_alpha_certs_renew_controller-manager.conf.md" />}} -{{< tab name="etcd-healthcheck-client" include="generated/kubeadm_alpha_certs_renew_etcd-healthcheck-client.md" />}} -{{< tab name="etcd-peer" include="generated/kubeadm_alpha_certs_renew_etcd-peer.md" />}} -{{< tab name="etcd-server" include="generated/kubeadm_alpha_certs_renew_etcd-server.md" />}} -{{< tab name="front-proxy-client" include="generated/kubeadm_alpha_certs_renew_front-proxy-client.md" />}} -{{< tab name="scheduler.conf" include="generated/kubeadm_alpha_certs_renew_scheduler.conf.md" />}} -{{< /tabs >}} - -## kubeadm alpha certs certificate-key {#cmd-certs-certificate-key} - - -该命令可用于生成新的控制平面证书密钥。 -密钥可以作为 `--certificate-key` 参数传递给 `kubeadm init` 和 `kubeadm join` 操作， -以在加入其他控制平面节点时启用证书的自动复制。 - -{{< tabs name="tab-certs-certificate-key" >}} -{{< tab name="certificate-key" include="generated/kubeadm_alpha_certs_certificate-key.md" />}} -{{< /tabs >}} - -## kubeadm alpha certs generate-csr {#cmd-certs-generate-csr} - - -该命令可用于生成证书签名请求（CSR），CSR 可以将其提交给证书颁发机构（CA）进行签名。 - -{{< tabs name="tab-certs-generate-csr" >}} -{{< tab name="certificate-generate-csr" include="generated/kubeadm_alpha_certs_generate-csr.md" />}} -{{< /tabs >}} - -## kubeadm alpha certs check-expiration {#cmd-certs-check-expiration} - - -此命令检查 kubeadm 管理的本地 PKI 中证书的到期时间。 -有关证书到期和续订的更多详细信息，请参见 -[证书管理文档](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/)。 - -{{< tabs name="tab-certs-check-expiration" >}} -{{< tab name="check-expiration" include="generated/kubeadm_alpha_certs_check-expiration.md" />}} -{{< /tabs >}} - ## kubeadm alpha kubeconfig user {#cmd-phase-kubeconfig} - {{< tabs name="selfhosting" >}} {{< tab name="selfhosting" include="generated/kubeadm_alpha_selfhosting.md" />}} {{< tab name="pivot" include="generated/kubeadm_alpha_selfhosting_pivot.md" />}} @@ -149,6 +67,13 @@ The subcommand `pivot` can be used to convert a static Pod-hosted control plane * [kubeadm join](/docs/reference/setup-tools/kubeadm/kubeadm-join/) to connect a node to the cluster * [kubeadm reset](/docs/reference/setup-tools/kubeadm/kubeadm-reset/) to revert any changes made to this host by `kubeadm init` or `kubeadm join` --> -* [kubeadm init](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/) 引导 Kubernetes 控制平面节点 -* [kubeadm join](/zh/docs/reference/setup-tools/kubeadm/kubeadm-join/) 将节点连接到集群 -* [kubeadm reset](/zh/docs/reference/setup-tools/kubeadm/kubeadm-reset/) 会还原 `kubeadm init` 或 `kubeadm join` 操作对主机所做的任何更改。 +* 用来启动引导 Kubernetes 控制平面节点的 + [kubeadm init](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/) + 命令 +* 用来将节点连接到集群的 + [kubeadm join](/zh/docs/reference/setup-tools/kubeadm/kubeadm-join/) + 命令 +* 用来还原 `kubeadm init` 或 `kubeadm join` 操作对主机所做的任何更改的 + [kubeadm reset](/zh/docs/reference/setup-tools/kubeadm/kubeadm-reset/) + 命令 + diff --git a/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-init.md b/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-init.md index 9d0e64bec5..f7e4bb9bf1 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-init.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-init.md @@ -6,7 +6,6 @@ weight: 20 此命令初始化一个 Kubernetes 控制平面节点。 - {{< include "generated/kubeadm_init.md" >}} @@ -44,7 +42,7 @@ following steps: --> 1. 在做出变更前运行一系列的预检项来验证系统状态。一些检查项目仅仅触发警告， 其它的则会被视为错误并且退出 kubeadm，除非问题得到解决或者用户指定了 - `--ignore-preflight-errors=` 参数。 + `--ignore-preflight-errors=<错误列表>` 参数。 6. 生成令牌，将来其他节点可使用该令牌向控制平面注册自己。 - 如文档 [kubeadm token](/zh/docs/reference/setup-tools/kubeadm/kubeadm-token/) 所述， + 如 [kubeadm token](/zh/docs/reference/setup-tools/kubeadm/kubeadm-token/) 文档所述， 用户可以选择通过 `--token` 提供令牌。 ### 在 kubeadm 中使用 init phases {#init-phases} - Kubeadm 允许你使用 `kubeadm init phase` 命令分阶段创建控制平面节点。 -可以使用 [kubeadm config print](/zh/docs/reference/setup-tools/kubeadm/kubeadm-config/)命令打印出默认配置。 +可以使用 [kubeadm config print](/zh/docs/reference/setup-tools/kubeadm/kubeadm-config/) +命令打印出默认配置。 如果你的配置没有使用最新版本， **推荐**使用 [kubeadm config migrate](/zh/docs/reference/setup-tools/kubeadm/kubeadm-config/) 命令进行迁移。 有关配置的字段和用法的更多信息， -你可以导航到我们的 API 参考页面并从 -[列表](https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm#pkg-subdirectories)中选择一个版本。 +你可以访问 API 参考页面并从 +[列表](https://godoc.org/k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm#pkg-subdirectories) +中选择一个版本。 @@ -379,7 +378,8 @@ For detailed information on certificate management with kubeadm see The document includes information about using external CA, custom certificates and certificate renewal. --> -有关使用 kubeadm 进行证书管理的详细信息，请参阅[使用 kubeadm 进行证书管理](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/)。 +有关使用 kubeadm 进行证书管理的详细信息，请参阅 +[使用 kubeadm 进行证书管理](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/)。 该文档包括有关使用外部 CA，自定义证书和证书更新的信息。 -kubeadm 需要的所有镜像，例如 `k8s.gcr.io/kube-*`、`k8s.gcr.io/etcd` 和 `k8s.gcr.io/pause` 都支持多种架构。 +kubeadm 需要的所有镜像，例如 `k8s.gcr.io/kube-*`、`k8s.gcr.io/etcd` 和 `k8s.gcr.io/pause` +都支持多种架构。 -不必像文档[kubeadm 基础教程](/zh/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/)所述， -将从 `kubeadm init` 取得的令牌复制到每个节点，你可以并行地分发令牌以实现简单自动化。要实现自动化， -你必须知道控制平面节点启动后将拥有的 IP 地址，或使用 DNS 名称或负载均衡器的地址。 +除了像文档 [kubeadm 基础教程](/zh/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/) +中所描述的那样，将从 `kubeadm init` 取得的令牌复制到每个节点， +你还可以并行地分发令牌以实现简单自动化。 +要实现自动化，你必须知道控制平面节点启动后将拥有的 IP 地址，或使用 DNS 名称或负载均衡器的地址。 +kubeadm can generate a token for you: +--> 1. 生成一个令牌。这个令牌必须具有以下格式：`< 6 个字符的字符串>.< 16 个字符的字符串>`。 更加正式的说法是，它必须符合以下正则表达式：`[a-z0-9]{6}\.[a-z0-9]{16}`。 @@ -494,7 +497,7 @@ As they come up they should find each other and form the cluster. The same `-tok 3. 当加入其他控制平面节点时，可以对 `--certificate-key` 执行类似的操作。可以使用以下方式生成密钥： ```shell - kubeadm alpha certs certificate-key + kubeadm certs certificate-key ``` 注意这种搭建集群的方式在安全保证上会有一些宽松，因为这种方式不允许使用 `--discovery-token-ca-cert-hash` 来验证根 CA 的哈希值（因为当配置节点的时候，它还没有被生成）。 -更多信息请参阅[kubeadm join](/zh/docs/reference/setup-tools/kubeadm/kubeadm-join/)文档。 +更多信息请参阅 [kubeadm join](/zh/docs/reference/setup-tools/kubeadm/kubeadm-join/)文档。 ## {{% heading "whatsnext" %}} @@ -523,8 +526,11 @@ provisioned). For details, see the [kubeadm join](/docs/reference/setup-tools/ku * [kubeadm upgrade](/docs/reference/setup-tools/kubeadm/kubeadm-upgrade/) to upgrade a Kubernetes cluster to a newer version * [kubeadm reset](/docs/reference/setup-tools/kubeadm/kubeadm-reset/) to revert any changes made to this host by `kubeadm init` or `kubeadm join` --> -* 进一步阅读了解[kubeadm init phase](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/) -* [kubeadm join](/zh/docs/reference/setup-tools/kubeadm/kubeadm-join/)启动一个 Kubernetes 工作节点并且将其加入到集群 -* [kubeadm upgrade](/zh/docs/reference/setup-tools/kubeadm/kubeadm-upgrade/)将 Kubernetes 集群升级到新版本 -* [kubeadm reset](/zh/docs/reference/setup-tools/kubeadm/kubeadm-reset/)使用 `kubeadm init` 或 `kubeadm join` 来恢复对节点的变更 +* 进一步阅读了解 [kubeadm init phase](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init-phase/) +* [kubeadm join](/zh/docs/reference/setup-tools/kubeadm/kubeadm-join/) + 启动一个 Kubernetes 工作节点并且将其加入到集群 +* [kubeadm upgrade](/zh/docs/reference/setup-tools/kubeadm/kubeadm-upgrade/) + 将 Kubernetes 集群升级到新版本 +* [kubeadm reset](/zh/docs/reference/setup-tools/kubeadm/kubeadm-reset/) + 恢复 `kubeadm init` 或 `kubeadm join` 命令对节点所作的变更 diff --git a/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-version.md b/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-version.md index b2afa2124b..7290cc11df 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-version.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-version.md @@ -1,21 +1,23 @@ --- -reviewers: -- mikedanese -- luxas -- jbeda title: kubeadm version content_type: concept weight: 80 --- + + - -此命令用来查询 kubeadm 的版本。 - - +此命令用来输出 kubeadm 的版本。 {{< include "generated/kubeadm_version.md" >}} From eccd0bb4dd2ef0e61c7c979f48d66aeaf1aa45bf Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Mon, 14 Dec 2020 16:24:05 +0800 Subject: [PATCH 086/258] Update 2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md --- .../2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/zh/blog/_posts/2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md b/content/zh/blog/_posts/2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md index c018c0c9da..b46fd0fb3f 100644 --- a/content/zh/blog/_posts/2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md +++ b/content/zh/blog/_posts/2016-04-00-Adding-Support-For-Kubernetes-In-Rancher.md @@ -65,7 +65,8 @@ Even better, we have been able to add a number of services around the core Kuber --> 更好的是，我们已经能够围绕 Kubernetes 核心功能添加许多服务。 例如，我们在 Kubernetes 上实现了常用的 [应用程序目录](https://github.com/rancher/community-catalog/tree/master/kubernetes-templates) 。 -过去，我们曾使用Docker Compose定义应用程序模板，但是在此版本中，我们现在支持 Kubernetes 服务，复制控制器和 Pod 来部署应用程序。使用目录，用户可以连接到 git repo 并自动部署和升级作为 Kubernetes 服务部署到应用程序。 +过去，我们曾使用 Docker Compose 定义应用程序模板，但是在此版本中，我们现在支持 Kubernetes 服务、副本控制器和和 Pod 来部署应用程序。 +使用目录，用户可以连接到 git 仓库并自动部署和升级作为 Kubernetes 服务部署的应用。 然后，用户只需单击一下按钮，即可配置和部署复杂的多节点企业应用程序。 升级也是完全自动化的，并集中向用户推出。 From d284a75ef23a97b8d0c205f9dcd89f904b9c5b0d Mon Sep 17 00:00:00 2001 From: xin Date: Mon, 14 Dec 2020 17:01:31 +0800 Subject: [PATCH 087/258] Update authentication.md Fix typo --- content/zh/docs/reference/access-authn-authz/authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/reference/access-authn-authz/authentication.md b/content/zh/docs/reference/access-authn-authz/authentication.md index 030a628860..b54ca2f148 100644 --- a/content/zh/docs/reference/access-authn-authz/authentication.md +++ b/content/zh/docs/reference/access-authn-authz/authentication.md @@ -351,7 +351,7 @@ talk to the API server. Accounts may be explicitly associated with pods using th 服务账号通常由 API 服务器自动创建并通过 `ServiceAccount` [准入控制器](/zh/docs/reference/access-authn-authz/admission-controllers/) 关联到集群中运行的 Pod 上。 -持有者令牌会挂载到 Pod 中可预知的为之，允许集群内进程与 API 服务器通信。 +持有者令牌会挂载到 Pod 中可预知的位置，允许集群内进程与 API 服务器通信。 服务账号也可以使用 Pod 规约的 `serviceAccountName` 字段显式地关联到 Pod 上。 请注意，生成 Secret 时，Secret 的名称最终是由 `name` 字段和数据的哈希值拼接而成。 +这将保证每次修改数据时生成一个新的 Secret。 ## 检查创建的 Secret {#check-the-secret-created} From 7bfc91534f790e51d0c9801b08d4dc73199a0d4e Mon Sep 17 00:00:00 2001 From: Mac24 <33311670+Mac24@users.noreply.github.com> Date: Mon, 14 Dec 2020 19:35:27 +0800 Subject: [PATCH 090/258] modify `kubeadm init` link `kubeadm init`, the previous link cannot be opened, 404, I revised the link again --- .../tools/kubeadm/create-cluster-kubeadm.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md b/content/zh/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md index b1ed43f952..a8ae47395d 100644 --- a/content/zh/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md +++ b/content/zh/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md @@ -265,9 +265,9 @@ kubeadm 不支持将没有 `--control-plane-endpoint` 参数的单个控制平 ### 更多信息 -有关 `kubeadm init` 参数的更多信息，请参见 [kubeadm 参考指南](/zh/docs/reference/setup-tools/kubeadm/kubeadm/)。 +有关 `kubeadm init` 参数的更多信息，请参见 [kubeadm 参考指南](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/)。 + +_编者注：本周我们将推出 [Kubernetes 特殊兴趣小组](https://github.com/kubernetes/kubernetes/wiki/Special-Interest-Groups-(SIGs))、 +Network-SIG 小组今天的帖子描述了 1.3 版中的网络策略 API-安全，隔离和多租户策略。_ + + + +自去年下半年以来，[Kubernetes SIG-Networking](https://kubernetes.slack.com/messages/sig-network/) 一直在定期开会，致力于将网络策略引入 Kubernetes，我们开始看到这个努力的结果。 + + +许多用户面临的一个问题是，Kubernetes 的开放访问网络策略不适用于需要对访问容器或服务的流量进行更精确控制的应用程序。 +如今，这种应用可能是多层应用，其中仅允许来自某个相邻层的流量。 +但是，随着新的云原生应用不断通过组合微服务构建出来，对服务间流动的数据进行控制的能力变得更加重要。 + + +在大多数 IaaS 环境（公共和私有）中，通过允许 VM 加入“安全组（Security Group）”来提供这种控制， +其中“安全组”成员的流量由网络策略或访问控制列表（ ACL ）定义，并由网络数据包过滤器实施。 + + +SIG-Networking 开始这项工作时的第一步是辩识需要特定网络隔离以增强安全性的 +[特定用例场景](https://docs.google.com/document/d/1blfqiH4L_fpn33ZrnQ11v7LcYP0lmpiJ_RaapAPBbNU/edit?pref=2&pli=1#)。 +确保所定义的 API 适用于这些简单和常见的用例非常重要，因为它们为在 Kubernetes 内 +实现更复杂的网络策略以支持多租户奠定了基础。 + + +基于这些场景，团队考虑了几种可能的方法，并定义了一个最小的 +[策略规范](https://docs.google.com/document/d/1qAm-_oSap-f1d6a-xRTj6xaH1sYQBfK36VyjB5XOZug/edit) 。 +基本思想是，如果按命名空间启用了隔离，则特定流量类型被允许时会选择特定的 Pod。 + + +快速支持此实验性 API 的最简单方法是对 API 服务器的 ThirdPartyResource 扩展，今天在 Kubernetes 1.2 中就可以实现。 + + +如果您不熟悉它的工作方式，则可以通过定义 ThirdPartyResources 来扩展 Kubernetes API ，ThirdPartyResources 在指定的 URL 上创建一个新的 API 端点。 + +#### third-party-res-def.yaml + +``` +kind: ThirdPartyResource +apiVersion: extensions/v1beta1 +metadata: +name: network-policy.net.alpha.kubernetes.io +description: "Network policy specification" +versions: +- name: v1alpha1 + ``` + +``` +$kubectl create -f third-party-res-def.yaml + ``` + + +这将创建一个 API 端点（每个名称空间一个）： + +``` +/net.alpha.kubernetes.io/v1alpha1/namespace/default/networkpolicys/ + ``` + + +第三方网络控制器现在可以在这些端点上进行侦听，并在创建，修改或删除资源时根据需要做出反应。 +_注意：在即将发布的 Kubernetes 1.3 版本中-当网络政策 API 以 beta 形式发布时-无需创建如上所示的 ThirdPartyResource API 端点。_ + + + +默认情况下，网络隔离处于关闭状态，以便所有Pod都能正常通信。 +但是，重要的是要知道，启用网络隔离后，所有命名空间中所有容器的所有流量都会被阻止，这意味着启用隔离将改变容器的行为 + + + +通过在名称空间上定义 _network-isolation_ 注解来启用网络隔离，如下所示： + +``` +net.alpha.kubernetes.io/network-isolation: [on | off] + ``` + + +启用网络隔离后，**必须应用**显式网络策略才能启用 Pod 通信。 + + +可以将策略规范应用于命名空间，以定义策略的详细信息，如下所示： + +``` +POST /apis/net.alpha.kubernetes.io/v1alpha1/namespaces/tenant-a/networkpolicys/ + +{ +"kind": "NetworkPolicy", +"metadata": { +"name": "pol1" +}, +"spec": { +"allowIncoming": { +"from": [ +{ "pods": { "segment": "frontend" } } +], +"toPorts": [ +{ "port": 80, "protocol": "TCP" } +] +}, +"podSelector": { "segment": "backend" } +} +} + ``` + + +在此示例中，‘ **tenant-a** ’名称空间将按照指示应用策略‘ **pol1** ’。 +具体而言，带有**segment**标签 ‘ **后端** ’ 的容器将允许接收来自带有“segment**标签‘ **frontend** ’的容器的端口80上的TCP流量。 + + +现今，[Romana](http://romana.io/), [OpenShift](https://www.openshift.com/), [OpenContrail](http://www.opencontrail.org/) 和 [Calico](http://projectcalico.org/) 支持应用于名称空间和容器的网络策略。 +思科和 VMware 也在努力实施。 +Romana 和 Calico 最近都在 KubeCon 上使用 Kubernetes 1.2 演示了这些功能。 +你可以在此处观看他们的演讲：[Romana](https://www.youtube.com/watch?v=f-dLKtK6qCs) ([slides](http://www.slideshare.net/RomanaProject/kubecon-london-2016-ronana-cloud-native-sdn))， [Calico](https://www.youtube.com/watch?v=p1zfh4N4SX0) ([slides](http://www.slideshare.net/kubecon/kubecon-eu-2016-secure-cloudnative-networking-with-project-calico))。  + + +**它是如何工作的？** + + +每个解决方案都有其自己的特定实现细节。 +今天，他们依靠某种形式的主机执行机制，但是将来的实现也可以构建为在虚拟机管理程序上，甚至直接由网络本身应用策略构建。  + + +外部策略控制软件（具体情况因实现而异）将监视新 API 终结点是否正在创建容器和/或正在应用新策略。 +当发生需要配置策略的事件时，侦听器将识别出更改，并且控制器将通过配置接口并应用策略来做出响应。  +下图显示了 API 侦听器和策略控制器，它通过主机代理在本地应用网络策略来响应更新。 +主机上的网络接口由主机上的 CNI 插件配置（未显示）。 + + ![controller.jpg](https://lh5.googleusercontent.com/zMEpLMYmask-B-rYWnbMyGb0M7YusPQFPS6EfpNOSLbkf-cM49V7rTDBpA6k9-Zdh2soMul39rz9rHFJfL-jnEn_mHbpg0E1WlM-wjU-qvQu9KDTQqQ9uBmdaeWynDDNhcT3UjX5) + + +如果您由于网络隔离和/或安全性问题而一直拒绝使用 Kubernetes 开发应用程序，那么这些新的网络策略将为您提供所需的控制功能大有帮助。 +无需等到 Kubernetes 1.3，因为网络策略现在作为实验性 API 可用，已启用 ThirdPartyResource。 + + +如果您对 Kubernetes 和网络感兴趣，有几种参与方式-请通过以下方式加入我们： + + +- 我们的 [Networking Slack 频道](https://kubernetes.slack.com/messages/sig-network/)  + +- 我们的 [Kubernetes Networking Special Interest Group](https://groups.google.com/forum/#!forum/kubernetes-sig-network) 电子邮件列表  + + + +网络“特殊兴趣小组”，每两周一次，在太平洋时间下午 3 点（15：00）在[SIG-Networking 环聊](https://zoom.us/j/5806599998)开会。  + + + +_--Pani Networks 联合创始人 Chris Marino_ From 1b61e68b7945c7f06f9918c0209af959ca853c83 Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Tue, 15 Dec 2020 09:03:48 +0800 Subject: [PATCH 095/258] Create 2018-03-00-Principles-Of-Container-App-Design.md (#25525) * Create 2018-03-00-Principles-Of-Container-App-Design.md * Update 2018-03-00-Principles-Of-Container-App-Design.md * Update 2018-03-00-Principles-Of-Container-App-Design.md --- ...3-00-Principles-Of-Container-App-Design.md | 126 ++++++++++++++++++ 1 file changed, 126 insertions(+) create mode 100644 content/zh/blog/_posts/2018-03-00-Principles-Of-Container-App-Design.md diff --git a/content/zh/blog/_posts/2018-03-00-Principles-Of-Container-App-Design.md b/content/zh/blog/_posts/2018-03-00-Principles-Of-Container-App-Design.md new file mode 100644 index 0000000000..779fa7111c --- /dev/null +++ b/content/zh/blog/_posts/2018-03-00-Principles-Of-Container-App-Design.md @@ -0,0 +1,126 @@ +--- +title: “基于容器的应用程序设计原理” +date: 2018-03-15 +slug: principles-of-container-app-design +url: /zh/blog/2018/03/Principles-Of-Container-App-Design +--- + + + +如今，可以将几乎所有应用程序放入容器中并运行它。 +但是，创建云原生应用程序（由 Kubernetes 等云原生平台自动有效地编排的容器化应用程序）需要付出额外的努力。 +云原生应用程序会预期失败； +它们可以可靠的运行和扩展，即使基础架构出现故障。 +为了提供这样的功能，像 Kubernetes 这样的云原生平台对应用程序施加了一系列约定和约束。 +这些合同确保运行的应用程序符合某些约束条件，并允许平台自动执行应用程序管理。 + + + +我总结了容器化应用要成为彻底的云原生应用所要遵从的[七个原则][1]。 + +| ----- | +| ![][2] | + +| 容器设计原则 | + + + +这七个原则涵盖了构建时间和运行时问题。 + + +#### 建立时间 + + +* **单独关注点：** 每个容器都解决了一个单独的关注点，并做到了。 + +* **自包含：** 容器仅依赖于Linux内核的存在。 构建容器时会添加其他库。 + +* **镜像不可变性：** 容器化应用程序是不可变的，并且一旦构建，就不会在不同环境之间发生变化。 + + +#### 运行时 + + +* **高度可观察性：** 每个容器都必须实现所有必要的API，以帮助平台以最佳方式观察和管理应用程序。 + +* **生命周期一致性：** 容器必须具有读取来自平台的事件并通过对这些事件做出反应来进行一致性的方式。 + +* **进程可丢弃：** 容器化的应用程序必须尽可能短暂，并随时可以被另一个容器实例替换。 + +* **运行时可约束** 每个容器必须声明其资源需求，并根据所标明的需求限制其资源使用。 +构建时间原则可确保容器具有正确的颗粒度，一致性和适当的结构。 +运行时原则规定了必须执行哪些功能才能使容器化的应用程序具有云原生功能。 +遵循这些原则有助于确保您的应用程序适合Kubernetes中的自动化。 + + +白皮书可以免费下载： + + +要了解有关为Kubernetes设计云原生应用程序的更多信息，请翻阅我的[Kubernetes 模式][3]这本书。 + + +— [Bilgin Ibryam][4]，首席架构师，Red Hat + + +推特： 
 +博客： [http://www.ofbizian.com][5] +领英： + + +Bilgin Ibryam（@bibryam）是 Red Hat 的首席架构师，ASF 的开源提交者，博客，作者和发言人。 +他是骆驼设计模式和 Kubernetes 模式书籍的作者。 +在日常工作中，Bilgin 乐于指导，培训和领导团队，以使他们在分布式系统，微服务，容器和云原生应用程序方面取得成功。 + + +[1]: https://www.redhat.com/en/resources/cloud-native-container-design-whitepaper +[2]: https://lh5.googleusercontent.com/1XqojkVC0CET1yKCJqZ3-0VWxJ3W8Q74zPLlqnn6eHSJsjHOiBTB7EGUX5o_BOKumgfkxVdgBeLyoyMfMIXwVm9p2QXkq_RRy2mDJG1qEExJDculYL5PciYcWfPAKxF2-DGIdiLw +[3]: http://leanpub.com/k8spatterns/ +[4]: http://twitter.com/bibryam +[5]: http://www.ofbizian.com/ + From 9c2547068ebfd8d625f2a7fda0bc79bc6ed5d5f4 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Mon, 14 Dec 2020 13:25:51 +0800 Subject: [PATCH 096/258] [zh] Sync kubeadm certs command reference The alpha certs command has graduated into GA in 1.20. This PR updates the zh localization for `kubeadm certs` command. --- ...ubeadm_alpha_certs.md => kubeadm_certs.md} | 25 ++-- ...ey.md => kubeadm_certs_certificate-key.md} | 10 +- ...n.md => kubeadm_certs_check-expiration.md} | 12 +- ...e-csr.md => kubeadm_certs_generate-csr.md} | 47 ++++---- ..._certs_renew.md => kubeadm_certs_renew.md} | 5 +- ...f.md => kubeadm_certs_renew_admin.conf.md} | 15 +-- ...enew_all.md => kubeadm_certs_renew_all.md} | 9 +- ...eadm_certs_renew_apiserver-etcd-client.md} | 14 +-- ...m_certs_renew_apiserver-kubelet-client.md} | 12 +- ...er.md => kubeadm_certs_renew_apiserver.md} | 12 +- ...dm_certs_renew_controller-manager.conf.md} | 16 +-- ...dm_certs_renew_etcd-healthcheck-client.md} | 17 +-- ...er.md => kubeadm_certs_renew_etcd-peer.md} | 15 +-- ....md => kubeadm_certs_renew_etcd-server.md} | 16 +-- ...kubeadm_certs_renew_front-proxy-client.md} | 16 +-- ... => kubeadm_certs_renew_scheduler.conf.md} | 15 +-- .../setup-tools/kubeadm/kubeadm-alpha.md | 75 ------------ .../setup-tools/kubeadm/kubeadm-certs.md | 113 ++++++++++++++++++ 18 files changed, 212 insertions(+), 232 deletions(-) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs.md => kubeadm_certs.md} (63%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_certificate-key.md => kubeadm_certs_certificate-key.md} (87%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_check-expiration.md => kubeadm_certs_check-expiration.md} (94%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_generate-csr.md => kubeadm_certs_generate-csr.md} (61%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_renew.md => kubeadm_certs_renew.md} (96%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_renew_admin.conf.md => kubeadm_certs_renew_admin.conf.md} (91%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_renew_all.md => kubeadm_certs_renew_all.md} (94%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_renew_apiserver-etcd-client.md => kubeadm_certs_renew_apiserver-etcd-client.md} (92%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_renew_apiserver-kubelet-client.md => kubeadm_certs_renew_apiserver-kubelet-client.md} (94%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_renew_apiserver.md => kubeadm_certs_renew_apiserver.md} (94%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_renew_controller-manager.conf.md => kubeadm_certs_renew_controller-manager.conf.md} (91%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_renew_etcd-healthcheck-client.md => kubeadm_certs_renew_etcd-healthcheck-client.md} (89%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_renew_etcd-peer.md => kubeadm_certs_renew_etcd-peer.md} (91%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_renew_etcd-server.md => kubeadm_certs_renew_etcd-server.md} (90%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_renew_front-proxy-client.md => kubeadm_certs_renew_front-proxy-client.md} (90%) rename content/zh/docs/reference/setup-tools/kubeadm/generated/{kubeadm_alpha_certs_renew_scheduler.conf.md => kubeadm_certs_renew_scheduler.conf.md} (89%) create mode 100644 content/zh/docs/reference/setup-tools/kubeadm/kubeadm-certs.md diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs.md similarity index 63% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs.md index dd1e3f5c78..9e34c47542 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs.md @@ -1,13 +1,17 @@ - + ### 概要 - - - + 与处理 kubernetes 证书相关的命令 - + ### 选项
@@ -21,16 +25,16 @@ - +
-h, --help
certs 命令的帮助
- - - + ### 继承于父命令的选项 @@ -44,7 +48,7 @@ - + @@ -52,4 +56,3 @@
--rootfs string
[实验] 到'真实'主机根文件系统的路径。
- diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_certificate-key.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_certificate-key.md similarity index 87% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_certificate-key.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_certificate-key.md index 46952e26f8..b008e44b38 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_certificate-key.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_certificate-key.md @@ -2,30 +2,27 @@ - ### 概要 - 该命令将打印出可以与 "init" 命令一起使用的安全的随机生成的证书密钥。 - -您也可以使用 `kubeadm init --upload-certs` 而无需指定证书密钥，它将为您生成并打印一个证书密钥。 +你也可以使用 `kubeadm init --upload-certs` 而无需指定证书密钥； +命令将为你生成并打印一个证书密钥。 ``` -kubeadm alpha certs certificate-key [flags] +kubeadm certs certificate-key [flags] ``` - ### 选项 @@ -53,7 +50,6 @@ certificate-key 操作的帮助命令 - ### 从父命令继承的选项
diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_check-expiration.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_check-expiration.md similarity index 94% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_check-expiration.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_check-expiration.md index ec5b186354..e01e7fa4fe 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_check-expiration.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_check-expiration.md @@ -1,23 +1,20 @@ - ### 概要 - 检查 kubeadm 管理的本地 PKI 中证书的到期时间。 ``` -kubeadm alpha certs check-expiration [flags] +kubeadm certs check-expiration [flags] ``` - ### 选项
@@ -59,8 +56,9 @@ kubeadm alpha certs check-expiration [flags]
- - + ### 继承于父命令的选项 @@ -82,5 +80,3 @@ kubeadm alpha certs check-expiration [flags]
- - diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_generate-csr.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_generate-csr.md similarity index 61% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_generate-csr.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_generate-csr.md index cbf2a6368e..03dcc9298b 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_generate-csr.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_generate-csr.md @@ -6,39 +6,46 @@ Generates keys and certificate signing requests (CSRs) for all the certificates required to run the control plane. This command also generates partial kubeconfig files with private key data in the "users > user > client-key-data" field, and for each kubeconfig file an accompanying ".csr" file is created. --> 为运行控制平面所需的所有证书生成密钥和证书签名请求（CSR）。该命令会生成部分 kubeconfig 文件， -其中 "users > user > client-key-data" 字段包含私钥数据，并为每个 kubeconfig 文件创建一个随附的".csr"文件。 +其中 "users > user > client-key-data" 字段包含私钥数据，并为每个 kubeconfig +文件创建一个随附的 ".csr" 文件。 -该命令设计用于 [Kubeadm 外部 CA 模式](https://kubernetes.io/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#external-ca-mode)。 -它生成 CSR，然后你可以将其提交给外部证书颁发机构进行签名。 +此命令设计用于 +[Kubeadm 外部 CA 模式](https://kubernetes.io/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#external-ca-mode)。 +它生成你可以提交给外部证书颁发机构进行签名的 CSR。 -然后，应使用 ".crt" 作为文件扩展名将 PEM 编码的签名证书与密钥文件一起保存，或者，对于 kubeconfig 文件， -PEM 编码的签名证书应使用 base64 编码，并添加到 "users > user > client-certificate-data" 字段。 +应使用 ".crt" 作为文件扩展名将 PEM 编码的签名证书与密钥文件一起保存。 +或者，对于 kubeconfig 文件，PEM 编码的签名证书应使用 base64 编码， +并添加到 "users > user > client-certificate-data" 字段。 ``` -kubeadm alpha certs generate-csr [flags] +kubeadm certs generate-csr [flags] ``` - + ### 示例 ``` - # 以下命令将为所有控制平面证书和 kubeconfig 文件生成密钥和 CSR : - kubeadm alpha certs generate-csr --kubeconfig-dir /tmp/etc-k8s --cert-dir /tmp/etc-k8s/pki +# 以下命令将为所有控制平面证书和 kubeconfig 文件生成密钥和 CSR : +kubeadm certs generate-csr --kubeconfig-dir /tmp/etc-k8s --cert-dir /tmp/etc-k8s/pki ``` - + ### 选项 @@ -52,7 +59,7 @@ kubeadm alpha certs generate-csr [flags] - + @@ -60,7 +67,7 @@ kubeadm alpha certs generate-csr [flags] - + @@ -68,25 +75,25 @@ kubeadm alpha certs generate-csr [flags] - + - + - +
--cert-dir string
保存证书的路径
--config string
kubeadm 配置文件的路径。
-h, --help
generate-csr 命令的帮助
--kubeconfig-dir string     默认值："/etc/kubernetes"
保存 kubeconfig 文件的路径。
- - - + ### 继承于父命令的选项 @@ -107,5 +114,3 @@ kubeadm alpha certs generate-csr [flags]
- - diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew.md similarity index 96% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew.md index 68b2f39946..58fff42d32 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew.md @@ -2,23 +2,20 @@ - ### 概要 - 此命令并非设计用来单独运行。请参阅可用子命令列表。 ``` -kubeadm alpha certs renew [flags] +kubeadm certs renew [flags] ``` - ### 选项 diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_admin.conf.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_admin.conf.md similarity index 91% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_admin.conf.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_admin.conf.md index 2803b6fa07..d770d8438d 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_admin.conf.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_admin.conf.md @@ -2,36 +2,31 @@ - ### 概要 - 续订 kubeconfig 文件中嵌入的证书，供管理员 和 kubeadm 自身使用。 - 无论证书的到期日期如何，续订都是无条件进行的；SAN 等额外属性将基于现有文件/证书，因此无需重新提供它们。 - 默认情况下，续订会尝试使用由 kubeadm 管理的本地 PKI 中的证书机构；作为替代方案， -也可以使用 K8s certificate API 进行证书续订，或者（作为最后一种选择）生成 CSR 请求。 +也可以使用 K8s 证书 API 进行证书续订，或者（作为最后一种选择）生成 CSR 请求。 - 续订后，为了使更改生效，需要重新启动控制平面组件，并最终重新分发更新的证书，以防证书文件在其他地方使用。 ``` -kubeadm alpha certs renew admin.conf [flags] +kubeadm certs renew admin.conf [flags] ``` -admin.conf 操作的帮助命令 +admin.conf 子操作的帮助命令 @@ -110,7 +105,8 @@ admin.conf 操作的帮助命令 @@ -132,7 +128,6 @@ Use the Kubernetes certificate API to renew certificates - ### 从父命令继承的选项
-与集群通信时使用的 kubeconfig 文件。如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 +与集群通信时使用的 kubeconfig 文件。 +如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。
diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_all.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_all.md similarity index 94% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_all.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_all.md index fc1216fe0d..2ac56da0dd 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_all.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_all.md @@ -2,23 +2,20 @@ - ### 概要 - 续订运行控制平面所需的所有已知证书。续订是无条件进行的，与到期日期无关。续订也可以单独运行以进行更多控制。 ``` -kubeadm alpha certs renew all [flags] +kubeadm certs renew all [flags] ``` - ### 选项
@@ -106,7 +103,8 @@ all 操作的帮助命令 -与集群通信时使用的 kubeconfig 文件。如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 +与集群通信时使用的 kubeconfig 文件。 +如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 @@ -128,7 +126,6 @@ Use the Kubernetes certificate API to renew certificates - ### 从父命令继承的选项
diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_apiserver-etcd-client.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-etcd-client.md similarity index 92% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_apiserver-etcd-client.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-etcd-client.md index 861295f79d..2e5c428da3 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_apiserver-etcd-client.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-etcd-client.md @@ -2,42 +2,36 @@ - ### 概要 - 续订 apiserver 用于访问 etcd 的证书。 - 无论证书的到期日期如何，续订都会无条件地进行；SAN 等额外属性将基于现有文件/证书，因此无需重新提供它们。 - -默认情况下，续订尝试在 kubeadm 管理的本地 PKI 中使用证书颁发机构；作为替代方案， +默认情况下，续订尝试使用在 kubeadm 所管理的本地 PKI 中的证书颁发机构；作为替代方案， 可以使用 K8s 证书 API 进行证书更新，或者作为最后一个选择来生成 CSR 请求。 - 续订后，为了使更改生效，需要重新启动控制平面组件，并最终重新分发更新的证书，以防文件在其他地方使用。 ``` -kubeadm alpha certs renew apiserver-etcd-client [flags] +kubeadm certs renew apiserver-etcd-client [flags] ``` - ### 选项
@@ -113,7 +107,8 @@ apiserver-etcd-client 操作的帮助命令 -与集群通信时使用的 kubeconfig 文件。如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 +与集群通信时使用的 kubeconfig 文件。 +如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 @@ -135,7 +130,6 @@ The kubeconfig file to use when talking to the cluster. If the flag is not set, - ### 从父命令继承的选项
diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_apiserver-kubelet-client.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-kubelet-client.md similarity index 94% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_apiserver-kubelet-client.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-kubelet-client.md index a6e3b477a3..9b1d8127b9 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_apiserver-kubelet-client.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver-kubelet-client.md @@ -2,42 +2,36 @@ - ### 概要 - 续订 apiserver 用于连接 kubelet 的证书。 - 无论证书的到期日期如何，续订都会无条件地进行；SAN 等额外属性将基于现有文件/证书，因此无需重新提供它们。 - 默认情况下，续订尝试使用位于 kubeadm 所管理的本地 PKI 中的证书颁发机构；作为替代方案， 也可能调用 K8s 证书 API 进行证书更新；亦或者，作为最后一个选择，生成 CSR 请求。 - 续订后，为了使更改生效，需要重新启动控制平面组件，并最终重新分发更新的证书，以防文件在其他地方使用。 ``` -kubeadm alpha certs renew apiserver-kubelet-client [flags] +kubeadm certs renew apiserver-kubelet-client [flags] ``` - ### 选项
@@ -125,7 +119,8 @@ apiserver-kubelet-client 操作的帮助命令 -与集群通信时使用的 kubeconfig 文件。如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 +与集群通信时使用的 kubeconfig 文件。 +如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 @@ -147,7 +142,6 @@ Use the Kubernetes certificate API to renew certificates - ### 从父命令继承的选项
diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_apiserver.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver.md similarity index 94% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_apiserver.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver.md index adec7ac345..a2e2e2c915 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_apiserver.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_apiserver.md @@ -2,13 +2,11 @@ - ### 概要 - 续订用于提供 Kubernetes API 的证书。 - 默认情况下，续订尝试在 kubeadm 管理的本地 PKI 中使用证书颁发机构；作为替代方案， 可以使用 K8s 证书 API 进行证书更新，或者作为最后一个选择来生成 CSR 请求。 - 续订后，为了使更改生效，需要重新启动控制平面组件，并最终重新分发更新的证书，以防文件在其他地方使用。 ``` -kubeadm alpha certs renew apiserver [flags] +kubeadm certs renew apiserver [flags] ``` - ### 选项
@@ -108,7 +103,7 @@ Create CSRs instead of generating certificates -apiserver 操作的帮助命令 +apiserver 子操作的帮助命令 @@ -125,7 +120,8 @@ apiserver 操作的帮助命令 -与集群通信时使用的 kubeconfig 文件。如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 +与集群通信时使用的 kubeconfig 文件。 +如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_controller-manager.conf.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_controller-manager.conf.md similarity index 91% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_controller-manager.conf.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_controller-manager.conf.md index 8b8d367b7d..a4d974bb52 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_controller-manager.conf.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_controller-manager.conf.md @@ -2,42 +2,36 @@ - ### 概要 - -续订 kubeconfig 文件中嵌入的证书，以供控制器管理器（controller manager）使用。 +续订 kubeconfig 文件中嵌入的证书，以供控制器管理器（Controller Manager）使用。 - 续订无条件地进行，与证书的到期日期无关；SAN 等额外属性将基于现有的文件/证书，因此无需重新提供它们。 - -默认情况下，续订会尝试在 kubeadm 管理的本地 PKI 中使用证书颁发机构；作为替代方案， +默认情况下，续订会尝试使用 kubeadm 管理的本地 PKI 中的证书颁发机构；作为替代方案， 可以使用 K8s 证书 API 进行证书续订；亦或者，作为最后一种选择，生成 CSR 请求。 - 续订后，为了使更改生效，需要重新启动控制平面组件，并最终重新分发更新的证书，以防文件在其他地方使用。 ``` -kubeadm alpha certs renew controller-manager.conf [flags] +kubeadm alpha renew controller-manager.conf [flags] ``` - ### 选项
@@ -125,7 +119,8 @@ controller-manager.conf 操作的帮助命令 -与集群通信时使用的 kubeconfig 文件。如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 +与集群通信时使用的 kubeconfig 文件。 +如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 @@ -147,7 +142,6 @@ Use the Kubernetes certificate API to renew certificates - ### 从父命令继承的选项
diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-healthcheck-client.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-healthcheck-client.md similarity index 89% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-healthcheck-client.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-healthcheck-client.md index f31b2e2f29..44f59cffa0 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-healthcheck-client.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-healthcheck-client.md @@ -2,41 +2,36 @@ - ### 概要 - -续订 etcd 健康检查的活跃性探针的证书。 +续订存活态探针的证书，用于对 etcd 执行健康检查。 - 无论证书的到期日期如何，续订都是无条件进行的；SAN 等额外属性将基于现有文件/证书，因此无需重新提供它们。 - -默认情况下，续订会尝试使用由 kubeadm 管理的本地 PKI 中的证书机构；作为替代方案，也可以使用 K8s certificate API 进行证书续订，或者（作为最后一种选择）生成 CSR 请求。 +默认情况下，续订会尝试使用由 kubeadm 管理的本地 PKI 中的证书机构；作为替代方案， +也可以使用 K8s certificate API 进行证书续订，或者（作为最后一种选择）生成 CSR 请求。 - 续订后，为了使更改生效，需要重新启动控制平面组件，并最终重新分发更新的证书，以防证书文件在其他地方使用。 ``` -kubeadm alpha certs renew etcd-healthcheck-client [flags] +kubeadm certs renew etcd-healthcheck-client [flags] ``` - ### 选项
@@ -124,7 +119,8 @@ etcd-healthcheck-client 操作的帮助命令 -与集群通信时使用的 kubeconfig 文件。如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 +与集群通信时使用的 kubeconfig 文件。 +如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 @@ -146,7 +142,6 @@ Use the Kubernetes certificate API to renew certificates - ### 从父命令继承的选项
diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-peer.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-peer.md similarity index 91% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-peer.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-peer.md index 4d3d8ac01d..55264306eb 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-peer.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-peer.md @@ -2,41 +2,36 @@ - ### 概要 - 续订 etcd 节点间用来相互通信的证书。 - 无论证书的到期日期如何，续订都是无条件进行的；SAN 等额外属性将基于现有文件/证书，因此无需重新提供它们。 - -默认情况下，续订会尝试使用由 kubeadm 管理的本地 PKI 中的证书机构；作为替代方案，也可以使用 K8s certificate API 进行证书续订，或者（作为最后一种选择）生成 CSR 请求。 +默认情况下，续订会尝试使用由 kubeadm 管理的本地 PKI 中的证书机构； +作为替代方案，也可以使用 K8s certificate API 进行证书续订，或者（作为最后一种选择）生成 CSR 请求。 - 续订后，为了使更改生效，需要重新启动控制平面组件，并最终重新分发更新的证书，以防证书文件在其他地方使用。 ``` -kubeadm alpha certs renew etcd-peer [flags] +kubeadm certs renew etcd-peer [flags] ``` - ### 选项
@@ -124,7 +119,8 @@ etcd-peer 操作的帮助命令 -与集群通信时使用的 kubeconfig 文件。如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 +与集群通信时使用的 kubeconfig 文件。 +如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 @@ -146,7 +142,6 @@ Use the Kubernetes certificate API to renew certificates - ### 从父命令继承的选项
diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-server.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-server.md similarity index 90% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-server.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-server.md index 922deb136b..237c9d3f44 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_etcd-server.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_etcd-server.md @@ -2,41 +2,36 @@ - ### 概要 - -续订用于提供 etcd 的证书。 +续订用于提供 etcd 服务的证书。 - 续订无条件地进行，与证书的到期日期无关；SAN 等额外属性将基于现有的文件/证书，因此无需重新提供它们。 - -默认情况下，续订会尝试在 kubeadm 管理的本地 PKI 中使用证书颁发机构；作为替代方案，可以使用 K8s 证书 API 进行证书续订，或者作为最后一种选择来生成 CSR 请求。 +默认情况下，续订会尝试在 kubeadm 管理的本地 PKI 中使用证书颁发机构；作为替代方案， +可以使用 K8s 证书 API 进行证书续订，或者作为最后一种选择来生成 CSR 请求。 - 续订后，为了使更改生效，需要重新启动控制平面组件，并最终重新分发更新的证书，以防文件在其他地方使用。 ``` -kubeadm alpha certs renew etcd-server [flags] +kubeadm certs renew etcd-server [flags] ``` - ### 选项
@@ -124,7 +119,8 @@ etcd-server 操作的帮助命令 -与集群通信时使用的 kubeconfig 文件。如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 +与集群通信时使用的 kubeconfig 文件。 +如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_front-proxy-client.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_front-proxy-client.md similarity index 90% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_front-proxy-client.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_front-proxy-client.md index 988c9e0b8e..7dac9e30d2 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_front-proxy-client.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_front-proxy-client.md @@ -2,19 +2,16 @@ - ### 概要 - 为前端代理客户端续订证书。 - 无论证书的到期日期如何，续订都会无条件地进行；SAN 等额外属性将基于现有文件/证书，因此无需重新提供它们。 - 续订后，为了使更改生效，需要重新启动控制平面组件，并最终重新分发更新的证书，以防文件在其他地方使用。 ``` -kubeadm alpha certs renew front-proxy-client [flags] +kubeadm certs renew front-proxy-client [flags] ``` - ### 选项
@@ -47,9 +42,8 @@ kubeadm alpha certs renew front-proxy-client [flags] - + + @@ -143,7 +138,6 @@ Use the Kubernetes certificate API to renew certificates - ### 从父命令继承的选项
---cert-dir string     Default: "/etc/kubernetes/pki" ---cert-dir string     默认值："/etc/kubernetes/pki"
@@ -121,7 +115,8 @@ front-proxy-client 操作的帮助命令 -与集群通信时使用的 kubeconfig 文件。如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 +与集群通信时使用的 kubeconfig 文件。 +如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。
diff --git a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_scheduler.conf.md b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_scheduler.conf.md similarity index 89% rename from content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_scheduler.conf.md rename to content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_scheduler.conf.md index 946c71405e..9898202f48 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_alpha_certs_renew_scheduler.conf.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_certs_renew_scheduler.conf.md @@ -2,41 +2,36 @@ - ### 概要 - 续订 kubeconfig 文件中嵌入的证书，以供调度管理器使用。 - 续订无条件地进行，与证书的到期日期无关；SAN 等额外属性将基于现有的文件/证书，因此无需重新提供它们。 - -默认情况下，续订会尝试在 kubeadm 管理的本地 PKI 中使用证书颁发机构；作为替代方案，可以使用 K8s 证书 API 进行证书续订；亦或者，作为最后一种选择，生成 CSR 请求。 +默认情况下，续订会尝试使用在 kubeadm 所管理的本地 PKI 中的证书颁发机构；作为替代方案， +也可以使用 K8s 证书 API 进行证书续订；亦或者，作为最后一种选择，生成 CSR 请求。 - 续订后，为了使更改生效，需要重新启动控制平面组件，并最终重新分发更新的证书，以防文件在其他地方使用。 ``` -kubeadm alpha certs renew scheduler.conf [flags] +kubeadm certs renew scheduler.conf [flags] ``` - ### 选项
@@ -124,7 +119,8 @@ scheduler.conf 操作的帮助命令 -与集群通信时使用的 kubeconfig 文件。如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 +与集群通信时使用的 kubeconfig 文件。 +如果未设置该参数，则可以在一组标准位置中搜索现有的 kubeconfig 文件。 @@ -146,7 +142,6 @@ Use the Kubernetes certificate API to renew certificates - ### 从父命令继承的选项
diff --git a/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-alpha.md b/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-alpha.md index 1d8dcad951..26a6b93f18 100644 --- a/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-alpha.md +++ b/content/zh/docs/reference/setup-tools/kubeadm/kubeadm-alpha.md @@ -23,81 +23,6 @@ weight: 90 请尝试一下这些功能并给我们反馈！ {{< /caution >}} -## kubeadm alpha certs {#cmd-certs} - - -Kubernetes 证书的操作集合。 - -{{< tabs name="tab-certs" >}} -{{< tab name="overview" include="generated/kubeadm_alpha_certs.md" />}} -{{< /tabs >}} - -## kubeadm alpha certs renew {#cmd-certs-renew} - - -使用 `all` 子命令来更新所有 Kubernetes 证书或有选择性地更新它们。 -有关证书到期和续订的更多详细信息， -请参见[证书管理文档](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/)。 - -{{< tabs name="tab-certs-renew" >}} -{{< tab name="renew" include="generated/kubeadm_alpha_certs_renew.md" />}} -{{< tab name="all" include="generated/kubeadm_alpha_certs_renew_all.md" />}} -{{< tab name="admin.conf" include="generated/kubeadm_alpha_certs_renew_admin.conf.md" />}} -{{< tab name="apiserver-etcd-client" include="generated/kubeadm_alpha_certs_renew_apiserver-etcd-client.md" />}} -{{< tab name="apiserver-kubelet-client" include="generated/kubeadm_alpha_certs_renew_apiserver-kubelet-client.md" />}} -{{< tab name="apiserver" include="generated/kubeadm_alpha_certs_renew_apiserver.md" />}} -{{< tab name="controller-manager.conf" include="generated/kubeadm_alpha_certs_renew_controller-manager.conf.md" />}} -{{< tab name="etcd-healthcheck-client" include="generated/kubeadm_alpha_certs_renew_etcd-healthcheck-client.md" />}} -{{< tab name="etcd-peer" include="generated/kubeadm_alpha_certs_renew_etcd-peer.md" />}} -{{< tab name="etcd-server" include="generated/kubeadm_alpha_certs_renew_etcd-server.md" />}} -{{< tab name="front-proxy-client" include="generated/kubeadm_alpha_certs_renew_front-proxy-client.md" />}} -{{< tab name="scheduler.conf" include="generated/kubeadm_alpha_certs_renew_scheduler.conf.md" />}} -{{< /tabs >}} - -## kubeadm alpha certs certificate-key {#cmd-certs-certificate-key} - - -该命令可用于生成新的控制平面证书密钥。 -密钥可以作为 `--certificate-key` 参数传递给 `kubeadm init` 和 `kubeadm join` 操作， -以在加入其他控制平面节点时启用证书的自动复制。 - -{{< tabs name="tab-certs-certificate-key" >}} -{{< tab name="certificate-key" include="generated/kubeadm_alpha_certs_certificate-key.md" />}} -{{< /tabs >}} - -## kubeadm alpha certs generate-csr {#cmd-certs-generate-csr} - - -该命令可用于生成证书签名请求（CSR），CSR 可以将其提交给证书颁发机构（CA）进行签名。 - -{{< tabs name="tab-certs-generate-csr" >}} -{{< tab name="certificate-generate-csr" include="generated/kubeadm_alpha_certs_generate-csr.md" />}} -{{< /tabs >}} - -## kubeadm alpha certs check-expiration {#cmd-certs-check-expiration} - - -此命令检查 kubeadm 管理的本地 PKI 中证书的到期时间。 -有关证书到期和续订的更多详细信息，请参见 -[证书管理文档](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/)。 - -{{< tabs name="tab-certs-check-expiration" >}} -{{< tab name="check-expiration" include="generated/kubeadm_alpha_certs_check-expiration.md" />}} -{{< /tabs >}} - ## kubeadm alpha kubeconfig user {#cmd-phase-kubeconfig} +`kubeadm certs` 提供管理证书的工具。关于如何使用这些命令的细节，可参见 +[使用 kubeadm 管理证书](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/)。 + +## kubeadm certs {#cmd-certs} + + +用来操作 Kubernetes 证书的一组命令。 + +{{< tabs name="tab-certs" >}} +{{< tab name="概览" include="generated/kubeadm_certs.md" />}} +{{< /tabs >}} + +## kubeadm certs renew {#cmd-certs-renew} + + +你可以使用 `all` 子命令来续订所有 Kubernetes 证书，也可以选择性地续订部分证书。 +更多的相关细节，可参见 +[手动续订证书](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#manual-certificate-renewal)。 + +{{< tabs name="tab-certs-renew" >}} +{{< tab name="renew" include="generated/kubeadm_certs_renew.md" />}} +{{< tab name="all" include="generated/kubeadm_certs_renew_all.md" />}} +{{< tab name="admin.conf" include="generated/kubeadm_certs_renew_admin.conf.md" />}} +{{< tab name="apiserver-etcd-client" include="generated/kubeadm_certs_renew_apiserver-etcd-client.md" />}} +{{< tab name="apiserver-kubelet-client" include="generated/kubeadm_certs_renew_apiserver-kubelet-client.md" />}} +{{< tab name="apiserver" include="generated/kubeadm_certs_renew_apiserver.md" />}} +{{< tab name="controller-manager.conf" include="generated/kubeadm_certs_renew_controller-manager.conf.md" />}} +{{< tab name="etcd-healthcheck-client" include="generated/kubeadm_certs_renew_etcd-healthcheck-client.md" />}} +{{< tab name="etcd-peer" include="generated/kubeadm_certs_renew_etcd-peer.md" />}} +{{< tab name="etcd-server" include="generated/kubeadm_certs_renew_etcd-server.md" />}} +{{< tab name="front-proxy-client" include="generated/kubeadm_certs_renew_front-proxy-client.md" />}} +{{< tab name="scheduler.conf" include="generated/kubeadm_certs_renew_scheduler.conf.md" />}} +{{< /tabs >}} + +## kubeadm certs certificate-key {#cmd-certs-certificate-key} + + +此命令可用来生成一个新的控制面证书密钥。密钥可以作为 `--certificate-key` +标志的取值传递给 [`kubeadm init`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init) +和 [`kubeadm join`](/zh/docs/reference/setup-tools/kubeadm/kubeadm-join) +命令，从而在添加新的控制面节点时能够自动完成证书复制。 + +{{< tabs name="tab-certs-certificate-key" >}} +{{< tab name="certificate-key" include="generated/kubeadm_certs_certificate-key.md" />}} +{{< /tabs >}} + +## kubeadm certs check-expiration {#cmd-certs-check-expiration} + + +此命令检查 kubeadm 所管理的本地 PKI 中的证书是否以及何时过期。 +更多的相关细节，可参见 +[检查证书过期](/zh/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#check-certificate-expiration)。 + + +{{< tabs name="tab-certs-check-expiration" >}} +{{< tab name="check-expiration" include="generated/kubeadm_certs_check-expiration.md" />}} +{{< /tabs >}} + +## kubeadm certs generate-csr {#cmd-certs-generate-csr} + + +此命令可用来为所有控制面证书和 kubeconfig 文件生成密钥和 CSR（签名请求）。 +用户可以根据自身需要选择 CA 为 CSR 签名。 + +{{< tabs name="tab-certs-generate-csr" >}} +{{< tab name="generate-csr" include="generated/kubeadm_certs_generate-csr.md" />}} +{{< /tabs >}} + +## {{% heading "whatsnext" %}} + + +* 用来启动引导 Kubernetes 控制面节点的 + [kubeadm init](/zh/docs/reference/setup-tools/kubeadm/kubeadm-init/) + 命令 +* 用来将节点连接到集群的 + [kubeadm join](/zh/docs/reference/setup-tools/kubeadm/kubeadm-join/) + 命令 +* 用来回滚 `kubeadm init` 或 `kubeadm join` 对当前主机所做修改的 + [kubeadm reset](/zh/docs/reference/setup-tools/kubeadm/kubeadm-reset/) + 命令 + From 7ad6aeca7b510db4790464997cb5898f4dbb48f1 Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Tue, 15 Dec 2020 09:05:49 +0800 Subject: [PATCH 097/258] Create 2015-04-00-Borg-Predecessor-To-Kubernetes.md (#25526) * Create 2015-04-00-Borg-Predecessor-To-Kubernetes.md * Update 2015-04-00-Borg-Predecessor-To-Kubernetes.md * Update 2015-04-00-Borg-Predecessor-To-Kubernetes.md --- ...15-04-00-Borg-Predecessor-To-Kubernetes.md | 119 ++++++++++++++++++ 1 file changed, 119 insertions(+) create mode 100644 content/zh/blog/_posts/2015-04-00-Borg-Predecessor-To-Kubernetes.md diff --git a/content/zh/blog/_posts/2015-04-00-Borg-Predecessor-To-Kubernetes.md b/content/zh/blog/_posts/2015-04-00-Borg-Predecessor-To-Kubernetes.md new file mode 100644 index 0000000000..5b8f06a76e --- /dev/null +++ b/content/zh/blog/_posts/2015-04-00-Borg-Predecessor-To-Kubernetes.md @@ -0,0 +1,119 @@ +--- +title: "Borg: Kubernetes 的前身" +date: 2015-04-23 +slug: borg-predecessor-to-kubernetes +url: /zh/blog/2015/04/Borg-Predecessor-To-Kubernetes +--- + + +十多年来，谷歌一直在生产中运行容器化工作负载。 +无论是像网络前端和有状态服务器之类的工作，像 [Bigtable](http://research.google.com/archive/bigtable.html) 和 +[Spanner](http://research.google.com/archive/spanner.html)一样的基础架构系统，或是像 +[MapReduce](http://research.google.com/archive/mapreduce.html) 和 [Millwheel](http://research.google.com/pubs/pub41378.html)一样的批处理框架， +Google 的几乎一切都是以容器的方式运行的。今天，我们揭开了 Borg 的面纱，Google 传闻已久的面向容器的内部集群管理系统，并在学术计算机系统会议 [Eurosys](http://eurosys2015.labri.fr/) 上发布了详细信息。你可以在 [此处](https://research.google.com/pubs/pub43438.html) 找到论文。 + + + +Kubernetes 直接继承自 Borg。 +在 Google 的很多从事 Kubernetes 的开发人员以前都是 Borg 项目的开发人员。 +我们在 Kubernetes 中结合了 Borg 的最佳创意，并试图解决用户多年来在 Borg 中发现的一些痛点。 + + +Kubernetes 中的以下四个功能特性源于我们从 Borg 获得的经验： + + +1) [Pods](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/pods.md). +Pod 是 Kubernetes 中调度的单位。 +它是一个或多个容器在其中运行的资源封装。 +保证属于同一 Pod 的容器可以一起调度到同一台计算机上，并且可以通过本地卷共享状态。 + + +Borg 有一个类似的抽象，称为 alloc（“资源分配”的缩写）。 +Borg 中 alloc 的常见用法包括运行 Web 服务器，该服务器生成日志，一起部署一个轻量级日志收集进程， +该进程将日志发送到集群文件系统（和 fluentd 或 logstash 没什么不同 ）； +运行 Web 服务器，该 Web 服务器从磁盘目录提供数据， +该磁盘目录由从集群文件系统读取数据并为 Web 服务器准备/暂存的进程填充（与内容管理系统没什么不同）； +并与存储分片一起运行用户定义的处理功能。 + +Pod 不仅支持这些用例，而且还提供类似于在单个 VM 中运行多个进程的环境 -- Kubernetes 用户可以在 Pod 中部署多个位于同一地点的协作过程，而不必放弃一个应用程序一个容器的部署模型。 + + + + +2) [服务](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/services.md)。 +尽管 Borg 的主要角色是管理任务和计算机的生命周期，但是在 Borg 上运行的应用程序还可以从许多其它集群服务中受益，包括命名和负载均衡。 +Kubernetes 使用服务抽象支持命名和负载均衡：带名字的服务，会映射到由标签选择器定义的一组动态 Pod 集（请参阅下一节）。 +集群中的任何容器都可以使用服务名称链接到服务。 + +在幕后，Kubernetes 会自动在与标签选择器匹配到 Pod 之间对与服务的连接进行负载均衡，并跟踪 Pod 在哪里运行，由于故障，它们会随着时间的推移而重新安排。 + + + + +3) [标签](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/labels.md)。 +Borg 中的容器通常是一组相同或几乎相同的容器中的一个副本，该容器对应于 Internet 服务的一层（例如 Google Maps 的前端）或批处理作业的工人（例如 MapReduce）。 +该集合称为 Job ，每个副本称为任务。 +尽管 Job 是一个非常有用的抽象，但它可能是有限的。 +例如，用户经常希望将其整个服务（由许多 Job 组成）作为一个实体进行管理，或者统一管理其服务的几个相关实例，例如单独的 Canary 和稳定的发行版。 +另一方面，用户经常希望推理和控制 Job 中的任务子集 --最常见的示例是在滚动更新期间，此时作业的不同子集需要具有不同的配置。 + + + +通过使用标签组织 Pod ，Kubernetes 比 Borg 支持更灵活的集合，标签是用户附加到 Pod（实际上是系统中的任何对象）的任意键/值对。 +用户可以通过在其 Pod 上使用 “job:\” 标签来创建与 Borg Jobs 等效的分组，但是他们还可以使用其他标签来标记服务名称，服务实例（生产，登台，测试）以及一般而言，其 pod 的任何子集。 +标签查询（称为“标签选择器”）用于选择操作应用于哪一组 Pod 。 +结合起来，标签和[复制控制器](https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/replication-controller.md) 允许非常灵活的更新语义，以及跨等效项的操作 Borg Jobs。 + + + + +4) 每个 Pod 一个 IP。在 Borg 中，计算机上的所有任务都使用该主机的 IP 地址，从而共享主机的端口空间。 +虽然这意味着 Borg 可以使用普通网络，但是它给基础结构和应用程序开发人员带来了许多负担：Borg 必须将端口作为资源进行调度；任务必须预先声明它们需要多少个端口，并将要使用的端口作为启动参数；Borglet（节点代理）必须强制端口隔离；命名和 RPC 系统必须处理端口以及 IP 地址。 + + + +多亏了软件定义的覆盖网络，例如 [flannel](https://coreos.com/blog/introducing-rudder/) 或内置于[公有云](https://cloud.google.com/compute/docs/networking)网络的出现，Kubernetes 能够为每个 Pod 提供服务并为其提供自己的 IP 地址。 +这消除了管理端口的基础架构的复杂性，并允许开发人员选择他们想要的任何端口，而不需要其软件适应基础架构选择的端口。 +后一点对于使现成的易于运行 Kubernetes 上的开源应用程序至关重要 -- 可以将 Pod 视为 VMs 或物理主机，可以访问整个端口空间，他们可能与其他 Pod 共享同一台物理计算机，这一事实已被忽略。 + + + +随着基于容器的微服务架构的日益普及，Google 从内部运行此类系统所汲取的经验教训已引起外部 DevOps 社区越来越多的兴趣。 +通过揭示集群管理器 Borg 的一些内部工作原理，并将下一代集群管理器构建为一个开源项目（Kubernetes）和一个公开可用的托管服务（[Google Container Engine]（http://cloud.google.com/container-engine)) ，我们希望这些课程可以使 Google 之外的广大社区受益，并推动容器调度和集群管理方面的最新技术发展。 + + From bf30950d98c05087ee63f166a8c97e7fc0319092 Mon Sep 17 00:00:00 2001 From: jiajie Date: Tue, 15 Dec 2020 10:31:45 +0800 Subject: [PATCH 098/258] Update _index.html update respective section to match en master branch --- content/zh/training/_index.html | 47 +++++++++++++++++++++------------ 1 file changed, 30 insertions(+), 17 deletions(-) diff --git a/content/zh/training/_index.html b/content/zh/training/_index.html index b70f1c9cb3..15ec4b0556 100644 --- a/content/zh/training/_index.html +++ b/content/zh/training/_index.html @@ -6,7 +6,6 @@ layout: basic cid: training class: training --- - -

打造你的云原生职业

+

打造你的云原生职业生涯

Kubernetes 是云原生运动的核心。来自 Linux 基金会和我们培训合作伙伴的培训、认证让您可以投资您的职业生涯，学习 Kubernetes，并使您的云原生项目获得成功。

+
+ +
+
+ +
+
+ +
@@ -98,38 +100,49 @@ class: training -
+
-
- -

获取 Kubernetes 认证

-
+ +

获取 Kubernetes 认证

-
Certified Kubernetes Application Developer (CKAD)

CKAD 考试证明用户可以为 Kubernetes 设计、构建、配置和发布云原生应用。

+ +

通过 CKAD 认证的人员能够在 Kubernetes 中定义软件资源并且使用核心组件来搭建、监控、检查可伸缩应用


前往认证 -
-
Certified Kubernetes Administrator (CKA)

CKA 认证确保 CKA 认证人员具有履行 Kubernetes 管理员职责的技能、知识和能力。

+ +

通过认证的 Kubernetes 管理员展示了包括基础安装和配置、管理产品级别的 Kubernetes 集群方面的能力。


前往认证 -
+
+
+
+ + Kubernetes 认证安全专家 (CKS) +
+ +

Kubernetes 认证安全专家项目确保证书持有人员容易胜任各种最佳实践。CKS 认证包括在构建、部署和运行时确保基于容器的应用程序和 Kubernetes 平台安全的技能。

+ +

参加 CKS 的候选人必须持有现行的 Kubernetes 认证管理员（CKA）证书，以证明他们具有足够的 Kubernetes 专业知识。

+
+ + 前往认证
From 09c5eed5ebbfbcfad1ce3e5ce67a59c821370f6c Mon Sep 17 00:00:00 2001 From: xin Date: Tue, 15 Dec 2020 11:34:10 +0800 Subject: [PATCH 099/258] sync with english version. --- .../access-authn-authz/authentication.md | 76 +++++++++++++++++++ 1 file changed, 76 insertions(+) diff --git a/content/zh/docs/reference/access-authn-authz/authentication.md b/content/zh/docs/reference/access-authn-authz/authentication.md index b54ca2f148..d72e8e9d2b 100644 --- a/content/zh/docs/reference/access-authn-authz/authentication.md +++ b/content/zh/docs/reference/access-authn-authz/authentication.md @@ -1387,11 +1387,35 @@ users: args: - "arg1" - "arg2" + + # Text shown to the user when the executable doesn't seem to be present. Optional. + installHint: | + example-client-go-exec-plugin is required to authenticate + to the current cluster. It can be installed: + + On macOS: brew install example-client-go-exec-plugin + + On Ubuntu: apt-get install example-client-go-exec-plugin + + On Fedora: dnf install example-client-go-exec-plugin + + ... + + # Whether or not to provide cluster information, which could potentially contain + # very large CA data, to this exec plugin as a part of the KUBERNETES_EXEC_INFO + # environment variable. + provideClusterInfo: true clusters: - name: my-cluster cluster: server: "https://172.17.4.100:6443" certificate-authority: "/etc/kubernetes/ca.pem" + extensions: + - name: client.authentication.k8s.io/exec # reserved extension name for per cluster exec config + extension: + arbitrary: config + this: can be provided via the KUBERNETES_EXEC_INFO environment variable upon setting provideClusterInfo + you: ["can", "put", "anything", "here"] contexts: - name: my-cluster context: @@ -1427,11 +1451,32 @@ users: args: - "arg1" - "arg2" + + # 当可执行文件不存在时显示给用户的文本。可选的。 + installHint: | + 需要example-client-go-exec-plugin来验证当前集群。可以通过以下命令安装： + + MacOS: brew install example-client-go-exec-plugin + + Ubuntu: apt-get install example-client-go-exec-plugin + + Fedora: dnf install example-client-go-exec-plugin + + ... + + # 是否向这个 exec 插件提供集群信息(可能包含非常大的CA数据)，作为KUBERNETES_EXEC_INFO环境变量的一部分。 + provideClusterInfo: true clusters: - name: my-cluster cluster: server: "https://172.17.4.100:6443" certificate-authority: "/etc/kubernetes/ca.pem" + extensions: + - name: client.authentication.k8s.io/exec # 为每个集群 exec 配置保留的扩展名 + extension: + arbitrary: config + this: can be provided via the KUBERNETES_EXEC_INFO environment variable upon setting provideClusterInfo + you: ["can", "put", "anything", "here"] contexts: - name: my-cluster context: @@ -1551,3 +1596,34 @@ RFC3339 timestamp. Presence or absence of an expiry has the following impact: } } ``` + + + +该插件可以选择使用环境变量`KUBERNETES_EXEC_INFO`进行调用， +该变量包含了此插件获取凭据的集群信息。此信息可用于执行群集特定的凭据获取逻辑。为了启用此行为，必须在 [kubeconfig](/zh/docs/concepts/configuration/organize-cluster-access-kubeconfig/)中的 exec 用户字段上设置`provideClusterInfo`字段。下面是上述`KUBERNETES_EXEC_INFO`环境变量的示例。 + +```json +{ + "apiVersion": "client.authentication.k8s.io/v1beta1", + "kind": "ExecCredential", + "spec": { + "cluster": { + "server": "https://172.17.4.100:6443", + "certificate-authority-data": "LS0t...", + "config": { + "arbitrary": "config", + "this": "can be provided via the KUBERNETES_EXEC_INFO environment variable upon setting provideClusterInfo", + "you": ["can", "put", "anything", "here"] + } + } + } +} +``` \ No newline at end of file From 2a92b2996de9ec4babcdb004ffd997a60498f164 Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Tue, 15 Dec 2020 12:36:12 +0800 Subject: [PATCH 100/258] Create 2016-05-00-Coreosfest2016-Kubernetes-Community.md --- ...-00-Coreosfest2016-Kubernetes-Community.md | 100 ++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 content/zh/blog/_posts/2016-05-00-Coreosfest2016-Kubernetes-Community.md diff --git a/content/zh/blog/_posts/2016-05-00-Coreosfest2016-Kubernetes-Community.md b/content/zh/blog/_posts/2016-05-00-Coreosfest2016-Kubernetes-Community.md new file mode 100644 index 0000000000..a93d96adc8 --- /dev/null +++ b/content/zh/blog/_posts/2016-05-00-Coreosfest2016-Kubernetes-Community.md @@ -0,0 +1,100 @@ +--- +title: " CoreOS Fest 2016: CoreOS 和 Kubernetes 在柏林（和旧金山）社区见面会 " +date: 2016-05-03 +slug: coreosfest2016-kubernetes-community +url: /blog/2016/05/Coreosfest2016-Kubernetes-Community +--- + + +[CoreOS Fest 2016](https://coreos.com/fest/) 将汇集容器和开源分布式系统社区，其中包括 Kubernetes 领域的许多思想领袖。 +这是第二次年度 CoreOS 社区会议，于5月9日至10日在柏林首次举行。 +CoreOS 相信 Kubernetes 是提供 GIFEE（适用于所有人的 Google 的基础架构）的容器编排组件。 + + +在今年的 CoreOS Fest 上，有专门针对 Kubernetes 的报道，您将听到有关 Kubernetes 性能和可伸缩性，持续交付以及 Kubernetes，rktnetes，stackanetes 等各种主题的信息。 +此外，从入门讲习班到深入探讨万物容器和相关软件，这里将有各种各样的讲座。 + + +不要错过**柏林**会议上的精彩演讲： + + +- [深入了解 Kubernetes 的性能和可扩展性](https://coreosfest2016.sched.org/event/6ckp/kubernetes-performance-scalability-deep-dive?iframe=no&w=i:100;&sidebar=yes&bg=no) 由 Google 的高级软件工程师 Filip Grzadkowski 演讲 +- [在 Kubernetes 云中启动一个复杂的应用程序](http://coreosfest2016.sched.org/event/6T0b/launching-a-complex-application-in-a-kubernetes-cloud) 由 immmr Gmbh（德国电信研发部门开发的服务）的运营和基础架构负责人Thomas Fricke 和 Jannis Rake-Revelant 演讲 +- [我有 Kubernetes，现在呢？](https://coreosfest2016.sched.org/event/6db3/i-have-kubernetes-now-what?iframe=no&w=i:100;&sidebar=yes&bg=no) 由 Engine Yard 的 CTO 和 Deis 的创建者 Gabriel Monroy 演讲 +- [当 rkt 与 Kubernetes 碰面时 ：一个故障排除的故事](https://coreosfest2016.sched.org/event/6YGg/when-rkt-meets-kubernetes-a-troubleshooting-tale?iframe=no&w=i:100;&sidebar=yes&bg=no) 由 Sysdig 的软件工程师 Luca Marturana 演讲 +- [使用 Kubernetes 部署电信应用程序](https://coreosfest2016.sched.org/event/6eSE/use-kubernetes-to-deploy-telecom-applications?iframe=no&w=i:100;&sidebar=yes&bg=no) 由华为技术有限公司高级工程师 Victor Hu 演讲 +- [连续交付，Kubernetes 和您](https://coreosfest2016.sched.org/event/6qCs/continuous-delivery-kubernetes-and-you?iframe=no&w=i:100;&sidebar=yes&bg=no) 由 Wercker首席执行官兼创始人 Micha Hernandez van Leuffen 演讲 +- [#GIFEE，更多容器，更多问题](https://coreosfest2016.sched.org/event/6YJl/gifee-more-containers-more-problems?iframe=no&w=i:100;&sidebar=yes&bg=no) 由 CoreOS 构造负责人 Ed Rooth 演讲 +- [带有 dex 的 Kubernetes 访问控制](https://coreosfest2016.sched.org/event/6YH4/kubernetes-access-control-with-dex?iframe=no&w=i:100;&sidebar=yes&bg=no) 由 CoreOS 的软件工程师 Eric Chiang 演讲 + + +如果您无法到达柏林，Kubernetes 还是** CoreOS Fest [旧金山](https://www.eventbrite.com/e/coreos-fest-san-francisco-satellite-event-tickets-22705108591) ** [**卫星事件**](https://www.eventbrite.com/e/coreos-fest-san-francisco-satellite-event-tickets-22705108591) 的焦点，这是一个专门针对 CoreOS 和 Kubernetes 的一日活动。 +实际上， Google 的高级工程师， Kubernetes 的创建者之一 Tim Hockin 将以专门介绍 Kubernetes 更新的主题演讲拉开序幕。 + + +专门针对 Kubernetes 的**旧金山**会议包括： + + +- Tim Hockin的主题演讲，Google 高级工程师 +- 当 rkt 与 Kubernetes 相遇时：Sysdig 首席执行官 Loris Degioanni 的故障排除故事 +- rktnetes: CoreOS的软件工程师Derek Gonyeo提供了容器运行时和 Kubernetes 的新功能 +- 神奇的安全性蔓延：CoreOS 和 Kubernetes 上的安全，弹性微服务，浮力技术总监 Oliver Gould + + +** SF 的 Kubernetes 研讨会**：[Kubernetes 入门](https://www.eventbrite.com/e/getting-started-with-kubernetes-tickets-25180552711)， +Google 开发人员计划工程师 Carter Morgan 和 Bill Prin 于5月10日（星期二）上午9:00至1:00 pm在 Google 旧金山办公室（Spear 街345号第7层）举办会议，之后将提供午餐。 +席位有限，请 [此处免费提供 RSVP](https://www.eventbrite.com/e/getting-started-with-kubernetes-tickets-25180552711) 。 + + +**获取门票** : + + +- [CoreOS Fest - 柏林](https://ti.to/coreos/coreos-fest-2016/en), 位于 [柏林会议中心](https://www.google.com/maps/place/bcc+Berlin+Congress+Center+GmbH/@52.5206732,13.4165195,15z/data=!4m2!3m1!1s0x0:0xd2a15220241f2080) ([酒店选项](http://www.parkinn-berlin.de/)) +- 卫星事件在 [旧金山](https://www.eventbrite.com/e/coreos-fest-san-francisco-satellite-event-tickets-22705108591), 在 [111 米娜美术馆](https://www.google.com/maps/place/111+Minna+Gallery/@37.7873222,-122.3994124,15z/data=!4m2!3m1!1s0x0:0xb55875af8c0ca88b?sa=X&ved=0ahUKEwjZ8cPLtL7MAhVQ5GMKHa8bCM4Q_BIIdjAN) + + +要了解更多信息，请访问： [coreos.com/fest/](https://coreos.com/fest/)  和 Twitter [@CoreOSFest](https://twitter.com/coreosfest) #CoreOSFest + + +_-- Sarah Novotny, Kubernetes 社区管理者_ From 24c81746c6b93c4f84dd015093df919e28456932 Mon Sep 17 00:00:00 2001 From: "M. Habib Rosyad" Date: Tue, 15 Dec 2020 11:50:09 +0700 Subject: [PATCH 101/258] Add habibrosyad as sig-docs-id reviewer --- OWNERS_ALIASES | 1 + 1 file changed, 1 insertion(+) diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES index eea832a762..3d1ae50afa 100644 --- a/OWNERS_ALIASES +++ b/OWNERS_ALIASES @@ -98,6 +98,7 @@ aliases: - irvifa sig-docs-id-reviews: # PR reviews for Indonesian content - girikuncoro + - habibrosyad - irvifa - wahyuoi - phanama From 9724600e732311e279f414904a474b53a8b09499 Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Tue, 15 Dec 2020 13:58:44 +0800 Subject: [PATCH 102/258] Update 2016-05-00-Coreosfest2016-Kubernetes-Community.md --- .../_posts/2016-05-00-Coreosfest2016-Kubernetes-Community.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/blog/_posts/2016-05-00-Coreosfest2016-Kubernetes-Community.md b/content/zh/blog/_posts/2016-05-00-Coreosfest2016-Kubernetes-Community.md index a93d96adc8..891ac55431 100644 --- a/content/zh/blog/_posts/2016-05-00-Coreosfest2016-Kubernetes-Community.md +++ b/content/zh/blog/_posts/2016-05-00-Coreosfest2016-Kubernetes-Community.md @@ -17,13 +17,13 @@ url: /blog/2016/05/Coreosfest2016-Kubernetes-Community --> [CoreOS Fest 2016](https://coreos.com/fest/) 将汇集容器和开源分布式系统社区，其中包括 Kubernetes 领域的许多思想领袖。 这是第二次年度 CoreOS 社区会议，于5月9日至10日在柏林首次举行。 -CoreOS 相信 Kubernetes 是提供 GIFEE（适用于所有人的 Google 的基础架构）的容器编排组件。 +CoreOS 相信 Kubernetes 是提供 GIFEE（适用于所有人的 Google 的基础架构）服务的合适的容器编排组件。 在今年的 CoreOS Fest 上，有专门针对 Kubernetes 的报道，您将听到有关 Kubernetes 性能和可伸缩性，持续交付以及 Kubernetes，rktnetes，stackanetes 等各种主题的信息。 -此外，从入门讲习班到深入探讨万物容器和相关软件，这里将有各种各样的讲座。 +此外，这里将有各种各样的讲座，涵盖从入门讲习班到深入探讨容器和相关软件的方方面面。 From dfea17333265914887371563967d3f4f31738561 Mon Sep 17 00:00:00 2001 From: xin Date: Tue, 15 Dec 2020 14:03:23 +0800 Subject: [PATCH 103/258] Apply suggestions from code review Co-authored-by: Qiming Teng --- .../access-authn-authz/authentication.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/content/zh/docs/reference/access-authn-authz/authentication.md b/content/zh/docs/reference/access-authn-authz/authentication.md index d72e8e9d2b..bd3aa07909 100644 --- a/content/zh/docs/reference/access-authn-authz/authentication.md +++ b/content/zh/docs/reference/access-authn-authz/authentication.md @@ -1454,7 +1454,7 @@ users: # 当可执行文件不存在时显示给用户的文本。可选的。 installHint: | - 需要example-client-go-exec-plugin来验证当前集群。可以通过以下命令安装： + 需要 example-client-go-exec-plugin 来在当前集群上执行身份认证。可以通过以下命令安装： MacOS: brew install example-client-go-exec-plugin @@ -1464,7 +1464,8 @@ users: ... - # 是否向这个 exec 插件提供集群信息(可能包含非常大的CA数据)，作为KUBERNETES_EXEC_INFO环境变量的一部分。 + # 是否使用 KUBERNETES_EXEC_INFO 环境变量的一部分向这个 exec 插件 + # 提供集群信息（可能包含非常大的 CA 数据） provideClusterInfo: true clusters: - name: my-cluster @@ -1475,7 +1476,7 @@ clusters: - name: client.authentication.k8s.io/exec # 为每个集群 exec 配置保留的扩展名 extension: arbitrary: config - this: can be provided via the KUBERNETES_EXEC_INFO environment variable upon setting provideClusterInfo + this: 在设置 provideClusterInfo 时可通过环境变量 KUBERNETES_EXEC_INFO 指定 you: ["can", "put", "anything", "here"] contexts: - name: my-cluster @@ -1607,8 +1608,11 @@ be set on the exec user field in the example of the aforementioned `KUBERNETES_EXEC_INFO` environment variable. --> -该插件可以选择使用环境变量`KUBERNETES_EXEC_INFO`进行调用， -该变量包含了此插件获取凭据的集群信息。此信息可用于执行群集特定的凭据获取逻辑。为了启用此行为，必须在 [kubeconfig](/zh/docs/concepts/configuration/organize-cluster-access-kubeconfig/)中的 exec 用户字段上设置`provideClusterInfo`字段。下面是上述`KUBERNETES_EXEC_INFO`环境变量的示例。 +调用此插件时可以选择性地设置环境变量 `KUBERNETES_EXEC_INFO`。 +该变量包含了此插件获取凭据所针对的集群信息。此信息可用于执行群集特定的凭据获取逻辑。 +为了启用此行为，必须在 [kubeconfig](/zh/docs/concepts/configuration/organize-cluster-access-kubeconfig/) +中的 exec user 字段上设置`provideClusterInfo`字段。 +下面是上述 `KUBERNETES_EXEC_INFO` 环境变量的示例。 ```json { @@ -1620,10 +1624,10 @@ example of the aforementioned `KUBERNETES_EXEC_INFO` environment variable. "certificate-authority-data": "LS0t...", "config": { "arbitrary": "config", - "this": "can be provided via the KUBERNETES_EXEC_INFO environment variable upon setting provideClusterInfo", + "this": "在设置 provideClusterInfo 时可通过环境变量 KUBERNETES_EXEC_INFO 指定", "you": ["can", "put", "anything", "here"] } } } } -``` \ No newline at end of file +``` From 04986e71095cd6da1d1c1f5d7f58cf1afbf88ab0 Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Tue, 15 Dec 2020 11:12:21 +0800 Subject: [PATCH 104/258] Update access-cluster.md sync with english version. Apply suggestions from code review Co-authored-by: Qiming Teng --- .../tasks/access-application-cluster/access-cluster.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/content/zh/docs/tasks/access-application-cluster/access-cluster.md b/content/zh/docs/tasks/access-application-cluster/access-cluster.md index 626b9f8422..be848efce8 100644 --- a/content/zh/docs/tasks/access-application-cluster/access-cluster.md +++ b/content/zh/docs/tasks/access-application-cluster/access-cluster.md @@ -469,7 +469,7 @@ This shows the proxy-verb URL for accessing each service. For example, this cluster has cluster-level logging enabled (using Elasticsearch), which can be reached at `https://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/` if suitable credentials are passed. Logging can also be reached through a kubectl proxy, for example at: `http://localhost:8080/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/`. -(See [above](#accessing-the-cluster-api) for how to pass credentials or use kubectl proxy.) +(See [Access Clusters Using the Kubernetes API](/docs/tasks/administer-cluster/access-cluster-api/) for how to pass credentials or use kubectl proxy.) --> 这展示了访问每个服务的 proxy-verb URL。 例如，如果集群启动了集群级别的日志（使用 Elasticsearch），并且传递合适的凭证， @@ -477,8 +477,8 @@ at `https://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-l `https://104.197.5.247/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/` 进行访问。日志也能通过 kubectl 代理获取，例如： `http://localhost:8080/api/v1/namespaces/kube-system/services/elasticsearch-logging/proxy/`。 -（参阅 [上面的内容](#accessing-the-cluster-api) 来获取如何使用 kubectl 代理来传递凭证） - +（参阅[使用 Kubernetes API 访问集群](/zh/docs/tasks/administer-cluster/access-cluster-api/) +了解如何传递凭据，或者使用 kubectl proxy） + +_编者注： 本周我们将推出 [Kubernetes 特殊兴趣小组](https://github.com/kubernetes/kubernetes/wiki/Special-Interest-Groups-(SIGs))；今天的帖子由 SIG-ClusterOps 团队负责，其任务是促进 Kubernetes 集群的可操作性和互操作性 -- 倾听，帮助和升级。_ + + +我们认为 Kubernetes 是大规模运行应用程序的绝佳方法！ +不幸的是，存在一个引导问题：我们需要良好的方法来围绕 Kubernetes 构建安全可靠的扩展环境。 +虽然平台管理的某些部分利用了平台（很酷！），这有一些基本的操作主题需要解决，还有一些问题（例如升级和一致性）需要回答。 + + +**输入 Cluster Ops SIG – 在平台下工作以保持其运行的社区成员。** + + +我们对 Cluster Ops 的目标是首先成为一个人对人的社区，其次才是意见、文档、测试和脚本的来源。 +这意味着我们将花费大量时间和精力来简单地比较有关工作内容的注释并讨论实际操作。 +这些互动为我们提供了形成意见的数据。 +这也意味着我们可以利用实际经验来为项目提供信息。 + + +我们旨在成为对该项目进行运营审查和反馈的论坛。 +为了使 Kubernetes 取得成功，运营商需要通过每周参与并收集调查数据在项目中拥有重要的声音。 +我们并不是想对操作发表意见，但我们确实想创建一个协调的资源来收集项目的运营反馈。 +作为一个公认的团体，操作员更容易获得影响力。 + + +**现实世界中的可交付成果如何？** + + +我们也有切实成果的计划。 +我们已经在努力实现具体的交付成果，例如参考架构，工具目录，社区部署说明和一致性测试。 +Cluster Ops 希望成为运营资源的交换所。 +我们将根据实际经验和经过战斗测试的部署来进行此操作。 + + +**联系我们。** + + +集群运营可能会很辛苦–别一个人做。 +我们在这里倾听，在我们可以帮助的时候提供帮助，而在我们不能帮助的时候升级。 +在以下位置加入对话： + + +- 在 [Cluster Ops Slack 频道](https://kubernetes.slack.com/messages/sig-cluster-ops/) 与我们聊天 +- 通过 [Cluster Ops SIG 电子邮件列表](https://groups.google.com/forum/#!forum/kubernetes-sig-cluster-ops) 给我们发送电子邮件 + + +行动专家特别兴趣小组每周四在太平洋标准时间下午13:00开会，您可以通过 [视频环聊](https://plus.google.com/hangouts/_/google.com/sig-cluster-ops) 加入我们 并查看最新的 [会议记录](https://docs.google.com/document/d/1IhN5v6MjcAUrvLd9dAWtKcGWBWSaRU8DNyPiof3gYMY/edit) 了解所涉及的议程和主题。 + + +_-- RackN 首席执行官 Rob Hirschfeld_ From 669e789eaca9fe8935d1517dcc1f47ffbdc15a5c Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Tue, 15 Dec 2020 17:19:45 +0800 Subject: [PATCH 107/258] Update automated-tasks-with-cron-jobs.md sync with english version. --- content/zh/docs/tasks/job/automated-tasks-with-cron-jobs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/job/automated-tasks-with-cron-jobs.md b/content/zh/docs/tasks/job/automated-tasks-with-cron-jobs.md index fdf54115bf..4d1379a661 100644 --- a/content/zh/docs/tasks/job/automated-tasks-with-cron-jobs.md +++ b/content/zh/docs/tasks/job/automated-tasks-with-cron-jobs.md @@ -76,7 +76,7 @@ Run the example cron job by downloading the example file and then running this c 想要运行示例的 CronJob，可以下载示例文件并执行命令： ```shell -kubectl create -f ./cronjob.yaml +kubectl create -f https://k8s.io/examples/application/job/cronjob.yaml ``` ``` cronjob.batch/hello created From 18645a2799eaacc31b3446c15fdf0e3c7316a271 Mon Sep 17 00:00:00 2001 From: Gasmi Christophe Date: Tue, 15 Dec 2020 10:35:29 +0100 Subject: [PATCH 108/258] Update content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rémy Léone --- .../production-environment/tools/kubeadm/install-kubeadm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index 3783b264c4..00f8e22f5e 100644 --- a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -126,7 +126,7 @@ Le tableau suivant répertorie les environnements d'exécution des conteneurs et
Si Docker et containerd sont détectés, Docker est prioritaire. C'est nécessaire car Docker 18.09 est livré avec containerd et les deux sont détectables même si vous -installé Docker. +installez Docker. Si deux autres environnements d'exécution ou plus sont détectés, kubeadm se ferme avec une erreur. Le kubelet s'intègre à Docker via l'implémentation CRI intégrée de `dockershim`. From 181e87818e419544d84726a5a40705022aa86afa Mon Sep 17 00:00:00 2001 From: Gasmi Christophe Date: Tue, 15 Dec 2020 10:35:47 +0100 Subject: [PATCH 109/258] Update content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rémy Léone --- .../production-environment/tools/kubeadm/install-kubeadm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index 00f8e22f5e..224fb4a066 100644 --- a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -160,7 +160,7 @@ Vous devez vous assurer qu'ils correspondent à la version du control plane de K erreur de version se produise, qui pourrait conduire à un comportement inattendu. Cependant, une version mineure entre les kubelets et le control plane est pris en charge, mais la version de la kubelet ne doit jamais dépasser la version de l'API server. -Par exemple, les kubelets exécutant la version 1.7.0 devraient être entièrement compatiblesavec un API server en 1.8.0, +Par exemple, les kubelets exécutant la version 1.7.0 devraient être entièrement compatibles avec un API server en 1.8.0, mais pas l'inverse. For information about installing `kubectl`, see [Install and set up kubectl](/fr/docs/tasks/tools/install-kubectl/). From 3d06157c5f0de75e5c29d19608df19d150b6843c Mon Sep 17 00:00:00 2001 From: Gasmi Christophe Date: Tue, 15 Dec 2020 10:36:02 +0100 Subject: [PATCH 110/258] Update content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rémy Léone --- .../production-environment/tools/kubeadm/install-kubeadm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index 224fb4a066..623cc5efff 100644 --- a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -163,7 +163,7 @@ mais la version de la kubelet ne doit jamais dépasser la version de l'API serve Par exemple, les kubelets exécutant la version 1.7.0 devraient être entièrement compatibles avec un API server en 1.8.0, mais pas l'inverse. -For information about installing `kubectl`, see [Install and set up kubectl](/fr/docs/tasks/tools/install-kubectl/). +For information about installing `kubectl`, see [Installation et configuration kubectl](/fr/docs/tasks/tools/install-kubectl/). {{< warning >}} Ces instructions excluent tous les packages Kubernetes de toutes les mises à niveau du système d'exploitation. From 2fee5a9219a0cfaaaba7119c0f37a4ab1151faa0 Mon Sep 17 00:00:00 2001 From: Gasmi Christophe Date: Tue, 15 Dec 2020 10:36:26 +0100 Subject: [PATCH 111/258] Update content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rémy Léone --- .../production-environment/tools/kubeadm/install-kubeadm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index 623cc5efff..aa463cdd55 100644 --- a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -215,7 +215,7 @@ sudo systemctl enable --now kubelet - Mettre SELinux en mode permissif en lançant `setenforce 0` et `sed ... `le désactive efficacement. C'est nécessaire pour permettre aux conteneurs d'accéder au système de fichiers hôte, qui est nécessaire par exemple pour les réseaux de pod. - Vous devez le faire jusqu'à ce que le support de SELinux soit amélioré dans la kubelet. + Vous devez le faire jusqu'à ce que le support de SELinux soit amélioré dans Kubelet. - Vous pouvez laisser SELinux activé si vous savez comment le configurer, mais il peut nécessiter des paramètres qui ne sont pas pris en charge par kubeadm. From 352c891c2a8c8ca6d4c1b5749df509fff8583a8d Mon Sep 17 00:00:00 2001 From: Gasmi Christophe Date: Tue, 15 Dec 2020 10:36:45 +0100 Subject: [PATCH 112/258] Update content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rémy Léone --- .../production-environment/tools/kubeadm/install-kubeadm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index aa463cdd55..d8f9cabe66 100644 --- a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -241,7 +241,7 @@ DOWNLOAD_DIR=/usr/local/bin sudo mkdir -p $DOWNLOAD_DIR ``` -Installer crictl (requis pour Kubeadm / Kubelet Container Runtime Interface (CRI)) +Installez crictl (requis pour Kubeadm / Kubelet Container Runtime Interface (CRI)) ```bash CRICTL_VERSION="v1.17.0" From 36f99d7183fc182809ab8aa69998d03343a04306 Mon Sep 17 00:00:00 2001 From: Gasmi Christophe Date: Tue, 15 Dec 2020 10:36:59 +0100 Subject: [PATCH 113/258] Update content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rémy Léone --- .../production-environment/tools/kubeadm/install-kubeadm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index d8f9cabe66..ea73e5b558 100644 --- a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -277,7 +277,7 @@ Consultez le [Guide de dépannage de Kubeadm](/docs/setup/production-environment {{< /tabs >}} -Le kubelet redémarre maintenant toutes les quelques secondes, +Kubelet redémarre maintenant toutes les quelques secondes, car il attend dans une boucle de crash que kubeadm lui dise quoi faire. ## Configurer le driver de cgroup utilisé par la kubelet sur un nœud master From ff84d4b11c916852659e4b6c2807f1fa1a4361d4 Mon Sep 17 00:00:00 2001 From: Gasmi Christophe Date: Tue, 15 Dec 2020 10:38:51 +0100 Subject: [PATCH 114/258] Update content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rémy Léone --- .../production-environment/tools/kubeadm/install-kubeadm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index ea73e5b558..927e3453d4 100644 --- a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -278,7 +278,7 @@ Consultez le [Guide de dépannage de Kubeadm](/docs/setup/production-environment Kubelet redémarre maintenant toutes les quelques secondes, -car il attend dans une boucle de crash que kubeadm lui dise quoi faire. +car il attend les instructions de kubeadm dans une boucle de crash. ## Configurer le driver de cgroup utilisé par la kubelet sur un nœud master From bfc04bda01f8cd45c94cb0e4d7c0ba11a8996daf Mon Sep 17 00:00:00 2001 From: Gasmi Christophe Date: Tue, 15 Dec 2020 10:39:05 +0100 Subject: [PATCH 115/258] Update content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rémy Léone --- .../production-environment/tools/kubeadm/install-kubeadm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index 927e3453d4..037a12c3f2 100644 --- a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -282,7 +282,7 @@ car il attend les instructions de kubeadm dans une boucle de crash. ## Configurer le driver de cgroup utilisé par la kubelet sur un nœud master -Lorsque vous utilisez Docker, kubeadm détecte automatiquement le pilote ( driver ) de cgroup pour la kubelet +Lorsque vous utilisez Docker, kubeadm détecte automatiquement le pilote ( driver ) de cgroup pour kubelet et le configure dans le fichier `/var/lib/kubelet/config.yaml` lors de son éxecution. Si vous utilisez un autre CRI, vous devez passer votre valeur `cgroupDriver` avec `kubeadm init`, comme ceci : From e42ebb413c2052389b5b9b44df226afeac328688 Mon Sep 17 00:00:00 2001 From: Gasmi Christophe Date: Tue, 15 Dec 2020 10:39:47 +0100 Subject: [PATCH 116/258] Update content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rémy Léone --- .../production-environment/tools/kubeadm/install-kubeadm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index 037a12c3f2..cc4f3b99e9 100644 --- a/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/fr/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -299,7 +299,7 @@ Veuillez noter que vous devez **seulement** le faire si le driver de cgroupe de n'est pas `cgroupfs`, car c'est déjà la valeur par défaut dans la kubelet. {{< note >}} -Depuis que le paramettre `--cgroup-driver` est obsolète par kubelet, si vous l'avez dans`/var/lib/kubelet/kubeadm-flags.env` +Depuis que le paramètre `--cgroup-driver` est obsolète par kubelet, si vous l'avez dans`/var/lib/kubelet/kubeadm-flags.env` ou `/etc/default/kubelet`(`/etc/sysconfig/kubelet` pour les RPM), veuillez le supprimer et utiliser à la place KubeletConfiguration (stocké dans`/var/lib/kubelet/config.yaml` par défaut). {{< /note >}} From 8f1ddcca207005aafc3136adecea56e3a7a3dee9 Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Tue, 15 Dec 2020 17:58:22 +0800 Subject: [PATCH 117/258] Update automated-tasks-with-cron-jobs.md sync with english version --- .../tasks/job/automated-tasks-with-cron-jobs.md | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/content/zh/docs/tasks/job/automated-tasks-with-cron-jobs.md b/content/zh/docs/tasks/job/automated-tasks-with-cron-jobs.md index fdf54115bf..29aca0068d 100644 --- a/content/zh/docs/tasks/job/automated-tasks-with-cron-jobs.md +++ b/content/zh/docs/tasks/job/automated-tasks-with-cron-jobs.md @@ -28,17 +28,6 @@ Cron jobs can also schedule individual tasks for a specific time, such as if you CronJobs 在创建周期性以及重复性的任务时很有帮助，例如执行备份操作或者发送邮件。CronJobs 也可以在特定时间调度单个任务，例如你想调度低活跃周期的任务。 - -{{< note >}} -从集群版本 1.8 开始，`batch/v2alpha1` API 组中的 CronJob 资源已经被废弃。 -你应该切换到 API 服务器默认启用的 `batch/v1beta1` API 组。 -本文中的所有示例使用了 `batch/v1beta1`。 -{{< /note >}} - -当你不再需要 CronJob 时，可以用 `kubectl delete cronjob` 删掉它： +## 删除 CronJob + +当你不再需要 CronJob 时，可以用 `kubectl delete cronjob ` 删掉它： ```shell kubectl delete cronjob hello From aa7ac408d2975e368c80acf493a5290a9cc30a57 Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Tue, 15 Dec 2020 17:43:00 +0800 Subject: [PATCH 118/258] Update parallel-processing-expansion.md sync with english version Update parallel-processing-expansion.md apply suggestion --- .../tasks/job/parallel-processing-expansion.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/content/zh/docs/tasks/job/parallel-processing-expansion.md b/content/zh/docs/tasks/job/parallel-processing-expansion.md index 4cbcf614a6..071fca97cb 100644 --- a/content/zh/docs/tasks/job/parallel-processing-expansion.md +++ b/content/zh/docs/tasks/job/parallel-processing-expansion.md @@ -368,6 +368,23 @@ Kubernetes accepts and runs the Jobs you created. --> Kubernets 接收清单文件并执行你所创建的 Job。 + +### 清理 {#cleanup-2} + +```shell +# 删除所创建的 Job +# 集群会自动清理 Job 对应的 Pod +kubectl delete job -l jobgroup=jobexample +``` + + +{{< note >}} +如果没有看到命令提示符，请按回车。 +{{< /note >}} + -行动专家特别兴趣小组每周四在太平洋标准时间下午13:00开会，您可以通过 [视频环聊](https://plus.google.com/hangouts/_/google.com/sig-cluster-ops) 加入我们 并查看最新的 [会议记录](https://docs.google.com/document/d/1IhN5v6MjcAUrvLd9dAWtKcGWBWSaRU8DNyPiof3gYMY/edit) 了解所涉及的议程和主题。 +行动专家特别兴趣小组每周四在太平洋标准时间下午13:00开会，您可以通过 +[视频环聊](https://plus.google.com/hangouts/_/google.com/sig-cluster-ops) 加入我们并查看最新的 +[会议记录](https://docs.google.com/document/d/1IhN5v6MjcAUrvLd9dAWtKcGWBWSaRU8DNyPiof3gYMY/edit) +了解所涉及的议程和主题。 + + +_编者注： 今天的来宾帖子来自 Diamanti 产品副总裁 Mark Balch，他将分享有关他们对 Kubernetes 所做的贡献的更多信息。_ + + +祝贺 Kubernetes 社区发布了另一个[有价值的版本](https://kubernetes.io/blog/2016/07/kubernetes-1.3-bridging-cloud-native-and-enterprise-workloads)。 +专注于有状态应用程序和联合集群是我对 1.3 如此兴奋的两个原因。 +Kubernetes 对有状态应用程序（例如 Cassandra，Kafka 和 MongoDB）的支持至关重要。 +重要服务依赖于数据库，键值存储，消息队列等。 +此外，随着应用程序的发展为全球数百万用户提供服务，仅依靠一个数据中心或容器集群将无法正常工作。 +集群联合允许用户跨多个集群和数据中心部署应用程序，以实现规模和弹性。 + + +您可能[之前听过我说过](https://www.diamanti.com/blog/the-next-great-application-platform/)，容器是下一个出色的应用程序平台。 +Diamanti 正在加速在生产中使用有状态应用程序的容器-在这方面，性能和易于部署非常重要。 + + +**应用程序不仅仅需要牛** + + +除了诸如Web服务器之类的无状态容器（因为它们是可互换的，因此被称为“牛”）之外，用户越来越多地使用容器来部署有状态工作负载，以从“一次构建，随处运行”中受益并提高裸机效率/利用率。 +这些“宠物”（之所以称为“宠物”，是因为每个宠物都需要特殊的处理）带来了新的要求，包括更长的生命周期，配置依赖项，有状态故障转移以及性能敏感性。 +容器编排必须满足这些需求，才能成功部署和扩展应用程序。 + + +输入 [Pet Set](/docs/user-guide/petset/)，这是 Kubernetes 1.3 中的新对象，用于改进对状态应用程序的支持。 +Pet Set 在每个数据库副本的启动阶段进行排序（例如），以确保有序的主/从配置。 +Pet Set 还利用普遍存在的 DNS SRV 记录简化了服务发现，DNS SRV 记录是一种广为人知且长期了解的机制。 + + +Diamanti对Kubernetes的 [FlexVolume贡献](https://github.com/kubernetes/kubernetes/pull/13840) 通过为持久卷提供低延迟存储并保证性能来实现有状态工作负载，包括从容器到媒体的强制服务质量。 + + +**联邦主义者** + + +计划应用程序可用性的用户必须应对故障转移问题并在整个地理区域内扩展。 +跨集群联合服务允许容器化的应用程序轻松跨多个集群进行部署。 +联合服务解决了诸如管理多个容器集群以及协调跨联合集群的服务部署和发现之类的挑战。 + + +像严格的集中式模型一样，联合身份验证提供了通用的应用程序部署界面。 +但是，由于每个集群都具有自治权，因此联合会增加了在网络中断和其他事件期间在本地管理集群的灵活性。 +跨集群联合服务还可以提供跨容器集群应用一致的服务命名和采用，简化 DNS 解析。 + + +很容易想象在将来的版本中具有跨集群联合服务的强大多集群用例。 +一个示例是根据治理，安全性和性能要求调度容器。 +Diamanti 的调度程序扩展是在考虑了这一概念的基础上开发的。 +我们的[第一个实现](https://github.com/kubernetes/kubernetes/pull/13580)使 Kubernetes 调度程序意识到每个群集节点本地的网络和存储资源。 +将来，类似的概念可以应用于跨集群联合服务的更广泛的放置控件。 + + +**参与其中** + + +随着对有状态应用的兴趣日益浓厚，人们已经开始进一步增强 Kubernetes 存储的工作。 +存储特别兴趣小组正在讨论支持本地存储资源的提案。 +Diamanti 期待将 FlexVolume 扩展到包括更丰富的 API，这些 API 可以启用本地存储和存储服务，包括数据保护，复制和缩减。 +我们还正在研究有关通过 Kubernetes 跨集群联合服务改善应用程序放置，迁移和跨容器集群故障转移的建议。 + + +加入对话并做出贡献！ +这里是一些入门的地方： + + +- 产品管理 [组](https://groups.google.com/forum/#!forum/kubernetes-sig-pm) +- Kubernetes [存储 SIG](https://groups.google.com/forum/#!forum/kubernetes-sig-storage)  +- Kubernetes [集群联盟 SIG](https://groups.google.com/forum/#!forum/kubernetes-sig-federation) + + +_-- [Diamanti](https://diamanti.com/) 产品副总裁 Mark Balch。 Twitter [@markbalch](https://twitter.com/markbalch)_ From b445946ce2f7fed18a35fdb28437d22217136686 Mon Sep 17 00:00:00 2001 From: Xiang Dai Date: Tue, 8 Dec 2020 10:01:47 +0800 Subject: [PATCH 126/258] Update setup-konnectivity.md Add missing volume config. --- .../extend-kubernetes/setup-konnectivity.md | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/content/en/docs/tasks/extend-kubernetes/setup-konnectivity.md b/content/en/docs/tasks/extend-kubernetes/setup-konnectivity.md index 82eecc9c38..34936014f6 100644 --- a/content/en/docs/tasks/extend-kubernetes/setup-konnectivity.md +++ b/content/en/docs/tasks/extend-kubernetes/setup-konnectivity.md @@ -37,8 +37,22 @@ by providing the following flags to the kube-apiserver: 1. Create an egress configuration file such as `admin/konnectivity/egress-selector-configuration.yaml`. 1. Set the `--egress-selector-config-file` flag of the API Server to the path of your API Server egress configuration file. +1. If you use UDS connection, add volumes config to the kube-apiserver: + ```yaml + spec: + containers: + volumeMounts: + - name: konnectivity-uds + mountPath: /etc/kubernetes/konnectivity-server + readOnly: false + volumes: + - name: konnectivity-uds + hostPath: + path: /etc/kubernetes/konnectivity-server + type: DirectoryOrCreate + ``` -Generate or obtain a certificate and kubeconfig for konnectivity-server. +Generate or obtain a certificate and kubeconfig for konnectivity-server. For example, you can use the OpenSSL command line tool to issue a X.509 certificate, using the cluster CA certificate `/etc/kubernetes/pki/ca.crt` from a control-plane host. From 96742e2418f089afcf061bb83227d0656abb9adb Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Wed, 16 Dec 2020 12:07:26 +0800 Subject: [PATCH 127/258] Update 2016-07-00-stateful-applications-in-containers-kubernetes.md --- ...ateful-applications-in-containers-kubernetes.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/content/zh/blog/_posts/2016-07-00-stateful-applications-in-containers-kubernetes.md b/content/zh/blog/_posts/2016-07-00-stateful-applications-in-containers-kubernetes.md index 36698d806b..28023edb4a 100644 --- a/content/zh/blog/_posts/2016-07-00-stateful-applications-in-containers-kubernetes.md +++ b/content/zh/blog/_posts/2016-07-00-stateful-applications-in-containers-kubernetes.md @@ -1,5 +1,5 @@ --- -title: " 容器中的状态应用程序！？ Kubernetes 1.3 说 “是！” " +title: "容器中运行有状态的应用！？ Kubernetes 1.3 说 “是！” " date: 2016-07-13 slug: stateful-applications-in-containers-kubernetes url: /blog/2016/07/stateful-applications-in-containers-kubernetes @@ -22,11 +22,11 @@ _编者注： 今天的来宾帖子来自 Diamanti 产品副总裁 Mark Balch， Congratulations to the Kubernetes community on another [value-packed release](https://kubernetes.io/blog/2016/07/kubernetes-1.3-bridging-cloud-native-and-enterprise-workloads). A focus on stateful applications and federated clusters are two reasons why I’m so excited about 1.3. Kubernetes support for stateful apps such as Cassandra, Kafka, and MongoDB is critical. Important services rely on databases, key value stores, message queues, and more. Additionally, relying on one data center or container cluster simply won’t work as apps grow to serve millions of users around the world. Cluster federation allows users to deploy apps across multiple clusters and data centers for scale and resiliency. --> 祝贺 Kubernetes 社区发布了另一个[有价值的版本](https://kubernetes.io/blog/2016/07/kubernetes-1.3-bridging-cloud-native-and-enterprise-workloads)。 -专注于有状态应用程序和联合集群是我对 1.3 如此兴奋的两个原因。 -Kubernetes 对有状态应用程序（例如 Cassandra，Kafka 和 MongoDB）的支持至关重要。 -重要服务依赖于数据库，键值存储，消息队列等。 +专注于有状态应用程序和联邦集群是我对 1.3 如此兴奋的两个原因。 +Kubernetes 对有状态应用程序（例如 Cassandra、Kafka 和 MongoDB）的支持至关重要。 +重要服务依赖于数据库、键值存储、消息队列等。 此外，随着应用程序的发展为全球数百万用户提供服务，仅依靠一个数据中心或容器集群将无法正常工作。 -集群联合允许用户跨多个集群和数据中心部署应用程序，以实现规模和弹性。 +联邦集群允许用户跨多个集群和数据中心部署应用程序，以实现规模和弹性。 -计划应用程序可用性的用户必须应对故障转移问题并在整个地理区域内扩展。 +为应用可用性作规划的用户必须应对故障迁移问题并在整个地理区域内扩展。 跨集群联合服务允许容器化的应用程序轻松跨多个集群进行部署。 联合服务解决了诸如管理多个容器集群以及协调跨联合集群的服务部署和发现之类的挑战。 @@ -112,7 +112,7 @@ Join the conversation and contribute! Here are some places to get started: --> - 产品管理 [组](https://groups.google.com/forum/#!forum/kubernetes-sig-pm) - Kubernetes [存储 SIG](https://groups.google.com/forum/#!forum/kubernetes-sig-storage)  -- Kubernetes [集群联盟 SIG](https://groups.google.com/forum/#!forum/kubernetes-sig-federation) +- Kubernetes [集群联邦 SIG](https://groups.google.com/forum/#!forum/kubernetes-sig-federation) -我们调查了为 Docker [编写 "bridge" CNM驱动程序](https://groups.google.com/forum/#!topic/kubernetes-sig-network/5MWRPxsURUw) 并运行 CNI 驱动程序。事实证明这非常复杂。首先， CNM 和 CNI 模型非常不同，因此没有一种“方法”协调一致。 我们仍然有上面讨论的全球与本地和键值问题。假设这个驱动程序会声明自己是本地的，我们必须从 Kubernetes 获取有关逻辑网络的信息。 +我们调查了为 Docker [编写 "bridge" CNM驱动程序](https://groups.google.com/g/kubernetes-sig-network/c/5MWRPxsURUw) 并运行 CNI 驱动程序。事实证明这非常复杂。首先， CNM 和 CNI 模型非常不同，因此没有一种“方法”协调一致。 我们仍然有上面讨论的全球与本地和键值问题。假设这个驱动程序会声明自己是本地的，我们必须从 Kubernetes 获取有关逻辑网络的信息。 @@ -69,10 +69,10 @@ Docker 的网络模型做出了许多对 Kubernetes 无效的假设。在 docker -出于所有这些原因，我们选择投资 CNI 作为 Kubernetes 插件模型。这会有一些不幸的副作用。它们中的大多数都相对较小（例如， `docker inspect` 不会显示 IP 地址），但有些是重要的。特别是，由 `docker run` 启动的容器可能无法与 Kubernetes 启动的容器通信，如果网络集成商想要与 Kubernetes 完全集成，则必须提供 CNI 驱动程序。另一方面， Kubernetes 将变得更简单，更灵活，早期引入的许多丑陋的（例如配置 Docker 使用我们的网桥）将会消失。 +出于所有这些原因，我们选择投资 CNI 作为 Kubernetes 插件模型。这会有一些不幸的副作用。它们中的大多数都相对较小（例如， `docker inspect` 不会显示 IP 地址），特别是由 `docker run` 启动的容器可能无法与 Kubernetes 启动的容器通信，如果网络集成商想要与 Kubernetes 完全集成，则必须提供 CNI 驱动程序。但另一方面， Kubernetes 将变得更简单，更灵活，早期引入的许多丑陋的（例如配置 Docker 使用我们的网桥）将会消失。 -当我们沿着这条道路前进时，我们肯定会保持眼睛和耳朵的开放，以便更好地整合和简化。如果您对我们如何做到这一点有所想法，我们真的希望听到它们 - 在 [slack](http://slack.k8s.io/) 或者 [network SIG mailing-list](https://groups.google.com/forum/#!forum/kubernetes-sig-network) 找到我们。 +当我们沿着这条道路前进时，我们会保持开放，以便更好地整合和简化。如果您对我们如何做到这一点有所想法，我们真的希望听到它们 - 在 [slack](http://slack.k8s.io/) 或者 [network SIG mailing-list](https://groups.google.com/g/kubernetes-sig-network) 找到我们。 Tim Hockin, Software Engineer, Google From ada714fd572040f9caeb8b501e857cea81530c25 Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Wed, 16 Dec 2020 15:12:24 +0800 Subject: [PATCH 129/258] Update hello-minikube.md sync with english version --- content/zh/docs/tutorials/hello-minikube.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/tutorials/hello-minikube.md b/content/zh/docs/tutorials/hello-minikube.md index 834ccec67b..7d0132e308 100644 --- a/content/zh/docs/tutorials/hello-minikube.md +++ b/content/zh/docs/tutorials/hello-minikube.md @@ -38,10 +38,14 @@ Katacoda provides a free, in-browser Kubernetes environment. 在 Kubernetes 上运行一个应用示例。Katacoda 提供免费的浏览器内 Kubernetes 环境。 {{< note >}} -如果你已在本地安装 [Minikube](https://minikube.sigs.k8s.io/docs/start/)，也可以按照本教程操作。 +如果你已在本地安装 Minikube，也可以按照本教程操作。 +安装指南参阅 [minikube start](https://minikube.sigs.k8s.io/docs/start/) 。 {{< /note >}} From e958293ffb66ba3466ddd3e7147b7c1e5c3bb29d Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Wed, 16 Dec 2020 16:04:20 +0800 Subject: [PATCH 130/258] Create 2018-10-10-runtimeclass.md (#25628) * Create 2018-10-10-runtimeclass.md * Update 2018-10-10-runtimeclass.md --- .../zh/blog/_posts/2018-10-10-runtimeclass.md | 137 ++++++++++++++++++ 1 file changed, 137 insertions(+) create mode 100644 content/zh/blog/_posts/2018-10-10-runtimeclass.md diff --git a/content/zh/blog/_posts/2018-10-10-runtimeclass.md b/content/zh/blog/_posts/2018-10-10-runtimeclass.md new file mode 100644 index 0000000000..35e8649442 --- /dev/null +++ b/content/zh/blog/_posts/2018-10-10-runtimeclass.md @@ -0,0 +1,137 @@ +--- +layout: blog +title: 'Kubernetes v1.12: RuntimeClass 简介' +date: 2018-10-10 +--- + + + +**作者**: Tim Allclair (Google) + + +Kubernetes 最初是为了支持在 Linux 主机上运行本机应用程序的 Docker 容器而创建的。 +从 Kubernetes 1.3中的 [rkt](https://kubernetes.io/blog/2016/07/rktnetes-brings-rkt-container-engine-to-kubernetes/) 开始，更多的运行时间开始涌现， +这导致了[容器运行时接口（Container Runtime Interface）](https://kubernetes.io/blog/2016/12/container-runtime-interface-cri-in-kubernetes/)（CRI）的开发。 +从那时起，备用运行时集合越来越大： +为了加强工作负载隔离，[Kata Containers](https://katacontainers.io/) 和 [gVisor](https://github.com/google/gvisor) 等项目被发起， +并且 Kubernetes 对 Windows 的支持正在 [稳步发展](https://kubernetes.io/blog/2018/01/kubernetes-v19-beta-windows-support/) 。 + + +由于存在诸多针对不同用例的运行时，集群对混合运行时的需求变得明晰起来。 +但是，所有这些不同的容器运行方式都带来了一系列新问题要处理： + + +- 用户如何知道哪些运行时可用，并为其工作负荷选择运行时？ +- 我们如何确保将 Pod 被调度到支持所需运行时的节点上？ +- 哪些运行时支持哪些功能，以及我们如何向用户显示不兼容性？ +- 我们如何考虑运行时的各种资源开销？ + + +**RuntimeClass** 旨在解决这些问题。 + + +## Kubernetes 1.12 中的 RuntimeClass + + +最近，RuntimeClass 在 Kubernetes 1.12 中作为 alpha 功能引入。 +最初的实现侧重于提供运行时选择 API ，并为解决其他未解决的问题铺平道路。 + + +RuntimeClass 资源代表 Kubernetes 集群中支持的容器运行时。 +集群制备组件安装、配置和定义支持 RuntimeClass 的具体运行时。 +在 RuntimeClassSpec 的当前形式中，只有一个字段，即 **RuntimeHandler**。 +RuntimeHandler 由在节点上运行的 CRI 实现解释，并映射到实际的运行时配置。 +同时，PodSpec 被扩展添加了一个新字段 **RuntimeClassName**，命名应该用于运行 Pod 的 RuntimeClass。 + + +为什么 RuntimeClass 是 Pod 级别的概念？ +Kubernetes 资源模型期望 Pod 中的容器之间可以共享某些资源。 +如果 Pod 由具有不同资源模型的不同容器组成，支持必要水平的资源共享变得非常具有挑战性。 +例如，要跨 VM 边界支持本地回路（localhost）接口非常困难，但这是 Pod 中两个容器之间通信的通用模型。 + + +## 下一步是什么？ + + +RuntimeClass 资源是将运行时属性显示到控制平面的重要基础。 +例如，要对具有支持不同运行时间的异构节点的群集实施调度程序支持，我们可以在 RuntimeClass 定义中添加 +[NodeAffinity](/zh/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)条件。 +另一个需要解决的领域是管理可变资源需求以运行不同运行时的 Pod。 +[Pod Overhead 提案](https://docs.google.com/document/d/1EJKT4gyl58-kzt2bnwkv08MIUZ6lkDpXcxkHqCvvAp4/preview) +是一项较早的尝试，与 RuntimeClass 设计非常吻合，并且可能会进一步推广。 + + +人们还提出了许多其他 RuntimeClass 扩展，随着功能的不断发展和成熟，我们会重新讨论这些提议。 +正在考虑的其他扩展包括： + + +- 提供运行时支持的可选功能，并更好地查看由不兼容功能导致的错误。 +- 自动运行时或功能发现，支持无需手动配置的调度决策。 +- 标准化或一致的 RuntimeClass 名称，用于定义一组具有相同名称的 RuntimeClass 的集群应支持的属性。 +- 动态注册附加的运行时，因此用户可以在不停机的情况下在现有群集上安装新的运行时。 +- 根据 Pod 的要求“匹配” RuntimeClass。 + 例如，指定运行时属性并使系统与适当的 RuntimeClass 匹配，而不是通过名称显式分配 RuntimeClass。 + + +至少要到2019年，RuntimeClass 才会得到积极的开发，我们很高兴看到从 Kubernetes 1.12 中的 RuntimeClass alpha 开始，此功能得以形成。 + + +## 学到更多 + + + +- 试试吧！ 作为Alpha功能，还有一些其他设置步骤可以使用RuntimeClass。 + 有关如何使其运行，请参考 [RuntimeClass文档](/zh/docs/concepts/containers/runtime-class/#runtime-class) 。 +- 查看 [RuntimeClass Kubernetes 增强建议](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/runtime-class.md) 以获取更多细节设计细节。 +- [沙盒隔离级别决策](https://docs.google.com/document/d/1fe7lQUjYKR0cijRmSbH_y0_l3CYPkwtQa5ViywuNo8Q/preview) + 记录了最初使 RuntimeClass 成为 Pod 级别选项的思考过程。 +- 加入讨论，并通过 [SIG-Node社区](https://github.com/kubernetes/community/tree/master/sig-node) 帮助塑造 RuntimeClass 的未来。 + From 70d09af40b599d5e204e5ad5de00b9b131bec223 Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Wed, 16 Dec 2020 16:50:28 +0800 Subject: [PATCH 131/258] Update 2016-07-00-stateful-applications-in-containers-kubernetes.md --- ...ul-applications-in-containers-kubernetes.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/content/zh/blog/_posts/2016-07-00-stateful-applications-in-containers-kubernetes.md b/content/zh/blog/_posts/2016-07-00-stateful-applications-in-containers-kubernetes.md index 28023edb4a..027a7c8701 100644 --- a/content/zh/blog/_posts/2016-07-00-stateful-applications-in-containers-kubernetes.md +++ b/content/zh/blog/_posts/2016-07-00-stateful-applications-in-containers-kubernetes.md @@ -56,7 +56,7 @@ Pet Set 还利用普遍存在的 DNS SRV 记录简化了服务发现，DNS SRV -Diamanti对Kubernetes的 [FlexVolume贡献](https://github.com/kubernetes/kubernetes/pull/13840) 通过为持久卷提供低延迟存储并保证性能来实现有状态工作负载，包括从容器到媒体的强制服务质量。 +Diamanti 对 Kubernete s的 [FlexVolume 贡献](https://github.com/kubernetes/kubernetes/pull/13840) 通过为持久卷提供低延迟存储并保证性能来实现有状态工作负载，包括从容器到媒体的强制服务质量。 为应用可用性作规划的用户必须应对故障迁移问题并在整个地理区域内扩展。 -跨集群联合服务允许容器化的应用程序轻松跨多个集群进行部署。 -联合服务解决了诸如管理多个容器集群以及协调跨联合集群的服务部署和发现之类的挑战。 +跨集群联邦服务允许容器化的应用程序轻松跨多个集群进行部署。 +联邦服务解决了诸如管理多个容器集群以及协调跨联邦集群的服务部署和发现之类的挑战。 -像严格的集中式模型一样，联合身份验证提供了通用的应用程序部署界面。 -但是，由于每个集群都具有自治权，因此联合会增加了在网络中断和其他事件期间在本地管理集群的灵活性。 -跨集群联合服务还可以提供跨容器集群应用一致的服务命名和采用，简化 DNS 解析。 +像严格的集中式模型一样，联邦身份验证提供了通用的应用程序部署界面。 +但是，由于每个集群都具有自治权，因此联邦会增加了在网络中断和其他事件期间在本地管理集群的灵活性。 +跨集群联邦服务还可以提供跨容器集群应用一致的服务命名和采用，简化 DNS 解析。 -很容易想象在将来的版本中具有跨集群联合服务的强大多集群用例。 +很容易想象在将来的版本中具有跨集群联邦服务的强大多集群用例。 一个示例是根据治理，安全性和性能要求调度容器。 Diamanti 的调度程序扩展是在考虑了这一概念的基础上开发的。 我们的[第一个实现](https://github.com/kubernetes/kubernetes/pull/13580)使 Kubernetes 调度程序意识到每个群集节点本地的网络和存储资源。 -将来，类似的概念可以应用于跨集群联合服务的更广泛的放置控件。 +将来，类似的概念可以应用于跨集群联邦服务的更广泛的放置控件。 @@ -525,8 +528,11 @@ Each feature gate is designed for enabling/disabling a specific feature: - `BlockVolume`：在 Pod 中启用原始块设备的定义和使用。有关更多详细信息，请参见 [原始块卷支持](/zh/docs/concepts/storage/persistent-volumes/#raw-block-volume-support)。 - `BoundServiceAccountTokenVolume`：迁移 ServiceAccount 卷以使用由 - ServiceAccountTokenVolumeProjection 组成的预计卷。有关更多详细信息，请参见 - [服务账号令牌卷](https://git.k8s.io/community/contributors/design-proposals/storage/svcacct-token-volume-source.md)。 + ServiceAccountTokenVolumeProjection 组成的投射卷。集群管理员可以使用 `serviceaccount_stale_tokens_total` + 度量值来监控依赖于扩展令牌的负载。如果没有这种类型的负载，你可以在启动 `kube-apiserver` 时 + 添加 `--service-account-extend-token-expiration=false` 参数关闭扩展令牌。查看 + [绑定服务账号令牌](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/1205-bound-service-account-tokens/README.md) + 获取更多详细信息。 - `ConfigurableFSGroupPolicy`：在 Pod 中挂载卷时，允许用户为 fsGroup 配置卷访问权限和属主变更策略。请参见 [为 Pod 配置卷访问权限和属主变更策略](/zh/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods)。 From b139ff6274210b23715a0500f13c5cf845e3a25f Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Wed, 16 Dec 2020 16:58:38 +0800 Subject: [PATCH 133/258] Update 2016-04-00-Sig-Clusterops-Promote-Operability-And-Interoperability-Of-K8S-Clusters.md --- ...romote-Operability-And-Interoperability-Of-K8S-Clusters.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/blog/_posts/2016-04-00-Sig-Clusterops-Promote-Operability-And-Interoperability-Of-K8S-Clusters.md b/content/zh/blog/_posts/2016-04-00-Sig-Clusterops-Promote-Operability-And-Interoperability-Of-K8S-Clusters.md index 8ea77441e3..e9d09cb84c 100644 --- a/content/zh/blog/_posts/2016-04-00-Sig-Clusterops-Promote-Operability-And-Interoperability-Of-K8S-Clusters.md +++ b/content/zh/blog/_posts/2016-04-00-Sig-Clusterops-Promote-Operability-And-Interoperability-Of-K8S-Clusters.md @@ -66,7 +66,7 @@ Cluster Ops 希望成为运营资源的交换所。 集群运营可能会很辛苦–别一个人做。 -我们在这里倾听，在我们可以帮助的时候提供帮助，而在我们不能帮助的时候升级。 +我们在这里倾听，在我们可以帮助的时候提供帮助，而在我们不能帮助的时候向上一级反映。 在以下位置加入对话： -行动专家特别兴趣小组每周四在太平洋标准时间下午13:00开会，您可以通过 +SIG Cluster Ops 每周四在太平洋标准时间下午 13:00 开会，您可以通过 [视频环聊](https://plus.google.com/hangouts/_/google.com/sig-cluster-ops) 加入我们并查看最新的 [会议记录](https://docs.google.com/document/d/1IhN5v6MjcAUrvLd9dAWtKcGWBWSaRU8DNyPiof3gYMY/edit) 了解所涉及的议程和主题。 From ba84d93ebd3beacd2e43a72db0b4350e524def17 Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Wed, 16 Dec 2020 14:34:05 +0800 Subject: [PATCH 134/258] t # This is a combination of 3 commits. Update update-daemon-set.md sync with english version. Update update-daemon-set.md apply suggestion Update update-daemon-set.md apply suggestion --- .../docs/tasks/manage-daemon/update-daemon-set.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/manage-daemon/update-daemon-set.md b/content/zh/docs/tasks/manage-daemon/update-daemon-set.md index 6d425f4d51..15631cf688 100644 --- a/content/zh/docs/tasks/manage-daemon/update-daemon-set.md +++ b/content/zh/docs/tasks/manage-daemon/update-daemon-set.md @@ -234,6 +234,17 @@ daemonset "fluentd-elasticsearch" successfully rolled out ### DaemonSet 滚动更新卡住 + +有时，DaemonSet 滚动更新可能卡住，以下是一些可能的原因： + + +#### 一些节点可用资源耗尽 + -有时，DaemonSet 滚动更新可能会卡住，其 Pod 至少在某个节点上无法调度运行。 +DaemonSet 滚动更新可能会卡住，其 Pod 至少在某个节点上无法调度运行。 当节点上[可用资源耗尽](/zh/docs/tasks/administer-cluster/out-of-resource/)时， 这是可能的。 From 575b183d693139cc191530bcfa57d5fae6f31581 Mon Sep 17 00:00:00 2001 From: Xander Grzywinski Date: Wed, 16 Dec 2020 11:30:21 -0800 Subject: [PATCH 135/258] add device metrics feature blog resond to PR comments change publish date and respond to some comments respond to some more comments fix formatting fix image links and respond to comment respond to formatting comments remove gks reference fix metrics names remove gcp pr feedback --- ...2-16-third-party-device-metrics-hits-ga.md | 134 ++++++++++++++++++ .../grafana.png | Bin 0 -> 315798 bytes .../metrics-chart.png | Bin 0 -> 165684 bytes 3 files changed, 134 insertions(+) create mode 100644 content/en/blog/_posts/2020-12-16-third-party-device-metrics-hits-ga.md create mode 100644 static/images/blog/2020-12-16-third-party-device-metrics-hits-ga/grafana.png create mode 100644 static/images/blog/2020-12-16-third-party-device-metrics-hits-ga/metrics-chart.png diff --git a/content/en/blog/_posts/2020-12-16-third-party-device-metrics-hits-ga.md b/content/en/blog/_posts/2020-12-16-third-party-device-metrics-hits-ga.md new file mode 100644 index 0000000000..a4fa02e4fc --- /dev/null +++ b/content/en/blog/_posts/2020-12-16-third-party-device-metrics-hits-ga.md @@ -0,0 +1,134 @@ +--- +layout: blog +title: 'Third Party Device Metrics Reaches GA' +date: 2020-12-16 +slug: third-party-device-metrics-reaches-ga +--- + + **Authors:** Renaud Gaubert (NVIDIA), David Ashpole (Google), and Pramod Ramarao (NVIDIA) + + With Kubernetes 1.20, infrastructure teams who manage large scale Kubernetes clusters, are seeing the graduation of two exciting and long awaited features: + * The Pod Resources API (introduced in 1.13) is finally graduating to GA. This allows Kubernetes plugins to obtain information about the node’s resource usage and assignment; for example: which pod/container consumes which device. + * The `DisableAcceleratorMetrics` feature (introduced in 1.19) is graduating to beta and will be enabled by default. This removes device metrics reported by the kubelet in favor of the new plugin architecture. + +Many of the features related to fundamental device support (device discovery, plugin, and monitoring) are reaching a strong level of stability. +Kubernetes users should see these features as stepping stones to enable more complex use cases (networking, scheduling, storage, etc.)! + +One such example is Non Uniform Memory Access (NUMA) placement where, when selecting a device, an application typically wants to ensure that data transfer between CPU Memory and Device Memory is as fast as possible. In some cases, incorrect NUMA placement can nullify the benefit of offloading compute to an external device. + +If these are topics of interest to you, consider joining the [Kubernetes Node Special Insterest Group](https://github.com/kubernetes/community/tree/master/sig-node) (SIG) for all topics related to the Kubernetes node, the COD (container orchestrated device) workgroup for topics related to runtimes, or the resource management forum for topics related to resource management! + +## The Pod Resources API - Why does it need to exist? + +Kubernetes is a vendor neutral platform. If we want it to support device monitoring, adding vendor-specific code in the Kubernetes code base is not an ideal solution. Ultimately, devices are a domain where deep expertise is needed and the best people to add and maintain code in that area are the device vendors themselves. + +The Pod Resources API was built as a solution to this issue. Each vendor can build and maintain their own out-of-tree monitoring plugin. This monitoring plugin, often deployed as a separate pod within a cluster, can then associate the metrics a device emits with the associated pod that's using it. + +For example, use the NVIDIA GPU dcgm-exporter to scrape metrics in Prometheus format: + +``` +$ curl -sL http://127.0.01:8080/metrics + + +# HELP DCGM_FI_DEV_SM_CLOCK SM clock frequency (in MHz). +# TYPE DCGM_FI_DEV_SM_CLOCK gauge +# HELP DCGM_FI_DEV_MEM_CLOCK Memory clock frequency (in MHz). +# TYPE DCGM_FI_DEV_MEM_CLOCK gauge +# HELP DCGM_FI_DEV_MEMORY_TEMP Memory temperature (in C). +# TYPE DCGM_FI_DEV_MEMORY_TEMP gauge +... +DCGM_FI_DEV_SM_CLOCK{gpu="0", UUID="GPU-604ac76c-d9cf-fef3-62e9-d92044ab6e52",container="foo",namespace="bar",pod="baz"} 139 +DCGM_FI_DEV_MEM_CLOCK{gpu="0", UUID="GPU-604ac76c-d9cf-fef3-62e9-d92044ab6e52",container="foo",namespace="bar",pod="baz"} 405 +DCGM_FI_DEV_MEMORY_TEMP{gpu="0", UUID="GPU-604ac76c-d9cf-fef3-62e9-d92044ab6e52",container="foo",namespace="bar",pod="baz"} 9223372036854775794 +``` + +Each agent is expected to adhere to the node monitoring guidelines. In other words, plugins are expected to generate metrics in Prometheus format, and new metrics should not have any dependency on the Kubernetes base directly. + +This allows consumers of the metrics to use a compatible monitoring pipeline to collect and analyze metrics from a variety of agents, even if they are maintained by different vendors. + +![Device metrics flowchart](/images/blog/2020-12-16-third-party-device-metrics-hits-ga/metrics-chart.png) + +## Disabling the NVIDIA GPU metrics - Warning {#nvidia-gpu-metrics-deprecated} + +With the graduation of the plugin monitoring system, Kubernetes is deprecating the NVIDIA GPU metrics that are being reported by the kubelet. + +With the [DisableAcceleratorMetrics](/docs/concepts/cluster-administration/system-metrics/#disable-accelerator-metrics) feature being enabled by default in Kubernetes 1.20, NVIDIA GPUs are no longer special citizens in Kubernetes. This is a good thing in the spirit of being vendor-neutral, and enables the most suited people to maintain their plugin on their own release schedule! + +Users will now need to either install the [NVIDIA GDGM exporter](https://github.com/NVIDIA/gpu-monitoring-tools) or use [bindings](https://github.com/nvidia/go-nvml) to gather more accurate and complete metrics about NVIDIA GPUs. This deprecation means that you can no longer rely on metrics that were reported by kubelet, such as `container_accelerator_duty_cycle` or `container_accelerator_memory_used_bytes` which were used to gather NVIDIA GPU memory utilization. + +This means that users who used to rely on the NVIDIA GPU metrics reported by the kubelet, will need to update their reference and deploy the NVIDIA plugin. Namely the different metrics reported by Kubernetes map to the following metrics: + +| Kubernetes Metrics | NVIDIA dcgm-exporter metric | +| ------------------------------------------ | ------------------------------------------- | +| `container_accelerator_duty_cycle` | `DCGM_FI_DEV_GPU_UTIL` | +| `container_accelerator_memory_used_bytes` | `DCGM_FI_DEV_FB_USED` | +| `container_accelerator_memory_total_bytes` | `DCGM_FI_DEV_FB_FREE + DCGM_FI_DEV_FB_USED` | + +You might also be interested in other metrics such as `DCGM_FI_DEV_GPU_TEMP` (the GPU temperature) or DCGM_FI_DEV_POWER_USAGE (the power usage). The [default set](https://github.com/NVIDIA/gpu-monitoring-tools/blob/d5c9bb55b4d1529ca07068b7f81e690921ce2b59/etc/dcgm-exporter/default-counters.csv) is available in Nvidia's [Data Center GPU Manager documentation](https://docs.nvidia.com/datacenter/dcgm/latest/dcgm-api/group__dcgmFieldIdentifiers.html). + +Note that for this release you can still set the `DisableAcceleratorMetrics` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) to _false_, effectively re-enabling the ability for the kubelet to report NVIDIA GPU metrics. + +Paired with the graduation of the Pod Resources API, these tools can be used to generate GPU telemetry [that can be used in visualization dashboards](https://grafana.com/grafana/dashboards/12239), below is an example: + +![Grafana visualization of device metrics](/images/blog/2020-12-16-third-party-device-metrics-hits-ga/grafana.png) + +## The Pod Resources API - What can I go on to do with this? + +As soon as this interface was introduced, many vendors started using it for widely different use cases! To list a few examples: + +The [kuryr-kubernetes](https://github.com/openstack/kuryr-kubernetes) CNI plugin in tandem with [intel-sriov-device-plugin](https://github.com/intel/sriov-network-device-plugin). This allowed the CNI plugin to know which allocation of SR-IOV Virtual Functions (VFs) the kubelet made and use that information to correctly setup the container network namespace and use a device with the appropriate NUMA node. We also expect this interface to be used to track the allocated and available resources with information about the NUMA topology of the worker node. + +Another use-case is GPU telemetry, where GPU metrics can be associated with the containers and pods that the GPU is assigned to. One such example is the NVIDIA `dcgm-exporter`, but others can be easily built in the same paradigm. + +The Pod Resources API is a simple gRPC service which informs clients of the pods the kubelet knows. The information concerns the devices assignment the kubelet made and the assignment of CPUs. This information is obtained from the internal state of the kubelet's Device Manager and CPU Manager respectively. + +You can see below a sample example of the API and how a go client could use that information in a few lines: + +``` +service PodResourcesLister { + rpc List(ListPodResourcesRequest) returns (ListPodResourcesResponse) {} + rpc GetAllocatableResources(AllocatableResourcesRequest) returns (AllocatableResourcesResponse) {} + + // Kubernetes 1.21 + rpc Watch(WatchPodResourcesRequest) returns (stream WatchPodResourcesResponse) {} +} +``` + +```go +func main() { + ctx, cancel := context.WithTimeout(context.Background(), connectionTimeout) + defer cancel() + + socket := "/var/lib/kubelet/pod-resources/kubelet.sock" + conn, err := grpc.DialContext(ctx, socket, grpc.WithInsecure(), grpc.WithBlock(), + grpc.WithDialer(func(addr string, timeout time.Duration) (net.Conn, error) { + return net.DialTimeout("unix", addr, timeout) + }), + ) + + if err != nil { + panic(err) + } + + client := podresourcesapi.NewPodResourcesListerClient(conn) + resp, err := client.List(ctx, &podresourcesapi.ListPodResourcesRequest{}) + if err != nil { + panic(err) + } + net.Printf("%+v\n", resp) +} +``` + +Finally, note that you can watch the number of requests made to the Pod Resources endpoint by watching the new kubelet metric called `pod_resources_endpoint_requests_total` on the kubelet's `/metrics` endpoint. + +## Is device monitoring suitable for production? Can I extend it? Can I contribute? + +Yes! This feature released in 1.13, almost 2 years ago, has seen broad adoption, is already used by different cloud managed services, and with its graduation to G.A in Kubernetes 1.20 is production ready! + +If you are a device vendor, you can start using it today! If you just want to monitor the devices in your cluster, go get the latest version of your monitoring plugin! + +If you feel passionate about that area, join the kubernetes community, help improve the API or contribute the device monitoring plugins! + +## Acknowledgements + +We thank the members of the community who have contributed to this feature or given feedback including members of WG-Resource-Management, SIG-Node and the Resource management forum! \ No newline at end of file diff --git a/static/images/blog/2020-12-16-third-party-device-metrics-hits-ga/grafana.png b/static/images/blog/2020-12-16-third-party-device-metrics-hits-ga/grafana.png new file mode 100644 index 0000000000000000000000000000000000000000..3173977eb8807297c4aea09e574331b59246cc89 GIT binary patch literal 315798 zcmZU)1ytO>(l89gikD)=DYUp0cNVweP~6?!ZHp9lExH8?l;ZC0?kw(F+;w+fdjI#{ z=brD&Ioafw%uJF=GMSlVBa{`TG0}+8;NajeWo0B(;ouOr;NalLUn9Sia7`AL!oguU zT8oP-%ZiIrD!VvZSlgMy!O29VXrgGT4H4w%CdS9Vq5S$ac`}ny6+s3y7b)HVk>ow< zhvav-L6L1t42>Q*@FdL)c?%jM#|tTvRd;!rwY4!XY;2U&xcNDmSa6FtL2H)8b*8R@ME?O*Q zO?cK1XePMfJs-T;rfmEzQhB4%*;bej@SNd!P))?c3DI_QBWyBbsv}Ts46XcAqkA-t zCN9h%0V(a|bS_DYHc%d__nKpI*7y;Ls_zR$?DXjrBLcP1O$famOp=!@%o4(JIgF^) zKG1D9gz}2gp<-)Xn10i)u0*W!mu>f>G_=c?8I4id_D9P5`TC20rJA1s@c9$rakX-{ zBKZc+u(UMx4%M5`kl!u?Ip`mUB5ZQ7r-L>S=XA2D#-h}gw^O@YoeI|8nqYey=lL+_ zsKW6SMN&*867+s7-s+8V@k((1?R9QWN$e!@+UOM$X}S^BApF*Rc__>MXD(c1FA?PG zz&E@lTnLP+PnI9fGhRn_QoKP8^mEd8f|b6(6N99Qmi_sIQT=F%{-n7RRP<&)m@Xa# z$oQx!i`-W5l~$P=8si5o(oOJjBSV1uvFjJXJqf@4W;bk_B!W5C)`^E&3E&AXq z$u@i=1vzGgs8i!6(~2c!oa1dsQ3!W8b+@~iz~(LDh2A2zO6;qXc!0cq)aaRQ;If#a zlHj|$u;X|lp3ay+j#GF@<%P(>BCZYJpT?9g#?Vek14g?qv5i1ABhg3f_b3S`K)vGK zU%PyRd8IdZH!6J@d|Hm<8>4YhzV$DLaAzt29TW5_$b$AUq6fJ^G#4C=2Zn90P9?RR zU}HN)L4Pm%@V=vVy8u!lx?)(w;(5xQ{1DoWI!fftp-RE-nn zM(p3Q_P&}ZqooGU{di>um)Ye}iGGZLx$%h?e*A0H274pcY4_?3yg`t|Io37RYcVma z*9dH4qc|kJsLtYAGH`DrC8$wlh!X?NsNYHi%1iIPFBnAo`D!s_meMyNco20*a5{8F zikvEYkYoopGFM$4n@iGuYLgD#JYU7?EkD+n6m72Lfu9?yPOL`0z?9E5q7P16Y<)iK z6gh@b#&>v&Kt5BZ=-@t+LoEWD9t)F?T0|N#bH)nie1?5XRV>HUioHaDNTajJx98O0AkRi+4O21@*-`9zPz*o5+U zei;f*POed|70zzXX|4~%u3W>M9#*7tjd>UH`DvvJ_3xh&O^04xs$Z&J61d<#ylo0z z`8<`opz=&Fn@l=PD#uq4>yqITcd4PKHlsQt&0(Nc%BNeS=Nh-iHx`ybQQWL9%@D?) z`uhh;E=4|z+d?aaS z><{c7yA+S^D#26!rYj3mylY<77e3oF{rciJp^uom*vv%Djt6A8v%OOvy38_$ERqP4 z$kjMzoYaaBb!L(Z^(~MsL@oF%N=9Qd+%q^v5k~v=N=D<-JB zV%e=(y^2R!OQATS4;V=pCFCA6>3>E&Slr6p0}f0!-kz|73%YjaoQ^gRd(yB00?#ES zMYcId1mG5GH))C3?*e(&y(B!+Jngy#%UqrrzTcmi?xgO()iKZGW!;t93L?&$^@WZu+r9S|)CX7{WO1>heO zGocH=dCu7$N$=t#5Be4omK;(W`X`hoOd~}2bq&S{Rte@2)*S|jAV4ta4Gw;l;1&%y zd1QaysfD_Y+EOAXGEeHG)E5b%NRQ}LNuC%nX~|d}zCQ-h3eg`5-xKt@m}>T~#nnV* z;(5~LyrUpAB!Y1oOLSj{)I>!0qDBb3UH^zg%dF6xX$LBmaZt=HidHC=^#&0qHdEF4 zU!PBLNEym=DB>1z6(&uqO*a(YMWd3{_{a}vO;q)nI!4!!@R+YWT=Z{W^;4vafI2fP z0m1PJ8CBHV9IUCDV@E?f78>RrSA5T0&uKxFT@0c{lZK6A_e>)ITgmw=JJ@l`Vs@U0 zO8T$Qqd1!3hWipbc7xs^lFSz723A%sN6&Vt04bccf5ROY#op+iwnoj~#GmhE!oE+W!&xhQ9b@jQ2&@(4QG6S&z=0nVAvN`n}`6dxAQE z1=i#!JD)gTVDK5tO3jkQ)KVqr^l*#M&lss8XuxM<4q@2)o%jVNHY7$d-ZewqB@l27O%lmzIgm_e5imhYV(B&q67^+0lN8)IYwythy zud835-q_@HHN#A=I}YuBEU+lKn4c~)te35?b5vRg_}$-9Xc0CPTTo|JmRIk(zmT2g z`R&-I)U|xMcG<}Dki1g5YQJwSx{c>n^2By+V#)BXWUS%~$~zRfKM9Y;H>;R=p|}0D z{q?~KD4Chh8Caw)e6=T)eVfD7kJ72+1*F-)+B2=Gs+{fVZGGBmB|(RrNx!?DgCwwG zAIL_C%>8jCy^@1=qI!Z{U>|sT?!A76!dl6~sdwG1wZ66JvcWU4j#cYZH*a{^KI^r( z@1nLmSf8)?sv@hA*yU!F>$ENkY+By1D%0+Kw6~CX(ty~Ivp(Jec~soYUTdj2!#Pb^ z0k<38cJ7GYoMCmGIo#O*E+HS{@ zzu{%qLC?rBdtQD#RkAcO>i2jvl8SX~` zeCJnx67%TagvW#ua~-$T=b*~phR1}gaDO)LeEkTYo10KObC@e3LCQ_Fp4kf-w^*2|Kj|UA|!^wp}c&(eTiN_Ui}9e zaq9=dfAa9-FLiLDYT~l8FR7ZTi@CXjtCgeMZw=#)mjYBL8EscMID(IVBfPBYhw~Tu zU~6?PH!THuep5$#7GpC<6LS_Xd#As2-~_$+U$XY*ZpM^e_I3`g{9Zy-|AOFu$^R{8 zrK0>7h?}htm6n1srMRPuIVCsCCzelC!f2F~l!7j17W}FbQvXJO`4XbCa&vRyXJz&D z^knhmU~zP@WM$*y<755A&dSct`~t!3>h0iW?8WThO8pO!|Im>zcQtjfc5<_JbfEl8 z*Vx3--A#y!>Tg5;4gd7h+{^m^T5@px_pn|D$ojX2m5t>S>wjs#pbGvi0aXBbRX`O4_Q7+L=GIB2%M~hsJa*Yu|A5Cx#S#l+Eh~^!fsGdBkS(Q$&Si=< z=iwVL9wjaQV5=jC`h4&Y&i8>mHANjNlpmzM zZl9&A8)-}g0xmE2cUh0EF{YVMEd&CHl4m0(Tg|d>|xr<0neXLnA*v(-U9F z=WZ_ubi2H*XaL5L{iH1X1zA>Vqe;uOO?o(D@y04F)R>d!kiseh=jBoT z5&doHGqa=YO3LbfGW+8_sabbJKfK)f1W>UU<;RX-qNtVi3dt2@YHFXn85gkoZDg`w z+8xelP(aA@fh}U~a03B*eP;a%lm@5(iX~;rO&uAoL+@{SDhXR5@5eSySUvuGjeV>;3ib(@yzQ3=Xa$SeLCJM78qdx`?JuhFr0U2{1B;Y&Ix@J+*K@0a>pW=K7NY6VJn8EG zw)+>45Qk===q7q($mQL+EV>eK0%!njg*w})|6cfKMBu;6IdPS4W_lUak4}ZMjPgRI zp#vc(p5U>fUX8FF#`f{aFmVfuZ;RdKEd=0Ua)pjI%D4XnihWu7`zHWLSV0;D40t2{ zvnVV$H+Y$X5N9B?*hVL&X%%@V`Y3K1N7E)hG?LvlM)TmKg3U&mWD-p4l*6K196T?+ zBjhhVf3PTir{fr$Y=f4P0i37&?T&}B?^hF&n*KS_`0VYctgg*=6?SZZD2Wo#IbfZ{|V%ISy8I@w*w6wHnjKqC)hVut&rUlB}d>BG>orfR5{*fw(H95wqtT# zNm`GDo%xaZ>qN1|1JZ+AuQ}3QH2$z#YUJS)aQt@_gBtDn9k3PF^<-F>1uO0Vgr3S^ zD=4xwNhw$aFd0}nWdudo<5O>GId;941&}#^#4yS)cId&zvm0tsZ1ptI`nV?qvJ7c! zqm1#*uT|ZU>xFS%vyV+yRa_^~`|%{iP9P4jtC<*(h!o7_dUg%<++EXx!pYpcph*WI z-J(Gm}p@Ef?M0y?HqDJesYm@#HLCPryz;jW$zrGw$mG>kPAZT^tKJ>pV-qD4BE z(VEL%pZvig^Bs;Wf|>qgp3hl*j*t0l2hNHHEYdkuTek6>^gVgKLQ=`#nR?4+tOo znhwrR#W`!@W?oqbr0WwDD5NN4Moth}r>CUIlEk!H_~GYcYJ|56UZ#(Y&Z@KPg>u`y>50f(@Van0@8Z0bqivhF~qA^rSn`QXjj&78Km{`3bQFKdr z1zzjY!qGyuuA>n*4FV3m^?}>xspz+2ka@-AG_wuRolr=RfioqG|9Ti3EFSkfmj@Ki z8gOf)&Mf?9ALLJy%9IszI#yC;1F>0gU#>_{t3jM9_bFXm2=~4spk(DCY+Gdxx4@^S zT?!Pdw(-$85lX2DKIrvi-jOLbI2T>SE?Fp%x33cCu*+!G4cxeeCs#iq>zYZ7O|Yb zRRzux-p%Gys~u@c6u0Z**C5^K-oF=J_VjB;(y)O5`n{i6gPP>HbVF3SahG&0w+)EChDFYw6_NQIX zt;3Gz*F5Vjq`sqBvG$poxj#(E`8CSL7Y)#rMPRzgu?cl0Jd{ZYWe8OUvrK&N2wS0? zqnQE-2X_6T%p^_&G3y8xETTW%sSUJ9`r4o77yI8Qj7wqcXi}FnAnEG(sPME!`hEW< zGr(QCJ}u`vx#E4{F!Xs1O3?F>>~IJu*2#&c6bNPe$PoYoi^$_RB9)ylhpl#Q;=(VhXFA%-6tw*QJe@!A zkbNxyKt&}8+K?+&X(^N{vckmg^n)G!o;>tic9|C#9XVWhGamYRIxw%W{K?Aw)(;z> zsSQO!>=hjPIQ@=iKt1(_0T?{c26RHbOJUObJE|RX&dmwnBfWutzx3Dv>&Th3>1V*O zONMjb9MASPsF75XNTtxWPk~1-0;1IN%6F_x1UQ0zzj&5$5s2MNa0F^5JaWD56|PG^ zu+sYWq=~iBtrpiUekc6(qc3Yeqyvgqjn#-p#LB(Z$Pp`PTuKxtT=NQ@kY$g~{yo%x z|L**#gN6QYw{2C)&-CN{!*LR}shaDo)HnT_KmXN2)}Xf#Yz}l} zh@ED0 z;Cf_=rtkG8t9DWKKf_|kZ7%Cpcmew4dJ{RIaqrISY>uK| zL<#XhTgd8QR7A8C6#zNH^}5SsH40ETus4i5YQJ_abzl_7A{+jz&xRdi^KJRq+1Q97 zeRlm=SjbMr;?~Q?RdnLSX%Nd%MpP8?jBd7Eo+Pc!6c`{@@Qy}ZZszr980&UiPl(?J zDZ1$C5Up!Fy_(SVIl^?W_2wakOK3tb#0yHoL}vh%!5+XffVB!-e)*`9Qr5OdsSu(Q&O26q@^X$W@UJdw9jXb3)1?lJ4hNUtoj-EF9y_uYX48HIg5 zQt46D{be5WkqMLVy-e%gck!+WA}`}bz{UPk>LO(ZJ;DUcLdfd@ z=snnx9_1{aq>;1_oPe33vBD0iVZ^&OXB)HXy3{NOu#5EN(k{L&KiEL}qih=}O&&&~ zr(vz*k7Vz!GuOVIHha5eSnskZ`kz>J`L;iknE`GQ^sdZs0(|BMDl-tWqOgSDjlev3 zY>05~#yUznHCfu=01rF5l`tewSM@IIMjl68?|@PO>v-#*D=Y6U%lmnX90`0B**2&w z1;n&H74;He9mAWMF-$)-?HYMs2i%;UW#HTDWr>VLFDy)?J!Ds_R_=EnkPR|^FFr6p zX)l5#x-IQ$bfe?Y8ZwRHl6a@U%0y8(-4?qsy^6zf<&0}7W z^cr-(xP5;st=JRS0Yhqid{#1DJPU})KfHcAi7OwtAOyZO&&-iNT=U(k0t$D#ud-JK z*uuwZH6nppT*=x4`e4Qo4s4StgQpFY^=7R7)+=$hUI@8mwktu-!_j`c=f=|{WQArw z{AoN>#dUVS>Qe)JT*Xpo;2zig2!LFIFh+IXbW+D9{d>cJ>S)<;Cv_aNI4f9~O-MHO z{G_4*&tcEKX|wcx`tsHP2oEU)L6)sf$=-BFgeKg9j&xT9IQ(4rN-8RFS4 zR06)fgI17p+zKJBw_lo+dIvBM+gKXi7zTXpxF!#cGxXw3U4@`aq-I4l--ca`0PVXn z6$KDMP1kZe$=Zp?dE;p|jbZH7>8c8V4pFhHXdem-vVoAj9^AsO9-P$RNs>rKl2 z#X2lZN$=9U2(Pqd0;-Q2W7@CURTjZ4oowPnSWB zN&Du%flqvs>pe1ZuHGLXI^N%*O>HCu~~pGA-Ogm#S`mVNQM8C<_aA=9YaNzx1%=? zmabOl+NfWt-%iE-raiDIZ+Fnwnr{sj!D_Tzu^v|;lo&SxJqzYFQbc`xr1pATZ!iTR z7zR&3wov_!@+$_)08pA(-ji&vy|{+$y0li3wlQ55y*GW#V8fVT)<)8rNIvFVUm@td z5uxHr2P)_px_!U0&nm3|#2x<4=(Js@x%r*PFtC0Xo67Sva3MeOSx-3#1$NIH3xLo) zUp`({vB2#3(c&a^H4$M?cV~QDH=+_mDMiTBLjc00$-*}}+Y&;AQD)c~y0+ZcxZHz2 zIgNKG6(r{ziC$0Cn{^+e{^bSud;Z1^odSz1W~Qe02xc3gpjQHo+T!pxKSeeZz7Y3&)I2)RWn>xHj4GL& zX-YZjTaBt&^A!y6IfFU%_3dx)tb389w(hwIw)x?+G#y~rd3o^p)0Q>fe%3S=_a#UZ zaVE8mwgs#~(N3n)G9lJ4nqPx+;9=d*M)wJIISPTE#m`uZfn zPCc0*w>TgQS9{prT9SDwvw>}!ihqV`&_W`|&-z=R_rYm2WrH7bq|fr?(o{r1ssK+B z2L2aG(kv>hQtrPNgf~Pf@ZtnyjZid5k4sJ34!OIXP;Y?ELO*&a;Im%AlL(w-WDM!| z`@_!6Ct(GF<-Z1RZ#`;S@KDo7Fsqvd1e7^k2|N|&XkH_Pdo<+d*2Q?dIcd#uk*{E4 z53shj-oxuOkq4zl<-}s~U+Ji*=tn(1`rz&FZ%ihwg_z#5i0jTXkyg<~MzL(UP)dIL z_3PJ%IOlmB@RI%Z51ZtAQzXy2GY4A<5>G=U&uZ3^Eh*g-eY)XYolt%MLFN(>DNTf1 z;ZueCVSK`kqzWOjIH}7|W%XGC?Zd!C-d3o;_mSaA#?tb#sla{4D#3LJJ8zJKs{R+D zRsQ#nM3gmr(xhXM9}0vBm=0_1`^~Q+`VCiK73|=)&mXjM`%TsaWS^uMC|kKXYJb8c zvqeA%?3pkKd!Q4Ir>JmC<2^QA3$=E`>bN==f(XI9AFf_}h=yPqd8?+Do%LLRnS!d~ah%gd zC9;n09-u{Muu~sc2Y^`Ac~v#bbI(>KXC}t?w3R5X^klOieLUMpMec&z-3=NBZ8uP7 z<$t}O?ZfNvH0-|6t&N|)2EBrU-a{(_9_M|0nh*I*b(!b!wR4zP z?j0k>Q!ye!`txb$K}3ijOq40?v!JJpg=?nFH;ry4@?B9H`E1)dIV|U5qN-5~H=;Uuh?+^db^;+5B7VN6LbxyMW6%Rj$ zoQ6+?+3CH7@E6^9mgn+Qj<<;&Sd=f?BKe=Ncg5Ew8UV*pD; zwxRYyq+N%Ge;{tZ{HqSUs`?}*BjUDs!kUi=Y=s>1n!NTs&u!>1H@t_2eK5bf>3AnM z9^QzR!MA88JC;gSRE?mkt~}^_BjgX8Sq5yWkarC&1M$!uVG7<)o|FXQo{kMf@8_ZX zEE=onj2KH?b0>2mNTvE}P1@qfMa9ht{`6u2xuHwSb)OZ|>hCO`8A<*~et#+^u=Q`{PVz>_TblG_7IGllTN$Z8Q6zU-0)^bc+4#o0D@lMO-bd?uRdn|PZ z4&4_e={S4tvnOU?tg%P8=_kp28D%@1BS%x~!UX|@wy6V98Tm;4#% zXY+gT=m}&1lbiH=!u>_E4lVo!$%PO$^KqqYqXi$IHBy&PQ*Gg0GBOu&ZN0;hj{BZv zg1}8bR|c_AafEETvhWQcI{f)9Ar{8|T6~v@!)Rw{QN$RlY4Hjzh(T7Ff&-i{8 zjyqJ>=VNjNLxK>5_UnIq{T0BldX9F8GnxyX{_Ni4?TdeT`eip?-WD}<6kyNsTtMQA zXJD#v&233I&RH41AFH6WPd||!zO5ie*!Dg^AvbX=bmm@?&FZ)g# zfKN~P;nz~UnXZ)(N$IQ{vxQl8^w4})I}se`z87B!7O(eKA{N-L31tYZXl!##DmP!cEj8pWlcF9J5GA?Nh+bsD&^yv#dzIC8pYf`2XW~yy% zGP@u$a96dd;-5qQ@7l?Y#YkbAD+G7!yq=<_l#|KmVva~RZil>2S-5`sI|cuqfFT4M zqPGJZ8a;P_S@C5d2&?3g4S2S6RL{1q6gJRb@`Dm|)Xzr6@{8LM=Ji*|PaBP2-rQEG zVFq(O%vQs?!W$jRallIb3J$Kjj~teN92}A* z-hHhj+SPDKg~l}p=ra3}<4eFD!H?n~C<|hC%E!2`QdvX$ii!! zmy%7_U$JHYd%O)BD{ut1L2^a4pNd$T8aiI&*oos&%sq4<?}A{*cAV37~YgVRqG^5kvLLq!t( zY-y@a+_~=oLpQYuFf|}BT9{L^mp)ry6o$86nj6|u$c_*rOlMc#Sh+wi^icV|9YD|* z@cC{a@ne+JlYK{DcVCp#r7Z3C+S6%Iv%9VHsrSA~PjgJ;_N{=jhDu4Py1Ts z#B(FDf+T^ib~g%k^tO1l1k0$`ZtG#7#dJy`Kh2kGv7(NDZcn@*N6Qr8=*L@4?x-4_ zR)}$Mjaf9jBk<#>O!~`Sy}spX>bwK|BGK#FWbw#_6`Z|H*E>jIc;gQUCaLp_+-$P^ zS@oCQSYT-QnTeiJNm%<=VaUx4uuGaqaONmgfkHaKSs3lNYl3E0@Np}X*{(VJE43xv zSiW+Z_2sbkK{%?Dwu6;vTTyA1_OU#(qo-)Q!Xi%=YLMUeeBVXn$9)L)8jQUfde%@} zyh?y0tr10WQCvKil_57~$;!^jRo9rTAsNbM5Utp#?e5Ndv{F+w(EaWHGOeQffzaTq zfMW+Pg%|AU;+kWm658kPbrV6mm8$E|l`&^~aob=R)ZOhT2)X9?RbJjbJZI~)QZ=xZ zVO!2sSU)Im&$Anhm23|gd}o_&k#Uo7GGOQ2ctc+!<@ zn1eItW_%jOvgPVrRzw>AKfZ>4$?|rH`&iyz;qjjvDM{83&GNV_Fq0y@6MYBpY~yp) zx`wjWS0pqnAL1M~okDih&&#hHbps~floBa13gXl?~>P`wlyrYYX zx_dHbV{p6f~7ftBOH7@!Tw(Qg~+{*F3sBd23M3;|0kl5W3;+re6)JM zYNGvfrS}#0wR46IO?JSd_9B7Xc6}5jXNrVKPtWNg#!fTb)c0;F?_ZTe)?3zn&pu=y zUbnkb90;`klwR>CE!-rVS|;)f3=fVmJg}bbdiF#HP$#vUyh_$w8}4eQ!3|)z0N0v_ zNs9!lY=GqMWs^PAwnIP)E?Vp-#i+pWo=~6sp;NId zet!>9>)QuK_&;}((+2cw!(4XaegY9cU~vZ|z}agG1cLg=I!z${@(fHt@?LV%4-=zX zcpqbxKMQURD4v6UKhx%y#<>8dZU990mafSfCqFN=^gNMLlBF&yJZ6_SEVoqCl(UBNZ!VWfw5$W?gxUJ2wAcYM%WzxYH%E9>RaK+MW5;XrU^4fgd51@aCztyBLC^7{ zz~WL^!UhRz;aAuW>CnVPk?}ynd;XTPDV4n~Ln`*EbKJK)0S{`H6?v_s3S(n#y)}$K z`(3gw8(PlKEH@b$8K+hjMnl)8`v0tOsy_|^jaAs1c|YZE6(vE*bYO{ul0jfFn0ASO z^Mkju$@X|NXzRHsC^a?pM-0EbB9n89Q>FOs{+RMJt`_?jv}>hTTV6Y${Mp6D!F=+g z;{&7IbWP$(;HUmmMSgh?MPWiBM|*`@=HDcqA$t8S^x{AQ$!m)QbwzE)M(>gs0v@@5UDh>s&>`aMMN@%{a^M5RTrW?DSlZ5BW_x{=mVH^nsr z2_BZ3SbP1et58O?A8pyy@?;EaZw;HMci7irL}2kS4+U5TzGbVe)9cA<%~b^kKT`s# zEPHdJgHtJFFrPSub)cP@i~k8U2g_`Sz~o0!_RPw==gxM*Rm@ZaH)32URVpcLQSViF zws6-mEzIWkzKA33CVo>E3h$?b)>l2#pf#lS3CpF|*%Z;l!(*tA06()-7fKid9T;O` zaNH7V2Xq;c2V6@p$Ln99C7*C%GAjv%Lml=w(4M3h8fI{cx<+`Ry+!d5$*6F2&Y8hS z%ipsd2fd~Z7a#=C`1xE~g!^=$WSEYz0tpNif}8K;u+v~G0eJo>^g2tTR6=Ri4(r0Aa%b^pffo*2bZ^yAMq-1W%j#8 zKa6JbU_1IBeMGjq+8evy!(0~=7FyKN{g4Ep!O(aM)!KYjzUjMa>)fKvVab;0fD70V zXK!L`d9x9N_${c&PkpU(f6P-bx%aZRr5787>Evd^d457&$it3EIe=zJ@?~d#Kew&S zfA+rUZ9o>>cCTTm*q1L{85zVgkx=SQR`N^@-KaZ*%JzIW?G}Bm>FE#84%*I0#Jn9Rf!Q3^(eCDj*)D`8up_1CwF| zHu1f@+hE??&^6UFP@RIt60~cV(NDvW+~|f6)eP4~^nP}F{mgwXnf%r#X+iDbHjU~i zN7r`Dn%|Zph+v*#Ze{C`FUk}=O^(F~^AXVGrfV_0n@LD0LeYp3HLcA&Q7SGaUNTu? zDr<>C7CxfiVAoWfv6fHv`}rPLQ1G0Oo-SF@mxn$fZXk>0qob3csS)`|3+>zIP-!_^ zvx2TC*-4K~u2z!ce@->p1~^E7fA6~GnWH=pMw4+oBU{E&99N>GoCcfL%B z4*2YLyd%rf(5$(mdK~*xb$eSuRb3ZYUrseaO4?Fs;EP@TIj%40YF*-~glIWuA*B1z z|9ULNNukURZ(MIwY3J8Sa8KQl2_{Vfs2ixaeQ{h)C z-J+5(1VVcU8*4`%5KdwH$nc)Lkm8pymO&}S0B#rWam?{_x7*!mPnFKstwD)?{IKsW zRHr-X=th0N0(Z}=spIJ*lAdwf$ovmZPJ2>eTqZ|LQlG`gr>3iEtdvnX5A*qCPI{)rLzhPiPz%;`?NDMY)apMWag%F z-EopI8_!z2Uq@$D8NwtYVAcuQWz_glQt? zz+;SuCVTFFf|kFJM~>p9evTr)p-)t%h3sW_F4@uA>Q~#~f*0LOh6ybWVbv*k1w8qs zssANHO7cFO+*%Bla31H3HhaBvxKM9Tg8!o_U;j&zb0HO^KraR}rXuNZeL~TY4Mp7a zVDG?`4yg7GCY{&OV^sOfsAG*x=1julSQpM)@+K`_UhpkcO%0mQ$zU-z)=A^qi_{Vj zqY6{tf+npoFf!M4g=oo#I$#apYisa2O4!Dm9En|+VMU|g5dl?wv%MLqSi=~%>kzD}tmCCom$?)%Vl;LK< z;S7fjeaY7Sbfy51RupAy!^PJdZI5P$QCaG!v#;ynDP~55T7tyq4199~7JGgz969wi z>%Oa#ST_1h`?y4+%xTZRG+!!y_-w)i+qA?fULPh%tMr(Ly}h!r`7PP;4Zumt zgoB9`yjQg3Uv@_jBQ-WPud+T?{3BY*_CRc;pZj`x{mn_Pd?j=0@eaGAq=)Sv8!R#( zf4Awj`-(ERary(=aLF(2)%JWRoc%7CRzgh%VpK=F$(B?ViSS$>U2@EG<83FuOv!5L z=nmQrOPa&4?-GM-XyQnNwlp*@fPK+rlQ7b{$!AMRZ+Zm^aZnANgf{U|1jXwfg~>o=*RKd|qji z#Pi+RrK)10c8#UU46;;GcojXx%k>exz3SLXk;%m)MI1XAvmY?@26rasIX2hWFNII9M3 z54`aPnLN|>lsMcnl^PC&^ImHGATGPkwK}k1m;(O1RdQ!53+0aR2no>lZXBCGoCu;KY$(oh7yI>Q58Lo zEgad?=ATINZxD?4Hb14B-a1!Qk`ej}_{6Iv2NvR&e1c5&OkF>(S6vQ(-_&OnAN!*6 z#_8Jv4^$3xg9<>8Xw`gAG>k1cjAweWLK6Vu5~velA%!zWwy9DTldnl1Glk^-l7jkY zKJiCGHwQPnu9YZ9$@xwjH!e%c3cvTm1eFq1s{AxQ@w(dKnAp#_H3r_VG@y?*Oaa^b z3p__gAJhmRn`@@(U66(eSVae-Y*m^jFiP*IET(gv;yX^M^m!#Kp7rpwJP1uYNABTZ~$wZQc3{V|i1$)1t=vPwoX-4Csb>FKr@#Ts* zE>*dSun(Qlz|Lf`axyA4{eHk%}?QM<{^(^&$PoT4f+S%*?-Nt8PrN?qxG+R}IdI&&eW{K!)$Rs`F*XIHNzY#XpqTFb zk-7jx{q>`yx%>{PGXutmNldVdlNi~Kn1w1`t#8I))^U;-K{xvN@B}fJd9E##UWv?j zZFDY2m$u%4fXvzEQ`UQu!m3$ZjP(=-u6tXYp;z3oe|mq5zEyBPeho~c;yO>-j8292 zbP=L_(fBfn12)0uOSl1$KC6Q}2zWs%0+`DS+S4rjv94q=1?1-)A5>@b2OxOEb~Zki zmw(!q2uhqLYq53dZn?{s^N2lS)ua&r95G;nAf3f+yQu$Y2|iG2MouAeNoXeo@=32) zkd#i=6f43K?v;=w8gueUwZ%T@?;7HKcDK`=*OtgyN>x_;z<2l&wlw=QG`100F;IOu zaTJ&vfI89b%5Y`KT~wHgN0|TKsaL!0T?yY92hk%f{tfGeGG16#$B~hcG=H@=aGKqZHyQVzAfI3BqqZ5j^A!7w544abH*)-KC7uU{gRtZ zMK(OKfE3BZWn{?dHdLs^@}|VXX0)MU+a0xbuqUEG4Ig$3kOy9Kqpbb~6IQZd6~Wx+ zJELTx?B-<8Io*6&gSI^;P|Yra!ATmO%yuMTVSf4>(g0RbtgAp#-@ zNH^%DyQEt{K$_7YFqO^`(jd~^4U(gg?(VLU4p{v5{(P_BU;Agfw(Hq*zwUFN`<(OW zW#Bn%afu=X?(0s(1l0R86URT;s8b8CBB}rS+}wEp_I_Kf`l%a_%0Uw~e*1N@RNt*R zXx77|bx!M^yo(v1)Z%A|cXH6uY5Jz#si4_#?c<2tkNIMJ!Q~Xv)xs>C^n_LtUw{5b zmDIwRdS#jdU2vGN$`B8iV3C@Eyh?kG5JcKiX5_L4g0IQE{4%k99a&8K_-_MBGPIFRM zs;D}scICG(xIt(vsb!+yRDyefrK;PxHPh?KF;jG)Eg?PtY1TpbwyM3J4e@*mpG{mr zpQu_!I)~Knt$GMNNj!}slH@@&&nExCh2g~phAhYESfO#tOG!LMN%!^!C;O}B^xV>n{&^F4_g?upaN-k8R>^ z4o9`P&nXl251L={UZ}b~gnhxkU#1g%2kB_Nr0X?m z@gVZ9_{+7oM-DLg%f+?tq2pYrD;T8xula=uewJ-7PmqHh@#iTf^3&J;OLF^0t*_}1G&Ly^*kfklclcwnN@`@bH1_t*CT>{%W=fEMpwm|3acAfi+9+z) z+eKQK!Ob3AK=U)XXait&A?5ls#03(z#kd2j-RykxtrO7j&ZBoIjC}6*0V5>5%+jjz z%ggqB^W<33Gk>VE_o?{!jsQK;PDt7(OT1lcbDa4t{IZpAZ)8vtY3>!XWCY#E($cRw zYL8(ttWQ2(WC=$Umz6;aZ=%ENJE+uYiXMT*wl05+(#b+6|D)Wka?q|YU0vOk zV(45rk-g-Y{+mkl=0;IEx}Nu--stq#pq;6paygVsvNr?E9CJ_p4>P8)RHk}8g_^er z|40HpE2tS>KkG4%w7-9B?ht#1629Y=2>9=0=YvG-8wNC50X(S?Up@ zsI@q)KU{Qq<7ElLqCL6>nWgyO+-J|W`^VmKYDP!5XQl}4dYawb{w-@@i`;pxdQ^>; zq)cXXSP`z#cdO9GYu~i`WY*WIm!}L+di?GtS z>>bzs)S^(vr6>3`%U1Cdd1tVUlc)ijb2-8uEc8iNdvuhpwRLilRUy+6J`}`gDG5N+ zuVKAmBSc?+(_rqsscH`UcdyZ*cnuCFAbqD3rqxTaE*gp{qU~DOYylRB(ywU&421h? z3jc-&4j%1{RS^EE-ooKM{rS|Kamr>>Ny9UK15CvmE)WT3LlI>%-=+h5!nCCFoY1?H zho59kZ2SW>rSnlBGSH7oNrFYf&nag{u-s9sF=z0f?rq%CIP`GgFjbeeu51weWsYTlG zZo3MCI&Az8E#Leqxy1*7?Pq}A5PJ)U&Nz?E%?~%{r|~iaudejT@&VzWNkx30sU@#A z;Jr0Anwaf+8TB~nJ6Q7i_{QbKle|zGnQJnOANy_bXw!I|7wUJm=GFRSps6B%$|LkE z1;Bi`RiBX#fU~o@_*I~WPPE9wo$enp3vRlC87AFKCG{j*9-obunvb$z^vA8<_q*PW zdx`G|N_NfK0H0r^EsxKIPhT^ssaY@dQZlrniLoo)RLV zE;_RoNR=8rJv~rN((AA9{sV9RWMh8@-)sTJzB-5r>1q+>2#D`=4t+bX4+#?diS{Ob zPcI?Y3#zXzN{MZz99*yL_AU_VPY$KU_jeK{t0bdVS0ldTnZ3ytzbA!&e`blQsWsf3 zeTJX?KrNeIGe)2V485G@CWeV^1xu?~On29xGLc+jD8*QYgx(n)JTr4w|J~!}=i`+Mq*3>xucEB5_4$@RS^?VZ&XD$y=>JTT5FTYG;U{ zE~a*IS^EI-VNP=&@G>YLT$pz>I!XyiUJEvTu`ey>wT+<7rtJzwuxY5Z^JKIY(p_Cd zDb<3#LpuQ=I$6lIM{Zu;@`<+$o7(RBjg%nKz#>`#YJNW5fCQPaWmtShsfeK*+3@iE z7A0M;LSMoxKW-A`bfL5ai;e|I`puaa=N6Ss1$^x7&9s=Zhp?e&ZCO-s?0zTNJ=)_} zKl2KEaK_ue?|wgzf|Sb$71``jxmO65$y_{sOQ`2_JV#Rg)sKj7zTRybkL0H+PydRH z!)a#U&8jFWC>24vlXiM+zDJVf7=$4GyNuv->xkI^zjUk^zfI8qMxN2khiij=teZ{) zq1}ujNVz|GCM-Ntvm*>fbqC>`GOOQbQ`B5bqF^OP!5@ZJ8Y&PZJ8TW37lkJ~`<~i1AIPtiuUnq3gr- z=v6vQ+j7rd@a~2z7{?Soh~LFjCjD9$SDL^c*zlL+J*b%yn`3;%?I-&>L7P{Z)N-}l zFv3(ji54>Sqe^peGY&w6$aGY9V&9qM(d^aGP%xX${Am|L+XdM@0-&Y3n= zP*0+y^uIH^71cnJgAq)1BzPt#z+Lz^!r;9bQG8I+qCz)(Cg<@i!n$5yU7dXLjbuMFxMT~QWTC$imLcT0G<) zUszV+=Z}7KG+nSrb=2R{n5j-z(|RaE$YYzw9{u>y1Gga-)YqQEkl}#|xwIlE`zxn; z9k0-p86CHUR|{Z@ZZI7V_dXry?c0hO^QrF2_hAm;yj~FZzILCtTEk3U8Cquw_=p}D zf?#W@vXRA%M~bRyRO*Ls&`Wl_+G}ggC{~Wj$gSpM=3X$(>?aqsIdbAtQTTc-#h_GJ zSm!os{mTJQ+u&RptF_#?Cdy-VQXO;1ObV<=9%WNGwH5Xk6`s)qwqADfEvBBLfgQj;QM!ow)c$85Bd{(CtfRx7rjZ-4YmKn_H;+CzsB&vf zS4#$erJP4&VZVy2E6bV$m-awv5*qlzdA%DBVMRe{j$_9dxxn2=;QKKp_X8Ue;51Ng0@qGcw!?zd9@mg2C)w z)F{HCxtW=m=-|=KbgecObpB(o8hxgi1D>#USV+8n-YmG}8)KODNBc~tzwe$S^Wq2G zFlVuSX>_PZGPuFLPHeC)5b8%CK>aSX5vU!5Vrc;Lc?~*1O|{?Bg*N>9aqI29QMKBq z(%k*Mu&~rrRrevI^wy>R6!Mg{!Xe+T(cU;XOo#&!Gm>u*3n}t@s3LQF`}Ozx?-<^m z)uv@y3pLxHlETScndDXabTdKO-G9P`TFu^M#)ym2iA>-emddEu<}=rMof^Z) zlk=fubUD{0Rn}W+DIm0GpOb>VT_k9FwT!d$EE-k+DA-?^uM%B0$a7Je2&Nvgn-uWt zKX+nyLrW9cyqV?4@rRzmpOXam;*(%pA*glmt-L|xcxv4eSmbyxNhk_83aamWeaa2B zJ-~5#I?XezamwFqy;zx;%+v;6`L31HlLFlQRtKZ5W!n4EVFe$~03)PF@CM^;#vJh+ zKhtx^qTG6i^fcS@12cli9#J^?ekuHx8yePQo9w~iKKHDsu>Uyw+0~V)?21kTa8f%= zeGAye`fgemR)vNEiru(nD# zso(uBK+C2wIyvPN$vnDAXBoQQaPJM18_7ZNEKdDgOvU>~QqljbDl;lwj%sjhq@kIe z!jgG?;8RrpO@$9!e>@k3>zq0Gw|+1G@@vawb`6xW-~9BOF^jVzQai$Ev8;Kbj%LX4 z90@>j@yU}?HR`^1SP;^RwT^KKsVCXX#S5jsH=-LbM-=p?OIg}wzDzsU$ifW*P%7RT zXaS-%*=M?DKn&S2^un$3f14dIH|X_A-()B|%6Tgi3dmU6!uMV6WuyYRjhclcV(w!e zW9p-+_0y1d2!<`vm*G(`(YC5mFPc+v zDpSOXSYXF%#uwmCer;`S5prtUs$N#W&J&%m!==vvZ33|5y*E30Xn}{5Q;yR+aIPos zHGSR;m|`3aod&-`SbrWR@lqSz`LTHT0jvabMO3w>3dhio2@Y;KSV6LHx+fIt^@7D4sPNO#m zkxzf82T|}d8XY&iOg4`E^PQyLW17s^=v$#prHnlJF6iA!sq&hOUwk~@orgh$+ZH*J z?9Q~;JbQPKT0rAA=W`T@t@rU*@Z{AK5$=VhnUJYS!k=#9OO0=D201HsbPgY%B{x%z znj!}aqGRaZYuoHm<`$M_?#AXM5&cP_+RfOmO39F&5&4&jT^2o!P2cER7xF_HV{DMN z9eLhE_krY;%tDNEU~^*xXJmJeNLM#{D#!Ww^i)QjoAt-_;puBrY=MI{*S41 zy4$5N9i^dgN5LYB%rUA-UyK#GHgV~h_bSPfK7_w5;pqJ}Fy7Y#ZF$b*y_Y1Tcbjq~ zIkgr>Jkt1SIsLVu^Knmy!e~Ro*5z=f9;*OvSr!y>Rp^V2yUK9y7KfHH<5tH44575| zb`?90x6xAGKPA-JZuqu%Q;Se+o%AH&U7_cwx^i6v6EBWA@?=eY%-R0D55eNV7bY<> zmILL_mU!NFy~CT_()RWT)xVB#A&7HNu>jtG&`gC*t;(8mQC>d2#9~nm z!@t4@@}V?jO?Fq$-Mh{sQ7X8Ii-YwXSfBLnuJxBZlBh{dMcca+_Z;UjuJW%S1_=j1 z0AnGNHWIDl1fI!B)6of`_;+Di$+1J_1M#IH!efsFNMu|-)TJS{B@YjNJ zBPJfpFCW}}5cqz})t}Hru4~8tQmq59@N;HVuo-&po+b{Z*e?ya4kfSxgxg&XcP87K;Gioids% zw;TOPc*o?O^|)*OL^j!g_gHwhzC_#-*4$@^t005sa|?ryiQ}Htt*|n46rpjtxIt5G z2`+2UWMpRgFj!_+qg@dLIodGC!*ou9c~_Rf+uR8%caA}G@uSW-RNf(Y;II?>K|(pK zNtkxwYPPQC-vyDTs%>Urs!B#}&&2XTuLzCXU^-2VfxRJP8_IWs30o&Y-rQ>Pem-*|eY8FZs zlLSOfOr%?B)$`$zU3oqHc1%>li2%dm-BPc5tm6Yg>H$%W)<$sHEib zGLmm)k1&=>j$6TXt*oZ{NaYWanATM{>veKh`(8{Wb&I^`QQPmsX zthN_UkJ0B7pb*c*aaw{iupZ4VT)-vb)uV z5>);tJB>|PqFoV6l31>>rs)M^WT&1tRzZ{WnfsNkFmH*EZf1;K^2mL0=&dle&1?COC>Edu zub!*_*W?{a>|>hcE69rGvQqQQ5c_T%ejr|<*|`$dZVa}3u=_yG&pd{4%q^5NG3=V( z`Z6&@?)~Q~5u=JwqH9F+cMOlv&W<$rS)B(8G(3Ybg^YMSHq4*)Uj%BjUd{=?`<17z4@M_YFR*6+__moi?2#~l+;y1wMVS!lm zdSQOE3rX6m6t=rf?9zgD?u%A%?fOnMaRbegso z>k=J7o$ux&rpLh)>cC<^C;HUwZ*~*zy#K!xpYx*5nEi9~n_niAk$_PaDob$>vBwC- zWjw&w3r|td`TG^*0C2PFABz5_U91^aOKP#q7#L0E@k4d}pNEOx{o@t1s)!k175%vn zTHo~$9YEv6gTO)?y6x`5F3Baz3 zL=XYdr@*+T10DZ6XjQlSIEvJrqwV6B)GVlO?f$(-)mOUls?QP*lY!Ea@u18O2Zvtb zLo_>oDNAa4>CaH$jm8R@tvS7xR~w=r50y9*{$HsYPklp&)^&b07F7hf5|g}l*O=ih zm2Siv#WuwKx3qxp$41>u+iDubL-gD2-b9uWt%wiRpDPfVmuC-USUL20pUwH@1XxBi!CChsV-5A=F-^PQ05PWyXmICpzT2qp&-vn znh|v{Cu4EVn%_7I?N&fla|5U8jcvHL_gs}-w+!&>@RzDAI|3V7#OW^kCfh;PNvd6X zBYNltxCnQs3w1tA=V)VTK?#U%*>ZG5l7Z~MUgs%(x6DXao~xISm(@S?+-j%C)wEo@ zYFU0K6yM*jWu&ivuP413Jk&9zP_BSGCm}V}KB5}o>+}d)0YE)7XQV~^z3J)*c0?Pic;XW1VJ2$Q4F>HI6Vp~bk%X(1Sti>XvRbDw6OYl#%+$BFUgHH>uUD{76R|@ z<_FLJE(%m*-fF5-^=7pGCphGf{!ct@Z6P|_;@~71`+{PW3^JSW9x{U(+{hkkw8j>3 znD7&XHUKFIfJyh}4C!?8{ept_P+EP0?fA~2-xx`+13?((QY?LD5V0za>wCS3qR~K( zh;n179M+j3WBMkLWwLy+XX-?L5@KXiTXw(rdFOuXohi#cCxY+Zyu^c7KdX=g9q5+~pp?wWf2Oy-e;2ojea?N;n(zDZVFguz1i;Qs{_@JI zT$VAVQY@;lV6OL(_Yl6(7hw!RA-lMusQm4V>8d~)<0z7D3H4vS#y z>Hj4#qE)xg1V1+gLRTR-TMp)6wm_NYai=pmGkG3iN5}q}qKQc#18(kzDIVUiG3pym zcN#HU16-1sz$H1OAW$(vYvmw(dPb*l$cqBN0_r6`dyCeD+cd`}pbm@C(P@V3 zEDfD`-R9~uCYR$sSZp_cYg6Za(=LNb3CP(BRoZt)jXU+Xh8@+cAMaVA%50c3upJ2( zh(qioVKRrVmWP2dw4RbIrrmprRd8zW;X~_#F5BH3kXl=qvmc(Z*@j=eWpG!^&Tw(B zIGh=$TQ+YKXw3@0S2w(6djKYEoc~2L9V|ojuZtNp8?7n4h%hZ4bu}{nh(9 zGzhpr#wK2XjSPdDOWI)OKXEqCxYzv>Mo&uv!Zs-PJKu}@9oNgRyq5o`1>4S33XPog zk30ev!(NdWw4#z4ywseg=|D51hg|5bn%35|6(LXTo0?qin7(pu^6&z6bd*=gMCUMD zAdbCqknOAt0HmCFbT7idi2ve|VhzH&E^7u4U(JL?y$wSXA%*;^%M)3_9NrdEScHdN z_SM#;f^cD97_m7jKNmTht|?beA?DlQV1IC;rf`>Xp=+i!jPbU~XIiddHcPuYX)?C` zfWoieVsXa&0RA|awwRbQxhcNMOE&F}^g0SZQK1H_a2EBx)GzRoO0;98z%E`{rT}I; z5c+Oxfsrj!Jlm7iH1nmiMA29DVJLbkXEyAM2KBAvwdkLVogi3@i$5dVuYb-v?(Q)` zw+90mJSg7#!w>JbYpb@Jhxadz!^B$qfuaL6Yo%}WT!#if7u+83gmd%$-#&P39uavlZ>t{w1pcjpGq}~5IP^JK{ zC0zJ=-am`o`|exFi8C=BX%bKke;yO)!^xYEY0_BUQ;ji<rmBPs1it<1Xbt<6UN$O}>{urU;3y<7yBcNZ4X@$FC8 z8TiXGTn=AW1nNlHqyOIhCfY2uJ#+ZFPyU)^1E!C%cQ23Ku3}Kd9<}|md`44=O59Xv zaX)5hl7!r7l%5YHyqYxU_2vT0Y?M8Eoa*ruALtA|usp-ZR-^Pj8~cRFOM&JU#lD{Y7x68CJ!T=aT`C4lybImS zIJ|2{0`NuZbMY#djccYB|L}U)93KF6mernS33un9#88h5cHyouq70RO26KG>TR!jV z%C6W9y^ERB8C+MqId^@^nUTMR{cbv*5YZ5aDox3_O`7X6a9(4UbjtT^!!|rDF}5B9@?+FaqO};${uM&2pn#4E6p=gRBye zB(!XxWEi}~f}xCs0_q(~E7%-Eh=)%F3oNL%sxnFj!L{x6V+HQLCB}uVTN>;iC67Ob zMf-?t9fc2Jo78czp}1B5;v|bU@1K6&s$vCTrVzPaK90ZQWgK}hEkn2n?fn2*Hx>ga zD#2UMlujw+8}k;8mQVnMzwGIV@wl&S^XrdDB9pS8V^~A!&xL{a=zCKFxwr-x#Nu^bInLZ02IKy3cJr*+dexGZAY>&*NXkAc)Ek0)& zz<#0|Umda1fIaCjeV2NwhhNubnO}Dvmj}Z2R^VZ~>{IH|!Gh#yHYns~3e-Hn?Q?+^EfNqjp`Fj8&bH3afHT(MlqPL?rVRQDzgq10po9#-@}_=)|%Y# z#XDV}k0V`Q2_nT+GMc}%(Z6vYdQH?3^qeO>r@%56w?qE^3R+TaiA!C#Nz86?{_#KNh+=caIi zty!coTTJa3^k>K**?dnoj+_OtxQz z0fkv~EdrkCuQPTg zmgJVb*a7P5h+G#%{nc1Jeip$-kH%8pFu0k zEvSMckr?UMD1-pH?WiAAQ_E1zO;J088Fn#t#W`H>y0*ZT?{v^2S~T+;)&tzDmA z3mZ~#WMT;odr6)%uF|8RRBm0I&lBz3Mw6E2iNLGQ+4^K zY{%$4F(^ko?w^ zA!;|gECci9$HJ-Kfq{1_4F9#(_$8ow@BbKc!#1@SD*AUREMtX*ZVaqqRr!z*6-+*D zp#c>!20UErO>3e;qP)Pf9(+*;BJXUHwo>08icsBy_3wZL2=!&gAx&Rae2RJp4qNa^ zG13}MarK3CJQunlC4a!KXQzLI_BmP4I{fb-8l|guu(xHy=tc&FaZk@>r@#uQ=C2tn z+&k#mbVO6*-qhf$?f;1*;e-lx@h0kWkbZtmGAV zyW8BSKTDeVg-a0tUGrFws=@1A8E}2ym)ic%!+onbvqtghvYv=#U(j*9OwlchjYn2V zsEAbCzl1v?);R9HA^I@QNwPW!RkY1wZ+FBu3*OQUR7Vqb927_;dy$y$8r~KO z`P^0tVZw8=yAdYIn5`W~vWk(I$CrK8+xjN(+-m6$q5KxUFeRrYw9XjTdy0ncQN;}A zX2-=kF|*>o>S;4aLV{3I_9#r}(`ICohM*|{ zrcX`)I(qz$Q@oxBOSztUG=W?na%M`SRi_5V)&Q7)I7U=>qLPxiMCJGD&-=Uf5j9rc zK;Z@*_IY4t7Oe==9srM#72z_mWQI8pP;Q}3 zF(Z5etw5m_wD7G76a!LaUcuFP?jU`+nP%g~Yp&@P7JOcJ6bu8oV6PAqNAC5xCMsoV zf(~@L;wqnYh0z!s))>}dmNga(G4I8dUK^l`exTF|8>_%WQC?~dB_-ve^Zn$Obi-hh zqEIULAZ+9NZ?V}r4V@H9V75_`ABx=fQJsQW%JdpD^9~fm^LuT|AoF~chxPGax@5<) z*aR4>Pa>nbVqqSl%z2oKYyh)oDfp^z>cU91=1<}{ME37d)*~@2ic@aPS`{VaSvQQ) z!H8~2qv~=C(-01acuvEGGF*F0+0{2q15(FIy}jW2b^K1^{E>+Hg`4a!;O6zb>UWwu z?_xyBdkOI+Q3_@WjNZ8bFf(CPDP9=)A8SeP^uVH^RgZ6QSt<^2J2Pv%vU|?3o6u&U z!HD|$K(vBWFgo`-quqtL_G%?mKW`pbYDa_y$t5g=A;D$a-Ip$m^=yw*9?=m#<(?dxlsNyzA<@1tf2enGN!m zI=ig>_{&kR6~>dhk8XV~wksy=>L9C92#hH9aw|qM&PipWc)p|1nnLl}S(9F; zxtD>2r=7iYpvZ7-=HvV2gc^b-U&a1PBr?BN#6@90^{%Kam&GnBOt6{?{m;ETkR-O%{JXItBDMGb z5(3zQ=o!)9$v`1GjV8U*g@uG$8!S{eKs}Vck~|Tx#-X&Z5YNrUZ8%#n5lk%o1xhQn zCDU(^>W=fQ)_M16pNmqQ{PcTxBBepNY{zVlE`qUed(j4_XQb9R;6c1p}O4ipBUvk=C)p?DHd&K zA#rA2bRQkpF#v) z!hcqIlcH-B1r;O_7t`imO#o~Qs!u^b&rWwL_gt)+39T0p%6&X+g$Kw z2=19OiQ?7i0txmsT%ei(8mkTbT?_1Dgow1Uk@eJ@P7gC4q^+db>*rTTK<@?K3O(J? zIPF zuSv;O&fApi-*#zrE6PKTj6j)YtBbdnHudlDD1-|=vytETI%J70F>$Lms9 zX4dX;7V&TGYV4iD)gQ`j;(x$ZlxNFDDE;pDb;)p?lQyz7d&-Q2cp!><@AMaBo=eMb76YpJZX2;wE@#*It(>I3s zav#DBnI96LB4bvj`%5N0%K7RU%h836yxD^0iG!IhcS z5v{huRP&Z-yGiV>dqryM`yZtxA-{tb;XexovPbQ{u{b+AnxM;LKWCuEEpAi7QSOKW zt;d!9^nSJ<(WKo?UeQxO)$grd^oKVW-!W#P`pE|1+W7BrvZ#uk#wI*&J6*g{E z8%9Dod~is{sOWp8JC*0}_x(~?PW_#mB;6i_-;{SPm`E8l-_kdKAiv}MbD{qe$>v|s zhkzG3AsDgWFH5XRaAQ)6cCO1HQdq=0Bd<2UKM3a1H6gBr7H_+}DF4aS;Fr>?x3BI3 zv)~yo(?E*q`3MJDKuGyoM7Y3Ks3oyA``qs_W{wat*)|I4wMHVIKOfd=0<(1VbVqJQ zyazLu*SqMW_)Chp5?xkM#BaE`WEVh++-)arY0{}X0iE|rsv67|Z#cq15q4x_SH$>D zPnZTshY65VjzsipJx3A6qFs*5{}>l$^SUu^ukKTq%8JlAv%knXO%+mv3N~+5M4=OMrW$Z!DP@ZuKI<-+MMyQSBQK#nH@5 zNUajuHa^H3haalMlU`_yNn)b^TlN*=c(JLf{tF91+O5HeTqGccsP9C``M;yFpecLB@4-b@|g`I+KHAB|!H8~4;t6RQ8I$66HhpbucAVx% z>h)^#&I#G5ofj?l>5$S79oLs5Q!6vSU1&Q!_nY!t3!fLb+kPI^I^OxItsd9;(AJsA zgS>frIsFyPEFs}79YN%AX+@v+HuuxU9lTegHZ8zg(a3nYpsh{ilB{;@%8~k=3&+b_ zEVz`5AVi*!glB^+inqhJ!hL3~lDhYshUg@m=Xv1!*ED@0ef+`xeyvXz>=JwS6w)_2 zSz+-UsCmed2quZS zew^(r=*|A9qiY(Z#FeXb5YD32f~$#MgbVL5o}Tnh>2QY;h9hJ8z=erl%BzBigP>tP zqLKu;DC*p7E}p8m7qY#(pe`CARCoy3YnTxLk}FRiE-2xW{N8~Zjd`1ZbPKsp95o9U zVHXq4XRh%3@h^|`0{5b1#c5XGhN8y5SumuQ*N>|WoyV`Xew(+QgeL~5yo(Z2jUIs? zuwVab&p$kdJ~cW*F;e(W#Ql7)h`RX={my=WT;kim?nlkDRfr^Yj~%r<)ObQM{CFpS z?0XP-L=7mxx6F=;HvU&)lu?0?onaTXe{**2sL9OJ7qBs4LKveM`qLyA+_m7*q?}Re zBRG{S3AQa$VyOU-&Rm@L6O&*JU`bA{)p02nnD~7>vfAIq?0s&^vt8Q9mYFWDs_L{% z<&u@sJuO2Mf@4griJZig;Y=1DXllmyZr<26{zOC_8e83qEQca$_f}LoBnRRVFQZNV z-uRd;28YQnbke~1s=viZNl8RMq;@Ku0)Od-Qq!e-bx#5VUY_q4A|Uxdh%cFrCPA0^ zQ{*}!%(m#+&5Gu0TazZUC5W?5tAG*N`OBR{^xErpRm4LPDHX|~xgd{8PBIjSfhasfU~g=n(&QF{xVyY|#12*5azy?XX^2Lz z&BUB;Ub%`a7mQ9ZoPh=aP^*bsUX)+fuRi>2+l%?H*Ez#sgLkBmjG`^Ky2FAisBI)b zzPqCRQ-Ndi4trk&k6ZJp+(oDYDj@3m4Dj>EM`kB~shUF<1dpE;In1}Dd%d1P4bNG! zSfi(j8r_8PB<_K9)CwMPqMm#5nkfyHmOP!?NKo=p<(li_1x@s8Dig?)g-mQ&6lFDP zaR-jGy7pfWBS|IM_p`mZb61sjmc3DBe=hnn`W3e)0h;CkqY9sAhjlLxtRTY>)YX7d zJ(j<4hO|iA-XV!T0Be`dB)9UJIiWMX}L>_&0inDF((@|el0ovepc6erTE8( zx1rxBN8JOs;CtVjf6Z%Y!dz-#X~C^HS*I_PJ!x?V1O%RB6aT{o+iSclExi5hA-2oH zehmo&5>u8H-U1d#AE${p4^#6mox!`%J}`n1V}n+h%;rULUE(wU(DM{2o()fL_g*rB zqPD9Dv_JFRFLh*IVi9d0od>PN$O2n%rwq4$NK?T87>|Ya?OgQ$sP}C=@Mf`Q$B7Ty^(NEaS>dmLqqcZwMEQ;PG?^9-2)>_1^QUk` z30>cImkjQ*P_8^W0`5ksXpiu5PgxQJ7O+XP47j`DEL6yS{yhG2n~i4c;6A#p6ptnF z@~K$#za%u}%+Zqa+qtg5e&?F&?6W-UR431k*05?pDj|BM{`!C5h^_IC_R0<{-;6jG zX8_4Zr>ws4_3mk~Q~Qy`zsxM$8^+1EsXihVMx4i_4hg1J9qgvoRD079kUFrVa$L&tSy$$}WXqjciFu8>Ue%Ylv6Np4Dc%r8CV$aNJj=?>3^|Q|`RchHLlU$hhjEoD z!XuntOu33o!Q~!+)qKIdfrYMS$$!AA;jWBrx7(uFl!PN@oU9(aEfcPXaf?TH6l-u! zdsH{)0-2k8NAvOJ(u;Zgi^uyB@F{b+>t-F}mQ=JH+dz@ECZNTg|#!TF|>Ji&}`zQ+vPo{ z41WKHB%8GVBP`Bm?XRiO_>2@Y7Z9ePk(g@48$0r%PVp^G#dwdI(Ywd!L0l=@SWDvH zGnpj*F)XnY>>eZv0FKL)H#|<#o9>#l<*NPt7s4cvQn`AZ_4kW0N!kj}-tmQ;KYrq* z=K1zT7uyGCShv_4+I;-Xb;5)PQPms_Xt z&Vs-{Sgq{FaowG(GlyJM*tiIi)u5DLG}w|j|1Dk3GgM#?+g{*?hV*=`z5V*POU31I zh+`3060vGYJXnQ8RHiK7+mpLPir((lzhLH7c=6{l8-V6B%w-{oy{=}7y-a7g%zlc> zd?^G{63-hv`NSuORKe@WMidb{NY&tpQ(eL3SE|M1?lpY#S)Ai^wfRIrp0B>$k7HRI z<70k#Zgvp%duybCY4DN2!RIE`14fpuBR;0{0v7cLSE6@5_vQyWYO~>@p*zMu@Kn)a zFDwf>2}P@KH(4POKZ>aM161Pf!SXAqmc-%VK`dj{y&Jg!I^V9d8T@sHn7690X+g4h z)M0M`5Z?!L^_=AYN7Gk_HT}NdtDt~%gA9gD>2462NDQRA8ziL>P+&+)Hwwt4LnIYJ zV)O`UkPxN2dmD@2-oNkl`Imoy*Y!O2eV=oma~`7W*O;eC;gvLVw6-3o;6Dayx*gs= z1YeDs=sO3GZ%VEonw)!ZG+PEK_~%6$ZcootP`v^oY1^>3`tEGi>A4Nhgx`)&`W-`` zKKzn1r>TRr&%m!8`XPEBqNY7W(%8J(jpbJ&o*WYaGe=~EGyO$6pUdaeC9S|8mMKpV zA5s&s`ki?=Piw<6CH_3w)CHdlwXR9n=KLPw*<8#&&dFnZb=ECVm+t>tdJvDTgXRWS zbZEZzS{B+*QPev6iIooN08-hK771A96p5{lKco|X#0TE67Dw|Np2_CnFuix7WveVjWY{M6QF;Vc6XqSCZdv^&<)?d%2^95bZU5^4_wN;?abVz!wtM{b{ftIA?i=eJFa+T zRcte|)`LGzI16nhR<+HLnBuuOWw7Ej)?X!68(pNszW``y6 zFRzhrne^@Z)!qD$DA`JPY9;p zldrFS1r9JWcE&l$SK@oc9s_~#?AfYspS>S}T&`8&RSMa1&$kn6*Lz#t=TK#;LMd9mke}|U;rF+`zw86V zi6EUsqK@yLz?c)__VFh!~L@zjw z&h0VW%E?_jA=|v2lAdi}JCt8Lx>f7sh*Q80PsyRNF3il#TzSz$DXl_DaM%gu*GvNb zL()(u$M363I{ice$vc|dub64l%eY?hMf#o2x`pk&MS{s5-nXC8A;f4BE?n*WQII`x30Rn@^^d- zD}x7VBd%%L-P>DL#fteJ77)NPN=+D^?>86SruF5$-?d4M6h%k=8}VfNGII!DzLHtQ zF|Mg{d{QJ#J~HFsm++a#IOi95yPlQ!-YFx7LfLvCmBHDgs1xirygawca*xbrZ&V4D z?GzXX>cDJ)a{&!2zq-0e2Wl-kwTk+t@T>*qv8*phxZZJ$b^CP+vOzNx0|P0=Q(Rm0 zg;{@>G2xQo(@J=!%ep$?Z4tAdA$oY~C#Ke)68p|tD<3@Js_3}s@VgqmgBm)IIvX?m z%?0;NX}@0ke)h%oslcI`pNxL1f!~iX>(0wI^Hx+|&?Q-mZJM~VgBYk|=A{jM7So~@>0$~@cG)LNaeHJDYGW3|9dlfD=uI3v8=V4j_N;`Ir?(9gKdYxaAHg3O!Hw8)9H_o>|3^^I zAE7wSAaz9Jz1FL}kxk$cGUb=H_6r-gPm(4ZgZ4Z&+!eKetnsi@D)Vrpy{rr`h<-x2 zHnIn9c6J;CPOcpJed#iCnOn%!+P`^*^~RMP2wQ@FgsmB%&X~ahSjXTyc7ZdwLyaXm zSrVqqgFJAbiW>7at>EJU>xux#4+FxE$>b&@C}5 zU*i|v8dJ2NmA^a0xQk}%1WGcqduR&G z6#6?Zss*o7y-qO+@lU{*7v=5)W^JwkhyONOj1?n}dOtR!Yt zfrKB?4<lSp2Z@Df2yT z{KuZ6_F|(q>F9{C&Y<(pjFZeRj`(qoNkRoF=8^&UCf(EU!>spzy3vdQm)s23TYZ?! zA>`N$5iioKV7H?yfBt-a?_OLt^?JNSz`ekd3z$o8FWF~WUv-XShMehH;=0_b!`{9A8z@dd17x68#(Yle04qD61O2s zRok{)E?)<8>q4)u&#J&n(eY8wVSEt}{j|_oSzV|VT8#L~{-6~K zlT3Ie*>NmWKssj-fja<~mXrXLcWAbxdmG*V@@yn!|Jle7!W*SL-S=ZX3b(o9tjo@O zI_xmRbQ{>d-1bB52-%Gn33)2=f~;U9D17V7*#oVuQ5h={{D}xY*2yctjw|C;J>(y1 z6`VVrLp|&QzqoEZz3_KxKMveIQl*mdE-c_hQAcg_SBj&Mqp+OvC1E#<4x4cFI1~g2 zdSv0xcc~vhmQ)_*>}=W{$O-N1bUynBZ!l9tF)wG+><DM38KDb#cZ%WdZS7oFc&A z@zA1ho zYd6-q`baQ!z~W`got;4-dtTaG#dAx!t1!r*zDsRdlRh^jQ_TINb7*Me)E!CG&pl5sg2^CB8UtOfw&UpDK58klE(7?);^B6nz(G`fK_{a%+ z4R5p!zy7rCd~0NGwzW!@-^IG1)x6}96f{^HScU#*CTq~6?GEK*BKw1SJZ)Zvy`K=1)?lKz8jrO*$GMpDD5 zegVHp^M`N)NZY}Y!_@17AJ2S@xmTKI!&k?N8_VM39aCg4c%M1jW3bV6@;Q&Nj@=c< zIVml;f8pOPbNF(k2*ejtsHQX=>Fw7i^+7>#>~r4-W6<~T(`6Af0s#w=9A4pkHy74p zqOGls7gvHB2dnbe;H_-_OfB7q0CGw}F2e>3K=285H|^ZyZ!YV$Yp#G#7*VLw473`; z_-~8wb3}rs{E=Uh-^2y1L)`Z41HgCYvK~XAY`?Ei5TYGcC~iDTj1uU5%{}q^aTp$Q zn0M;Pu)f>3pl3X#-3{>cbzqa^cO&23e$7I;=*+#+|39+7VXZFrBO4R-U)uXXgRK6{ zIw}L31hpOzbRAdK&u6cdWbXw$tNBSM=iYz@6ZPe;))6@t#?cOydbj^C3!o^f6{eJy z7h{?804n@-Gb2E)FZm%?O6G{VR%0q|=mOdck~qVW?{CDCTU_*~PS5fpVyUzSP2ruI zHcA<&g&|)zxdRqd$-Z#z+aqL-XYlcjlb@50j+H5wO!xu0cp~!(!m3`QR=(*)_|@QR zx!rh+)=em0Z*Tvsv@|R^6h|$RnQC)QmK?v{D}>K%h8EamOAaqo0C}Y1*hO+VYz1wR z7pA2LJ58Hdo}58~Xb2Xc5(i3&?_xDI=&-15I}1P!J$!n^z2uA0ywQ{+fMS zdfn^nw=V?ci=r2-jaYdZNH$ROYlT)zj<)>}6*gTtNeCN#q_^-i31607GI-%=W(Np_ zK5`@wyDELELj-KSll9g6S)>~2d$Lz9F%M+dkQVo%dDeg3nqpNmkO+MD#Z6qeEAUOx z^c}xMFA~o;LgS~!^K82MoKiE4^%wekpT@f_MGb50ssFi(xkS+MMxBt2i(ursd4+|i zG-~vpDW{@NuIa-)_t<{-{WnrOy|O0q>+7b4?5^MgP6-$JkRdb+%#C{G<&}XYNmI|2 zAW|W?&Cme7fxo zKTHK;T>hor(;9sHrj>Z==ifmNQes;>TJ?faYGn8#bSqv!AO@5|JD0NlrfL9Kbz;lz zYo=ptV@|*!@y)Mo&QzKn{@DS3!H>M76zCr@FBTP#jwimSQK^2n4!>yfkCKcU>JT5hJybO{c1v#~`~SJ8_n0DQT@kDk1{n8$1V0WW^%sv+^J z8o<~I`{8Jx-?@6KY^G4NuG<~$t7TzQlN0#Gbg-*4m-aBmm)(yQ-g4LI2cndwI5>AEeAP{OoR( zw=K8!_x`gbO=|=Fp2xW_9RsIxvOSyvAwp+Wud;KOcVc?k9xKtYLnHCMY3oyY7Uth; zv~5CB+Jdv6GC`?Ud{2U2`>M8j;42{a%GOTSH={uhoR?EZ&o1^24U8jsttUhpPQfK> zYL6s83Lpvtk`Df%%C$C(2Pa3^Honi>elm#=@eWA=2& z$mpb;n@b8U5uJ)D>7|srjnT8f% zvK+Je`QJJy{B{pH(kj9)8Ut#)v!qAiEtHL?c7!pq)#q zt`hwHIkT+(zneFF``JJSVM2C9(Qwy4WSQhM(!Ny2XGD2l^igABz4=jFOlo}}-G{<= zV76!8t{E+u(G%x8)&56nvqtUXn!`9DM(kH?a;z?l>RiChNCdPNIswLSfaOq4DYD7& zy_}#xtR___>Dw935l$~VNE%m66L zm6GSZGc2aey&^DKa0=l^o_`gmPs#=T94B=7*O<)vp7%VIzE3+`AORheko0=i5&1Z!GSM z)jd3IKZj2+*u6^$MSXx#^8hH-?wo_AgPe$)fyN2eH*wn&1lqxL%M6W%^-tLDvc!N- z^;Rz?z_gfYGN{*s7}m7o!=(L`Tt>u?$ShAuKt=o;G#q+bS<~Uv3J6*BtFR-IN^Bfv zVy}Vnix>&0+K42tz!Tx;#2um>_@XZodP|=yuLkMyr;SO}NzZw1eH4$n>W>7@;CKx1 z?`^2KHj=y}S`)I1!{>p$vb`*Hu%rYCv>-oHqV{O;KEsx*(hGsAx9u)EHgDT4!=ZCc z;!=tw>kZ0imjHXQGf10)oK!8XFK2yQtEM6AKdO-m9zW3?UV%Dd`VV5{HqRLE_o^E! zLPCa2OFYXHiBm_hM?q#GAv$$IokE$H$xj)KDP`YMDx?*wS3KEtrTV1FmJ=8VGG$OU zke~!JQxb?C?jqsmDodg{fxCZvRR{DQa}XF@!j8?c+hyK|9pHpx`np9VH<_+sX05BQ9RUTSjLc;<59zv z9befs4TJ0>Qin~%&@fj_lQB-xI)ce#N9k5UcD>ymlomZC&LC?yI};jhgPO%>@E^_3 zNO5mfg0D;&|4e${k;p{cXDFNxTDgVnk*Rhc_~jCThBoKlmHa^DPMRW{Vw>fcpoboS z?oNRBAX4nUQD%9=Lxoov_4mXsV6DzMMM(W8wIM7i$y`=P*GNZ2B>Ac?N$As@`#MRw zc5=W(DKi(TO~DUn;L<6x3R!+bXWS0l4Aom|6pPTBH8RC1nRd<$PUCL9*cl8-LjYfj z=6B+Fn6N0notDIutaTB^7Xpb6QzGk8>t`!)MZQ3Ry-TZy0K_-IwBUFecJ4pWx#Z1y+2msK$&%qd&Tic%NyfIz zOYOY~z1tC>+5%(4A<4^$GXrDxaVn}{8CSjlqB%KJ`C$jIu9z8z_H=RGhPe}z58X-y z74U*%T=_Jgth+U|lDz+cta)SVwUzVhX=2;-JH+4K(Lr`{<2u6H&N0m_ zSl#AHa3N-#D?P-KphRGQmbsu?UJi|YdBw`{eIx?s+o~p4px9A)>xw)Gc< z3q#LQj)vde`F$pYcs^9Aa{76sw=c1xumrxVXO=@@wc; z@!NHwgCtkNVi(YR%uQy>Z0Hh*UQN-2y*2R>ra=YS1erasO9|G2H#Q&I9Z+Ssra_erIH zz_EZ3qjI>v8l|3pC{_B1{$ zXTg@_t>lCVp5#utD1`U9Jt9L&|OLL(x_-+8e6d0#m0>ir){j+rZ~l7Fu%Nk+(k7IGH94b(b$k2h0{j+f=Xd6Zke z7j>!>deSR`yU~WedYOfh*lWB?>q|(JbMYbtUi?=*Ez^GgHd&ZXj+a%twCHRxh$YfT zx_rSjkk_hkuy<;G294k}bFsP=IA6Ly{|Jxm>RbfAyyfcr$a1&tFmV!}&P+*pIn`Tf zqh*KLgHCJU>$8)ypeD?Y7sf!sGX;@ZR{{}e-EBqzY&PhpH+YI;zVmTBS{EX6DoX1+ zNK5jl@|?f}(9YE~{ZcpZs)Awnz9g4$;)MwB zmA9YhqeH~Z2ucPPNk9`Vcl=#%3eiI&;xPbE9;-%+gmf7lM3MX7tXJ*727#|u*k*Ux|Bjn)#L4u%UAUd?ark4W_g{76dG8P4<1 z9g4jM`O$?lOMAQGD;1EV70%vRbth8_f4smE$@VfWaTvB`qb-z!ydQ=-hMzp4` z=$DWBI4r6nv@-7@AW+hmImZ2CwU0_ai1vu zUGiv9uJs>?6Oq?g{Af$oS}gm1R5J7x+hUQE9h+g-ve0kQcz{6gLMADpP0zWU5+NVG zAWX5WK2~wW-C8vISiM&zN?UgGguAAO~s1s{BOgVgr`~TYFqH1PYf&m zpY@EB%c|7p$J%9foAHZIU0Nh~f11SQ-~ZeJzQ1ybWFw-z4`i{r@~by)_}zn7D!@)4 ztuOk{s8at*saZ5Q!iN6}Y>uKPdVR$dG4AfQnVl5B?|=E29dn(DYZw44m>B#5_{PUS zSyAE7ASPddC7&VGa_>;5(8fVpBpJ~?-D%X=x)(7bSX&1yHKNM+d%Zmtgq{jfME(kd z1AfllwgUD{&Gaw~K<~!^70+Pezaw&Y94(|6y%&`r83r=BP>k90d9NpZ7d35+!Fr?+!p>LScVn46H3H)-$1DR#jv{fD}GX+Gf zw$M^To456rW4M_H-Ya{qjjWdQWM~(;GpTG5x$bwzEwO)cso3w$q;uCrbbHFn;U-k= z;t|jJTBuXxHmelbZqB>M#c%Sxuod{Sh}#P4Zg*pRFw~D2NGeTml#s15FsqZyQs)FR zwf$3GUJgAtAge~sKjtjDbQxY^dxS^Ri~k1Sg;H=Zbm73$XqTZeZ=v52JujL*sD~h6 zwf}MZ#-@Xw!G|r9*)`H3>x02A(}{qNReRh(9FtqY`M@Qa*nD{4 zL>Kub*~L$J#0BXwgv+pn>W`TD9-$9^>U+teNN-y*tCRSx2yK|(-MgeggTK?hE5gs8 zv#KO`*yTvyO{jjJ9*q~NcVUyvmu7j3Bh^(JE62>CjgDd$sU)xzI{C1xlEzP+*$*`v z^l=WW$17XybWjgZ5Zxn*n)F`Rn5aW}RwJ z((kU=Lv890`XqqTr1+8E z#-^D|5ovtUZ%J;qS@3%Nm$}UXKt1hCy-Qe#!A|>L@6-(7rDH{RL;izs(CgS*h4ju- zh~Je=20rxAJYmR@H79^$M~R?zUX5~qW>+r)Kb}$tMg?zdb<@g77LWb=Pt$;MadHUM zF1w(1aN{rVREu=DhCgI!-}H~?R)SuL=9a(wi1F>|!;J04v$4*KiMKJIadY4-E~$8; zBMVEUuzQ`!s}*gu|p_%&UE?`LYh0S|UY9h)5aQ20iw_EwJ2Ie09_%skueE6XRf zI|AlHVH*BrVUMucBrSRxHN%70KCDR7^h1WukLii{HKQsw< z(oxjwxBbR-vE$Ncfqx97UN3^T1@ds57te7bV;_IHOX*RJ`)vY=1gG@&9=uWk#3#IO zx6X6tpt#kd>0N3$WAMU~3FouOqG)G%xb$4CL4CJSHJV!5ob&J7L%wA0-Di>-xlJ_! zy(bHwTV!^^|H?}T;5rWH%8VC4V<+&$F5y#*fPJU<_N+oFJ zmWm`}HBxYDUcspgN$u0I-+Nc5JO1z~yvuyUt+@ea!oHf0k2A&bm5cfJnHK~{wW;pD z{r0r}S&lmXV@nIW8?}5;phhi~&r)oY=FIQ2cxI@~r~%R-NF?d&QwBwctKx7=PQ{h+ z&7EZ4-#*WB%ju|o@CHx9!=iy?+V4ajD1s1&Q%0SkwElDcW zg}C$0C!n>K9l4i;N9HpfT)>TnIN9>AN`)ig8}TI|55*gZ%wKUb4HD10ptXcXPt5LC zJR2}qjKO0<#ybZyiRQpQ(Y%C>{?MKdgAFX74nWUO@idrU*U*BD#j+}4Y*7&57WsqL zg1P<3E!o~Gg!Ub%Vw<0DDdRQcS1VkoF&`VuLlAGNb18EHk5Q_jRZ;>^KPjK}Q8y1a zFxTY#mbw&W{cyf9MYZ^v=QET9#6|=?Zv)X)}9Cz7uzX@ucWZjbBUV+BTPWFtb@_8Yq&=FdH;ZW7$6V$=y6ns0N0XbfL zGTpaPn$a(SCp3KBc4H4CZw?Z^reGp7eUq|ZTi#v)l?Fvf;`3c~u_QC9mpog%WAbrD zFIOGgZI30F=Vv=p$7jMqS$MDH6_dF(1hrKgV*gqb4$i&CkI{9MPB#-Dj84Z9#3jTJ z%e4Z=Dq~a#OmAoJgRn<8h5bD|nI7q&T51B%H5hOPrbkLp+iTM21ll(`@&Ae06rn%q z2yJM5wF#C(hI)`f0DxUXQfOcx9ktlF)N<%ce$0J!Cc2Roc!{pE zcgBX)7p}`|ruZ)^53R*3p{Tnk1AUuXV?(L?ioGYJgZ)WhgKpSfH!qbuV=_o56S@PE zaD&$TZCdtx)_5ZIlUkt&^+2iLNy0Ab@rz7sstfei#O?^dlj%0hak2Wryr}#d&8wBN z#P463I)$}Wp^LX6*UBLuh*7togr-md<(6?0;#%W&%1V(nAi+n~;KO%q(+~uc7_Y$6 z+9^054GG<90*8`4kx$q>7W};78E{MV@cs?amlFP+#0jXPpCZzm5tU!~A-mb}!Nw;b zSbw-WVP;I5LU*`i`K^-0oYZh$Q%)33p9w**nDY56hp*xVm%sE{Uer!1xxK9$^qT>{ z*YV=(TRJUYEj~P?77z@<9X`VcEC6d+c%MH@)hHp>Ts?)Gy?j6dkn87|KA8*O7b_^% zo(v21F>x4&jNms;vS#Y4yXdy)^)`rnd=Gu_9~3a3woCV0i7Gos-m;sGDN|j7V-s>Z zOQ|$U+)6%xsBUb~y|i&Np%V%BHgZ>QIj4Yxw&ML0q$VtDWmbjd7bsdgwARJQW9>%O zK1+T?4@~}ZenUUbxTV-L$JijN?2^k?8@Eic=}`vq3X)meW*uBBh{@AIMz1mB?#7Uc z^iLVduSJw6c84Nw$d-3U$yoAB#E?2nieW##6WVfWb=4MM4*k~9)o%C+;rPYT(9TVH z66#*UVK!W=OE(9X)0wkpkJ>iirKgo4XbP2zpn@1VB?rP8kLM~ODx~^cRu2w8fl1dS z%dK76g>f*TuInAeqG>fC5v3jOV@s zLB=!r-)tC5zmc?%1xDKWmix)pOF{~${E|#8$4;M+qQ}+mUkQbD*_*NZuG;XlyEMqm zJA2@JeZ8d4tf(luV!MZ=fmjzi=#!mzZS zrKHH-tSJos$LN@Dp}aRlKVZETZW70S32GZd3MBB6SU$B*?Je?Vv~vSh9#+hNu9@?E z0oH#757ihRJR?^OYLu+4o^E(#c=QUj@Ot-;+@lJcCY}45EMr;fcp@3{c=jO7SDx>= z(v_!GEOioZe7DcvZWMVd@;FAVn-2>7sR6TmD5~ ziQhS|v@y#|7_$;Utey`3x(Bgh{E$R$gbQen|J<qCkxMw9q| zjW^Rc@KPs5HV(#5zEL)gNxi%5jmlS|svF=I+t1Q2uch;`M;%fN{e5T zBMnYo%z5#+a?0USg#JHIoTTQcP(WXih4`7u-6&kcCJfcKXmKKbJ4JTdcTN6;08C*~ zk11wr^5hk2L^K2k2*~s&ZSL;WjLv2vf6`uJiRA4msQg_Vr#pJM#-qr(B|%Mk;Gu*uwt~n z0BmGE5@>Ye*f0O;3MfMLQn}S{;Bw#j(EQ6Yp2a9Dxs#VLg^Oe%zav-y=d2JTjrOCY zAScN}tp8mz?fW8%!MN0@!ci*;F@@yn%C?QkCqG`;P=20%_cI;^j{$C+!WZAEqQPtH zy4$XWTgi^TU+yB78KgI5AK!kv!<>;0Z>?hesI&|nK%}HQ@8@MLUy!^)ZGJi1xNatU z-p}rmvI_TrQ(uB#-1orCG8Z_g04|0!p{XD$xiwL}nQktIAKz+vu-euBo?!B?vqg_S z##el}4ZiY~WX|hx{F#oN@%gE3jG76^^T+gwjkcCUk|O3ax5xk-r&R~?3EiTK5j>)=&?Ih9wh*!^lQc6SN=lPQ#L zj9}Yn`awn@#=qNrnq1JrBaxs~YS3CegP+6w6j|T};Y?NBZOEU6G8GWG470IaL2c{% zH|xy;cd_L5bcnJlui2SL2Qc7C6)d)PY}z0KmiX4Z#-8S`3yXG-P$ha?{4jKAdZBfM zg5h0aHvIE0obwa$w5F>Hpy8wnZ+tIPn2!*UbY>c1Rb94OrlSIgOa2(6%Xbom_n)}Q zm~s%*?iaVb5E{^MNYe>&>)lD?J6hr)fa_$L#&h};}d9=O#-ad05uV>s9 zv8yYt{iR=RxoPBWZA?J3frC%C+v_Fn%~!VRhe9qimWqdF<{3Rb@t_PD8e*5{?Gt!Ja`A*!6)yUFpEGGKP#3hPPEsHMGKM=SiL|EjVj?LV+g>uQ?>rFEP7ng z_DgwBw_{GZUrlQFBYj!dk#-D3+CCf^5NQH}ED_XQi{3QxE>PtzU%8yHHe*BfXA4}= znVUB%eaR(e%E4}X7$iw6z9Dps2~DDpYx;!WI2;rO`0}O{H?T9f&{%va|EXyhC4<+* zBbQwvv^!Tv$ACyo<9=20z>A99S4LJ9f#_y+@#HJYJ*7aOdjcLPrRflYZ2e_Hh|X=i6T z0gQcAQ#t$$*yJnN{|p#ZoPH-%A-#Cjli;0fJgZTYyG*!@h*MX<{K5LA639Fkr+`}` zkw(qI%3CKtUXepxL_+%*dzc3>hf7E|Nr5=NwH903Wv48fn_o}#-w|RLjjY&A)Ty$S z-pC>n#JbwidjhLYY+1Hgw2a^3_k79jvpGC!Up@ra<(xZ2#+H)XcJ$Ly2fQ9&9yre* zf|*<%>A1$JkW>T&r@arI)JbXP#uqI<_&fh6qYSJ&q-;vo-F5Pk8jDAXZ?%KE7_s zzfGV1^GCM0`WwX&Sca zm#Qk)4UzM9_>qV+Kf-Q5tNi{|^{Ok@Enaan)uFK-J0gu*&mVVJ>$7*`XE!H^NUr?Z zg9#;aw#s{X0XUHnas%@$AuuDb?&$U*0#0#dQ8&xEgudSce@Qguga8PJ%=Hok@bnPa zT2YgOzbo_VTB8Dg}JMZ;e%Ia})lLs409?YF+J1l_k!N zXd+cyMF2+){-Kt-se|Z3EIiInOJ&Jm0*1A&!HvtW4Xnho{V+DB6KxkCBm zl+vMl0*@7^&tWPk>g*^()-SR3lCy`<$;CAXdfHrVbndHlSk)@494b%B@1V^@)8;l; zo6?9(;bL+m*^To$$=t(YvatshlUe3deu_8SQ_GG}-lt2&hfr6AN2#GfiS1`y!hF1t zz5ou{v29Cp!o33A%B9(=upx*B9_9*@zwk62bss1{h*BmYN(k>trd4$+qFHX z1%D6}58hbRo*Nbk$NBHR{KumbYsbOxZ%~1n;tB8Cqh?1|fbS=3`S*`Qi$5oCkwE=Q z1bf7PtpV%ADo%!mp3tm&|3ws{IpoYIqZHl=QH4IG4NQ^A+m^dN4F{N!hTqPS&icGa zCO{=_YE=GTCIZh&K;Px%72D6p@o?J{W=(>V@4LG@Ilz}NhdCx_IzFO^>I#J+fz*ma z%#^*u@IrN#PQKHzM`%JFvq)3@&jb{}EiEJC))1>8sByh`4~{wpVjceg*QR14CH`6` z9j&jBT4U+vVNN?hUEGdVegA_NVvEfjVy!M5>h`kk&A1Y`?b*RnOj#AhddejJQ3bRC z1$&Q+)39r84~NNzA~WKI5H7ba;WUI%O^GWis?mSM29qTv(rb}YZexd42_$b_X z-Viz!tPAXU9G9U?Qc@S0Zoka)@+}Ez+yWoelMvhboq|9Bk_`M*9s2Mc3eXltSRP2X z*SsZtj86!WNDJ)DS;93uen1b8Z0a;pEM=n zjB4!#wWUOa9K-B zOkW`0FgPWZL8;!;6Joj8W-Lcx>+u=B(@<&C{Wt3ud7H~uhRD;xI$FCz&-ZRdu2En62t)Xec9!fO`L2N^AH z)7&9pH?QS3OX(XZybPK>7b1Vmm*r7!UU`Qq=dtCl){_slZg*&w^YCnL`*evtl7`o- zpRGpoN7QHKWIdBUHPVW|_$qU^r#VGCn$G{dg`r30!JoEe$wG?P7P?Q;5}Wrwry)W_ zz@N^y$YK0;eGhIhx&arc`693<2a=OUZ<}&!_g1|tvahwiQg1*_Etj~{7Mb}*DzqfY zb&zwC(5wjj5pzWFD$2oYX6+>sXwDY~L z&M>nv4R#%Ce8#)F*d89-w7n|NQ25sSNJ=Yyf{`2t@H8?paW(oyu^~v1!EZ+jkve=S zH*lPnLJr}zF2D!9`|chAay;^e%#=T12BW7wb-z1Dpt zqkx|fvjAY5L{*h6K~Vk14@i1NiQGaH+4o ze!BenFAwUqbY84d_()6C$@MR|&uHICR!ysGYeDF)e)-9*ql2YJ$kENsXnX=FA2r^) zt&A~6x#$f%LhqULi=fs937Ssz5_u!5={t8q!>H@5Tbm@ai9`%$9x-z(7kN}povx;a zs&ocj2W>h6Z)ExJG!NE6&)M91&jjf3Y(W_E=Xj4t(Zo}1y8q%`(@X$u);M%d-5?&b zmfIMHpyG>Eu1-pk{Z~ZU(=;iID?gp3tYD!<46>*ROr|3wqV46a{HdYm+MF^+=W^|l z`;%1{W0VRd`K@$g-~uz!&VLaIT4)%z;%FgV~g~ zt}Gkv=Bvh3RaFhuWa6DpTu_&>18)}K_=ryXQ-XT!o%gO6-0)r9$UU~zcp~B7v1P^3 z@R9%UjQMSXDqN|-aI*V;JOiQhEl$Zj z5D{=Y^qm^-!f(9!9l>bm?P7Y(bdXns$eSG_BSVi;#kRvbR<`+5gdlMZiwK8ix>Gw0 zbu_;#;PT6bV7KIE7Utu-6Y10U5dET8C_s&|4+j&WA9fB1R@we?z5pH=`EIAMbO*AO z88g@$wX8;G%$vJ}TeXhwWZ1NPEx#UsYGVKLatN7=U1rH0l_%gmklg2Wg>`6$s>W!; z&(>)XG%!;4#Y-Sot_kRyQ~nbZSJ0Ls3%GE^U7M`oHzvN-$a%LGwC>6#IVUwW1|5IK zY>!e88rwpDWX)yq&Z>_)U8Zh5Vg}k{*9*mjwU{sGt;b8=Z0%=!`Af9<-tYSfa{a3c zzCQ^%9Ro%{55Ao1h1qNi#j-nfc;(;|fly8(a`gNU|7X(Jn-~Kd>!b-Gy<7gx%l}YW z?dWGegtcv4F&~97P3AbW8he1TAu4iQ6Ay@f|7CH8AZ70j3f~bYw$8h6u)C5z9OGZ@ zNFa4c*gK9~TX%{Rqesw%;b=a&RU{>gLhj(x>m>n^&K7NU9V_nP(h*aekZdEP?2&&* z9cR5jtl1}G^lO%Tb9}K$F6XPa)+mlBo@t#-oLpT|3GVOxmKoM6^ez@PD*q+a4qxHn?KtDQbV^CJl(ydH4UqXbs!GGHi3s8Kq^^gqG1xyPZ{S8(JgjK8NVeU?EVxzG*XpjbH!7K3RK(_Z zxfO5KStISYcDdzh1fKQILLL5Ko-OUc8bKzemq=%ZCCDxaoDJ=;OB$#ESTMQWRm%Nw~0dZqn#M@-}oK!FR>OXd^%kV{f|XnpleFN z(a<5pat>Z;2F{rZoxgJ0vJDVU-I+47lwy2Nc~e5$%0e#u8h2^33FbbKuT!`l$Se(f z^(o={LPh-uzm?gD{^s1c)?!k_UnKN8DN4dt(+x-Vge9*aef#*2a4Pl>6JK?pjlNSA zRznTfezk07$m!hHBG`m)xUogbPv|l~oT$2me*Sv=4Hg)F0*w9$_?WRcyXkj?(Cy0D zaVVR7CxhP1h2F6EW$C(gws;=kzZb1IzBoG$Xd+}y=nUjRC4gAs>T>r^(pL~it zAF+DbdGWB&f6R@lJeXCc$7i{Ght@wcd=2!Vv-{&eO@DDlWR1H)Wc_4!5iNSPK*;}u zY=RoYM;-W!mIPvz_TR}gUcz4$*(ribr==v)d+y&g3Xn z`-UBXfQLez!UFo-U_geOFO@WWe|c@KaxCsw6caE~uJ`UL7*(KyRW=sUe)4>Q;I}g! zV5oN#q7-017&Vn129ns$N@Z8($rI;2tPU!~1>HjmE2}JtTV4Cu6fw|1j+^_C{=Bxf zrl~JH*9ZT~+?$#Ie3FxVp&N%alqOceQLR#YH8jnRifV&TyK58Wh+8G4sKdmGL;^6B zH-?d)snqOLJ%^EY3&3R*kWLQWp53^L^{7{vl@+l?_EYWd0@9{y74A)HSgmgVf^#umyRX#Hi7b zL`>i>ou)l1;^_0$aJ-CUbk4~z0Gy{2460W_&TLN5QSg0{Gfcp z!?vfuMbRtQH^3eZ@0f2L|EEBW2^B z%LqXTe2&Rx^1+`;92n!GxA;|?f)88mk}=$&NgA?Lw340@{n%42w|S3k=_uGDdg9<;!EoB-S7qo2m1ffbe3UJwc!?4k?xR?7y&6k z8l^{CM7l$e5(K1CkQf!|?q=vz5RgW?L52=dsiAv77+_}h*?i}mzg!pm(7oUNyz5!( zUT0#W(l2uW3Me|fkr^9tNwWY;Gxb;&^NkR~n~7UvVyNwV>veJXP3K}WTYU2#u?Gg? zmA*)qygt;5+q2`V=ARAn24dweW|mx1hcfs|{d|Y>acWp?@7{%qa?8uGv=R=EG3nLi zhMqi9&?YM>+0i5=>v{geQcG@-vYKF#-|*yhWRLulb43fc^aI&HSH;6%gs;AE_1+13 z%hO0UEzO>!{o@8DE?~+ky0~2FOXjl{?hl~YGsIRW6>WAuz{#APV>SJp+s2En(ld{z zvz+b%PK?BTjkuHA2;*B&E7UrB;s_X&6B{2 zPRLbZ3Z`n&zzHh>{e=3ucW#>q=mDuTu(JX0Uh;b!vAQPI=AEbTeK(N*C%yVzk(t;T z%r{;l(rhd;E2upx*pXyZBzgZ4uzF~&EMux3Q&Ukm8~kp9e8#~!4D`&tOa#i6y&8Ec zP$w1nsXC+|+W#v<`)}VHz9R=X!qGXFdOLhdJ?FI+dP+g#XBOK}tqXnT&>0pyY*}U` ztmYE3hUr7oI;7dk{{9%ztJG|g*`j6)wrodvgZXC-L&kxKHjL3ckNa z`73jU8cAsXjHdoAx>uxqdfbLw^6u@c>Nnb60P|gViVwq=Wc_Lr%3t?J@n4KKEVZ-a zwW`_m_|H94h}iaOJ5w6Cz32O6ib&?*2X8K}%U6p+a~QzDf7YI-unh^-2i{Hhe2R-{ zdX<5-x4g8ueWP3~CNxr1iV{ew@33(7+bga_mWdfZ2;V-Am&NsbMXd(PutNgw`p@@W zz{nJSmU8jK84a*=Gfoznk=d=*SiHc!$!Tfuq9RE49R%G^8jLY%Egwu`LiG3mSd z*L-VMIyXX|_^sqCwCVO|t^a37;2%>T2e&6$mpeOeJn-y|dc#188h?o*5u4bNG5*El zTG|Ww%MZ)=P<{D?M7rXeFFIX--N~9lMX!J0=VG|QwWXgY&fF|B@7%xF=(`2DQ6a>w z6qj4P()cl8_2~>ji7uaCazsZzt5WXkVmD&>96X_$`eX;3oAw9)%r#e%27K({0U0fJ zCL~v-v64nXs><1Ci}KgIUW78Bp_UCg28wmZ1RN>5GLx^YIxahuuONaoHVPF-;EMYW zD?4dAjyBCxQmxtIIp^g}ET8@nb@RgzjKBFes(@j4pNE#*c@KmV;f(&HguUYcRqWSJ z-=;gUO=`>G`~`G7O*0nNAXOn28?p@A6s3N=b}UP(5s_Tgq3ZggbL@usL3i1KK8~|i z=HBj@#=yXwaNEab}TJS8{kCxv>JPJxhyi96qy=I*ij!Tpd;{>t#t*p&UAgzVAr( zK^BhDVjulRGmRco&UD6IYzh?YGTm3o9Un6-b(G`)U4S!E%I@yHDMmX*9u#=i>rBLh z{{N=LBM%TPzGo(^qg21Lr&Sm6-UqXJ93YL+joe>*uVo9TXoKsu1-N5&NyZO7-$mS3=?^25}o_ z5X%kz7b?CXU*mqwavcwOYjF&QozS397A3GHae^3fV1Oa!?^L~KsOxKw{Eb$UhKJi!|PnPv&p^#8w1{GB@5Cw(}ZY3 zsi@VU*~6wr=YVg5jKssKDJ}1&$-m=p{11+4o8MfV<*~NP7VPd0%47HY;jaW37l0bx zuy^_gW*^7(t%I_5yE|x^VGDl|{*QC>*WAANs-`GQuU>3^k1p+I2+n9W*%*jOA6m*5 z2zVxND3UmG=zR`MpxzPT7Q=AJe}jYZ^xL9Xq1f@%)#A_%2IzfQ1x#N_%yT$JZRC

~E4j4DhJ8f&vSJ$pR;=g3XZtjBGX{SZxPJn^~dbO1;8VA17b z-5J$;-e4_N@R0#|4ACJ$VzTzNW^tZ-UC&M}UeIj-vS|M3r#M={$5Z~xNmxoNbODS- zEg8v|H46swzdnK9CKSXxiVHf#_gisTEdCZM{3eVp=+nW4I8JVB`|Lxe=9Ephm^u2L z4OYlwmQV^lG_|x^P3@5c!g3dFR%`=ql7?w=u0A!n*QsFKY%Vdw^nN@<4T+8+VPWx4 zcZCleD?thwmN|k3{t`X6D%tso>AO1ad*MPSyf!OF=xxeCTsQumcMM=mJ zh_x^T@m87zzFRk3gTS!7_9eFl=#I|Fu4`{FdJi(!Xo5A4rp2#AwjJwnvHU*0tdcht zif+HZJ$Z1|3G28{0_)n2+-x?@d={RN1;NBoE=|TP)if%vh($c|>fI0J6h!R&kY|H1 zeTN1OE|H~@h#|OGK?xLo&9G@tqm7tcG9mf9eKZa39Q^Ol!|G&>d`6ZmuF!l0N@- z`4l9sM_62cZ7KNJN*03&Xd@D2r)19}j_sffg|y-3_-~Y-093ebHkb$rzlFq1O?kXA z811&dKzxV+CfQ*E=N5X#9GgqNwc=mCgvxVPTP}UZ48)ud6*uNS{5MkB_VN!F#H2)D zv1IPPn4i0NQMDKN!}#Fp7p-W{;~$^T4&!kTjd0taZM$fz1T5OHVLH8Az^f9)MB@z3 zG~A4-o=)`Yy_fokF$DqZAcKBF)4U{6`=Z_b-@y2su!O`-HLmcLV<3-_UNuTm$9U-r zt2h+>_79lGZqV5-#e3>7$1>hk!W0>(k+SsvEP#-dv?DXnPyM*K^10v+w)B3VE z9hlj^AT}g~zXXVtBPOQKq@*rq6Qx#1Ck-rZA2)DgkLoo)^p?=t_-e2Pu@frx^_hSd zE$g?Atv5i6y>UBj)cq|8sXPzke~4#3LjfOwC3l7{5KU-uL{6D_jW%&d$$-*B{zXR}794_n6>?%ZJ5 zYROd7Q2Uksa;pOzrVZSxr2{%WR;hKcLW7O5O+j0velMF|o}Kc@qxoB}VC{D{%(uWv z{@i0oSnZo?Ck-257lp|vF6ZU|FDzVwpnXD$3BsJDLzL8ie;@uJZb!~ufEc@(PH)TU zTE1m|un=&ps{K+l_lq9{ZKN8Xcs%st-k98OV?)!`!xok~q zueaZOR3jOF5tX_$0FHhv82uc8z!29o)HRm$J#n)BjB>G1Gm=Z>uBe>>Q~=%g=_BJ^bYJj-C+y=?T4x zEG=}S5Y}5y5pWk}M(51m@yv~0ipYG?e409~XGM4mD6cidESXPRuQ&XfcxvMTPG)ztC!e($QADF%au1Pt)dv(=o{W199 z$h{V>VU1zx;uo5-U=#d_=J{RKyW+)RWNAu1>(_tks}p|-u_gMH4n4 zBi=}fdywo&N{Ew&1jpFvRPw@J1N4_S_9zE<(w=wE3b#xxmU<%D`Ze$Zi?k86~`vi`!?#W6Y> zezJ(dKTE z>tDTKMTW^6ULxD52k%&`w1lpaP_k^?Y;if`=?+ckq^^1jVDWJetHbuWiyF z(r0`af{z!E;&%>E8t;5_^4kwql=eS)8RTb8HIYSk->lqd%hhEVU7PyzhwCC;;I)?+ z(Gqtqa&gJv*kNXx#z2UPh3%8PByF^?pUvta4+b=k&fdH{3Bqnzpjj~Hw! z^hIU`cqyl&uD(v97qZD8!RYe`)_rNkIoG~qf+paHcW~2QF`$&i{3v{;PHzs{fdoS~ zYpC~NLUCqVb}LZy%&mM2VO=#z`qt9wo8)O}w{iYz9=-DiPQk%T%HAUK*e0z;r=70< zvW%9%fHzIdzkg+z-<3ks(*lGB0IA3juTb>|{Tj-NZ%ATl;#{1UxWOkPU;5l-4Ypt8 z6j|Wo_59A0Fpf~iGDk@ggF#xC2af1|#NH0D0><#CsZvWbW5>m3#+Rb?B0j#6f9qjd zateFBJe6T)YDqrj+P@VEC0_m}>V;;G4_j8kQA_~$E_!azgPb?VFc0`5(2Yw@NnU-t znVXRXYdNYb1M)}3S&euOFOz7Co3e?~DwclUX=M9siEBDV>>X66EA+)LA2^}MJDIYP zubHP_Rh`d6>qD9d;&yiLCiuJI9?lZ<5D%zz{M?4PU^e6R#jT9BbZ_y}9?(w!y3$7s z61c}}+H7+`f6(#G_k5nUT4Nw^{%dNF_V&1~Z7?lrIS29dJcAS6YHEp%@ScFRpFYu+oSz1SBdetcdV@ZpBL%zyEOHq-H(a*5+hw6pv8#mrB_4e zhZs+PoJNL#8bD0#a>RdEIVY=Yj_&C_wd}-Dl2kVEbfE-G!ytu%S0bO!p0UczZw@!xDqvhDCw6)K*_Oj6c?d2CB20BH+UwCL+jUjS=TCx`h zK_f<=gQjI0a(@;zi^xj`IPkK5Ah#qKpv!XtzdF}2T`UOGWij|3EHq2akSZ7!d*A!X zH7`?%78HQ{PTzaiNOrno6Q_ ztdnU&nTa=|*P<9{JP3r+`9RyYWUgkq_Y>`vh2Q9c)G?oSgSGH9>Q>B85#a%=2Ef+J z>Vv-c7(bGFyu#I(SXN#x;I-am>qwSL66KB;c)8_1VQv@%%pR)#DB@H6Fb+jg&&hGnFYG25(O8)eZ@V{?_GgCUoy! zkSz0{7qLeC?irD!U(QZG-wDoMk`7vyrw}8SparM#LZ=GuH;rj0E|)8HuPH*&qA{XB zHQD3|%>tCFMp~Yl%e&sZ9?PA$uE+ABEi)s{edeb!AYNco1iFp@S$q)}K)&^k#;usWyz0 z!^q-!VGIb0Rc6VF%+`@ABhUl*C_xFU*69JkK(C7ZXW1UgTHd>WOA0iZEUn>MFUhtc zca+)pp!x?-I=#Fk0Mj!)YEm|RlzT*}I4{uTY#N!T1-pr-+_^z?Etf9PYm4PD)6M#Efp%cnZwIH$=?BB z3sL!$fltr&7y0Al&YA+Q#${rY1?crPN zM@lfNWwZL}#HL82iGHDNMb6-{R|^UWaRIxseAN%9f{>lN*L5F@>qyEkJvBB{%_ggB zBucQ!*B>t+2fFVQ^X6Af9ItHupmxFd8%f0kWrrqGD0~h2KtU9RP;lkyH`y8TLBH{1 zV}=oZ_R6^s&2*5Dp`nqF3P+}G4l>PkDBU%lDbTDF9hVb04>+(+u$jF_xq&83zu*9} z=VEPNKbV%Z!E8#eI!SQE4ikJJ!vmKtERu>P=`;gd!{r$)425<-q{hODsEmH7BX2#H zzcIIie<>`tBg=RtOz@tvdb0jK}uNLY~ZC{`!m$|E=`FI4yWRiTa18 zO)^RJinr98)7$J=I*ki~vXYiKJ>Xo`2?={-PrRq?d0MIkaRIhK$f}AmOX1b>ef56O z76tz*y8kQ(AY=S`jaijc^(k7!mD0k_%=gO%|3nafRpsY9oTsF&_=BkfHp;grpw|WR z_c$mt^qaE@AU8JqdJjqogVJq2Cz%0O;g9RRFVic^S(uORSRb82xSw;D4)g0s_&`~T zkm^tN+`eOW)2RYA1ZjdPDPt>GZD&^YW?;Id=DeSSbcS3V5p5oa@8>SU?XnVgp=WCD z?c^`Z17l=sE(ty;I#6%fKSlx*U&`xXv`*52qBA&HYx}l5ZPrH;;MDt%tB31Y4E*3PO&LKt2U1tIe_ z3$Oj4;4!T8^FtpzsUR})!BK3b<={%lz*6#D-j0>dK0IOi3;R!o9G6Rj?Iz_J z%NT!`mx>2K7?1s-7Sc&YTwiBkNj2$T4{yg6z{Vl57WAw zAzGg^srDc-#q)Pxr9^>@xEz0nlEJ#hc?TcrG7C8R~+I|~+78aA6wDW38UHputm5S|)zu;{rFx6!XT$5+iOu>QU zhp+QUN#@TA(YW|Hw5L`{H*9m|AZ@e8l8R(1JrTJw1u{X(%_I!RCr+qiG0h)xa=bg= z5f^*o9jWv@(pqB%J#jD_d$2i zF9`G$POlp!k$2P^B)yt$#yNBx2a;Tc?%-G?(^kl(3m-C3mj=K7KJZNIY#Umzl+HO; zp1HFRYz15mra%&$AH7N3t-j(d7{i$c9gkQILYB}2p6hB=$!pq@mVeK28tYN8W0i|; zIM6JMI^y)iE11aj4~jD2(2JGD;?56K$(gm1pkVtm~-=h-h{N7+S< zi{yo!fZW&dfZ?oV0|A8&@X_;1WL&_CS|9$NykDz1tBVT&Ize`ssVnr86(lHeoEV;=LU`WYx zP9^WO5+xy+39dtGq z$8JVJ{Z+ci-~S9M_B2W)!ka#TZ-W)qO6}oeGTYroCp*OA0ixQ7#5Ik!sZ9FfpFMMZ zNxJCdHJ*zSjk>GZ^X!*?&ey{kvdkR9W9v&D`7W2Xuq30O)t?&^TU*c4Z+^!AG$INf z;In#%50V|-NRCd9N;>GMJ%T}g*X#TC-RAda1pc4h1mZ!1hj5k#nue)N1tycqHi>t^ zA*<2uBnkkX#lb^swqI^PVZ2u6`Hxkb_Nx0j9oWE84Jszpb${k}EgV;plc3kLUjOjt zSNC3P_4o3gA?Q3<&=6=2yPhZUXe+D!@M6ch;!&Tg1;9wD0j1z#0Vnt=2XhIhkw;u{ zL(~Io&tftnZ9!gWY?G>TFYA^<7t`6CYB?RxYVADk9p4_rEA5+;lhxsk%YazIpEun2 zK%n32_}`=#8SQr6aoU9-&vtJ^OlC&NZ` zmV9l)0@keBBN(cbJojn_hSYgn<9DmB%CdttOg;aUI4|2(C7-vQ>s??r<@qV)PUBT; z*gSeyYW+@>K2z6K)|Df~qhB}Tda8>Z#uUsLPVAP)iT6ny7)1zBJq zdB1gZgFhx>VC6G^nyVy1oTO)cz+DZ~^Lsq66%_KL05W6^2^bmkucaih0fJSTZx&AH zUyWK`DB<~-Ke(V24ESF{r~UWX>&&8cy;>6IME>4lG$2MRR*OmImfE!CQCASTq#**F zwcieto*yKi2mCXTG_3AKXkJK`&X!l zuDHX)Nh0&cmZL9YNLNRj0tA;)3=ZQ7x*j);snqa&3>xA*45;jg)t}tD{qb{-Ks=I5 z$ZhF-9k`ll-aHG;IVfsf3j7n8^c(53)E;;>TP|(rvol?;Uwpqs z^joSBy~j;;OJ(H81S=AUZK|)=zcYmW9Xa&XM+RGE+%c*k!L04OpB>%hsS%j{MkuwK zE_QF>|Dc|O2*i}SfJfZ`?mFom!hmBF3V8d*Ug8?)S(+mshlP`2cvgz5Dl1dYD9EID z0w|8HM3)CNV61eU!;pp&o0)8WlfuHX(QeyVu!R_t!Cc$k&X%I8SwmoJlRmeF#T)<~EoN%D zl+$$}HmBu*eQ8MTcT4yV3w*WS+oCZ=BO@b8bxTJCSXO;ump?6<10f;qD7mwFTRlt5 z(7~n`wbnfZQq)>)TpDR3ZyGU1nGAx7CqlkivXKv~-6YQin%8C*xhT(&S5$rHo6sfB z%2*4ohf!w8YFMBF?sD+Gi;SX*N*pE$q7iS@>FiH~xOZelwGRLOZ_)~?<}39a7J287 z;wzk5i0F;xLY8I}rPL5OfPgl{+_$F`DcWW`5MUpn>!Klt4IUWWA&t#*&`f6p+IJx- zDb-fdisatrT%~Hc*sY9^SN9t*os2B&LdVzcH1yGTkI^|2m zdUXUT<)>aDgab`4N#yn zZSIif{dA-JJ$N;J66<_vhkL@lqUuDl#S>HOm1_qZj>BYrL(|oT1yg%?_gb5$Nw3Z; zvXwj>`r!7mM#XCY%EKVF>h0_VW!vJ)R*<3rzfIboaS6*wPK`}rAIC+8w0Wu?s zo%s9aCl&0Ue^Fk5pEYt#n@#A9wbqP5rugwzhrz_s&JyU}0^zMGnPrx$y%+ajxMNrV zW*{E{>T_`_jIi!w?YZNyYu;vyvtGtD~C#ZlwQHWU1@r*e%G;tkH8LlON*zS%N2zu2s`~ddo^3?S)f_WE3UP2AZ&lq#G-U4GIdya|aQQ zv3w{RB>L00iq6?Ic2I=kN-++b>x1S{pNi>fWtsrTsK2vd8~CmRvMnx$1HU-$PAikp z)%+6X6G|&#i4s^`Ea`VZp7FEA<1CT4ei9#`nGJArvCj%{_U<}@^lvcJK=@JOLz&R^ zcXQQ=cVI~ zX5XL8;YjE4fD+B$nPwIw@AF)w16PLWRO9PwKIerJK6rAE!7xanDw@oCm2!&=Qc}~; zTPPxl=NPVa&jYi3#K`Tga^oY<dLm1?6Z{hG*9rCJ5H5hROdR}&g);=KaPg``cbT$aam^~E* zO@NyZT)Du}Z_hscA>(OWD3q1Uhj;cH!(xkY8)6j-y@KAwV8KW8$n?w2l;ka+u)Sht z0CezI4%Ik0nLB4`^_RQxb}A&pVh%troWJl5j~4sy`nCVGWluK?#0MFf3E>hPl2>e$OcSnFp~Z+mtmXDg{6_N!-Dw zFp-d8&NmK<>8R;G{{`{dhH2$W`hgR9#1B^1Erxl$ct`_h(dhHaL~Gb6{(lI~+PttU ziGi;Zw%h!G*kF?MeOmAE{Qa6^=)vs*!aZ0iLrU(i{GbKs2`PNIg^}9hcz(%i1<2ch z*gThE0G?=WU|G-R{h*ig2AVz>l%k`}cB!$1VQkn^o>xUHgHC=^JlcsE8)cGD zKrVK~i0ObSDe3PInr(AQZNdb1or7ekheD30uo=3lAu7o2;MW}PzP7_)Z0RrLxs@3Y zevIGMJZ#$u`1WU89xx89vAQf(#Yxpac&Om&k^8}iq6}t%)APZ%jFQFG|BD{HlV&jJ zkErfhrD~9g(;hK|E^t%IiiBsEekd5VD@!~$i?ce>raxew3YT2o?}Jl&BrjD|nC;() zo}_XFwd)xJQF88BSzk)%BCWj3`fv(rqp{8OpyLokv45Xhxy>6dbBKW`*L)xH+x($R zFJ#KG8;`e^ZX1`-k}2(HKQiJ8V4aVs%J6+!jxW%k!}Q|~l6a|Zb$?71VV5kVe`|ep zqmjl0y+MHBe-#@Vmz_$(Z#fP*BHv`P-e7c-x)E?fMrpEn%r>|oPJotbHf@2lLhQF~ z`#>%is4{J{g8lWo@&3IZz!)AmXG^?o2}~SK3%(}i&JC1Om?}yizd<-IjsOP3K&$|< zTZQ8;nyd;&bK+}YWN#Ch6+6|Jl|hJ9kSHs3e1 z2{xB%JFrJ7q)ELhl_eE?_E)zL_X_U+g49ed6<1dFI2LwA1b-*=UL_;TWbrr%lvS6x zv`t{#X8P__G1cC@d{~>~FG_kP-U}bK_xpKDNqR3O*&uzy$&D}!u&8b2=_&;B$6z(9 z2&V0Ol_j1)D@wSRbdIDZWXyte*FWgF47RQs(-+whm7@kE?#Ic&%2{A535g*r=D$Pld4{~(b0$jRllC_`w+T3E0xe&1cjuQ&S!l($vfd$)&~O&e#WppTE$EIhBHqAd`N z-pBAJ%VJNREeJX6Pi94uiE`31oRd>aDA+Av2XH(}VG3MIIjy#Mf9p{_%~VM}K5kO|n#!u|d%cSDVZVZZ`C4h?x~47T0GCYLng z@?V`+17h4_>zZ&W1$tKf>Z*pnf3T?TOyiYo8ATHQlNndtpT*Dkiw0I#p`*aL>=OIA zx)sBohm*O20d(E2AfmHexyj_BzW+IHHK=g9nrwR-8zWd z=q-no&v<{_G-H0e(ml1637LP>`u5wk#h%0EJR_lMkhH(KY?6nO;~62SBxcu6F=3{` z%;a+ml%)$LW7-wY6T(r}vfRl(l|sJf*9TK=ag4gr`ICwN2ZSgL}`wP zvG8|77ml#qaB=ew$lf16UWD#|CLM9ikgddgW`!wc#(Fn+v>QJ6V#00YO3|z&0F%M1sDdyaP6zduD$T$ECNMMbtu7UotZ|bIr&iT^}H(}1boNl6oWlJ!!EX92g)xW#sr57YVQMzsM^$cO4%lEs3wdfC`u zR2W0bL#=FsHgw|O%grY!2m&MIC9N;md|<&>#d}-smEG>z*U2B1#<4I$4kT4xw{6FX zRizb6tx6&cO=Jhc1&2s?8`S9=Da`(;T&}%SsP9OT{F~Nu=>WlMWBbCVvRUZSH$M*Q z>0ZIDjtKZ+8?#R_X?(PveNdyJi~%7XH4EpfvVhfH^I|W%TZ!2gK-9=BzC9QSRRwEs zxb-YA-m!Z8&a9{%cBzhk>Z)mY{I*d~%5izu#h~s2$pbAZo`{ovpCa3O;pcamQ7S@h za-+w_%(d-UmGvki{Q%tJg(Vdlxwh`VL&Y8XSIeRX2^Q*{DOuiL2)hiAOTGH=%2n_# z3EkU1ctqFCMAVyLmQKB57^WLe+q06-o-{4ni9)DkN&B4HFcTOr)pxL_s2ZJ= z1ILW=&mntZIK$?C&YxZ$pJIzSt8OJk2LAX_(c`PFvkqmB4ObN4B|H6hli_(A9n)$A z=MxmdBQYYL>CW8LuE7V*e5?q=1y8j{*25$L${wcTR|Tm0ZMx`W-+;?`t0L^*hDS(Y zRY48gt!C6?v7v1B_@E;i`)svGEarv6@!B#c-p$Kj8606)R7n=nO8(3PiQt902*L=EtcPtT zW0L>8B|$A{lsWjPMOAI9&j|g+x{zDyTC9}n-vAu`w;Z>SKs`PNOEkqo-Mcu<#vBlH z%qsQrb=LcTLhku>X};xyHzcaDG9mb9TpC~+ocdn^190&j#-r2R(1=)&yP0?L2Gm54mwfy) z1~>Ni&ENAMbS*Yx=w}0vnH04IeJ_=d2p%!%fv67LyllKx>p**&qOosk@WaOfdB zgB5MoS>{7KSAHBqEZa#7Mf(+^ChSDurMqc zmr)x>!foG@_ao0JR4un@?g|sXMxGXRyx}n0+<_VdOn)usn$P@I+;m$F7_(ttFVX>} z1!Rf7h|k%;Z=_WbmAOlXY#>#FX~m!{O3_Z~cS#wdB{2Y()kRMQ+D>K+78}Si?!uFQ z^`+>UBpm*-nz9v}Z1_PN+xo+^hx{=|+;O1Z%>iR*_Adu`V8d^J;D_gN2!n?CfMo_7 zJaM=E-PeGB&H%gf+?N^uj&m$zFb6oKkXldHxBHnXksd%cREKa4{hCHO82WStEw*zY zv(#*K!c+aCRqN54AXQG9zaA5PsMRQ;!5L$#hiQRG&Ygf(?AYSE5^&1yhn`R?x@E5M z*!4Fr6zD@N-&0nQKzQ7{>|q&*rBj_NFFss7gk!C1>SH{=^)vIl3k76Pm&^ZlGaq#Y z6hj-Vj+K-z=2~BMFgpHq&gb6{*sH@&496bguVshjx^|GgkRpTsVOEXfJ>5*62BivNCE){!K#^VgaAG=?syLsH7+8;Eif395bWJ=44 zaUKj5$G@4YK=iQqFNr(^;dgVSMf)X}r>D)WbI!{fae8q-z0Vq$o zLcxpy!qJLKW(uH~6I-~3FjNAE?xFye%B!m9@vtKXa@e8Il?y+tyc;gtUs2u)av1yW zPDTI^V{F!;s5Fn>n+&ei4pz(THP@OR)C_RQo489J1yU;=iEA-px_ASrtTLuwKH5g5 zB%RK7fSQn>d8Mhu9kAl#p-~hy5C78Hi|S$#K*Y1HsL2Fe`MN!fyEhE&>j7!Hz4MAn z;ei93jwo$YK4thf8G@RJf9~CKS^Wk}9D$8eJFs}r3oe=3A01Xn8mF=>erboSipWZG zzq5ST;o@hVh1pVrrmEpC!`qIt9}myISzP9oF$xU}E2c`=fMTlw#nVM86n3{Nsj~gj z(DZ8D%#T3VV=iEq8C9+wXeQW#xf(OU{c8GBVyR6vRS2p$ z(B#~4^=6^XFX^|(K+e1_iq_8;`+nXerPh6d!?ew}CSXG!o)CvSf!Z=-o$uy1GMAfq zdNs#5HefZZdECIMsiBh2Q2))e4%Glek9KQiW_v~$^RWQ+>OLl?dYC3_X|~xv-k@&(6=kkN<@s{}{L5 z6dxkb0#*srOOt?ly$U6MXN2xsUmZ2ybtvh{xmwT<(??jGJ*eMH+HWjvxO%xc;$U0j zfKE63fc2oP0Gr|nnAhAt*TI>()bYA0wx4gSOqxU;Q|(thx~$_)WS z=gVUq6K@^jBOc)#fAMaFbB?t!gyC)zS6VaJb%sBVZDKMr8>QZ)b6(zQ!4Y+EP-zGg z=K6(O`s6z0ex2hRGax*u9(7!8?qQc%-Zdh8MDn{c{wW(KRhNO>yLaC;B=_ zbwdghBj@{v673RVh2BKIBK7JYr&cR@%$Qg;aSU#E#Iih|+VPgUKzIV~CX#-8^Nr9@ zKUf)XL~Co+3V#4Yul&hrz+?h$uT$r+CL|RsH3wZk`b0O`G-Pmbs=!k)+y=spI!Q+F zQm1iX*VF+0FbNK@s*vaFWibuoPS;cP3B4h;{0`g~oZ#gDc{4Q@D}{-qX@HVm&vRPO z-u?L+(uqH>?g$59jthY|+LsEj9@?v6K)l~2cI6QR(-qgB{tlC4gncYnqzxLDE6J`T zaQ!4pLRf9Du)d7Ql}?))0@vMXCaRE;!mi+ZK=ut!m!Vq}qm=4+p>65yDDY+@xysG` z#!m8X6h($=;#U713B8%yVRRy$z(hW=-@gnapKvVEMGOr6<8Y{X-nC_C&`>m##S5xX zk@C>oGW8C>(eTyZ^Pr34xS;!1EvRRvt!M1YrE+{rxY@>piuE;5(0w+X^X@O-;&P|$ zL6g9X>BTu*F;=;~>1dx}D3cJ9jIam_k!{_6UGC#Koo(1{Ds_**{I<0d2ad?JMFJJe zK&QC2+Mu*-pKXss{Trpk>r7{!Po)hiL~zXSvi)=LXg1z&5b4IF5N{%&e&@jO^KJ1U zdkU{o*vXPzT!+FsFg*lB+u3@QQgtaJGtigNY#K3700@gY@5`m?wb4kU`Dg%-^FO>S9^Y?9TVx(H1XdXr)sh(MTT32k z^nUFEX;N?E-|q^qrs}*{>5PzgIVzMhu(0WLE|t@r`+Y8fG3%2f6!ls9W26dV|MB}^ zFNStoMR%iy#h8k6rs!*7I_d)iJw=^H$PLNkjP;Ja33||Y6oIEl3x+9!g!3VGzhu9Y z<_LhCFbMa({`Ughoz$g<_xzZVT;V8qf)rS4VxZY~_P$lZ za6#Y$O8c=5DX3ikuF=0zxzajzk0*}D)CpDSUNqMwElSDlH)3h-U2ICKZyGY_LF_6% z-iS%#xUv*KKD~=8Us3~|NZGu;9eA4gjomXDSADe0V}_z8_p3TM&VoLV zaRiMn!(1A7B!bEu;kIq$@pD4Cv>GCZGqmmTW?dv`5R>}g4vR;F@|4@wfw#_wQ@4tJ zE9vMAB@unnM8^KH4>*t~`#q>@?Ey0q$9MtFJB5GBH48BN(RN{_t*WbsxwZOFXl_y4FW20T(x6f|rk30Q6I0dh~g|mA-d#Op` z{Z@+`cB}BDq^LLXAzI4Wrf_ZU0MCz*OBjKtl}>m?x%&f8=ZdUW%E4YIpy(4W;b_xD z?}JnReAnj?W#!(kAoWmenk3G>H$QI_Io-6w!#OuLRWJ^Zf`0#KZbm;WX>@D_uGPyG z4v_Nn`S@a(GU1p2kfkovxbfb>>sH4ODu(*v_+yD1=C({eU4c1XukTThMd-j zO=z*dGn`Anayt6u;&HnkEWi#+dlyD_rj0%3S~wcnykDIye(nIuWSE|~V`v$gf$qte zw|_-#TKk?Aun)s9J^2_~7dsXY0|se|cnb+K65v2kqs95++j0SiXN;cTq$tjg)hbJ3 zsXi8rtDv6Zx; zZjB{c;Jlz-u_*}7%dk+ttDW6qAIg&oT~mZSW)CJWm5DpXgZ=bUSF_k<8+xgGqtW~m z51=zNHfvz;JoJdr6vxC4CiTFErUR6NpZLXPTnZfIh4T0?E>g2#M`quz$En0bCQz0! zms5%h{SQ}f;TC1sZf}dEq$40Tw1j}9NHa)>fJh6{h)6d`3?bbh(u_!>ARS6~2?Em6 z-7wS)O#B|+ckg|C$M+8~9B|L`+}E|%I+r6JCrK!3Qb)7k^Md0PsK2+-c<})kxt(FI z2h6usCL_~&^vhM$(Ot4Ca3s{5lJt$Ske9prtM*sP9hkh`q8MIUV_z00-OLEU*WVcd`vHQw2B_u#YT{ zhW#kdd``)~y4q4+{_vyNOeS9~p2XT;mX6l=D=ZV$3#|lMTx(-qY_zNeiVi(B8I-E{g*W#!}df%%Pn2+cBL^RogRNtLnt|- zY?j=tH;MlOL+7V68YS+ix%p9K0NCwS(#1+k`2d$tVxqE#*)kZ!IM&&G|7@KBYZX3L z*i_Fw{pYz#PGukNdpTe|2y)|aHFI;|=~rs+Gj9hjvHi^Sw_I4K1~9;dCFk+=@?&Fx zj}hVg4;nT&ZxxZzu#P2luO=la7&Lu7mIAS^trA#gf}T>M=W_-2W`Q=r3(r>)F7bo=6tJoY zkGonbreYpF)lSlX{(6=Gx(HphUaS=vz^f2}|PYdqf|5p5#?V5w=KdLf`bAiKgVRvM#^Z|X#s2d7^ zkZpH?3_n(sy?OJd&yA6jL5}A>d@TAE4rd}qk<#mADTNVvE5N8_P3)24<}iCF=cK%f zG*#z%j>G;LrW+&{T2W>+Ad`eHJM{5&#QQd7fOUT$9kQIw8VPcrQ@s&<;^)^aSlllc z%Qv_w5hMT7OXNb;AfX<(8Q=~tbAQWT?~l8iYaw|L6@wZRa(Uq~ID$!VVh`A&*Jri( z<<}zztzvJO{+tQxeFx=*ns`R@#==r(L$8k5P#qLk%q(I&ru5D7!mIBXVNhh zWr`WX){6b&Yww8k41vnDP@>hT3ZNwUPG`xxQJXcIsK-7%W32T2tB*4gPh^^;;}C2A z{C@g%eFIzGx;zaK{ z0t%pLYFL?bVMJ*5POekq>Te_bd=lv}}Y*TC_y; zMKu;(Pn8t*zbt^SP)}55Dq!5F1&PV4fc<0K@nj1+9nw zyVg*^+&Ues)BFTZzY+GIO-ICN~7Hx^qdHGHcj+!gN7e_RLI zn!pzN%QhCXHR=!+REXNqUMDt?_{F2$@7&n&-+rj18*y$$Sy))uJDF?zI}<*r5_WPB zph(fPV?9F7LrIo+N^;$P?lm%0wm+A>7{u}xk$gG+a0A3zT#_lZCDo3uCz&^8(pyyW z{8#<_-mfc595t1Q{gzthMGVtlTlM4r-{e|0zTs2rPa z5}_$+DitYx5d_WqM-Vj=lkA*;i8A-;OuL~cjmvDjKvmDE^!`Pb?D|$VH2;~1^pV>* zv&AZvay7vvBf|q03<(^;%!|bb5a(|9OpC;W>pv}C{9YAlmD{2?g+9fs>(&`5C~FO1 zA`~9Cvn=CTi;ro$pbJXrKlGGByKbQFuCEisYt=?E=~F*7^A$_o)Iqn5!2Wm1O@=~<5AUqN~P@oR$_>Dz%!n7?b-3Z9T4=57owpPHw z%xr_qyM6nprIuA{)Ut>W=ka6yRBe7^9GGPL$fqA|=igCf?Yc21xQiEG+JVA9&7mZD z!U>?AInnaeDN7L^*ZxIBHiSQ|w5b>$Z-*sxrgC;JOI<*0*E&UNO&MQRa$hNjmib8| z|Ln1&wjeWJJbBR%F7TF~v0LR}x>gAtOT*v;(%o+>va^4{Nlzs~Z2)!4@As=KzO_>3 zhEh9GU^#Fx7z9KXF|c0HOMf3Tl;+L6As~xTeuhp0;D=e|WdopowkPEbq}$hvSj;#? z7y~pQQu3L6x2%MxtE0*qheX+&RT4n+OHrk8 z&=dvsq82vPjymi2%r?>n5{%fN4x7B@t*@smO>j&8y#d0HK}Kdi2m2dGzm7jc(5HzR zdN%fd1@E$?xlE0S=ck1gQbhn_H;v^7Ebe~HR8ECztjNW zC#E&#LEHX)7=8jz)_|~SyL?dQt*H#$VMT6<{TP>Sy_spRN?{RuD61Lx(4i_1^<^Gb z2FA{YM6TXAKqD8-Dw>HfU^sT$HLCz#wNh{W9Fq}+U zRDz@N&1q5#624wkV~g|d&R4m%!Nlb4<=Rbi`?9)qy2lx;?6{Qf$3D+gxA{jlE&lCJ zbpT08#}v*UfznHD$rJNR0T_)^?(lXJOP_>s`^ij?Uq74Xq&xi=^OiO{v6bR_9ERrjVsPUPv^94Vi2_R2Cf z4<$D#yP8!8kH9Vn1=Chb0F}eeaijw6;{Dr$`yW%UT`XFq2GC-T{$FqB@B%>|b>La~2RCQ{21U7C z57cD_hVxsuD|NyMptyaX-~1F!la63u+z!PI$PRF!kJB;nh1jMcqxevb+&2JYo=S!V zvnz>l#Q z82|PlB8iqX15w7r5gV5#QYi)b+(BlWUyoUk-1c4!fFhs0M$b%%a)_DLzZ#VVNy(ky zbLGjP*Wsr>Tt3H-9erZP>_oy>a2@U!dAB$&*65GQ-Z(0Xc&k%CWSXh;SN+Uq!VhV> zeBHeF%{;B%VP*(``i2D<;KHY{h%9MjkMf%w(;A!Ve?d2lukQ5QK0+&e^Lb$1rNZB; zw{&sT-fyrRggn?xAKo7mS6K31UDy~lzZQ1iaZD%RTN1pR80!E-AhA!*v0($NhQGj|pL6GTk*tTXq`zF=@gm_@88>B6|M`fGvE|u2j1hwBrE#e}jZ_iyK}m3BwI z7aqL6Uop&^ERpd8uPA8)hWbl333(Ggs~1|XG~FyrGrAv+9=2Op^*~*60)(dl#yF~gcd78MRR9^RSYoXymr`VOzs?L3}9b}_jsHXz)q+mwvhyYNo3GkQ9W}@O2#1}m7M_(J1cV;VehMl7V8295zx6%qeQv8qGGH3%|ADo$ z!86e<;pBR|3#(41llWj?{dZC>T!S+eCu;>}8=?4xDmrO(FRw;!MVkI=RMpjh54O#iYiqozfpJO{^}dXTLq&r?&m}9KTHJvqW$(8v7$}y3c$9LLABG10Ft6d9FqhPtItUua4>-i+Alivn= z9`B_BJB(Bj%&NHV;-|WGng9=OiP&d|j{Vj3b}bAm_Pp`XFJFNPb-HZxv3JoIVn#j; zDN}tk)W;Rmx3USaqXYk=5f{n}|$YVSS#(esrt&=Sy@^>LbopM}XS3P^`tsZ<+ zD|Hh&)_xc;`3!n8rkwIda!owii_ADSy2zULf1m#zeQ%77ftvKjVo4&Spbizl)&3yB z?5q|$X#K)-X*~K+!4r8WIAm2$jTPG;32BhGyaf@o=*%DKqVIoYV-ACu2v*UW1n6=eY2;r)g! zAdxAU12s2-Y+7WfJAWXB*^bs^%Ro<;dykiu15d%jLvaR0$4%f78kts zX~0k4Bpe%Unkx(r2lQBAA-t{Hqr$LhXb}^0k{Pr z|LYdj1o1T@WIxpRM*wn&m-*cEGO)4~1GPa}2 zpQ~@PQNv&;#Y*oEfwt4mVVZVJi<-KnMp7?1KBjjssX%GORnkTf^)f$UaDuq@6(4}{xL{5VGec7VoyC652xTrIxQS0b* z3Ar+f+W_56MOjo-ZGyM}a4~PwqEdZ|f6yXwP(>`X{s+VZqTPYgOL7!##@x2 zWSNLO(+5pnKn-$M34s_+#W24 z{#JK+(%${#ef{hivJkTAZUOwWGgEq2-JJ_Iz7p`3F+D&h#=l2$G`o+s=WxfX7^EJ+ z=eJ}gnp@4ad~b;H>WzkW3~S9x3D55oeZr2k<_{~MG}Ae+GyWJ@#%%iyTJ`E3`ffi7 zN5kG@q)1^3?EN=)6)my{+#*H!40{WqUVqPa+R5YWmtBmwxeWL^JcMl~ur{tu|XqAW*b0(SH#a(Qj6@@3fP zPmV!!-hy^SR~>K%Ehz={1-}RJEJ68Q&YwbMyCg&t@l2)d?ka1F6g;#Dwiy@7utB_C zuT=7KMr?oK3k(Y4=W(}GqT?N|zCEDnlj~oA6>rYDzJaB~`}A5-eJO$SHM`p-ujJ!^ zwf3?>`?4Z-aueObbF*9RE0-!M0CYP-zRZhyospT@^T_5O4e$(ZTg8D~!vams%}JV< z!(u*1k#-dP$GZ%v6HQxie0+t7)%iautRMv_`KV;3e5HK-yAeYXd0c`i0mcP76J4K! zSGdq4_%<^(wdzxW(W#*d_&?9)ekVZdFFEk7x9H@1Hp>OlJ$aj)6=(X zUk+wLBp3g8%+R3~{rHa$q&pd%6AS2}#vmYRdIq!L-4)zR@M|otsoqtB7Kd0qC1(7P zLz`I8>Zkfilgq3Lm6-3V_^jd7#`@RyiAADbzWFnSy3_P6Z?${ikKlm2eNcj_=DB75 z@w?KPYY9xzJ}T^RqN1$o#uV9KFR!Qh8!$g6B{S-1nWIG-kphet9JcuI;;}rwwBNS# z`U28*`foXfH%rBycyFZFv?U_^H!wo{n`7z>eoN2=s^(EtlLWdM7L0RZS6WuGI zF{rPN=`KnvUcQtxC7;Om!iAeH!Q>X_i+@+e)Ur&A-p=CwPDaHWOUaM&CGQDdv*6~n z+P|QUJApHlOdjB0ewmDy7Kz+7$a9#GM47p;vV0SDjaGkqcj&7UdD$U!1| zHF*=>UXit@+|wHj;5TqaC9Fz-V+1Dp#>1PG(d4sq`xa+gwZrO)8#R9~ATiNBe3jY_ z9Sj}|;ibp+69P#2jQj4SLz)!S884xc{PZ|7Nx)3Ee0DA|1j&7Lap6_t;FG;k%B}^v zSBTQK>@BGV>9l%hS6C%4o!e2CLA!5YF?r)mxZL91gGgYP?23pWK>_I0>OKG&a0qDi zTY1rfm=Uf3^;mPbil60_9+2~M^Gkr!RAAACz(U#s*pQDaXI}&}^;=;z)L+x`}k`f_S zWK4k?2dyycREUrsTpfJtn@BK>P(F_-#MY<4Z z#lnXkNMMIcG}QcL-HWVwmtFD{>i@pdd-aB>J1+Lij?~CbbDCjuwt$7xrt|O-%A)e5 zN8+4Z@knbp4Dvy}L8e-_20o6opTNeDW)YoVRzs*6E!?WEAiwyg5F+omxhQl>-^CS4 z(M4_ZqdTFs?eU{fQdMyZ95dMKCfYGY9wJBmR#fk{?eIYGM%5$*4rVf{Nl5qmbNhSO zZW!hv5MZ(;ewN9sY*_l9rwn&uGCUH?nH2^pOgee+tdK%6(;o7Kh?tgAD+F>+7e!4d4Hf85)>+DmmCid4F~5RvS2)D)%lHAnA2 z+jm{m97{Fp6J+HIgUhmpD#{Z6jp<+zD7}@jp|KG_`UE%5^cP^)_Mwr6fq&aqPs)ym zdDLycxX5vK+MQKkyH{_@u*S8e_w;prtavjd*E*P2*T(|73_1GRY8IanBL10~$Ae$x z<{G`|STn9;r$!w+Y4Dvi6El=&?M1VZWS|xXt%YJlJuMt9+j~Nxk_nKwKR^Ufxrdx3 zS(0qmW)@oM+9QLJ1WZ^Neu>SK%-UhTNPB1x7dE<^3j%=1d_Gq}(0?Ikwpgwu?2;Kp z?pP}}|6@P{WPKkS#w=T~A`i5ac7jkt$Izu9vtnQ|LAQ90Vf z2s<0pczpYb{x?{;YX}X=SEP~Z-)=_e>Eq5*7t&{YLVn@!-?pW9`5kt)mwC>8T=ad^ub*??pqK2k}DPgRg#&tPg7FIhnEE&%pE@jZ+P?D4w8MW2p=Na(A!**k1V>J-0ptz7k};DhLw zu9}8r;HWsx@sIOAMW?t)CfU$JT1e;2F&;M4RS$%tB+V)M>9SuoPVn)mF>^H(u{Fm^ z6c8%07CA<2+|%CvgSp4`o&Oy`E;y#aJl%OwP2k8#d>>t~3W=}C5f$~y;H&>u&@&9( zRmJY0`ajNxXDOQV))vxXRSKYwklUAtpFcl{|ES_vT+G^w%4_QtfSz`gj1rw*{@Z}k zOMYk4Y4xxA{aHfm?>qI7TbX_D1+Wk8rBCYT20{^LPVe7!Ty8Vcl4R`LFQ4|GxA<}N zhbNq`L7q$pmoD*pA%gwKTRZ{vbF&@1!6B5;#1!Ab_PgR~F)unEJkkJZ^2$zoqH!P8 zm~Ikrs(rj(_}BvO(omdryJbylqBS%v^?ADvdyUCX27(wHw0Ut07~NGj39WeLtH~f_ zVqi?$CXk@W7C_Y10|mozedM%Q0EenOjP0DldOlzP3d}im^H>bO%T-*asvCWXZ%;nQ znqI>|E@_%18;ns=!=t}}s2e~D)-lMLV2e#C!^dY^(atO`Uc;i}u!S64?Ud}4z^dI; zK<3v?j;ewgS49OA7pbX-8S=5`iLT^6v`)I?j2W`c9ALnPp)lCt@9=iLemQ^-1cKqq zL4A;7Iw{T)xwdM@B3TbAkCty{AD%NY?sQG-*>zIOk-x==JQrq90{>B08bH9FvLz^1 zy0fj3HtT%P2PB-TYkRP9f;c>~DKoUibMBR~TaPdu6I0rgg@z%}a5{Uw6BCb$48N1V zq|L?NjJ@KphCnMDNw!I$_XSO2ifeSian<^ zTVj1)gq$Ja+UzjKQVo2)M~>e-1OsMT`Z;))obq$$g;jA6`ylvgVN#ott@)AYDj>4rX#Hs}Yt<@8w9JT*r%leIz7fV1+^ z>;~SS#VmDmW4 z&?HB71#%-o`H4I`5p7%B+JkW2EZbE#(Jv|oC~f~F zN}EK)4sz$uM-*nyYhors5BG&eFYXvw92%GHPkv{!OvT62GpHhtW;cH^`o};rm_XkO ze1jPF$I%U>@$JC5pjdHZdXD6h3m>Ebe{j~ajyy(!bR<{;wvo|$%v)?l=q_&GuI#CI zSJnsX%#3a-+gqI=pF*3k!3e=)%vFWJU_sy;E8+3g{5w>%n8~fa1PIcF_za*?a^$J& zh6($A%n4VB746uWqKLW=cxIah^GQ!}>zPUz-@?Y#wV~L&_S74!`w!FW<&xbSM3NGd3aCBQ)QiCo(EHk?meeIi|1V#l{Z#<6iAa+ozlA$?a4a3=3h>s4gU zmqi7WoH+kC$hd5&4Vcd8S8sZa?q#Kb3^d8CtB{e$FqF>d6sXZo%=7*?yWejBGaRIG z#>0UJ(BGdQ=>i$B4%l6D12g9s(GDZh8kDtQvalU)IB_g&G-BHP6^3h2)5e3;SKZu$?biCOCg zMi;_0XhSr*8glLNT!t|93+i8}92~&1Kn5-ic@E8KtD>S5o=eRFDONJHuHMV2v78%x z4-Cx&q@2Hd4wpvZI#MTujQ9O!i*_!z1XAMX`av?xIi;6tX1FVLPtT={pn-U#0IHvU zszjY5Kc&HnP{zhx#t&jUKw`6^j_1vUK|D8*&&Zj-v!7m&X}Yb)*=)U4^}gpmIAMrW z*!m%`g{Jqz%9RDNMKA1m05@KiNuJX|;eEfi;}9@bP5g;ngy7e2VgkA~>Q$6gayUFr z_x|oJ?*fL@9i{Hs`wP0k-DHm>HjPulyJ%7B3v}!#y&cGrA`f2|xpKV0*}S>p^kmT2 z!7;*cmmxqQW9e3;Ljh3Z$5YBp zawTd@HyXUvK-09@(J^*Q4j5~Kp5x)s|?N*D(JGHedo!*?ZdFv z3G;b$7p7La8?}GjA0xal#2$U3_8M|Rhyw})innuRLcRib{!F=Qf`y-wxq~SS0z<^} zr{oMD#UCZ#hICg~InF&J1=b?QPS9)v_$^1CJ-eNeg@m^_jmG|&e4}or9qK36$6-K7 z*L+jh`8w<`lV8I*OgS_$g1}MJse4)vrIB{~c9$(^Aq7_c+wKpNgPu>cuOd8l9OOY{ z`%&4yP)bKwn*nA*MApyudO>e>?%0}k2PsNgz{gC>0UMK-cV}5CIrGYWRV3^=PmH|y z8Zkg&7QUo9A^M8)ure|o0xIzo!lJ&&wF8e_C7}%YiL=2$9jC@LsMZDv@tKY>SS^*2 zi!q!d3uSm`8=s|P*p<}PFX4e`$?38a5tCw@cY^B4qC?AA434&&*7X^8==T?K@dZ_M zuX=s+?AmM{N>=|U*XskQz)N#B#6BM`Ak`5%wUxoJ@T;^)ey{v6@zMP^kR)TQ508Ts%TDax*Qy0zRubHu!@4 z!0^`>Jf85XZo;+vMETvJYC2;-=hz(Iah}Iz{3)2r=YHp6*)}(Qt-;%!%tP_bsPflC zo3lQAX~hNai|(hn>>9m2UtMx~14o%R3_EBybW^G>7)KMzZAB57GkiU~w`h5R4VZwC zJnoMX)cR@m;+k=sJcR>cksYKV@y8LRj)aJ{4jc-uU}I-${P+FfPr zWc*I_+a9`f3&8%qw$IH<=t+q7~$J_S=12ivQE^?7VP=N|V@!pQyU3Y7^~v5xxNi zNd#2BzOUaq?AshKJ>!169buH#1hhd9v4G!n ze5F8l;LkP9DE72tdkD&!;_v__M7zbKGSs@;i9KC`kSP?F(}QFW8MD~Q-!)zLCk?xr z0VxZ~@ATI-fyZWxcXvI#CT{T`T#%o2`UGU-?RABCIznMDaSce$r2Zu`yGB(tuD?k1 z90$Hj1vX88C+0K=9~;g^i=3P!Ku!nDc}`14JVtDP-udA+NUmyltwIl#upRjQyDwBe z|NQ*Y-pVgMAAG~k4cA5vbayeFd3#@2WIypE!E&>qVn0HE!k0-A8eCoPumdMmlNWayj~b%U=DrzyoS8qS zTD^;FKhEK888>mf{O1gN&7BRF$ZpYn+a?z(o@9y+XiHHoTHz-Z)y9w?Ovdo)^yG^f&OO^-I z!5ra5e(I|8nDR66A3ZXZ-IO)RwhH*)MH8D3q^$0J+=8UZZ_n*kbV0exq+E|Yg2m)r z9vShin@3?eK`b>?2~7?_6z~rDg$}T0*qV9*w-DI!)!ETbA`o0wWm$+bT0O&@XJS*B zm4VgGKJ-7Cdy=PYCiv#+pfBKCatL7TXn;{L=pX z#DsH`deeQOqH%Z~V8d@30e>wD|Ag&zsdeZ^w_~Jo z#Mtp~^7H!`z%1GMnc*`Y(_b|{hBQ+I!A$e|n5%_ykC&Hqnz_Bby+)32UfykVxRHE% z8sJ_ir;4-5>7Aea0223HJ?{V^01KpbD$3$I=)>9h|HF;gH3DiDfe7l_v`0E1o|;sE zn9+lRH*iR!tk~}5wE<(@f3IBD?sPoILcs2?J(Ld%7R$<_2PQ-kWk|nxL4V8qNFqk; zLyxT2(Y4qF!usn65KubJOV4L7eyi{{NBw)u4{*>M=gO0%7BEpC+x@(4kQxMN_HLRd zqk5*mZQ$^LrokrY8X_Dp?D3iZ@B8S^ZKf}PNUo&UX#r^{cK;WtMgA2fa%@5O^@G2E zbH*KO0(WL7RPPp-eJ5Te-R|q@w;SqaS#z+1v7w>&idSUp<|0mxP8Rcn?PVJ|;#;AYlhDbK8r%;x#?!-%Oy70XQ2g**6?Yll)^)%H|!43%TJC__ryA| zzJLp6M6Cw1RkBeOY2KZY!9j@&^!2_`8Hhf9%^~4OCrsYI>!5v{c4UC(6TDQU&r!31 zAQ*fy^!c&lo4~zFn$7BL^OP2K$>y(#kg~#dXU!=9!(BXTi78@?S!2l{d?Np8-v{^x z-M2mw^hM1d{ul_HeLQFaXuJ$d1P@{c9W&SUJs2OvN=(ucXJ&cQv0^E}Zs)&kfrNP> z!J`MA8CeCrj{>J-QSubj9KILV*B@-&(Gt*APUIK+BTt9tvk3CL)ojVlYkt0W(dKF> z*ZOj;k)Q|A{@ober%$3E5{yo9{MOjY0X$(Ze^CQ+nq2teAtvPx>*s6j5PxUAXNFvC zqhR`8V)Nw77GEZ*Z%?W_#sb< z5=b}&M*YR^MNL|fz3?RORV@T#JjOk=CPFZux0V`cF+faRa*fm0vu6;bqQ}i(4}=bP zT!^&p;<86#%fj~F1F>GeDZxK;-LbV-(hrfbgl#bNSb5pMte?Ls$O50gQFHuWb7=+Y zy5(M7LTn4bz4S(|Z`BQNo=r|#3H{fiQ*H=f z=kr>uOk%u0iln5S_-k~d_ zj`C*Bxudz$xgH{|@!+qh-in`L!6YiC&l>WyJ3&`1 ze9wFI(a9uTN;!C;d!d+o4155x8D6^;cmSmm*l}VEWp{3kJGZ_fWv@N=@!hu1iif;Q ze!(VLaoY6WZ^3RXSYi4UKUjcvTt(&IQblW19xI2f68sre^UAY{)g@3f;ex@!=^FwA z9XROmRf9ktr#^`WX!RNERiI1QK@bi}kn4(47u4ps$u!`%@vGWW`J?M;bK8FNg(5ev zv=$(xl|sW>EO6-6-{+fbPu9PXM{<%7| zTZyNUkJL`SH6+)elSdiF55=g|`a5 z-oKZp&(5~F;&){JT2m!=QkzsMNONdd3oCR?5)5eg@Hw z=oBWaTNiNdc>-=u9+a_YeOo0CaLGu{|B&clG4dRPTEqGxT^=MfZS{SatN%rYZ^wPH z1tbQwPq`H~WhB>(%5EbXYJ4<)FA~IuWHN`r(StC$QacS{|4fIWPmiGIE{|?Cf%iLA zT2wi!zK1IyU{nWy6Pkxdp_XJ_NKwov7kci@Ky(gMa#nuF#IgP^UySkZj=Tvq9f0>X zVxspkib}DEtRrZ3qx;9{jJj#fMq&dE$>_P|el2~^{GA1d2GIocy&jX38PaS!Movzm zJVE({M$ZnIiNiOGUk-}@?l+QV>u>CjJq&hdt^#y+VrvT_$EMD#}Y~e9^gF zj?IS>6T|bNRoogny~*ToG4o4`Z^isF&42`%_*~}>(6^QQx!-w?Z&=IW^H1tN5Dg=A zuQG{%rCI#QHPwbQ$mVdYZ4nokmjRr;c-XryBiHfcP<}MEj`U-tYwfDo+An;DqiBR0 zx0Mb@puZ47z63|TXG3OG6S-oK(43K%Mo|l6LQ_tQR!o+mU=<~TV^+>*eH(|wt*Jo3SUCNyg z-|ze@SZ*=W3cBL)y5H7NrpfdZ<3j&YvFr7XOOv(y5;9(-Xm>~Q#5F?t`d7(jCd4uA zK%RiUD!nD}^M`9YYpz!~Uxk{3X_ryF!q|9A(l-%NO%C@#hQZaIv}a$ByFgcR6ud)c zssbn=+nrX0HMw4xHklw=WU#+ITtWt}tkA2e{_+GgvB)|aVW)-{Bd)Z!4&q!PhS zZrMR`sDOtK7K&hdn*{W2Z77KVO2!OvFh8_M%+1Oz`!W(6l5{p&LMaBlhR`9jyENVy z8uA`8s=In^@br-W@h2D`mbU01}@ zXBj(fCq&GLU(x@^g01@xBAHskG=oAfT=olGI}9L`GfH{0?WI@`xBU+&bA(zy{+^#* z`kNO-2^g{&;2ITWZC3BhwR{V9wS6)HB42iZjuc^mJe(C-QEAqEg1))P!d%I{GkkL# zWFc1MOE+<~xCWJ{LwT+go-3;4P(K0O*xEYaM$&Srf>m3Y3H5(nC0O@NgaYKYD~fR) zZz+EOaw{mv!t^RO6wV+B3y8b%2%`u3F*^_%r0zS}Q)tp*;+JvQv)+z7U^iF1CNu@z z$bay{L^~(};VXu5A{bVy;QsU)CH*GfEspZ9z2i5V>WJPFQML7Qp4sLkF6zhIG6_f; zsIsrjuj|c97f5JSjgS{#Q9T+L+A;28#?#+D7yerqevoBYxEjT?5pBZKEfW=WgQ1*A z0K3t-_SAzHS+)bO@it5|S()y{uSt>d8FGt(XjZR(_w^TX*azq?@ zWGVBqVZh8QNfLVpO77?Q!#d*ZCVd2)RrTi_bC>UU!92P@t+y}InYc8x9Vd{4>@;GF z=o*_U*N-aL7m2u$BoBv$6(xn2(VxkrY|h>+tVn;83t2J6+NwU-ogd*;$?T(2 z;5`JPwN7ty4ZXfDPSQ7ur&=-9y_#uEe$hSsybK=`#dG>rNi@%jXU=PuO7eVyoI!MRONGjnCRY6 zi_!SxDRu&Pk?22whz{=$9a7)51$v44F6FLLw1O@H9dwKSV>cJ@q!kCUp^BDw;5ptA zx8nMbjk6+bbs!PtteW^*pN{Ah1yX|=BVr^``pr%e%;;90*4Y`)gb(DP`1_I_rY#<&xYoh zWpK29y_jooOP5B)+TCw`M$HJFpz~XFZ@M35MM0TLDV!`c_()k8_vfYsa2*@g{v5Fh z5Opn~&zG7FlcD_I?%aNMTsBet$rK`Kdzt$wN%sWyqAbpqvsZa8`?0Xm5NauqLNsrAb=!a=L;G6L zBP~iR)%aAdrJOwzFQaovj=jOFp3RV|bzm?8b}!_V1j?B|s-XBUSh+_>Rc!>le$0hZ z1gvecl)HvqK(;h09C`E~Rs;}O*#o|Q0u5f{SBJMoXF|%-FDh#Q&AZkJmj|S<8s7!l z)@Oe6Wv@vJ(VKyE0}*REQ}jVzZhw1a_zcGlsdHq9p9cKSpNl~L;1m(kJr8k4#NP(5FjVTB&2g;?r} zPHjT}B*oGjOESq3v33_a+`rJ~gR5-ok~J8a1qZy97;t(P-WBNp#l-Qc;6!dsWqiZ+ z?=`2>NUKVCf{@=d+r?cg)g^Zy^`Z7bFZ~mh6z6Qm&P&q0W1c9({sZ(_{?+Vm0klYs z|BEH}smC>_^Kjt_5w=F?F3w8IW0&SNn=<3LsHQg1#s`1-d0;04awB;^ym4qQ`-V8i zLx;~&?g%+rFtIH9{fwy8UE(s-)*bGjFyU{0v%vJEOHksOo5f9HlMXg@f(bL+88l1M z?jE66_o>@blH)4iO24QEpO`6n!&Vh=UzR~YTsMEgVN#9ink;_81t(1gVq z!IbaypOqK$o8$jVkXYl~TyFdWnkgeO1<=(&^Dw@DV#OdgmMGy=bs;Uk;LrN{^?Sh< zv?AS$vBsilPq*N#_EPM(_ARzM6Y533`M~cfMSQ}r*@P8=E+FpLMFbohyp$pM@*HGLgC>E#^(Tj6E z0tuKH1l>>fj_xdhTf+{3kYWCExyS&U>+tBe^AO(f| z4Xj+X58p&Mz4>SM=n(20f z-Ad((tV!^C0S^*2s-KFy*Y(;HNSArsU3KkUlBv$!XenXER+pLTaPq%SHqm@6oDqh% z6e^7I*!K{cVEPj+8eD$-uR&;ERpDA?9s2AIFpvDp4CY|I#7!$7`bEeakk|E_Z~9Nv z={uPi(GAHr+s(r{#YE7ARCK>I z{%_&@kgqf^sj^PAJ{(*TEk5_}L=syxQHC@8~ z2j;x;k!8I3xEa_bzcKE&O9-buzEJ67f1&o&>?MyGMpuF0c&jQuZd3)6CwHoXK-Ek5 zwx12M{%q|J5{Vvt?;OGI%msEM;?R5+;6%7^jEiZW16+U`k@*1OOe2Yv7_eqF*2PBx zH!EA#SJ6EV8EJxspRFA zrrcv|ao5_QfKj;sbJy%)qvtlnz|ihoANWH)4gGX@1r#_u!+4ri?->DQ4fDyD9SKi% zwSYj2wu->1AjnNYlJnIT@M_^?10FO+-$UpLRH)Fg;ME!;wP<>wd=rWrppsrM?8Xjy zK!FK4XLh<6;-LhIJ?#l%_4&;No&Co$2z`VB(7RGO)T%cc$ONm9cAJIvks;ClADP+y z5fr$_(Si);f(I&j$C6sQ!0}Q3C&gU0b9>6hp7N~;o1hDUUgo=nF5*+{F{s4E7XypS zODu;AO)KHq6C;>RAWWaWIjn@me0W^RBmZg6%x`5rUN}Lu{3|>F0OV_>WED{he;g`} zi*i_=kKZflu$I()2-D-T3w$TaGs@P^w58CE%WX!;G{id??u}P|!twHPTh$TZ!S@-n ze`N9%VK-(oyZ{0jPQ5DD7drlbJe>tsmERYwr5gl6xzU90EKj2+WtsM1$Crv(oh%bidpAJr zbJ~B~b5yR|aZh*7RxnD1zR9y2?ETzw_WAZ93p{x5f!xZ>Qt86jn{t4)%ZH&mYPhfo zKSQDfu`|5ONIQp7y)rsGnFpZlip98lrP1108qc<2hMD0ONbkK(gW1cBp26xo7si4; z^X#zY;)sqV&qru7v30Vu8TW>d*_X`OBUOMGMC2xCo3q6;|YvqS~yI){e~T}ByLmW&P;^r?d|=?|3B}u5PXHol{%ZlmFVohDny@5^FPls z!!yFJZ={`}etZ^~DDr@aPh5J4*a3tsfPbxujzMY2tXw!gasJkX8H+NJBhq{kQ{ml` zVTx4Tt>LxrzmX&g$gK|$6$Stm1!HdBcM-m7)t8?Ho6eq+q%T6>i?-Y+*?y%(hv43C zQpE3EAYkEW0vIG8yWdk^Oj5l7x%LXtfJN6)>_3Og5qn4G7qb1+3h?R2CzZ7dxazH~vH6z)oBeRD-5=gyH3CtPz*MyqwzSHHo-!{yEywhQgE7BK(#U zzDihhFEMKVa_J50PbUpyjF0BWdSK(uH$Swrw|mE;KCvBuRRN2UgRw1H<0$VtR>2H) zrjF~#4dIh&T2Z^G>{CvW2^z6xgVp%)k%LuBB~zd}E|;;9=PiK%?ML`Ff*0qE>Bd%O z89UvN_x-tDBIoYN`lx-p1TaeBL@)l*UCy@(cn^H(NB6b z=k2^*voF7o;bL=^q>&<4BD>5<&p2uyiy^H`jg2J25K0j@5-o3Vlzdyb&SZE6fLv&B zPs{=RR*JsU!8*xBZd^G^&i)?@Ad@>kw6|K?b)0SH&UFR0>@?2R_M!ZQwpSfrecVS# z`Bi`Nlxed4vHGtYZmFl+1K_w^y~)3A%dW4F07_+ygbcvk9rT9w9}R}1x&q-0+<8Y! zRwx$NjPjDyBuM>3>6H=w96>obtU|oP^y^-d{i^v}_%hV=KcP6|KXv7L)N{zyzUC&B zXvjfL7g*nw5!>e~j9co=M5S>hJ>1^|)xjk;nBZe^j1Ar#CFpjd@`h+7pl?=b1Z(3T z`KdKrJ@PAxO;32?%_1lacIoV9f$0O;&QGcV7cSAZ3sl=jX5|2GZd3G^#?~-Df@uV7 zJ3Ei#{|D~aFAKC)cp*xGlaQ?EQ$&HzMz@N`R6uZb!dg66Nu6=gXLXno&~j4>gid3O zPQtGdmPy4$3l50t_!y?!P>MRXc8ccbKimQEeT4n#9&z-4*>I<~*)h;biCrDJ!}CU` z3L!t=J6j?GpGyqF0-tNdQ>Em#BcO5bEvH z$8w9namj;Lo=NL@e;H_#p#FxHa!{D(I|9$0VWT2?N=hO5kDYU6P1UjozH>cB0t5C7 zB5_6SeU#=eS$j+c^a1s&m=9pqtIiEiC{Ub}yFO6Y?Gv6r!8xt`pzdPkgwdy>V$6uQ z%OBJtcDF0|k+0BK!VKJTPUnT&R!wdjJ$fP|7~-|HWwcZEb2&-=lxrCq()IX*t<5g8 z^W!IKYd2dA-i^GozCa*q9}*1C6;`WcuWda4E}44$;E?E*`jdv&-q-2zsFyHxI|cgs zI;H*m{H>vzF(bnb-~K}7r*Hw@FL`UA!f06m!lfL$J);M^=IK41K;{NtwMVGjvp1DIB&}wQcpu}II zyb+_0ibIf&sW$-+WaY{nF(8+XQ z`x$l18I~t4mAvY=uRj|tym$ArjQ(BFJ;?MfDG_kX=we^Pwzz%QDGIOm3+3(b5O(m!ZQMG5_-r1mo}RP< zNG9ThAYqS&0`@K;XIm>TNl%D}s31BzY*@_+`#zqei3j2v234L8YyupH0!TrKS+LqP zq5DvAF};&zt#5dJc5~zO+i|8njpr&v#ySlmm6}lnZ;kbVbi;#_kL}M4NqqFA3O{)6 z51|lWXmp2pa=t*D0$I->m{IP|=B&j!YUgA4E5VX0T3eFv>(LAC?;Q#jkVkm)BlRmi zT?Ke^&trt64jKs(p&Z(I)v{bdCt%8W48wLguwFJ60n5eNZ|(P}0-NH?V|o>cNC z2ci^x())#ArEs71TeVk?F!Ix6vqa?O+$K6}n4(u0U2|}$I0k=LQjJT~2KtvV*^CUD z>%YH*TS{QBE!gcuwhc^UCGAuaq-q|~lzHu=%aTp`+QrN-xerH|d;-+_NVWaa()7P*mo}z4ktoiTBjO^x?d+Td zw{6P=%+Ptb-XW3hAS?V#Tc+^b5e0n)8Kj^1wW zf;t~o#>dA9^`og=&&Lwa;fJdP9&rAAVMe^kUpxkU85fFwB4MJXf$$(#b9*CjzF;^b ze&XHdaFCxbk!1GK%hL~W=w+{^!VRr$ysoyV?RyfgR|-DTEZ*Dq|X)xN#aZAVpxzt@V+Qr`#7 zG=9>dNLZ+;ra;>ozW}e%UW62$_p{=Qk|Z!rkveW{95`!3WlUn^3qJ*9lv*_LE*D|> z6~QXi@{&=>++OTTO!4rnM)Avi0;Ri5gK!e9R-=q-fsT%KAysW~Y!aVWS} zV2kcPsXuL{Jp(>LmeMY0vtU$B=Q_`83r|N(4svKExdxKsE1`72Y_Euyz5`9>JFY_z z{vNPzn6=eaC_Ys}#$RSC+QBr9d!-gK}LRGe{-p^n@CAR zpppM=f3e;9M=)co)~CXbxqH9lQP*GE7tSrD6y)!0F_`*07v^CK_3g_%6wrr zb{(Th1jWFPN~hSmYei#QsRKMPo<1tW?Eb?vqvW4!J3&Gj@!2Az8hesWBhi%^ zIXMrb-D3qCk@Ggo!qrgo)SSI&OB4z!UkWP6=E)Tvxn$IW^o6aW9yXW$ky>_E!R>FH$8sk}#?=^gQZBYPp=3Y`gAp9TkH7A75H1+UZ|aS_Mby91FR-=Cif zb-LOz2Iv1&9+{nI&{4ZkdUD2s`N-cOp9DXu7p2i!UuC0@u%1kgR+br$&;-f$E_{cHw}2&xSr^jHN zms!H7P(1f!9M%B>3H?(~W{AhGS*7GCLpnQ`}G)yxAZHYV6iaXL$jf7lmhb4RAb*X+#6${GPq7(G8qfSI}J`> zlZ<%((|aH=bGYK+iRO7Z2M*9s)3WUW1DRq4nN)OL69S&Lmsl4+F%@eT5tN`jy3G3b z9Sg*0#HBFF4&aH2;h@o~)x;&Jv`t1m2D10_%Hr`1`>!Ga)m-bSJWu-Fo;qb(0A!La zzP5?PPV7V4VN4?IQs{}lhq$QRUwymAsCxS{#22G%qn!TF8mI}I*`Y2?yzFTO<<6SE z0l#_rQ(K>^kAatg#5=Zv@yj^aLP-ePVqlSSQ{3|;)Dtx-N(pZII057;u8(9)6!;O2 zU1JGHIr2lz$oeFhv5sFN_4R}BE|DaE$1BWzUOfr@#nD6x8vLJm&5>8G(ha)$AAwix zYc$gKY|$Hq>r&uVq+gfc|KjA=x@?9`Q2cOcr$%r%Si?Vd29gF#_Gu^>qcZGHye34D zdhj424j|4a=lVb|UF8}?J#^yA{l&KOqbhkY%()&aIY&E~>tAVZNLr#qN0gzS;qwf` z|AJluM~Q%E?o={zz4gK!FfBG{Wv9}!_~t*_t`R_JdvOVjEx*G>%xM(g`j+^i!}6jE zo3jkbvsHr`)oUeh`0i9R_Tfd_=(0n_c6Nq2>Zu*CA7x>cls^l()HX_>B`vj(T^==p zU7)DHfANjG#BI&r?RT^{(1MNcL-6@D4-*pNSwaOmy6azKFc-q*%m>?xZ$Hs>DE~|f zszh%5JGO;Pmy7=$15i+fLe#9QrecD4GfQQ@n)EH3USz>dUOX{75WgG)6Iq+CGC7Q% zGnd%hu+MotNKn!AYAN4Lc4$ZL^CIZg7s?BtliOO zp)Cy{310N=q+&&h>hJcZb;O6`VB4nXgd3K{W5 zcGJzinVCPlF;RJJ_d8BG=jClk*hJ7IjNOPQk+VeddaEJDKJBt2r9z z8p)l)7a|hUxDb?@f?@*{%papGre%yyce>2xe8pASD%xy6o^3ub_6I^PK?3)2GcJhp z`x$om?t#V8Q@vzKM_@(qV@geBb_Dg@{fswhBKue)| z@Q<~3e6u$N@MERGr3eBXho|$QicvBtd7Bula{hI2zGu3R7mEkeo>& z9`!zrs9x~WCadji)p4?PE9hx(E!3A1pmX{2$`V!H`%gMYH}*FGC|=pe=m?JB>8{;DW^ z;jeT-!oqp1E^^Vd$1k;L+%h+@nYv`+^1&=nEG?m-8ImwG?5(L59)mqS@$k9HMltyq=(P9hMuW-h}^Yr9FmKHfIsK{%$A> zV+OpO#Xo%U=|23Nw}zPDXH_gRGSuTIMKnIfemF<3f^R%tD8ig&3$3iIitOIs*5n*u zIxKCh4j>LRNd4UmVLQUYWkB4w#_694+(>{4Pw}g0Yr4L6D;GY% z`DGX1JQXIMvXV6$f2~avzEh&R#bF2?9^+a+UWj&m16mdVz&b;C(P6bsbSqg*n^WO(%mmuR#FV#}c@I z6U>vX?*jf+wp7bTBNHB8*NvMfOst@}MKn$xY`36uIXgc^4)kJ%3hD?>nCYyDJ><#| zh7H6d(fM8{Chgy?C8g`^GnF1XIK%x6Y`^F8)54Qgiep_8n zGsS-Uq1dH6yzhY^u{={MFV?PCaeK{s=aKSTw%*M8<_hgtf7JM=8_KBnvFbr!NB>lS zM+-0V--rg}2==X>ValFi1d^e0iov)RopkDigN|?nf7sdN5*t|}wPo1(!t)LZ z>USts;O`J=vw|sflYTMb>-X9n)Ej8Uo>_%PAD*J``4xQEi-8SuVJc3H zkDs@|^LSz{^AAQG(RMV%nVeQ%pmLQ%upu9pOwO|ZS1ddN2Ic1FW~XHoYF_VXLeC&6iJy~y)m zT+1o;=8FOdjx5;35GQ8t^YdCu;8XxJ9|OLM_Q}}kI7CByi8M{jsEwhT>+4qD96)X7 zvi@Z>49PdwNH9bGDa^ZF6 zsP9e`Bqm;f&~+mQE=mOF5SX!%7naHjWhb>0&aC^84`_cEOA-J-AX0}JnTojQ3z>J$%@=!{Q#Sy#UxBCg zh^lWpzA66cMt-QA?k_(c8^51(-?>db!zzLmP38Q0MByq3+9!j^7i{qmrMA9~`59Z@ zs zYe%(LukbkL6jdH)YH!2yYIV8`BsZi-_!;MiQoWjX;w_7s4m%`Uo=$EhJR2WnE0pQc<8P z=&9LVrr#ifbIujAT~9F~Vsd6SjzP>2_RPE)KtasOiS6ef^r(D;g+iYrLH;)Y^YQuU z4hLMT>%=ciz|Udu%zXm9_V92Y9W~BDqHp}s%-}R#KMJ_^_=9In1-j*PGa#WA73jSH zIFH-x(R6uNh)=72^GRT@neqhGQx0+w-nD2HXe}!06Ryu2i~K$S=Ls&lEM?}BkY{(Z zR5u2fvD^SWm2usMTx|`=^RMi9$QiUBE|nnDOX|w%va%r4h52^~9|8a&G>me1(JnW+ zBYaWFpsqJi-cw1&-DJi@-(3px6-sdV(G76A74)kT`uEESz@Ht?rZUkeu%P-mbZg8l z84%C)VNw^*TU5DzbiA-91D@XblZ}@TrXL-A7FAx=*zq|fEf5q=T#_<3y0=r0gNUy+bPY3<8N7K5elv7I1k;dp)-xPzC>5%QNMvt zkRC`?jB@fpHYBC|5LV3`B2mgjsNV)pt5BksbWUF zdH{|NPUp+AF7`!tycgYt98(1@USD7&!dcU1=U&UT;b~f#TcsWzXlN7x2&~B%cH1t; z^e_VapSfr5Kp&si(qSuJ78arD(viN~-;S}KoRwg6GZ%B*Dj%Fz0n2yMwcelsR-BT6qCNj0T7{;THrm)DQ1O8Ng=L3n@Paz7pAQL(9krcb*;-f;CpBN zD}VvDZAQlPb|1eqJ-%SpE>;*){EpgX!}dybL56~Jl?m=!Wq^44B5!=eF- z6s2XQQ-(EiEDu@wd(%+gq0W`>R&qy?jN4^W_DvxMa`bC@Khk?zZZ)!P+!Px8AuyvP*9ckOS}d`UTsm|_g-yFNnC4&XFmuv=Q7i-U=Ff(4!|kps>W97XsV z2c-SURSgI8Q_7(I=&>Nh-JM%1i<+DHf!TpJb&Hv-q5fG40{9@i=)6pKR0#au{W4M8 zL5-Nx1Gg z1F>6$Fuin}T+W=i6mJfe8jJ3HcV`PZEB1}K9q{{3d#LOMV`I+21e} z8~0EF<*~7SU#j%*7SX{pOb;md@32@hSC%Q$#|b7IJ`%wsTc;n4Ul4DjM|znxqP}~- zrrGs8SJ>+w`~uqBQJ|sS*Snb)QpQtZ^5%bW#)EipSXm)3F>Z)mIIh=_rQC;&AaBsx zT(6$mpF0x!Z`^P+gd<*h+5b5!eJr{I+w%!M6#jWFsA#*AZl20DPxD7eCph;nAmkW6 zH3Rrvjwnjeo>{Sj$Jmv}zE8k+42b%>?JDfvM;MshH9VACMEX-Vz;p86Q4qT3f0>%R zC$T?{foQ-5YOAXMvyMtyivNbWfeT0U8LYG4+S9QWDSU1Mxc&mfAN4l+_F~E>nnLi? zA-tJyzPIH)+!uJuz^R5B?d;@q%MpG0!L-1QKM(xT7(6+HejhyyT)QVI-I^#UuQqv! zf?SL45_e4yOS(_f0?!lSwYO*c`&;p;^rLu83OI52svw(sgnntD^pEzaK*%8of<>+H zSzy1aYF|Mcx>s$V{M^8qNkZ$Gnp`!5I66NeqxDV=keI~y*KdDo{o1)rU%(|y@j5P- zIwtnIvTujj95=ij8ARfdzf>rW#C*y+*7mapf9$e(*OYJy&hI zDg5Paj);4OvA~JN^Vfdl=ex9N>!Ii!t+VQsW_5tdX3&}1N~3Swxlj@4d^sg7>xzyK zp=Dhixr%CuYoEWabXN;IXWZ{qQpw79m}1=<&TDCC@7VlsM2!`hnh=z&@S$%8Ti)np zbLw8_NuAfkSeDG&v2c2}Qe@gm156l=ii?vJY?-P%8oZ|N1aP?$I*xZ!Qi@UfIV*!` z1Q6${qA#0sNUN#fdARhD@BS8{sEDF9G7GmfzC9sVN7{moNH9biQQ$OJzHFfPk z@8V1Sx*4}M9xT&b1}`RW1hImQ4=}5Avk70moR}84iTxdd?e9but)P4GGOc`DHB8TsR|g{*+`Mz00!Td@1%m*9F*V zruNxs{d(;wZ6w`4n@>@Vn?$~QX1%QNiSGBhkaso;=ip^m$h7`?2i^()Z|(I5rS-c| zKjMRmj421xV(I3P;KIP&>v?~|HlZtwrogbx#T}sc#T@VYt6%41u&poPGW1j{|23O` zQnT#v7V&_NyGoF&@M~xT0ZXMY_c|f8K>)pX&VyYAG|?0VLtm;$G7p_&fc2sGTpk=xP zkqm@@jiIF2k)ni8;U$d+yzd#L$zu8KQ7FhP`>rDFTRSAT0 z4b~q3Fle9L+7GX2JFZDTyNa5CSUWoQ+FRQKR|i$4`Y|-wQ{S%I1Bn;s$1Z2V6C#R& zvf{ciAl|q`73A*(rweU&3ke;rIzMoh|E(?=C1ejcX%vCvmqT>>FbYz>@)w{hy0Q+5&eC2+J{V?|%-1$^o;H2cXRT!VEy-dgBdgG|$BFDeWAjf zh6q=fo(60WLk_6s#G5Y%E~)rT|5+ko)b{X6haArZ_LXO7xt0%np1$?rmglK%9CpW2 zd9|u9c1*dmp?lLt9mEy5t!mHu60*(f$CQ2<6GZpbClR=+(Gg5Yo^NgrV5?YN>FsZO zwgRuWd^s{A=%DQmX4$}b9&CW3&yu|`Gli3)F=kOPY`?;>+4OmXA}4-KI!h}wApOGP z082W6{d)nGKlC(|lWwyK7fBBW{+f#px(I=thPc1W6M}@?ybq5H9Pl1>R|5$!fG84E zFp)mmP^f{f)K-^*wzn}Bum7zJC?nm;cRYPh2Lxz{f;&fVm6N(@jug{AI^r7?guoGl zMA|OC`0k7A?FdPP2l+KToSE#7G(P9cz)3&v0gJREoi7gPVFn?Chv zGA`23vBXXjp~8f;&%@tm(N!wK1Mu|WXJ)9EeL^K6j+^lxknUgm#C4Z(Uv{$sTMYjz zA68A`z3@WS?2e;+SOUolFg^B2u(mjHAd)wa+<$Z9cm!5X)4Kg*3+uTKx`3T{^sxH+7V<%tGq3zUOT z)4+*Etqt1V;wl6WqP}M22zYZabJHsa)LpYb_~Ab~);HLc{wjO!0*c_xCw5wNFg+#+ z$?m{U_^{dJ4jTGPU?Mz%j8sXFL$xd31`;M6rSz70m=BKd*Q>V zsNm}dh3^CVl#L=gcco9#!~P)eeo{T>gp`%#$`jYv&Ou6|6A1;w z?#Ou{NSG>+o-T4zQT`7SJ$u80e8wc^Yb7uBHVPJEx_^gT5_#9;cvC8uv%T)zh+T|B z(rt9AZ&L*GhdbVD2SRwv?{d{uRU`S>(y*C6{6p)Y_=}V$z=TgVacjeDS* za+9pQtWpqCS}+EENh|4g{4IG;83 z5zwUe#5q3P^_8p)J)^kxb+_dj{s~$>e}h&~Q15(+bB+D!j7DHaW*c2~5W1V6oW<94 z9w+O4&ack7P6Z)AK=HPKGnG?M|D>nq!uGx6EUgHy;k_%P6&Yh_^}JTfV?7eeQr%ix z3BV#HkH;`Be10*PZ}TDp5RmgQ(9lF7@4`)dRScON-z*lP-%Fpu3aXFwTCcHM%(-c2g9vQPn7z9Dw?KJ`XM(|jf{u#{^?9YjwOyJf zWWdMAC(y9Fc(GQlp_h4DlRzo-E%e(gm$|JH{HGecuII_yx10^0=DKIGm$HSeYd;x_ z(4J&p?xS#JZk8NWgIzz-P*P%$=d+fN0d@8C5+??2XF&JIgANhnh47ZNK48rqW^nVG z7C0oFmJ4mH0kiyP?2R&8sMyyGt63n@anuy`Ds36vK(p_e7dfWEihgJ3in4dmL@udc zd*T34<;vac4J~byBAiJ_;g2?K`uBO9abt!Sa)*a+)GFG~T(Hw*g=6YpQa5B@v7B@& zC&k-;1<^oj)dr}wUp|z8v_((WW}$`pW7_~3L0I6dkvoB&Bq+Sd49T%4-Goic=u2%t zdgy?fv9kPzOleQ^_2q?+jlwg!bkqk+it{(>URI^Y1deHB%U?T1e6>)>>uSYc@g|Xy zyj8Mus|hcup*)c0yjgV_sBe9sH7#b`ZU_l7vwj?l{3WUJ2V zs}^x>Gg2OFMRRlB*zh4Klc7HODLGI|&hj*ViYE$mE90h;`Q;M-rJaA@**mh(qgX|o zH}md>Hc`$pK$oH7sQ9KEkyV<_I-26fx)3awi z^EWWPHZO`cO@d6{9l44|Q)%JAv&qx2e!ni_B3b+W$|SZSKTwz4v z{Qe8AqRg^FBQ}eqj5$Gv6wzrl&)5wMsNl|&WCUeYZg}z%13#5##)4$T@v*^(g_h*V zZims6So_%R4E;evVG@qsHyu!q&G$4Lu|-OVn6O&O8zU8V4#|(A>?~v4=-9kbLDzrz zQyc86;~$Ll%5oC~@L^WZQFESSoI(nE4w^I9kEyA#De#Sqm+))xu{%3}5=bOBPf6hD znU{7yyihiITzk7sg}YnN6PD7&m+tSa6pm&8RZteoe{UMVr|>oKE(PCi1O4-w1X_D9 z5t64ug0L)^Fld?LX^`i*YkL5Pr%`3}Ola&h!+yUg3_o~>nEMfai9$w|F>$|STB}a@ zZgI28w~I>f1=HMf<)}iuA*O&N$I)RcZbNSyB=U4(RjTQITi340Ow{bW+C;97BD_(A zi(}p*0k|;y!JL$l=iF_`j?ZP%f*Ll^J4-3=k2D1kJCMS~77>2zO<5CvI+VH%&28Zc zetK+MM1_e7zYcOgqE5|8!5VBe4uZHwPCow$2pUq0d%B=Ed}%j{ zq!yF4*zWc_thTY5T;voT`{Z(Wp@xAL3d3b*A7~Oe#rlcODI?X zYQ|E9q!g?-Q}eOTDw$jvjQF$>f_J)2=c5O#H#d<~9#<}%H#aINI%|yln|bt>i8LrS zcBwy1yW~xR4gf?+C47j>DkK<$jP-l^BQP{x6ylPw{(LoP=!R}Z!Gdp~^fF2dl+-;j z9V=!eSYU?CZ57ZDMiS_=Jghl`VnWP*R9-s_U%ZFZXNMrh$jfs+(P8sR};B~-09KBr=Q_ohjq`c&vT zp*vBN$(us^>QQs1O0GG^f%gY|K37O~>)fVoS|ifaGn#_ny_K6`Qq!@am^aqHvw2Tt z1E8(&iLy8r^FB&0ZqQxqj}YU;SL+_ar{GhT;(lkkPX1?5Bai97r+a56Y7{ro4gGp! zJU_~a@o)-XWWM-c);IgLOeB0A6uQJq^K_1jWqe z@a#|t*X|Ib^*9bQEfk?(gaw^iFaAi{Uvut_fJMvyTP5z?c{w}y)4rJ*_m}&?g)2zR zzYX#c|?nPfA{yI@W82w3p3&R^~50Z z%0t+GkwfIM+ueF+AmZlVNB+NnlnNDOGhoN%@>|5PIb+GB5rrH1` zRNm)51E`B>&X*cMQ#Wtw5$Wd&1H2+~mAj^}7n>aTL4e4=r@i#vOb)~Mg}{f-RZv|k zd==5h3go50v#-;i!cmtKmQKQV9^>AIB%-tRI1YwS4{BHT5$2aoZ6g#l{AZ+JhZ*`N zA?sbA(arddlYmeB4xOmox$I$qHy!Nvpxqjr3xc(v(KFN14}o{``Ik!YPfJ=LSKIs@ z0J>L^0m?|wXB{k!V{GVIuL$U4YhXO1Omex~Zn`T`M)0pcum7A3GIjQ;C0)OBrjfU+5V;2KNGFO22Yt0E-GcO#Dd+(;x{Sq&w{d|rDColAw3 zem=*4(9gOD3L%IR!k!cTON8h&2NTRM>Fa8p8=8VGNA=1|Y3_5)WR^^5*#X_w3rS6- zzb2AbB;LUV8SwXvPQN(S!|o5FEoG@XqHtv~QXA}Q%uzgdu1zFfkwhPVoFr`ptr7nxC?E_4M+&+N+xjy zq=0EVOg}g-vu<&lg!hJwQZezF513%w(xX+rzVr0G?{#^Wl+EP9qLEVuZ5C&i&u^Lr!)Cp=0pJWV=x@+L zm?5oM5iCX3*XKQzB>zF&^wB{7Fw)#VFrqj7Lfk?cB&x^{wi+nTrau#MNFLW$&s^Gi zYTz(z`Sjf%CijdBm8rB8`8wY2yvC4a>dO3buHAWEL23QQCo)m^o%)Bn-|a|Z__26x zYYOnXkV5-|(E<;K67$$#xQ~*w)c_wZ1DU3v?~N6Q`*bFA9I)>PusEJtTn~dL?2(qk zn#B5Mvun;;Fkkvdq^f8`D8=87#d-z>7zuHAQpspXZTNeSN6+Gn$+>)Wo!xuJd6uaMd zkB(&vD}9uDepzc^##m?&a^83sMZ;&DrPTXs6oR-5vB{+OZ>K>s9%x*Dz`*t_n9(RO zdM1pX$97gWN67hmJT1WF!+`JAFlpgrf3jm#zwN|rToy-4tILN?zq7g~l$4(MBFh#x zS)Ve<5x}`h=9}{Yu;|M9yQQ$!Bfa<7Tz=!{cJl&b|39tS9XapV5j2C3z(;#xsn6k< z**?Nsi+wTotzzJHfrM25hpp)`JfY39#5%)fi6OzUIi$~bOQ4VDgh)SYYz<*$QMKH~Y2rh)gZ0nZ1JQS#XRtEqnVdCtY=*`?v_T~ifTQNX`k@_V?f@hwT8I=6 z6OvFSV_8LQ$Or)!Ie((?*6#{;9M=Pfq3===8c#ose3%or1rl`L18MBH+rRH((dB{e z2|Lh3TdS&!6F)k|Q@QS^ATk`a5BAeElKH2EznBExd;TU|f&JdJGnfc#m9b5qoV8mibV25CjBrdq^@ES2XDg$fn^K|cLWhwf6 z>*$VQExVoiNTBH~W4(GiZF^_p>Dihe+&eLG%s4In_=5`Tvly2AB@~V`%E<7cqkE>k zwH_+|7ihn2BTHGD2D=*FI#Y$6F4P{JH&115Mh^s>ft-(<%>Na-K(1Xl&Lx>7X%irE zGN^m}@bB;BT+rwIPp5%(wp-hDJXfS7#7c#|wr(rdX}n~9GFg(}Jr50=f}nmYuWYzW z{p4x9s`6cSWB912+JF4u_+qjSf=hNjSDab(1xxu*>x*^ZQ>{=9R8*I+?audlvAwy8<5p1>%k(opx%jIOFfl709gw!jaqt@s_@M$O#aiRI`q0YkjU!mlu6IQs9v)pW5?0VstakLOU)) zAkJ|)onJilZ|3SseH4(=&JK@rh~nSRev_2KtB@e)vCHmu{&RGEY>*%=0_QC<{GbUJ zk)I;v&M1$YHM+fBEN1DkrL6%o`ru?tAo6ynys>^Ccxo-*^Cjrn+CYne@3zO=YM}FI zydQ%Ww{ijJ*ZEHx!d@2X$a0&ndf+&RQ`3O~GdekrSl zloDp;b;(Rg+&T!$DvaT9cjNlTvHsRp&ulmXq69XfLwSi_0;{+pz6SlEUTYuh7bHmR z*xMgx`7Wj7EAT7Kt;+tna1zhW{dQkec<22L;1UGT4)T3I;Cn@AP)OfYgCDt6^|!Q~ z^c{sk)u}fKT9==I39qWc9E;R{%{e_j(zi_8H4D6ba<&6@Ud(BZSy#7jy1nsvd9#8) zdRL~D)<>Y3tpkxvO-r?=a>&_DwUAB9u&_9??R2}z5S0wtiO71bq)Z*tevJIw#Say< zh_MZ!^63l7p6^sOLEU0uOnp(Ep*%ST5620fIuEQIDJmJJ{La5d@~Ktj%J(P^Xg5ni zjK^4VmHTEglLmgp!aD^7-}6y*14Z)xZk3oe9i*zfW5{hmO2c*c^c-*RoR02X*yPTL)M510csO#Z~owfJdI| zkY?uVTP8!qf|khcUGN07F9CpXKfD1es8cZvs;`>r*Xw31PGoU&{!h!=JH-S>bEfD%#_b3MY_wULGb|wq6FNKGsT~V-+PLxl*o915Bok+vL zP4S7x$UZ#rJl?EqcY4J$!>hx6N7xT@GO<<@!aHlnuHU@Qk6ho$#-0RH|U?uSEEz1UHYEC4BD98`V(g^&X0e>eK#cv z#(j3%4DiGpv9y)t-oM{z$`dh=@VM$9WNM((fA>XL342?yNc z#L*GR@@|x%_an6FkQ2JOa9Qr#=KDk`cw>Q?SvvJ{#W*gV*ebTq)OjAOav&qi^do$3 zpA2_|Gyt5S`s%4x6DpKo?8vhlU zj-$ZaD}KM5b@!=MC@&bg^CL;hS;k7iDKXz?0PBX?Z0(nI92K8M_z#0NRj1zPcZS^_ zSeXD$?a_@W+5lGCpgUd$(oc&y+;It}e;$Fi7yiCw)oDqw66sjj3ec}e9jmw~`AU#1LGDK7LY zT#_J{%UD}_n2)c+Lx+G~m&^T*y&I+m7J-6vPj8(=%3mU(((rj?DEw3_f>D8q%HQFX zsW3gn>_!H}kZ6n9pU!#`WQN~TH-e}t(?INxMURD1xYRF)*I8qH3u>pxr?yk!<9NS# z++Y%^>l&zQ(6pFJnz*!}L3ph2Qq9|}c)Ng0J zzU{6V6=L|)zSUInQ6&KOcxc!AIh16C=>y^0td$1y$F%(5sQ`C#$zpB$cqNbaZ~O4E zF*Z`46(v!EZaD9Ql&Byn0i(~4!9r02z%ztjBnU@7{X>R=gAR`Sqh#s#P67Lq1w}lU z0$cw`8d0@@hN(YrJ`NxZB@=Kj>plH^F`b$cqp9Y>{vPrHiJGTS*e-Ge~#w{AnG1n$37)SQy^u`$7t&ekqYM{vDrJHwX z&&_9-aeubO56V0Y6U9vFcZO*`WhD+a&0JedJ?oU-Gv^CSmu9mLpUdmP(QhaZ1`wd7 zlC&=_ZV0G`SL3*82?4YDS8b2@uM}9KCdoz7-sHq%^hr`B;A{dtQl%>`3k$TI#N^Mmb-N#ZN+9

PBsW|TUrq@abKKMX zb?RR(@wmY6o@`nc#pz%rJP>0&ch}Z-(M@GO((9l!xE;2WhUgUehY{^$4in^CZ`U`- zF|$wetRr|!_;(5v^(M_wgjCVyt_Y9xf@UnbQ>_E}X0koI9oe1bZfz;Vb3yB&%)azBD*5NQMxG;|X7oiJRb9{R0o2=-^B6HHA@OeGLh7sWASMSE>m|FyYgA~Y@Sz1({h|A@rqO9Ck_U;QJZEIph2E{Xq81&K-MnN)grFc*RmNl~IlgK!W zfLElM8zB|im2Vi?)PAJGjj|8eUO(Z;3s7Jos(n(Sk1JYdr3T64t{WW$ix|^YeBfX6 zn(Ap-A-vKBRSi90vJ&-W>)4lc4K%V{xo~p4oq?*-`9??`>f>wudQ+rm69Lpfs6Yc* z);ms%rq@V!SUa!3r8yKqh3UpLvIINMyDo^2EepHX(|e6m;grfiQ@$Xql0a1I&xm`p zG{CDzj%$v0B+!V~VzP*vK3O&aZ)qYf18W$9(63Kqj0A;Is74O#Uua#+tNbxa;GWqW!eh zBBv4uoAkVI$80b^EJ4#4(;C@re|C1x6ua>(XEx-qcDEiF8A{^ZK8i?COEcfW4gXZC z-G@@%)(-S@+@u;c0q&`P4i9NEdbu0Dp949RC9x8R^aB1)!s+0< z#&QKM9fp5TL3i6A1Ohx#m1Hqwvvrvzr_pd#A3~XkfjY*eVc1{-(*GmFtnq_{z?-Gy zYH8igChXo_^lFgc&A~I_hji_q+f?3ay3c`b2bzkj@V4MHee{F7B!E~L%$OgBA@_`4 zj$jRnM&+!5yyGL~{vp;BI?$ivMz%LClIa{>ezX-aWS z0I+k6OFy*d@i72>k?{cVwviQ;rXRLzew_L_cA=VlSw-kol}uOPLks)qmcpg$dzTD0 zE0--ID9Je<{Vz%Zt(}HYWIm89Vm#HP#nxT1+D96!tNsfvm@- z?1AXT5Ewktz0K|{S?HzU`r6&C&m=*<=Bp+L$h9@K_e1Et z9m-($#@W-kRWTlq8vUC--7iYW3TG(J3${f0V%{8$yN1%*g#l(8g_)VvL*3HW>uYXU z|A+$nO-MMk3KJ`7L#f+5wo}DbN_x}-Y605X7~lk6TwT&9M(I+{FJG`M33{(G7IFPv zBvC5CC;#n>ows@RyS!$`BIf&O@pO>L;$l@7W-PfB=_TlHKXVd|&(e9+qjeIEH%UY* z=SkbBKOnMDT8VK9f(PE<{f@AN8uC~~^iefAE82u26Od^@Q}XJ9k{T_Vi()liVNAO0 zRa$7JL&csU5gjjAkibc62GF1G{bb`FE%C7M8izN?sJ;9$d$n`(Bfi}FYoBPpo!th1!5le3J(_o_Gv00hhr5_6%bbgN`X!Omoa>UOFtqeFZUq)tp}&SKSNSbA?c@#= zEpUB=;LA3A0^(?%uiXaOy6RvW;`|t@k13nqaD7=YgE z)B-=W`04Usl3Z1nkODcoub()0W+`th{F*>W4sf9)1biC=P<%8%E8#@Z9JcIqBKg>s z>?#1$>(P%Y{dD?pl_j>z6FZgZ?bYM$$cBqBySI?fA|zF$z(_)&&2w~I{@KxC1fvN=m(i6RLx zx&(>g#hmRowu5YX96XQ9m|0f)88m|mh31!W*ykQ)`2#3S-Z^xk65=}aW*!4itDalYlzZiPg8pSw>?+!ykFz|MB(}yU<_Y*QQk6xl=)rBdqDO^m zM(=7!ghC}cqFtph)#wER%Dc{jvN}};5a8A$0;W~{S6(Uc7H{Fb=vO;$%HwhiSV!lm z14i9b4*=}II!No&@QH;p(0#=EjN2I3etp%c@s3$^aBb@~N#kBoA|-GJW4XcNEtral zR;TRcV%BmkJr_gvqdg_WWDv0s9UFPgjei=D4r?u>Zb_K~LC z0s_SmFGs5@130IzO8y8J&b`r%$^}z%D}F5${gW%#7JL_8vbMW5S9AcN_xqn{V$+Jo zsj_LpHLJ-x!K?+=L#@uZ2i|mr7(dUiZTUj_n&g+`K^-2K-F!vuskTY{@lE1(?)_;fLefFP$6N|+(3Jv4ufi;UIScGBYUHcl= z7xY~j17y$g! zlmXI*zf(4bI-lV>1C5>uNb$`EW|DsH(O9I)}#YTrU@8OCgel*2lQ5?N9 zYfsdlQNuC+0*^W11oXQ{mn!P&y07;6blTq`Me;Y>=(Il*l5kg?JN?*+OrW0Z{H%HK z@@JaG%5bWIS4$vv$j()TDRN-p{e$Gn^Xv7Va9)7i!%l41zq2|b!&UhyAUfUVXaI}= zAM3+(`V66^-tT;z|D9STG=XkJq8Th@Q~QEJH$+mFIC%L5=N|u}{a@;|JL7f+esaMw z@YV9PY}vCI(QyWnqwIYkNR9dTXL+$pE_HS3Ce#SzS^}IQG-Y|+u35R#Fe|OMF+*~; zvm(6O?i3Hte>VMzg(Vb|axKislPW!GJM#|nk$%Jl3+xwqO&m!DtONDa0l z#7W*IkW0$0EBIB7=DFJ1b6hUlH3W$WyDY30FCrIT6z;aWY#|O6wSPajD1}HLMq=Ig z-!yGSN8*tG540_>t0UZ?eoW=wQ~&R#5r-Z1>~S|bYN2N@lahTJ2Bw3la8O5wA&vh& zbsG!~@rgxY%uh{68%`&1uo!~#ma#10>Bxp`?(g3bLF-^@^F~GFNRN*CvpTnD4-3m} z9}eC2yZIB@DM9m>HOr(g*J7l@^?&y99~<^zi6q%^i5+HB@g9T=DAqR7Jty{ z#^-$t7kkrk$)^>esYsT2GuUfZQtgNi?$;h0B0YmAFEEeK0rk1s<21< zw#9igU0`nRv2ON7w^KBkfBPm}xVwa2S%7%k76}Y)a@ob$a7{)=IFkBt{jr-WFcV$} zDgOMQtU$Tlu{%$c0CD+W&^#hU`%IhfDw{~nYeW9OYvZ%eW< z8J9jR#NRtFZ({2`uQ5qINVw|5ji3&6COe{bB3vesMnOFn-0^nIxVSNu2;$h#>Xwfs9vvQ2!D@sC8r3g2U^zf+8rm16H0n_<$>$? zFY=WVKlBk_*&N^|90zN{bXIvY;&V^cc(9E>%*<_wD48Kq4m*b>e+vCn-qWKkBkND= zgUyuT&oA_wm;&F)+f@8kGaT(K@-nAy_e!AZ+d*KmPCcyUX=@FjU~lp~{jXfPKc;qy z4|ahd*>N8HjuAl%v83hW!_@ZFDyb1n2w|$IgFf@Oz-Qr95InX?Biw_P7lD(M@OjN* z=HrN8oeC?urrN}6NLa*I=5vwGa1`fH>{3{Y9!aaO4^9i9DC}zu!EKZg4xYchN}*6= zU*?bm&Pfyv8{r6mI^J0mq%x|UsZzM;K7X8k0&KvToro@eyX~6tPU-%*GVr5-3x3u= zj^V#@`}0%%2Lm%57bC)EEW=XS)O(PTB_-{T^6l%tF&`(KL zZ(G>0MU<^QLp-Ael#%rAH~Bw>dSysWpRV7BJcp4_1$wcyf9o zC4*zsG&a=9AS#hrYwNvo_-Brr;Cez^w~SYsWfU{aSZ%qAWD~TvPg+@yk9OaT^8ew5nJJtH*xaOy&GVw76Sc9o~bP5i|0pI((0dj{_aE zRii(py`rs6yM#`*yrc#nlhd?>KCHaChU@_+b0kKoy7o#54nyco?*ej-BB~*^ma;?v&PV{aY@iyrq4n~7vYeQ=`W69uSpR`Lp38rW#|)l zr@X$BK4B)dY>^4)gr{vuQ*fCXK4U#J-c_pNlwmmo*RK@)D1aW|MhXO<6WI&J@XgH+ zM4@`?W}CMNTz~<%p<9L*Daloa$HHHeJWP3^ljTKv>D5ac+~`CyY6rkUx+5>m>K@?TppQ1Z&$S5cY4x#ElUSg{vo$Kh(;q9=x;-QJfgh@Y0 zRFF?OV`&h+nihAM2#`=)HvP+8xPxuazwGf=Zd2pjYQ5)Q|1b{JhgG4rgWE-+163`J z*#ezA!hS0HHa)fm(W?61g^dD=l@ZORzj!h>4<<0!-g)Rzu~ zMqWBvHQO%gi{AA1@OdqX<@i5}V6d$+wY;?(cN|ViZ#=<&3_3Sx_H~I>3pn;Ldj1VM zctlA6kA3et7ytq|oK>tZ>%5I_7EM=8Pg6XYsn}m+rkW!q%2P?Q?PX7j9*1 z=fg?SnoS~T&b{}q(n!U_BSz>UV7K2WeI%stApFGkFu`g5(JI<2jx4wHFRNr6`PJFP zgpH;=GRl!gbU+IpRZ!uw*|6-J?jL%Yv;pS}XgFPY|E-6zSHVT>_>i91^a5mr-1Oko zv?*-KhN*dLX77O7&w@eNJSet~{YvT6r?MNVbKl23<=}&h_Dv2&xNl9qFq?6vOKfrm zJcmtlA~9nb@L13dUjgjIJey8+o@0<^Hfh8B@58~p?9`*5*W{bat-eMO+K+$LrniOe zin7?Iv&4Ds?RO98?(ZE+Wx=8i#_r1aZIx^j{Y!LgcNB}paturv8J!QuHt!`lYxVz( zEMygBw$2x2I%1LSFFL@B_Uj&1c6C3EL&^_47ecL?gKVl9g#RdAzT7Lf+HA+qkkU&f zYg4ir(lV0Vqd%7POlLr?&wARY1s`9-Q#G?(l6mx!TOb$1cfZZX;rcM6$NyBH?!yL> zj*wqXW}-}AWn}sVoFaU&h|Kf|>H9Xzt9>EYUgU5ZhiJLm6K-G^oa)hcY!ZA_`IkYA z-%LfAilJeuL&LlfOl*|GXKvmDaYQpG`=$ znwZbm{fwB1{mHakDAP!CwoJeYE-<4LB_TzJYBdjNIUVzr3?o9DxDDmzjR|zIr?a@$;J)2*aSn@Bx2FAnqWx<3w)%3 zTVObiW1^l->ucKOmpMqlH@br!071cj>Ooj(c0;s^6w4OZIClQ$e3&?BB$UJ3!a!ucyHb|I~vaO9azISR zn4WA0#aV@!w-=I}(^JbTB!Lreuy{17ruMWA)i_dAC zhJ`&aw%DGl5K%EvxhNb-EjDnbYBjTdW`A#>&Euz7^hm2iG|(dGE1He5;eXp=L}N(_ z6nWLeoB--bu6ZT8D*&h!hlSfF{Zj*4fM}hF!La9IO;9!xfw<>)SEUrF$`f2!rGYdZw`fP!}0HTAMY> z`}#U_aKVk#C3+6{zN;Lbop+Gx!J2Bog|AJ(b)2I;N5YiaZk@S*-=#OiL_C^HDX(MF zC>{1p$vW;J$<;7nNQ1%Kq(e!;bg0&&tD$PfCJg5{r-GT3Y(S&^_InPglPR}AT(i)j z5fJQ2m{b7f*=c$6VpQcXqg&5Ye!f492;2{a(_ zbqs2#xy@A7#k2=FfVwnE(9Q1KZqK7j?oC071}2rEiTiIe0>=PzI%D zfM@+OJjY!eMuqt;(!QEMTd}%Wh(f-~?F(0@r`l1E)j+wDn~FQ>VwB)Jo5YMagBB_i zOW1twD_WyQS78%IZ)w+;gOWCU-)DdI^lr&O)EFj+ZVA*1I(yi2;DMEJT11ssGd(4g z>amEtwk$0vO-#Jx&&#r${Ysjh-$hc=n0z9hCk(&$OZb zsoL{!Az;+#pHXKFl1-Glew!m9C0!We)28+VCS)W|pwW_Z&EPR1*LnD5@8H&PdIZ6W zP7ecUOQbd0a_ZrXW2mYFLv=Yk_Ot^pc30lcOq z^}i_x_jMJG5-nSBjY|dS^5IJ9_dM+fv`c1xl(E z8NJY*2qW=a((O)SY<@)Eq9vMw73Iz^~2EFGUKxe;eWc?yEMv7Vz1>_q8jrN%B=5e=vys3JmmX+(2tDpgpRaXewTax_j;l5VvX1Ak77T{$>v zEW{mz25QAgL?E-g2-b+>=7iMaDc|1W$uBifYJ^ z*D&_nhj>1|Pb=4K_+S+2_sQyybtlQV0q#*A+cbq-8WgD?puVbi0(<^`SdS~>p{u`Qc}if zB_#(p0G>~%hivm+_UCIdQGKq*Upe@ThD`HRk6ncKVhXM~A`0fP!*I_rb-ytac!;r3 z#?Y7>+&%3^nJ`D{fR;4qvA)@6s*5iW=82JrL6q*5Y%|qkn5bdM?5Cc?YOnzo7xk3` zjzX_=15Ou{>~>rIlobY4atgCpmnkwLJ+rX+;Lse;Uf#Wf@T|h*qPDlnBKkar@Zla# zAh{OLw+gafWFr2z*T9?@k@ySUPY6CeOmL1At--9WMIb|4A<92K51Z~C)Rt}JeJO89 z!a4u2axc~jdI&!?1-FOmHtFU>M$oH zDDBq>_{;pPBgW=x#^_kN8)R#u%81kA_Ew5hs= zY(I5%ciz-y)PLYdKX}XciCIM>r3bfb#54cnJ2$B}+< za;^IOCEuTxPXLH93e@I|I+2J4s}8Ejabx3Khej(EC9ZP~vqBqpcGJ*n<-o*>O1p!FHlHm9rM zG^BL-M68jlY*@9HTjMstVKi4E;1BZzL zxsXO^CgyC$hlJbi)1oOGO(_^%ZYJq48!mlz52=OM{o6lax)k7gbS7&pRDCGGgt&8;ByS*W$3qqrb}F={-I5#US{$%`zOtf`owr+04_) zt+*j)NNV5^v0dD^cvDkBc2OWxM|m;x`LSPc9~0W&e*R$AyO&)1d*H-jkNZ8uIf?0McKjL{n&f2dke}Qm05fgNaubAUNoGg-xSY<+P=w zMr^;17{{9#U(&mt`@VrbQ+@o;vH*6f3XT^2-XS1}Or#@vRd$1WVM^%fgM#u%7pI4B zgy0I;%OklEoIkigR^L7kj9Fwg*1?*dnBAW$@iIbdot$`vywUKZ94F`Wc$`%*zX+E&0H+C0Z$YFSSf(nNpp zzD-&LiH|Bc14+U@GtsiuK~X5QVs{B1+;8i&Yeg&(iYD;&tE4RMbnSfHjIt>0^vI40 zz5l41b2%UQo z<7zH@Ldib^b4AjaS6@xmk2LKH7J)dSq7by8A0H0z#(^$-fIl&{-|G9jDH_qqYz7-( zURf0tGkDRm@wp}RiK@CyY(yjXxsDQX0A%GZxf8yg;!hXM%cq{$9Gde9hkpfpX%pw3 zhX|f14uwO0RQeP3?R!o18%f&zzeDF>)GY0{HM|?R|Nkx=v7rdq<4(jvxL=fPb?*Tv z;uIDalDB!B;YNs2EHIHB1!>nz$QkZy@!bA0Qma<`YXTP!5T37zN4??t}8f z&Jh%~RW;LUn@&TtLxl$XNxvoh@5r`!t}D^V-kFY;k^_%^o`)6yo#(`+as^s*FY~4? z`NY?yW=mtdrT#NqMs51vZP{sw*(Oqr(8CT@c9% zFtugE6a}!c9t_sOke16Qg?m^cH1}d+uw;IVxGurk?*Np@z7U&X0HOsi#q$u1iP6=h z*k|iG7Wpqv5hHJkd%xxKy}F<)kI&9*<{^?+XkrgP!Ew~qiIP`B@V&{w0T;DIt+d~# z7O#4#WmA=x&Qb3rh9^ZweSL_j5u_nta&$SM8Ts+m$TmmLIQvumM9Vl@Lo)=;8_|az zDIBB8N%!~K|BGIIculbtNqhr_tzVsvMnf5wPZZg12T zN8|~*8`pT1y-Z7qnOx6G;{t#_10S<(qi#xyyPNU%N=p$QRA1}53HNN$SU5TRW@cU> zWcE{rIV&BGBU^eYkFjtIC`NakY`Gt_Q1nd0REdM-?3SII*+=0)TZ?H~H>#MjSI=@PH(}44d7hJ_v*M;{Eztkj+k!2 z!JIG%cEe#O)w0<=JHbd+_rB+i@BQvcZNtzX0^z;=G>sv3;m!DQ?)6Y==tHId{Z==Y z0dUXh=I)M{I;;I6KFw4d>93g*7Q>1jdTe`{ISAGt4h~tj$JZgr92ZdDG7QboO4{#9 zGuQ~sNA3mhC5^^C%k>4^aRLL(!$Asg!AFyM0BNM)vrR<`>UzCHqdgF@_cs81TLd|u zCAHpV)zRZ#d|!f@Is+SS0dw>462Ay(YWg~R@E#Q4YpL4*t2^t=tOewJ=STHCJ_S9! zd0n!{AM;vs{vtVicZe>1>AHa{zNGmLSSH{#&RCOWN%t#r;(fZJLsM8aT%4d_NT9%X zKE+WkfU+QWXYePBeE=1CcCQk5cWIwy2{P+IYqA-F>Yf^aMp z>GU_W`Dzmynl|}e6>FCD_i7jT6dpY^lTOQeu1hp-JO>$tdq(+cWAez^L-}qp*>|E#Jk1kk-?>F#xjXR!Xu2W!u*CQ(f>UTK4oa8->`DpZLJ4;Wlye&#_Og&g6jzmrg zc?zU`R3(OoUuMYyEnpIaLA+!Bk43mZ@`4gIC$S%tzm=CgU)ZxjC%=0BMhy)p$M7`c=6#7H*C!yua(7 zx&ayDeN?o{O0+rl4g8l*{D^vRtG%5JU4Q~#)5r$6Y2CZ32(&m2eiRn}b!S#F4kFUB zrWW4?H#D0Nyr=I&m^sGw6z)Dn+_Adedte8AI-Mp90!5}v-el2@z(xXw;OV6{t)Ruj z8GG!`jXK&Pk2`51yvj*3hT_$5kV+ocGkNI{KRIxfZfwMx(7PmsX@dvC3CDXe>VR%yMPJ`ykQee-n<+KBn1I94YQ;DelcLfXrs{W?;Aw8NP6jb9 z;fwD>@Y5Dx?2}t!hq9P^LIYJ`fQtLzY7D3hZwimu#o&Q4ZT6*be1FL+$N(B3BJkp8 z){akFRef!rkwZZoH~bl7^T8jT8Zv`6yEq%Uo63VJODl0T=o+*~zV*)MJrNO8M2Sok z*|^PFpMi;-3w}%8oqOgn=FxWXeNLNd(#;y&N9UB;&&|d$TkFd~d)^uUg(9z~4xRK; zYtQV~?4?=2Yda>b-15H4tbBhtI$efhnr}iuxE>eZy&qbJhDVj774K#MF#x-cv(4EFmYw{=u(B_34zOb-y)IrFD{UI(O;(4<*z*l8QB;ROKZANY zGRu1iWls(*u#UfDe_($hJzX? z-FI>aMCz4q6X;z|HRSj9REEmzNJNa2?&uqZjop@iSTT)F&9x>ph|tzHux>u7Ez17^ zw)&t@Q)M~7Z^V=aD9D(>NGCF$wt1>FxciKIoZsS|Id%(*$U-Qi*I?5BQ3xF3;p+v# zJiO1&hkJ|h;_vvsxMsKc6LzfcE|K zb#)mvq+!Dp9*d^*T+=d95#>t=VTt^RctduTdJ)qY_HP}pG*5pgJR>wAvdj_I!q2}1 zANq;mlv~f|@FekzZmc560-&W&Z{)A|<(R=weCp>B0I&7=SJCqCL_Q%>tuYLGJvwjZ z*>o|O$2@x$7xb+BKa7Z-sP)P+WJzZs%&E2C-h8e#y%7!!5M46#Omlj#rjiUXE90e#Z)An6pXJ*HD-{d=n$H=QE zw5zQA$N_l>`yaw%b0I>x+|C1TGYD>f7No=G7*e#O!1S12dQ#)$?dzwlDatl-%J&|2 zIADf`S1j1U+pYu2v3ghSeriS3gPqluX1`T+O*TDoV@ywO;gibYaWu z3M8CelM`QDTC)0UZi@v?YJ+!vaQfJr(ni1FHmc`412BZEr;#RLV;>zIef`#jGo^A3 zK)29oGlkWvEWgmRvlIRCBXH$~?=95x%%T}aISJfq!%Y2_H4O9-QXLhuJ z_DQsqL3j2V3OdQi|IYTUVtJSk-U2ouN!I}ZH@Kd*MVRP&RH#crtfudF~Hk=7ZGA8UKE!pDj(9Oyl@c6X+Jj$fV&9xid+%(^q zs9*eDJD7rsk&5g)qufAI@SM9gujeA(=p~FAOG!fcqI4~Cl?Bee42%Ceym1DUub5Qx zWZSxYU9(J7`nVvb*PdA#VuP(x8>eMz^x-yCUSmkYo{)5QtAD+&#R+WRm_5`;Yq6kM zQ~~;w8-8poJat#MP^o6+o4w_1T&u^Ngv1gM|Gh;v$nH+e6dvbrWt2cIjy#V&qdD&( zGBBn(ZxkJPoE=z09IS{s>kH(L5>v!u<9_F=#Ix}GdV9?%;CXmn5oi!5_@KCM0aoLv zq!BS;TD=sl`1^QkfrL+{mF~vKf)MFER>pDq*n*m3F4Gs&q2s#L>-_SILa8bIj4)_B z960RI3qwM4KiZ}>^}mw$hcpde{^Ab8*!<`Z`n!2i*2K}zjR>=gpkeW=-}g{THny>R z4MX}&%)<;`b3-DfPL)gtEnTy?zG7*i9>bTpv@HfrMgC6FKc44$>^sY4KK1K`MpXP^ z?e*Kb3beEOedvE4^77Rxsx*ljbx(SCXLT&4tPq8fa=j45dxzV+wXJRC#%8%so#t=% zLnT&-*h2%V8!Np)oMG(!O%v_A%FOf+T#sG{=2GzaBmlj@(a5*zYK1_wf-W!<7=5hd zJm^ss5QOAMIPt4L3o|n_J(u3q^6M5GjX~(+ry+_ArS|a|P{xpjf||3P@4Zr?913NQ zCXjUZEA;(dX=^!YH10D_-RW20JLCMSOKGet5%56ApSC9-$qZGTeZyN3-exZ1JNh1S&=$;h*dim6w}|eS^E( z5akz+Dw#NfM@+$iuA=R`W>HDLY5*^%gSX6v5K_YR^KW}VGTwCkCxx4Q3P9}B)!5bU zw|cH01~2=bc?4%a_p@mPv&V0z0D%biy3*6Wh6reByc%}tov4A;Ufi@*I=1+I;4uT% zeWRmE_|XWmQ@g7^4Tab_OzJN9B5!1GD8N6Y@=~v75u+CQ ztmQ~u>dcO}J5e=v%git17;%A#!Tx23KA6Sv+ko71X*Nljq$v}2TMXCbt?(j zW>U#TXrLqiCJk8T%uRW2ghbeR#3N5IJ1FJc>O42M{t0CGUAgci`SO0CQoPnI(1 zC%{$QnGJ%60`i$#Cq*TNuX$>HGRMG+;)@{9sRUeg%SJDB+^z4#lu5Ui--Gds*~B{D zbCxy1h?OYWR&ybuPiW5otW{9P96&ULnVx{DRQjPQrXzPvjKKP*UQCOx`sAV#4~pqd z-rj4IWv(h~*B<$HkL86c3`|Wf#V4|CE;PxF4%+BahH^V160+0w0z;xij)5As*j-Wr z73S~wy71&i7P@akC3YpRy)x;wEHHZ1MN9GLwNIk%8$wR9B-gLs-z1;5rIBYWS1Ua2R4T#+&dN*b zA~GDMp3p>gNey%w_OH-#b@~cwx=@5)P`+ ztN|e(Gg*4E_4RsKny&*Ew51+;HV$HDv{%hqgB2#+l^jL*?Zo?aQ=kC@nc0MdJc{pl zPBgyt8V;k2&n&WV#BTSx`C4C(TMP+U{DM&j#o<}K$LaPEEjR-j&o_B2fG%}EZ1i9- zsuPL$Ul)9kxDOH=dOAX`wS70WMWbp+zGt0tB0#-A zmpzCrUx6khS$Vpzl*BVUV~v7N8xX-Yz9?g24o`|)p2+;T2>&%}!Nf)W7wC{nTnpp^ zC+OafV}1-stnsm1@mxh+_^wx4*ESOL+Wu%Vj;_@j5Xx6#rd1j*LQeU`{q3em1sXH& zDj@#I7Fl*ft@yfFD&oklmTi1EGvU_<7cMz3^_O4bt~*~co^gxQ(2C7`Ia0!!J*>?E zu4VJ7C|U}rI8f1Zw+ckwFcrB>@M>_nToeq34y5@9O|v{Hl$iR1UL-i^6*pItpvZ5a zmvl$q73b5bGMjmb(%th>-}MM|!Iz)GbkDOkg=MjXz;blUDnK zopSb&Ndf<;1Te@imlVA<9A&bTST!fzR0+An&or=dtJ(*jx2{h{-LOeqfaFsHsy=C@4~vSo?1XDKBhiLOP)flqg8zwec2Xd(6z^&c2{#;WNW0P`4hm2H zKQx_XKvVDA$3;{S1w^_9q!FZ>{iG$O8>FQ>1t#4f-Ap>9yK{6mNRDnskHNNQ{}<2O zbKaeE-&cLF>vO$As?KfD48`{0r5EG`_orHWE&wTRerz=i+}+{*MQzWgohO-p^lf_p zal)&$9|44ypvb$tAJ^?J`>Q4~nBA+9b-1@=C#+xkn`D(@?JAcg@g!pM4kGb1oi;*h z&mS*gOA?dRB;;1+QQ$U~$}^znczCh%nn9H;BGoEu<8D{AD-iBx5`Q#<#XWC4QOEE6 zTt$=0TAeSYmbl{;sW?e$3pFZf9ePN`ks9yGKEd zKumu#65|u81nEySQ^Vf-Xox&zXq}B2?Oyew5)i6?%;v1#p7}rbuy*V{zW}~v`01HM zg7f%QED#KWH>7#i-^Ma7?0(4S?NM=W#912wLs8_c~%VAh!kBUZ$c?5mkt8zSwn zngB(H%qFe82e3%8OHT9ia|_$x^4)e%`o_Gkxdqu0o15HGG_uKO2Sif|xv%XVAQdIk zZ^<;nVm;pKmSWGWq(%?^lS~dJ$Ce5zmnq%zulU+$x31B0Iz4jAWvZuOC-Dl7dfK=a zTjqJK=BOepWfG~M$zUEsvd39&zB6}7nck-nvwLDTzpDEYtG)eDY@g^X_Fz6QN=VC% zFw#$?mT`^=AFoDPBUz&sB;;{=F7sH>DFpiu%gaBfZe7={rBFwp2|(pC=YSec<5&dZ zwx~L+Wpa;9#ky8i_Z5;vc5=*wYpEbJc`r-)@R!r*{9= z{*v~}gyvRT<+ZS1dYq85lso~-y*Eu*4+oJ1iQcH(j}Wz>Ygv&*eLyDWzCUjw;^c&6 z8m|+5q41_>GklM?!L-w@iLP=`rdwWv5}0xss**G`8a)F?L1k9}TBPldw3YdJ!{~@> zYL~82OHKsgSv-B%$uZ@0NrVvbKY({D)noHN*khbfbVPw)rGOvE-qSb?SqAwxJ8Kr# zB6d9JcjZ+9KR5!L%wZd}WcQkKMfnQfPR)g*Dn7}Ze33IGJxj**9UkXgMKT_5DlDPc z9A$jUR+j19z-8-@#ziu0Nas28YV|v`>is)`Es#8N+37?eQP|e$~ zMnN!DXD+n@%eZB;wDwJ{greR(D!1mnR}rQJ!xAvF>snv?;g|2s%Q|%#hu=44EgJu`lKU%tGmT}ioj_7Hi z5}2pG1e|4vH+-6a?Yi%>0%_RHt#I~+6)^x4{iVqIRX_OWo2I-)@w*-?;6W^#kHWFoy;7N95Gc= zjZAA1^@2+xRJA0{jntw)uDW}^Sp;oFlxx32I=|EMr`$8U1!Y%tWRpdIcC{zE-|!@B zzc>ch3+`_TsThctm0?eK(D8j9tqj2v?B&?fcf2w^)DL0+#Tv1w8gYF?W&B}n#Yd4L zfMrRT7PNW^{I|a)_(k>(KNt2tIjg?-DZ&ILLPwzf-V`O`)flU}3sF~X>LOLG`}rY8 zKsHKMob8O_0;fL?@33gk`;ve{5mn*g?;P{f61>Spl+t4n-7+g6fcgWdwybQ2gy5iX z5HVO>yy$9M4$#m03{RYOHTR=ooXD3bB!D})GW5DgLf8xJYo*%tb33(Z0qsG8_80 z8odA`=u6e`AIE6n7N##{>;Hy9*Ulc3$!KgInXeGG(w%~O#w2nMgbw=w=Dcmhq8;8Y3!i8DV&t%k(|4L zrQ+tqgdSCSnQVp704p(+EYU!=V)IQFe#M-iM*CIc5pM0Fc4;?w24m{2ZJv?>3qX6K zylhI9QY0lgRV}>N_r>m4^uxq5CKWHogLzH1u%l3m(WCJAm~)6 zR#t{R4|tRSOiTB}wLC}$ zU<=!?M)xi<10zTX6Gw|P2R%_MHs`~U90J+!i331`K2W23g_b}rwjI3pVi zP&ZEJt&I4I5iDR;a`@j?oA-mELH5m-)NE8c8cpjQv_RGkA(A>T&5S}MAgK3c@&EDj zFQN(tLsr73v=Jun5s_|hQCf$<>K~7)F(u&&6MI1!e%bfMpM=g&nUXb~g9#P@$(Q7i zQgANPSX%V66m*14`kDLmpXr3DFR|;jo55r`njO>dQ5MM`Jre`<>+F-dd zPi10W;<1r_sB%lq&?W6_DgZR4k53x^R58c9@?j?RZ(7#j$Y~`Pd#x#>j>gGiL{@Qc z`~k#O&G9nmkjc3aqbrznT;nBQsY?yF?_8c&vH~A5@;>uvuH9<>qMWSDm;r{=;SM> z1qLGN)C`!`?&HdbmK z^<=|lTfacAucIlTU^$5gZ?7vyE>XBVINGvN<2B{RFJ$*I)*n@eRTMO<7>?EDul-|? z>Sq9t@keC@aXna*w!NkzFGab2w8i`_&?IHwnPJ}0?e}D^YZ>vx>gq);XeR`oprE3u zeLu*>^BY-pc6b_p(;hfR-cXP9bdVe|*k1p=-FsCj3EU|ZsJN{`X@zpW#KClbY-1T(1SdB9OWA-{F)#+33 z8k9dr{p4WGl8+!`Fjs2F+wA^xK(pJsgklBhR-)zNYszm!My79~%j$#1d{vR84}^nq zOtq*DfzyX|0(a`;AwI9933ehSOk1c&hRc)S*x8)5DQYTe*dz=s;#ip_Vu~h`My6c= zp-;|+*tuE!KjxFyGz+C)Q@b=(VPC}d7UoH~8e4L2`p^w{tEQZi1HFITEJTK^;}rk8 z;$o`43&PL7(SN?az(eo&>&-{GqX@Te>5`k(&;2m2#tzfQC!<5S25e^LHM6V=M?dmE z&AkMc-Kd6f6*n%Morgy}?+?*QM~y(|dVwD03JTG!cIBi52QshHVQR9$SIzICxRZ4c zQ?kT@W2KeX^xGXr!nR^18YpcFpwHTv&>nl2Y<4LF=QWhA)BVt-Z5JrDLROY&2VjIpop<72;k~J!wyp;y@&yQk zV36>QP7l^XA2r598iKl*K_xht`>|iTYRR> zQfWcNHs+|E3gu7d6&8!^U$eO_YsZ6Zt*@^Y=lbJkRgi#%MB%jHh+XYgpBFa(qpOm& zGu;;`gg~MRkLbxGUn6SQ;C}&?a74EZ_$Xm9g79(IA!Bb6ugEegVh3;?bXkkj4{#GY zv45d?lpeM&x2jVrYb_yzg6BKl$Dg6E-nxC;)K9o1;I1aUqdjJEm0>^?nn7~HNV zX#NLHIzy>L{%#}^o=o@lH>_3>SY^kJXg#c}9+Jh_cMus92;t)hzD zQ;Km|?16L5ovLnp5=eGO|&-!Xfax~Lz-rHRFFTNUR2W7Nckp)f` z?`_}f{~pGZ%>Dox(ktjGdT-q zij*t`=Z(KAJFnh0y7#!~HxsJUt5WtOQS$dMXj&X-62a00@$#l7? zFh&d7M|J|4@Dz)?EhHcQO^IC{^pE@pYtrj~LG7X$_8rBH-tsxG$u20$WB9hGxLAK~ zBD(9+~3wihQ5>2a%GaFNc*%<>J%2mdBxZ$d!n-XW|iuUU2u>Y>@J^d^o~D z8KF~9AE}{%?*<*Lq?4hFrCrfPO?)82$*aq>1KZ$qo+hK0$%45*u>dFEimt08K&)3o zL1?*o0T|q05Eg8oOwHsSc~v61f^lgld4(jHfVzr%tV|)+)mPAr0^F z-yFdXVYN|P3)1eScX+;VFp%t0J>pO^zGk@(@pn#H)?Rq)(MZr@&wWwZ?JYS#s zK|#&0EdFVUALdQZ9ft*EsID~k%UG^j+!_u)(;{79?=k6mgMDIEm1Z$|V?SU6Wp6Sj z`F&wG@rgA0*j>NXhUz(nEJE&5Z)U%DFRCR6e>vvP9tH3>&o`r;;C7GH)DV{{@tF z7UEy&7XLxSUp-W$e%K}mseW!}TV9EEaF2p`+C#2?$Ivs-6!89c zHz#|1b?WRP%6$niYqtQDVU!Vic%XDXb`x}U!#_?OiDh>W(O~;|hoAS;OO&P?`OMfm z;C0pVOoRun3|LN`2tX3ujZN49pl|)*m{Ii{k@m*q?XAOshTNbFVj>5|&#?Aoz#%lieH>-eDhvP)n( zvoI&EFnS3ti#4?^!LYqt>rUWeX69#GZl_zGaKyH}%)@Z!vmMWMeOYqJe9m^X@gk&5 zi{5uw3u9@ys_e3?Y}77Qp@9ObY}(oPC}V)*r!}4V-fRY!q*Ge*O?5PNjsb51NDkbtN<2ruF7x0BMV%1lB7|Ph=|BVlEfktf#gqmnFWu^i|+& z#$e1~4pv3emk|70z}&8h%v=Houu0Ysb15Q;VUo8{!MgO2-V+RJ`CIs?RgA8*sufMQ zRlN+ychMjhNURS<${v!%e)US!YA>cS+jX=TDeP3u_xdGuw{KJ29T`U~&Cr^iX-nYZ z7%SBMLy|!cnRt2sm0;-Zkonw5EY#@Xzgcb6kN+7bk1YO{UP_Eh5Az}jbA5_i z38JhlD#E;<WE5|%Lw1pcTA)2hit+;WX$rwo`iO2lms81Rt9P}Y@~ zU<8WX|_$;IklMr@gv8k@vF()i*q=Xkyvgo{p(8Ht2rm0zxnHGl6wn2NOk$zgYE9!j`Q<9E6oXhphl2z4ULq4 z#{eb`X~U*t^!_rhc^AVg`4r+?pu1nD=q-ua&dX2Beh`uQifRjk|A~h|fT>sJ z> zE`)`Cm7EI&$pJg#DI1g+x^-_YI;7F}I6xRixeEq)pChkfN&K+)PRAI6_ZeF~VHV;) zfH@3t?td#Q1(`#sh@d8-mgrwk{$mU;It>ZPrz z6aBAsPcngbxr~2{7*u9>-gAoILNlf+6Wtwfrh=OvX9OAr>uN@&)BGJ*KfexkF6| z2$Y-VnieCHtT;N6K5(dxJ2tgTOvFiH&g?6Ih+pUR)Lo32LKW&(jBr==*2_{RRGAcA z2CTUMUyY0sWg{@}@ZYyAS-l*{Vb;-&*QcSDC%f-%m<-qWHPqV|QB-bD7GDtuR4%wN zL>_ivOP$C5qjD1zI}clvnCyFmza{DYzAZ{_=;vir_tP_+SNHip5W?8_5FKoIb_4jiablU@8P z-X;&L;}XeF!Yu9FQs_8((x*DIa@V`)WD(yh66!L0WrDa`npq!G#_ucH$#D`P?VMq2 zz`FqBpO5q_ays^?0)465d>^MfY}hwoqX&@c&7aiBokypkDWIn~=V~n`01=PES9NzL z!SqlGuf9jF!h(upy=_r+**^bP(vQ|d;{*2X8f1!C?1ZVS z{Riryk9NS2RXm-oBw9ayINq5Y#6nc!DFrn^zREciJyl%K0k`ki%{KFUZ0{b3_G;Mn zNBLD&HtwAsKf$XL%ae2sSA*D1?p;qi+yI=dhu&hX)zsD?FV@_STLajv>bVp(RvqIC9v z=_%2*`7b~M$?FPcWsAf2>pJ9k6crg|#2^wrrWS6nl*wL6tb_wO(0ymBO+flDOiO?{ z_l+j|g5bLc${Ak;%&R`f8S=9r5k+hD`@n#;n@(nD?H!_A4+YlA4gIk4sONXA)Qcle z@hhI72N45$Ihp$t|CB`q`W}aHE75U{He~NRzLAr^?`mTZ)S(=YmQq zfSqAVwfF-$jp0=qYU}D>Iw1hKNyy)uva?GXF<7^1{#hR9E{T=(Bm3$ukoydXE3J(7 zPf=Quk7)!_$?H_}=ukR3Kw~eDf4gIXV!pOE9!C5)!ySB77HBPlH2a3>}S-g!AUPP(fQi63$Akdm_x^(uU26w;ZteZ`|I zjsujLDi^c02lu`FWJJ|PHGRI?bKtji@B^A5n|r#iEeoceKP>5jcHwMasHuD-+)6^? z<)er%UZia@_1wE^Wl%po%jw*nkOTVf>|6+@zXg&cX);iZD@I~Fue+SoI9<@G5Pw%l z>F>JjzMJyR6!A+7Wp8zr?*U@KnR|3ZX2E-sUq?(M+AIFjK)=~gA*0SYAoKHPDvYQ5 zyv$kwBL|^V6>oL=xOuB0CSG3NKcjR{d-S{U`fB*UH`1>_LN5K@vml0es=%`!JB}fN zDk)FbC%PIB$d0#EGJT5m zNj3k|u!sD`+jJGbk7T!K%VQZ*l+rI$Bzyc?35_@$eWoC~D!IBP{E;rPwe zr=as*GwEz)e)WK|V^D7nmPFvtsC5&#;DP(F+9?Q1%^8PkeOjE-*d>_)8_6XZHdHwc z26kp<9^V+)%;f_^%-(;5jnDUg)F#nk62~3Rfa-qq^O(~oC@{E9PnL3*vv_ggs zxr&c@!>caCqTkgg$s>o!-&rcmD!k_dJx$30Ep2&~uZInUr}spm-)(#g=&u&Kw9aEE z)+!)1-Fi|~!RD7HN%x76H>6TSlP`u3E6JS1y9yP6`~eP9iA0w=`pN`1!y~-aEYM^3 zv9)O7zR4{ON7pwMzd4{BuSD9Q@gO)+0F>4Qyz?k~*)hi1r)O;x0zzz2rVH;>Lz~mI z%y*&v-l%XCuG8aT+Km7G6!eU?8Isiv<8wsbP^$S3uKr%S6o1;5kPR$TX8Q+L=%c)d z=oPFgFBE%z1>mLr(jRF}UwzNb=j1~okmk8_z1c}l3%}87L5k`W6jYP?3><8&JCzR5 z!u6q7xH&DAPNK%{vbcBv*EbRm4=8EJlds;WRg>uIHRop_?}e`|_ko=D;*CV0$H#l~ zKcx#)p{y(2+3%XNJ6^Y+caU=VT>Nx-#P1H{vwJus- zvy*R|O!7FnAcPgK4E(3PFUo~DvvfsN=T^842`i46y}SXs+)TZN9mlw z?pV6WMEcyCs3QuV@d|HOfQ}ao5>dL+hPeGzMnk$OSyV1JO^IbHwcbo1*0^2i4pY{_ z!_NXRUrVoCb=VU`@9YJ!Wc4*!9mTc?&cn^JZ6}tD!CqY*wwr_x0!~4s^>9ML;+1wO z31y^H3+s|)P*YMq7Te3Q{>(qhPt#&lV-Orf_-h$jCrj2{dzYajyCJM}x@&Y|^j5;= zKWlkBN<-I=yJ{`hy8F*3S2#b=JjgtmGfQ;;_O6AfX&Z-KVjtMQiMTQ~R|@-2_^&?E zSt8`GIhEE!Nejt~CE&N#5+*(5Yhw+Jl44z-JtY^RshPyv6jy~vB%VZ4JsHJB1Hbw3 z<~vcvmv7A{*y%Y#4da9D6n0NCSC!u|f2snANQ4>MDdB_{T>^-oDxI%qH~Z&bKY#eT z5hY;g)^iAUHk`4yRpQGsGf`-;l9{rWDGIFsM^CSAIDtt;!4Vd4^#7;hsO%)z)2Eyp z2S#aN@6I&gr@TDkk|^K4JN?5@Q|?|KJW&Uq26dKUU$`&F45%TR)3=3dMDSk3=DWZlK3#P+09 zXJY*?=)PMtU!gn3(L`Aw-DrZlR2)YoZJ&w;XGzU)q;8MQ+8g#OHGQq1(SPr&D&O-b zmb!8q!$Nqbzd~Q@P}hjk?}6KYGmn7~%2up`_kl05F-!=0_vJ zZ6oq83J^(Tl$ky97eXaN(x3S`h5yh@LNh&!%Oy{~yVSo5*twqD68i1}_bGkxP;Ev& z*&+WLxZnB?fvb!kr-w;lKz{#SO$imk@Wr5kgKNH5Jb;iv`R?;9nD%pxU&r`U5K}*? z=~<5GW5+a{sP5Cty5QY}Q@<+v_F1e$C(wKF6P$VDt7nAZs>5i(ulonay05}kB{)B_ zt}F_ER7=h$C91EmRvlQb$tMHluu@X$9ATm>8MH_-7&`-xqui6n2+b@^!h!UC&89TXwleQgQA8Nh^3%hP)JgIKtyUv6Qp##qj%Jlji=Odv7Gm&5&zk62!Av6nM zgC$T0C65{hGG|qRZ3PdhJ=8RMl<|`dg@<^w^GH*Hw3R*(<^_Q5L4)Jg+hBw%3x#0J z;hPgsJ*`i&UL{0Jb41`j){{T8zm;#<-?~+Dt2}7TC#J|f;BfW#OAT_BezqhZZ@TJ( z?u(|36=T(Yh&rjgHIWs*wXjc|yDL`0V+!*D{OA91>hB5LbU;m3FwG0ucV!S&cwG#f z_fet6HjCI9o;Sj7+4SFSJ~Ub4%19D%cFp)57z`g$z;C}08ulD`c2>!rCijAQIT!rm zl60a_^b7pJ1-BO6-WWM!5W3s_>*~86W8Kg5wOH|c*Gt5^>7|uGeBf15%QZgmJJAH5 zp|>CBzsKcXDxu-K6;rXs$FHX?ryNfR0FrV8URym)aBuE+KST}NZv^#TNZgZzsJ6fN zIYUL7NPPPx`M2JXJDwFtFECb=_yALV>tT*)LI=Col$V>R%gsYtn!cYB4_q)|YL{@) zxIcw^937CTgAbWHq1zjjGg{Y%r>(b49j9Ez(FWDXw*js?v>R8z&1g5_&U5GcfaHqR zxW4l&Xl}eo^kA`i_4hcu!PAd0Ze+dkid6e0vr~ZJu^i1HKJZR)-Uv?80U3Yq_oM+j zAiE~3f}L;`cD_N}5WLD1<~0N5X2BI*j4YlzZBH|hehH1(NVs^mWy2U=~e?(Y(HlG)dUd+2Ox?&apV=;NP>)nn&>mRZxTIKkeUB@_&< zpGAb?jJz5kJs0EgCMAhe+=6fH+_! zbaI`q2And{#JEG-fU<)#n>X@IV)4G2##Myz>k~rAna9g$$ z>y|q)7^cYsi0#03c^x<>RjX!??|jsWy+E`Pb4{?Akzj ze$D=`xSBGH-tISFUQF8RzW@6l#%UrhaULU^Zb=|@n2je5{ZrOnP}Q-RlAat()b{NA zw>NLo1K;~U*W<>NphKYDYvQPN0UJ2(3*O~7OvU@f6-{P&+)olq!v%|0DQdHjVdXXO z$}*<$AwRmz8r`ifANn#{T-#WLWEadAUL?#HN_cU!JG%|XMA#P+1V0>hlfksRe4tCB z;eoQfn#VAL-R@jFH3N_I3IYX+0Z~*3Q{@%E!hcT_m(p$W8}?reEL)%XVI};JXpXr* zz0*kXe6Db19!5lOZf`ioEfo&R=7DF?q4=*HLOov)Kno6?9^Q1#CT`kJQ-DU?E;~Pu zzjRvp`fhX2J@M@*onx$th)+rDyDBnAV|Rkka7;mb)Ptw2E8Sny&95}rpsDdoaQ*dU z`@I5#&4Os}UHk`xkpx>7qqd{{_pi&#V4eop59M(Wr6T(wnOrcxA-{^CD;G6i5@R*Ik*kY3FWB`beBwTcsQ_!{ zSl};7A{|m!aUz5ZX-S>riP-C|SA@IMEW>Zq*itEs7#57Mw-*JP-EH#*dEd>%^w zxT%7QtZ}PRFwP+?_*42TT5rxVwDnKD@Fp0DyriU@zY}e*Jq?CE;s;xECvT3{%1M-u z_c7+zTbEeamDm6$UaMvq^fqEW!e6msJx$|`Kke55Uoi$EzqDY$v7kCQkh;V>RgqGU zkua>V@sZl!2*Q9aDfJwZa64{~h2V0j2Km;iMnYqj?%xc}+4>eyM;{~g!12OcV+l@}`gQAI z<}_ELL|ndAPRg%T>9TWWj61f&;8ogW;(ebA_!KUOdhz@ROB#Klf9|1p+@cyy<6j03 zqSk&-Dk({0GxHu?7ayXSLv=((0b{6Tqji#?~VnVbTEJ`Rx4=2! zTvBlkW|L%LL@=n0*VQ}Z9jm%hR^jPUHrFISl~57Qni}c$!GqfhFha4hA}8o7+7v=T z*Vx;t*oCz>PN{IJdY>*t!KsRx@dDEMO!fGK)aMtyA(&P7}a?r2Tf46ZkC#)iNjO^7^~Kdqg4GM z02fFrbKUt$$bp14uY(1~IdU(j1zME$eY2O7%48!RAJN~e=IMuNe7|_VGhep3ebL>9 z1$rD`y@cRD5egM{e?Tew_M^)hSW)pwycoY7h?dsqUPm?pVqqgspfTii0nsT4i#}kK9+qV9M14v& zq#6MDW#lis{M4Z=guHoW4g6~E5fj!HUVG9c<$ahbo}Txq3FH0+oU)JmiF$&x2{mQ$ z(5(NH{BFoo+45KFt768bE<~j8b~!m(?c!o3Ho{}Uog-i_unwE@f4@V*Rmf8Q8`EL9 z$FAt0S%q-fC$o3|I&-G2jHX}8oQzhzVdUdrxUlOmLH`JW2&rzFf_%dV1Qc4sFEq}Y z&ce)1=GK3p!H-;N$;@H&lL^B%Wi6z5$>9`7<#|l@KDEX<#2E&gcvt^S>0*l=u%}pF zb6q{yDpJcrE^i2m0^ztG)&@#?641M&z$LVWtk^!VPb^@0D)2eO>-Vz762C(bP8{KPof5 zx&2J9;wOkXF~wo-U(GJ()IL+v!D7*1EX@&K(5t+uvmmYy?#7U=5%9m88SZ0YcpAxt|->pD7SvjS2 zuu7KH1L9?XAk=nQHUksy$8@R=lE%SOWnnl`ZE=G0ND@7k5?9ERy3IwY6NDbpiWzQ=HiKr{aET5pFTb@L*MYuI|>`DPxf^nCl0cYf$#PZLd>j za$j1iETr7!racy*S#@vGY$#kjfHTMJM&p3ZPC;G$U9Lwjs{ER7LD_S(8K98n zJ)Q^TXto%knyEl31!(e*G2zhit5hNweywR1hY)-c3p*0}Rzmmiu5&+BRhQS+YZ!7i zW9$(j!{K79Lg&E=KAe;^e$0vsv9)kG+Ip)bI!DT=(gdSS#|~a5iV; z0O=nlvEX)cQ|;M?m(*CG9&G9--ZfnJ{;wtGk7dmHKQ|d#b^^syH-{~_jW0*34>#)x zy~I7!{a*?T5JHBc)3HsaaOnr9J<5uGiK&>;o1sBtVumuPF?`U55&X&f{TA$Sn zvVT7Tu362dt6{EdzGwH`ny&PmZBQ{K5Ai^Q3;#ZQwZfX0qLU8b%4Ug(9o5ySTr65i zz(fCR0#0q%z8cgV-}}q!fu`%+&{*Y^h9!;V#%q#O@@lZn#DF1b`I`f$&4@>*ZpsoP zG=Xm>*kr?-ISz2}KD)Vh0v2Y%roi;@a7$nYw-Eutx|CH@Xggey&b0b}Ccx?dS2h2l7~wr-BCwOK!KMb@(zVIQd$j!b0d*@N4>WpYvd_CK zxl*j@_WkY5via-J<#{}D*EEgwCUj#c3>tdTly@nURfA}yB>yx4HUI0~(m-}{+GMoe za=Cfl(3>gtig^Hgn{#n@^W(xud4fggjmfnLQ_D%iM?Mx*w!V@U{nNjHuS#BYXqWtn zL2uUU4>d{eg}70MehYk1dZn(gv&v#}gZm8h7f-!?af7$^NsR)cZQjctksh{m<*sNw zkNr)poGg!9S}vQygiR-3k}XBU!9SJ9?@?iMMQ1#j_PR#&B4JEVFpx=&$8Y~Pj^Exl zRbNjJFN!Wn@ZK>7@1f!^E)gE)1RZxH9^~kMK2X&T%`mhuu7i7fN@WXi;70~QZ!-=H zq{ZA5kLnHfXm`8O+slDni+K%idUaY;$AB^_A+1f)bS1@jH+D;!DYMi=L0sf%*BXZ` zl_EOFEB}0X#&vS!+$PJDMoXut1Ozk&O)}J(Er_m{g|(#N~n)+XZaSv&b%PWH3<0KgI^`*utZBt#{a3KN^16Mk@N5PO9jXOB-9)ini%M@oO92DAwevsZU$#SX!x6(6&xhuT^OL@ zI*%5xqgg;oV_9gN5FWPee?#HcxACJ>QY8gj%u9eWbcPVd2~@8IT=(4{GGvY+7i%XE zkFQcwp`)kK7SGXxc0X@SBJa{p3+Z3(87=_STvZUHpIBaOcYFWA=&*qQofPzp@Wyy# zemteh@g1{Ulp-Wd$~28LyIbV{U@tmCF+=_^S)@mwMBvF3P4@aocr6`rc=+OkRW{32 zk8*5e6wKjsh-5)x9bVM9LeDUf0-sNsG(vdP){Pa|T|Lx$0|IP8Woq8nZ5it=o`!*9P1D8{x9 zB4{n|mISx|I$-Ua(^E8K`RAI*S0IpRMJG$EYL@r~BUI_{u(c(xRNKhPfI&30k;N>S zc^G|T$_z90e3gcT-&J6|xooMadDog9z*~?LVAK4986+t>;3+L1_^bh+Kvs(MH?s@8 zz0^-R%}Q2j?1wepGiG$}h!E~oX@rEIi@K+ad$LBxYu;j@pRwjH{dOU5o!rP3X*ib| z6cO}v|ARgxaf?Tom3?(o0use!9@cfAQY;0qyS#d zl5no(WBYX({zj@;Yt#X)0O=d`fbo?$3*=w1^OwN*5fp$1)@R^ZP|p=~Ve<2ZSHrQR+I%`bJtKWQpl-I)A^;?Bl6767~di}PpFHzqyDhdsyJzGRN#DGQ-!$N?ioY%E&i z{t+*%m)u7qgyyoNI`zw)Fix3itu95T|#VM-6OjzWAT2Cf)H zf2_}W8jj@1L%07CtP?9QPR1(n)g`eZ&5VkNLA#~7YDYQ7a^gvQfDGikF*B;LnDTS! z?gt`j7u#=QxVIOs57j(rt`3?qe6cak6B7OXjW3h$J7CuGkNra+T((h7hPI#WVqd(R z>d*`WPQF^|+5IzQ=BJxx?NVk`zK?^lIM%Gl$eSzExVwuvQ=sJ)@dW3PVmWjH`As@g z%U>Ofx~_QY$oG$rm-nmThY9m*VK!N{+{7LA znF?BH^_i@r z3Wkcr-pA+{t&dgh->5iyZB|tVs^n+~=v2scn;oec;w4Ytdbo<1GkCR#{NkNl4l`=^ zbo*!>gfn{d&5%kb{6=b>(Oe7zRzO4XT1`5;xUw}2Lo3=cOKUm1WbLj~$M?vzYJ*Zl za`c#--ZZ+uj!HhL%w7)RRIzTRL^4@5)DGr{YIecpgAQ zbTOj}9?rt~j(Kt`Ur;Ze$}|Rw?3K7JY=7v+wWQ2+r~Cm##hwj)=Ix^PaSVL4^Rwr zDhM!ZUt!JB0&vzL&BfD(0tKTZPSDf?it~l~RIchNd~BO9-bMUlYh<rmW`GIQ5n zsn2pIE)60to|9Q)z&a4D`^1gmnd?w<}_iF4@hI4$&-@y`4d>M}@l0lPvqV z_e4j}4RbexU7?f$0TX+cqb(zS89Lb^%A^(bxBAMVKZ4uu?jXG&Kw$mf5@;qhZt20l zbVvI@cS1y=qvv~SOTle88gy5gkU@=l_(wY_dxh@Fl9)>~M!KzlG-0U!Bk3&MqWZor zu7V&)he&sK=a&KL2I&?A>23vv2I)o`q(hKyh8{YlyBmfcV3>L5_q>0>Ja_K7=j^@D zTAu~RF-O5hUm0?nI1gyOs-rmb9n<^QoKC(i%g;&NaCk3t20Ny2R{iBPD*OBC$tIS6 zNTOjM$ao8k2<^Cz99(dESOGQi?~yTfmgaSoUT;=Q5Z|t(eb?3&94*MD5~2i=x;)aT56N`uzEVRqW_SsO2+|dmPtYM3k}!SuEOJq6WWe@4 z7VK;{>~EC5*v^`i2a=Vx3@^vmU(~#m8`re;H+~UVMwImAmo!L^k$SSw zanU?5RgV1y9@hg{=YgqZZ`9QOlw0jN3k#n?PSmz{D;nn{9x0=+k9$~`8t=o z2LDHGs_}mkPY#fVG-Nd{?>PN6tRv3#D(0M3Y0 zUS}YucCA$H3tioNe^&om{76~U_ZeMlDLY+1zt3v5!z?TR?&LkgG=HyA z39S;%aBxDg5uMdV!0P%J|J~=WE&X(P2_)k79rG5**ObwEDE=kzpR2ieAmTidcSSrx zLLOXVj~Ltqct2)*1e2-B8k}!>9)W}$J|149?a2In8DmryxG~b!CjZy;KsSK&Vj-8+^zCc8!>?4a3C)0qFpSX$``k;dD<~*SxV z%|D5RVS@AsY7bLu_=AM_EWY>1I_Tyyxo3HNR(pLaLWjlu*R?Zd**?7PW8ocs{W4}=>EjUFp|qb4mqzsrLaG} zQ)W+N@c923hC;`A=W^h@% z99d!b)`vbw#%MbNPa3S?waY+~e?q;c+D=_EvzwQQdQPeL3McwwhC>YtHHrOy8jC-5 z^E#-G(ejH)gr%rU;_I6|%A0shOhGyi0l4~ZRhLsHUc}uu=a-h78(q+01wh}RD)Y?Z zY7C)Oz(IPPW-t9Z#?{ur>Uu>YIjcbW`mjrL)`~WdGgNq73^@oehAIKHQb0mg-KdfPhJLP6nVf zOwEfT`cq_N_pO_m6RfQQ3mr?KK&a;JtkRNWAt-6$h}mzt-AeGt;>UO`Ki>$vcofL# zx>oERwV>ayO^(}(m5Q_h>yG|{rI6^(&mS>!AE|BSTV-QNl%$OVOz(Z7JJRHjqsaHj z+LIsu-A&2x;1f&6QuD&P6fmxBrm#Fh+k9b}!7fa`$4RrHd+H7l5?kQMpL_}M%J+hT z^J>8RmCe*KS6&-!MV}Bb8NyUhDT~7xKCf9KUSREj!WB3tl)5l|RRPDPMmjw_WFkz< zOQ^SUYaL}#%6=OO%L2OL=#M+5QzgIyf5=(>3Ckk0$Nki;=&yt=W3tkQ(=CDWaTB-}9Ir__ z88D%D-5lkz_C1q+{VQ}`m|E(&Xx(Hi|5j+{SS8R_AiwsdpCOR1)L=u$i?X^a_+6h zNGNcwFejUxWehnGMld=*O}Ov~iA9i{Ed`@fwNhtXw&qN>PPuZnmO*}M1QLb6r8V(5 z7xdlyu^HLYbxs-U81tDF^9XCC5S%v39?eWCuOg|xUCF-OOL>L701|uPnxx&Vpxl+> z;7*|LOz^Yxa`J=Zl6@R-p@m9n@A9OhnV&3|M~R#ZRSIIKUa|FQP{XxlZ*(^@1Ib!i~^3^$ntxW|V;I@qgu zOFoL!NS*Bt!5t#}Mfux*qN#Kcz!XlzgQ5r;1WCvOLD14^(lO2D9Bj8r`J#Un%JAwU z4f>n=Uk#S_KW~jKe-SrX!I`h*f7A9&aWqsMVH)E^?Sj7%>mrGs! zhTY(J8vES~MKrm9+$|7%m4Wx;X_xD6WG(`f!$zifdhk8qME#H6vkmLD%eQ~@c1Vxf zb3+MI-0j9`Dc32sKJ5RL&EX4Mq?>5kk+UHwN+8U|i1wl#!%PD znPitY#4qcu&v|KNeT#+1!mi6aOY-4z7Ib)Cx5ck?_K}k6)k|VITkTe)_L10HxMg}_ z&fK-7`7Oz<$2=^^98CZ zDh~ch$+O4B(T}bx_0tyo;0YP3#QQE^s--=0uZIaaoC6Iny%PRm(b3lUS}hHE+Bwk;?LtP{eru?DcEo7FJVF>K~H;5|_bU@*!jp>Q&g!9 zfA)vK^!YNvH87uNSC($JFC}?Nr!4;cQI-?n=<{)9h-Su#x15qjL&sL#lJX(yz|r_! zl=9!Ln-XaP9>^l-*Ph-ca<9~J0?hR$x9%RUyHJbs!yk zu$<<<>zm`8U8DMBdeLrw3H|rL2HyA6fJl#y9}%TjMMz?EWU#-)bDRyG$q;GufIiM- z65MU={v5sTGG1se<5}#$ww~tYXB9rzP@NV0RFL%t*7Jkv3_x@TW~!|uD$d}8G=j$d z54mO1M$9;vlf?#3qibJMvbA#_iXZdg`CKzl%6AU%eP@%~MA@?8PVRltIn{h4d3e?^ zVF7tpR%YMTdRqHTjA_WPh%a+XN8;-+kZDEk!BYBJy;f?+j+oMo{fke|JbiutaOHcsnrC;C?C?2g3(f1>TOh{ zl8>~JVt3=(wn1Z*nXxvGJq7-QW(Z*OObK{jZq(uV8%2eRj z%daYmotM60{~L2G1ipb2vHZc$7(;u2B(7FlFy6W_9=Qnh{sat0&R{!w+W%3lDz=>R z!&huId1>fe)8H}gP)A4XM>*Ig)5p)z&hK20I+s~5fznDrqa;X%Cx+9)^#AB!Gr?FS z394nFz2OWb4{U*0H`k(BDCX$0e8QY>Fh8quJy-B8w>07_#vqM5ZxEJ26+~>Rfu*QqVNu* zJ)xf`h|vjdkhxuXdz&EQA~ix`W6}hqG4;D_3OR&v$l2_(Z33ps@`$hch*sU6Cxg`!kjv7d)>cOcK1xgti>?%|kP~j!i$Vc#vH9xe704 zbMzT++zYKeffg+Nn^I`)CCQ@fsK4L4$$+Hu02SIV&)2v*pl)8kU$)s5TW<0&K@_`+AIEZyCA1{a=7&OV`t*-=vGV?bMym`W7eNQsNB&SB z=-|Y|w#Ei@u{{2)U%&eYW!V!+9Z)xT%j=&ZvAI{`nKd8@P6z~LIaGFb~k zrXh1xJ{B&$tgTiayxqXve&6%>KhUAY!1(KSf=}5h2ulBv3SuT-x`5wnN)M_0`EeO$ z-n8Ez)_&F^w$Nmw7k6`kkM@oK(qjfHZtWXn*DGA+s(NI^T5ME z*!m6o)o+`bib_0w0!wvRoEYp1gHbsX&Nw@jrv%9aZNlp`bj^ZnVO zS^V$IOc)7ppYeFDs!|Uv?X(1dpEHI~bC_FSJI{hJQDOD3Y;EN0WRg52_I9)RR~zk+ZBl1JMSV=PK52@v$q_kPw3~ZdS694P zs`MNR4wSQ#eu6X;)7f{Xyt>*AZ9=2~mKXbkIt}?NVWDwd0o)IiZq-?%Yc8D`Hdlii z`0Zrx7Ns{%TCOC&pZVeTLc@maSW*2qdbCT0djyoBVZ-*;*aowiCx-%=RM4xwd>w9u z3&w-Q&t+#Eg&=ZZv_4uT=arL@c)A(Hgyk`Y1hEd;Wd!=in8j9BOiY-3LoM`{9l>7+ zOGYF@W!maJcrriXR6BG0r-|JJqd{|<1tmf_XDt5#)pJzv@E0eeM7+hmWZOeeU@<5N zHCdBzz4nF3e#1`)DOgv$$cNmZu3XOB#k%Pv;Ld~bMT^N-*H69wuV8;^yN3%{}}n7M22BL zOhbTpbCfR60gH4B6u8w-blmb-d5i%7N|Keqd^mQSg?RQ};|*ND+xN!h^QJi+d2KGe z-2P_LqIsYWvg+lG48#@vozcZ^1Aj6SJ?J|vIlhbBt2i`IX=*WH=s3HR@w?1?-ap6f z){F!^SGgCA-vprc;ff(N$dchXeo>HR-33l#CK6M4agNXWdGg9rumrS6=K3)jN467t zB#Zolr7Xv<+W$5KW&h-Gbbl{JBZ+h2W4bo(f67+tm!qU$j&yz?B5N)1QSy2~yLRN^ zgA-GWxpyhY@#qZt+Q|7P3k3#i{Rx@FNKMBDcPP7gavA*br(^5XcDL-75R0N%cizN;L%qS6p7w_r-eor66?grvrB)q8iUoQ=3WjSIh-c z1Gb}7mDD#$vL6G#+pp56O4r};H^mWous=3!{@lFg%s*m_klJt<$sn!;a9wg&gwmte z12FtgqPf%tn>Ma+!S%ce8cOQfX;0MHFRWlQSlW*(Abfv}Nj`95^WB&h?&`alf+#Um zq*C0Zgv5&WP9tCL@9BpB6PPjXqTqG>maQKj+~Mml zaS`Zhv!8Gbn!Aa^DOLK4d_pHwK2o3&dsJU7_B*+}**$)B_g6F5C)QFMIPV*#yL)m4 zQ#De3u99KcES6y_jkfn%xfENSd8$j!sF=6hPXI>ETfwgdfYpy5Kc7{u!XC}0fm16~Z)AL>2{g6y$tX)w0F6pO`kdW8s1KXcEN6`8wM?jFifNQ`yL;;`l z(xRP^5g9Q@a~>15JF9c&owDXSV0~Cc(-2*`jqlv^O;U+T=#6D>gK+c^*3~UR*HBeK z=j)J^^dz?9V0^dlqj)*Obsi>xi|aB9Yf;Tg(m^K<*`;1{=-mEmd%y)z7x7}sgUJ7S z^!!1Bc6kISkuM4p<=bT9DdeGz$2 zjBGk`AK49)AL#9$vc%SjbG@?3_MW>}>L*PGoCtexH~ADm(f8PA&Jt#sv0e^~gH*)G zHHi(+b>562c{yc;3sE9qd=f5rYME>jAnv#P{^AfCmnr}F?qM|0mVcLNPf@v;j9p5#zuy*@puMdF>y$ipqgs=Oleo4YAHme6# zQ4eu*=es8s^JR-cjKn{xao=pAAdRA4QDJ>cHs2GbNb3Y$yptW>LNUpT23na>F8XE z8fHJ<#{cAcJg2@$38{Z{pMEVq!glJycFvv4%6)rDk7!u2ukS_6bVo)RDgL-(avw4T zE6y#R*UuP{&MxJ0-e6|$k85+Kj7RhJTQFv$OojN|fsZy>sDkuIA8^}L^;EuVT(sUu zvaXyHJwB$lxo?y#+P3Ev76uwR<^H#iZp@LfxqekgR8lrtVUtHE4Br+b9Y|h*{pJ%r zn+_-`urK^qdzLsK^J6c(<1(=<{Q=`m2v#@kb`kK*@)bgRj(@L!J|SfzqNIM13y@gm z3=5Y)s3#ONdMQ1AcpkYRHl5XL{pr{upa1Xs!I-|rOTGjg{^N7qv6eeDkX+IIN9Z2? zrQKJD771@ezO~#}_8d{vogxLEXBorOUj8qbNRrtubyzgJ@voCe;{sS*gY*3>>9(z_ zjAtJn=%~n=LWeU;DYehNAu>FWbq z5+azN_3e`rO9ATb4E2GK<6>i&4aN3%>&Oi6V zo6udAphy>rt(OF?V8auP-tZTzx?jdrRcA$K`*+=I3 zP+aJ3qsaK{YE$+r^=d8mqRWWC#&+zdr2^x|cOSet%>I&tT{g>ySBarO!L4mQlb!pc z(R5DMO^bHpQ<442I}#g@24)O&fZzLeB7A?LUB~a@D~02B^ee!#8&o08R$lhW*YE$u z0JySHCEWy6w6~+^>ua3Ew#YxV1+{zA2Wv=-&+4cKiN<6x-umonP}D=1IJN0_3($|^=Df=uBR@Bm zug%UJ01uc|ipkMiRkcfCoSgZF*k6U=sRK;yHDH0ISN7BA5y#Cnl|JOkW(cA{ZCG6> zMejqYVDgHbAPrs#R(6u7W$49^EUEa#@T;Vv^43fbbu|Av2_1Px@_vh`{U!#vU4A2{Cs~}x%BoT5C zkO&tW_B+Qt1_Z+MgDI3+%<7w~4f9@iT`iku)iYlpjJVoxXLjEzvFt6-k-(9$I9un7 zBQ{@+M|44JN?9kXdm6%~jQO08MnX&WNfaH3Qg`^E@aXoT3F99ZNw%q8{0y;KPVtvB z6T5&1L%&Nxk)3}^GODlHPp*74XFWjdV9H-?`fJUfxSr1~+^49W)BcNJQkfKgcw^`Z zAyrfbrC8CLuR}&3N*En3zyZlK5qy)Tp<(Qv4E!!X)B6?c-d1A{z@~eCvN! zEfb*h&GnbM)Z&s6C7T=uVc39Y8&d&l^9ecKy6t>i{wQ*e+|?q&~pUmbMs%kT>_K*0#T2lF3$c$xQ_%0J?} znJ(ai-{;&@L_yt~-)$AeX`Q3HSc60Q^$jp*`7 zak{OmD_qT@;U9(t;+rOX9v%@i73iRqDbMlWqPtrS7XcBhi2a;KnvUuCwt+M)Eq{d`Pob_B1)f&eqaEsay3u}s;y-iMr9U{ z5fnf^98s1c{0$iB6e&FM7nVfQY#@VsM)WK?4?Bc0Z$J}vFbaNme$J42!W6{ItjI;Y zN@_i!KL2BwWly)WghbW2upM3IB0hcpXxsM*wOUin#`5o@OXuTd1hqX}G$KbKG*7yh zP1P~cofuaiqM1_?`sQ&4k!(mTmY>yJ?tKcS zkeOQYoJaA^Y0Cf#c%lk-oqjCImzC7cIq-IuzL*L9?Z#*H{cgY}`&f2CsLXo(c{f-Q zTvj^*1RyYPkTI2(xd^PUX02@$oeGt(<9nNZaG5!SLq_Rn1~rITjWzu9!zJ_HpikD` zF#lwFh_(LcJZ{s75&1bAn6f+0#N(o5HjeptTDL~Y)WjOL#?l#MBV4i;ao8fYszN+5NTF3 z58P#o7o*3yB6G#pzvlzp2NL$DeAZ*$<74TJ^t9XpOtO> zifU6aA0VI{77+2mV*WS%tZC7iZ}zrA0;b$mZGM|3(bB0rDdI`)x0NSuwf`lFqH)u* zVuUOafY`@BzW3c?)=2Bukd%gdJT%QVt!r2(tnIt6b|w5|Cf3!63sOVoe0?TYpzu43 z1^#`#td0ym+0{7#4Q}?hZi(X&HwJ17Tc!bocmv_$l#ocx>H_()viOM!-O!$tmyADWaK<0#>q@6%cuWL_sGX3~kOi9%pdE>t7-s>y^FG&PeJ0 z^D;Tm-@DguBV>F5Jk^t{EG69_n8`<1R{x1~lBUEznGw1AYUl+sW0v5}IDtwlAsS!dG}3sWQPxC4#pv7SKC?^NC#CsQR_VNIw}qxTwZqUDz)n z@-_9#)%}bBDN*+u8R{h;Rb9$=N&SaXJEmEf;8L#5Mu99e=Flg^?MBAD(*qRt4<}}PQRAK{<5FwFcRS&25oxs|cMUl) zr`Sr750t%u$0A8vbnGO9WPdvg(6wq;s8*0rGM`-+3b#@Nlmjiv)#Rhw#qQ*!h+BVj znHN3ubb9TdYzXHka;$2RPX~o_o-7LsbaXglM5Uh)Od*$)#+F+EW{Z7m^*S_(&LKYd z_(wR!VNyYBLBVv3Kw5n|%RRFcJgw}A8kB3X4C}cxDYLiNNZ?j58NcUNh1N|1I1qMa zqxkrXu`Kq_AM)u&o2_*h+Wes?*^VH3#+&J8(C5Si$T-zIVfN1>>WwNYM$AAlx?c}<<7=#Y|h3MNX_Kq8? zi%$BQ_L$Pfz%STAF;*xxkz7+qtFt(su?CYMB|DM}=H$>C@V6jJIjM$yB9(8NrZtgy z6$n`t3Kw6xQBZvB_lU9TJI>>vjGERM;YudZu{u9HN?rT?hV;ZPrMZTdRo;4buaL>^ zT<&}Btz+@jNU|PL(RRbk7iF&WY->dinJO!i^kGev1}ux^a!U0yG}`T(>Y~WuvD`Fm zERqG9->%!fvi3B3cIQX;igI>^je_&^GeSqnqG4ZU$gp)##aB0$-)335(IC?sV;I8> z^j0^--x#u|PIBeY1Nwt5|BfXfI)(Y!NkmWFHS3yQw|-EROvh{aq1i?(aC&i+C@u1e zon6_gpb8uEq@@#TA}!1NbZ~5&woy&Ts(>-7KK@`poWZd(#4S)u4qAu!m3AN(N+NE2 zwpq;NuP9_nL)yc@B+$w18R?l!gB8gnjctziP>1-B8`r9OO9b+da87=Pk@8$0JFpiY z@0Yj}q!&5=)r;>1&*qzY@p2M8vCloiVwilXg&!mnu7r;zd3e~&=kLZiafNzb18CT@ zBk-(oV|sg#ltoX!=8yT>DB!VByQ|aTDf62M0pLdAybdP{eQfcw#B&Rjv+ zn}ml2=ucDmWzU(@!?2yo{rv4uI>hVShgqeopgGj9XzyW~UD)2TeDP1hul+y8W+JA; zQ~wF*_{hsrQ0b^m8lIr@#^uA`UYnEae;x$GwaN{ugFS-tHmC%q;Lo?f%5AV1;){!t z*XPi;QU-$as$9A`olh>c{UzU2G+)3fR^u{|Pk5pxnSgI_jC2HVQEd7bUMZVnHfLR1Lnu%q^s1ss(A*9-ng z^+x`RW;9M+$vL7nNGUWvG7UdR)cT?2I^nzy z<34F~Ty4Tc8^()DDZgo5_jq^+SK(bhjLDrAKt$GLxbJ_ z9xTCMz#WwG=5l}d-PZOhHBf@3C?R4+o!sDlz)iT@bu=i@?#}bM!Hv_eRv#3C_rlvjp6muVsUII znd=N2^1WVA)0hFU6zxVKJyA=i|Bx{pD4teG$BUUPRX~~vpuA_8ntO`%+Gf?0K)P$}Hu+7BU_|QQ+}J(glmN@IR)OwZ=X9 zaHO6+fZZ&^DM-aJ=4FVBp3M94zYh-6f=iuQE#<^TKYvG+=dl$P)P4_>ANCdX?fS9% zwy4xVCVn^S>-)yxHAf9kAQtgrbkZ;-hDombiCGlp<}q3gqY0+60YrBlV=hP+E2QV4 zul{A$m?D-wNF({leIVFw4l95C!AXiv87jNXq2}eTSjZZQg`ozdzBuAWm1KXf^3I_8 z^~l{wT*U#h%f~cLz18=Vb6Ga;Cguupc0DFzj{eDkpuGZPAe-=z!4QrC>9?b8wErv9 zCGSYzP_QFtbyyaHDBO^(^up3c*gZE6OkZr!5Mf)!b{y58tgin3+xr(*A?L@#fr4bw z9mg3A!0WB~k1Vl#gW-r^$Zjw2`u7_ZZSr3z$^6>j>F<6!Fm>DK80RuNAHs}Mp*eg7 z3B?CPDWK;pJK{_D-u^-G+i`qwNrhw}gTTwgmb{MVoZq|37GXi*j}$@j5@-4D#ME#UB+lZfu0#0GgV=KN^XiFg)!i$4(qKkrJH|yX5VAkKIoCD>C-Ae{QY0X7u*HdO`O*gboq@SlDa2K|7<1jP)JCG)2HGUCVw;k$YE zedajW<92@@%e4RYz1`7gPrm--!@RPL7;09!*YFF;i*XI0#HiVzHc0tUS9~#E1B*7M z@JK_v%-+GMml+t|4DcLo@x&U@M%brhQ#&OG%AOMMWoJ~B(h|d5!eKt%^vO*;rZ}4o zs@^gdk-y)N8=h(snJdSM%$k#X`U+wtYymc$Gu~g=CI(Ec>W%8L4v@Z4N#Cay7#;(D zS9tn?Hqr3riQo>3;A}>mM3GC)>!|qh5oPDotJ6z*UOQ5_{S(@B*X>$?yzMBZ%~Ddh zVqw_Je0ZfULM}t7&G%Oz?KHM-N(EY0c#_Hs-+smXHhdUgfnHT1rQHH+g8M;%`5<2O2Lrf-Vx9c%*g$!5Nez@)N5&QEWGu=#| zFyWWy0xHFbX(;%8cd(QI?A;{{6IT-5>mXfGL6(C4*IBmc#(%o7d`wuTOu@UE-?7dG z^j!WgF?ooq0#H6Im_&3KA3Q?zzW#_@r+&eLJCV;tC3n*;lA8IYsF3yBypF7aeYBc_ zEa4zLj2-B2Y#OXc7#CGElg)T5ykk)un*YyEegGL0y=zS{dHv=xUFsST4C8grm{Gy@ zZ1f;S^LtH!#RePT{{Lrm*=F28Nq;pL1wa#J(&Fx^=gOydCff#M06)jai*QAr4$kU$ z4NM?!^S6-Y=YCd3tjFfE5aRD|)wY_-%IgmfJoaBER~*X8`MD5Bsw^+N*ZF+1S}iRk{Yrrh#dMGFz{nL*M_Ta2s%j-r$E*jdPOCeogQDNeRTh01k&3MeR0so{H6Cs6)&=&|m2H*wK#ddd+8Trb%a=*7!#u??hGBL}v0QVjDmr3kjo*h*ugH z0bqLa%a-ocsWN_?v@hridky-abbS|@ZHj+)TO!gIe<^K*2cTm&9`~CZw}a&vm)3yv z(%F`sQqUs4el@-uRvU^nDOyfwl!z^AS|5k&H7^d?w+`2*Ffr7t~_fcG^*7i43ZfqBdI2j1!d{e6RxYqQqL3jedD<9v@>&}ELoOWC9Z{@gO%Fte_I1G_U-3#=id?Bma zOleqe%vlbH2-)Y7_m3)`nXmtT$sgI5O#w1y-;Zy?rMi-|8;DeLjc=2c&dq;Mo7S9TukZi96S>r`(Evhv;gbTDW)xz2VcrW52NqT7TH47J-i!BPUGS!Tx5d zHeV>t*#w|b6Y#6R1~nA;tF-8ninrl@vum@M=oOTk%b|8bwNV7>j`s-+V-qs66ux~? zB5YvCET92wCV=zRY*?qRUNb9hgA;7`bB}!|PkCrjE^$A~9Z+b=e6mF3n}Dzk=<2f? zb@i8)*ucp(C^!)77JH1x%-@)_F01lHAp1-s=N58M19aT|-e=0#f;E+?&zMd58Bi$BDuq z+{LgPER7S0ayIeg4G3Z2c=)KIcRL~o{FC7WI1N81B_w*C*8srTSK5KoPNRA(I|+>= z?*slM%{v&(3rXHCej&n9q#dG`XO(<0ijipGP!clfq+&avBOsodkYOpkS)fOxJy08l zc&3d%P~#vlBFXD^;Ah#ufjM|wJkD6p)~nwbFUPnF6bUp4A__M$EcAoFL)u&$@93%2 znVlGl)_uj5Mkl&lu$Us}Jo+R4zDMjyk#Ucmez2bs*et%mXolq&g z*J?VKIv#7{UrBziOc9hP5cQ`0=vERg{W2H--NJ*J0-DpquT*~!g`%4Kt!~{e z#05fwQ+hhnXTwOz{g{KAvl|K52m8P`Wi43C{bqda)`r-gBEk z<%KNg0Pz7vf=&4G-tq&Czg~Dn$R2%`$o|2L3$rYwEhI5fMMQUWum}d=sKX$2SrI7% zX-4@(Al1m&)SyXl5@~Ey!;(fkkZ##rx%h)a(2ar{79o&P;mruOS5YOViuUO*lv&MR z6mA~zAcAGMJE;b1`joIB-_HC?eNS9?66m-XV4V{$GJ&rUJ^AU`rIEkxF(2=y*6=rC z&q{+jT96^r5_{Bq>D9saW)*FlZ1@xdB2sJZYZ_;j^2{|Py60G)$p z^DqWFw-i1BRk7BfFu23^3_x}eE$lSR>j3-wKo!p~e1J!xI@PtoWK*bYqrUyCKpb@l z*U{siIT21ZT~)`W?;K*k=(*M-z4RZ;lowsaCCIRiccicQRvIEIcw-Io$H)+7Qvxq z`DCql5cPFlN9@fp&kZ5ZdsLfG{lb5qjf94zQX)Qok?GM_@^I$UmqRx%B1g_DA_rFe zdzyx9+qbg2Q#8NDe2}c4@52YLsbCvi?@Me=zIp1nifk>s)-KgkcN+ZMM>Kl#zs4<} zA}Sq@Osp7Ol{U?aK0<3Sk#O4wFugpf@zYydN*~JMq`pIAj9puscoBi}b4a!?1J?`6m5mi6 zrQ4nALCt-7fX~?M?FzycdilezpT$0&v>_61_82KqO4H#k=|0fp>oI`r!Tgw^dc(9u zb)z8COx-ozoj)*-@h|f_qlOx|mExh)a~S#mMWZ9)JV>}v+tx@2vYc*k9T407$tR;^ zB0KhRDP;cJLb@=U)hnc)V0-9-sdvGBUWq*iDR}<)exGKiL-_%U?*jGzh%*EnZ6Co0 z6SFvHlg7NbwOBc3l8)p?y7y!n!49{cMMR&EG&%+=D_BR46O|4hapi;9jgyvSfw57g@?Eq*Pp$+wsGIDT}a(| zBPKDg>{s!@<+=aL#%?`m?b@JA;$As}=-bz{oJmp6Vc$N)w`0J$w@St^uFr7B?n8yF zr%C$A)Q8XTI4>{l1qVbgdR|Fwc-HnR>{!Fk){#8@ruNyS-p52i=;gxxXd-0(uR&@o>qZW*9aroPP;N{%KH8 zw3Fn4lX-7Rug{e##3S-+)rohX6i|i<)bsz&eC}(@NYCRqb{#lwI*5HpfsoEiq3iJy z%<=Y7(*HG}7TN1e>_Rq(-Zh|rl2y^-M zHQ#Pj5eoaO?iTvV_`yxpw2*$`+XpbUTym*ewdwu$wo(s1+j;XPL=U9M7Z7F5YG8?`Cl)sYu{bc@ltm?!uag=y% zJi5O!&cI@jcd!1V&rCk#?3*7xj(^+2LcEbHWo??hx5}kB~U|mO_m7FMki(F&oF)7U6x$t%~4j@-mj3v6Wg?tQay2qP- zfC#j8IG-Seg-tEs8i4Pw?u(Re=vv9!$=U;nE>RN!*VQ4u$QG<Xtd0>c})t*uLD!z{7K@kvDBt^3>-=iEB9f^mann02UAB1Fu|AjKm< zF0{eCP1JQDcy+y9K(PA;H>TwUM*;r3*PPO=1lhiMqRG2+$|5c+LTWYp8bO2;AQAH_ z>G)P7@J!xcWM%wf?fmO==b6y=;H%Z935FMp)j9EET~+25L_AT19b#t?@hczjX&l7y zzOM{H0e|`k7=-C}#1Ip*M%CO)A}sRKMk*^f7I+3BqR!~lKpRp-;c8JHgQ4e6X}wr9 zf3d3)+tAU2nF&|kLwE9foZ9s0nyHOUN ziQgf}i+}?>U*P%F+->tmJOLwX=5(?{~8&vTz;AD!+lf zR0-E9R!BCXq~v5})L-k3S9o@$cFB36B0BOSVrGV`_%8=uJOtrn_=|CxkF+MXs1pK& zDE{n)LDGlB?R0IKJe-b8&LWY{$7w5eMjYsp+{ZEm{ehlJ`8Q0x)GF0lgSDT?$nfyX zgg;`XesB~*g%@sRcf4FtqlLz3DvJol!Q2yjd{~|cN#rj*AFk$(69#iPr6Gqawkh;D zO4GfV>QTc?7sq?=Cc*}R?-PW<7zo#G!Z{8OwTba@>3N;KDEhb^DdYsc+hTMm`!zg? zw0FiKRH{5lwucCqpCWRaR zDWWA6fpXqoe+73KPLElX3kg8&l>)EW|JZ9#*vKd%As#+B-J^Y*YM-B{{pnQ0{QVfRSMdl>sK<#%F0fV*E~+(5L#D`9w^c``+9VO%Z@g_+thGI3geYXE+{i`#C!J;xHDb(-XH zS();#H`(viE71TYS!tcusrud#XqI?HK&pQju3u3OsO7cZZGN%u4&4Tfj=1ANgQ2)m zq{2q@DuEt*{v%(mEqMm>;kIEgX}~Sk-mK!YOzvoT~Xy#6$ z)p^pA6uG`E1=aE%VUXD$e@x`RC{IftqAgUGb|g~fdHmXFib3I4-B+a~ObNXZ#cu!Y zz7+|GxAXCvjfu4^TvQ)GxIz+$B>#M3yv-J+nGYr|KsY~UV?y^Y82oS`Qb2LO9ZSCA$k+rh89+^Jv{_&pK41#h<9lQ%vd}3eF>xQ84Az?`sS_Y|Q zKliwkj;Nymn{@iRU+wGzD9ysi{xAteCt#-5)&GM?=#rO~8FuBvAZ|A8i(x19MAuJU2Hv2A~7u;nUW``aby;Stpc0 z8c=msR*0t(J^;A0p?Q4?KtKINf((xCa*RdpDD(+Av-Eg0JG7xU0VdjxMQ_PA_UxI`SN4f+l`_?TDkCopQUs z%$5PFL=GPywzsD+*UlAv0-;ol?mNMPzTIyJdnw#|`*fdUPj5>Ej{c9Pv;J%P``b8( zbW7*xmhKwT-6^Gnbc2Mzq`NyO9R?o(DS^=`Afc3Wcf$sYd*2`Ke_-+0&Uv46UC--! z{qo_I5@Z>TnFqN1#tYjj1J!<7BTt1qD6De${7D~EOEA}Fe)e%h*t|8EWPDm9f{iY; zDm&eEa%ptq@)A7tXz-fERh7~8EFZ)&{Fch+gfAD9Xy$EthmE-&=g+{oPjC^U-QoD0 zB|on>vSMPWHFsk zGMGF1q7*PN6qpj!yjQq3x!0wU)khnT|9=XK*C($#j6Xb7QD;Y`&6Q%Nd$xVb_U_uk3XQ+J}*2l|O#RC>db*dYA^q9jsnY8-| zxjq36cHrH~rm%G`Z2!lvKeF|kuqCAsSX()Oyby{h+#sK9Cm)Spi1it*P5zCYSO{w@ zP4hB7CV1|vnF$&ztD<6~lS8asK9SuuWAUvrULpKp8&AjB*zf+cvTFX%7Y`9|1Ei3l zAhk4QYggQ00|;HQxHa^QeyRee!~MXWBFS6T`*RW$&PQG8KUptF@dMssgwKyA!F+b3 zqzlahg{YB(rY;A&u0t8J+rQ6MuW5M0)djyA=Ww|IEMK1H8mcj9LWtsrS8f=KzR49ec);2&sv z^S#}bvrE~_=jdx%d%<)y+)b6y-=AJ?nAysG(6FDjhnMlXjq5&TC0;<8j8r3Jj(XcIU ze4iYfoQCYb^=Z7~UcRxEpvtK&UspVP_MIg%IsN=H!GmxUk`XMH0AvkdRzAq^cflFi z2)P7Hw!IjpKQ{W(->nolyLQgSf=D~1N6x>sPY%SH;%RfbWl)Ya5pzR*6?j0Kcl!e^ ze~_Q?IHXY&esF{5FhVZW!UMCp-ritQ8EDH=GFhU~(fr7EBLE&e!uw0#=s;LOLGQhc zmrjFSyXhIx-P0Ka#99OpC};t-DJ5T%duh(^mfg=X&$4v7O>FFA2>nqw{kRZWaKyA8 zQ@X=3S-}6ayPrV6TLcQ)9%j@4tW$;|s}2TZfy~lMk&{pZrXyzE>@ulec@(7Ivds7{ zHyemVZ%KoZN7C`KN8m;)apZiV!;6!i#IfqfiYhx*^ldVQY3^Gr#qj?W%WN?5Hqml zmtvH4*>|=E5l==41-;>A#eCZ2|3;#_Dux*0eDbtlsljgWUwL_FT-Ma|!q>$Yj{iAY z$E3`Gm|D?oG(vgzTTI!x8?KheL480&1sTa}ILtONX!`)wVeB2zrRH9OD{){bYN+z@U(w<6S|+T6xz4n(_CU z4?j-c%eAnpD1l^)=JtLuk2dD5UHvI>eYf@>Borz!optWTR5>(eLT8R zeN1SNq4jNl4b-6a%H-zWFy&vS6|Mhqn$qN>h&Dj9tLnc8PEnR#+R~&T*vBj{Gc=J( zPU=Hcn{lrQ8A*m5UvJ5om*G9RGRhzqE^MT?>u=ZUiyIZ)3y|E!@C-1B4&GUfrXx#U z7ZWis`rXWqaD%=d+Vem?*D%uUP`V7hLuP&Ci*MMsiExJe+fqTPrD*j3l8x$_^Ofjp z629R#D2ECl058z3(R>(7ZC2!fuK%-2)++e-4IqL!VCY%qe+Nr=DJVv`j{-s>j)c*V zm*=?V#WQlcLF>PsyJ6@T(-2ibA8T!pnL@7fJ%6*)-rJiP7n)%0TrOTnjg$<%qzHxH<$NsZVxPBvvZN1*S)VpQS)}=%D0q4=654K z0gpbe8uU-~zid@DHBW`Ck5w8Qg8okDi;*_w6EBX5q{WQwlD-zVetz5DerdOg14}<@ z2)9k3VqO%?nT%94_-mUs{3Sc{wVSGUXsfw*XtfzZp}9r7PbX6E5^k_T&%P}^8hEqu zQ#?;*`}RB4dcKJ1`>`oBv5h?9NnP-+cUW1Nhp?^VTmj{YUv%6_TO;=9f(A}jSJJ3svfGp#cWA2{8GW-mGNot zo)YqdA(!aKv+jfp31}1rUpI6ZIhS}Ny4JBHKC_XSk#%BFBt)}rE#zp~Mvb>&Gnu~0 zC3*30ayxDj~ZJ1p*rBOETHhnMnWr_7;Y#^dI=808I|g z+JeeGd+d5`o`kc%437DSel1JYivFm-AtjIyokJhc7&`QdeOt68e3*XwIXFF4S6ZzJs+DGgREoKMcwLto(@;=r z_iKt|lQhQBV`?%thuUIdA2(9)#M4#h)zhKRE@u1Yqp51KFv!7#9X;z-*A>QYxyJPo zjmxNMgM>&<$u5685c~4I_p8Ka{P*bdjW`{Whf3NEW)C}Rtopn+We~Ot2Hbvp=Q)`< za6vKp4{EYTc%8i$8^O2xgS2a}?Lf8~&$0Nyt~7YiW~!T(SE|<&dfE5cAqdzc+dRZZ%`Ne>h>dJy#yAV@B)PzkMXn z=s{eAz_+`kJBFfXxh>*m?7^>2{Lp{N#Sh$DpzbS|YF9f<_HFg7&-E4wBj~g1`v1)M5Z)C)vK>1^lbjw!bhaOs!}ob%hh zGT>$6MEp6w7h{{I6YdvE|F6ihxH#3SD!N=58g-u_y6c0gqec~Os(=HsHUgUn+jB~{ zb@y`WT$IjXcOL$;uZEikYq4b$l2(xQidQiK!QHi{13c|_R;}NH4E1{*8U(D4vTOv3 zO6P$p3=o4%A@|3V8!79XBXAvv2$|&BxxEl)Y!bE2&>df5jXLcOuol0hJG|U3Ve&tr zxbuIK@z5bLm(E57>BU@6@)t}L+~E-@BO{`JPocG{v*6Mz(nZwUeiN>$e!#r-D5^id z6wn8J0e$_YA4`Lg>*e_Ypou+Q$0W}?oZurxD*B#EvuOfkBH^szY=&y2I1i>tX12`8 zYTPeHNLh9GvaTEdox~zl=f{QPO_r z86pbD&v>*-ukURkE#ihid}}cE&hLM39D}zr6kVJTHov~( zW79LtU}!x1i&BCG>==X{)+RF0cka!^{C@iScRF|Qdo0{tK=D+aG(U7M>+(BajJukH7@r-rmDg(TA4Zan27<*bC2tlBk zI@is4eY1)&OeViyt2Bg&swjXEyvS!(dYepS(3L_%{iEFyoKzjfI<^q+;WYX7XYSaK z%mz#W72K*+o2$wH>^fHc;AqQ+$J$xo4KOKs4Mdn_V5xxV3bQ7Vml}&LG{3A>P zjOcOjHWd!s@+yN?@v$Vom!ftloHf)cCI^LkK9yJ zm$QBj2cv=YO#`{%vGCfl-{GYbDVx^?nz!6ZomR*Iq*YvKqI$PG0j>ry_bjBS7Q&$D zVqfEoc2F9}x^~mMynIb6lo%VJZ1lP3gUd|w3}0s+641ih;CVWkl_F{5>c$o)+a z`=POdjTO5&Vse+F_~BypP#PrYR<^7WJ1VA{)4b88Dn;AKK;}(M5?J5uSWM48y z>a*+v0lFJ{<9j?GJQ+VH<;QR5-gF}-sdtFqZWVSKHv6{kz8UxPrur~|#u(pPa(?Nu z2^e@5x>fc*^lnfwCv%P7A6N0{jns!^2tJ4`%XQT&lYR8mh!=>wdvP?ln~5oPJ~dFM zl4S;`KbtePahkr$DcjnK_F%!sQoOntjM&WTNHI_&Oz_hb4~qKDo?Xb#`c2b|MX z;I5p*J(NxX$zf7`$-ADKIH{~^!;t@?IHB?I@FL#eQQ(9=XLQCok+b3JH8ML=E1|DT zRg-ss-8>&!=$bU5V6MA{p(dsOuTERP`<~y;Rn3g`F0$lv2(eVqN`I&s26s@3`cM{` zd_`RkV22czUZ@bMFNE;orV_;~jM>AsdA5PZ#=G1`FUeJrA<3&wj|Otai;{fpWis}? zu9stuO@Xq39AK6C4KENho{cmwR|o-n)_HTJ9t!;mEWw$U-!A*l z(cAMMwmVIq?niC*ALy9F+fEHfo+aUcfMffkjNuaff)h}l?H$neJox6bw~HHJmJuxG zrK74%vJ~5N9J&u{@NfAIQ;{CD<-uGc5V&;Hq&9n}5M60_BiWF70q*@#ef{d$%!QuL z>fYq2qH3Q~(Uq=Kj@nn0o!Gv&f@X}rlXlP|^s$LxjdD4U`R zdR>^!*-I+e1mF5s2^1C4W;_Rj)J2iuU0)247e_cUf$jdbl@p<=LIeRe{*xBhzg88D zH|3?Ku0ZlA4UL4&dS=7gjsyFUqk7=g8!M8Y;TV3Tde)hUP@NK05u}rNkmASj@#pb| zx-tPs=O&wN*X+t1+d*kW`M-#VvSz380{<;F8cllxK;axe;r>((4HB6xe|^cmO*fg} z0y5?-X|m@)Jy}REtN-RYi>0IJR!>mi9h*srX|gW!pLUCz@v!=nOIv7AKFo}B#UamB zR0Ta^+^exS(p2>pDjiYDE3 zqdUqj%Hl1vB?^`bQCC5mG3sy5{(F@i4$6`5+<|$UhKdfE1QmZo=1&sl{V{yq)p(we7d;+&XrVn3a!Yp>?8rh7v?Du+bwHrcn6lp|zfHMO~8t zF7CF=Ou)uVki2($(k*xvhmIDG3el~A9~CjfnxlkB!XGbc>i`HQ3~I&sU4eBj3Nv4| zZxPi7u2M?wYyU2nx1I?=PNLGeZ3z2oc7ML|cYCBFj*$UP}b7 z5047>X&$>C&vXCP04zlfxyQpc)G1?tQrmpzWB}&lMLuwny+;@a`E#p9&%5o+b&H$5 zIeXTrELHJ+?&w4hf~!xre*RZ)c$0iwni+D4uTUd>C7NR0 z`bb02>$ce1wC1;Y^VpBMB-x$&wsoDyyz=>+{Zrh@zZ-B!Dlq9IWNx71=XO$t419D3 zST~Opx$qV$$IQuOpZ3=JZ@6grm(Z#7_Xfj-d^E#Sahm~^DdcI~?;1Orxz!4FUarsX zs-c__T7b=ba#2M_F0T4-7LPZN-q#ej&>{><_m=Uv8R?nnBux;bh$2)a}az5CH$fUrSD%$ea1l=6$}gCY7IQAZkF0ivaw9 z5Uye8ot>A)EOV1-_M?%HRlsVNd(^&H^^i>W<^!@h@NPC#6xs%f=kK^+5JmonQJ5gJ z&EsJj?%9aKdrG*#m~_Zw*XPE&oekKlYS#-n z8I#KgrQE@5eg)mg3#nanK0oovf3L^|$pr-7)5^exOsY5L36;h`c}08=$grT!t0eW^ zx0M6Ugy~CIieU7KlrTj{H(fd{aVK;?Vvsv*N((E)cYgWKSYh#9YTRe+Z3Ad`LJqND(&oE2u+0ydj$S|S{GCVz?4Rz+_-lFyCtX5& z?2clZlG=@SKjG{2W_RQcxQ%CVd99|slDFL`fhX$cqGVk2dE>Hwf7uUTV-xSGcOB}m9nrr|yLO_(^wM-!cja@#{1MlqKSLE6 zp(X|(dk7Dq%yOq}(ecQ2fFN%wF8sX!dGBoa;f^Mk`43;+ElCZKM^74p;gl}hi)2kn61G(wuPCf$-`#7R|L^MCzp&x3>=-J; z*;P=7)o;5`$eW_?glfm>J*PS_+L^!DV|4G@Eum--XC%LHcIW_vR}GwDQ26gd{G)<` zWAnJI%=PLHwYD=pVR>Qx_BiUDsgc6nb&Wp`9Ixc7b>b*MzQ)1(p}^&2?^=$51M;!u zdJ~B|uLH&zb%BeC>jc6W(A=`@wl2J6i{UEaS58mjrg9`bMX~<&EO|n8`fqVQ7PAP? zLj7ikW&cUNJ+Kgj@AKE*#xE`BvX*~MoAf)*&+V4oPre#T%9tr4ZXwN6ZL4Dx2J$i4 z^Om})>hVVZZPDQ7u_x#@|GNz#T=lcQ_`r_%F*p`)J#p!-d1F^jRn`BOIy!}Vb%?H-vtEChk~vqrlD5-888XluI;|N4BwF!lea+SQo_eANJ8Xi4aux@7iAiEEDK)}Q3+JYg(>b80{rDI3HIrVyyh zTBNItW3gYqMmGJq6mqEHIXQhXJBjoZ{bSV*M?xM*77Z4m3vF8Xl9bh={1erOeqq{X z7u7$`v^Vc*VjCuW*JL933#&?HRa6~>`|bcHkR&m6ZeuQCi_4!Um<%MwK)simIB!&A zfOpxmEiM34P9e||uL1it)rEp7x_1CJkVqxinfhDa;}hicTHq7JI6rncKbg@FO(Q4j zt5Qd*gHwI{63#yP-4O zbtGmL?(VhWn1x-NYKbZ9IjBKQQdMMTe{ zKko`!-iumi)x)l8Ey3%ZQ)q^@_v0#g+VNE;0GTsrQ8G}Lbty2?J(!%lAk{@(gOvk+ zMu3YgeT5XiveD4|yHPpUJjACNE}~^|1%I}DwKP>-FAHACoUXMCJ^G6ptHI45Um>KU zt1-Q9bgX`KsWtT+90MGrOr5EqH(LwWmGtQF(j7Mho&)IM7EpclI<(nU`^^49Df{%l z$Zw^f+h@ElwN-TW&_&RGkC!RTotGod{_~+84pdo5s#Z}8N;L2z9oR0vd_v6@8*w11DD%zwD_FiS zF3V$&v22u;m#<%Rd3Uu%ufzR8AvrMYbr%s4v8K6tzT&1|lB%6u;}^)gZ;V$l#xf7* zujvle4K#Ti)jO+3T4`mryRz85@nraKTg&^+&v zk_>@yR`4Jswvm@dfeM&$&(OGgyF3c)-5*fr?G4wW{#u-jFHGU1p^cV?HKKuX)Wj%! zFiJFQ7cJSZNNAM03A~2#@eA|SomzY&0W*}l=IIJpp|5z}P%K~ni=QeLyUv`G06?X# zUxye8vonFBF{>uFZ>*Ffn}LFvP*(wp^5N zwK!brG~EUn3XXEU?}i9xjLkCo>HjeebT|JE^hL%bsmR=rIE=SdttX3QX*oUSaC^h* zyiG08QR=vU=^0&180ja-2YA%L0J+7x5g+M#ia2B|J61%DXtYdX9!lx)#IIhn_1@?B z4&?A8hYM;v^9es9HG5TU#vQl@a&wRG9g?__LtP2=Ub>XQ*_~(G629`Ega=DRz$Btw z778v?3CB`N%<~h+b!Y`Mev|i!Ipca7C-QC;YsL%~# z{^waYJeA zL3TS?MC%PRUr4YoW@GKUe)7>hB6yWE(NcZ=2rHSdGN|#`AtOev3}>t%*1gP`r!IV# znbT5dT`0Ks<6byj_jG3BnGps$M@mJd5pS7@@$fjWWqmN}blFe8l^s8jEe>1TlJFO6 zT>t8+uKaqU>L|Z$JN|;{8y8yG?sa~mpxL8)`e&ZS~~}-gi=*9 zc*e$K#qmU!X7y{RV)IRT_b4_#oZ0Yk+q5e;5_asmI6P8-9-1*~nhB9)zAJ}vR@Xgu z*Sm)&C)GHe4OmwPSp;c?tjsIVWPRE!w;0-Tife7#Xz+mMND2@=k@c5~9^%lHL*LXy zR7d$*pyad#|L3_~DO`(jwcy1;Rz1a~mV0Zxomg~0f971EUN@&I6MmgZ2#L?ZB@Wvo z<;L8wmdGPD!;rQ{&yN1g@vPD+bnFI`EAW8@7Z2?1xCz{2r?8t0=u64yJ(ZYM4=2Pr z*5yKn`FC(?>hgesa*E-L4sIum*&Dz)zTqMy(SFQZKdq$w{_Q@o$Q0t<`7nSF4?;xG0;ViFvZ=^O zGUhzK{4)mZPY0}`L*?q)vApAE{vQH)FH6cR8PfZ+ebGJ6p0xHwWcRI4ZWhd0Gpj<# zhqBD-6}r0-wmoPq@rTaS1q-ouBQ(vbqhl!XgDU+!TugayKBMChY@s{|0Hv}|s}3z+ z&47`=ZRm$TdWk;XRQ!^dy{=^FM9%c1+GfGcf98ob80Q#6z$lg&F35jLw1qi9G>jf_ zT)pK4yOQ{+`TkYByPJ+zowx!jiLqTL>x*$-%{Ij}RHq7!D0amSrLzucc7SAGxy^JU)K zuNhbO*cf!)+*PLd&Zk$Ul zcE|TXUb$aPacR$8c4T3G{Rch{O3`F-hLjyrEDynrn&s(E*M(y7a_ZDMN9-*oz43Mx~I$aq}^_%&*#TAl?BfNX~Wfd&GW0r zcvJY%>b9jIZ{cY%XO<#-IS~7rT0*kWCfE)scga-+*#ikf+h+dKI7;gzDniluPy%$p zn2M6jM;E7eY(~wz<*%0hwGt!VkP>Hb#Td}7ffAlsVR2SAMYLK?2ClZTRX_^3NZ`M2 zon&78@htdun#TY>%2iHp*cE~*BXsnK=N6t(kh}10ZUqv-+at=|9~oe+U6S#M9gOmy z2FY=mxFf&!jk;qm2c8MYgclgYrWA;?30{BKLzJi@L$kDBlOaE3z5(4_I8Cz3ToxshbwvIj232K^{ugQ&h${KKrV+lXB;HI z#ZU71%9}P)6$>nxkM>Re6E_C zDjpd+UjKb2V&fu}@Tm3}ASgGlVt})eulbtaXfxptD7_uu2Nb2E&DSW$u3;14n6f{6 zI}eHx5t*M#0|~%g96kB%9!I~60I<0aHILMHzpbn;D}fS7_~bJ|1Qv7!watn6_e@EH z_${1#2&@D9g}8}h_bJTrL}}#TUVek{j-eEEMtO7!RP}L2CWtP-w)s=4mEy(br$n;4 z!!rOc*;n|yKFKX9s|Mp&p!KYgk=w6~PxrV5v&_SiC}HU9CmM2Oz$Ik%_CWj_jhRWO z_#b{yrp|uYzI>dh7&k~Ag(IioRA(ZUC(&kweM8AOIO_2b!DC%_Ki2=joUIsu%e4A} z^l2tf3LtcpH{S%K$3BiPy?2vfL%TM&_Ag)JYxK&K0hEiP(1vuZdeEb?(u zBinOORlb^N&syCDUDj7AH%7qQ-%OkROWu#IK{mfO`**QnS?l~HkKm(<*0F{~>i}-0 z5qeK@9`g~X?ITaX4~wj&WMA3LMeyyWyOit!cvcKQ)>N)witAKao0_J!vwr!KT=$lc zg#aqPulbqF0w88k4r(%4M^bjS{{||XY*g(yi7%1)fEdrJRSlk(GN|vQNKR*!NxjTv z|7OW06Joi;Ney~mlGI*8e>H+(aQR48Om8 zv}C_G4xow3y!2Zo2lC8*00sC|?e-asf0#mi#4Pt1BFc}gR|uZI!r7w(CQ7%vZr(5l zd~R{1Z@v6sWLH50n^t=U_Sk6&5aq<0tX^G}`>1gXKZx-~X*R=|wf@<|K3T6LzicFV zCNcfbKfGsfs`6Dyg2RvZigU6e%yy%I+$?HinP8Witv5m=|BXD24szsM8{1IpLpmkFFuVBao0N%wi5iePE~?K04MO@jj`Q3U{E>dyv#IduXi1q0bW zE7LO|Q>$&6NP2hPjDq4Egck+Ck&QD%l>2DV{!l;))iIN-Z@UZ( zt!3#wIH?FKg$lH?#HV^Lx}Decs#6#~Bp4LKK*E8}0m-q*!LrB>#>{{?ZPZCAv{;@&R6^LpzaQ1v;&b0SGv*Ayk zo0yV1CM-qWe$}a*q`_tdmHz>!zqS}7)iY;0Jg1&5pS5~%er7Rwsi9%g-W@u4;(ujy zRNP8->MGYx$ z`QyibqUc_TVRyVHx~mk>X4S3Tgdj@BN_?Q|9!ubEKIpG6XaY=@E+H@Hfin2uXSdAZarO&+8Sr3ar!0v8B-CG7>{VW*CuBx z)FnMib?OD6g{8n4a^Zi&={IP&J9hE}nnud96iZMCQS5jQgBkB4A?@r^jMJC$t9`*N zh)_Vr>bvfcW6aV`5H6CeoMf>S%zD85n%%_)^&{L)F4o3R5h}iIW^?_=vW`TpboQm) z<>)+k>S=Ry0JKW9f#Kx*PTI^wF3=E7br68FjIATMO-M#wY?T0f^52^hY2#<2G||rJ z%+oci2}H43{XDc+iy0Z5LAkB9HUZKWZ6v3@#w;*f>{Goav;Tg%L2SSA$RE6;0|LUZ z(w93!J|_)O*scW*VdjI8aWf!wS+7<7etC#%+!tZ!4$zRjg(LV;v-h+h+(@3FR%J{9MvJt3U&gl(XU7iQgE69D+24%CFnp~ zK;Zz(o3ERzdOdI;qX3>IGD40kr^aob3wMci=E`Tae;=3zhYd@@{P)Pdd}9KI-veJi zEn;(T#A)=YS*vp9 z#iNP3sbSxnbWqh8$lA;*=6HI+hj9lz>%vM5DMGBod;60vPOR`5m(ea*cK3)bSA-UL zW^+%Dr&PKUIXx!ZTD+zm<7xFdb`T{HP;lbL4{ zZPKF?3?M6lG9gBEo^S-$nEfWy5l*@_g+kw!&wGuQKNx*44O$A{I_5ufL3e$&n0fNZ zjQsZjmJz+`56tItsbyP)O`C-=)iKQUt`pUHea+32mbz3&j>^Q%`1SiBM^Ac}@4-jP zIPyGymG=C$n$o3>zg07unOtQ|vXIxMH#WR;qlBWRGNj?1RaVpzLdi4;>>!fN!^SL(q=Srbl zZv00>{NdXnNoK}Krt-N98JFJhB-~p_@4s(|zOP+H>*TOJDXJtmvv;&ytbarVJ1NcO9o>$hm<(`TWZ^lC(6_gh`b zUQbPgZ!TRpdj(4Ma`kC+_ju=E+!`D_X-3+r&B{jo5*gbx{;!CmC`45W)RRBUyK9{b zJ&E`@aiIzG*$TjznV41;6tVvv?|THm1985{T@SsMhxs}~$k5ywZ#goremF;5yNr8nx_*NW=kjb4~Tdg_XB#9_NKf={6`%+Vwk(>L|X(u8m$9rFDe zO!9?5b*QMZf#iyc@SOX9!RQ0y0(AD){O=!n4V%K-gaZA85Ob6O_SoRj2$=L|n3zoJm~Ji)nlVud=l9FMqz8hL<3$M&@^eh}-MGg6+(x zZ1_`o+9hLxMPkk`(7+#{ew`)?7r8C~LFtq^u^am7qg=r7A1n;NVH)P+NVyhaZW+y~ z{tXT!={1lJp!hVXun4Dcw_KED!7YUq$-_r~)RY=&byR-+pgH~XZ3FxuAftBvk?Y95 z^%~t_jzHH8ZA!JH@Z(-~Y@(UItX~-({8owhJHXL!U-mOWxEpgk|Av@J|yQ#KTE$*Qqiyp=}0m9*%Z4= zJsXKEynOOI$@h3S(L{EnHh2}Jz{c?3=^P%#sz{pOfD859H7&!a-)INJ$BM0h1|!}| z_%s6l&A)czbz4y$O_bwf;`<4-Wrpcf86+c6%(Pc+7+2)=g2Yu0KV03Av6;udx7{rZ zzJ&~n72j6uCMQWi_NgB=eR{U_^OF1PdnMLH+jhbH8*lq0P0pe9Eb5M|-Ai+`U6E|O z4Us`o3Xt)H=kwGap3Qlq>@>LVQAo+(q?!g#6$Zi>B#tC7$B8VkQBWt3-{3Wm#hOKm zugw@`5H^B<3-!DzdH4o;vjahQn7|x+zu)R+>7*A5Ny!@tHG%&5I1yZ$Y<4@a=8WW1 zzj}$uiTiGJw%;zyepWw>u zz=B?Mc{@@o6O`U`05IpA>6z!vK(@@^IbaLwEEZ1p;kBql68vCaP0|E4!3Y1= z*7lQIBqmA=R&WdbzVN#j!b7k#fwV}xP2QrQ%EAT(wJVJc=(JsWYNp_!$lS9GbdmH} zxaqdDseSbgX`5qP(I5y9$x3ao{C3B^8|oT^+zb*aJl_M#j%hp}UW!8rk0g@j6TeyB zt4}Y8+_@kc+rVQwvn+0m6BCY)6+;CiUL;s|-+`Vx4tx^S!@e>tg6bWyikwl)phCGz zW*bOKQXP;U6+c561ko2p7a@d<%f)O>L%7@+add2`x%qqQXlY}_9iVxS3B=P(Y3uT& zJ_+z$3z_+Gn;|oKq=8zUx)@t0)Y$E_oqR=MIgEi26S`3d+4P@+ft2fd z-_CtW9lvLNO0fKEev6IO=O|JH&bw;!qohmNs@zZl44zewW(R~w8*ANrU1$&}00ssM zRa5hk<8e?m$S~nZ+-7|x{E4#6~%=5|@&k;Xkor9OhWk$iA4+d}8u;+d+u&FK4P*Q7#MCv#4dDMKu2qqwOj*PUsOv!o1sB;_da!VcDJsRM% zbHw;<@ej35gl&?pe3!j2QD}sO6jbc`iA44@V6{9Ns({CsnCNZ^^>r@H*wIKEVjUOVG40+Y{9TL}k*)y>^XioxsV zuw@0r^&~Ju(+WTI?F4=#RRWJ`w6*-^S?nb~A-4W>V)$-q+BNWjXbgo6H8pgO$az?i z^vt}!f6vPWqP_&=Rb=`mtmfy2%PfT`u!cwQDIx{@cpuT@AO>C5CMHyjnfVH$qA+H2`oEX!SOT~l~Lt8L(#A}{K;&2c8BR`iod4}2b`dc@# z3YGIlMK3H$XPJx!6ze)4d5$g!ZYA>n6 z0p+Cy^XW}F7EEhAfR48rx-n85S`*i!6T`nZ5@tR)Q^onudRU`7579Us04#bPbCQ;( zmsuC-i=mlCoK@*dxm^i!ZaB;oMn|nKE%D=LCUhci8rik990P(dQ)t2ra9yN9C7H6i-w-&rC zOjpk`EGR%>s(=1S)Q^>>rl#@7>^uRp2tL#Pw=I9!_Gbuu7VHu5IZ(OQCMQehel&BO zOb^7qJM{9g!nHvq&Yv~>OPyzZ{xnjghndwUcGKu~bgwa)ZFyb}ZAR?aL9-W}Z~nS( z&9qfFG+2fGY}im!$_P4m=lk0p{-qUeqFy`V;{2W(`JO1;ap^a~W)bu{PRkwQj7)l)Z z0P;0@gCRDLwZwCOEeTfL5-AN(OD%$i&ZD1sCPTvha$I5i@PB-@Ee1edQ}`eBs2J0$ zAcGLN-|K7t?L{F0`?)QPF2IvyKMRlzwm09}evU z@AM`$db@PipKA4*QCx?7%n?p#r6cf8{|Hc&=O8}N&ZE>ekvxm_>U4ZMi&6<^BaWs!H z#K_szHf{x-XaWuFn^}a$CNI+f3*X62EjfYC;c&D@2O7ru2i0$_jQ!Kj+7^ z$M5EBoDa0nHyRH%SA5mO@{7|}0ZWpH)DmO`~p*N?;>zm;j2Qrbc$G z70seY08#%D7x+|PA61I7>c~_Lo%HppWbVZ1^glK*A~NChsQlHNIYmZFN|}eP93mYw zya|YhpF=8C^*^}fbYH~3FDfcFQL!{lReJB$6L^Q7fhARcntf?efE1U;L{$tD4N(pB z)6>xz<-NO$fV&B!KRwsPF>s9CY%dOv(I+2tN}qE9cPH!Wf6=UhvV`uAPG&UbKOQ@D z!hs*ED=9y*n53mm;SI4u^_Lf3l82L`1Xcm2Lj(JQLFlE*aQm~R3OzKK-$CS2<6LdC zNLzKfY7Ydvs*Cx(;(kWyTFMumorT#wIsFe0QJl{JTIV+VuN~8De1~Hd&`UuKF2(ec zf6B0ARHXFE%}{~-9QmbDFD!qMpHCg${Ys;ZBt^O1W(p5^J-=a^Cq1nra%!p<@$wl7 z7a2_rN`?!SKcs%zplu%O=IGw|IZEGhM4b*k9*g4F1bL8_qK(*+66@+ZTtMJq-Y!1k z2l7+c!BDr&ef+!7k$ZpG1k>Bl-S6*t2WVbZG2~mN`=p14kZy$5(0dKZ8F=TFqbssE z1J;^@*u9t1G14m~UykR+^u)|0{Ob7y0|Lr()DNZ5KQpxB%!eOyqaCQ|S)6}#MORc7 zwcw#BY(Ij0^m2yfd{f{CaqGR|eP2tveR_ z9}|m@Bdn<)B!C>XI7X-)E%#@ zmAJ^@orlCPFSGae^5t-4gFE$27QgVRDqpgGiOL2>?qjEkge3xe!} zzvhH*-91)6rWTP9Bb|tmFQEJcT66YS?}2`oE>(7RcIoQ!9Eh>RDg`6E97Fs=03nFT zo}4x{bol0YxBH|#cS=GH6UF4ZHW~#4KS$7v0c3T3Kx$R+h{cX@1So-=QmGc7F;n(X zJvak@NCu`uh$NT;5`cc!RlbOlejcO|uaTBIE90xlv-K5^dlPutC4cdoK<25MTIOO! z!FbTq!a}L-FyoPShg2cK`!u2NaMkXwK%M<}>&DClowa%m^?xj4+m;6HoP?kshZo0g zTQlqvOUbDgINJ;N+^;~?{iFU`NL`k1W-GSprOrvOdqN&*R8Ur93nmZzc{-Pz7d!2z zYLcbnBa+c>v6I>AyoJ2Tg(Q=7FC{TKp@NMS{vVmV6Ip~qA}K55;EJ|C_;KYQZrlGD zSKx_mlfii%BqLtjN>Qrw=8tvhd_u+M@gfSEQIr{tjeMsAqO!8z?uX6wjBLH3%L8DJ zYTfTsJkJ4NUSr@gV-heY9)O$(Bby&JLb`b0e9cd-Y6-nhy1R}(SQt0kh(Q_s<5^p4 zHQ^#_&qch7F7Wge$iG3==$)^Ma4o_+G$uADlz;s9RUS#CD#6D7Enzw7HNGha?xBH> zR9b3>4E-w|(3uWhBfrC})P4rzu)NokOllJ1fikd*F* z0qJf@X{4o7e$pi%Lk}?V%>P~M{RsEH&e{9g`&_aAGMwWKVkr9H_oOeNsv5h)L8)Z? zju5u@0Vhlbh{_h#dukH6niS&%E&bPaUCU#|Q~-`aFrNs^3G+RKKFdiyL}y*kL_%JE z9bK5+1ypDMAh1|Mc!WGR5to|#!=;}c4!+d+PZc-f&X(-`2rWW9CL<|Yv)-`mc<*Bq z%kPo#jx}9XZb7AX1f1L?FusA%K3{(aB^zy%X1H#b=37GSgJbi5C^$5fMY1cQH4R+=Rp906w zB6(-oo5~-;(4W5v_DctBVk={2di!GOIS1)pvAHy+ruGXAJsCw&4k*bhV$#QvTQWk=ymfpbsh!y71*C+fGLDxLmJ# zaes&TuV?Sx_Ky-y3JTO#-_o4EBuY4FSKxtHHbMG%=7HV`AqchqCK&VEiXv`Lz!V`n zUQ-Elc34)bKscPyX_U&ItQ<3sy$EO2Yr?w+rh^xje`}n5ZQ*fqNX&a1Q%S_FleNtS z0a11hP;C^XTo$ET{TFM^Lx>lRVK0CQw$>X1n-;0b{m`@YS5E4CV(mQ$&sLOpt+M#u z7+bAh$KFPAw~7VHwM#5pR~;o{7+zXK{keql3xT=R4=K&W)zvjA z%wzcD1=`hurWKGC5RO(U(O0bKF={_W12ZTPCFGq3hXSvjbK;R>u8{B5r8U_Zrnexy zR^*c)XE#nra%71d_SLs zPUFzmE(dwt&-~c5ourN%(l)l!=FBVg`$^4g4Fmq~bhn+-lc}286ao~f0Pg^9h-_<~G}M=UrTl)-)aJ~ZBYaKXzgPv#AveG%~S4m?dEeFKy9 zc0`lP6MjgRo?UR^bu@W-IRQ=NC))tvI@b+olbH%Jtx7OC-Z6;WO}#!raNPZ{CVf6L zh`3Kd?A~?yO&JTm($Vq@yGO3x34|fr0<10NJdFxqXBzpWWlUMkrq3SQ)~EGImtV8! zCtqt3HHABmOt`~xq7kI#;>dO-qW>(p#&=k0{eBR$V$Q)PfaSzt?z*Lzttp#G&p;z~ z4k6JjRg?iAD~%U@etgL*uzWu)MUSeq*bPns&+NqO{|k7K zr7vf#JBy)05R> zA1{2qx~rGBx3*DPE@%_$alMm7=A*y|tAn{Ow5^=Wv%X!o-JcrncG{@BxtAInE??nHxT^&P~9T^PxtHATT9s^Ifd8+J;W2KlhUKR`&&XBSx4%v?<06(A# zG+}9b{Ex1PBoroPU}?!-`ab#>spEkjSNTek8i<2iIpT(fv9-bAmsE>se|X6W#*yd# z5fsdaxdj#usxD>)v-yFJA9(qvvAApJYb3`mxS&rq!pVEXj zH@7&^BhfdfR5Yrx=6Hv7RuPhTYze>%Zx!}LFnDon(HyIrXhXhJ{R`Mc(oqiNyI)z;dZX&|KKJ z;mJ)m{hT+bq$FTv)jr1a9W-@>9Y(?{!a7Bn!=q8cdb2dX;S}>Spd%X!LAV^;3Am;= z{r4xjMy0a6HFx9NZIz~~Irr^xVPe5=^#g{cPib`SmuWzl8(JB@5hLikMIkFcH*0ch zrsDH4GzSl%aS8z9Y3gWBqk6&9JwTpQxaB^jxf}Bu9EH3T{npji&KQ4X|K1T4fEq(=75jkB*&W9(S*Ll2^b#_ydq-YH}{h+Am&v z(ZgwP;D6iC?W(+e`=JC>E~@0$HK!&6ulfgEkmI`SyT?5}D{6T#Xm zKGS1ILRM5Fwsg-ynYgdI3u{C(TPUm7vtzuK&qa#Es1`FTk?;P|CUSxvbu-n6_rj=` z>uX2n4P-l`_7g&Kf|bQcgVEChzpi;H>Ws)(Kdf&gbvj>sB&0y)sBnxNd6qSlD$9Ld zrFOK6U#%`}9LghmJ5?x5tP#n{FXHyAJQwG`_b9^{`?3(&-Nb*s@ZqzBumCJqn zgB0{b+$w-72%U~Fk(4KRXtx~)VL|S5ooxJODvYqg`^d1@-qx+ukKV2FE7u25M#Q!p z+jY`|TQ>NQEGMyC4DMc5f4NBf+eidspo$11qTCQC513QfqY(Bm9~VNJpd%V1h}%P? z<)+5))^~W^3hhaaaVPSs(+*-)h~N~*gpStHTP-U3w_xp&5QE0>RmQIeu=O!QpKd8P zR-}0XU``lT%ckQ>xNKQ|6i#BC6enABW#=adwRM+~nErPJjU# zp(s&_eGR6Chpv}(z#t3Z+w9;TNH9SNyv&JwBc_4czBvELX$IvD8#8T`0J-<} z=Sl-=w~J18^cq|ER6$$qm^+dbnLO8OOUv=hffpC&)pWd2I**$x4zf1rFsv|A@!CVc zJ>3PgUO_XI@EbtFjQ<3TCT19C(0%P8)30KA8=+QC3h>wz1m|FBQQ)p-7QB8Eh5&!u z6C0}Afpo|B_E>6GW-LV13cu~ZM^QlD$Gc*ke+9vhw!NVK!1(@BkOoTd%gEUF6L%qn zi0CViLv*+;WKEu4c+dAG$s)CxFjRma$;n2FwB6wu%mt6_=nNf7TO;)zmruF@cY@ zH<9oWWA_y4V1Yza=54e6G`D2()W#|(CS;4|RZmuIQi$Y~#=jQ`g{|#2`8~CzNJzz$ z)=Y#EW|BYYS?Us@dS|Es;*%1$;E$#0KR)fEZnX+Mi4!J(BNNcv+@YE=fJMykb?rcm zLl=!>!U`yKwGH%Bk*Vv;&ZOVAOHKhKt+^J@1M_0L2hs5A(N=GA61sEO-|0#O1C4{) zs$N8F|2_9f(SOAhJh|1erqw%iUxt5iFD>_29daBWSuyjg0|v1z^F|n^OjD4BbwT#~ zosq|aqJE!0lesXZ2C`L_y1YCR(Qm43sUe&h^n(e$UcuNS;X4*{y?^ENZJ^Jl=VMy$ zIpxhe^C7oiS(R2FUw)&_bEX%mPm?e7aVJ}~p*^*_1d+3^Fyv>Xg#1wY?&dlQ)8!{o zqy8>Kf5qE+#ft`_WvF$__4&8BBtAum{Esi?yUvJ}D8#f%aEI#;@7S>MmWdkmeNb}N zYhKJ6phQ5hK7O&vn_?QM2(?Dw1me(pvY>NfGUp-{xBgp?6RQyq%5GN0vqvuii062# z63YU;{)SbK`7l9ZL}w$L@oiwQD-|(03|582);<1!LZl>-n-(Su9+q#sPCf{VihcP} zsuhJel95AZM1%R^tjnf2;JaFRRdX&%SL*X)dM~!hw1Eof9MJ~TqSJuSDN2MS@VOan zCexxk!Z!{A3s4d0GYc8D z_z>B{%B$`n?BciJ&-Dpn^M6`DtfyxoiB2BGJUlXf;It!eiJ@rUs?Uhky`FJmJ3QgL zKd52)slcOPA48P6d^Zgs>GQ$w0otLc>&mi5fGk>`UL~eu!mwIiT?6tpPU{+KP@|*q zDu17e7@q(<k8Hg zL`xzKbyNnTh8Cd}+4sQHTfuO{%k0qi@mg)5mj)kp+YDEg^>dd~VfI0ad@Ryi1O3vM zl$Au8@xC>j*Bu+lvOV#*T?wz!EKQu8lziNJxSt}$&Yso)Z`XSNs9=o#8Y)%)70|WN(lA1Aj5Dh1+ui-Gi{(({d-Q=X!SmDnZ17I1q0RL= zsU5cXr<|@kctPJlG^@f z$e9r}SK3Xl=XF{jK4leAiH7@uBIm&?%#NCc`J}zNAQ?(}xJx zE@8VdA(HW?$E^vE>ms^`E9f@Rl<88UhN$kl;Zz58wp5Ze!Qqx$W#Zw;fQzqXql`=0 z`FVc&+@H-@CcnsAK~w?|&BB^g)_dVluUzn(hFz8dIqe)%uQ zegvlpjqLCqgiCbsks>)3MqPiKvj9Htvv(uLEqZ8$XGhd`foORMV_x3dTenx zer_4J))8P9zYtaf+;v8J>Y16-sR^JzTUirijn>tJMrLf+9)d&i+++OcAw3OgkE7AZ}CGcYR|d z)e0Llg<+0GlV7u(LAY}qn^Le24UqauoWrOPiQ@*5f*6gL!=Jd&G^Bnm*&*~MIW^L< z8IYTzxw`xA5$y6WEd{1gCUf(`!E>Z`^bB<7=j=Rs1RXDbJ?A%qYcYhvJgIY`oo3E{ zElSVD4~zY8LEvzgm!J=@8mBZL%WZa#G3Q=_nHHg`WrR;pP4;ssG#+ zZ3=`YQXvJ?j|2dapPn+L;tl9w8L@Nqn!osl{`XaeMQVpd997BKjL1AfV|`OLtFSr5 z^@a531qJG%d5e?Sy@8P1hr<+wzf~T5S>na>EMTa1@662VTYx>DY4)QcsEp~LVj*iP z9&eZImS9v@y#9%rDDYN%(H=TSkfk_7?mH`epD`dS#J=6-^H$O1U3Nt!2T0*GVX&&) z`sNmd6;VK*QlH-7#{77MoMl!jBj$opqBl5)JUf=qnClkes+Zh<0HKe;*atzS2=ZJm zFK-e~V*AX8S#_Q~+bo9^im;I^OHC{MucS!LmfOQ^zD)QmAfi9ad z%rR#e-$m;(kCQ8(!yu=E%G?DcqI{Ao%PT(>=|Ej#1jMN+FpxtMn zq&kus#+79LBFc36J?Wtz{|4Y1%n(6n^51Q|&-V#g)H_1c_T;NQuHU532`Lk~f6+JW za(!}o{=szmi8E(^P76Wn@J`V~77vKM{{7b1sUD}`thjEZlPb?2*_v^q*m(x^RY#*? zrHJeU?Z4Jl-unlX!OJeJLZ6#VBEs}>Mo&Ky>Ou?p!waCYw4f(IHiT;)oI?AkKZP;? zq6&R#8ZrJn)`4^>K*SB#{l_;rzbucKk7yXJ&PKZkZghhcA$M;;jJ6xje|Zj|Hz}Ew zZg&vow2u2vO}>beu*ci(-@C+-?5hZc*%?*LhjS}sB+CULQYb`IJaf|MBT2>?^5zto zy7^PEHHQ2Fc*j6FMcBk|4`PK7&gA~x-RnU-!+~Jrv^~giw=GFKb3)cCnD%MHgdX#l z8#IOAuIqI{T+B2u`5*y1w&#BegiI1oGpu=Jpno^GNB1OO z5;bDR&D^76Qm7o?sHWXE5o)s91rGCZ5qtYA>wmmxUKM&)9_U`GE?Tc%6s4`R7Jp#o zptt0+>I=nV7#Xsb^uxncQKDho&~?;pyw+BAz&{|sNU^-%`rLhz(0i4&#N_mXv*V6rw!)b2;7@qPx2EmmO?TC$#*eks?e~YX* zZ$dvf+fIihc^TiUgqg%H?_^}I7_L;K9mnm@FXQYb?15iHKLp@&lEZ4Y3(XpOtCn_N zhzehWSnMX^VOq@31AX7$Hik{JZ?rfnx{q?NXZdT>fRUcEVr@;+{89?Z4vPpO6VU23 z-Lg)|ToS{VOE)PGEqNDVCj47txet$3nqp$VQDg70j|xK4I0b)nYy`*@wa9v{%znEz z$c|Rhv%!$UTCuOZdsQntZ*lO|58CX!QzWFtwF$ca=97zPH#4sO0zsJ1?}pQ2V~ zX@n2e-3qY_wf{@lz8t(Y61g5~`@R=s=gD&Rq;K^f7cw%X*O9j~sE`wOMc`Obj8AEworplFtZPLU&d9BYT49KMXMp&?2# z|2Tb+szjW|BQT(s44U+s$ghjg<;)TYJ(ZGt0)qu&8Nzb69&e-%?FE3k{mB0S69ZtM z?;(gAtNHVs{2o05y0I#4l86_NkEk4F zaQ%@`x4M1IR=#CcMp$PCi^W|)e zPijVFld42D$(h?5bZ|5INPsdkLLR;D`>Jj9yyWAlm3oDlh{OBrii8cmQJ`E1x(^pD z6nb?^9OyJy73kysRnKme@S}HVmSf5Aru3uF;Wf+E8XKz5mm-nr*JiG{EOgBq65IIdQ>8KkFPH#olXJMNE(bi{y?{k@9TFU5!iM~0WU)6OH;=?MoJp&rUn^B zVt98jzsgtu%4L}#UmCr6lVfdoghJYmBG;X2n=LypajfN?is+SP-_eAHz)YW&Z*>Zg z&4#ZDMpvFAx?V-;Y?8FFK?kT2oC@e(^x8siq$;(`#{;La&^cdV=XN`QHtsvDUy}UN zsPrZ*y}kpU!LWtWE0EM*JPXbe4);L&u)($o?|c#?XBhV z1U?~>iO(DwApeici!TIis_?dV<{l`o!C|J&CMYLBv?sbaj2Udb=(*#vQ=P5H9A3m3 zWYWv^83)eAKrrg0TBtyuGdwiEynFz1n*jKoOo-F-#xg!o%!&fWo0oe%`gQ&U>ow5F z*Z5SAJ0mkK5juDm0+wed1?dl#KlJ_mwf|Dks9xXmJtnw;R(s%is_z3dl-?rt)2rUv z{-7b!Mn?fMLNVOEsD$J7b!2k`*-ZwtD{-XesPO)Q#pz)8zl>{0^1D20aAtvkEXh^b zM}|Wvc;F4?YvnwEn~mM6;+R8lo;`LBsFzV52U zS2K=NW^+;+at|8<6E0Q(ts%Sk#?w^-$aeGRXaSqIs9$+;-Z}N-0r4(b>TmaT6%cMp zBnNf6?oSX{m9%wsP9=@Sq&uN+H77^5$?`Y*Qm$F~`8K$2$3>$x{^rtR&Zne((OSr? zSg0=y#fz!U`y3suZ${tOV9p<+m0<2aZD~;S;He7`ye#;5E`-TR6vAN=bzF?W=9(}f zZm;sEdK}{!nM@FS2{Sq%1_hCAL?&1M%Y#D3)21F5%bX8K9gQcS2UeN+43#s@oFRm> z!XseC)=-VSLNCP(^T6qH%?FX2Si_e@LboYns0PhYK><&^BG$l(=z4G3O+awVb(ymV zT=FB{0p_#A7&g}x` zLJ>aR)0IcUk0&*5*ID4(iQ-}!3m?t;q5!^2J0p`T`zrU6-l zN_Fh|Y^LPb()Ud0c72R`Vy0_)doiU5?T1^u>5l7{|wD=seFgc|BxsB6@@-|ngn@!J@G=y&5EiA;kx0KS{36%(U zutBn{EA|1g&aRU*_mOjfcS`W-Z?W&K4khSDW;;2eN!+|<0WxXDLQVw=O$qRRi(E`Y z`oXfsW7afoz=X&NYSglR#b6qA`)*q4Rqi(o;o8r&*+ZLp9A<2{o0$WO1iQdfCAG~BmL3b{eT*l^J(IHPuIn(0(2*QoW zQS$4Blu!zu;^ZlU7acZaklue!9b2Ez8a#Wrg{X9s+LBSgM+m&eu$~_*g{=Wb`ld-@{JmQ>q)0VJ1jdfn1NwW^83SEa|ApFZ)}K@` zpi>;WwLr&*k4HzR%rA%RcAlYaart;@o&EKyVUIiYThKb@n#1Fd`mJ)b!S#6fu*Z~N z94#>^)eF~(bWev{oOaTzCj{BF8`s=;QZ+Yk-#aY=84;zedKk(|!ck4Gyue}@DL_fQ zp|J02U5|^0KO2A`s>AZ?SLhvEep8|n4x&71ivA20$-S;En-VjG@mbMivnN6vl3+cf zk#n^W8m!<-p^)Hs*bpXrrBP{A29=KA3g2n0p;{K7MU;ukcx7R00 z{WJ~-e4)|C7q&ZI$>%Xb^u!|(J5*Hu$`W>cL?if9%>aU!kg?1Ob#h635Z<--y_bEf zn^NAE_c*l_ex_jCqsPyYZQ0yf*fWH$+B){{r;_tb+qwgAF_vtA@?bKfVRnrhB{BdVJ8vg>s}Ec!E2#pb9zD*M20_iKK6mqJn>Jh#f$Cn4WNTcm+&n; z?N3r);j_VM!j1{wM()%Y^+MK!W}*>imli!o6;tLIXP*gw($=p+voBnG|FYowMt_Dq zoH7`U1}~eN(IP)R-}Zf6MEf7C%fTl$%O4V`H-!-9VEgd~_;*5a}Ogen_ybl&HPWp?(}G(=9Nr zCq|nqj|Vy{sGuWUBT_zpuIW3;JG}locdIbqR2GN+mF&mZa1~z?EKgf<`>=qwIC#^R za8>@2>^lhW=kRh)*)C53M6-EZs7>h|#=lQx)aQJv$2EmrDw|;_O=WC0cMbzx|+5*rtek9+M z6N(ElK+!)oZfOF=_4{pt9kFR=GeZ{2mPy ztO^+-xy1%eFvm$6ZRP^Wqh}H8CZ()=E_^8QNE+F7lQsQ>C%HT zCI|HpZO?!Cw&%uZ8cMd0yFMVM2>OU(+DG~0V{N#7vXWS9qsyO~mg8F`LtLR8`#ZFe zi(mB&96pZ`Bd@(Sn=rG|Wo?qFd^Pl+BJ@_o`xgg5Az18{(~aQ{?!>V9$UTTC zsyM$mN=_99dJ~A+LUW|^9T@AsFYp=lT3J@)9ME2kb@72%cLMDT%zYQ652tt<)7Sd% z?Yj4=fH_OQB$OI|9BH)LjuSnus|k#Zt{q;VSs_1Yhc4BiT;ng5_LBv|Cw82MVV;Cq zhA-Y?$7zWaxOz{!iuMx(79tiuI}L|;mnG)@H8z(ahAM=Qt<#5oZB=v}AS;?`LJ*J} zf0U>q&yK^Xp(`0iUry4EM+dStA*=S<(qopFs_|J*k_SnUt@FHVw@b*BLliQ+XH^NE8ypFl+%@zbCiQFW48Ur& zChe3Cw|>>on4j>EQe?_u;oZ(hbdi%gPry&WfTGB>{J{A)ks<9d`o`ZTo(2tE#2Z6^ z_E=aJlfLao=V5|a^Dju>%oLd}^DtO1^TySIs9pS)4kOZaetR4&>^EPjCyB4*l&gCv zHS+c3a;NR*n0zG;A~8%dHf%w=b$<|3n>uR^NHHO6QW|`{8at4SsM#ivwXd3+vA}M8 z8S|)~GWa46p5^DgK1a#9jPSnI1^NJ&d7@TB(#&+QPT;PY^U_jDgs^4HZL7wV23@MV7vu=2m*b zcpx#AC_DFMoxl_w~Tjbo~BPBIsq6%SSwhxpZ~S zU((zwO(I#o!o2> z83$t&?e*2Qe_bY*09F#}NmIwbl`I;x4k#FIb`=Zf*cw0yLl1`ny(pXHlBuU*`v+=j_E6T2IfAyq8j637Y7_Hu333pY*Xp8m|%!ggvg5 z^mvRw7yth0Ia&h7=r)>>1WbVTZWGG@&B(2r2iz5ATO}4q&?xA`c=%-HkGiOfMl}Zu zGxRU+5=YoIEl!PzZ#YIEHrQ$;f+K1#kl#D}~lpyL64;f6;erCKn~>mBW=TVN+SqMua|*e_sMVIc_6@Qe+?# z5_0J}*!|HuNX^?6F>BM8A+q~otFBHku8uQ^0*~8?f&d5TfKMBKzx`i)b~&sJ_^f0u z)=`}bCg(-k^i54G{hgL>F|C6xu|S{16NrERPFZIgFAA2}v|1+;gdzZPY#g1l6GC%t z?=AM|ND*`wA0@XqiQ6UG@t$;(^Qo2)dg_cG;PeL@(anq^{d}Cg^Gg)%A{1^bJ<)}N zmRsz<#j})XKegF(^m~3i9eIqw_o)ye<1BQSz0}Gr3zw$fK3U^|)p`?hNU8So1b&x0M|KABLLR zKzUndTw>RhH^$yNE1I9-Sc|hps8U8B6l!}|1?;ydzA98YJjDj^rpP^2!~S&+j6-*D zCGS-P(p%r>Z3Q6V-dkSdQ=R>f489UPHkf!<(KJN(s8x4_t@v=&&4>zsXsd~6gRae! zZ9%t6q#pT+49ZAvd)}eD$jg&0DzHzI&e7wr{Ad^2u^6Z){@vjA7Kd%}rtYY1FqGWzg4%i=L)vBRoNe&kD99(-<$NaVni1h^ zL%1c!eWF-iRo9-047@FD_EW%Hg&KoM>ulGl|JNsaTS; z`~7zf#FFE<`}3a=CVGtHZfM06GVv5J0>ZOVvXzw+CiwPG!b_^r-`WdtLpt?lqAo%Q ztA>W!`Aef=lwd5QlzBVqHIphh1m`8V2*y_f;=~?v`Z+_;y5%4*j?miOqtL_8QxF-J zCk`(|R=#l~KQeN;Jec=EQ7Uvm*g&r5oY#+FRqQl7H|yh!ml_V&rH73Q;f*!5%Cu+m zj~HaHCKzqU+sU*)=MI5i^y^6t(;1Ro|1|$tviB2tnr2b-_Vw`hTv!7Jf}n&U=xs)n zqiU(re00}S=R88sMf5EeL!{{|2McEigObK4v!Esn2EW<#MJ8HCJzB2Kr#5+{=St_m zOsgG}hia?=YsvT^;K1^M01}Z6Z5p!Vzc+|sR+hRo|84Q2?LuHEou}nD8Z=PQ6xN|k zS*w~5oc#;Hi7t*ux*J&>RTlB?+zB672}tnXDUkT52V<8oWQ4%^4**;^$Y+Z*<=4f35`jufVub z;&mH>p<@buf>u@;-i}Wksa-XI;Azj9a0WM)DjE|ew(AcHql>!F+6J;yioPq{Z{wiLFaFio z%9wz?(*%VUrfekLI$E8p1^7)LiU+)X$HiZAkopbSQFskwPlz z;M|IY+ky*`-Li|{5+ZiQ`Z_le59&k2tjTY_O74aDR6|F0*&oYEeZG4BdoA_(+}y~J zDL6@0prlDCP90?p((4-i-e{UIG}-pS>BTK$GR2ErRgw;B^kGB&G}l;1H&cxBH=(bT z6rInkqtr<0OEOerqvz5)ju_+|8eht}dsa}p-*!AQfp1V5Al)`H5*<2Uch0CN<$mRy z*jK!;vTB2zu62sC2IG>SiQtsJGDDL)E#&*3tcB28#OUeoV9qBjv%toK_CCnz<^JV} zF8`5jOU%xY#>DH4FUC^o>6kLmi|)R7%Y-F+lv2GMP*?tt57$Uz_1 z!ig;kO{|W)HPR5Hk)N&;#3MBh2ENVyD5IxvXt@_BMX*U~e0@KijngwHGMuax6a^+z z{>|g!Y~KtR!7)6#Ym`-`Ntgh!K(SgQ-pQaRdX97;?}ee=zRx<_?BrIDsfvfb)4hCAWIff__GuWT537SDWURnr_|Cy=h!iO-v!o z*e6Z?Z=KYgf6p#%H^1O0hTYie@=&^*obO?yv$#U$D&g359kQ4~%_<{~MSEA^B~E51 zJ#kj#y`%={N6feO{uhHO;-Rvkn~1SC_Ljg&8IN zkAr=E(kS$Z@c4O{mP|9WGf~AQ@c+F4isT!iEo<{^l5pGK7UmLMR$ZS8Tz@ALTf`wz zaHYBLXm7lnP(KZ`RpTnEM0eHT{f~PP-=r0_)k0+@$8x8E!G(^XXa}y6zF1MT-Ol_n zH^Gx(ESgp?S#;)}EQ!XeY0lTgL1~UZzb=fo2OjsO_N@4gExtGVDc}3LpNAk=X3$a6 zq=8Z!20g)%%9sf)^NEsffds`S)B8^ja$x+#VJHh~?3l+Vh1y8rbH2BbHP@z+oBlM6 zXZk}n*F1M<=2eUbgf-@;btOJneK|&R@|U*em&WA2G8=c)Tn`qe;l{UFSr(>IbpW3l z@ChJ8p{gRnIl#pM$_+wzAx2Sy7tu6`1y)1FjIkF_TF7|l9HqU$RF%2ndTPZ2-B<)Q zR<4IjPEyC&ItFk(k3ZFy!{1SYdR%9<=&z&4Xqog;6cxW&*~cpSj-5yaX{o<6lv33k=SCG)rN_|bE>Ty4DUx^VNkeTWbNQyK)o2pf3 z=m$!^X}nel))*3g!v@?0PEl0RpPpT)3@$!t4E~&mRf=(}6F??xfWlPVo!piT^%F|A zTb{tg_c=j#Nq4Blb*w14<_zJ}Qpdlug3)TSgY_X}ttq66^gkFUBfAQSC*VmU*${8( zZUDtWc6t&C_O;up&!@dbG6@|*CG?_B)AcSui^DAdYu=)b;{+IPYkGchyyW*kK8X}I z?HH$5gGDJ5OIT8e%f_z4BWN{hgUJJ^bUipLUFJwA*0JXA4iXU7QTN`V2=dNm<|3K- zfzwtOX={O$SKeQ%=X+MuDZyZUKZU9FW!dMK_>-qAn=l0Qq$YUqIGf~sji0|#l|M{U zGNSWbw`@z~vfog30y=1c%?{<{Ehcv5-UC#%>}zltgzpn*yixR9Llk97-EHY45=&HK zXXFpo?CYlGcY6idCZ91cmse3d#hS0YE0kXtq;=UPu)C-u-Ji z4o1$7sO+3&L{0nhj&Y;jLUq7zfKJ25E`>6E*hI|*%^&!F;|&?pNA{2#yE^UYgtc40 zeM=?Pm5J{Ct0g&B*NkWZb-uLT)1Y~k>Y*yW>yaaFYFyfY>(zFwhjoOW)BJW0XmOzN zyAenIk>GDkv*g9?aZrCakCoxyHF3gGg>NBn6#v02q4Z?_r!l%jjJfIN%=zeTR2lHpWT>0?$~jda^*m7d9)kP7W&yO-ye&I=%huyW)v z4EXn%(^%`U_V;G-62*+IbG&!3mLx4aBL>-){seA>&3@dhs48v-_nq*?);TXGZ#~Wq zOi0F3OzF-wrp(L#HZE>W!ACOBTYN`bCu<+5ToOQ8au9tagBO_;ZJwE7*zfpJl-@H- z%FCn#r>yY_ta53*a7M2Z-p~vcVX2gsvDa#6 ziEj67K(4@V?A8mC6zG=Nt_zL3KU0Y81-kz64+xAQT-o^{MWkh~O3!^>JWU~ouUGtG zr_o%$4JTwQ%diFXuiIcZV`A1byw@+6^y~Llh*qJbBGPv^I_g?*W(SDFkQ% zJw=@wumLB2v>+&cGOn!D>yV!cRm4at>LK9UrV$Pd6xUL!YcvXa1x{J<9-LD~G9bBh z3XdZ*dQ(nnYqBM_YQCs8LoSqSpE|doZM&a7Rp&6HH<(sI}r>rTmxra@9*cL zp)1hsRid#0|F@#~AQQ`PH-cOW47VXm`w751K7v@q4$Liq?*lL*x>)K5872U7@dix# zY9f0E4tt$I)m*YOQ2*q%@^*XQ?GGdyHscS&=UsAia_@aL5YKklv4f}-9U#~|8w2Tnz8u2ke^Nt@<>1Uw&S@~HA_@?j0QT5`VZtQ zKG0IGTA&g<(fpwpo%FyqT<1V-;BPvyc`sF%^mFU_J?Zn@I<3gwdTin+8UsN&jcrSUwr1XULWV&$I|D$wfwxL_RWE%$PBYcWN+kMD>P zKm4;HIEGZQO#2->JqEKZFrD7eM+#;1JjnIxoo(}8eAmk8yDW5#DDH&J3bk?j_xQ2^|OtG{2HmQ(^Yn#l%ds`?aPURe` zI?aEw*qvtj``&OiQ9_|IHE()x4T*W(8HFTg4dtmsX4X`yvg)(ziv}ESSApu`Re;5* zFKlKNyGMtB#k6_BP3HMjG;4qxF>Sxqf%GoqR0kG8a2#Fa|M_!JT{QV1${u3+Z zO4e^xYIRH?U9kx-D2!7~YA8{nx1QziG@}EKlD^-DfZNWs26Cwa$wt``v_xgaLTKjP zjudMSFzNSQ6*vF@CCMlhTI1hnR{H++=tFe=dEG6qmi5lR!3|kp<@mW755C~>7~B4a zna5~)Br@nPh;4K`bpm$O1#9{a=ZhdVwluXlh^8n*w3s$?JNBRG%9}sCFlw=ZT($kr zsndXAXHL|~AHJcpGX9ok=P163YyZB>mwk4Sf$h=-Ul^lhCyk5z^N0YEp!jA66_`s$ z7xM<`n=^FS>OHe$ngM+?=&m7>*R9&X;mPsnHpYZA4sG$8pqk{HXB3e%2P}A`vf6ed-C$vZ&>XUN>Z*XR(LS zMyg5;{wK>G-Z2bmiw4rH&2*dQI(^ys`oH1;KpSawZ^C~;ZK(^(DK!8EeCzw zanwL=2)Qa(Ifo~R?EqZB#3(KV*uNH2Ns1_#JsV z0ia{V3J4YyU72CVq+fCcEk=O(;5__4=~=~4kM;>u^Q+DU8n1*j&A#4?>%&g1QE-AM zHpxaTaF4{*=)13@0eIrD9I>P=B>&&ih|Tba*;iK};fev)&I}Nis+pjuA)G{enxqWb ztqyA7NVOp!*Y;6jHP*T?rc()JDl+PYm!*u$Z%M=qdM!zvrq!6KBg9FPj*;X@R7drL zx_m(xP!nm1xpiM4cRxtRR{l+ubnaW=k@dU}NV)<{2Wr^sSMU zM{*e$4<{U1$V z85UIoZ7mJb(hVZr4H6?FAsy1)-6)8_P}0&3Iw0NM-Q6uHEiDZLOnm3P_q+cGc$l-# zjQllrU(I`FL5QjXZLYGrL%E|t{?@Ff?);mF z?=}i|dJ4=Gm1K;}$BD%H`V?>1#QVr?l??e`-uTcu143-?!M6OefOI-2#svi`t_#7Y zKu$KxPy2IuvluLMhDP^xU%zb5fSpn*Pmf>;oOZ5QyX4{Ib+3N?XXG(QFAF00UXl++%vX_Sc7d@>Hry_tFA6W32Zlb+Y#6L zb?~lmVoQlzXuF3HMDwV)pcTL5ob_7_Q00wd455MA(bFqh=8|0oX3`OJ7WFzJqi=GX z>?_-TzL1rz*?R#jmK=C+(D}!!*1zSAv{6m5+HxV+&~5@71tTisV0GUFsXTL;M$9xqEp4WN%&7mfBFST&LYZAo`fBjiR?f)JAl>2@CIa^_HEg)SS{{?{ z3w?ZryoP9pawT7uFe3@VTM|iiKKb>D7dCh|9W5T)bsJ{Do^7sogksNFMnVm=QodmdrC}=N6B1XdZ4Iuj;M`~v8 zMlS9&&)<|FboF#CwWNhygn41uTxu+r9T(bz$TQm9WL%Bvqy@7&Ews^;1#ho03WgNq z(~0;V!P~=cKPuvpsyw*yCSz(&!}3Do2n-E3SI(Gfg>aRnAP0|xOow|v9_BUtD$$;2+sEW zhqO23gYjS=^!1LOo4*!L3nI$Qa6e;!^9spFQ2p!7gzeYEi(-F`FRfdaw9fWtcUs4clxA?r8v-ly3K0H;>|O-qEJ8B*^sQQ^0FBd}J$V zTfrEp)U)XrP`Qb`kwuUx2N}B0{?J0tQC6*q7hJvVKvtD(cWv1R4j4Ir=O$h{T|Xr=Y>1ozYT@rCrl8YQ>Pz4U-(C~YSebIWL$zVcbtxoZR5NLna-D`#yrm(d5#7Mom?Bo^aMgf!e+R9nwbYM zpbp0uM;pRcb(qr!7*~!|u%`LS$apU&RvyG!sKzrH_`(nb?;tUe0COj%SB11a@k{4$ z1)yTAM*-2m2q$QPggBC@G)XKb6_w2?r>V6(yC}I1VKOnJh`-}En7T_C2>OylEEW>~ zLh|Ba7V(!EX?WnX4}zTb>_jst`?f#Mq*BpkmxqY2BSRUeb{w9YMz62X|3b0Hp}m>h zvj2s&<`L}M>?=757`NJ zCCnYh-uB^XeF?;J-s;2#oK>6eK5j?IWgk*vEvj}QXMBP0L0RN;JN2Wvw)W2oQZ_>1 zYR}JG2+F41JtR#d*ZbLHusro<+g*poxLV7tmHPI}Z^%SDXH!J~|2z;lNgFH^-k{$Kf`O?pB*;*qKEXEgMXfYeV0;q(0MXcPcvDe?=GbuoMj zhQ=kS=Gw?2)58!>$V#{+-G41%6dDOBMwOVyT!X_?2G@=6hfjA2R54X1WK@4^H ze+bfk8kuC6%ADh_gyjLL?2_x1KJWRy@;Y`q7hkK;bIV_wQVvL;cyVr@+09MDtk6P< zF2;KC?XnaQ1JYz39K>JxR)ID!?ebC!Zc&>F_<~}N?Z6|Yr;mM*JvsMZ+-e_(;`E2tl)}ZK zU(RZhaT<4vOwUsO)ANtbvfnaLe2}e5Z^x3=aYZVve}prOEO)}lEDfA6$XztEJYX}u zNE_7UfWFp%TewEjH#JHs9AY?vuVarytkIhE722@g-{n@|(lWCfFrW8sx+6Q^0J#J$ z|Gi%jOGRlV!F1UfER$Nn{u_P^LXl(g#r7~}JJIuTzAty7(Y13aLqe7&0AhFh(RSHl z2j4`<{hH30pt6iA`*n;ZlR@85YH?3iuRR=AZ&2cQfio&K!Y;fS<5JdpVB)LBGwOCI z_`N(WqGr!#o#NI4x`VuzVRxS<!xq$9=-^F-%TJ(mydvqbq(6Y>r4rlbM)ogctCURc6P$ zc>?lW*&(R>>k%)jt&5bPa9Wi|_b-Uaeosjtr)pb2`0DivjBkAJVwK28+TX#6%B9|J z@NYh%WB_S3`TgVRI$=iD%%9){eT@0;FPhKKgAD$_+tnhj4SuxA;o&5qQvm442`6pAOry!#3do(cqGLn4I40f>4qw>or4qE z-zb_|`HJKmJsFK(Aa!+AnSToLmIf+iW5v;WOdL#jkV30287t?EEf=1G^l^r5|)%+P4=4SJV3L!Cw+35I0D-2l<46hh<(4 zj>fEF8w+w+PiF~I#tkVh)$$W{0XvP6QeB9+p=bf{%2gZVIp2I0=~AJ02|Y8%+JnuU zrI)`TSBLaLW1I~Ue~FB9a(e;f!hR4z?hzyY@=y38_>6Kl^Lwb%Byq_=+C?SihKFeb zkrKa&_26QHR-MuUMnB5GI(!=lcG1ZfktX?hz!gq*k)E*Zx{tz;96`(*hR}2KTkbvxtI^pC@AnAl>Om@Ev;-l z)@B7x9)jF8V=&;gi!6j+f3_V#u;4;2=JP>QIbQSQAT&KSK#NOcd@ROr@e2~X@|S00 zFWvZYrd&i=)T*0x)yPLQ3Ke`+1qaG%oq-&vp|)}A!r}YC4PedOalQm#Jk^oa|0?hF zY^S8;|3I%4@jm}>e$?2vN@qEUD&V%AKvW4M!dK$joTwZUQ~}|N2Qvj6r2B{RsUYN2 zK^~?Y8@TN%AWa-u zjCsaj6SMwGtpaARv5X(RwTHFSv8v-WA0KvqVcErtTgB+jmfIu}uS78^`@B-S;pR@G%vP3P z>BS&3mZpFG)Boq!%w*^bQPNQYVtrbnf1J~wwRnmdqku4KV&YM>27ihQ;lMxN4eo3C zWyHN4{GUOiQ+{VYVHR}>nmJmik)lq+yNf{D@0#ovq}wEC3X_J5>jU}PhaW;}E2SM} zv$@4!fItKnVy=3lB79(%&!2Y(Q*^g*eH7KkxYU4?Ne=~xBMC*Yo&&m^ z&XmJTY)o6UzyU8Cj-2iCwFPi$t~a2@v5f3$Z+@#Duz6kRCfDSV9kTi7F0+$gnA`nz z{@CKLyQ*k3vA~&ga6?7{lSA~c&9=4AZC8JP8?<>n(-80p55Kkvqh+4K+w}{^r$|3W&P+$_r&2`jEoQh95p?`nkl;9PyYpQ8Ex^N)S?yq+ z*z=h?{IyJUe%Wz?;e2SofB!WXftH}G*b6E-oi+osx84^_{JA6_6x3T-deUY47YImq zOcgZSs4{Ryq*$zdA}c%`oRf(4%^7xVujRvh$4p)ywQ7{mNlNJ#kbHD1#-US8hoA;j z$>RkKSmA4k)3Rgh9%0Sek;4`VOF8-(OLYxC?by7Hy~S0n^}DLJ+-ogRqLd z1{*Z2Mu$5!wQhf87j%@)1O4SWnuvTOJFYxY>*T}%+)UNO@@sqOp@j0H8 zU4f0f%q(bDNSSaiVw#k#f}YBjkszl8xi(Ae7lD&_>RN@x_jryF5X-u1fy<-UduUR4uT(98TFJkZc(@kemINCMM6`eYE=u zgSecSQ(kvA3%3ByagS4Rl$fw-0KpvKK^vr4ZgMZ@#6tVM~RjUzwu;revV zFagP50*~LI#wZWQk%ayS67aQ|*&*uZ%7D=TsxmBZdTYb#u}2R&)2(l+Q`LDDrue>; zJeJlf?o3CX2P9pMJ;+kt>%| z6zui}W1;zH9}cri(f>rVO|MlD)ljpk!_;~HgJr>>RS)|w#n(lCX1DN);+^o|R?8X^ z(5_?m#Dv0@Cni+N-ZwL++lnRRT9*IN%6#?-CZNF^K2vYND+y|Mv=r}`A%hMUl$B|< z3jk<&2gS1`s|=d%g>cnNwx*ADm^OoCo;VD-ilb%k#@++1l}__yd0EmB_0?B|LgqJE z5<&!9+nJHzdlCS0LJ-{uE&o;nG&KBz0%ifa7alAsKtt8d2~ieEm|p>pe~_-vz-%)J z6VYk2`L6(WI_}VVo^Bmel%1~j*ldsdLi#++B#3{@Of`$Fu7exd{?|_NaxSd)rZp!K zm;4}jCp>k>MhAudOeceLaqy-ems0~>^CZJzTMcsYwOgATxNK4PlS4W0^0N}wv^y~1 zy!Fz0AB49fCe&I15ZadGfsZ4P<}PAJfFI5A@tevhy)f~ujD8H0&p%G?G8l4xTj957 zdtjbvh+dX3Y_7xtBukysOR1|NnE5W8sv#Bsk!Bi&<^-9NadH6|RNRq03XKapMHbh0 zY3fEo$k2B@9IGZEzhb98Vh_^su~i6?qS3PbTvNwkej+GzJl=sp*WKp;VrocHvR=avYZDjz@Q5Mu_6# zzk7zpxO-Qz&CGecnOr>F46UC^HsCEZ)7L>#2*&6e?(dC1Biy|A9|yD91~!Y67*YilKMk3u=dGvyYn{pnti7+eWS?kE@dG z{jlsSvzK$W`VSpQcTndvQTj>hE}FcS+k~*ME!~ppqmkMd@Ap{o(vG*E`yEnN3kMkQ z#$B?}+bw+{s4Ln@DpuKr@IbjoT*~Gk=jhd2i z{?+Z~ZB0xWR|LO;4Nh;$+dwgNQ+7@mxlBkkk(BE*yyJJ#v7J&-Z^7_{!S>cO39}(9gCXCMy%OkR@^ndon!KS4v_cYo4&pfCJD|zgo`8ej3ATBLLe< zq7mZr-SFwjMQ*(O{D-ND7#31`g#XTGQPYkIsmA}6FVP=^GEI=n-uyE2)Ctl%`=;4* zQ3Y0Y0y^A%6}K2SD+*j?bKmcP@Aey;Fv=?`QzxOQAKfGEOZuBzINJ71gW=)M(gT)?7}$AIYIv9*%PZnb?hzto%=G|Tc3YH4S0u`Z13>R zwps*5e=IH?9dSsU)*g&T^96EfpFQm#^t8&^mDum8xy$Ifbsv#S?5B#2eq1qSJ23a? z-uOK7-3u8;XsLbSRaV1gJwwA%XMqt*a_Tv4PQBjV{+bdSNE6m(EW6g**K-zfT1F!O zRJHne=r2Uy9GlHts=kC8v2^Br?4vpAw+{q18>{k=-vRp3H!IeM6ZN2I>coA6K~WfIsz<` zYTTFojHB|De|^&n`SM;q(kq<8Pc{1L^8PGA!<^ZViwnHyZYPHKlBk52>ExU8ehmEb zXme&l6i7U#9t?N|>T6PxPO*SJ|SV>_cU|t;n4xn{#^iF@ES^il`G{3MViD8q5q3W^FmZhF22jSCE~tTV)fh~yJbx7Z_Oc13KJuck+xT0TDrMmrW=#rSq$iKS7O+MK{Y_EVl`8l z48AMj(z1?yUM&b;+de{<}pN3xD#|@GK>fG zTI`CTlIcwRk5X@*#o%}_vDO(&J(YY1uR@qGcVwF6ew=1uR&BdedN%Bf_g9}F0aHuL zTzuIBcGJr<@H>kSM(n{-7oz5fVgb@esvO+CnAjgLqe>>k1@~lpep_EX^~76Ko^~^V zue~Ruazf)JTt(i=F{(?WR8|A4f0QmLECZR$>cFZsaUohsg2jw4)&BQ>8*jE;kI+tN ztMz`!6MZ5B94bmw|BkogbiixH)OQSr?Faj2=RS?suOs(#F5aFOA-QgoWglLC#2*FO zeBiWW{;(XH23%#w8?5Vh37?eSxY@eS-WE^t$dM^ylYK>PAMjQsgbC6zJlwT?N6?L8 z=ON6`O{&L>0rlCFcvYx)04yq^7gaIBT(&j3Tl!J#7^iI}p^eeA>$3u0KY;A1ucDTO zkO{bY8UDtkwDAL`z}}h!s?+c_#{j7i zG;%I-{tfLhD55PxwYh3nfT)gr?Zn3%cG(mt%xQ`I(%p#)~Jt0D>JA5UKqCLB|d9(VD`iQ4n z?CkxSYgcLrvLO{Q_YcovX>m?~d-)BLfv*sK^I6mfdd15Nb5W!(U3U@U^d<7twa>lxb3_2JeDI}q)drcR?qrJJ3 z%#%jZ00MUJ|K7}8Lb^>@>NUyw8sQ9F;3%*vQzont|0P8BKQmHi$^leahKFCglUm|2 z?-q{z#-2Us>8nZ5P>BV<-J3n_tnBRJW5=bdKEgokfw^&kcQ3;&%!_c24Ht-+ z+Br3EmzbyW%nSam@XC#j(?pH56PaL>9|BnH4xkrG$ zY@%4`>)wFYzqlWDVJQ*fpkq&Iw1eM#;AX^rIrMgp5Cud=r1h>xqmJ=s@Vpiywo(!~ z$=kR7OiW$>?7p0LAUEBoyY7DnuHko_cLkoidb!u1|Ms1bu>U(bnI&XDtxBCdJ}Xp! z6Y}vhZ93uxC*U0wG9~;t_05_Hq5u=y4ua8UJ*^E)`J6l;-PkFxlR0*Es6rDeJu;A zIP4`mq{Ru2LfAeaGVKF1#&!kjYYGjkJKS?p^{5lXd1g89m5M>}C&x?#2Cnc49`G5W z#Ki|7Io);>?%^X0^;}4wZy1|I1(^pHvSds+uh$P}7dfg9g)2EMX==AqM$glQaj7cq3bR9pT(L6 zGky3J51pW=W(f@TS1TF))#3o|(~q8i=`H$;eMBy3ZXrY%7hHLNr*d*1GZLe7Qu zvfb3==`mi!QIBY~H;9NNM2MSgm2=>GZe%O}6y%<8CwH#Qd6n!aRQ#T&Uh~J7e{J2-dQvY@Fiz@0b4HKT!R7!nxMA5Y= zu<;7JO&P|-R4Qh)I%Q#T_%i_M2!hq}?G&E$-M3ox`c4`JADLV`F0H7+1N!(`C(yi5 zDf#Z> zI*t<7momTA7T5nG`a-(U148`1f#l|f%W@F(<i_R7%{-t4v+T)|!3R*8_sNeBs^avGTg=Y`J(! z040S(_ytJZ4U5LgDJP*M@1bom*-1$Rawciv=Icc+kQ9_ zh%QOVkT>Js@aW1w!7d9o_ zDH{jM4~OjPv*3GT=l<5*3~pl*tG>hrj#3{b{1(!D*bD=C!8Oe0s>&!;avvC~i(YyJ zn7H%@?}2klXjx83ppb>VI`7C)9P_N=h*mw9UE|w5>NYRCpOd-C`4L3ppmJA4WCF6a zC|7brX-Z1`sgDx#VTP_d4&QfxuUYxCZjPIp?Ppr*Q+vbsFz|`%??Uls`!zJhm5btK z5uLj~2e$t*NMs3U>y8|p<`*Aaf+UCy126TpV$sv0A`RDRneR=-RF~b#Qbx=w-n~^x zde5B90%BH|G1z1;P-IcoQt0IVt;x0<`AWsot+NwnruGBn?uP5PSBTvwM#;vA~4$^p(vTdAiaq_Pic~S8rXN`a?7NPYOT~McS6) z`7gK{K32|7{!Xme&kqjK)2M!tMKG>!n~6E@pi7*?yo<{64H0+H-D43EyGcrkYaRR1 z*jTgV>uE`>%Wbm^Q_1@%H~lfySxQg49jA7((nw7a)XihZvGF`blkfbcbnD7Zy{0|g zVT8@e+EH(ZQpY6!&dxsw5+Z7G56bAJ7dLgCv0H=MpC~LaGB7K7=?y;JR^R!AfZp9k z;sueWnnzjuV_{J!I1ZKGh|`AohA_Mp#!+as@w3t$2zxL2F>i|j+I$3|SJ}AIMcL&o z(i2_)Q^2kxzq#i+FMseKWHLm1dRcz7`4!v}r&aLYjiA0b^oLKP9wSaEy>!1j$YK|* zhZzS%mW0X*@ZhH`J_?Ov3|k|`NM7j3M=>}_)rOTZs)T$(Ye*=#dHo;wPF|*qgwV^m zoT?MLMg#rbIwyF!&3>qy9Yg%5o?z3xBS_u|`w>KMhG)WG8V&?6@!v5I!IK5UNEE?&=y~sWfV@0OoX2Xma+~$cFMNN( zBv5N*Bs2I@rp3$HwD=yXI(s!zVeWazhfKhP=`1fVEm{1DdWDh4osGgCE8-DQ8BOe4 zxM0rKSu{Mwz{(cznL3W?5*urYwE_a%5}j60JxUQO6&JrEEPgovws~v9`YqrEQfqU) zuI9a4u%d~sE7!1i=P5l>?b7l9X-DbI$@RLHnZWz&BIPQIRUw%yVy*e6(!jC&{9T-X zzcaOXE5Dgh?S5TnZs-K(Z6hIgE@$p9E{Uy0H2kd@dY2szH=HG+m!SlyszL~UJI zg+tgEpD4zzkj$8~v|g*b_s^Xm0|ImGSsX~IC~W+Oc>f|L{Gi?{ucU84LQKyo?{8j{ z*EUs_*YM?<*Kg^LqEdGCEgN<)@>1NezFj#8W>J?8{`=nXs!AndRPFvO(U_Nk(>kJL zyvf%+#XX=|NpN9jj|Q~Kf)T7GDfAY~)(w;qOKH{q>1V@iY-(#*Gp?}vA;kRigYruW zPp@-(1r@cRsP*NB$8@d_FN*7{lYJdha72GF>f-$pr$j!{Qxd;xwYsz8y}X?ffd z_0Cp}kpf*SU(A^z7Vw#(+-CJtmQZV23-9%G`w_* z3RAZwH9qsO+T_jn_O?EvlDn0qqoH^wNbGhYX?PZIbA(XON+&UB*Io<@@{|4@S4;On zIV2&aH_l);Me5NElw-x_eE7nEq3CNt(1M*SjENzz3eT!KRm2T>P^E7<(?3Q$Pm^20F5*tui7PxGSnu^m z+2JG0@HnA<_zM2b5OM|SKt9PK<{aLh?_LSAPUp>!reE>HHaBnAmoOv|TAwFIEtY*! zD*Jl3p5pXi9or>NTNByOXH3sf16DWDY+$=kHR(dU2=N9+@!A_gIgvaicIU4cVU?7L zTi;MZ!3;}i=ZCn!TQ0Y}=r9BGxk=Zw*xjiOtR6 z^au&X8(X!eD73d(hC0^PwKeX~u6lTI{Us5eE&Z#zkz=7Xsu}P6Jeq`kMvv{6$5-sw zDCKA`@^uUbgh~0wTlOG-E*Kcr2@+b}f47)&o^Z>Vgg+!0i;du`BuduMqwN}XRIVAZ zkuAA;&6Qzj>#W4P#(mivETi&z+%Rz*X{cgMjqSd#Q>9E{yf=|XZH_Q_Ke%yN!Jm41~?^XL#9&tYQ+pE9PMZ(g*`NLAo?^LLeUQsy7%YFpnxxhs&qNLDl2*u2|+y?^p6k$FQoO;UaURY zXjJ}Kawt!67!ewBYTx$i`_rAWi&3SN?}4~sLy?{n^)K6hsj3e<37?58tGr%H{IXO5BDi<+)>N zgSj01g{6$ZGXBYh!3i{$u3g}Jz0Y0L{*n_3{BR&#UuQNo3R{k_g*5q*<&9XN=INz% z!epKDwy?ei3k>$vEp3(1-2KHjCS9F$|9refa5+Bql{2{XC9|ZgS3@!*pC8)Wu&{3O z5PL=gNy+@&Hzng*g~bwNjj@WbMu^yvD}ttV`bzK7C(j@p8%z7BC} zt%}@r1#y~wzHk$die`$I*tjJb*X-5!;N(JnD=d&>Y|t$6lLF}i!3TBZD73!w8(jLJ z8}^q`-aiktQLCgL{j6wp(_axxwfaD11_esB!m$_o)o?4#pGQ|WY|Nk?X%-2!-&@Ya zSlSp;w&6p_xj3*G%uYKk(gvRl9VhamnDSmiGxnb4#O9AZ!gbTcNFH+o&FK74nxUKX zVbHesHNyz8{~#H2L@M3*+F$S&FDmtindRH2Apc?q6D=FHC3(V};v3^HtUs>~JfOZt zk?~5seiM7wiet~^o9QH|^_m3s`2i2^i zO5CH|MTgacP}T0~UU#=zePh2E)xWxv3oBFKq@gU+nT>M?+{{f$yd)ut33%vvzCQ-0 zOB6aFV>D6kfbGq7MR_wYH?X~$XyKz{>Vd8E8j4FA+w~R*eCi~e&+e&yo+jTF&TV+z+uSR{49I>=PvgbpIu;Q3%bA4Rb1 z;bxuZ`>TdJl2=r=V!gxH*RIBUXHKWIr$52+5eV3}7*S+8f@--GXH5Ob@qiw=$Q-Y` zZ%pr5?Dfj|O|LEfe95G19rKs|MwOnphSzD-f+V4Qkb zdwOJI+_Hm|bLrn+_&0rh*EkQ>xX@9b>&U03_smob-XP#Z{=`6X7T`ZP>wDo3+tBdT z310rxLD6U&h5WeC(B8B3ql8dKJ>P!tezw;3@y9paQ;Azg&|wd^?!u z1ZarlVtcl<0{F|u8DamBeh%qWN2;8=*HJXsP~QO!TUH+YG3vY)ezPiS^#Jq{A!#T9 z+cN?;pnhtr&oNii3NW7Ox`-x4I(A5~(Y0jl z*|N*1f|gbS9YtZdXTOZsFAGEHtzj~{oC(*@C%!xxsx)YD!0>rt{84n;vL&e^bBU-H}D_h~S3ND4v9(n1V7yA@qaVf?Kcdq8?=CO|uu0)eT?FnVYdTGD2 z=B7`hiJ_!^-_H`wUmhaoKZUdM5UhdR9iq+1Mt^r+|h-O5~_@dySO zbbi=@+k=JG6_^m~@m*?OQ_@N?TARE*twHQkCxUyszi;au-WP2^A1t+F4ICj|wiSEU z6_sMYrwFFGl|NeB#|Ec1n z7&tPrSnPFYY~1#FHvE3;s)X(-CrgCPW(?_nVT|tyD;lE?rtOOET2Nhn*3hQz;&LK6 z7LF!XQ?dVz?^jX2z5_l>M-D;1v~-^cHmaN2)U>)bbNe{PljuY(0eM< z;uQv-gI#@|-E5M;;%t+$(e>@Q6mo_7mSQf5Um{M*5Ed62eYOiA0Z2|Hr6)h&>NdB< z@pySo2-+v5u<&u_#BmAU+N1}&JRYFeKeHrKjyYPh57=qcKgCMbd8vU!Kz$EM(cc;7 zWVmA#>KBP$T#j&vp_fmMMF&qkEu&I>{6oR$o1jvxe|8_+J8vqwNzz69j% zoQY%-m=T|vfA^)lAmXEZ#AQRYQR)!L(F(05ng4#QnV+y62D^$f>=3gfnqKIHgJ5Rx zSJ6KXKrv0sL`cnYVRb)MmrlYURg0`KBj3gwPlTg*Rpcc|`6ywUR*sc)ENk-zenKlc zW!|s7Z=mY5lfQ$bp@tHa-?&TLkHE1xlW4!=d+gH9bk|w+H{o@sXvhktX$?ep4sxrO z)w)jPmSQC#%^2K3=LyvL64z9zc5E~EhK9mA6osZ{Q7WTM&drA*b;=!u@u!pWq(ern zh`tlowO`5)#}5Ph`z%Ell`3grwGpmshLL{vI9DqxoP|`zIy!Z>Hxy#M!7ar`qUUa@ zC%p8Wv45napl%QKXKzwAoMApRJ2d)E|4jUqo$>2PZ}JfR4}6C%^H0BU0d% zq?(Hi$+#_Jn%;BTvT#WjnGGa^?pUXjGDlOQJ*&}?-D#;8iOugWFS?|AV)Uxp7sef< z_TrYyJrcPNe)=qxk(Czq=6h4Nh%Q5e^Paauf)=T2S63C}T_Jy773B&Zy43b|`6kx) zkKbpoG(qc!vBdUK;<>k6Cev8K*hE2hO>5cDHAo18(9nTfT;i7ZtSkb~oXH}K1`)0F zhcidcMVr{L~?lBgp+9YH%FE;ifLMpR=fza}qHVh{?Q1$m1eh>-BM}pUX(8IYdcDQF<0~;F6yuuor;E5Mx?y zk0q9ci2^&6C+b*CIX|Iv)Cj=rIsXt$CuAYaQIv0rZ%}-s4ygr&?tzd9wojzI(oDst zbHCf^gJBCc_^a8+vBYBh7aF9i7bLhx0QN!ig}J%7eA^XxgMUL52xaHlhv^o_xZa@9 ziXxp`NO(_bw^tyY^ly+ICt^dGo5<71x3AJT>XOH6--#h3Ly@b?h;YcUC+`Rz^-e2W zIm4|+nD5i|1@z!;vTIbBpFm@ueig!3{icObPIeo@b&0K*A9*|EZGHsZUeXAM5_ytt zL%d?gs9U#AXVDK+={@)8e(o!k^h}FRc10YFt+mkAM2HWYgU|Atyrl6w*(TMDy<5cle42(P=o-*InVngN!-Z%p zHTXo{(#Ia{$uLIk2ESqq-sJF=(&qLxd9B16ubx7;%KEf;QsgxxA4Jod+8Y08h+^SK)|rNrHJ11fO_xh8f%QiJ(Ur+VpR8ld~9IVs3TCn zV#9yP!tm>4IUi41QsX46`{UJ&k!G zG6>(=ovLpfrrdd{2Hq|;$M>8X%`QiyHAsQS6~r>Bmsrt$tEwzZ{p6Ows}j2q&yP`e zM83NVEJjRYkh{}S`U%z7ijd*GQ(!f)=_ zkuFe<2S4@BE57-g5ts0X4SzQ_=QjmE(-6O*VmoV^B|F5ZIrN@bF?B=f5#lmiuYZyu z{~->-#rY`A7NdxPL2Dd0xG&fWh4dBjYZ&4M|7R=UYiF7sL2j2q*q=8eC8p^#wL`? zszKMx@5ds(^MA7V!oI1ZI{48>`x1nwUB%gpB6dLuR2Z<1i1&cK+*# z(wcJlS9~TjZ-@cJ#Pj>1|$)yeZw2NgH!}>r0Nes^XGnS4B8#cVi;d{G^56_xt zwP%odbar)5am3-cO1VtAu#20O`-f!=N@h`#>zhzzbqv52uWrPxuz`r+?-k@GA0w zg1Qc96aU!4eDOTnF5;pZ^whFS#CUi}=q#dM>=ns#q$T3MQGKOn_j`edkaKE{pWa1y z)r?_F0-LU7k(nSuoHG*eJe%ovUVV<+sSa4y6^b|wyImD7l>!gno@$3;a`=~~UzJe^&N)aKW z2U@fw?k_)kG;hJB7v~WW=uH3e2e*fqA{<7wYS|uX{)D$HkMzzV z&+#q*H-hBLc#yq+j*0c7ZSbWgmp}LSh4p?)1J8wm!<->7%MPkZIAbzx>3xG^>1|o> z7PB~F;dK?_zGl-Lf%OZ?t=LdJ-=N{>WC4tNU@TVZ2c=xua~5j{263qG0$8fK*v_Vq z>6sKBL3@2oEO_C^aCM~e8^xdp|1v^U@DC(<`FE5_+8HEw%=Xp3q-P~gG6 zTa-V4j$IVt_x_nrY^!e!%QKZd*)&QwbwWR!sbHX_6o(#!*EQ4AdjeSf=b{^|A}*FJ zOSL?qyEG)01=81|_=ga?%5+DdOnot{welYTI{fIhbVDHF`ia-W>gGt}2UzZ+^MDu|qe4CsBg4PN);Qt}N9irChPafU+5I`2 zd{}!%!>NI|`2^EYRSixe!V#6ARU-3oU$jd@0`AQmo3mauiPcCXGD+*8R`%M=Rs z-W2v|`~}^25(!z@#JIXS4*RZLGDL`*$qtLEEx!pZ5}`2GvFt9o8jjh(GHD^vR4s&+RM>0>|~a zjnFNpPih}^n2yVWuIYbR6Q|#HI-hk_Ks@#i3UBQ;6%+h2TJ73kNB>}n%h$@#Jd?Z3gFi>*>7dRgJAOd;&diw zPPSvI4W5Gm8a91m{Zn@|!w^J6OVR+rv!d03Q& zubnHLO;KtiLlfmQ} z;oqqcjp!rur`{1(pe3f6gyIHwEFcG1!Cj9D*f1TpB@xCr)i{!VI-ltOevy;ATG6C* zI5Hs*aX>35#3eV~{;}JJoF5>>J1-CLz2-{o+7257ZkJ`y5pI8b0u=6N5^LalU~lJ= z|3}kVheh>$;a;S>yQRB321Gzw>F$&UX=FfJhDJhSKoCS4Bm{KmPU-HJX2^*<-`~CW ze;%Im>^W!ewLb5=-W`r?mD^qW+`L%%b?p2S!iD@UT!qL>=))VnK=CcFFaF?6dVm|u z6H^DAp24v}Ct;rBI-0J!lPy5+sP&nBrY)E4bX+9!TO*N%B?Z^?X{aBjI-vtAUa{6-n?z4WvYAhG|Cg+SulVs}oau{>>-Uin@`U{l|`6 z;f|kPdOYy%V=UZSH_Fkv9(y9O&4JvH;I`K>tb&xl&#&i;eMz2vAyr~gFt!h9Y+Qbs z(A1(yhyly2_=oTwG^3N>Zu?<6q2CZFuDH&wR4v z-t>p-sQqYw<<+29dbj%|)Zgf%nSl;Sx@B?U-ECezV)cSAEu4{4W>GbEgUs?vK-*l!6Z`bRr_#<^mCf-tcnCh-Jf*Iq!NA zp8*tyPCXj_GYb66-c&x&Z!h#hf`0n!uFM*p95U&RnA}NC7sNthSevs%22*u0Hh z#o$Aaa$G#ip5h4u&9-R{vfKUUT`{$#WTwOv8&S4Oz>~^W_k5ig;*7V2&VIrB6(z~5 zH^NIqKO?dS1z6uDl%ge3#S71S%XY^jl}@-q@!q>1E06ymcm403D*g}d{p7Oa5Refe zwJ@k^*8ATfiE7vW0=YL`j7znhb-t+={H1u-3xsdBk_kXUl9{_vIj;ZhXa!@Zm^V1z zRY20&lWeoFg^dgH=3fs9q}VD2wH_!B2VbKVvth6s>IwLW@VvxlAhaRv%s}a~%7X2A zi4?Q9nn=OfAerWPEG&PaifIfO>Hqu}w3||FY~&)_n%$_GO_E_qFBCG;jq*2`=jN59 zW_}LkGgFa1AvQ+VKcPx>@w30&%dw~{6cYj;MiuCzN!V&>8r}uq|NcuMsDE}9y}|kq z`DV+e!DAZ0_1m(OXYk(BF>75SwHWSPy=N#B44*jz2Ei4Mz-8%;jn0nP`^J=FQOCsh zVL!m0puk6Z*Xz_jH$d@iFoBf?z6wKURizj&!Y)_SdESuIohA~t;qn+i{enZxjLKTf zAWmEG*;wJ#OpkVS)=4waonnQT1|Qr30HVhrA@y2V@rea9^|dWjR5h>iu&$ zy2CnjB4?chQuQxQ#NPk}eW5(WIvh3(te}9jr1-`%qG-ZA3CNaU>Nu~8q zWb8#EZVon+x!(36Jv?PaZvt$6#6-5G&mQg}fJX>m^B}N1`~uTWbH_KMySMm1r1r1u zZNH`P8o0Ks%)jGe{(PgD886H`%$H0-z**4m%gAOJ3vA`*f5>Ze~kY(|6x$+ACTsZT%T5v`FriUx#F_aQszl+-(MB>V=t2sfnSz)8-X7p!wyo~HCDjAc zQ!hfg1&?;qSjPEaT?$KLh#_8)A%Z=0{;M0Eb>@nv4hdVh(k{8CE~QNGWxUG2VAC6jNJSY3ph9s@ zL!%;zVjvOH-(`$F>z@i>Xo+1U3mDPDB;J2RT~`Rj3W^1br>J$(p=^ zHvEzO#Hko9w&!_IU4#Kx(NmFu#&XWQuDz(S2--cla3%6qDE4`^nZd&=niCV6!j`7) zsJTf5H@|(_F4;Hq+k&+K`BT4Fq^Ot8ALnm%C8{zrz@_8(Y*CmXBn6NCffC5_+fAK( zZqyaW)EeXbXtqH)PSpS09~3UZinNY!ssV=Chq?8tM>&Vw2VTM|{@1L!snQ7l{|8*0 z7+PtKSk0o-i^_qej7Y>)>IyUdr|O!@d3Npo(zRbH1ik?s(Kt`6CvqQQb*Q#gI*Y~q z$7Lf%os6eTwC^i4_|p#9eyAK+bkIH8SiRbpAm+J`&KuyFxOa^6q34cN8J6Gj69e^2ozs82|D zn24~W{Wmf6dODmFCz9#wB~x!1GA0yO3KHP%`-qkykt;nw6c^6*_9apQ3Lv!p6*3fR zZEbfHQzpfXyi-TgFDdhOO`{`yMc<6nR1#WZ4VEy=cayTiq2&=42vxj@x`++fXg09? znr#8Od)FT7sN;k~6$a~VHjK#?Sty`-)csn34BLk2eTA4&>t?&TB%AcU_H_I05$qVd zdb!sv$_{wjF{&JSB?a_N!T+|rwbpx${L{$!>vsKA|E)@@DIR;pD-&Ajey87i1#Lw; zN2H&C@rV@B`<;@(Z?@EC-2VXV#O$v>gIbIqpnVP;0NkS5;vC4?3LCP+n_hm~H32<< zXZ*_T#K-l1s06Uw{N)Qh8t)dS-qN)VjzVKL)+gtGc)E@>RRV-@(zULcBoC^pABAYE zWCe>UUZj4)M)JJ4^d#EZ^+Ik3IiqUwonImOddraDcZRth9+0XzN5Y?57J3+F0Q|p- z%|Dt(p>;NP&Bs42$~Qh#gI^0qJ`aDBDM8}4RRjLGcta4mMQRIwWsYXwB%CWp`JnWK zVj8CrcyWl=MjAt~p3};kgc%w!CETZG$Roh;ze*0~a_zjVmGZ3%#ZBmc{q|pUa;I zcfM=HvY2n;s|Gy%vb`r(#pDNuS^&_#s#`WFyd_TmpGWEtC>Tm}&f&qUUGFekY=|JK>tgp)i3fpEz*P+Opj;Ynx+QE?!yuszaEeUrcjR7XcFowiFf zGY!*yNA9#rsMoj2i(jnVOg1K(_%G@cK|CI>j{(P*dJm{_&C-&8$H43+UNwDIe3WhC z>)84P;Nf1W4B&Q>g^RB~l4v8VtFXD;zziKehp<6@dwmBnrxWD1=K(W+`B*^+GI@HT z7yv?_1*Biczx9>x9WUe&ce~6^?_b(~q}ygdoXp$@al<9-we~MXF0Z0B23_L}v%@x0 z1g^vfZr;;TrI0=7t0u6}(Xr=8Q8_4=bH5{Dv&45SO0(8` zMs0Zc^92`TX#V3OiTtx=oSzYYyc<7vcSOC~2j2L@5%+g>MLq%XK;ZonbF6URXW?5i z5SQbW(tmIa{XbZ|oHxftWM)w4NccMjKmnC=YD*_kg7*PATgpWTK&YNlwv-xnP-{Mk z{{25HWxe1?_~za{Jz1CtxeD|4!E8fGDnZD2JQT-W+P4fAGBPr9y#%xWXGzeNt45@D zM|6kN)X$P&KhkmE0~}FT+zlk~DGLV?QJ^Ze_*o?G4j3hkl+h#Dbn<9?FTQd%V2Ys5 z)ClKSEv@Cp?|5w$b`P;4`YRQa=GAkNZpFHj#p(rJ218e?PE84m&u+l4yY;?|Ogez1 zgZt9U|FMl+o^K#$RX%Oz*??*)8ypER`;Q5(!f@{EAV;a837OSVvVl^M-t4LP>>pM6HIjUzo8cEW)lVOw7ft=JT{wFOnLFkNzo7r)Tq7y7bXLD1#& z6wxB`5i7^bPCdiDPFr(L@2PQn@nM(w-lOOnL!Xbx8_NiT8xIcnvtcW22p++=b=xTh z?plbSr682#lGFL?D;=wdHcue@QC^4?Nr9g|q+osl{Mn<2(2AOt6NwU`>o@_DktJfr zlHHzw9ekECc?eVxfOe&9XZH(ij*|xn5 zT!ApCpghyOf;7O9Vc^b?2 zS=1OffrbUaGvN&+RP{EQ z&L3`={Zq%B)CRXY0JpmCL{FvT4r}0 z9d&AyLDExZdNcFfrydHmmWuDthy#(Y#c3ir%h?Fhvb`5|L<;dP{W@a!8 zEzZDbndq^qg3`rg%kouxj7n;oZm`{~lq4_VTeTy*>FfyF`N6%zEJ&7t_?w*U9+JT= zi>I$hDEQ3`Ghu1$;+G$x3C*^`Bp2t|0D|=H>LDj5O3o9RUDC@}Ob1)#fSv(12ACdW zYFt|!mU*u7gGXi&<{N^X9tr`q~a4jxtWpaLL!#3&1uC z#3CQZRT6|!OAT-2@*ep;2k2ORbMv0h*w^)+&{G5Bb&7KD?sHhWch$1_Zdm@p@baUq zMqCC{#-;bO3!vQXp`?^V^a*SL$PMn~47mswW%9LETR=Tw{m1U^l94ioy6$SiWa!_; zu6rJF62~3JHgYyTj!b!BsCeC+;R4I14IPMOIKi7zXldzv#W%zHU35L3*QUb!H--!k z)`jlwyx={IbqETmo<9-^jNFmC@Mhx_LEFx875u$&AEC-8AD*ayx6Khf-hMC!Cm zU(9<)Mb>R@at%(Q!fmH-F&1#ec2vF@td-<^tOD;{9`Yf^Entqgj2Q`zggh4sRnHat z>?c%K-UT(P{?{iML|67Ry=YcU!b7hF-&d$x#-5V8;N2L-HmL}yGNHCH9$A{8$bq9! z51lzG_tHx=M5;5aV~-ekiJ6tgHQ_wB6Sg<;bxdtMaD;iX=6W_8Q4+0d`hHanoa@EXwIxl zuYGx!At7wwBK^2w1xbqWm8nN?0V_~KS(Iw3G`AYMCbIrg8PVv_x0ER6!D-Ucl*m6a z2slgO=B07GAvq;DHK(Vbx6FCpB!oGS3|~=8E{az|mI?N2uk0;yR0NTvdwC^-}sz-o2W-S@_0u-D}eRVJ4`*-~mpAg$$&u^|m>> zRo$Shi};(xtQgt_nc%3Ysq8CD0jBleBVaCP8*-25`cIKePtLjCt=s$ zT;JD@lzqt8+$(%q&&fgh@DH%l>t3Hmx10nhI*;*$_h@fI%~p$n{rgtQez#JsLuoHI z!U7jAG+Q6z&)**Wn|l0UGM0y$Rmf1<1shbI_n{taJgC14at9l{OdS64@3MFWaaS_0 z){@k5s`ckGD99?gQ#hm?q+O~kqbBLFu(Kdp(`$xp2&9-dfp66IKtH%DkGe2tT!C=`QTJQ^Ux#0j z6{uU*6=1>?3-5p3{1qBHkGLxiKjO<70W-m(E&bP^SM&Ma!y`sj-@XeI#8Mq}>^=l?vo`~IxeEPVRYWq+JxH#Vj zidBwu&(FRqtX9v5p**z&hHoO%Ftq)O^JJ&ZB)zfOkf9bRLE-LFV`JBwAIsOPK>)?P zQrKBDP~MjhZBH8mZ@KrFf7|$NsajbN(D?R6Z0_i>Z>1)w%o_&x85y$((nfpkTtKTz zgnm=?U**Js2@b^wgsUwKDzVXUERaX3h;!lx?Aw-?j=853fq++XD82(QntkEy9baJI z`3E)5V!_3+KAxLiRrIys@Kq8*c{RII-7LEF=bV>3~SFr4tR9c!xJ{QyX%bFb7B~ctEsl6Poi% z#ONPzz0-#izTd}SJd8NmWCM^#tiSd;T1WD|I|cbnYO^}d{%Bc$*fWwre!Sj01Fs6S z!tXq*2yE)qO z$E9P`OG)H1KZ{PsM%4DIB;G!C;VV9B|CB3Z6xr5iF-2K-nDQCEj!gsqQ#1{42DMA` z@=!jEY$2oFw~5Kn|IKlP!d>SLwO<`V-*x5;EyN-JFZ@HD;JX}y8uPZC0&zP8PS7BD z;6wKL#poayj7g0X4OYpx2whe43UFgAk%Yo(#0q(quMOnf&!pPgL}W{-^yF#T`cfSM*4O`ThO9uBnOY$_VELoD|@! zk=7RJ!t5ee%uBrV`DtS&Nd$HVOysxs;a8!ng>fVkEd3Pdl`~&c`7WVp-zImE!(S>k zPP6f09gz}&kRrhBy!AyaS*~+l*D2~c7bp-l3aXjYo9`Yy zgXeVHjbkI7w^&#%n`S0$J{h@b>?T0CX2@m~_U@0W+U&V1<6(eJsL|Q)^NPjV zrM`gy-$QJO-%3qumAbxeATNP$edE^%fxj6V4A0&QBbt<7R4$Gz&(0PfOhn61N9^}z z7cy6r?@>tyFUWfrO*6|k*Ht}p6i`^G3%Wr&;rZhYnT~(_)tsZ2`L4}IpLQxRwjl!F z%=kA|7uu|zhm(VxBZoY2_CwZl;IsesI=2{FTe5BPZ)n!0hLWdV9Ga{Dx6Jg;Or?!P zuK;)@Yxn>8;Pq4<#1NHW{CJKV!Hbz_N?KAM2(J#8Vu@H)R}x8-*&uwxH3|q zdlD197AF&6ZvJJO5Z((^m}BNeIDnmdxXsZO`uLS(epfrrZ9w_p=4BMxNP`w<7iTRe z35DgFSmO7?N_0qRz5U$oKU0_V!l=uwdF|0K$=9L3Zq}o z^c*DPskN%1m?#j_$nQ(D33GY21rD`ml;5`Bva0!r=Q9{7n5@oFnHqe^h9qXWUxO{I z&kC0A6KCsLiA{nkHcR>^t1~BwJ<|;i_A@hKM1Ce4H_XSIe3Em+2VM`RSj5|_J=^+J zPQKNHKy_?ndTZ`?O{gmpv7qsCV^7b`J;^fDh&v~hhUb*#=fgS7X!KiSvsuRLa0dK` z67BIiwj9JV>T7zLDqa6Q4CYU}joL;M$^#0k94p;uC%hZkd}q+grnRYw(L$D-a)!zE zu`-f@Kf)R&XB>;u=77$TmqKd=R#&LfcL%87fi#ktn5U_#-npI zv2J4=RNA}lT)9GFFJE(*9z~{Z`YcQix~cB*N)SirEAL1sjA4q?aCN3+tU6tqw?cQE zt{F`1p4WjjO$e;QMS}ZmR}9-uT1m*{VSQ{QFJp7u+X9hIFxLTK>V?I{O%U?V6hg-3 zONRkBYa%8_lI{ZW-i}b*un|Y7WugvScxA9*2(c?a8ZF+#!pbAzt!b$Yn_%=0o6nwA z(nJ@e8OW$Ey_R{!sq@VNu+lNtSqMff&;_Q-!~Z&pE^>!?)7F?T8ebJ(^)`|o$pBXg z;6RU$z!F2GwcXo{_Tdsm+*ZJvps9hvI48J4@EDOrgiHSL1}dZ!_sIbHQ?_j3YSKI@ ze)?CxI7!xq6g&t1QHlX!^6@YL9``X}PiZgJ1eqQKyn3ypKve*5Dd%MUlNH*hkMTYo zpzek0LIN}g(hOyg`M zcB8V(fGGNQ)5-KX>YWgGf2YM3oS7}ogf*SQDoD-bJ1`SR{8K9w4>hy*<$#%^^u+a} z)Tnk}LdWfwDyQ?J-&a6L$g_rRUZ;^P9>3{+>S2deMP8f7zd3tLF5vX>{8r7EFFW79 zd#hbx{=WLLna2Ys-k$f*z9oc(c9z@KUFb3EJbKdo*>O->X<(4A^XT%>d-#`0W(~m^U-P;TJ`Sqoa*=7&>g4_*&@7m@z1# zk7F_Ar>!)f`;R6GD0c~fV8Bzt(+^R|HJqk_$s6*8-h8iyxsw-o59Z0Oc-lUEE10*F zc>r0J?rI)+EGJrOs8hB!)8|cvRhc)Y%goUuqxwsOVJ@I;3~37v)&g?IPXy%4Kb;H~ zw;qVgeSJipt3-KcTA1%eX$%gt{44wSYKf0`WUtC%UP}@8f;%7B(%UkRG3n1H`QiGU zCN6K)oBsFF2hFeksqP1bS#VbgaFk9Km7LHuU}DXpjvJ4ZCmR`%jDUhahlKUS9Q2{9$?pEu`b zf@%Rboeq7vb;pFZh0NfX!n`L+Q~<S+)2oWs3j-`kNr@i}d-I#l&Zo*2PfYGX9E!>q5!P1ZI%JVb3S~0EVS! z*gv0ar0kwOXF_r#(WAh8A9d2|vH)cz#E0-Jpmk;ROV|-@{bGPP%vJu4w&RWcQhaJOPDEA%=pnZQOG7TD{JH(l zJU|TOyBIxvJ}Z{+9<}`Y3$JdH|56;r?_d#%7SOb8D?Wg)q|#8t2HZ|?LKp~hbHxCb za?h!BVKYuukY#Q+kMkGGPqYk13&|?!&8lpR%o}VGslqYX7B5pnUy~nUT!HToa+Tpp zmsSql*Z+W)!XKU$dH0)cq~!7qr~RgA>7LgM{g;GT_<&S7Ko_dFAs5MRwk3P{Fe<`I zdT;DlT9lnFX_*v@AjMW_rJNgZ1!CAhj8tiEHqN&0j=2D_nn>wY*v{*IfGLx|R*Y+; zhufE&jvQI4p}p|Gj`8>$vM#bMu)J47#8^e z>rE<+0@f*1a5nKBKpI--4LhcqTv8D6iD)6FS83Hz3F1wIM2^biZ(hlT#X?0y zU$~3tob|xDWAP-#QfLF6!hF)ll0G(*C8g7f0}+YW99(?r*+MqBD%MdTdVqP0=Ne~6 z(7934)(!29<5cnUhdand@BF++Uf`-oqsye?(sSYtcI{6(As#~X$)&{5s?%vvQS&<9 z>K`I*C*$nhKj|pBhpMNs0i!JG6M1r4HetY{C%=CUgDld1wbiDVCA0Gqwtf~uTmsUV zc*fP8&|7<2$@e&xKgA*Q~Xj9=2KG; zcs%@uXk{^WTi>=5v%#Io zsgpMCpguf6$b8i2y+3xOA6RcG`QfL=7Hy)!vBMxJ<5Vti2D9K;%Y1Mk~!oMDj^xjE#E43=NG(uZWFV zm>j-nW2`cJFU4tS&@U!Cd+f6mX#<=WTTDb`Rv(&5_X75bTmB5h-#SgNmL5$7has5t+X)+m=%llDad=<)@xWLjh zslipq@0O5P?=kF0t7snsqLZ;yd~|L42k?33_ruJ2QkjzlV=LmRCdlr)d%DcvWE9yF zOa8NX-Od-0sLIx`Oq#VoB8-!>{&WN)<}#i&R;|6~O&5@_WW!Y$PR4oe+32;VCbPGT z$(zYr#k*Srgb0`|$yfzP!^wzX9Zz6N_nKwzd~GQ+MHYxGO=iQ!g(d`JdEBWy)a)u13Z@ zN0yUQ27Efn+I7s6@sAssM4I$$%)?H%RWkoM=gV#pNF($W z24y0*8zTE+U(cy(NXd6KtsMaZOnqeO+wWTAQ;jQfu*Tj(AWo&>rY0Pg#x2$g?@;ce z2_8aI4{>RZN#5hGihW^g&!4$=FX}7|P?n-{8M*`6?y1!omqY-*TU(62{j{>-RWJ>d z@WA+JA0N!S*<4XZSv5*ttYj6@Z?czH0q()@O`&*+Yj)Y~mj|k;fgs`D5_Y}Rg7A-7 zIVPIMYT14M%;9p;YtBPLzz4n-9HU}MinWEuB}uEdTevH#Y^)fC4OiQAgpRPkPv2uN z0?>gv0X5YQwfj&|9QcCDyonnA}CF_cOwNc zIx(RJ>Y?8SXl0MY;FAAD;B{r7pO2{{u4p(JEOwt-*NF5c%=5$}zE)c{t0_nhJTE^0 z1FZwk7Hh~e)={_;@n;G($xLoyiPm|$TsOK752G9$*RkX|kI8Y1&FU$>|K~sXUleBQ zu*M65_UJueM0gH}MqWE2_<+&xdc0Lji~OUXL5N5KG5vp5jVU2+{$G5`S}XB-?yc6t1UU4*htY{INK^}ew8su5&<%RSUB5Y}bt3WRkFs}=aqo9S;% zMea%-HHIzd4o{3{a)F;S(A3kkS^LgRqOuPlMIDb|td-F}R~)pG;oPE1k}Q{+l*@p( z)*;XUTCvbJdDsDF*Ub70A-a1qXKQkv$Y}hePZO`XTUh~)0>zPz9&fw`0WDigVGr|C z5Dt1N?~L@`xXJ}RG5OI$ff3d69Gi!V-2+P0D*k!1KMqhX3cb?EQ%1*^hqs(B@_M6N zpW{~8!e7bx)X<8m)g`2c2iX1i#rR?zY7K^gR zYJEwMWfqsH4J7E&5uYl^zP^W^2i}_v^eirQo2eN6bx_1rW&9yQH7cA|%B~ZJeWQqn zj}1YLd)tC^-#F}ewr)g;?3(3?xwoLQh=IC$xQtRPtj`R3wy+Wg>hdG=yo4}jWuzHdl_W^G_O?AZErKB<#^!V-qHI%c%|1wje z&o-)S9!X-5$h0j!q3Q>V4kb;0bjT;){TN2|dLm7GjQmwg?V^y3T+nEM3-!yvlI{$9 z^l-dg62L`iS~TT&V~9yK>>-wHslCJOO-!G?h%nRLQF`5^x+^STx6uTsbc-DZON~LG z{he+|wD!}u-#Me8+fp))!wY$--$xxJ8`0|8#vfUV4_;a~6_P@^D-#RJc28d)0n@(% z&d9b>dWd+>1@EKqHD!bQ?5?z%EVz<=>zBV-SQsSA+s|U;^hZl4*kZntpqoJ>@N(Ti z-9Zzf67=TVV5su>jD!$`g_$X+a+#E?(C|%-G1ND8Ka>gK){aL;A*|D=?I+Q z(}PTzu+{K~ZEAqfB&7az;Q1<=Ud_y|?UAzfi><9l4TrW%lz$qY6Qdm3m#}ql%$J!Y z*#4?0F1?j@Agc;;Ys4cH{D!b*Qt>IMkfi9t#FF3ODPSsb>X~U09A||Tr?4UdLd2DN0NK50Kb`e7t^tO4OaP@ zb+Vfx7l9K!;`(q|2oRw);^7$HRk#2Hk?~&;i`2A7w7HR8-~D|c;b%?Y993kv#;t>W zz_pH4Pn$LCoP)t@V{o7ceW;D}s6mzp_JL$)A>^Qt&E2H#Gh;{KXk|qK|AT6Xuql@V z=)S{?8U{4oolMU+>=h3_r;B{-M5IyC%11d#MaMZ5Dku>-sP!1Vm?K!S*2` zgZXyO^$Y3}`h13jTu2g!qkhoC(`T2HNBlW z>kyfN&cdrwX5^dNU;F0Jz_p)lA?0oF_3yB8`H*f%R_3I~=zu@glT`})K91?mt zP~JpyL|hf3Ek#-e8kZ;PCtJYs?8DKzY-PAh^y+)vs9nbw9(X=#I~F=t`5sZ1o=2$Q zfrC%xOU=J^@RCU4VjMmPwlEZDTw9 zEjyVvEdCTH{X=TkI%2D}q36m@0DW>%$~P+20vmtc;-3Teas#hx0}@hV{TY%Z)E9Hi zEcBYn_^ZoA5gPhDiFP>xHiBsA;k zj{ki?wUCz_M#0sNosTON0|R6@;d0n$gTxUs7ePI}Wuz7t)n28o2+y;wc&ri zni|#`%n^t?U>8jeuULKmZA{3u)A(ca1yh)+SLYGu!(3fNQsXkkM%02g9W_5}YUdl% ziYvtD=s^5-BrIv8|2F?Y6m=`K86@I&=hIo(MfO-u$lzqAnZNU>3NX|ZZ!2BYeV*ZA zY4R*Ko#GSQ^xjv}8PVv0vqu{gg+O%lObWd6O!z!t1eFrOt#FydT{I3}ovpm;+bGH^ z3~LYR2lyU76{EMC+&YXfgbQ1~u$1U^p&wqEx1%c*0|1wX; zrF_@fxtDLBl(PJWSLUgpX|uufQ_Xay6RxQ0jKNOD9gL!$g@`2ibW@}icH#|N2{sUo zYvtY{nD`=Rm7?JM1$O-{$8oza@xrixr(ZbbPyHbWRJKSatX%K~e}A^HR}*A=gl}{1 ziR8UKK`s@6)t(JrkLjPY+>hxqzw9*RdE&^F~LJ9!3WIy6G+b@M6=5i)iMdVpf%C zCSde8z&n_PscHLdyL*7ev8D%l`N7I=Vy4s4)A^{JH-v2i0yiEWACKzh(z#V?@ml#s zXkl_P%Xhl~iFl@#xymxQv3Znwxs_p%xjVx5hZ7n8;FLV5E+gUgm*Qb38kofk+5tRH zBV8HfLt$${8-%n^5L&Fhrbz{LPMy3L4)vS2@*qe)6B492j;O@W3t(%R|;Fe@&DNV!)L{R|wtO%bpEJX08 zoQMEjPnnn&UubRe1EPr+sJPrl>SxP&GbGEX^(XAQ28aCP;@A(`IBI128L%$miso_E z+!9v`sY;G$P<#HLu~0u}4{cQ`Rik@bnIJHkAqDwj90@lD`1p-g3=UP}SG2FMRCEfWXCcp;`7aPa_8h^_leTTxnb?Sp)p@jjObfz%P z2_tiFOahKCGkdrInoZ~6Mr|}83V7hh70O2LTYJ{|6yN^MbuON-#6u?&y&v1rXWF(8 zVHSH$W|m;2LiM_DMkzgc&YceP{LfRx8_;y32Lo{gv?PM@;66hWhsu_&2F#D$8hpl= zD?AhG=CynwMl{>`;BV*ArZ!(~#`ko0rpi$5KtaUYxDw>CVET4&ve3aZWa-7E!V`gU zv3L3t@IfvsF>)0zdfvkvC4V<3o;h!KN}>D?5Io=FKex?QyRWnn*}!^Baz|lj=4g)` z`yLBC;wF9?rnoLSR~pWkq>@f>$bR0jOz%Mszts;ce)CrJO28Xb93>a7|I<$M!UvTd z!aop?Jg?I-G<#tX7id!7IFKZB#f%QyRhYA>YN0wCW#pY^xsl=?Vz&F((}(uIGEV75JUE{J_5};o~x^?>pnco<7km{Z1YhkGS(t0-oZjkurrrN>nsTJRO59jkHT=9 zb2kLrVV-|6h;>(dUf%j#qsq*uV<~=8ei%g!XwP>?XQR7M2=lUJJ-+p?aAkM)Yh9Az z^Zo?NAQ()hJ>#WN+yaTa4-qGy*~L^Sy4oxf=EBng5g|<&_m95wGkot}RSVYmPOF8U6#dYPfMGz-Mv(Ik5l zMjlwv7;bl)tPKMyK1K8ZO&*dc4in^p#{+Bzcf;EU40d=K9C|Jn@s~zxJS{1PCWgs$ zcXR4Y1<5&6OjK6=g3%B=OF)*N%3tyhVw4cr&w&CUlbg+7H%U3~p4tK;#tz@U`@YZJ z>Hid{BPkZ|fJN0q#TMxFeA{18sk$SlKKV3ykNHa#i}O{C1@!Em*D2Ehnz45KMHo2;i26^Z9{0} z?h{jO_fi3Has|}kb1Z#ybhUQAR&DQ$yE_}xu+#8NzxL{r$WvRfamq%8?WHq~eB;^g zyNZhe7{fpcG(n|({h)a?u(Sxp0#*lX(!fGNYXKGEF`nJ|tscq+5;RNG#M+<++Lidb ze{006QoZ+qq%CsiGqHv5`*Rq2mb%HT_}Mb*+8=q7tz?*3pX)a)YUJIXAfJ-sN)A1dPYcX=kM1vf zSkE@^&+fcX9`#1gl@>x@ii+<=`HA(+oh{yz5g658@h%%nQ#B(E&_JF?cS(ZxJG&iH zYd?y1b3Cr)G@lp;LJTo-|Ty}ygo2XNpVqt;K z{TQMy45-Z5KJ_AfSTnlG@pnPqffVH z*&!Hrk4^-<;Q4)o3oC+Vdu%E@2Nk|aP)vaNOt&_pyQZ?MeBf-04Xdf$^j&Z=xXo*1 z`fiLke4FaCEYrTEpi-J>fPjf4O_GNoC;b?f8K$znz9qqAW<%rNPK|7$fPm1P#szoZ zyO8VTR*?q1jGe8uE=Qt{`bXMSBhnTFt#b!>V8^25(^SSkzl)mFRk6)vt~I2ZDVxNzts|-^{;I91`xcSWc+6_quNX5AAKYrZ&5;MnI$D$>ie`g?N`q|mwWPWs;wv#^S^!rSMzD_Pt zHq~f6pK;}2Sz<@25nKRlV6nm(NycR zAHO^{&1>W{d2L-8r>HDtTI<+XIPdNoH1Ia$_v{|`r%)DjZ>ARO0lBDdZ_~`ERob>Z zi;DSLGp<2f3oWY;ze9_J1y}b|0ddp?NBDG+zY0BP4@v0^;y(nYmnUs5Oro8Ms<56uC7Z2jJ#S(zPBDf#CP7WsjNZwFlfO1pwRN+G+S&!-b%sA zq}EixceC_j2f_y{xR{<23nC(jOS9N3E^Pd(PpjZn9scu@ZB4W-=$wfbRFkGsPk0Ai zSnmmZa?DHmvy^yRD3>1j(dVPzGyLL)T^ryOMA;ZMd5$O3TfD!!W4akIs%{~U#lAyb z6J0+#hJR4RJa zJ@d_;#=wo5~z1x$pzP_CD3ftW-OOA?3(}=FO4kt;n%B1$K zEIl5ZeDsl!Wt)=2j}I6Bho-NLYO`y)ZVME5*AysL+=>)PaVc8d-HW>hcX#)q1&WvA z?(R_Bt+<7deChqX->jJJwrhJQ0|u3#_$8AW!k03=;Ky_ zw;N8hrMj}KbUXzTbfbXNx}~o;X3ar5o}6|ef>eOeR8BA^K|bJ;KB?}f9a@OO*T(}U z><$UN$7A4PZbHvgoh?^$9(Una42=aoF?vE1m0(kp{drH41p!5uZ)Hxl3?%K+Iv*H*3LWL7sb%N3X zaWXFE=H?M)8D)Z3ag?8Uq-;2L*`HayUXq(!!hu0-s=_T=)}7i~Ft&#@yrt5!U*H;f zzr=_oJ}^BtQ6c<#6ITJ$PkWp0g#NQ!UxVQ}T|KIwHYe6@CZL^jOq&Yk1tF$@g*rp5 zzjiPv9t3(wQ=831f2Y&O=zC`yJ#>yA?eB#U-Uoa60V@A(8BO4OlOkPyT1GuNnPp?c z;r7^E+WSwzl#^Rb=R98#?T+nGr{%1-kX0pS7}Ac;bCBJe?c_52gqdW>Br5to_H*pHF{u7& zF+8u{ld7E}=3mS9?O$6f4#>nZatY`=;F|9!mATmtMQU`}aO6^N$2Sc!8T#hBvzh13 zBLj10AKdLlCU1ZL{Z{tI=X1L~!)by``KK=ih2=_b*p+LpjO2S|b~d|U+0?-#pvXbd zSxoMVBtE=p!0m~O;2Vk%X>)eZaKGVB>Ir_U8E(CvP{%RD>kkd@k_YiW(_&y2P<61{e5j2EPt?e z5vO!TL3^1Jo|B{;G{GRrf(6*0zkg8ls;J%w3^a3###wx#&wEYI9XcbPQkwviwJZU? zvY$3Zb0w~t%0l;K!+P95Z*P=_|Q)` ze>Q!_)uo_>V{5Y}_E+&YyT&1mVY;Gb!oidG-E)Dj#qKnDqAziX$cSXZ_nb~XB=&d3 zemXxzx$V*fGBO20h*=*GyH#|+?YGhi%kVTwsVYA3U{@l_f1s!B(+EmV#=pfHe78)pvZFi1n}9b&hO3QvAgIJ>SFl>|_6$ z+Lf=^+=s|z&2?-gW#vmg?9+LOSjR79;qj`?g14TRmlrenL!dm!F%5yb>u;dY(`hVl z#E>u@=eEsxqS}7FSMUREpQ|M)gm&v`# z-}~<|C=Ysg44SEc&DiEm>e^g?6?m&11`vtow^tab34+p!LVOXQ5H z{$;=aHXSZQ{2Ua8>Ay@Y^t78cln1#R1UNuKeG4KkZ?W?i&>jo04v!80uQQJ}=Z1Yz zT~pJvJ<$y+-G?TQYGnICXvfp@21r}b@l?wPyF2JYu!L4oIZe=OBkX4g!><3cM!>XH z>)et$8q2Z?Gv?iPV*8>>#YHpgZlOVTrHg4jZ+7?kl-zKg!Z(Vo>Cd2f+k{~46<)|s zQRe(TJZN#ugTL!N)s;Zs6Mgp17%;+Ttw9yq>p*Glsy~ zd_JhxF2F)YiW=+cacWwdl~n;{b5=cbSW4Zc1-!S!RAYx8^RuGWV{(YO@bm z(c^KME)7a^$I!z8eB2DMy`0+xDnUK3mo7v2pq{(6Wgy4fz3#1lZyeRD;6q9o$mb>= z-gqcl%?FpR{M>v1O3;@7gE!_W>&gp<}yW{DaBZ? z%`aP>8P{BC3h&7LeoB+hQ9LND<9g*zQNO4>X?-As2Gl*cq6mLN<+u_`)%(3-T>C-s zhv(|Q8@l#(Wijf#rM*fenD2h$Mwdq$L4*7; zShs~Ak}zUwY^;hv-X71Bi2$(tz^Jp~sb$ELnQ8YJry7}e`I=Q3pdL&q@|bdyL)1T{ z%rI&+VHN7N@$c;;lf*-Xpv7jFd)Rv=44{syA##wq9X!q@5mK3yVAr=wN-*~cX4jzY z3E-gydRoyk&EN}gqXaS;xSK?FhV8R zNi1|_0H=(~!7<#lS#9&Pyu>wj$m0GO#>jp5xX;Ot9X*cqZlz9(A}>-OR=6goSYL(P zG+R3Hf{xWfpQY!CX5HPd)>EO~g^O)Kf5E-JIFFpb$2-qkX}0Uf_*0w|Qpn9-JOgN9 zWs%IG{olJ4enHp`8NiOSH@DW)?;6)X%!EyCc)S`^*V6}B(^YG9jCE|waSxO(8>xz+ zqIQH3*@(TNZhTc3iYFt6iSvjjhFus!CU#-;O*OWMgq-|gW4^6%bsd(I`JllZXs2y% zcMO_Z>=b#J$Xz>tH}~Yd?5`NUe>(*>vUv=V~j?p59*B%zHV%1GYocmtf#+sO3Cv zx+TpH&weDOnvTg}w=;oUzkF0NV`}P$T8E6IJ?eC$t-PtMjhKz;()7n4UZ00%CszfA zgjz0+yp}>)Jkw?rZ20dgfj< zS*)`J`Mh8=$%M0wPYP(jMsHXC+r}+;vz}(Z;1YtJ2a{A3n+axS@-ms+-3ArWPRjpo z5!ks!a`v{~SL69a>F=V#H*PU<|2$L~U?*2b#)(bF#iuAlCGb%!x(?^&-4~8gamfq; zf@))Qo9r^o**~>cThS>(5b_U^)CBR+;cP0HN~71mj%)Xr;W?narLdH;H@HQ51t4?V zR0py`9m(N7AI>!u@d8iHf%2dX+@9dgQ;^q-(r)qn8DI)p7fhJrDgo<4V5oV6u)!gcmt8)_i)hmprnGW-1X7a|0TnWygX=O z&h4$kR12_IURm8xHyVX_**W%2mbHxRRbP6FnQLLw522UCW1tf3zrCMlKWNHVHto(VfzDZLKCXyrBz7QA7`}mQiSP#*JG!+vn(7N zgS#!C$A_aScLoeTPl$B%=)WM~MH@V!R)X<+;wYAc2){7P-)cP5_8`xzY1UPkv()AN z8FT)EiRd|;ZSahb{72|{P9n(bzGVsa6XWW|uogylb$kcxfVLchE+OpwpZUP~z1uis zWaK&(rnDg1Kku_{&|7UjV0udCJN^E^HOs{>nX0MxY04>Lq(6P%GRO1;eGKfvm)Eu< zpRO?C-Sc^eFw`+KLg=~kIcw!c0DpTwFGE1Bl)%=~`x0|f7!v*YU-ZUPD*bl?%>kuM zvjA|3b&x4&nqQof(h1iP9pQ*^AzyANdWwHv=s6nY>P%@0dJhKdA;=-u!uJ1dmd}qY z4<`CDq>+6Hij0Oa{h<&uRTburXdDE&+St4hC@cc@|qWkuHXYvc0dvmqvv?rq1 zMEgz;0}VX9M{yGq7=^&60ubalv;Y-y<55C|aEDSyIYqh8)2KVLrLU%!)lBfrl@jc# z?)MEdrs%o8YFuR2G1HEVrQkES3?ao=2G<{@KcbQSeyV}^a)%KjiRJy zViG1dnLg%Uo9eaz@%ZVQn#1DwwZFtclYOtB5iT>2E8EB0G`LqE`E^zGmj(?xEkD@g zooL@Z?73xY6*@Y4T7sh30k4ZliYGOYa&!9osBe5D z#FAb|`~*9h-{@D2>*MDg)HskI=sOZd4-J=w0cmufSS37@KoDCRh}pqMCHbv+Uv6R8 z^ELZ&|8pcn6;W0Wt!qLVw`(LBr1GqJF40(C-41Oz%5*(jfrUB6j%?k*H$yT~7Yb&O z&|a~k*?DyT@giwV-&j;ou*~1hI3VLmZB}AQ8psr^q^lMng+0EX25_#iQZJfn%$U=< zS0H@XePW$G<&n2d8r?D`d1T&Mwf2{YwJ*)Y-s@6#mobVN8%FgKsnl!-jaJ4{4|Ta5 zGt7&k4kax&Xu*N`?`%HKOtJMvbXvQH(HS4-RA_z8ilPKBZr4a}^cN20Mg?v^dG6$T zUCt#oKSQOBHrHFiflM))hF%Dg#SA7(kgt&KMQLRYD}F_x{r4ql6FtG$T|q|mfK~*L z!4*piEYL437ZHDSrHOT{ctbv_7Pt!ZqqjI6@s1=R< z<%|)+hqtBnqJ~KB7O!u3U@Uh?z_FVH&-y0a$*??VGTP?gzLG;7aDJw`kam(pdFS(W ze$eh$65RCi*9+z6@BNG}eD2dNLH9)9775Cm)8l-_)BM3ODahmF9H+Y(NU-tbvKL>e zU}_oR=Te-wfDD=FK$HWAi!3XafD!T^w}Eq#_Dx)VS6{4}u5)9v60B}qhP;sVw<)`` z*;EqtFctpuTh#=OkHjF*mi2u0YXr=Q(!M1vKbj~LSn3u z8(mf|v;bT<3R=+uh`B2Y1}PY0Pzh5FQFLOTcO#BxU86y0?+29JLUb(CT0p_@cr>c&FkFO@og^+Lg;3qATHG(iYsHEiH{lojIJVSUjC%E z#(M|O*9d7e8lm!nELlTuAOJiR&X5K4C#6DN zIDPyYkT?6fq(Q0zU`i8!#-on+^Fl?e94}gGUNOC!^`7w$;Ung zki3^Z)8_1CGj6eKKE}>oUZ3X9y6!cnYIqC_=ds{C`9+!A^8|Lw7ecT^nbI0 z(fz$~$fPNwPaS?C-ra2Ww;n=qJ8|2#M{R4x*ULaX(pBNR%e3@c@tTv}lpb+?_)|jB ziKf`1#$nj`9d}%vdJFOl8+F6iNSrM)!$S- z|JB{4nkCQco)}kx1&=N+R-R&&h_FWZIr-@7td`0iq`eBIhQ=c@Z}b+?ZB7E_u+L-`;!+1=-}!oIW^{C!s8M0*(Ry~%zh z7XgvwcJfkwFJxLK$8&i@1~qNF_1U2>!?dP%^5qSqZB&8(lf18xEhhbi03N9Ine_Ht zH{hoB7urJp3-SdkRSdThX=IWSnfqvUf74QXxarh0XZ?$4`)&V=)&dV1LoS5YjGlKV znd!m=whM~W%m=?p#$JDIsE{Am*@*jmU})rfgCCb$<*i3@!X2!|335Oi+3R`Vu)M4P3WWHWEe`Scoi2{W z+NplSd4&yvRM73aybPV#WbC8(yE_pKtd#BV z?Ae@N-++7AXW{jP#%e6yl<^9zed{0*qzA~cV$6mq1@vi)JH>~h<6PyDVa4j^-=QV+ zvQ~VK&049hs=6)zQh%Rby2ijwGnt!ZqlW19;*&iDqk{QBHjAISs?NKV_t7u}4*~oh z-7UYsgKaFguB9Smn#*bl-1uRv zT$q*ofTA$laC36`@oF5LMS~qSLu)VCNd9JrN<#e-TDS2b9$r*6g0AmM;nv)wvZqcX zhJc};fyqvD3PU@8quF|rO3iMW6o>X`6$eCV@vpo_9QPLeBcpy$)>&?%$-})0ASbl} z=UBZ7{YZ>or~(50o=wgfly-Vrh6(Cp>RAkX2H%Omij;U~@AR2C%go z;LrTh*B_=}ViYLYlxLvq0Wz|qh}{UoA28;Vh`D*S)LOk)Ii3!srK7|aH-iIOE(g@l zq}S=K0P~_Zo}zJ|xQiGM+(?&&%J7LMvMmfm98LuM0}3vQa-D@fE{zlVuooHsDwp8F z&QiT0E!7h~<9{Rk_zyo>3ww%>`{fq->#7i$e-!+>bgF7-#PS7W->@@gHU{-5*&sS9 zipv+W?PE1b7D?;=I_~9e;_)2Q!`OBG`PWWjd}3NcU{JeQ%&HRxJ%!tw`cdLyTx-`q z6GJ89^hS5}sVL?|MM~#-kn1zsX^)+Fr<)1Q?U`h(zUK;rIvBhz?WlFW>c&JasINpj zJ?w}f2P_A4z3kHLy@hB!jp+Y6ipyMf>fQJSsoykpltQT$@c>eR++MS_?uZeXzc)QE zQgT{)nW84phzMW+!BMtjc)2=vA6fiTxPrEz!@E#|8o*3VUuqri1PLfTxY<^!5gkCSufw6Y1baN=eUK!?n7`@qgmmAvWDZxZ zl@0Yg@2MXbHl&T0WxM)Xr3rVpcG(JO?WOg6pDw0<8H?Ntc>>ga7(_;u_>*M*e6=}` z(VOsD;GmjCJR#A;E4X<`+G8`qDSb0^l^q&-K^DFfk_#y(1BYr_NeojCO=e4sNt)LDGnTuk zn3FsP=NX_;wOsc-2!}C!?do?K_tWQ|ekx31SX2Qw>|L*m!QZ!6+NSz+4K26N&?lvw z6p0S}Z$Ch8EH$J)YX3WR$IT@CDx z>Jc2R9mAF#(Ujj25<-o<)dAaxuRUZL{EfN4>~)d9wPOefJXS3=DeIs&IZ=gmk8yXJ z#{Cl08?7iK9P1MIJfb?<{Ph-fL|aSbTmwS{qFBP>jXdUu@YBaw;AZ*-S3$DxYAl+) zZ+U!QOF1iS+YjIADi-~6+HRNgbnS_R_uG4smr7jP3{!gpSw!SB-d6yS_9%rT^;zQs zRR%bHjpL-zl=CK8VA*G zZFZgfzhzvoI~hP2vX?{2z#1!_@!k3`#hqE0C_+#Lt z5DQQQ+=M9uT{D%&bXfwj5B~Dgdvr~Pw3+)S7(vhV8GZN`yZgJQeq7d5eDP)=F}3X# zvQ`2Y+A{~ud4b3SL~pbq{>^wj(y4aj&;GAD*|C^ zq`nhq1AMR$j-1Yz<9Gl)Y+b=RgEu#y;mljtTX_9VE_c#uB*BQp0J}Dc8PSopG^Uoi zXC25g!Wz7@>#yQg<#d-poLC9o(&Z%tu%E_9(u!G)lE!420}73vBRyeF4o<5TK1Qom zs>(t(j7iR5+A5om_U&K`HALswb^>dgXmofA+x&fdu??^GLTVb^(jl1P!Q;3~R*uy@ zUzcEn__&&8MHOaSp_w?s+``$|0;;NaLWW;O@KTLHxnGwfm5jpY4fgd9>vLUgB((|h z5Yj)TnUC=daW1XbYuo%VoD7C9UEF2R1H$Fu;V};HxbIs&2N%_t5N>!LE1bD^EB!oc z(`ICc)S>5dMz+J8px;lquJi%Hus~iu!Yzk>WWQ&tY8u(d$eto44`74%KVWgM`+WRZ{0>vLZgOchN$1wFgFx8zuk38Zx&q-u-VdxISNXf>)kOeRFc zL^sCaa_n6)oo0iDl(=ZgK=IMqhexBP?^#tu)J_$rumI3@QTOR&(J$6$gQO&#MO6PD z2V=^%_ftM=|3)%HA;=!h!vB_j_HA5Wn1f}})a3KKLNk$%^T-^Pwb-@(jabrvI_#t% z^2>2mcB83$2!{F>OXK^qR{pzDAC7YOk5K4Q!)F^oxN9EG=fjnfNFN&JCenO`+#sVx zBeu)^zVNwpqfK#oPH8;^gU1JEnd2qwXT?=wQq)w>ix<*m|37SxC+818Zc%!dn#A3f}KodvPYf^<-RiVE!HaE0p4kWxAsza5|} z_&F`OLqn#Z9>;H4_jaF#ll|(;xGQqU$V5BEdYeUDtGU1HCff>*!pXtnpjY{K#2!9w z6R#l_7rS<^MaJ1$1bumA3A@d2V{t6jd>ukl2B> zd``8;1`ruR-0W?oeY7g35tSbg5|AM|M>x9z9-8Y)qxFt@5e*KA=2e?9NJ^!9nj%E? znqXUe$CqOX^13e*oXdNmY|8rP5S3F{JrHz#n_mT^L79ED-a;!*L0?j}(w}o1b^2R5Rpy)7a%}0j5t*;G5Pc7A}LDM!0KnA@Gp(p~~z#-(ud~p@h*i zF3sZ5V61rIVpWFWCt1~o(sd+=^~t;IzcD6ni%X;}EG5I>e`NXNxeE2X%EmP)h%`SX z8{6?pP#t`uXU)rG1NyDD`yaq%-E#^DavdsTChxoYQn;P_SH6>e>(U1^km05qcB`w# zeonnkqh-rRWqt|>9Pa=(fH9~@`r^amy2gET1l;pdRjfp`4{JJ$15$Kngcn|KlOw~w zzQ{n%DUbAxyp~g~ z3pi04i%*4N%T;PtFIC{5bJN^ny`NUoebJI z1HNSZINPSO@0L{LA~z?8z^p*i-C}ljbeOaZV1fmL+d-CtA& z6Mos`zUw-K9c4oEar|sCvpzcfXeN3}E+BBKpG8B9I_FWN3Ma))AE9u{f)?<_^nD4B z3fe`&V$AyaTMLjGl@c?zq2-6sG1vXWE#-(ca7LfV?BijU%ShUfWRmn8qgm?19)=pB z|4+)jmu8};!-f~eC&bp6N-$6G(rgb5`yM%#Myj7vI%hWm|Aj$?K0{qqLFCI6^!iLm zQ^flp{Co*EG=Qn<1j+S&gI`aE5s~TgU_Gf;&hNJ2)q6%2+c*Yast=VPW^5_ zV|w-}9!g=>MI)U7&-wY!HZ;6xD=R*eb=pp;$#SeJr$qTlH=nTt zZelu2eL-=_>^d<_i~gy8azpojg1)sL_B>p&+c=JhhYQ{xDXF3fLE$8lt#cC7|CRUm zg3scE+6r!j9aDog+~6tc><^jf(~lV`e{{aUub02!xTO*?Em4`eCx0{N9t@rHWaI3Mhp+_k2@!r ztG{e2X?FHp@spiwDv4|hY!xjG-mARLbxtI?=Qcl5Rw0e_)ud9hOY`&kMzXYi)z5$R z81zdYc2|Sts-KIL|sb0`A|2?6SdooE-V*#u_ zSMT>F7+?S!I|Z$3TS}RFzBmNGr3I9m3&VmBLC0b+)r{yVo{x@oZ{0RbA%-7m;-Z+k zBC1NS4J9V|z0bLFDk`p>qv_9g(7sw7%zxl2o-xDwK(03?yi2{+dfju3dlS%6y_C!F z9qo=DHjaGt+CQh&Mo{rSEpLgI%GV>MSF%hrswea35xhtOhO1*JTn_yoUo!`+fzM`f zWT&R&LC;6-!+V8n8?_Kpy8oPjki1I32xn?fo&#{O^o6M{v*g{II{7Jthv{8d-Z;!g zc<$F3cPpf}d7*9zR*wj`9vXt>L0m$D7+`dy6V1HmhOCRqQ|hXO5F$#6eWy2lDf`*t zBD6cp4sJB_y{_<5`a@_tg%jQd#G4gv8uP`!#sL2tR&hlIDif3cWL!i+9cRQ|$@}+o z3|CJmS=r*3baU@Yf`uv2XgM?OMRu+5afnLmwbL;7@KJiE-JqH5J0ice9}l=6b7J4r z^Gz_bwHy=r)ihL)xO|bkCKrBmKCs@c{a;SI*~3OE#m)S`tmYH*Lj9tzYU~IvgMnCrZ64jAv^7?Y+{)wn72d2mtc6dms9^;-KJn$Pk=pf z+pWq9i;mC?I1^(WGxq&{oSBi!v?}XU?WF)WuX^_V3-zWtoeo&~f9KR3i5v@ZI;{WWcWU(C3OGp+ht!O-Zo9@$WfP9x^(J%)Bk zreU-RHcTwKkR%!>9=g}z;bfdJcMTu)B2?{z%())O2r<4C%0jGOCy-G#)e zPY0v86%0B2U+>P<-bFJzh?ZKipLe#XXqG4Yo}O`n2S917_e0c$+>>*h!pUMmjm$u& zj;BBUdCv3G={UEtnqCNS!;w~ze;bj2;DB`Zd{;?iU~eQjcJ91+?Jvj35nJaGjox#( z?Q#29pVLrY09=Zaet!CL%&bJ;z`);iUSo4sF5^FB4iB`dX$KlOcBip2YvA56h7< zG=ywMqkQDm75un)p+@6wDF_3r>BmHM966maCbyOY(wQ3h$TxZO_(7hHmszH8uIP2JWkX|t)=P}n6)jaQB0h8 ze)AUWT>**Q2jUmgtib(Jq!wh^tGZ4qy$2WbHP03U!OZh(Grv^+xWVV5$fGvbvY)2j zHKxzxqbS@OA1S%(x^Uwqz1-V;I#LqY8J}0XZ`gaEKxqkWRaL#&kJzP?j2*!(tEiCU zrP+VqE&Aq<{W6YTzf4QpUkG^||B2%t_p$0~yA> zaS_>)6^VCDEUG@%>fbR8fHQ#=iQD}h3ed*tuFZTKyhu5oL2+nP=tWf6-!xDZq6yVo z9zG;(1!<~^(cF}-Swc)qV>JzpBzAeHjx<{rTr_#Xz-w0RhHg z>o|%%ge;sITL}{>GV-9Y)|)^XeD1;0eg0sO{tuA2UPWabm?0BTr2Z4nN+@&%8Z>sC z-B^*3k%h(f=|rs}_fkRFM!}TfG1W5m;t8cHGFZ_d>cWkil0!$!!dezmmsf^DSiUeSoP!Jz!EC92n5ay=treiEpAN*WB2#P3q|e5 zf5NKmxDph3I#NAI{vxWO@u9w9F6L(XN$Unlc4UMeja}?8A04FI+$Hz{L_nF_+iYJD zJm-o*32AH7xSfh#t9)r~1&=|MN?57TMzPY**W1o6mceCQp^AR`2&4-T%c`bi*pu&? zovuA-1oODdr~xr$?;ULZc=~{1wINR*783IQF=MPf(`(%411vJ`;}T45?)%sLVG-W* z5sN=*$Lw-uUomuLKxhQlbH_8?>I|_PoM?(6Yu;-`;7`F*O-;sF-xdlZeMLtt1BJ7p zpQ=IDOjh*Vq5A1@Lu-v1Asc-m<4Fvd6!BOPC!1D7BlP z?yjf+&y#>1;EvYwYGjVyVsRmG-EVyAGIg~9Zc)L3<~4f~_y7{kALlVU{;Pg`4%0yl z3b)6^jF)pgQ-U~hzBsH_P_{2Ed^BHxtqbCOd$EK)MCHNqiQaf`|6nKd&~U3U;`>{b ziVBh21_4RGW)DHJfAajPJV zG^%3^W%Z@G@Mho~_QuQE8GI$xkr#WayAAv3v8nwCHtC9iN&wOu=n5-TLaa1xUAcY5 zWh<2^PHLIB{J{4EI#S{`JnM|0vVon~o6T9`)Ha`+JX*SyIG%8WT@{fsan?Q)lruUB zgzF+2n$6tZE@gtF)%La27fz1#VsAe~Z9y;iiMgrPIm|Trb2&deET6hwF59G`jiKyi zqW1o5qjIAZ!rcs7n}3r)cH7e0CE5G=R&bMFBb}c$HIrv;a!@|iOb1452|w}at+>!n zh_sbXdrG%O!VdWmRnD|)K?TrN2%zvP=_3)6&-uV=IPUvSRjztv&O<*k#o$D4Z~jpW z1xcfBER?i#n&~d~50)K~Mv|yqNx^C=;8U}gWAhvHI5Fts3(gOns8TYWG|`iy&%oY_ z&(4EJ&?l7^3;N1VaLA@qaa6atr0!t*>Q|sS(NR6E#w#+IW)D zHRuXj6Q}4t7SWD~qkM zV|bUcg1S`j@)5pC%o04kV_s@sb4_xARU8Kh)3-v2q0w+TTE2{rcjAh<Dt*&%}nl z1HPRImpka}rr;sKR%h4dR7Hi7=|EKK;o@xZ9KI{#@srs;RC~m*+h;nw`f6T3s}J894hRq^7Q}y!b^> zo9aCFnlCXL)7;FgAgJ{yHB1!o>;zEe_DK!IYSieifRII6O;G6nECNF>Bf7D>>KeGz z?VP4+s)A8kJ{EMOaK3GAJ3|7POZH{$Umg+{IsbKizaJ-cknp-(zY~Y4b)Y;;7~yy= zUh+JM2_?9*PouJ`HmP(;b{g^*TKlRXEcjhxl53$R7)wI8R8T z5|#V7#9PqNVZY8-p7%hSxR+8fs~^OHx%g(P+p;zBKyOb;FiWu?lO?+|gW}%&%SmEV zW}o+d=1KuB8-G@J-9n|nO=3qM$!c{zZ4->K#LRq}R6Drwbz32|Y~ z`cWv{&Nw}HoA`cOU5Vv*4Q6W9`6A`{o&fcx3sI1%JYO03UV(wtuVnasUgay_yqbaxk#kcSv97Px^S9rV z_^OyUuK=^qaK6CAp2|4OdFtKH(l3=&NP7fZf6m@MGTrWh8TC$LX(xlC86chuhPU%& z*pyDTO9`Dv%j;6`Xt_(jc1WXDocRd+Y4_!JX$CBf*EcNxrEI6@5-*;NNPR+23ch?x zo)(NnVCRF?G-`aY6bTo)arv1L3XI_z{*r z8C@!9v*bv6GA59epFN zVLfYI@;u{%D?s=ibh*Ay-D$t^kDU@IsPu88cocft!{@je(>~b1m8LKrCFgQ|H~Qtn zpge7@;QfNWGT zi!{_{BiY*~+NW}9{|Xkv^P7~0qPaQGBA3i$_D9Hua-w#=TmGNVJj52d?M_WkW&04WRS&#DZc;k=dwJvwIKU z#T*macyB?ny##bv{w=bZOF%0Q^$bDk4P1nj&}gSXh$s^U-8Mt@h>>;UN+g-sN!44zQk)i<$soo0y5mUrB=UsI1o=&j3M@Cc4Xm%0B5z=ah1-os&rOL_!9G(v@;qTW;qk6EE+s1;i9wE+$pRF?cV{851U|S zmAlw`@?c%F6ZyCA<Jhy0dlvqy1B!02cG+gDn*2R_4;os^YJbTiZ%F~4V}5S{tK89MQFwO#SX(k~dyz{gJ- zLeD68v&a1>^bjqxwk-z7w>?|LKxR3wJZgi>h&Z)5InsWzDK-eC>U$0?eJu!u!G4rc*MTdAJ*d zy>CwDi!#@`Xr==fXKPw@J_;EdF_y@ooY*6r$tmiY%SaN1Uky7Ir@OpbY0sz7`um`B zCdAsVrD>dRx(}3_?=I}XN(fxXG0s1}pR?&t(Z{a15&>SA3$Vi4kUCR78yMgst1LG3 z4f#hz@S&+B=uVDDJ{@P?r6-FhB%0_I4D2DM$No+Q1Igz=`hg%oaTG#|1Kh~16!e?* z9`?HkYTRt-FGA_msARs@FAmkFiU7Va;|U}~L$9x$qjZitY7&9YaX+;Cn8If*e`q+= zbqTJ*VnX&JKB2Br3X|?fpU!~d{k6c8ELi-1yRCk*gpfy88Ij5zq?+s{BAZ-|Js3T? zU_0F-*rCw!Rim79_>LM{w0t*Zr9_DDq6%Fjc1in8wm1dB@*BM9uPAgYH&Bl(jk0zf zRj@Glqpfwj*D;98P&wc1^c;L6%vWMM&x=j_^%FW>g9Z(#$`6u zGQ_mLl20l{Q~XO!H!e0dPPnmOQE~EYRd>xDzq6B8x{V&2Kn0BM5=0hP&aCBEdZ9$! z9?`QKp|#g{=guF0X|hrr&igTWuR1-Bj0@8h*VJ?lY?CNG+NjLKb=RGrp-Wc|A~ z#J|HsQ^p#litb#s1xIuMGGEMxzGr&DbZB-yO2O7&1F3EuD4nvZu*r^dHiqcWQD6@# zU|X^z3`%lb%i$%67TI5Zn8TO5bi%R-emZka1|h0z2itkWO!7Gr+;`s9`zYzR(VgOU z)*tg+)u2eEsG47Orf}I$`m6$XVoAuHYIIj4gZ`L2f)6H73{wlMY404cAu{D}pn+w^ zhc0mg&TIq;+@2hjU+`2KO${BT=##kT1eyv+37JRvX^y2$oGB01L6~A^LXt6gKZm1s zK6o2-wRYSgBfoj3fD#M#hPj}L32G?%VFd=E@|1KI6cP?b;A4w%-SnxmdB?{6BF}g( zzOXpnoXjLb;^Y2azDux<7d)aq2zR0)vBxDV=b* z!kx|1bB*ZYm~*)?k=iI_X&tC$(ZQwzZSe(=xd#Qdq={<)>W?^FCtPU|P>Z@yNCV9p?W1(dE|veGaQ7jvskD zN1t!+y6x5n{fYBVhZDN})>is#xbi&FivBrV~v(6;+k zfbb+Vnj>^LV3%XB?77H9TNr%4O3Ym99}LNLmk3bYHAUFk|GLcsEjzNr3}V+|I&j&FtxOP z455Qioc}ZI4XNKtxppzrZ*hLs2U@|MX7Qi(L2*5~bw>kh%J(bC@_fC%L)llr&M#veRo*1IH_5gt(Y(XM3Bun{a^g6-6>b0gZ7LFbJ_7iq-X;sxFN1MucHM2AG!ZeWmTou^nEYAQo|5@;c znu})geUK&+pCU}S2^vMuJNLX7VTu@v`eJF`oC5Qad*K$qtf;U5BT*YALPtzTJpRyz z_^0o*)_eb8zqqlnUw*2NOkHTj5B~3L?2__(lauv9SWQWqf_WHdd0GNNMG_y!m6k?K zUM8!Lz>5eiv<+I5gJwnpF*g6KBEmiKyk*EmT_a$>2}M|&Lf*VTbVmDpr*p7o^mpkU zkS9|W!-hl@a1zz7_UehV4(>6l+PL+Q>uW5vGT}3P?Lf!rSB^F2>XN`srXH z$L4cevA@V0Q?}ltWdE2H9$;GMlgAJ5C+k&Jh~ja@M9-m&Ld-*oaX zAM+53b99*7P-9WlYsJ6bbA)`bq*c2J@7j#BTD_!m`F}LMWmuHo_dWbUq)SA)gc0eI zZs`V*4r!#jbCm9oE|Ko;knZjj2Zjde8it8yzW?9#yqy>4y62qx-utY*)?T|FA44Y3 zl7!;pkOz}{>fB_8n|15*qK>6-^RUjtFRh-x+K45hj8_{F*P-;> zaI3O1kNF~n&YW!Pu39)f6ZdWd)|y$DroE?1#q%FZe$Jqk?z@7oJ1;3HjkRZ@g%<*` zj-^cRY$csZZh+c%N2ub_sx~1Tbt{`c2c1Awzgw+;U(}je=i2Ssd!(%3V!A?=TCNbYQv#{PS4;r$6g{g#lpZ9&SI zNYb4su=)V{*2i)qoFzN!}dpTv0^CKsmscKHZS(1d!0nQ*#>7=c6GF9}^~s3&a+ z8FN00bZX~iV(r~=jEnvPlnWwu7-HX zgj|OY&UyQSxY-PA^BInz&sy28Vn?iTaO&#IXn&0g#$C$KpA&_<_0aJEFIo)37(Xge zlND#MVUPQK^v)N|?sWZDP4QHxW*;!Nt@BOEB#rGGqYoVqjZvJy8}c?`a0%JErX@dJ zv9p0Gt(Z!il4QMyfOE#0|JNNKir!}i4(5kI3{b{}$=YMrS{GVKEQ;ukwvx+hW8uih zHWeBor$8U0@uG+E&~^ty?}j$L69F#N13=$pDf6Ni!V=6m0FC9%NJO9?T%JEW-pFQ$ z-ab=%*8Wc=$)XG5(&Bz@x(J{#X_jL7TM03|*mqhw;-xZmOv6*m-Ls{-ugQU=RHV6& zvonCo7pGsW8a{2QMd&mYrYtRvTwXk&!!D1dZo~I`n&Gct6^uO4Uk5RD^L?03?L*A} z)oN5#zSBV{AiH7p$wqKxH%a}?CUi|5$gcPuNN6W!|?5{3&_Rk_g4i?fY7E`_0nL@x*;G;4mfxs}kdq&Z zL0DQ}24E+tHdx?dX=;1o6o4v-oLa9pM|V6IFtzIx1QH0!AC4LY$KLY^=FHlxEo5lZ z?Yt!Pcerlk>6=h1T$!v6(5!dC>~$Y@kFXl5W?S>`O-G6D6a}$8{lY?dl(Pg7YoL@+m|>A6ViIcbWECI(w%Cak>HDVF zMsq6vVXeu|cVO;odG%oYATc4@D0PVMM1cX!anjI5gH9zIfO;<7ITjaM*7X$>;Oj+u zpC#wwJ1I4Qlk6kUPLQL=Y2GI7oG*rEmf}|GF>Fton&qqwIghEt+=fyxHqfsUM1mJ=iK{2j?jqH9k{kir*GzoIl zDYvMPvlSSh_Y1%!7KJHnrYB(nshm!t`T!!kT_b(4eZH#C$)fU5+=01z zkn(M^ZPR1}~F!T%`?zkiM z@yLO+ysS#BvlPY+y~KxcW&&xefpGwh&fxTQv*5W^_*~)*vP}nA3o+c08;pnx>9VxG<7Dzv=#MySgG-P!zFHV^_Lg<4}hHmp4W^Qb&*??I~$NWCkO4oba} zwxl?%(!=>IMouL`d1^V2As6EzMDpCww&kvB(yFIJ)r(onga7HlP#xcP{gfQ2+yMYv zTVMT&q;B$LU`tP6)~x8{nyYwaZtAgfnl+b$wQ0IGre%=j`-V6ZMfa;f*&{u|-~Fzo zj5kQ$X{j#rK?}O2yl8LfZ%=RJJQ@@N+4e40CO&yr&JoOW8^f&gAe`tlnNBGUQ}y+E7qPY;@{$bSrW?b~i7F z3SY1-5`?}F%DC!F0_;%bu^w0we6_&WpQFaqu?fUNqHcBX858*gDR}2Co`KY^!29f* z<7t+IK_)Q!ZKqz=O}hZxw*uKruwr(<6b~R#cPx@@GewpIZpwc{G%b^5smPNmt?9~- z9Uh&gIMe&K0-mdf3NrQkX+}}a9c?zQDN-32#*n$O=#put!)W${P{mON=UU*uTVpO@ z>-cI;>-}ho)$!1$7|!#kO|xc}AF08hB_M6YS_2T(=v&3KqbcTTcZ#`j!n%c zoC*@xIDF66x_27tt%<^Tp=x8#WyQnxH18GjSnChaEiFdrs39Ed8Uo<_tX%3aS20yy zqEn{e@+$M5K2f{ht^T5iXOMGaY^jLq=`Pd)OuZHfZmol zf8zhEFY%tVD;vzLoS1;u^-k)G@5wzU4C@FjB>>=>_;nBHB}-5yyA^A>*ppdxnVv%< z=4%&@>Gi#faC-Ld|9cc)vR-`AW(Nn>@-nuf_k{m<4Nh1>g`(K9L}lX{?3}5J{4}I= zvqKe)dtNj7k}&li(Az6D{EREKuM}#F`lR)cfmf^(`xxtT&(w-}FKe4SHC4$rPHc+k zoqfLXt_Xv5xVS|^J*@85h+$Lx%gf7oG$P=lxA-uf|64S6Oa00!HUYz8XDkjuN}M_3 zg;8o!GcZfR;1{CavoofO8c_dsTW*+FiimcwErZjUZi@_s%q*o3Hk#rDP{`obAJzK; zs8`O+r!TeQ#%Z*vZ!*?cI`fWu?ed+JtoWHaD~yKS~{%(xl> zR!s$E z5aTb?jT^!qvq=bXuyCe>kxhG-!HrcI6uPmI41|-px_%oPjWBZXM;j{=^m-H7^_0H< zGewwW_3npI(K4f6*1F!6(SA3GN%(wG_5a)u9AEGjSYUmCB(5tqxe;CqOXTK zmL`Yf<#Yv{8@;2njdVu(4d@$hW;m$>Q4NpzDR0Rg?Gh)5$u%KGMXPBgMn2B)kz!OT zfrfCRlxfx-U^~3-?%iBmA2eiZJDiUa{zUU=GKIag zTOTnp=&IVf%>*PdnEMtJt;+L6aNbW$-Au6N^|CkZGV+H4zejA<_^=E0k(A@Sh)9g+ ze^S#XCaqrYV_CE}EC_{GJdA33^C%~dlW}-stQ_8^&LLI>wr+jy12%b=FZhKOdb8 zQNkk@em~mL*0K{4XC!-55`0JgwdsR;il)W`fGK4edEOvN0sJN43-otNoCr&oRKnGp zgx7WThp!3IUcOj<&ZDaJ)tO2dSi^SU3p8*(ClUcWR9oq19=sta;*Rjv!|KLJr7rJF zyeimaVxAHO8}M4ScggT_zS?P7{wi7&wv7pT!}0lG)$q9*a8DkjewhlW%VSro_Pks* zQ-rpx<}J5El5F85l;3~+934jF4Az_WIvnbKZau6#c@!hxHkPPGG}+bwG>F}~gxbsy z9ZDxS_nM5qG1cVqP?t=ALi=iM8`F)iaSgDE%<=8Hp5BM^|IX|MlpnW{gO-kJKHSJC zyE&G=LPqd#@pU9hlqICC-AqBOKf1xHGSNTjgAtSqsQVi$97QiEkF=x~0dHb~7G*i$ z7$O3VKiT7|WmCZA!3xw&)*e$(yK=}nP>1J7fe*$#3zkD_#|yV;xN_=X?83ScizaAZ z3-ZGW%9l3LzNG^5sD0fTkS^KiLLO-sGV4z3aq5rl<;A5EE}lj#xgbao@9qBKUaMRWsqI* zEym*&EzA<|B-`Jf_pw51v}MtAviXGjBUnyPbE93Q7VVjHq%~9$-fYgXPAJJIC=Yvo{57;Xc6W+R^S4g(nm}+qtu&t*TMYMGXTfFzbba-e z$4xsDLmwUyunvwdao9!ZWk{mrOa%8`R@FG<;Cu4=m#Y~|0{->0(-zSh^GbAbDadsd zFw1MDyn{%QcGbYP9&dfal@r!ou#kS04lK@=5m4H-6dYogQbScJK@C5jHpG$MZzOTj z^KDTLK7$q2)x7+U*^x}K_uZ7eCuu(4VfL=@Rs&gqa$%P53F9E;(UP}J_fFY(KNf&e0 zH(YMUJ^XE9&%OVzSYhnctY$6(<23*H_rq=+Pg!Gg5SO$PbM#~7Rvb=L!2oIMWOFFvXR8S*|{-Gs3uh+B%JNkBkRbj z8G8AAWyAc2Xq|BDk_T5eu6K0s2K&9{Up$*!a_q=U)KCk5`!roi~bh9})VP%-l zAf(XH?_|W6Hw2_SeywXUnHiTn!B3gH*5|ytgo7p3M$d-{P$cNLb?uE^Ms!>LnH~D{ z+XCm1%P{WT_YVOj;;R~RM}ot+kx)!clB)9_?`kuRK=^KayWy}kvw^LBobng67eS;o zF31<#TnjHXv=Q(cZXN$})^@k_aarZxdEx(}g<%atTy@zYt8%l-+uFE4%2Q~Af?b;0 z&0Er_S@OouCw-3Rns~ueyUYvH>FGl>?q0)*j z9#zX7GErt-Zj3Bx!|&C5b17y0=7FZ2L|2YPG6%{T`Hvq{w!_XwR+b>6hOP8GExsJ_ zjQL(o^gneQJYH9O%GjuX-+udo&~UsRuNJjk85*N2hfwJw1LKWbdRj)5GSNtVf)$XKbK#84|xuD30C9O5k@{X`9@Jbk7p!AZI$$1H+F%vY-28 z{&h_$^@w35J4^oH_uhI*WIxwvnz8HJ zq^xRM`HLXa83wwthJ@tDXE{Qt-!O^ty&ysT6tMpI&QAv`Y4o>q42aa;Ts+AA~ znL2G4G`O58OY`ZKxvSv1Jofw2x{vO5knZGGbxCbwOHH?V>8q>rYim0jcm0~_rQY4r zgG<7_v4Z3=_)~BMLU$Lv#dnc!k>0%UxS^5ayEQ(>vHTnrryp8iG_!AQN(iqeM0Q?| zkqwQzONnyOu5TtRrWClsqKP8*y3$2&PHlXfVQ~@MDbz$y>{bF2VE`wc@H}A!u?tBMcrR*z zbbFzXHnT-%3-fyoC0zjnxiyALWSRFGfto{<%*d?b`)t2MB7LhrmvtlL+>(jyDuI_8;X z&ZcLpPp02yq^(=@9t@Az32vupw7Je86PE*g^ZuP{AdfK=K)m;n$f$Mk4)iF7y&jO5ZTyJNJ!poU<9irDq=-hdam9FKDZLq0$+&ro{SQYVe9WjpM7~~S4F;O ztov47hC(1D#A~JqS9PSrq4RGz$wW4a@aw3`L9ci%deMe)H)nKPkiK?)igd<+YNGgB z4?Vp_X`AY&VECEd_P;KaHh;x=7pXY;XM`65(Ow8Fbiryv3j?)~x>jzTBqGO0BukY+%75h6 zhhO)mn?t@E*LO$Gc3%r4;~V|1{ysP6dAy4u_L3h7PEq;N;SPO9XARa}RF%x(rm)>oa7Eyo!V3_g9Xo53a0%B16HR?qEc<8%TDp zFqQ{BPxq4=L}nzTUlY50=TQjs{m@X;$`FbE=>~B|(Qqpl^aPa<-Z^f*p5F!z{BRS^ z59=Rb&X2>O{~h`WDoCWh?8VY92&A~wC>WU^m$N1%l98r5Z=--Yre7z2j>SIWeE_bj zsq5aAy0kbgR8~?EFWxk4zCIRKo@=Nsn=FZ&wI$_}hn1OEr`0yvezAV(C`cZj3>Ka9 znhQ#8UNdy~rmc;)!n&xzIq}bc5*7L1gBA zlM$NctI_*5WSU?1Xsyz!|3i;mi@2U0(!BO`U{lmjzY1~up9&+QuShbu)8Uk=XvX_% z$N2tF$Un||A{I@;@-l}NofTFUq>Fbu1N6-9*>TfP0j0+97aK z)KKnPwHZc(s9msFS&c=~_L6HbUEi_yDi^tLFd`wCvKOf-FS&YP5-{ekpF4Byy1&*a zvyA5JBVR9p{LtZ}@$#QXXdqE^k+3)Koga=0U9R~dc$hnMqF_QKyjbZ8iUvFBZS8ml z>01l{jtT?Ho0D4(oqL3ee-!_GFdjN>yh68`cT#>&()V~@=2JYMO*JA`fV+i4lKr%rz2B#EE*r|0lfL+>4jQ{U_am?pWF5|B zOxzDHwP;VQ+?FJvaaqT`%3}x|G4kNJz{{Xl-Sj}TL~%DF4x^s`0GQUh7lCD9a2(+% zl9+se7;Ep)4DrS+7)}5s0uh$-Nq%&jr(1XY#}o7bcJ8>I5IN2rfN`If0tJ^B53)Os zuFtL>!hrqNaoX;GW5&#ncI6FzTXKe`gUnUjUMEgxg>}0i#NLA-?-Hp^fq6n@gT21ox322>VX?_19w)Hm69xC;InrLp9=K+n`kO7~cRb9qA zjW`wajI~r!{7%d!yndv>1*U77>!Rv)wU?GYi`X_PHSK?8@D&Ss!6U3Yqce07 zT0a{SBK>p1f~Lr+&25H@>&of?=sP7vkHy)%e#ue{n0<-U*!2aiFMBq{+oYz@kaOh4 zm$p}ezzQUHfI9e%ylijeuZ>CTG9>`Wxjwm1Of9C-$Dv&L^zcO5ByzI=a^`{{!7?>C z1qt(cQpg7JAGgCw7J6~AzRsP`;gfnKk7y;#0v2EFNk%VPnHg=&b~3guhM`7fpjQPO zr(4il{UhfSslk&{dwDVNGJt68mxXfH%|pPOuU!4@2c5#^{kBk^J!wKlp|19Qlhtze!=Z@%d`89IdO}8Z>s~&VP8C-cc?*g8qvt=q%4tLGKV#WB zY<5A4$TWb)v#9q?LR&Q2R>T#~APZoETbAoE*NTm_R`#)9b9Yiw`5(rLgF}@z@Vv-a zXb2Vd1oB5}a=KhdCsb!m%Zb}RAi9eYm8bD`4prIOz4lNPRWYheQd)ZPy*~YRdUDkI zNYuA6lJE+sS=mSCSiz$VWGYtbZ4^KK;7C;8cbcA?stOo8jOJT8Wx5$#jYv>{7qhX( zG@}@pUt{~{KWJia;XSIz^7VRr1ZbUBCs>P*j-Oxj4+|^-sfyMZh8l;&} z206`S(9lK}=CgqXKqu`u`Wu+i04MIa375E@FV?gK$tHcAywSWm^q_xFI6K&k^v4*u zd$;7??7SKZ+_H2~T=F_>gX378ESiXd>xKh~{>Ix($j;YSQa#fH@xN*Su?mOz)r5~( zYVx4(=z?|(Vf&+Fjjo$(emAWG!iX05)u}6&EMlThM&+EQ2ll{GV&hg7(cK6?5EfLR zt*2CR+hNZsMY&5_^&k5$W`^#id5$Wybb;!~|H0cH^cDB(i!fV0g(2jAE+kwDkaCPi zcl;_VJ3ajRuP?D5DT&DEjxL4?(8`ptvsm4^@mH}VUU4$W@wyUqq4l1Yjr$&$E%WCZ zKpoMy=L>Sg=pGdH*USjxLt!#$P6n>zY#!|7r4}pI0?5uJxyS8qNHV%pQOFMhu=ZXw zfN|w_?21&a+g8|FJsMZ(FP`c$s=;^eZ70A7ohOnl1+Z$ffvh}JjNG52PYx~TGz{v{ ze<$~Aj3U`y!|D3#H11k|m!z2?^~xwohy#!(Jn+D+OO8Fin-zj`| z)Xig*x2w%I>@PI2?b42VyT1wtp8pWvIHkBeNnXDOL&wVyGD()BS+kF=+!t450t}bb{|8MqB8Hs zF1ewcWqnT{JjV$}O#yJf>wHS#-RXkeRz>>5esF*Wb(#7+7j#d?K5y0kkByLpbtF-k zu-(%^i$C@n=RoYJ$-f^Wc&=_AJ>iqy!nb*R*Z&Ga5*7zzAm@f-I|rE}(YX>hVcJJl zdiJ7(xygx&bpB+e_mYPUWqd6XSAglI4B`LQ%!0YX2nUtwOyf@fph0%Ni}Bil8(D0^ zO;~SIl8wUA+vfV^g`^_*fW87)NtsrJOSv>5gYGo{0ZB*1E@Dbt%lA52%>dc{|MtVZ zb{(}aH(WA2TJ}(v;ROTqTkPBsD?c$dAgvTlc6OY={K@-+>dNpFuih?+&G6Ef zI4D>YDQ3pjFS>Ww?|a$lJN=Wq8$AT~_o*ZsKA(U$dw;vZF#^gSs!~{dw#uWJXQy`D zrgY@`I7E&eW?HV*P14Hd_gy*Jz#3y0KUun3u1vXyVV5;Pv;&3RNW~dMa1i zH&GZ)ul7`?^X9dBkdyNr?<3=Ir9yr&1TMref|vhz8`%vLN?mLFSpd#KrVuJaT{)UC z3&V@U`+~^?DlbBqQt->}f;PSz3Zi;dE=242Fj$k^a+jQD_h{VMN}bk6;!cjH>rpB7 zSKm!{yH>UU-IA&Q>)VVPOKY9iArEmNOLL76xVKB!b6c*1|4O~H`jejvkajGq_1t4i zNfMz4G%IOn3!Ts<;`RV>m*-n0@yEeuVQ7nI${&O8O-u!Qz3uwDKbn(d&vRU_?v}VM zHWpVp9_W+y_K@2#TfeK8SP&nriMhuO9bbqb<=5#&Nq$g)v_^|N2> zyzlqKg1X*CrzX*jVe3gr0w1L+RHzftiE_S)Xq)!u@_%R^rH!~Hq=^K<9*BhD;3*!) zPJH=5+KB1RbciL?vEy=NPRksBl1!x09>Tz3mJ`;8IP>TU1eqnbKQ~ecy^F)s4!_zV zsW)GfcpRuJ#=YK0M@DseX6}vk^$`KsOb622fl;{^qUdpw28r5S!uV6Y@Yk0;5B!op zwP*MHIbr0CW|Mx7Q$T2$5m&Os=a^)b@LD-sW|Y0-L`dNACDxNBKXVAPGDXw8=}{uQ z)HKjX&~rGY?#{dhM!?h9$OsOd7VF@Juq|`8W2o4k%&mel#+teek#>_`1+i??G_})- z35_aRpLbE5)q0TSiGoHX<@pxr1F~%$L3Q=%XYG&0*Cgs}n;;7KqZhnB$euDjy7~i3 zkx>m+aQX5J2_6BS7Xmp6-|(PnB;E!p0Ktk)7vqw?*&Q=tLH{Q~Mh(Hd?SM@9`6)d{ z?RvEEVf3CnJZ?pbwp0rB2@sUy#fmEdauSJ1Hka$ zflEn)@B`3-ixsjkMi4BCMIRIPKr=1xw%A}jDue&m>dja2Acnstsc|2D%<^t?J(J1p zcgB{%QkvoeJ?>|XXGt0(g(SYxAt=$z)Aj+2I=4d8@#fQ-5wb;+WTw3oSlXjx!4?x9 zE|cdyQLpt3ovGM{bNmw*rY{BkPRi_69%;n7{4Rc|+4+)|X1P4!MwkVtCWi-yu`u#`N()-Vc;n$JvvmG8-Q z10#UUnYqY-NVxbrgB5X^qir;iEqT6cUz!@0Pj8qO||o zOs39tDrEqs1o6xatX`!_5vLM~;C3Ho?n=eoxUYt66{D=C5FWRI9s6^A)`*>eLwGQn zW-t$)VqSLaKMJ zbKFk1)fRl{0w80eQ7=pCBs`9s)k2UbFIw5?_XljDCc4xNpFSgoUL89Ioy7{8sY-wu~O*R6XcZd3> z=|61PQ}nGqo5~DsD{XY#;S+-_TRat6vOc;>-(eM>n&XjW%2ym4hD)CGLok!E{UY8F zwkRngE0#IUI8zp1*N(PgU;y-L4VmD^Z7Qw}CJJ3fq{yOJ(k59ed0fa4`^CyyNx;Fw zhs6z!-{|NLG+)|!w2azZBHSHh+Khjr4<W0fLj1NS( zxEl5T)=6XBUs^%(4>nR=dcmVoUZA71yhSG>uLf%25cUIRBg-6Yjj0$X*2BK!gJDxN zar}ewjFF>%Zrb1Ee$w(A-k8_n-YM5cs_7zPD1yS3{l;i- z$SpqNMc`;d4clK0bH^q z#p^A{3S0&{+z~^{ze?0jb2C&$ip6+#Twq7k$m?r{jUNAM{*Uy3y4=wj1M!lX{jgB^ zgR%AtVBSC1+WSko+%6m>`YK}9C{FSsb+(Q0m}>nlEY-r$UM?r2a1;&mtHl*wNqez+ z7oJKfFHNdCj~`ja>Qv6CiW5cOV9ndb7E7@=H@M1Xnz?V%!czomWi|z!KXP^diYEXt zqCxdbLRy!LfAn-CDMvnbk9omb4ba(IKiuaSBSr|^@zrgxG^&94IO+!`av!ySmI<+T zR`uEiY-dM*lzS79*PuN0%?6v|@({hgxU&b%40A|+QO6bE{Z8#IZ!>`MVHC%bqOekJ zGK)V57MWj&i*7NC4&o0JdJ&IqR)0b&NL>4N?OOUF3lE7gNc7SoJ>n6Ez&-ohB{`x6 zUx-2flPbH%u*FUL-X(d^BI5}`fBAd?`IYLB&Fe6+52~8BV(`*fsi!o5n#NT@Q~4d@ z8}`zVT-Rnz5Pdy8J3>O;5@g+ zQ^$Q<6)r`JSQ<@fpD^9$b>?8@7JIS2vJ!#49|?hZm|1gqBB{-`Lmz>-pznv*%fn zLcEt6+&`>8tWo=#V`4>Fn1oT6OjV2};(t&y0r==;Pb9H3A{0F#VpRK)#5oQxr`oP& zly(^E!sdnnCQ%5Z`s~ZszQ>fVt0Xv-ia&S(fb;dlg#)0L)UC2+KuV$ItY@LMrcb^U%4Y zG+s6Yi6#0sbKFl>?hME!?f6csip*w;WGelocfjM$<+{SkcdzMi7zJ##rEUWwjgN;< z3t`@Sm#r{B&2Wm?-Q@wSJquB;_=n=d8Ml_%Ll!+?GA-hrw5M&8xNzcj$4>KZTp|5 zvm(oKED6F3l5PtQqpM{Sg{i<5|A{Gvc9ZCPPy$ac{|>R5`PjW>cT*@r_PC@XkCu{$wk<9(Bv-9&o>u6w0y`Ud zh?WUELUI*xufl!UAOWZ))OQbGrsbP*$9Zc0lmZ$!|FH8=2#V)PKn_u(3u?Za2@awv zNEYt-Mqk1}sE1(i8@74TYX)J)cb_?xoHW%fO{azxromr1vEqA z#w0wy_=0*~$?%guaT~%6YYLMl+(e$lvZ&Ir_Hu`A#uB7_QLdRx{32i$cuywK1rjnL zWkBf_Qg|HWdbcA^d)0}zx*%Ca=f0}=CTZ1wc$!`Nh#qSCMz(W$8I~G@5PGe(@qX{t zm20QIu=0-~Mv4Jk_4yU|A6WPkXB~20ggyESC*Xcs4yg4;%b?S;Gtc8x`DVC_`Jk!~ zW;iQ$DRz}enJfk0#SMRWm_Rw;$_i;+cHPoF-BA|&z`6jwVqi1g=_C@3Kqvyf2)zER z&mg|?jz;6y%z_I1pA|lxd*?4;sVE|cpT_gW5aeVcs~UO~1o7-$n%8k^8~9?43qM$b zja~JM`jL8jwTOv;VGGEkGoYdbW>RizY%Ws!92n5eCm>629d!?%8haW;H7PV=9y^q@XT8dA*-~U#s8$}pSbByTp4bBU!iwpv5T>JiV6XV|@{-cNZ+o8mA#j`<@!Ur|hxe$7d2fl!!pi!6x6Xhn8$gH` z@LGsk&Oq(G%JVO-w6EWijB9$_|FZt2sev#NhJfXU%=MQXdUx5F8t8h4V2Kc8$Ui48 z75^-;>_@^QF4)r-@LCVI0ECH2Iu$@j_kVfxkG-AID2==EcV-NVBsrq5Rmk7{1#!gh zYZ6B-4K;z4V9mcA5sEaN$NU*f>VM+P32S=YyqfcoKSuiUB0D7az1)QJvENs$nI5DM zr#M2iKQF#oi&?ySzgu-e+Z(`y#D6)RK*(L_vk-Z=iEbm@ZSr=dCJz^<@B zsWZmOB$(pA)bZ;86nX`$E+}?x&xQcdjxe1_G_Fani5)%^VB7}Yi%f)Tz>*oX95M5hWN}`y zZL%-*neu6>uB)uRZ@xHZsG8;{Py%~{-|q$sqDwbUFN9Eg*2daAmuAuu7`|4ed3phE}9SFT81Tp$nq5aJt)vksH?5Zqg`3VP^WTh_OX5F zJ2kIip@xZ@X;#%^CQ>_?-^ zCRs{XB-w_+LpAe)2MfB76B5*U))}7w@f~f(@X-4If+>Jp859>omIMpO6#6pmHxr^z z<7voVyA99q0$lHwT1IJ~2FVm7Rce6|C&0s>e#2|FKj#G-D4r%BgHdC|y91UC6b_WT z4nSTIy;-p6L5uB`bcGQ<_U-gMws=ZDZL-%m@J7~FAOELH*bY`Xl17JY3U#v+BDn>< z4vO_iwEudSbb>ktYgGOskhY^fjt{IDcuU}9PCwP>4khvHC72}dg%m7)GE16ok&ao` zn<^%f3U#QP8>fB*nQ{Hz|NJzW*;j;juSg%LBMEIJIY>m!JZ?J7xAtGceVRxLVWegG z^vO)0Fqn5bO)lV*+Q*=Zzh7mvi~0I(K_i`NMP>mWm`=^>c6d#} zI`42Mt(6A(6f!%xFD;?8LR^IZB|L2cm$ZC(zONi&#Z^%!9kQ(9Cwxld>W(q#^WUvC zf^URsa0j>#AA+D<(_`Idb(TG8fY`+!-@av-ccK6M&Yn(@{tkHH8+@IF%QCe53G18q9oD4`*iQuZrRxD>k7-kd1 z3!+u+4yJX=p-d8onq0Q6JnneM##!PCHERQDNSCPiV|L}qzr0B5@GSLqtnRr2dtT*; z8TDS@*H3Jii7KMJJ}5gc5v{L>FB~Xzr&nw0(4tBYsG92sU4Nga0Gr z54zfMWJnjc933+0Cvq#AEYQlB&h#4*u&UiBMU0A%g@6Tc1&-`{YI?F=AR||}`@_Pa zY*b_!{*PF_1Dk;`5qurQR!UgdT{`Fgk~hP<8al<8({*8dcS8+e+&}@Q;#-!X$zq*j zkEH)a%$gn=-8krqan_9{^5{FveQyq)#kMbTDvvUm6NfS&|6J*gf1W*!@x4jHOZ-H! zQpFoGl-!M3WRD}wjVVdU(!gr3@&azRJKOR1#if^PA!F#K+h z9#F;7j#;t@*iJ1=5Md%P&j+tIgExua{#*JShC3m4*%c>#b5(rv&r@@X`Z2KB#AAYq zXE>M=^OU&r?4o;L)fTAi(y@!V0Vi-xKCACkFa<5f&#%3nKCr<)kj)|P-?tbi7-|16 z_wSAswq`yds8H><)Y=hna?Im+?Dwg2G2e^%nZBnaFF7LM_A9LO5@V#mvg{;}?K?tQ z=D!m_rjIwc)};~kyQ>wZ>!p8pS}dROK$@`5zt|CBO01S^dfAsi?kjFCoR4}Kd;a{l z%7|pQl{ieVX}3u>C)5m(vTX|YmrY5xQX{_~Z-~U+<~aU*Ix4(&;zO2HA>Ghhe*>zh zE6Tu+EvLC@*vGdU2cRE_))L_Ra-ieNGK)30Am%@q>=U`r@Jc@*@xV-ayCc4;(t-lq z(K;#R2wgFZ&%`}|5CKu`&VjBJe?xDMi<1VnoLvp7rw)kvkj1bwv-XMhUO1;ew9?z- z^7rGo?W`~fY3pDU%0h5FRZ}V=IZCR+7|3G6l5l?&QfzKvb(MrC!xhA;8@UW{F@`u{ zUY75=87<|J-5Bb8qMZ`2t9tvMMx4t%`-_EKOGG`<4igKVLt4qM9p>AUZ}j+>^O+;3 zx@kC&fAUgS<+l4C;bnrZ@+&(3tgTg%f#0RJ5!nD{%ssERC9^6>s-EGeh_Sal9LpV5 z1^-lCuKovg2WfwHD*W*)3qz(xT&Ba^ht^Jw1zL@8l3gA{#-)UUK>PIkRXj4s!gBPEW4p8m*7y{@cGE$sE#KH*}om4zm#l#Cu{u0GHiwpo_mwK=5>xYgEF6k+u)NVV{hzn~9L z0qR$K5hkjX*r&(ew@m$4rG}YYUHkqsZpf*^INoO<$Ck!qvi?`|Gsi{!d6ub+OeN1- zy~=_6x8Jx>5@`p!SGnjawwn&E!Icae?HlDwpm$Z?@(2Iw^Ozj<&c6vhOiB2H0AmGi zp)KvLQ@X(4pI!RST|~}mkT2C+C+S0cJ7EtuQx>km_2`zCHsxO~5ic=wO3S6#MpmXu z>sZ)oX_t%Ta`Y})nC7W*`pQBujyc}b2E!MXa#Q?26`kG3%eZ$TzN_+Gfp`R^L_c=7 zPU$Oct#U%o4yyH3YpjaB`b`B4KSc(-RR16<{Ows`H`@$dG1K&fnkH3rUZSA$JcS0P zyewlrP%6!uI@(mh-#$1bVF0M6Vn4V~s6Pp)uc3o~p^}k%a~S#2VA3MjVY@|H=3f0Z zPOwPF9GiLgu->zq;yHY#5lG? zeE-@jl6p}K^>S@pHiV`9`Z12j-4oqoi?O&oUt%+NvO0S+$t0cDQ=e!@^Bl0BK~0;$ zplDLazf$Z_C5WXq0{k{}rT5T41^&ptwA*|FrFJHf6fO|C>#6J5^=)C#N&GN(SS_D- z8Lp@*bg5tZxo@o+irvd|@s}Nf_HUC1=fm&V4`?86n6hPpI=;I1QS?+0Dn|6_sYm>Z zO?YeJo$>#I#FSk$z?FcIN|t7WWetLYlz^)@XD4BgI6UuG4&zW+Nppd`Q2)PMI_dYs zioJfUsI&zC0W2}(#FX0{Q6Q4oi?$Wr(G*7YYw-{Jiy;4tDJ<05cx)h=XpFjGW0>wv z0tGel)1ho?Dn8bw4ti|B*6Ep=4rgwrRJl`z`mR)Qq;ADJ|G5%Pg+$RZjP+d#`(OO* zn>2GZVz+TfGkJ?R7CRR#CF zY+V#u5^wv=ph)W-PvZ_j++<$< ze>7cXSX5ot29fTPZjmnO90lo=5Kuxuqy(fxWXJ)jA*C4_K|(6N`7!5DUe00sLU7%-+CCXZxb^}ae zD}VFUaKpO_eeV*STYd*w5?&56Esf#do(ed@*VjpQ4w>mFq=C>OL*~-1&8=8)*6DwPmjGo;$A!|>?D3qZe3k+Rx{dCaZ^E0l#G50a zQ*>EoW0D(}PyKh9EsVXqEaRa{ku0_y;u8my;*8-xfbxd841YQNz?sK6dIMf{QON`s z@~)xX?$L{|aox{A`;38IpXq$SbD~ztVpIM3t%hr+PHVkV7&r8_X%*tB@&G4m+;^;U zLCu~2u29kI&dtqrWdF;TzFi-tCYOQvmF*qkA5Z zBh&4lZ6McSvHtbfmv2GWV--wT^AzOhDSyX_<@tpOSDLJHZDvatJcDjIINK)Rx2;vC z6y@Cm@hIs!I~wfrR(`|{T6}C>oGTQpsn_lb|z%>-Lz94ZTuOJ-W`|T{e572 z|AiMO1C9CKe7>_`Cnk1`<)K!!7CQ)YvTxfy2-5p~EqP7RJjT)Tn^%LLR>t)OdWCil z39bIjoOh8D1QVv*F&-1UX~?kntjBNluHbLSi!@Q{tFeRb_f2TT+RX^g=51usDbfzv zK;5Z}y^#l}YCzw2XKI{<)`)OlNs4>E_o-XE*7M z?-I$6@+f!s2IRNz-OrT$m$?M%Fgg)ZGg^OvOhW(d+Zd7B=v1c?3VDKk>(mssOMjaF z4t$2Y@7rT!;#hXRi&+{)U4O}ZB%e#IM*Iekbg3lPaZ@31`ZHYFLMIEn@}gBC8LNXU z`*di?k@SQ3bHVxKc7#-ybXXP}Gz_aSC$dTFWWtH8#k*v@2H#zOD>HEPBi6s4;O489 z2E(Z8m3kNuzaBSru!}<5-~HVjWnq?UmK1uQn!CdUV+?i*AD!%zHfRuw$JzXcAr2%D zvJy!R8TaXoX&D`WJmtGaoYA__W=XlAZ*w%-YB?~Rg6V+b61*zuWvdTJ#elBtXfw_E zlIe8Qt)ut&;tEWAuJExpBeresklFD>o-h9xz;C;?9`?{I5nwWP_GeMq{}xL4B@Eei za`!=Ayi!UPYc!r1zdsu1{w^u?KXIBMbcQRM!_BN0oisb*5>3 zwskY=8Km|=paVzX`)l>Ux%;=}D7mp3wZldhmT3Mgc{$nz}dc;f?-%Tt1E)D4EF+q}E?2i(E^Yr%h{a)x!KYFEi^ z<%r$wFIZ=B{r1xucKWq-^M#S`zR=Lf!qVD(MvJ&nwRcowKbKbdtt`Yj*osoM7dvBI zjd$w?LH&DwS^cMFFhhN?c*@c9&J8h_@a?-t;J=|Pq5bWc&WD;C? znahT~Pge3!zFBxp9JMrUzPkPA_=r}!j7^uOq*`<_!kKKLV?>=7U?AX6VOyId&^zni zpCWbsv^`{0j`|j5$q0{0@WUSLyrm=Km1!0#Z?FFo0P)Buc6|^vB$hYS6Jf-uhF^S2 z8d1C-)9`Qm$IsBtBMDc%L26{*@`XARul&UXeuo--kkGeF)(OaD7iCh>HIeB)T4b0_j#cf;Ft51Q% zEAJTPevR__&N+j!KpTPG=)VbI-QUYvZpT!^;_c88c~D>pd)TaibKES`9&vZ8QJ+P{ zVf*fp_ZM(t2j=}o#(UnWu_^I3oAtmyiswZd*XaS&Dx&Y${l8>#qj_!CBsM^}+lO64 z?{=$Py6o-3jsU4-Z6;+9Mgt4)xrZFDQhVS523N0LJ%@%49v$*);-q3c7l-))q1hTX zQDTg;!D4i!3MQ&7Mn2jk(UHPS@=gaA+(V44bAhjLU}e4Yd@*Xe}^ z%pN#j7CY@~X#W*tD!L(O5#OO|(92asLNRmHPz5KQ2NjPSVr|47z7jDfm{xQnFRA|| zEJ*fgnkZ(C-D|;GCK!HVz9^gJ6W2t+sMXHOSw{|>f-8Hfi1y;pVvxya)=y)}<_agp zJC4BJo42uGd=-vS2OEw@Bq~gKnT0CosM95Mzh2-KNt3&_;K%bKDgnFnZLrIPli*ax z`Hi(6E|c;y>O|u!k*0L?F_**v4%l_Ky-8bz9FXKx;_k`82`T%B_v)tXK!4L!KOV5A zR@r{3I~t05VSvjB6iLMtv&$nnO=zvp9XqfzF}3ErhjJFx_n3wvOoG_px)3 z{CCdICNnQE<5v8aLPpI$yBU&LH1>u3r~vqFIs;F$&V=|c{m0&k-*_3WVizAPhT<&F zXQaFNt8fR35ASHKQBrqNIW5JrpPdQ}=e^Om57pKl$tno{SfvOn@&ez1z2Oi|Z-8A{9~$)2xrS@% zZG@Gtg&eIkZhKaZ!u`54mmF_L&t=<3?XupV+vDD6h5aSp$kGU^i>7V0%=>6LW)Hs7 zXL+2j=7*p?nW~#$;k;{UY1zhl|&>ZEo&jRKYP=#HWk_xM2Texe# zo1$-WYWd;UVq+J2_CH1{MiSy=;Wi)k9x1{VQ)Rl29zO{Qz6%?9;H;Ss0*uhc!; zesC4<@zYD0@`nnuxkjG)!Rt@B&IscMJb=6EJ$|W%y1CPpUb~kSf{?I4u(v-9t#e$1 z5N%o9Wl1B$Rgu9ISR={xp2whd@2RP7TghgXrhYq?4{O+kvVlYEo@oP+G^fvxSznsL ze6IiIUzz(cW2t;pr+k-BAPjohXa}#>$&{zT{pou9Fx>dKZfPH85=|h$)^^<;lvS8I zm2ABAIIxl&y~-v(G6Y`Yp`_iFS$X)t9K zqU^$$Wj9t62?nE+*>BpoMm(0VCiNXoWp|w>e5b1%;*WpWV~L=xk}7rprjmzK5V%N9U~DBCvFVwUff=g^qNM(2xlWC_P!6_f1)g0I_8)@ko-M+Rlsynl_DDG~D>em9l< zTSRUIwU{$cxh4b+;1tsCXtoW%y3K#J;RNC%ZeY*a!0z9eHg24q6ABu`(9ov69T%`h zVA|^yIzLpzko%S@e( zuBe)5oqT`Um=DALJ|CLJ*}ws3@A>!3p*^!Gx%35)S?rYF4P%zU2~;wC!4Vw`sE#Or z4d;+w+6D^o#n;xt9m_ zjl`w1;2iH?1Ndk&w4|CLX)@JUVZtrE7GyP%6Jp(Nq5wH|<+p}j;a;Kaoi+28xO_AU z_T&56tL|AyCyHrdrSlppD6>i&qVp56E^}Z7qN~q(yW6<6$ImS0%qA{Vy||qSb}B(# z;-D^ai0S=k4vonsdO&tbp^DZId3((1i+<`o>l*Q53YTQl%=4g~6V0i3Gk!B_*>y&* zxb@9=q>>mX8U$M4cjD9V-Mv*4_0Y@bfGUK-BGYXz8u)5#;1gmgJ^M?csaU7}PG7iG z)#%Krg3k91w`6~iAM{N!6}O&48T-{DX78u6UFuAi(aQ03fBErh!*EtZLuOMqTnIVR zw(-REPnYk{5#mwQx-Sy$kbG|M5>70nW5qtG;KdJzQDV#eJ#$m1!f)7D*p4I?YrRs3 zyt_45Z&BslByEW=PBIpMV0PVNVmNO~oOWwYd7cEV^!lz6Q+>oKo!)VCMJ2I=Uq#OU z{gQoG`6QjoHk@rXH0GDpM;SG-1&qf)HU*5%**`B`|D((orsA~*^Y3!~j zpJZm;%ILj2E&uzAIimsncglD4pqsxz^=;=`_!7n!J0<>cA4rqykw4{^FSxL1^Dej2 z8;y8J2S3V`0SJWovNaTO2ftxm+VkLn>O1jFMh3NH74b)<)Cee}{*5lOBBEA$VY+pQeh5lsI|ri@Ycm!pQh*Ok+Gu3{TCgd8g!3 zX$x{{MeO!gIwdCTd!+Y=UovD%SDQf!y3%NFm2I+@@pFU@M8Jg&I;zI6Z}ucHY_`k( zYtX&v*NR~U8(OJyW=O?UDxE8M97!x-wHjSNqI5m^1_SW7mg1PH&PK#1d~^HlV@xN^N~YE+td8%Kf>m;sWW=CyLt z(_i8Ewn^opPfO_MYnr?^9kdhti6^h6`F zVrch+fW21w_G3kKEB&iE>6_6D3Cm$^P}k>gEtw-mzbuDMEECuKHdJR-bt-;7w%ve7 zzVDS!n)AmvsVs{9I>j1Qi=3n`DG%+XYFuj*Cy(;otc&!b3Y}rUKaSBu)wmlxmw8KM zZ-;r5Ek;1~of=dMyEN5WI<9jkw|cFT!k!IkVoMvCjwj65C3v1}`%$1sl{N>(eT0TH z219c7+sl5%g=u$akm{xr+AaLGog(u|C^^L zAd^)a1^SGO#m{$RaTHv}oA!}&WJBkHDWycJgNZ;9qz!lc)Gf1t6?$haGGy}?cW`$$ z-6(uC;PL&#Q+?pJ6wrs(dz^qBIzjTM!q!{vt4-O0U3@J2-0Z`c%09l7bKZ<&Snhr| za(Bw$9Q*(!qU9=lR=)m|&|7VU>jn*IECK>#;qe+3fj|5swL;(%HBv}kFpKK5lshJ! zqUrsIs@sQoU{UBfN*&HMMC4Ac^53{o2n5Jd&qgOf>ANP1!SFHlLl5uY)eLQ~4ckS- zShelnhgcOICm(gNC#DRaa|EWz|AVS$!&5@BX_gKq>OB1cOC$Q2y@z%TQIQ8?jb=`< zmjTVAm>ZCAzm6Fl2S--n`j>2T!nobYA$jgo&#&L#$f1#YVHaTkPsS)nl<)Gpl+?5; zuguclDVe{Q=7&EXaAh#HkL_&|1U{B|++uT4g%gO{zDwMR#A`dgRyOGfOlH6QC~Imv zcfZ*=qqx(kje3TdfI!D$-*jysA~Cx$BTmowYfLKcRK$2KtegF^%PC^x%i8f}8|9xC6biyxJy25}pExn`+u zT*@7-B04%6OU%{-<{juD|6UI^DlsnvPrX0iJ}#tt5(-6bLILb9s-{|Qb#T;vSluh2 z_lMO|@w?A!s>QbjkjgtkWL{34W(k&kE%ATaO$#E8OW(@JY+QHY}r(D-pQM*F%o$<4e@Szloe>bK;V^pS#i9=H_ut`kpLu4 z+BQ7tTY18)f7w7=x3M^83i+|T9KL!MnV)GgfV>yIayUhfaF2IdFc;MdPF2CgG~h8d zhMe6|o7meMrzM_o=zK=%Qi49!{ErkBk-d^;sUKChJUBO}4O%ykH^8hXVqtf94B>9Y zH6P|(@Az)(CUtxSSDqSFA^E{aE3`!aOh>65veO=Bw^kB_zscj7R0*NN9#9hbva2;v zB$vtxdaHHf$TdhJ-wG-1IFUqG6!iWhBplv|E$rInK2Pamix_8)oz>PXJdewA3>c!i zNzsgZ#cpTDFWF}pcUlB4AQq6tJq+|@-a?2zVwmFq0YPz63^Co&DBP)tZ)|&k>=(WEIc4ldhemM^34g@)!j@h7)`Tvb8nX)&4YF zA8@U2zN|-FDE_7DRFlSLA}REf0ZScrSS2c`X&NFsaKs1iJ8tT;q}k^|B{0dOk1oAk zd(~D#S|$dDg5TM+1mnXL)7lg@GzzZ1`;=@)740B27N;-XM<54sXzoRqz5n}Dk^pl` z)NohpNAIBd5UkrN*j}K9#gt1x?EJ%u9(Yydwy_6W#bm>5mx4*X6+hgLcX}$39%5dmbKte@_%#|C1p#2gZ54@ ztVPKx?91Jtoj470<#8yOCo|`FHNWpShV5iu8<<}4^Rt(C3zh=6&f@0NBxI4FJFThS zU4$y<0J~$R?&Wv!$RhPDsHsqb`|eJLCY`X9mcsi8Uaw72E9?=0i3%R$3jqQip;9}N z)>;KF3KQ@Xb0(!2LK5$1Gj32WIN5*kO3Hz#2 zROCpZ-+6ZfxSR{49XHub@+pQ&nLUMm;w9~L-HDm;J*ld%dKi;~Z|C#WsuMrs2)zHC z17eg@%;1QRjG5eJ5pF29iWWvvNVCaXn9Ycob6(xMra3Ve;R6>lUqt!2gLa(O=tlf7 zdEK!Wf<@l<)LP^FnYX7S!;&u8A4ZSR5=Xr{kx>aULhL^c-XnqY1P@lnN;8FZvPhux ziMzhXb_aFIY;29Kz+0$w@znqq=%_JNA+Z|<_nhne3ENqkUlyG36kLp;EesE)w6EG? zIh^{=R|s$0bWUlN64eWNCH z`o<^qle`~n;5U%$o}#d^&-KeYce|S(0nrIN0gFE&BBIIr6HN4lHkSJbw}#AcH#-yi z>);*-w>%v49rHSff>*K9BL+Hp(=roUK&@qx*BJ%doQUbLgsWYH5^c<%Y01DUrC6H? zKV0vYqG7tYa;e<5mu~TMUw^)J(ZDrT{l?UBG0ou2yFA=YYD=0pRATrg@R*sYGF9?$ zfTYjD>{hCxJ#?0YjFA}`0me(*HwDz^P=(Q9nUU@%8(&Tdx3A{zAOUVm=cA^)^YaC=?Bb>t}1 z37c*~P1+IN;-DNP6wpqVq(Kx8w1dldj5xNggOgv=paD`|W7$sQG;_NoL zZsO-^s%6$v-79CnDLcl`EgCE&ANSF?=q%4lsr zQZVnN-9Y}++O?>S%Lb{gb0PF(TcyjsN-lOuIeXLN)G!x!QH*OdQ`LbgXoL9NOw3H7 zt%&B!Ij*C0NUL7(fSWws7ry}wGpU=iX>0EXsGVlf>2A|K5bO5n7VVNDRADHmghcs` z=Pm!znY`k*iL3?SG8Q!$8H3sM!ge&BfNEMTbNv`+oP}NPdbNu)z)XD!pfvmkoP^E- z@aw3Cux$e19j0jJhN9jy-~N4pt8hZoLt2ZTxC-ylq!?UxGr`Guf&i-yg-=G#PSWf0 zPkGr4d#4I2+s~f^x&`8a;TC=jd0{ojo6y__D(j=YSG!QPmz79+Sd74Sq}?d&P0SSg ze=Xk?v3x{Qi@3r9q;heVCQiI^iS<9%PwcpseOe*X=o^AmSt~I8ArmEis~ttx3AEkgZsrJSQnR`PZvS1OBZ{El~=wH(JyC?Slagq;6-9I@K@eApeEP5ky^ z7r5bqc}yj*iok!+4v01{p{Cm0rts{B9Q)?-fG{j{AlaCk-QC~7Em$0Yb<~aot+D!y zYQML}p04D~2y1N42qn^TZC2@H?&iM{bA)S4j zVhXGeueMQm(((wk^WX@NuKsiS&yDTkuu^Rs+H;!_P4I4(@NRq}w~(xrE>b6QCw7n( z(C|ax_6?gZ(dY`PvPQC!>g8|KaJ66flkH0v4fYrIJcscXn?eF@n>W7Lnfe#y=;r<} z(^vtHC4dYdD5)m(hR2TK%(tpMu)0KQN6i#Ys~{4n0+w47SqAzUoEv8~y#K!BKh2@0 zCW#v$62@gtn>+rcu`U`1v*rO>f5`!#uL*o?s10)D)R(iG1ifJ1pvNbUcymv{PE!BD zvT@i8KTLNy?j_!ZId)tNM=uytQ_>@xK!*@e*=ElBb6>ddiK}~vTSe&b%z5oY{p$7U zu7}E?xqLjWZ>0W}WC4r>RN!UuS06nUAWXFH0ObSal}^FLX~>6;SZ-&wyixbkq{+bk zA=}A0I6)urLF=^=q8X`1iU^emH}0(f@p5PTj%b@;;ACok!wmOItq6P>|L2I1K6nXe zhbL&OIDKBnkk~O^8vybGxU5VTfa$RNB-D`GYp!19QsjFe=B(@@M>9lwRe%ZHEC=S4 z(A`>w2Wo}y3EUjm^ngks3MaL!C8Y@3D)wxU5*-!h>4&D0>RO}0{{N0Z!~JalTH^i4 zi9g?Z=#yMn_3aEMJCMwqJy?3Qk-8*z0d34kN!9=-=710W;`k9tkhudKz&W%2CTh*m znq=MyCjrS@l2VZysG|Mz|I@ zW*#@smqH{ANZ{2n$WcrFSbYfgj!xy|w7FPg#m*6hu<~zys4oY&KHDSJw47KmsgB3! zcBpiWT09Inf>F$dyM&7aPRL$9BMzn6`{10p=Gc$(7;QN18zVvL>wf{bQ+oUhP1@uKuTdP40 zTWspQC6i(01lU(wG3Gs=NvIx~%%;KZtTT>+0&E2l7T-I016| zp?L!24x|Cn>dxSC_@^iM$A!0o(;um@?p?0_-LWzKqs!#-)>?70?dDgXGsm2pkE2wL z?|>g*{v9$uHnl$Q8`oAsOnIYjqOoXJT-Xsv!xF3@{@nZv9z#IwgdTe z5mI{Xu3FHWuMj)HU`uJfovn`^y8cP*at{-I-ultP>>W+LE?>H14%d0ya_gCk+Ev0i z+0ltC8~4xGTByNK;_BFxlHx4ZZFo{x33x8(SJyrprr)vo@a)D6`_)~T{E1}VxGIh@ zB5k4O*^8xeBDyYvKFZ(B+jPpG*?X%0P8dTN>BgtLwhCLL8iei(-VO1LIz=&d_sqvl zZAsQtE|xU1bmhdj+=2Cj3((0tUJ6vwLI^Ux5JYR?Gi?JMQUqCQvNk!z&&i7d<6u83 zjMSv4dY3UO28|IA}|#;yzhn_r&}A!_E9W*@ihQ~_Vuy=eAJW{*se!nVbrG< z9#tcLF%6Ui2Wv}|0R(3nYs?9_^sKIEAPS9mq)Yq=OJJ9RGFrlA?3&>Vd+a^B*Z+=Tf27SlcM|t1+L|&dc;qo0RRk_#iHar}X_#8KL zJSc)H)2^=08+D{K+k;j*zZHf^5Ov9^F`{mCux9J6dkz2l8;P?_yGbj-w{3d#;4sM3 zB^|{i|0>4?z~u~FYa;(Lg?WCyM$ZEPbC}T`Sy{^ECvF<%G>bg<*Aej&kFfhah^D@m zLh8e}L_{*%LI41>vJdmW1kPdJAs>L%wZP6Q%&xIp5Z_NYtacq1D!4Cmxhk-yQ&By`(>3CCgdLWKMQRiA;4OH-l8>-~V3k zk2_<m;Y!8OKHp?Q zE7T1b&q6`Xt?od#_LWFf3!Mu7E`l_gzw9BFID$DW)aL1hascg=OSXS6w3oiV%#T^w zZY`pb1fPo<0rRx`iym`<>ktC>Lhe5>-7<~J_5+9bCO>jFMP{-Zp5G#<9UCtSpGqqN z%GG<}f_I^9^**e-dQiRQ;5FQ+5fx@GO72!fhN`H|?#4RDL^#aZcc8b^E zjrYT2-Bjz5XMV1-gEvP7>mmsNKn?(qR|r+ar9KH6a3edY9^M#`zNdv7j~uG0Cct1^ zW89Kp|Fut?d82Dx2&RJ>iW~5cGp;z5dH`MVHiqsvXP{B}JCl5tKR5o@(ZBCoxsIIy zx=St%S7Q;sftmCVxDhz$_Khx1&lp#w4sKh;?Yz}d=; zf(KXM(NvF#Ts7~Fa7Zd|Xz^o86=CUI>PQoDO%`xsCh84PeJXkOBA|Ejoe%#wJJ68i z-h+ql=9_t|#87QPN**(Rf~&EGsqvltitS(8@E9v#!s81M9wcmJp^{k^K|G$IwS1*+ z#`v-OKeq2q3UG1fJulBF{jV6XxqjR{qw0zIM~J4O+e+cnwgGA>*~>tnH^i#{NB3R6 zUVy8yZW95IHh5Vb39>+B>hJ1fI{6@oUJ(Q%iN>FQ|DK&%w4g7@yDZO#e&Yr{|EPSX zq^vBXGDHpZ2F7RF4uJi3uihB2rx(OQfYk@pIwcaU*x)xdtI99qAEhYpk10gLU)@7y z&`|&CS!&qN0dG_9kv=Mag42gLpMI05nz5I=0cmdHQTULmF^<<|n9_;LT0lASB*{!s zhftLDeY$zLIbGWeoNz2L8F|)Q`h@q{G}C@P2k)RjyYU2 zE)38EZpNhX1pwAr=F$2v_g|^^F;(q2F~lpR1Pem*Q{Je}7a0?lh6U^W4TZM_yWH3v zlFzRO?VrVIW+^1OoFAVWOmkh;n=jepm;01v7zI)HC2#HLh$H*gx}MkK-``vWjj)Yx zDCA@7%AHt9l6Bp%Pq|U$o`>F~;n*wO{c~C>?c9X%!K!j;nxb?%N}tMS1W7($R=-+B z(6l9n@t5e@@<0eOhYZ(p{aFJK%A`0lcZ?JOJXa(N_nYyWKx!T69^5XwHb`tq8;k@ zMv!F&E5=#E1s)6;e1$w4qRHmRG`Lo=;J$(tF1f`-ln=FDHJKZ#VSdt)#d zpJ6hKhB+ZDdu|_RU}w!lp}Ww0><3Fqbu;CsX$d8s!c3|FHil67FFgQhOzD$jAJ2Wj z6#99^=_`Clk|*#RlvlJ6?FD5)z$B$`M^aGq2kN`0JL>p2#DL}mFj4q*;aDJ}Uqo2- zb!aoY4JesJN!hTn^O}0S8{d#Fv^!H_4dc|7$tph6LRnN|VdC&1$6=^DIinlf>xe12 zr?k6L)R-Zmq8sNA*ddx~VROTOhmV*+zjiOdT@&ETBH^kVhQvyTG?*Bs+Z8FFj8(Xq z0j!zR<{4ZICHm( zJ3nDZ_`nLfPQXUj>z^!;Di>^=jhj2%SUV^Uu!|3}zMclDZjS=d0f03x=f?EAMiguH z|7QV!4Ei@%x0kc^*u>F093>dqY$AOWQ@rFJ);_Szh_FP;HziWi?6~JM=H-giybgI&9fTLTGYtj5uH;dwD!<=Wl{FrEBid&H0*uum zekVDsm+Q1_AwPq!e|`A@aa4%H$rfYu@b;#k*ps}soS)#x+(h>8gt#k_+dMC{2EMsr z?As4a9&cB7m;kKdz)DVrN2b|XB&l<)MgILUQ`l;eODRZVGkcaseoJm3EfgK?9YE#p zgVvD`OR-}K9L=>%LOPjiMY!A>#o1i~>Sw>1g|hayho&?QwA5NkIhHn4K4=!-XB^dO zMt~hTH+Y+6$WZD*%D$ucj&XTkvF+?1lKvW@Hjx0e815y zc`nbHy!piUMR2+JqtqxqvA5%h7G|V&9tZPb9M)0he)t317(m63`;p>53mYY6-mbBd zWgJb<$EpuQm5hKFI?x97?-O{movVv6_G1KEJ2^2y(PhrAT{fIUb7H`w+&^36Y=zVS zUxVcnbNdPj+(i?dmJ8$j9MElNTo9jT>XK?r?p1?&@I5}<{thmNhpMDHH7)!IXLktG z+J5@;5yCJ7yt6r`G{on1htL8IIsJ&Un*&{$0$T-mCMA#NkpdQoGe^qlNQ@2coi45* z{coE0g?HrvZm{P-MJZ|8T&bXK2;>$28L;sSz9oxQ1ZGlg{%A5tUcV%5hF~~Y0PTG`Bb+@ewg{G;}*TdyDBxK z7yFcGy8F*6-?DIWe%Lt`01gGLCs;;SJnr`Nne6H^fJAh$m?+n*r+|SA!D*)qP8QK_ z^`D&rLwyf`+Jx~RbU@W3!v>-;1#IYSQ7mH?tvSmv(d(YMG%#TBT|>;xRaE}Cm#7b^ zR1zZdR}o_AOarP%_=x?ag!9^AuYtndHhp*giAn;spl8Z7d93`W?FU@MkS$v8y{RO0 z%U$~+1sDoeWQ8FhY47V>jhX!7F64^B%DdCjp1vtHD7L!yS%9~Lk$mBt4D#)s z+k%;jNkZD+f}5;Nh8+*IB8tgROj9@t=-zU-7Q4SWDyW+|eVwU>2mD!Jk`W~U7BC_- z2?zhsE`4yMe9qiIdEuir21Occm@V*8(Xx>k1{~v%GB_W6djcmd7wx!uOVNryZ~u&^ zf-boBi12)UU#{JY2;}4tB|<0|xmKLO-d#|x%|3e9Z%bD_hzs)U zae+d}t@3(`Nqj_Y=V`d&-!DPjAYGmM?h_)G*uhgVZ#A9orFySDJo5jxPZgc_5I}XF z;_30l=+HX7#OG%a*K)0q8em}#7Jt<$o|)=z>o?#=oac?yLwwgf@pESWwh+U*#kQ3F zW4x3b@@W5pQZKOa?eAf(GqpR@zlq5|q)tfvI|+Va8fkAzm&CTcZG1!9Mf-7160pu{ z6tcO+dw4ungJCh)(G%a@XBOy%Bl@_zq++o{uPq@pzfY1xXr@`0<35v zftYm0yRt@31%+9~pcCB|%vrZ-nhxAQd8480o1kdzJ9YesdCO@DyD1z1Sv#kZN|Zeu z>K8=t$PVByu^bt{3}(yZgNDiX=?(2owx6VB7^6te!>C3$g4RAv%&V=uJMCP+yZP%k zHTqPWlgC)~iXv%D#zfLyQbk`-V3U^VL*`+9z0n>On&w{Dj(dFKh{6P|_D+xE;l>bhV{1_Xkj4TH9PvXfobDy)s%%D( zy`h$8G_BhQ+PeB9ltfg#r{}w5!54RTo(GPG&kkQp!b3z^v!baLtx^=vT|?koal2WT z_E|xkfy`^|pZB)3xw1gGy@vBbzi$5H#k!1UkEKzUNfnKH#17Y&p8os9ZZiuLw##>d z2N;1U@;$-0x>oMp6w1y|khsIIlAcjPyA-5SQkHp%*Pp8?YK(g>%PP4#c0y3*;?}`c zs+HK$HRo_y=cuob;7x;lRkRuJAC>|U8F7GEsg|LUy`=iZi|6Gzms$M(^CxFQpvlk? z=0w@U$AW8SBWfspM)0{HrB8;WyX&6rC?$slW26Fsx8O9;t;C% z=dI#j+tc)X?=Hrl--K6OV4cnv`xA{m{Y1!P3tVbb*CpY~CF()j_7sruAc0erd)AP3 zHGTTv=V99hHJ_gWZ`Mzmp-!0=w9wvK+(1c(%L9bW-mV62&M!4z`Zs{WT6E3f26D|b zy2in=Jx#R?A22L^4S@Lnd|8HBJm_)|TgY&67L$@{<j%NT`$uA=Gyb@-m0Jx{@3i&rDa9 zwN0dQW74=TVb|E8Ly8m?mV^^--=7I4}Qh=uhf! zgzCTRiF~=SbH=f~ui9K02b-9{9(?cgM2R+?uIuK8vAl&}BV!WXym2p^u7J#&%smlH zN4~nJ;i$R9ism{)cRq&?^B+GY#gBpfRWy2YATd8%kKkD&4Cmh^6lJllZ}8UTveL+o z09xHLx<`om00fW^B~t*<6!^Qx4ylNfGWf)qLh_Hpvj%!wifdo)F-9!`Lvs!_1%*Q6 z!}k~Vi^KMZF8ELEV*wTD@sYNon@f7oRom_S6gH^8`5-Z}fz#(x;0D1IsFH2?0NFre zVKzonz4R;g?T+K6UEbxX)S;(X9bY`0Mf(Qe%v++3Wg_BEujBX;XPodRoWLU|zIbMS zgLi^qe~FGNRzuAV32A+A^4DqiDu%Bh9~4ULa|mgdRw5sL4Z9qm-}AP#6XH_7Vp#E7 z5dQmRy|!I%?eQ%Oh0g&js2(D#f*o-39UT!EgNCE|kSO^s9;n)-WFPm*BP(|n3NM}& z=L4-dLA7NE(NM<6HO0M`!n`)4*>}VIC@K0SS{EFs!}j0HxSTaQR!;3PscdN$<+*z>c=^JL5%}JV_x96>{`eG4rtdqio=~QsrBc{;Ky$7K0r$|lpDUIh zbG~x)*I|sV=1bI(P!t7MZi9rfBo*>#Y(#h8r-IG4cIF(B5<(~fC?t&vpKpZS>dfim znSDH(OFLe}+uK0S)2;spBe~^v*_3ntBf)|%3U%WTac~dp6L97e+_9bc>}AVc5YWtB z$~=K8K+=?nr_^<*@93lCP}D~WPAz*$T1-5j{w?b}!w<@S;oYWr4W7gI#jW1%p0qFZY1EiMtNoyPj;4mOn_a1$jgGHk3ZW;d~W0$K$inX8Z=6+y%0XjHcIRLE<ziw8YB--{q=I^D&aank`aI2fK{pmx6aXd1L znqIf6cB3<&T;q>j{+&Z*Z|LO8_RBF-wT$;=lHu*nX-Z$jRINnG%}&8Xd;6<9ptBp3 zVs=Eim{RBFSy3M~#6*_y{bbAyGs(tQJ{3T*QwiBv=}DTfvBW{ywHjoTB(=W zq@NRk4M@>wzy2FzEbkTmJ`)9Zf^1KIM!ciS96pGQAWXTYa+Z6D!$?hf5=S;OE|mBY zTyV**n0EE37)Wv9f!#rscGW+7t_(1@xbZJ{^o_4@=11OADB@(6OA@ZbDs6U2gB_sj zL)qgEzGfEQh}I$Ug6-#HJ+F*I{T3G&4vB<6gIU`?dzj7!A}>?~hOp_%2s21 z#+SRg_Bk_TE>;<;>d0Qqp@ zPrEAm_fZW5yK{hh+m8a$%1q&-muhVQ2GV)@2b&wEmfeQ$dHhdi1B%raV+$pLAtMe^ z4IkR(hH)z~pkJmO)mm7i48BP?1qWR#)57_e%?1dxR?T{ma$4KC9T-PDHwge5O zVe+v!Dawhq9>^C68GCU(0Ms ztrs%d@Txc5umdvGg*E~QF!6#$K_dxx> zUU~V7f-b~v&Ro(85_|y|%CL8pkiwS;#Ier+hxSFcHxHWA1>Jax&w)$-A*He9ua!H_ zd|Ct)dBGzMd}X!MEcc_b(WCYW{~H#q9*CAV!T9*b&#tx5-^Q zr9j>)aAry9iTt+yN8dNWwVZYyy2WZ2%rdwC@>jBxUiweHqc!|MRcpv(dSKJl#QfYh zesng63EuodwG#Y=m%^uFlk`3X*TXig;lx1mqg79Zxo;5ry@yx}3qZWnPZMXu_Y6zB zWRnf@LOC5imGw>b_wylL`I}l3a)8+TfZnU^QK>A~4jstF7^jPizbyS~UObnu~YT7%tVpU#3m;WqSX_Kk=v<5hT z0Nb~`zBUg6;tc<|SHL+d3;vI(w~UIikJ`R3KOBx55ne#clpXXlh`;8B*#SCZs_dbqe|8~wB+@D$CYB4wy*oiZW z|6WVL3P0x=^}T*E4)$NS_58<=+i{_`mc7N#C{OIf(WaloG;>OR8ExNvIuxcpXZ>BA z4ZC<#r;lqsDUH$BuRe(_q;yEa{6x9}Q%=Qqqnm5oqTiWbf3&v$dOGLd!(sDo1CP=A zC-QDiz7TYvPD-n^d8Hh<&#dT+h2kb-x^cE8U9gyLGdYaVw&zAs%$hrNVYw+Q<~r) z@ZwIWk*aCR7jXUY`is5rQB$flkx0Pg5U~!itogAqQr_W_WQGPko?o@s_|F=MuTq7A zw+!}GV+mrVt4~1yz>`5XP`9=7DI$ErYHLr>M+7=Nd8@SUnkJZ&}~#&?uwO z*I!Ljx_(jonsJRY<<4|b`DsQkV*%gnQ&rQpH+cqF3G*vc@GA}J_*3~cR-TBPW2Mc} zp(kuk3C}PQv3hGdLQB_(Z>zP@GFzfJEkd|v>!?#ymCpqDgW1h*H3UH4k)&LB%8^WG|^-{}eqN^=UiV(Hrk1H5)V0N@(2nF&VKkZ|Dqny+QkE)sx&QZT1)<=!63Y?4 zshQd`C=*#El !RX zFV6+XW5@!AG(1I@M>g zOhm?Nwycuvx?$)^CBVS5lKh<*TW6~;o!t01viv?iFp+8|)E zZ`89lIHNhjq4Oz3h3;$pkY1Jzf|`p-r!zhEQpI(L89cJcO1YZ zrC8&ws-vqggt~du`GrheWjexX6)?N8823s-Xz$R#JY- z>vw1Ie`xY0rr3eL{E0>vM{r|>=JR(W3k~DnQcY73gdJ&fJyVC9J?Y%&oU76cP0GKp zU0v)kR6~Pnm9$m&Qq^mZk*E!hrlXn)E-g{Z>^td1@(4I&({Yv_TPxpW! zAMj6-xrm)A4sKPv;z8^}EZ^p&XMtg^krOYLMM`bYbLr@u_6Oj&81y9kT1}S`BgzH* zSp7AXxw@#4^^c&PdHX#n*7|eJU+{bP_RxAs9iH6{rVW$(`oIjgAne=58#wnw&*m!@ zhR4f7H^h0^G6xgA-qQqAyGF&~alJho_Y|H~B>cCoa+`==xQcX;_oJl)jk4NptDelt zw=s{|7;sWb%fXZ)tL%qSpc4M@E8*{s-Q>SteQfwnCZgV-#lKv8{8R%^a>71h+~IUJ zJIWm{Ayj3zA5VWAA=%S8G+sdWKPY$-RT~L9vYzP#q}?%=84y*t`~MM?4-uZ^XRq}; z-i#fes1S<{1K)eVakug36d`)im1MuaZ`#$M#+Q&;a)U-*?BgNHs+s@|OGpd_C>L^WJF>4gfa$hzfNA0vkOE zs@h59P7bXQNu_17<+`D&ua7xNMG0Yt&VM^U0jmzdXcdYV$Fak=vBRSveHfw7m?Rta z40FEGh^_tklj9pmoIT5pE_q&0@rM%(h&;$k^*%&PwANBSQDD!P<2kPJA^pj-hT;43xN%!d6B7U8Wzryf7Wv{KQjMlUf zkHeXBQI$YBb} zv(_fw#SCv9_h60JD2YY$Edh(qGY^O4LRS=POUsL%b19p z((O>Iys6?Qi0V0Jmrt_&EF2d4>Pa%fJ5Wx#m18#^>f+DRWZXxqOs``t@s;SaN&H-; z(gUcD_waDse2C zE45`r$^H28R7l!nx&0ap8(nE05iRY6>7fW?O$@R&z*CYrx%uT52-d!dLjHNfpS@Lz zF`qtue}o;68es1lz9;9l!Ipq*wvU4vQRLVGI#IZ?TN>aZi-O$OWdmTc7^U}>knZG^ zusucFKA6HxFr7pU?oYB3sb#)fa=X8C|BBc2U;UM?3!{L?zSnNT<&k0o#QuL^VXLP} zu_)0mV1`2?48fsd>JPNXk=J$)_3^Y9ls4u7d4^-Imp;%2r$6lwH)ZP0Tb8O_L zRRo8ZpWl};qHN|j7q27KqXYy&21B&WbBArbpe^ev13!ldM&CA`W#Ws-{KVdo0?}7QQFqB6z~yP?}QmEWw5JW z+_Cw8Onfaj1pl@6+`bcLjV@s*d2j;4`|@N__+XyJ^BdupZ|V%u9kc;cbcX-fc?AfUWsOwbI#4QmE8g-TW>MO@4a`Dv++w%A_)TnkWvlJ z2{*ZoqkB9HNl9gDYqa2Y@?m<35yT&yA!+*<3I9(JUrVmtnlYL~b^T-llc)Z_C}8+Q zBJV!M>8D?&WBFYL2Si8DrTN#viN}AL_MdM$Bc6vJTNl4ek9Z*#`9v?~=$I`#b^i<@ zR#9TXDG4V3%Q?nYYgzI|K-Qz!96MR5n7H~XxLc>dG!160fV1(Mo(41Fh22$Q%}*Q8 z_eG6__g8e@8vym>w;;lR(&uKsXa3gM$(TnwzbTZ%mfQA_xO2 zTpjV-G$e9y{iZwIeG!B$DkEkMLUQzaRH=21XIJubVJ;)z>Bz+-p$Eiwwu3w@8BiVl z9D1*J?jSkJyt}2V9fn6TyVl4axr8g8M|?-&VIGpGn#O}mG~$xHK8BtWfk9!f(lA*R z%G~tdaDdXT7Y~>UY!B?=kc|26X;wF`489L6#ZeLbYg=nbFu&L(BKW|v{Z*38NF4tO zqT+ap8}UBMUDcHLtEl$>%m?&OyIl2)Rr`Wy;NvUB4H$CQ?&fwxI+$kQ*%^PAF^QlfV7nFV{NaD-yE3JyyuhBd zEX(u$9uJ{equVcXX0nMhui41d!KDa-(c5C!f9nj@Z+&85(XjJ9wkyN^_;|uw)w{QH z)(IvQcP_>zrh_*THGUtDm!nIri-GYuz%3UFN}>H}gcV^*8(7nB#{7>T%5tRf1-7?= z=T+5K3MCmS~qM@jkU4izKZEtCXlXFCioOL5Q(`$QrcCPXvE~}86JXtKn)=)JPQdjr#^NL zb%SyD_;iF-s~*g8v1rXLy4Iso2ftNbK0?McKYTdV=C4eKYQ9SUoqoG_xoCyJf2YGO z^2)a+v17MhDxr-iPI|ttW&1M19o7ncO1_FdFEf6hIzz4n&Rc40cYrQ?a&zP$PdWx-4?xH!5aYfX?5UJ&i8PTNoF+wU47SI3!3~l*lKP&9D{kzCQOi$v%1r(yA zm4EEzb$@tg&mw1FjN?%;HSSf*%l>}lK+>)|+2Ob|U@!%1ErQkFmu(XXwk+oNT$Fz(^3A>@)*lW2cNz{Y`8x`*k32(I5eM(N zp2x-2OImw*Qe@lS&5rE|#IS3da0Gq-NPkm>3g-Zgsn#s4DJ2Ecx^=%CagfM-}^+ zYMCuRb`yPi?ms4Ve6iTuJtrlrZ^HHYTMv{Q;-EJGcK023EEASy)*xE~;%I93%e2e) z{r}>e_h;v)BkxWQKw_9_w>%s+1sMFU40Vb|zfQNOTx8>`GN15P+_C3)U!_XMK`;F8wfsEmdn@^v`xc)j{E~TSUD>Et37s58;0us@Y4)_^+%62Qn)B{{|Bgf zn3V$Hd1(VGe~Ze2R2Be@N$tiOQdxi!?!;>w+;eFy?eBD;W~Mc|_Y9xxko3?|-&?z4 zdXcZ@BI21p?mb(;YK}bB2$6lH98z4dgfxHoMZ57L8&B&yQ|L@UL)U76tnV6{Il67K zu3A*#O|7ex{t96<#ECMTbQDnf(d{6F7UdSmaJi+PF@LiSmdo02$$?EU^Yhh&cl|AE=O4?+<=z2;J>s}5$!-XY`mR_ zH|8o^%ltocQ{4fbX!o3$i781rN_US9t&PIeu-c`u6^AmwG;AFIF>MvNNvfiJ$4l{z z2bjg|N#y4vT$5E8jQn!1C^!cwOP=Li3(=IPfd7u<+7 z_}KS$l7H!3?VC<6S13IJEG}`%0@QX>dWK|>J1e_#2HQK`kqOq}G9!jAEu^#$dY<|W1w2IiYbRvTOwQN#nBN!59o;|UKr zh-n5)${v~dAwu+kMVMn5E7*g0$1(f9$HH}&LK^7pe{Jyk{- zX&{=xh*{hNf>6Ozs{DyEtdGG0*}7*S_bfyaguMlVsF;QnE-t@w{Wl_3a{=w(^pk>MPu}oGbjs zcNK5sYmoU%B*i5^Ic7}^p&8a#t`X?CLqEduRb-7VHz%c>lPh+m37ONMu#~WW-Ui0w zOOt^xn%zsf3*uC`_D1boEH&Pkt|+5{{K? zv0ER@U2Wq`4{pJ#M0oBVHd?TpGQvsAeUh^|_s&yllsZmp%6-tj`q-bfW1+bTb<^$k ztEC!3k%*9D@ zoTT}-8MgutJ+D%G^U7v2on{6(IL9pHND3xW^Y^U$a$|4c-P}Yc?xL5?x!z|8*of@u`=pZQ&pW+AOAGKj-+tQ zP#-;8)0rx~?%xi-`{wBtG`EpeCo#)s;0m0*?`L~ifr|XYZxjqtCW-Kbx^T!vw7l3h zSstT5w7PbuSx?`Csh{w|Pljd z$9+HqoY@s#8t%pZD7UBBY0fz~YO{s9G?&zrUt-SBFAys@&#^%l9FqCaF#NsL43t)0 zKoCf`FnA5Be{r!>EuC}R1p{zh{TZW$0zC&&qSoCXLHV-QD~&5Zq-VxYxP+-jAo*U$ z&Zf!zr9VSyoa18UYir6wT|=qL1rNbRbAh}jRZ7+^dkm}l(|pMZc2sr8)JMdVZrT#h z--)7AzGF)`d6UCN_`Wu z(w^c6iy>k(2}!CO=v+ZV4@H%^AB^m}4>o=3M0k4YK;Ui@PywJt8TWFV?Zm#k{ErD%@F0qv}xh50zgOiUT7 zWISvJzSWZ!Y--#fscM;pdaTl9|B6JuqQ`vzb!IfZ~lq( zj*>%pc>(NJQ_zu&ev)Jx%R<8X_i)1O7r_IsgM0nseeda_7_?ljt{`f|x zQvvJMq|*_#F+Q%BW?5Sd9QngW|Cu==T4ETQn<9bZa{j8{mNHrtPx!)=2UB;vlDgj4 zQX*^vN#r(MBe$mTR*^is2XG!sYv!1EStWc~dW(yH<31-jfHS!j{CjhKIyQAD*0{1m zRuJ$b!%hFPJr%<*b2>58|m zkmna|V}(To>$#{yborCVX~-WS2Pt%O>VmERd-Bxk;#d5OZEJ$6|O(IlEj{Knr6(VeT!R-{x{`JStT@C`cYB_6*L z+U)lq`65$+hz+kC{N5t4u-32`g2_-8QO5XUz_IJ;XLu}vM6shXQs}t-SldEg*N+-{tL67>lKLTh+z+sYK5ULqc87KW%lA?mit!j=(b&w z%(@zFuvtB!ihnN+Q3b@o)>J*+;zxq%T~eq>tu6c7f5;@PaNL(^Y8#?LRh>^07a?me z=(U*P<~P=yR0#~N8aZ@2(*_aRN4Hi)W@s>I)9(AI{J(NZ3DNEJxAN>M{IA}|#-k-f zUUiC)A^MJf_QtObL7^@a39Ku>ptuvI(?~m0X8|bc(u^xb{jsPdBqqVyI$w1a$PFI3JS%Ti_kO{EH+R*3Uc-6H@r`Ycx!nb12PRaPu zbgR@5zswXRJl<2p9zB5z0u=ZzQwIa!^dnBRdV_E3k>H?zlrnZ)E!u>x#kf+0EQi>#& zvPgvtVguYFpUtS%Lw_uV`RTWLKs0SUecIO2zd16I7})WBU*D3!RAs<8)2wp)^bXFV z>P<^$oM zo*yMN@-HzU89Oo7)Y-Xo%B~)*T1nR^z*8oV%8BHn*nd2}3M;1!P_Rzy5){F?`+@~U z?ZA$xgrMf{_oVN5jVGisaPM<1ZgOHUE<`vXz6a2YH}(`2qx?~685l!TQ@?vGQln|r zAV2(#TiuCv|GB+JYN8|V6iJ2j>(Ap$_Tfa`y&>=FGO3%M_Fg$er-quACq=I1r+jJr zN?WqcQ$4&pG*po#bWl#xS+v)BNZ3A}mq+sWvG;!~Da%`ra7Hwmzl%6g;gpU4>Y9h0FLItk8UAW1E~)XKo94VQl;6#ZmB|u+P}}47H@68ltO{_AFF~4Y z4E5D1om{rj^mvGeo^x5y0f^>&mCQ%UuNgzZd$Qn(wf~HtwIr7)^-;&7V?{-yc1wxLf+z~g6-TP1ewj6(rVI^h5 zblh~ot~%LBfj#=rClHVIz~?P4&{e`1qBfU3bw%sVl6i0Ak9eT;zEb4cBH0T^m%raA z+9<^+xJ@6d`Z4#(R5MWwrcWp_e;J&$4tCI0x|Z&o@!6mkB5(K8H+QZeNBMS$kO5#Z z(Nglf*>?a<9|nWKZ;0fdIRw?N@77vlNMhL7ES)Rr%%yq?HR-rGH{8~c8Yg-0xsn)} zV>LGHY6tR!aI2Dq(`Ng(Vpr)))Q7>grEY_bvfo%efPH%DtOaNJrF(KUgrNI_xC~hg79F?k$>{L9w;ICTF3NT>d>Lc)d}=zmFcsI8<& z*7x+INn-OZLvhJ0h2Rf@fBi~RQ>lhJs@$LnnU#ykVMsOA(VtNz(>>DdgSB78;h65Q zOx|Xd9Sn#40@_M|&+D?qCBg#GMplaD>}#q(mZ_YY8bMCV@LuD0skr_7*KEwp#-ugQ zYb@IOx7Tm2uuj50WC`$!+nQDn(U|_?-e0L7vKx}o-&LNZ0B@jEe!hELD6Ifos0HS) zFT97J(;z;?s#9bk8?)kap4X4b;0GwDiG5sj%gcG<)H>c`sx`qjCyPcv(ad=dy;Gz< zuofVd`N}?B|HZt;Tud!yh^R{%F&y8u64JLqLWS!E-#;N-dI^SBfn6fV6U(k~plkm@ z2nFc%8wPlyr%RP+S^X~wE~hV6Fes*%RVfkjraU%yL!@?ObcIqpt@A8!eNZq-NBBDEL zWBG0Dh#cbe-`dC>ZP|GUg#Kh)6?atbaeA>YgEBL{RZGk?GC>Z=2Q2Xbhn_73-(^3; z6no@An)ks6m3aB<;~-BAM=g|YDkegFFGrvNgcik>FKCgIU|n4Y-Gauvx`x|M2fob4BaVDAP7|W?wT$rL3J9-5K%A{w zlQlLk!H9POF(JI*BmM3Nu@!dnD~?xZ_bso~q4ozKP5T2$w>L6LNS9v;nEge&kef5| z%O>?6*PwdB^_d>P1T5mzm?J4p2H_@0S$l3@rp>F^C@rJAh7qf5F`BG5&(X8=NUOeI zn%#wV=x{l0eF4S%yUS=nzy*CZhkOE&xLLbKJ@=mt87GCEP1RC}gzWy!(nf#sL-v#E zCK;M_)wiSS4(sW;LQQx*##n}w)r;og=ytM2i3@9n^{14(xI>i#nSh8CQ7f#I@XC2_ zXl*j#O6?1~gS&&uG`*`L5Lc4DywCe0T_ExYwCLwBRH5^b*rP z7y_d`Ue3pT^N{SlV&SKCkz6&z=z4AVU({p>KaPd=lVrZ~$7;v&Y;-LI1FtbLea+HM zyXHv!kqVH;w|i$JO3RL@JAUiQemkRthLp_XqekmyM-%*kIu2Aa8mry`k4<7r?C#P$ zPDh&fdCvcd?q@>^Fc{f2{}Sa9@!LS;5&+GQ6D1asl9BC|1pc z?|SFnjkS8$Vkj&OL(CX71zjq6{6Hd+u7kLnZv2l+k2u1V273>kXRAqP$o9X7we47b z4bN+8#hgyuR@iJ3MzO|lO(S%in{Tz4Y;@F4oQOn(Cd6CQ20Q3{O3gP#-d1~+MZYt+ zqlUh82a=A%{vy~D$Su1uy;tDRZ6d8_R4cSkZX{|c*bqDGYn?=F$z)YU~@0qN(=C+I`+VKjG{OM8iL zSITGN9(CraFU`+KmcR{-)w4;G2#6euGqu*f&(teGSU7(^7b($h;n_ysb0HxWTPd1GjX zKD!oT+y2=&+kTd}CSw{ddSpDbR`qHPCU*wKH&6!FG5 z2#Wv7Pev#xoGq8ejN?Wfy1UX{>K2z7LO1%KFtCPfd_A6R!aYHcu3%QWUL-5pQ<)%u zzblMNf2H%9N}v)`v_AU9)~dF+4$Gq8!kbGPh#zxk>4IJL0NZ|+9F*n5hZ>gjbj1=N zw(5T1M@D#&>#Ih)`+r#g5vr}D11rKG5eG-cyU6rL zXe#~m@}Mr@6Nl|*^mMd>!0UP~JwCX|1!?0xuW$jK8D3uX&jPGR8Rz5KXJ>;>ExmMH z4JxG#=ge58W-gKwHB&J$ULfJQHI+MQuN^yeb!k|HKu8bKEB4&DCF0_95Cs;8opgWW zvOt+py(g?M_%38Sw%j^`?$^DbKLehPFSD$8>+h^s+$UEL$-6ucs_mvZXzrMLR0YwH<0<%Q7!|9qeQnaYY@_OHg}lu_~Y6~E(cA2mITr>}%@^VF*= zNsok5maw7kBKLG2>3{wF{J*dW8u9yBNtWT9ZfL_Rk>1ACCBoPh&XM)y^WWzLma%gK zHa7{!F`Cm*^R8E_wx)}CD}84E(_$AQ0qf)8=crBHHG%SS@jvr*s@9Si@$I}Xh|1K$ zUaj9lk#>aGZYGO<UT%}A?; zhM(UTWZT>yUypANXZW!A5a${VmG7}G8}&>?b2{1Ed-Md<6aJQfgf_}CUS9fj{TW++ zd#tayp$6<&Z0E~i>JDIDJ=~*=FDHu78MoPfFU0lb)$zaZtm$KflRPAPf*;&3ips)`7pBv+EtfeNeohr`(x%!>J~zvj+8YdzC| z20Ab3Xwi<`a({i?is$vh**dZoN9L^`HP(?mdYoZ8+Wxqn@Ke#R6vYP(rIK=YpA|?^ zfALIEzV>aoT-1qYI=nwOzg*(b;^3QWTfxy~ko@~rVkPvhxqNegYgZ*7 znpPI&@x)EweC1g>s5oNsqjWQbAJ3U_uj}w%&u83T$xoL6%xSxpRxH(+bJxi`$BL2m z{dtbzC-9lrZb<0_BIjcDmn&wD4@XUHD!$|P=-k-?w{WEYjf1y^32~e?$rUi*S$m z^BM6o{#2Pg3x!k)W|C(D&FGcE^<>vZ9!;BE!}J!eAFqnU_iU4?vpfiPWw2MzM>*Ad z{`yu7dbsyQVIv5V?s6Yono{cFAYsaq%%hB=sqga^?hY5KZ(Hqwagd^D{GL>f=)o8+@I{PYDv)cRxjN5n->0+!|}0Gs`1cQCCn8A=kOb( zBU*{KcVQ(3HxV*hrQ9N7KQVn(;g9Agk<>y|kH8pY8oy@!lcfosklL{6yh&bu(2Zj= zI~Q4c1~*!3ct$W+x4PI|Lf#egeASe&zon!?zRFW5>c!tG1Q)QddhAJm&BV%F#{-w9 z#rCV7c>5nVjktR4BXsz!>IrRmf8eA8cNgs#sWq-&0)_$)y>(32-6KYBIm=4{Z8Er+ zp<7G8Q;?c3vWgLjxs{&G@a0P7q`Tl>v5tVqJDgFo(YAfZ`z)3^HPSbBDN6EBeBxrF zpLlB%0m!*gS9(uWFvID`=UCunw-*B9`b_7{Y~5AKxYf#(H(KbVvIsE#TrEYypWHhB zR`T8)en<_u-NDAeNvWB`iJBjZc7Lebk(cC>A+avy#zawpVR!8J52T_TvrRRwe!QdJss4<$2q9M%BgZiLDtmBo36me|^0 z?6>=X+#T?i%FQ%Zt0!IiHAVk!WS|ItBX81S5aXUCvrF%I53ACk^7~ObGRP!0-g)*5 z$aM;l4+GxtV;vT4kNxn<&t$1o)q&>cy61B-D;MjAi~>%UGP<9MH){3X8Zng10&+ge z{MYgexH{7@EriUreTfDQt#kpAfk6yJi43DSqfz`!HAEh-o#aE`4y@SU;ONdxGEF(Z zEQ*dky>DERdwt~#c99!Rtq3(Zr_pz97&uBhaks{?Fd@9zlA4QqT~MV(?FEC6n@eSG zkPzH3Q@bpRX0usNw^G!RBS!(6LF!9N79?)S zJK`?ABykRAUB8`&b!#_XcboX@S3G`|WzpI+^Jy|~pA^8xxS+I~TECe7rae54-_L1X zt*5K=`Diz>dbVV=Wks4vjYi3zh1;=MsO3b)tM}j~3}+C7@0iSCvW&E>mgC5rHif3Y zUmuX+oX#z8VT_sKMAn+j=Yir_dOSb~Gba>m@2+P!R4%B2y_X6pSgb!q)E}RrkQ!_C zI|YO>idM8IA1GEhwnPwh=u{;oiRzki>5Met+J3eH&WC#2%dC~wkKDOqP-gj3G73;;L zSb@megtaV**cdxkyk0FhG;FvnMU7~ChzPkEKZH0oL#|bm-2|ZNZ|V;)rAf`!@v*6R z4mKKzpdb6}<$oQ&pLrrwis$_wy}1cBp;xmykpB5I+m^jWC;7w7BH5A3mV{FtK)-TP5d#0z@~8=L z46iGFH=YG44QQMl`*Iq>eESt(sMoEn_YyKGNt!?Yq9Y0 zlf@>#f8N=HRAqyWR|}={lJnxZqB!*dpffCARIHd0uInw`r{OvQc+g*|rdA7*WxroH z^1$177v9$>vqQcHRM|rN6M(Suoy)OrvLW^RY#e{cg^J?nr33 z_{LX_wI4WGTJeb$UUL!YkG!ZN{x9AiS@a9sSW&gsDvx50PWzO!sG_Y;U!{>_TN_Gb z{c&NO(2gFoH&_Ol6)4)t;z!gM_ukS9Tqw}3L?vXzN*#Y+>0(^?kv*|fhN6lEmI zR59vg_-@MjwLb38(C5eEnmL}A;yu=k09kT9$Q$biC$zxb0c18$G4UsPQye-LdmH=S`>Q*y~ zfih~XdcuO`HoEf^C)Y*vb|Q?-WA8OsnaY;_XB3WI5yCcx!(8O*7%VK`9%meg9;t4{ z*}5V6FIFa=ns6oAQ>cvRZ1&IQffnMywKNs_xOfJ9JjOP}&WIfBZ@qH5>}QxmI`ro8 z$cjPJTM!I1kKY3_s45NS)G1Qz-^0A02W)fA!WCEKo$D%x-Z%6&jzOAXmd1DPpGqgj zW@p1h!g}%bUJLe<*qXN8%znM?+qM1q$((t+1gqQ-I}f44J2hlj$URY<^9+zx#&B2hN3N-1{CkI!yX8_P$?b-pAilwkpIY6O)1rguEy_ z28M4njuv7^IzlYR%erG`R6ksLe2_Ou`Hwwo^qaY7otGgZ$-Ou3T2d+W&Q z084Q&1!r5+O?NBHL>ZCjAm8gFIt(uj_Dh{!HDuEHrKeKd%g1YgK^I%E=nDvZS~1R~ z#p-H~5;IORo~7QCTYnv0)10DQJ)9S!-eYU`n{rXdI7%;=V0amYU=rY%)BUH-YEF8j zy^qTTrKJ7JJur+U2ho{Evy@N24zs1fDi2Sk{)t_;eq@0Idw(~}C{;f*t{OgcE;~Z| zs2k$vr9H}cu-iD^iexPK*MOIVN33IZ=+YPs?~jG>a{o)?qp25Tem*y~}7U1yfxoa8u_{=B}m2 ztT2>cD6!CXx-A1(JMV#Biral#(O2a9rS8D!_Q9B_};< zIz!kt_|Rdgt=mC&jEM910XmzDQga@275~W5InbkzpVO@h97og9zV}_{x$}Fc$m<84 z>HLvQ=Y0auT-|783&!l+VKGY9r7G))mXe|J+B~nvR=%CiJ(G%1DKS3M&{ih52VD;S z5g3rf6fG33j-a<*Cc73#$$z{MIz$m-;>j9#S z0$TepazEa(I^dD@B|`q#LBBtzrb2^RJf?bS-R>5KV`llAJ%z$U?k+a=(%0%8BDy%1 zSds1N!_a`u4~!MW{dW%l-`y3wmJ$=LKhZxEtLyJmKbnJ$4%s>1JZWorP`cF~UE6wr zxZm$qf>h`OhDi`;A6+P_4mEH**VS`>`geejJ}u-fR^7V?z0*9yCRThuu2a7+Tokf& zxiH&>K1A7jc8E6}l0@1rkkeAGPEY-iUBWz?gwT)IcVCN3N!0|+8@ix9A|7-~Q?{{$ zwz>w*h2XPUJ(Lif%6b3WMeMkcYm7O`^^JR3Uk3gfo1^fHxoJFI{fn#Q&xdUf(Mpw@ zBQRq;`9}!{f}FxXeKL>Ns8R5z!v(7Zc&zD2r7HK{X|w<2@@Od79&Y7?+bK)B-R>+E z{Tl}+`^^U}gfRshhRok$Cxu2CwVIxDj0^mDdX*71-tmD0A!gCv=YmS~D(4#e!$pLa zL4BZW>iWP8*F;lkC@2Hz(FnHC@kH2pgR&ZP{K(67(?*jSRg=Kf_$XTsbWF}pa=d{d zMWwYWcUj;7CYMJ!eS^pgK8b1EZh z&72f>`V%{@b67#FjI+h^`-q{*0~Ro`g|Pe9Tv{TW%~eAVelfcujI0|16`P&L^=C^z zYeTDl^FAQN`KKa>OIwZO(S6ICCU=CB*5UwyMG{B!Axr1{RiE3t{|rn`12`k``h5+O zQoo*Phsf}5=M=2!@pF{R@-RYsZ1~Soa)axMih?&ef7OjiBz;{m*#6vZ?xLfwI9?FD z;u26h$hjR7K5b^3T2mf@I$vD%qFu^fAvA2B>iPH+`Eg}--WWjJiI#-gc&rli*)8rxh zzf<~WUw{9mP(P$eSd&@Y0{Alk*e1Yov)rn81}i*e^|sDqF@s~U=>D`%Rd+YVih79y z3mpIbXFgyG`)Hw_4?PHY>#X1VV5j0RrH}UtOiTm1_857(0g@Gm3%eg`6*^e7o3OS3R^ZrDuS3knQv1TK>t%^Swkh=`S=>$F z=SEiuyh}bFNmG@$iNUCIJtQT%lPF~{XGZuyY%gK?f`!GA2%WQ3^u4ItTSk_HK?n#l zP^&*7hDxx^3_Wf3=hxPMg$(V6Irp5jcXF;YMA=2%O#b-|qD_U9F?CLjL4;a$#WF8D zwuljGxgpWfM4KLF&d%X5_gxE7@TJe2+uKs|1p9t~%)wne)|C}ZJk{3S<4|;Xe7o`) zad*0Oh>`}N-T@;6pk#St0kaEM2d$87sAMNF+6C+4O0g!51oN-21g|S)M^gS(Z+~9d zKN@9p3rv(@nq^IaCB>hy@qq_%2QxfyLY4k|>jq5Y#OGh;%vsL&PQo`<6i|0H9&IS1 zHT7f@S-*!Uu%6wBJ)4nSFNi6rd!<1G*@jdX{J=k_GA598UZuKgDBa0R``Qu$Ulwb< zht3rRzOkEq4`+&FH7JZDorWcdsoF|mBbZW-Bwaq6=`9>5b|gf{_p%Z7VSZnI@yBLK z3&g4A4jn&V+b%}jtN5{i7$8JXGsCkceQOZxdj+dh{DEK4$2_sspVQffopis= zoT*YakWLdRk9^_TW39;-B8?xRp)R@ABjM~L(oo-y@DiPQ^0bLe@6F!$hH|*- z%s(%^l*QO%Cqz;X#do(-aFZnOvBN{W-P+)FE@{WDFD&c+3bo)HVYVtPR;Dq=o#5YP z58p$ngB6x>qKsq0n*GROV+eTO1#_YRF4?_G*mzvU|rz(gbRCdD`GAQ++xFf=!z z1J+N;Op=Tz{e~nFv*pbUn1DJRHRg~F$&oDUp_LVd!S)0VeLv`H$;*o)`E1(l_b{f9}24TF3WT z{cw&sfuEm{LApLHpP`plW@K>^UDqmP(}{JjaHT3Eqcpi0RDVRGrN1X|up(Jc75h_^ zTLC$>U-GLvRRLT1Ty!JXuw{$C(oLg^`0hPXX_RBY%!Ri%tYP^v(eo#VzwS4 z16BegUmB#-W`!qzzU&3BM4w^~F)Nqdhy9J7W5gr`ER}3%{JHV-3L9;kqNvs4nB#2I ziJF0MeNY!&7kz%g+&m1Y<^-m=!NEcD>XgdsZjMdt@&a<)a|S7kTWu+13FDFxh|r{P zZ$(0@r~Ifn@p{D^#2FB374Z?c@}VIfRr&xX1vcN){9cA%LLJ!UJH&EAid6J9;sF*r zZ^Xum3>GlN4G!trwtfp$NcYX@rJSc$XkATl{?K8=_B8t$|AmASsXvmR<~{2qLkv@1{-EyPNUre z;m#Cv(Xvk8`!xk|tt8o0O%Qa_#&2UKUJ-_WU@b;x`UL@kh zbQLYxS-)lj>kTSP8M(As8CT`Gm*1~pJ$KB~v6`xMML8p6{mq`8pmjsf4yLi+Pz=L} zy41EznfF|BplToW%rrReN(+5C{09?T>yph>HtkXAi9PiWM#r_!OomW1gVSt)|&AXG$5Ov-AJ!{ACe zVl7~&&xr7qO+$2!PLGX0{NAP(-nv(BXSMSrq?6Kfk1L8&as^et+ILX8rE#)bur8pj z^T`L5`B>1X#Y*u7)vB4QJ!sV0-c)1WPs86@hCj^B1)O*kq9)^x7C9l96K)YM5nuJy znC~?niauf`-fH9O@;RA$gbRKl6-ubKqA&t0f$@<^#36{XZC=Mqx&#%lQ-bV~fMF`8 z=K%Im3z|BbLt}rZ=oXpG9_L$1xN&dqJb4QKm!v^1MUdL^G(`E;g{u%b`3a`cNnKlR zMFysz;+gN)x?h}IGMRmweEA`Viyh_6;W!J-4Z-x4yshW@vX4_gIrRPOlD^CE8qjJ{ zOqoU4ojvaO&6+1k+k%_jt z;9AhH9c!A}4njQ>@sUNk1vTA4veM-KcS1|@x0Jf;MLeQ02*IbX))n!=Bo9|d*!X*ZRvv$`}Rp^?1WY<0U*7- zJJ~)xha*+}>yVSU8y|yOrUGw5I9z%&vZTyE{oLm{O{Ejkz$wKln}$hfjL)~PSz~hL z!)rpl%2e6apDEx*H=nXm22W*a>zI@zoq6 z^71mXyvi?^C`h*cprMsh7i*giLn*d~hblX_wlO+8Yf#i-2bi#$Pt*fq7F(UdcZ+3X zAmiN|zf7k6iK%PZ9tw%0h)@yodx{+>R&3vo_5B@=kl+cyF)-MYM}2$QB}dro`d;Ud zn|u9=QPN}FVClB==Y&WUG{d;`Lz;Ix5lrzy3!N=>`ZxPW<6I(+|zhPaetK^A3Wn1EeR034$=hWhK27$ z2aZpN<1jji^3@{Ox@B3HSYkEXB;AQ7n4l^o7K?s2oS6_ODE{PNb&Te>De}-K^!*HnYJP+|3b~(zJ`~>e#X48ae;-oL(D_AtC?{n! zIq8-@eh`t^cqrQ4XLdjRLd)E&lO{w!=gT1LLhGLwXnC0%MYF|Ma#f{M23dQL)@;h8 zfBn9HH!^3wZgWu4R$`7n$IzehJ3*rNk^yJwxO~U=)o1TYAXvy(riW9jtC$~F4_MI3 zQ;C6iiDJc{#j}X0IQS!o^X6Gc$5nX>OmBWh|JWC-?DJZs#o2{CzRl_|W83N~h6kXn z6OC&X<-$V_U!R9c#tTFT(461NHf*`t=EQfh(7Rh~w6nZAv)}zjn~icc_+p`>;%}5v zdrIAJa=#&g*;v_?{^bV?RG>9m>}aH5%yuFWic-6Z&h>V7uyw%orNK`zqGMuzWw(5` zVt1C6MnNlKt9ppQDv>XwU7nMiwnC+R*gf?4tF~7jJ#*0{T$I_lZY@3!QR7g8D%*$C z5vtSB16MM3s8zmI!t3-1DFLt(kS{nWQAe}NSi{?oIT{>IwG=}`N23^>SFlS9j@f;% z{;g;$gUAg;DSV|lY6+EafEq=l8~SgEjg&S+d_1hzV-DIsFfZ)w35Ou+GD+E*@5`0Z zFK)kIBd9+K%QY=eBX-lLjz3s}+gv7^fV7Q+{&baNEb;U(?yK6Mb~OI{2WbJ00KYc` zXo-PJ5z2*G@llzb*XWDn58J0rYD>`$p)<1^7FwN4?yA$$zOq3uYp1E1 zd5+D;Vuv#ngx`-9=Y_uKq!m{EjJQb?4!f{*Lv*f4HdXM>@Yh1wkBTi3!ruy(Zu!Vz z8Vp+;#w4gZ^C{v4OqQz{oy8xm@cYgweXney92-6oC6G0=!?V}h>z@49cAO%Y z8Ld{rqN0|dDxcUKR0`3#qHT0$pex!?SxKBuC6}6<|yIGDv1+h+R zFcBS^XV~U`wSXj>Wrxk0y6MM^K5rj!uJ}2Y2=`DzwsDguc*O84Pf3n&-OekdKbU#1 zt>fGpInq0UWY}OooxG)J_~(C;K((Z*8Wqxbiwm)%NcOG?Zv4rFOR!o@{Sb`{Y@Xl z);m9gYfOdrC+bX3)z@alzpzpXVsq$RGehuKt}1Zx>?y9bG}gALKS2fp?`u^uD_@|1 z?1@Ls_PCk(GWnK{M<>Is7A@XXlc%m}O1zxZWz zh%-2L!zJFfs#x9SoqwFLo@I?m(UtiQV4?#=&EH7a_;L2g@9yrzOr!o=Bln8Wnn|Fu zFrWI~9T!7wC_2}@`ZWqS6ZOT!c&h&q=Z|B5{#XWMJqM)0q>ROTFUg2p8{u-GAtw>{-kz?iiryyEKSiM-kSW8&?hhSsEtU zpS-(}9iYC`HXi|luz2*62F4SVTrjh9n?w;o@cX7jw`Gbl%U3y8fX1V%>2ev;}8Lz2gb zpK%?#(A?a;wCRMduDN#30Ix>`=4I6Rj_FS-lKPH$c6loj0>|am-rvhqRMjo9Z^$&! z@Te>5ov21UyXQnTeAT7?kwT(@2oF&RDFGOdoIfd}{ofv=(vg4ENpIMEeMyt=+o5K9 zL-z2Ga`O=`efvs^C)SZh=((2ebS7q&l;zsC&vIR}9sEQTt&@U%<$)1kxh4Q_<7pNk ztc!E1BC?C~+V8{Yxz}z!&;1hrT~ksfI5b3CCwQnpE=Z#+ z=E_VdKMOorg^gu&4ybiwBZ`K=pQy`J z$oHPm64~t#Uo6+3o#ikklT<)wYS$nL*VU}q3e7@R%`FIcAdx)2nnC@wGAn}B4=)0r zOL77K4M;T`-{hr}>|68OgOdzrsC;`;WuwM~-VJ<^#xM+kBaQR>93Lz}hyk|Sf}S|Y zH-8px$U+>TMmL^rQ>FM~&1v&cECkH0ZOURC8qQc``h(8z=*UmJ{6w%_|s4-U1bpSiuZf&h#6{edu9jQ4= zBZP|1A-p(5MIBG8b+8c!l$W+GY;7Y?vZr?=B-`XFtI}%WOJm%B3GN-y7+FVl4Ds{G zGm(fNiuWGvmasPX-zb8fqUFtVmmkuSm|(=zGGo@q_L!w#)Ha zF&y6)EZ~FQa~bdz^I5NM9D5Gv|7Abdnjc;~^@qd7k*4~iL!FZDt*h}^)gF_qy3(OL zx3Uvf?p#>B>9gg(=gge!^c&eJGQiLgb$+w-{75C0p?hYX+;p&PV6jY<8m5QqQ<>EH z$6c69RtjJi?Ha_<9XX}Og_(bU_kL(=3J3DY_*r=nM-jr~Vh!~#FvmH$FC3w%wA8XO7t^ooryvclfaDPl8zZGP6 z`KHf$VH^Q z8^o3)Wg7KcgvjZ()f8DA8_D$Bc`A9P^?U<4t(A$1E*+iJ!+ETQ07bwlOAYJ+ZWVP! zfavJ=@Y~h6gV}w5G&&e|EBOew94wCSOla05Eab;@lra1~O+E^O@6^ImIS&IddS(a4 zmU0_`;`M0ymSq_6@z;bxa5BSf65eaRn<-NLvcb)kroTY6-_`dRC@_~_yc!EC<<5wA zH#QzQuE6p+#AJ(TR$OyQUOo2(nw9n&HX6NQ?3PCc^u}Y^$_LO(+x_r-JHP}`J`qVT z%zi!$H(av;@VRVoFpp|XG3c9Kb@=%0&*qg=Ba&Ok5!xi>Z_ClKwm0XaLqm!R=ZovQ zZppgnzn-TqYvU8uTjMJ}AU1APanOks9AB?^X)(r1oGF6a52&W2WO4I{n$}^&Mjtz) z1dxL>H;h9q1B?llvRPf`BFB062~z@4)NsyrCD{ed7as^g8q905!}<>fGzt=Mc(>YwHsv=HAv_w;2hRP4o&aA`D+xciMvzV8t9ruQdme zwy{_;SRi|ty*9bOrh>d;<>lz)^30FJ+`*%z`=gy$yPNrWq!;nGb>DF@jTfE0(Dkhi zn4R;hR$Tez#BQ>G5Ql!*o(_XK4=4}})oEpX&MPO3rY)GIgLj+{+Hg3^rK*Q-p-8M@ z;SO(u025Ez9=tn%dbS{*)7nkoy+2?UGSa`k_N&teigKRpT9qrZ3QA>+B96CTBSU{IPIPwQHb zXGc1Y5Euqp1_dQ^o;}mOJ>6e@G=PoR88Pd}_4#9MGa0McIXa$xI)n+8U&H=hY~I-J z#yzSl54ntTrdDRINu{_s>oQBiL4_YA!&4+O3E`_#gP;DT7}?<^Z=~S1;0a4uge@&0 z_p|38k+gshG=SDMIFlLKv}<q5v?-AAv6djAVDneg%F#Py!F*%et*4}(Nb40-S7vq{R9jKF6*rIKM zGMb2o6SgtE?hVSl+4c+$k5mnrAGI;@`lmvwD#SMrD#V+l&&wWdf5pfpxH&nJhRE-( z&egdId2;HXet-(juo)-5VJ<6XV1`U_z5h6?56lA=){laaI&sq~F2uI8{^75kw1MYz zbVbj>hT}7Hgbu!ldr`BHbER%@wfHrzjU(N{A}b?jo>L)QuQr^>*p$NIO&vvT&c4~W z_`5mj9&6goeq_-vvz6{Ansy)j23b?PKEuPqP!Rp(UHu9*El*~Kcep?|^)(j%{%Zu% z)8*#MObW?tS_+;8BnI~TUQj>>EOh@6@|#>%^KEYX>hmHhR9rjM-%|b3sCp`+J=e>J zBBBMPath-qG}tjqPyX9<5wXG0pH*0wI2LXd{+>e7eLSV3JBgdHdIP-1w; z67;taittF*X59+sx*gqRSVr2$+Z@UK;&%#0CX1<-fp{k|-|Kp1m4*uB9)HvBP2@C^ z_&HuQY$UI2askox;JUR{oe6D_(RK( zxkoccygWExojc`6vYW3%{PKgkG`+OPo~72JaDS8wEletfuJfDbsdjK^S%37%u}Kr8 z{Yc+hQd;H7>fwM+Y0uS*cD_q6)FR2L^S~9-P%n#=%L9Km zYR011p)D{0?7IZ^o)6hN|8zDKo|@K%u{ksi{FSlzJJfy z?HkQHSr6mv4D|}t1hLN)gS($ivoEu{5aGL#>O>?t3f%0mk6}3Gp_91@$dKh$NF?u!+Gy&R_!7N!+_^R)bOQ`lkLo*v%@f|Rqz=?2cUAO5Ip z{2m8*Btvxf--{;?dKa&v-tN8#TTgA97?D!f3FJ62@wm5}slN|R+UU&}>2r-2y_;98 ze*i5zkFPGPwK_>nT2GnVC#KpOQX1_K?eb-2F%Gj{KlnsE`MPGQV3{xi_ng&iuP_`I zH*U;)?vatj8hC@SFW%s`0x)^(pu(F(Awe*=TFZYLdeXk|r6aq19+gk3J6hzx6ZI*- zqKW`G`FI+R`h`N{6VMlgeP(5E#+|#@gH3tBs&P@mUCu=3VEejtV!hkEimh$;x5K5& zO1X?LSp8l(?Lm0x3$i>glQ?|FFSrz_leCq7Qt7{?(b>_%?O zaU#p?c7XDQ(--98sL6ejK9?}2jBTUPk8ecVMM2pi2j?W(+;)@S5c)};u3s20ZgZzg zsd6?KBWa8CK^rLmmOMu9`9B9w;)yL>@}!tx!}>Xb}OIsPsf?- z2XkJt)43I*7eJlKbX=^3R`+WO1R$`*8hK`dXS`!|eLJ(u13RtwX2Vgc@T03kfv=hr*eJAdw-Mg-AP zM+vK10>uK;x2-rLM>xt|{Z^F!vwoeMOS1Dyj+@Nz6&X!zaN6-dau}1nT$_P1fWZ8L z`Irozgdn?yE>=6gc}jdYh|_7W&&qnjbM@jU_E-h6D!Go?0pyPR@8c#8L?B>!9k^7V zJhr@8ibx~dyr8S06o*!n9)s>j@^8x;?NIJi1u65&#w=gi zGm%R*au2Oo=MCw*CLbFe2Zlk=YSQtX996Pq#6G@=y|bd^)kVZ2A<~26=c`1L(z$HXo2pCrE7%n^3TgBd+rzB zJRV)a*3FJ4IWh4eVZ9c$Sp0@{ePTD4i4HJQ1=n-75FAN~;GYB2>R{1i6pMEZGh-!g zhYBp~h58z1>QG);{fJQuNQogT4xX7}xT)WE#V>rVZdR{SNERW7n^C3HfuVm7zete! z1l$nYEjL4;mSk087$_hH-YPQ-i6$mV5l&rN?LjAIxQ=>H;W)o^R%`UfeQ9`8a$(un z-H$!mI&DK_4o82FXPZ2f#Rff$<@|d}6|T3w#fI$AxeE*Kyna?Gm4m1WnU2N}6(tR& z3^*Eau3oT~QqEJ&S5A5OL1R zn`aI%u*MmJ0UH8Gb@`OWwiEy0ZE#69QC*s^=4Y2Sk?ab_IF6w zZCgFU7R%dKK~48WxW*q}r`U!yb{^uU!H1LfpGRo-MeN>t8s$WpOCKDrg{C7Vmc$)T z_U2~U%%z-L8Qx#?i?O2k#6~&x#yy~~N#S)O_-js@`E6f5Rv<`I$coPW*A*jJKd<&5 zSIoMq#of%dS6Z#Sp5m>($#r_fw=)?>T5Ocw%pvE}2bW+?Q!};K;AykAKpdv(Cb5~E zM5sFt`ndr1pd^i1iGBUDs|c2`2uEq}PAnZ)I~~;F^$&4j z){kPY&3gWj6f8I(fHSh}J10BqRo8~!MBh_2Hglnr_Tink@&-GFF+0_EiTrRcXB<_G zYU2;}N7u83vc)<$B)`4sn@Wrq{XBWQQ}$`N#Cm+5O38#w;+Lm6o}TvSq8KpF6*G!A zG-R44)`L?W*o#+B8Zo8hIX0X~3D=TA6|GM#*G$}ZRsCXt&fF_%+*$q~yd z)%_7o!bjfMNJsWxW6TF5pcMHG?_Lax-<&cSn$r%2vo%GQC;vi>zWrTxYF`8paJPdhRl{>6q%0ZSIMuYT<1{{_9)V@OrQzBP>PLd- z7JK1z$rSMO7|+|n{Mi&pi3Gcz*BoI)$no;;Y7qiw%J{gaqOch~)$0zfbChfhi!1|h zi8&=c(HMucZ;=6J$6l|Hb@W8@VFVK(&K?UcRm6c3t-z3GG*MfJj}T@wYhNPxqUyG`)A>Cm7!~ zz>9$KWKr&wPvc3WIy$rv`diMrR=1e+Ms=C3Kc(t(ylt0Ww~U|J!xs;ii#qy`%Ls72N>t~pIFKezGr(|Vq-IwlolGF;n&T{`? zNl9N8GjF-s0O-0J<^S4X!d8F%V}nUq;kL%1q0G)vA&C4zhClwcgnJO@0pB+bd7u** z&cnI|ewoXrLB{dsR(s~;&Jm;YTD+=N2;H&b8kDKN;N}~7f|xV`M|tLW8Mlung9(6= znvhXwWV?2?hjGroZR2Nxl}kHMUB6C;op=v0m{_<-@E3DN$?e|PJdJ~NOcHEk2`bs| zl&4%|L`A>lIK;s;yj)M1K2L>%8MWoMa@Yg>rTTGCCEO7$q`KrgqciR)ar1^G24%u! zjVDi=0+c2YZbYt?>|`q?W@g#qn@Da)jL>HP8XA%WAlJ*Z5htMPPz}2AI^aqDpv266 zE9Z^e?Eo?4o1yO8q_HhGgI&{9idxqmkrw<%+_Fz{CT>AZPw7%XlZa9#Db3uxQALqzk#?wiW2;vQ84iZ$HtrdKb2Yg z8vB5y`kkXiu%nYjW9HZ1JgMpo^4S0VGUFoFvm@mnWlJxBCdhZA;Ni^zj|k%zjB;~F zu3T?2`*;?_m0(t;UHtIWoulljB1>r{C;atDNzPdj6K1DCtRx}QsASdjoPc-XJnNlW z;Q=TW_;#G8!$kb@DF(w4HFCp0xI+lDFGHQ4{s ztq5A=h9_re$VaNfQ&06umo{ zfh&c!%zj!c&_TJ0))07Z5SyAHnX`FxeEqkF_7M!b6-PBNT81(ZeqFYAi#c72`Uqpk zbY?a@NHE8jNP=cVFv6yfTCVJ+b7F@OOgBMQHOy^$#>8YV&1R|{JstzI$&PEWmtfl0 zFh0UpOCvn{P(Wo_a3>dHonwXJW0V~gh$lG5YH~J2&~+yOh9=-x?frIn_UIQZe1h5e zfuU=vwisZfBl=ZYiT45Q#66um_Ot5oF=<%+abHnx+^f7q1|eKKYb@fN$Q{V2*KTwI zE&^F&KO6#X=A&itm_GxrPue?9t9F79$GUq!q4pjAqc?YcCfM<_hAu##J0Jn#qN?6Dp}AC~vr6Tl zxro{#^6pzhoF#IG3c$_)-DAi5wfaP=dbzcSzZVS}YSFE8WSMM6OTl>7QrH}b;!R~h-ev89~)VwY9^hWe+_6Gf$nQSWS@ zBiq9F<^e1ObpyQ71dW<8VPC06ukfTQteGVOF#VC zktUUvzC*{Si0R9IS3(Hk{l7O5DRtL~V+H6~*10(nUCjDD!o1&LhomJgvi% zNXd5h`o|6F*`!dXeJ@1@-*^_)C=NM!WLq(B7ZkOXqM?3$-s4=B;=^p zRTU>{?B&l1ns@Gv4ze7Mh@X}=TJ_4X;ZzlS7&9oUt7wl$&m6Jv9KG$puA_i_eFS2V z_0E4U1Zbs{WZm~5UH>4AvUMMf8-@m>XU-q$rlBythS z5;Ag%t;2c4C29AJ9$;aw@#Dy|!2JN%GB2yfw7DgB^c~_v+doG^Z(UZ}5ppfXYEhs! zl1JZ-_uLi1zZ54#h2xoOqSRl4VuS-1CggEf0S+?r@_FF>6ouB~i}{BBimhlwOO0l% z#VRRrt4R18VYlRm&U22EvPf3p+r6byv68`dHuHsF08hwUy1mivQE{SEI~-2I?99=! zY>Z0kuGIQ&{eD}Gxt;w7-)VEh{2PS(qLcRf_fh+}xY4Ol$EIlxI%hMALeo z4zM9=vbbNZT{mT&ZPToi@eG>}_gbzI5v4WOOa&<^@ZR1+=-g5+J(0S!%}y4N20BRC z2%_BU;ZBwgqeC)rKGVZdoM_S31GK3Bqu|KU8x*DWGSRHfS`sDHg#;KGPYh8DusnRN z9aTt1SWY$?MiqvE;EZ=W^ui?QKcq4{_Y<16^K^NZ9t(sJ{w!`G_N*u*D%fzg0F6AA z4!JzTlSnYAUuI!MQx2&c+JHZ7tJJaIkdjXgID^_ z%o%$_2pt7x2y*%j{BJlR_k;52Q01^5MKMoq{k|DTKRiBO6&RV-JcqPoGjoV1Xz-9s8!<9}_z1N>hQ{b`NJ-&wE^JuYB5^HDM6vuezPxw9I%g zlYFZYFMHnJ@xo<4uVMYMCkYNUK#-9S5nsv8y_|m*WQ};wCK?0sHCZ&igszX=(Xg4e9RxxhFao z7IMw23v=Xt)N-IG$*RlN`&)?px@;mVd~FUbhILz^JmF~IgkDVJ0-m4h((=*=O7Nry z1jJ7eoLTc>%rK&Ad2BgU$HF0kzO3!HAM7h8V^X@Wi+ErM59huRsKovt;N`~Jg%e7Q zq<};FuNk+Q4}>4KbbdPfQ1iXNw{cCWckD(Ujt)h8#4n=morPe5M6n7RzxI>mUrr2@ zGxlqR8T44E>4iPkeDo6Wj`RAvxTp_0I^jSBiC~MF#)|xXB{my|bXYXz zd5J{M1KR@{e8Pp%VE$IP+3T1QQN3yNVRntZaqLOmt^MF>%RaT64)~-%LXh6CPq&j2 zx>UuVeYG&%4W4KOv4zt}Uc@?li%+ca_Q_TaZV)YXq4rzWe#H4wo@phxFSbFP5S*u6 z^Wza$*|ikg6Gdr<&RN8sDTT|g4m;)Y%WQ5rx4yXN{Yemb&tASDB0Nzlb3OIANMif< zuS@S(M`uyU$!6`_J9*tWF|ML|Z+9Jtm_U~juUe8ksBaGuJ3@vDaCq@3N#c<#F zf_LlcXuL2xSYZA%buJ+UVZp=Hc%JV(kwnrBXo7}YA*270DWaiQ$9jek(jN$Q%jJeb_>b{gZjT=QC*mnuhDFji<%h*R2?b2c>mD?ZJoHG$PiMYd-UY7p!em&|A_F7 zP2=R!#eM;W{I)_pthe^#(9!CcSY%`9QyNpaK)%9IT$6~FrGg_U zn+A7@zm43%?-A+UI7AKL!uSUZ^!*^&&VK(9tD@^9#(bycclYTqGq}_>NaGoJ2dEL(1Rpx9j{@HRbgrNWCs-5 z`ega8!@W@amznTqpogo4l+ajEgeL}%GX0~sSh(&vc;zI8-e*Lid>Er#Bn*)3ob%#3sIx|n3k#j`jThiKFN!aB%y zx($y}Mi}e<$~T&5kqlN-dMdEjT<;Wo723U4S=KFIKuY%>%LARMYZgxXNnm3Ccoe&KR zq^_!p`?QVkZsQ|*J!WT&qg7WF;fcm?h`8dYE`yrkNq(N}8ZcZ8f9e8;3)0&jOXhG; z&_ByZ6y!n4BG0izZWcT$z_@*-zDB9_=DL*i|a6sdK<7~b>;-nwupM` zs+gPW&pH7}HE?18+!I`QAhW-qvfjsv24K-)TikyP7q&UtLHL<}jHYf}qH|8Il2I(f zu%2BrkU9}_`nFCq{f;U)dtXuqIw)xsN5H(^>Ez~KOtf5vxwiHIQ2Uz1ypS!hbW*aB zkhDyhYqy5o5KE?;Z8T$F-fz;${(3`<|NX#Huut#Sa(O@?J_u1`?y6pR_p-@cMwGsn zF@&5L0tsv{HSXl#gl zpv{|xa2gj17r_guZ%$T?>wi>$kbCNuuMlywcibZ5Dff z0?&1L*Q>8d`oe;>StrjAs}9^hV9IxAT2l;l+kT_|Yq03zcdsn!CXrRID&l=J;ZK8| z4(f{Rx1(Gq>I&S4*?$MZr|^e~!-vR!Yb-t*d=IQ~i0$ofR`Bli442r_Bc=L;&`Eef zmwesp-x>=JgJ^?~PD|f^{J0))1Hn6o|3aGjoC!E0&NLPX({}sRj4bkJY`sPLDF1Ft z$KYae@4U#~&O{GJpE^i|(^dbORav>FG#J+DowS?ViCPOW45O^X4Z_K((PwTf71u@t z+t$R#AW=_%x6sPl%%53^D?->bT+^xmK^{M*0pwUa!6VMGQH5o>2#Gkz+_dljkk+v2 zTX~i;fVqyWiH>9LN->vjLSM9z(HyAoq$?)Pmp;KRC%J-HiY+%pl>Ik|w)g4G3l1Y5 z^}osSj+Bwpur3unuCp@%bTOB;fUsod4hka?O6c(gGaWT1_^Zh5IP>n(A0G@wm6^Tt z>Tbw=x z!nwQLqUrrI1u>CX)PfFVd!4x~9n%xP=uQ5DIpPH6a?2Nc7^7z>-m?tD3s!$y8JJ}D z#=cUH7zeRcagnb>XOR5TVAma$8~3`9wdLGhiYLZ%CjwM>ax(ypNzT1thu%UmRP06* zzjej-5=A;b<>n6IyZ)+y1tZFd!w7$g=ii8pc%69sTVwihoO=`20&2g_iQ&GQra;Jo z043-$dx^pOPxgxvsdj7cX-a8%y7^1Aw4L5p<>X_w?CtFXBhjh%Ghkt&=P1{Ooe+r( zbkwPx=1`wr+;ARA2m*kRiG>E&cUyxv^Li*)>5vRJIexnLbkO2QkU}{oa!%^|EFbzJ zPu%wP{o)AuY?n1Ira_f(34#C7Ton0$7ocYLXYc6vlh$VWn;#p$91D=kzBL@dmERl( z^GKO^(Xq?1i%r2HNNsHb1`Uix@y}e7TOsW$Zcw7ADx4Z*j|{U$5Pv`pmMPFI8rRXR zEZ7bHkGe*rMe{!cNjPZsMB2i(B-#)N%HBSk`EyJE{+d?N>&qYwHCH6y5Nw~BBY&^) zgQepRiX!H-ogT5$g1~0UR#?jbTFwW0U}%XE@A;KF{4dwVG#UQR&(Y!Qp_KkHo%eR-XM(N)>;;Xc|revJY#pkMtTrrs(%-`4a0>-KY zHQSM&+_0t;P0N*;GOXi62&Y9l_lD+GluQ%78$_jKWOM`9{z#eq^>P<%gTWniS%P~l zSR$`CWD|oFibX*J!q7i8zMeU$(xDwZZz#aEUOn_j$>Zb+3sA?GmP!EdxkiRGQVpl?o(co5J1BVYvJIG{E6X3vJ2x9)}L+)6KP z!p*5GjrgA)V-7=Gqh?O0ugkp`ZvrinGbgZR7&uXLuAHVlmS7-0n*}aENltOG70RxP zlJ`7Re$3%%JFx5R#{b)!5gO!3r>wH~zq}c@p1_?Md!-1!(t#zELwV}gulW7~;qW5P zzpHd-1L1hl0`4}sORoZI7vz-)mCeL|n!?TkgTjMCE)HYz_1Df6DTeRBXzd&$5K^#? zl@AbK??ueN{KuFP-#ZEeq8T#b)8tXCaCQSHTw@Mi)(LXd`CTUNOuDZ^DgIQV`9Vn_ z%58E02q$r$RW;233Gz3g)vq1=ihYAs$W zpV3)qj`1CnJ4*rZhSx?6ZPfi7y|OxDzX!WZI=oO}+Y0_U3UBUgi-IP;{nhYUgfxdG z{0rXkH^<&gA(r~_{r@f5c=cXrHAVE++uA%v=K{&G&H$)$ZzDKrA6HiQK-vNSfIIKf z`RpRlmd|{^x@b&q#pye&{s?i}kUN!LL;ZhD8{COT(XgSz1}|45jUHbLGa%FLGA14h z;TKbhv!i^&h^`Q}DA@C_UjyRLR>3eTrU^I|g-0Nb@DLqUR`)4|`wFbJo5GDXGLY@+ z`V~bq6KaR4d7)JSyGUGxU#T7$Y0<1-Yi|Y)_;TA{_vstwrA=@6?a2%L7t^z`&h zR2JIVh9L$6cbsmhi~mQ)aWf_9g4s9ZfjWmvN=_$HysZ7)iu(4f%PY0nJ?f%4 z!EQI&r1epmE8vq-R!)>;o;)}6G+f|PGwhG?ucBO%*!T&Cd8k(PQ6h$e`-O67B(UKy zSg+O=aY;oG;@hB<{>m{;EF;w*qnkdi{*Ry$oIZle%$3~ZiGG`g7g<>yOzy$w?Dr^@ z%0cUYIwbHx{>I&bQqF(u9IVM7^fGX52Dg}sKZ*BcB5TOX^!`WCktOLf8xSpfKX!8f z26jz}6aEZdhB)&IMTKh)tLjmykZ#Mvy?+0wWHQ|ei3_%Vu(t{X^&Iubqkh6ZbEy#l zX83AHN;syfIxvuf%HbPjn{Wb{pzI~2Geq(bm36ezCOl}f4aBTH;5RhF?&>sbM zr&h8-aCec+bql(Rn;H(247EbsCvfiN1gMq*vnY>ahuor#Dr==0FCv$^Piii_=opaif?5sv!{ zyDH#2eiR5J?i~dN%O3V)CQ^>SVbq9A6zFZgHed8M5nnu*W^FWWV$~9t?7{kvSYO&j zSNF^TqDdnIp!FeLuj)UfEL&OYmrw!QX)SWD|0?w$+wyE?&*ag>x>Dnc7m0& zt*n78KxK74BmE97*!^jUwd{a>^mu|I`_aRfY5c)PV;8Qh(Wodn=jP6XJ*yu-CXaZX@~Lo%dDfG?=J zez7{tGJ63`!6I8C0@Z>D+ylPeF0GqDTq%aV;INQ96+Eq8zAsQP!3FnxDhJ#J!-HWS z`(XO@>zCcUs+nme>B9BTedeIsme>21U}*Nob2mP%37uHB0f#Trm_U5vVSCJ51yY&d)LJK-NF&f9OFr zp7XZbPwS^$O(`dW^De)NY%`v8uO{vAlQ;g1xlbILdT97i^VH>+kT*qbIbq z{C(}B87b}A2}4-CwS)2U+**3CaqoTr(LJUiTjV8@#98?xA0vx^Iap&^^ELn#c%pH|eqI@Di>$Txn}ZajQ( zvSXS`Jg?XkeoddZtu^v3t}~HH03J(onqi@Pa!Vkw?w7*XkvS}PkKvGaQ;MKF07l` z+rnU4sJu^~nOwGxw!hMU8nek_;v%ejSP~>WD1aRAx1%)SChhRgd|^&saO>>H{xp`iE^IIN5Y1$Fj}qS{DSHS9 zRS9POi6C^dAWjFhMvyu1FK@B-(QTf;XJm1I8R0fBeeL!3btAlQUjG1rC`aN4H=rw2 z&s%y=`=NL=20L$77M$rw^mh+9f?X>Jix6J3G~gR#JNZ4*GICV zxc<5sCc@!cxSiIY46^gkWw~dBoyT!_o0GxW^>f7VUHq`$(`@2`f!03gLOHd`_Rc{| zPh5UNjU)Qt;`5H8TA4Ujdp9Y3r4S*DJZzIS_I{FVXtMVeIC;srJ9q}KE42{iZ2iX9 z>o0N6UnZZ+MCLW{!lOUgz3ZG>sPyy!S<#fe59&0u;5N}*L`fF+H|0WQo|DN#QZ)7ko(oAD- z9C`QK6@N8gRps$&7hp2MV<&_*C+d#HA&qlP*9w1$*PmKX}RFhLb0MD{S5Y77{u5jd4IjF4S>%`e#=#wc2_rdfeOMLvS)gmq$ea^>+^#_6+&f}x1R)%>7GDzT)`flA|J zZDZ@rwP3`4E%@PR3h~egMtnfG=HR?8jC=wv)L5z}h)N1hT!0Rvn1mpMeKL#^&jg4p zu20;>A5&g5ig+LOPfq@b0r5lq}V46=UQksHW* zr=q{IrX^BuTBtCvsj;N4Ra8|KuJ{w`6+VFKt8q>BwH4gjFE6XBaF&EH3avF?4SM)U z7LEKdd+R;VoyK2t`0N(5n|Qv*{**M^OCI_Wf-~S&?!mBk^4ZzZC6XIboOM1$hctzV zFz@6&(#&@?F2fIlOq%B^ASnMNY<^Y{(3|C*&}>#}_zj}M$BMzb=jD0)G;;+&EgdD< z@F~o6b<>|!3Q7AvCR0gi=vQcn5{(eQr$ZGDvzqgf&m35N0j~9c<{}Ny1aE_-ju88? zWmp}HZm@o*SVa_ZOiI5#lQ`Kur2S%#4Y9g<=xAT~6q&-!lp_C57*t{uue2bQgO$=R zm{jSYsb1~83r^XnWQSFQvrT4vf{p~?%J?i0ln1I5vm)XCUIvHxS>9r+2o!%uE9VKu zUT&{oE7J#s_?SUY>Jun>Cq)KmSZ9<*TXv^<84%AR4i{%-{^H z7>_s>j(=QONH{?AF2bs_*#K)oNaXjR&hQ{|dV*gXX-|GWh<;mHWIcY-UMcZX)$B{z zK3vl}-qm<_3xeJttDuQv;rzMDR3z&Rkcju_5EJi7Gv5#Eov|>%$2krr-Qv0Hj|X^e z`c;QwdEiQgH@_a&CL2R1M+bRtOnLK4kkgjNMjq71r;jTR8co$bSpU2{b#CI$peuSG zxz3SEHq!OGgn(FY!&G0-bhSl#?+(Q3bf6~d#DZSmk(4yEOwR&w$xJb_QZeDll-Oln z5EHplp>=0d`;E!?-F+?5-SEuPd}1@C#Tvhr04e`?sd01v=7@dSeW`p&N-(1mQsn?0i^8X&`%;GdctB50Dq%pGbkf4Qf?%$lHJ|CzH;ED1H^TS!2AhbOQ5Pxc5>kSp?KokWp#e%P$FciPQ7o{ zRTEl+q59N%P8eWNClm=B|3cn<<794ukx2H-Oq>7o&smM#6Y|6q%R)!D1M#vjLP}|$ zJB*h8s!T^Z^UbeWIi0f?-@g9xs^2uyn>P(u)+GvxVx*5L(8(mwl1oZRld^w-%8(RR z#c=wF@Hic3ruv&Sex`6^!s7ARzLyJb)mFr%J^$Wspb++m4!W(lz<;YgzTG7cwfmJDQqRBrDPq1xTQx_-fzi0tIWq$P$Vx)S z=Ff$0MY*TOYav%Bm)0)3akCby*3`@wp!;kjE}@bWq>90LrAaUJ{`tL1)$+tUX15~Z zsjP2*{rzfazkWCF^0#BGES{>AeUPEX`sMUKcY_U;8%bSF|GxLk-s0-J+mhS3?pVzy zo?T#gOSNnH(ggol=Aj}JfUn_N1_QC3wK{U_XJL{mXwmuug*K|02j?F}u60TsE_Z)! zBwK1#dvhyGq_I_NSS7@Y-4!DrQa*z^yS#XPr?R>}4}rxIe8PPwbM>-V(UnBpSOl~w zR*H$rV|v^>JJG2HbgCN$?^&H|yA&Mfqms9WQmsYqtd8`!A#MDw{{nSiHS6W82oQ8* zFuvAW4r!%gv3_nD< zZDqGg$jM70NBYO#F1yyxs|{$F1mrI80;HR#XHD>H#Kj_rBfzx7g!MItPSVpOu@viM z#phtu*x2!W5jvqiF)EQaCnYBB7fK?DiZPFd2p zWPhEL83ap5+Dg$SeuK~6KO9+vyxJ$PF7b=CbtBIp92I`oa;h<;OhUTaaj9_{H0CujbTu5RtTL@=%^MucL*L;hAFVEk(MK zv(0`;o2+#07Z`^{(If2f6s(Ah^MROe*9P5qAQM?w#mZv@QhdFQXSxMBHnD%^Yz8WW+ZWmD>Rs+XEIw7tNQp! z^UVix-g2#3>y4g}o|(`ul6YT+Qq_8*nsprukg89ZvK#>#kk^Axx$EBp- z)|*A)0*>=+%bhm3=+_gou!p0xnTsB_h(5s zuaGp33R*569J|hdk+q1oU7ybi-a*9NXf*+lYTd{>f0JF_EZ$bAu*SOoQT~1p%fZ4n zV768rm@R47qLUcitFpvdq8qEnc8thL;NST|VF9Cyl0@lb;{hIgf#W4320VPW( zVSU4lSEjCQ(uj-sxs-_gRt0x_o3*w*oApjVfv3v@0qry6|py@y|p2>c7r+_}~_*Y<~&gMitW*B{!?%f6T5>}2uU1-?|&3Ajg* z*gmGHX^2k**dj7t6yq0vQcR#^AIsoQZE;I0>#^+cI})zcZG2-tLSWeBTeuc{OQi@=51 z{F@%GfH*BE1(A!8W895$){f@+tg{E)9w+Z|8yDsuHLZQ|yR8 zM$Jd|=qfjKGK_RZ|dV%VqCloL?PGLSmI_y?+KT+w~YOxKf zX(kD2P?U|tlch6D3Q$Ox9sUCw(^tyt@M1aGC(0Hzo=Jf=G^eKXBY%;K{iL%vyaaSe75epdiCDM1eBiIk6OSpO0> zHJ+>v-NC`tfw?2$SVe$h5B91IY~gtmA3Y2Bm&|YVBV~?#2yGB~Aq&DY@jI6w9|9U| znuBo%_8rNQALRUh*u{%_a^NB(Enl1^hLdP8B`CChV9V^Ibf5f$FNk^|>l^c7!G@dw z>=l)TYfCNAcrHG!*!FK*Mqu8=)j|}`ZqONtM^hDNu`o_yfeuh1qTkB+Xv_?=7Kjrb zk}`;>oE=EozJ&&u55n)K`qZysg{9R z-~kJJSX0s?ov&1Pwh$H3H!K~LVW&s1Fd}3hsBaV-|C2iu3yRSjn9FgBHoYg0o2m2> zyUu*_PR2+&>j;sP4t}cy01*uct0D0Yv|hpW|<&tu-hKR9gr} zhT`n{Nb|8+t#!IL1_GpcJN&&4g2uQhxpf=$XnLds`nIRWu(CiAS;gPOIN-Qka9BAK zO#k{>7|0ja^8O62pLxDLG=_Eyt*xd%UFo8to!60j$MbwmpFcKxumhh_Z^e2e7GB!H z1-y++S|O`p=O*wmOf2M8A;#|aT~QHy~D&$(XUUju;P-KD_3{D-|vss zs{g{mmW5GD>By4KsZaXtbINf%wAulMs8m(9;CoEkj$66;`uY>;6D~U9J{Uz&r2Hna zP{Hne>(359d5_(A)=TN8wl(n$VK$@lL**amkVU>Xz;8MY8uzHEe|@UEQ!SYk*nT2N z6VPxP);b#%*@WF{$Z~<;1w?ud(xak3iQuk8Aczw67=C}b(+&I^tJ@k=QTSSS&r+uX zt5{SEt~Iym_fd*jsYWNZlIK~(Ul*1sbr{3wfY=AQZ15(*hg$L*;hVU<;GuI?G_g=! z?QC(|GeBjLs2!2Dkf3FOQ6+kng7y$>?T(B;mo2 zH$M2Z=;D4RhawfMu3h&D7x06*@;-M78n&d71C~4BRV=dS=whk#ArC)dO(tCC$AMMeYIp*^2Bc_+P0av%sVo| zp42}&vILf3*#_RB2<7+NOc(TOd<9MGOd3K1nOfIZ012@Q0yd*|vyFT4lr&`EceIl^ z?Uc&4&t!)es2Ct5kL1n|WQoi|S+T>;aPpzWYNtb^gut$)@{*5~_9khs-!Nrtu>yhq z5IY)5Rzm>ZjNYy6KL+HK`lG%I!qR*6Wl3)0*TOc&hS%7MvK9rE+N~`g@`Yvb_2RbZ z+*VOal=CvJtvBZtN+jm0p@By<XBR+@=15|I^5?EWfwP-#ffovcR2%li zX3|z$804D?EHoGdK9FPltt~UrNa9zom`Ru4op!yGR>|a{(0H0Mzst|?HY(O(2TkRJ zQ8*j(GiHiUr86cHv!?n|@FF?9KJe6Bo)0KDcrL&4+YgDX!`YY57IYA3a7&u4{Imj= zb>lk+W)z8|E|v7UlgHH%zxj~VGM)a;)1G%VDO%>Yw8U;5**7s!ByZv14cK+zz)4^JbgI_!tfjlzb=!d^%*ZNbG6h*Ko5(lQrD*#Zr_ z^ZEI2%O0^R2b$NMdRhemm)Aa}9+@{<MgQv{=POe4L3inH< zE&Bbg`tN?v#T-VxKg+yD6sItx-D{BNcJvqAyp5}j4X# zoLjaxuu#oPw7P!L(7# zQHvz4#d&ok;Pi=DVdt`E(N>FyC~?AAFjC6r6}w6_p+Pm{sQr6JbZ?8Aq?SIvtGT;W zLRdb+IuG<}NQJM(>uCKWDN{;_gR)Ki1|I%kT(EJSMaUYm97~7YVWoy&i#}mgxMZx+ zmKxtv8z?JBO-+Vr*4$`z=OraZ{xGGqw`I9GTYmeo0k~OkoB&08(Mg&Xk2}l9qqZJ+ zi7zKbkf!(37{xobiY(}K-Iu)L&=LWZej=A!C5&Ivgy;J_!MOno_{Sp0Va{d)jFs${Vg0f zyxsHx#lbcB0JMHS6<6;J?U6CNKZS@R(k7Y|aw)g)cxEGwO0XRz+9v^DlYo!vl{|ui za;gq;LpqA{ebn)5z(h~_+4xrIJ=S5FDN2G+WT1~`4*gHw4#%bscZ8Eelcqb{%ES<< z(yLI>#8ccRc={qDl~kwJ5dWZ(#zy$Tuvtr}WIvKYi;FbY7*0QyQ9D2H!_gaLS@#^< zz0x@^8rXDi=mkXoZSoea^IeGS=(i9=0L&GQ?2tIrl7m|4d$wZ-X0n@c>%XtERoSDP zHK`8|N3~mR@p23g6%LKI)5I#OY>W?vtzzfHn)lGe_Yq%0R_a}V=`Rti_t4enJpklM z4E0s^zd2+Nrw^F1r(UJkn-X%EC!blb?J+cwofA7+ti=kZC5W^Vvo5KTw^j?F@Lx2I zs{0i!b`6G0lV7tUt%81%a%&Ql+s2JY5H-K?m0+TKyg7-jmtIV#OgfHaY}5=IQjX7JYNj#{Rp6p{kMj1=ZBxBA02uuNfyze{VF;|Y;N10I)%F|6NWYJ>th} zo_EQ*y6q}9Uj8*^zxBEY4x#cf8ZKzW%(_^6y1#S`k97H7)%hCmXTwKG=FOC)R{H6& zJr#Fi58kF(K6t>BRkNA?tG2HC_)7iv>nsU70LruH#T-qqdG*LS$4VL#y%~wmry@L8 zv}+!Cj#0$8$RJKuN!?xoT3!W^JdM0Z>a0E9p7Nq$-ejI=v=N{NANX0jn=I^F7eXP> zp9^9~f6Eig2Inr7(2mr6nV^cE^qVH_Qt$Uc1&>orhmIA-*Jq)C;mUau-yT4PX0G7f zbfGNa;4MS^gXkgENs@FZmeYiaxUvzWQENcrzl)`;q2zT94JY&tJo=>rSH27I@!4L2 zO~Ib|vX~GYWg00po!_|u#3*@drxqF{I^&w=aF(wyFjGkR6=9B|9u*zEP!mQXH^WC6 zo{+()M8WZOxXSBDxB_*F%0Z`urKVr^SD@iM_-8bwd!)_QKy(E#9Q7WqHx1~&Mr8%T zybumLMey6>x1gDhPrq-EXIA9gKTdJQsCX@??;;}l|l~A0f5WBs4KKdCtq0I96&=P60Xex653Puydikuj) zwe3-^H^*G_$71~R%4T8QHEGn4nGNO&y|)WF&fxw&)*rR=VF|2$!JJ#qTw@owV_#HK zh)L~4KDXKCw#hhdr|dv(Y_9EQ$Qs|QRjuxevQg`v1m^I(5BeBLTEA6E&ek?=A*WfnF$#X`fNGP+S1v%)Z zeQ#&znyS?1J86oyI8D%6bvB@K7{@{?(nVSYL_th~)9y4d9ANRmIcoO(c$}&^K5!e?O_@1tVfCGfBW zQ3tx4H8(f9fUbc|gZ#@^Cp&osSPwG-> z__n0Tq$9crN=Li8Y4mlv*SeVK*XVKaHal{oFY`bGuYT?K`@fERgTomDSjJr*Z>rn2{AQ zPHf7pz~p#2_rEQ;lehTMmDDCSsm3pS0dFn2Y#w18I&$K=RlmrGeOP4f@c@ZmXM`yJ zjt|`9SX0K`bRF9oj^9>`ak>RW=BZVn? z$bD>zuSIVb5|@%RD$_6aI#DVPM1N5GOnZ2Z_>AONrLB+h?CaTs&4S*0-+Z7vOY$82 z+|-pluhadO?<&$^ot=Fo25Is-9g2KAn~(Dv2jdiXuH(~4LFwoG@Uyu&-kxE1f`*S- za`GAJsBYuWz5kFhAXl~9*+%fSQE?-!UqtnKrd&|vd{b)0EoDNJPszJa+m2~=g&Q86 zBu03X?DHg--t*%E>%^bW)MtcQU?sU~lHsm`brrykmqbLG9gf2KFM$C!O_R>q0x%RS zd3t04;d{&ofhyeo8Q0_zwTEqpF1{d)M;~Z{n)G`>GZ5@|w zR9!5B<2eC#2R@VfViWl^k5M+gNl@KP{_(cDA$(YKoP9^6&&9F^HJFGKuBFa{`5oOW zel(rasW$)E7&VKhOxkR^it~-i&mj%lE5d3-i5cv=;RXVl@902Yd z?#C=F{TT#D?0pJ%(Rh2D$&QBhVrr8v^PV8meV~R7Eh7fEiKc=K1)#00Y5eWSHf~oz zE&iD#y?4`5^2}vv#IzsPO|FNUCiaG8VCoQa@2!>0e{Fwm__ITLh5@|a;Hz+w8O6gl za}9zR1e^uG@#>+by#)mYYfM>AS_iA&;-D4=B#<#cs8)UpmEP)^NLJ3(28-OI$q-SS zRuGlzOig!bcz)FX7@oX53sgmNJ^8@Uuoi0>;jI^dv(-_M9zyqia1=?6S&c*oBNSyD zpZy!U(>o;OwbbQINJyPF}y&Nd1sI(^icV-za?(rQhm%#qqduf|rVVSThOWa9}Jb13}K= z^xw)iUS%N7(l4-@H53jV2fy_r+qKLXie;l_7ZB6Sz7OuST+_SXPWmKsE< zc&e;8q{8l6yYuJY2Lr!~pFzf9}84+BU zUQY>mlWAlR8M)OrZoM|T$PYfCt`MK{35o3V6ofC$3BT!D@+|a3iF)e?IPXFGfUt;aT*NX> zHOSz8=)W*DUgU2g^$@th_qVSc55ANhs#=@9zu_e&!YU)xC8#dj0)L>~wrJ+uEGe5E zRgIn`S!9vDB|4igQbbzN+CM*iCtF zvD&&_Telg`&(ckbAhF{@7(Q4X)Mg4BAY@}Ko=&;Ot zSDGf2Nf@^*MCP!Ce*H9}mj7vZrG@YA$ki{jmi4kf_gv=8mKqH)aah?IMI4yjc>c#R zs^3qcIlO{Doa~yxWX$uGp?eG_Fo?o+SM^T7XItp_a;U|1h|XdSx`muxwJ!=)~-EHN*YH%4qQ5dY=yi z>60O~N$pMm1QzT=1+-ckQSc${MPwx> zUpt()gr2&Tq$v0Q7T$UVEyd128X|mz&VZTV%8-yMel>$fG|XOk&oQJI`nQjWk+AWM z&9Nk!$4sC42sW;To;A!#=3p-XXr5XD+lR~A(dODSIRoIcO}x8g6%BbS7hrHz_sZ!F z^yo3_vf};7mzok)sM}qIn2T4O7^mhXt z1N$AiGOn9DCt6Mu@P>w$kMHa-Ncs}OfhduGfbqY)&Ie}cik%G~obD50U=^C5@E4oC zqvmFObru1-7aOaQQ0$O1{*h__&b4SHmrQ4= z*HmJ6_c({CDfTvNz%X-g`R3%#_^vp4Z7aW!Oq@VPq7%gR^z1`@K{p2a3Acpta)ONR zR}bkFOs=rw|C_x0*{fCSnyt)h>nw;3fW?&atF%f%=$RY! zwffWhu7k|Fay{4EDl0*c&rZA2mvSxdu99$4NvU?YyS0cD&i$Ke%UD;tea<|&j_;^Y z{x8Q~shLD5~%G1F=5xo!d%!&U7 zgQ`K~s1DbFXIOgb&lER!Oq?AWn+Hn>ZJ970>CUe8!l>%id1D%@!MioTk3359H-k)D zB&T%$o>Ski!G3J>imZ0ifO@`#0|6XuN_(GTdWmm`pM>lhk=G^=nyKU|=YL{|FO7G0 z=YTqk^QllAQY4;@8@v2MagE)C(5d z{lAuPysnO)XlB&1qFxqi%&g`>i%D>H=@#?gYE!R z2SnCiWTpdO;Nbu`#CN!WcPflx(9IuSprHJ^2XHe89()W$Vzn!~+27c*Iioy3%JOP* Jzho@F{SRV3#<>6h literal 0 HcmV?d00001 diff --git a/static/images/blog/2020-12-16-third-party-device-metrics-hits-ga/metrics-chart.png b/static/images/blog/2020-12-16-third-party-device-metrics-hits-ga/metrics-chart.png new file mode 100644 index 0000000000000000000000000000000000000000..eabdb436076cc0bb59965c79586ba56539e37783 GIT binary patch literal 165684 zcmeFY1y>zQ7dD6n4ess`T!Xt4++BnF!QCB#1=m1;;O_1OcXxMpox|04X1@CeW=*f| z({;Lh_pYb5b(p-Y_(xbASP&49kCGB1iXb2m+aMrdIM5$}Pkh7TL1=p zOWoj%42s)Coind0a6F$NT6x#&A6`X&XehiRBOx&7wd1k(w7bf0I{I9&oU-fzlI^oD zndkQFGsr_6n1+xmql2R+SNt`E85pm?hY!A^TSIxr4Gm@>#_O*xZZ6`0rgN8NPstAPd{i!@x7u3D2Pbjss+GLIm}eJgfakBs6{HQTE(>)#kA;r z!#nLK1VT>|=y>*}Yn2s9&8Z-7bxhVrw;Dd-V`}73a***5LA(yk3kW0{Bf`Wieuc0h z;<}Jq#ZUtt--HKz)7!Os7N`femSe$^!D2mDp&o!af$ia&M(P{ggIhQ#VV#}4XjLeL z@oPnJJ%Cc|6BGI-y`+hBN!2Wp4-%ZR6BI~ZC>ru_YLDqahP{r*PD%uMHBbgJSVPp% zZZbEf2@5ZiM2<)}re(T)G<#5X7(?MuOxT?tVHRmoRbem|dS+gUk=?3CV;5gvyc608 zr~vT`7O(6i#A+ka=ICK@ip2Q>RytI&VSegxhL~1UZQH*9X)k~(2Fi!#QBCqgYo0Hq zJn3tQ3jv-dmMsC^;Db*&;kfry#SaS2QU!R|uai);VLy713?Y~z_kD4n-WFa-Ub!~e(oaeauVX+xP`dTUO-g%26hs|FRc?Xd}islBqS@xgLM~j9D~i? z5#`5n3i?uUA+W!IYQcHfkf37l+VN5k-{yg1!CggzO^!$m6?@{NUAXgWhjSpO1 zp*NLN-F9?+IQo@yO+^pnOo3n15U%oNUgH?TnSeWz4TQoO-m*utf>es9p*i#VtPIo^ z=H+5rh~R?%`C^(cA>n)TY?E`7x9SKwbO9O_B7td+W07<^9kqVd#**N`w$wd+cd|{H zO&JK)8e36&dHu!98B$O7PMXc?8OS~1(a{n2wG5^kyl?C3`90xtezhrRb}mduV}NH+ ziF{sn0w&mVQg(N|3B<53dPT@X11Q5fl)nH~C`2U@%um0Iib0ZwF=Kt^WQ1K`LwVRl zznN?>E0DBK=L)!E@Q>?^9H67V5$nti2&Y{uQ=q#3Hs=V}B+x=aX3*eFLc_?oJuvpd z>JlI*;Uc6k5;$>wUrA9!{G`QqiSq_ve}XLpP7`^=1`NP#^GpUWixH4y4B&2~hW}7j zMr0GUp4gy*GtN~oL*YUg5u^Mey6@=-qxnrWmwUqf8p0j9^;=yo!vq1merhtPi65sC zZDc^N;ek2^MYo9|xjMFL)Qo}5Ij3IlVkP}Csca862dYajHwTzp-@`qbCq)}pc}M-$ z&Hblm>Q|(*zIGHd2vmR6&ZG|VNQ$qh6sX}a#(|}Q;DJ-;v`$E?$YCPjIrtN}nZ2xr z2=+MkO!oNp>=zuBQTNI7!X&Yg60&4IinL+k)I{jWH7>jDCY%DqkvIVgOJdP#Oc4zfAm?S9ty;`5kW% zPl_||8z2=BeW|LXG^IEt&Z4VS!l_lQ?GU}oITDgeSlFa2P94IPSd>lw!zP!YU^Txj zZ^EpuhDejE)VD5BRhV1SL*Oa9cN{RWX#rDXVyIpC3Z!6UTb6g& zYM#t&-OR4pRgI~Ing!u>Tj5G>_c-2#a12nQumd|rbmLuPmfC1G&j-v^|<;U>ON=( z@C4+2c!IaV^29OZ3gi{x_&O2OM64Fv!j5Nw^_7a1mTB4Ab>%!Bd5UV9YR;@tAz;GG zXnB5uW7W0l!hLJ1Pe=GB`0?WoA{};MrgtoJ^4>RGM>%1h%j?{ku{+v0=uSf9=YB3OF0jlz!kB9&brcu* zmdu@F-h<07&fcb#x5Va>>XH0Jdna}`M<7ce6n#Tb&x4(r%Y*6q*~9zd@;1(G#?8rH z%fr-F&28=LLFJ};gvOpHG+!rQwI{-p=k?7c-TBJiQ$bd>UfCK#`yT0u7_7Jr_QU+z zWY%8$?{;2a>=@(N{ClbaY6+wowteg+zl`qH-`?oQIJ9tlNY9yDLn)n{ z1pYyRA>RXQf)9f!LR16!psV4B5Q;w@A>6@dVR-ZSBO#+#@@!JfeIMGJwQDAAB{dbv z49^iG7gG`84R?-A6lISR5*PiZ$$6+7DHBPSPmIw6FjDJVjjoPJLvx|Z#3IDh!+v8m z5b3%OtPYFpfeGVAStEy}q?2h%v&t%wu#x>y5GhkA>6V2P*F;k5b$vd;BBm$JB8ytU zmLET|n-%@n;%IfVnVId<&Kq2MVmtkbJP`y2o zZL0ydEZnqax_Sl%Hd~iAF>kR~!LTwiHGoCVLeD4ErJu5shUQOXYm&v3PD43gwRS>1 z(_1P95WT1CsgBY4KM`PjKvTu=PEKcbdqd0k6!(cv3BQ0o^|6GiWIxILp7ph6_W)yR zPuhngfY)eB`m4$A@UDhx_3qeVGCrTj6W(C@GH3gUQ%1Alsos_19@_|e2EWJaR#ul! z5#20xBKn&4dcA(PkmnCqgCmkVQAEmgeD|zf5Zqd1D!c}>6IW3G|sCSFvRD4P^D;_;l#213uzO#k1o$O5PL|K;3 z(Q7?53Mt#SGB*HR5+rAGitdgej><|9HTCK{9fc2q<#2m(ZLML~l=ZB&bm~$X8tty8 z=sszUzIHw4nG|2lPL}G`N!Hcc%FTNh^)=_4g#7-NS8G<9Q|GWZpONGebZk-LP_|UF zr0;S-P$6Eq*Si|o%6=<)V!1lDsCQR9Qmz7p1toPD`&f9h@-Zj)wy&nIE+7^vE$ulK z0S~}gb5hZ}F-ZC-o=A{~m*G=$ran=bxiz_^Ls=!qW0N`VdAGeEKPTIpWx| zr#IjLZid-TYa`~2%Ia4n+U$>Z=hIH=A?h>NMw?$AWj8Wbo2$=|PZO5s+VpNawgqp_ z5Zcdd?kxB(8Mh6Fa(l#G2(Jj+JxP2n8;xF-7N@FAcgHL;n|b+{v1i>LdXq8n8S)rB zn#145A94>9UW)bJ;2*2=JRDv6Ef`sFU4hh#8TVZWU;{49NLD>9Si zowOD0k{#Ir{_OgOX%rrl*T0XZ1=K*ojnyShWMn|7foW(E2v8glNMH&Sc=3Va{*x91 zr2+x}<2e`zNQgNI#9w7(f%o?#26(;K`ST7Q7YqUg{D%U(T(iOcE)B7r4gPl;3?AZCKtM3a-!D)}MY3~X`*Y^X>W=C%(p*Ni z*7OEnZ4Hg-U9Iij+X3Nm6S9HJO;%nE$ux|786?tExB{1B7j@fqgpi{rkTDs{Fs1e^umRc%Sr!W^6bw)?tkm^_`5)ibpOBbK@|F_x)DnHqp+S(u0xu`a$1a>Yi0nM6O zD}j)jK42BStaOPuR|iA$13I>x#s#;x&g#ul_`Eflr>bI}{{Rja00@X58A^G+}8e(3ac@6I~A zy1I7F&GjqpJ)-R3P1)t;nAsHd=M76wv(|vM5lcwn1)q--xnhNlPS+4xc9i@BBid0w zY*OPUrA7REo**#r0I<4_nbpbA-9-S;+i^8VRzirz9q+g6Fe4^+S2Qjzu1K>vwpyhg zx)6iZA5*ofVF}i~`Ni%_r{AY(xeDs*Z|d|4pe-`+t*J)G#OxJ_7hAfKP*EcS4Ju`K z0csHzD{jSlEvm{1dY!?hdL6x!A8N$Ow>DI+V!7NQT2_AQX3VzLmCd!5s}!vceoa#2 zw`Fa;YWo*H8@S*15d2df>i-$D3>b9@C+&9X5siXMdYJ9=lAQg$H2v#^o=@-t%M_!# zda`g#fV6>AJw$;n1gF-oD#%YyN}Y$FJv?l)*-9PUxudSUn{?V;oNIDg8$T?qdSY|C z*o5eH;SFcEo#b)x{2KX9r`Cq3@wv`>%q2A84BnY!Y2Z*xh6$V4)o8ntaTq0u2&QQvf;T?Wf z)@k~Gw_$%;qG3aa2NZ z?}55KY#@SlY$YtCf?e0z1e!F2J3){V`h+3ZpWNf>iVeqE4C1Vlab#|6pfS!lSFl&5 zgg$Jj#`{xSZRzwz`uEvC3(6$`xCJ%~X7rQ&v%~ojO9?o!)E)s)iHoS7@DQv$V8%{q z1aswhyzk|*`u6YbTpL{^KmuhirglN)5M65O>auI|L_OQ9dce#GZgv7wU=G0YA+Vfg5f$MGh&9GWp~2Gt4h1j($ca) z`eZH-V~Hqp99*}{HJxC*1;zh@`25f-)T_(OK<-8Ryb9>35o_P1ENQnW5qaNsydmm%4Eej+CJP!gOsMRsEC zD1C|OsSqY+Rs!}0Ow^VZ<3wHQ1@(koU8H1d9KY2>Smjufly8qjjC9b;wlllOyl-$@ z&KEx~zx7bst-&I1o5%?RMJ`v8zFO8E@nA3x~V zIT7nz!e-Y({QVHi*w#r#NNlW5sKW2u*yNaROu42TVTknpST{eYuCQcxRI~FdAuEyF zI2?9)s_1vZZg->HA~1|b(^IH;>Iunj@PFOmhvhj;lDmq+E8kg`l_MWDYNvB~WA)4F z379yysn6F!Q?t81ejp+4 z5s34`hGt;UZ9f(sB$3970do->mlV)i*SpZBp+?Q_P zV0!p*5Uk~D@x${u&01GWv^N1w<}>52G?rgnI_iAwmd^9Gk8}6f9C-Dlk==FACuLRD z(AqSpLyMwyOtj$bYe+*VtB4bEU-t13ZzSEX*lvnyV2jWWAC3S`NN-*M*Dw$ z=ZO8mC9kFv&VxK!*Ls7oy3&Y<{V-!#x%+|8mZ7GeEq7%E^VB<5z4g$WR;LBz$|NtR zwGFx-;iS{W=Q)eRi5OGGi4Gd!I`JUih>_NtzU{>}nv}Q--PEP+TartLpsYC?iU`&4 z$Zt^t?;n+B9_z9Fc58<_9GAOO4f2!Wm*X1um*R5J1taJ{ROV;aqqCPZEo=6 ze_-PrxdM{2c9y!?69sqHwu|5E$lUXgu-%`M|5lI;5f0t{ki)sP8Iu3;uAPLT9YY}& zM*V8QE1A!UR;(9dd;3Lk(9AuafP8P!Wd9P4b7roG~l2$@Et1&~>Iq>5t$Z{%ap+f50 zBH!HXS-yQuBIYr#3bp=}{2hq~%z&FhCL{FcPbw?VM{W*<@yNk_^7}(dg0AP9iF0$? zo_x%#KHT#5V0PzB!N=tt^%hTbiYS>tElavf`pkZob{`Clq@@jXCd{?Bi4aC7AtZXd z<A>nl~;b)MW- zSif4@evz9-zevndB;o7kotYq($#5%TG_N~DzBEphM2frn>%OejVhwWp{fPtgH`yL# zd<4)40id7(so_y)01AK5Q^v|Zhq?ae4X?b zU^>?x1eNv3dfM!QjWL=YsSh(O?|Q+CVC44zs5I?$ZRyI%^ zGQy=1hv%-ie9KH1)nZE(OVDO^o})%(cWce(0nTcvkuVe4sM6vFCv3e5qT7&ERK!Zi zT!H>G?;GtcUQ=Xsui*V|JCC2eBp*lJ3;Od;t=w-+2vFq%+v0R79d&!@?BS3`9y12XU#;1$$?L}PRQfgS& zlb`Qy8hn7i8Z&Ke+1KakVM@K>(4OaYyPwhYk}B}SV?=AFG25)XPHXcUer$WZfQrpTiX1#Px-U3;hV8GG zy4W^t|2FewPv8CUR~cNc3YhlSFXs{6{q&(K`p5*@^;ib4r5x9z#jf68=!=#}E^f+w z@D2*YLL;ER6Cvns-j%_s7zYgumIm6&Q&Ies5r~0^9oI*9N03GeDGX*-kJF7Tx#LIp%BvWQich%t!rgrK2_xP?sMo*T)+1X3_$1=SMSoRqD2NNt~SV<;Dh^^!G zp>Zy1RG!CFlF&EWz3;@)l-`B!b7Vl{5Zf5smw%*90kD7&-%xv;Ev4SS{ReHVNBryngnC5YculS(TR#vimQud2QgTSM0*@ zTyBe3T8u&j7Urcv15Qsz=394ETF#&Jaw!~f@<$t?vYyUgIGT*WSJmHOUym4$m?+qE zdWtnD9*e@2txxdJV|=0U@lWI1xKbD~s(H96ofv8toIrA4YWN zC+CfPBofnXdi%9_*fd)I4Rr%)wrH+M5L1j6)JF|~MSUbU-J zH-*)j6LhZ{&ict-R7@yQkBBHKH8siv(*zbf@yAb}eoGLrO~M`$<={bbIt<>6{U!Ri zWW4J+-mvN*|D&@lL(mEqD)lhCu+9$Dj6X|zZWONxx{;obt-XE9mjDSci0%B~Uroer zJ__*M(QAvY>{gDsVp_7KxvEg0+itrbORhf*AQ|w2u-uh(R3A8S95y*#c%*)%@Yi-4 zVEs9!;opuacr{y~&Kak5c@HAl}HmcS8OM5FVAgUg*SgfdVBvL4`a`B3nU zu-i{Kr1GxAAf3lUw`k(i!D8>`7;g2M8wibBX=m<{DlyLh)GJ?ll?6RX+h3UN3-=Be z@sypnet`I92ljU|Vktr#gYLu>vC@12BO4d(s5_rDk4NuKit(~QYnmAGi6*i_ZhYEGFfv`%=fWo7SPnZot!RKQ~5!7&ibL=cpv z-Olt8&M)zvU@~^9G8(j~55k)kI^}|FoTftD##;IS3mk@>ve{i9LuLmyX`+g ztm>ia=DXXc`8`1;yP^SJ!M+GM_hxSg0H~`mJ;t?ag+?Kj?aj3?x_U@l9u8ij{pUHzWQZ1`l7E z4*1vY2sZUyqVe4>ITS2vh-nZR55*$Tox$(Z-Dhp#{I;~hcE{?TXU$ncjt%_JEnjoV z8pLAaKNTB|d{g6V1%zdYX)M6b`XQgW6sFi%RTPprFjap_tX`4>k7*3H6+BwB#J0oy_o4q z(i%?c1BHl!&sWCJH@>0m(rE-EUrd;l{}z`_gANx|NKQxv ziT?H(dEa7qZKuS6!~QFw_uHJ>1}YP*oab#?gRL%gUvzlgqCo=kr-6?NOVKxfS|;oi zfD%L5Ue7NqN?u8=nCeVbfPfqCesb_T#jU^+gQQ&?`L%vl*I&g$Na$CfFj}Nv=S@GB zfK%SJN3mzU5N_8*^_f+!J}&pqcC0N8si!uEL1w@LJnC#a?|MU)e{v3;C)^=z@0Qnj z4wPaL0!ICp356Xr?hhCu5F63e4aGIk z2?0+%AH$U89o_zG!h( zxi% zZi{Fbgl->D?{gq}sBACd%_{YJyN4)@E|Xmgph%C0oCSBm{<6m{L%zFJe9OSapNv05 zQ4exz4Aj=w=N3wGDS!O9TU}d=URp|bNttDB-S?@&fxub!`Th0y35p9Wir>KPY#hMY zGBAXx|MFQqpWXNN_C8O7_GyxxGHW)2vmdqo*=jRhX%GZ_V}`?! zFNgi1$uDI2bedryNpb=8_kbyz#AXQ9eRJYFW902V9b@9XZQ)V3L5mpmf#3W$#07%* znQtpT*`KXo^M_lZeC{@&CaC?$z7fv*tv%l{*f-{YgDQMdzgriUNMpq4HtHJJRtvf^ zRH@s#NxIneQ-UVoB+z@_JNqIKQi+9qFh@S{aywS8f7*If;o1pCo63ovD;6bSt$^{( z#tXFF`xcKYU?yalz5Ie$jY2^+>-7h^ajpG5&hr*fvpJqd-Y=o)C4AfCuXI~-M*Dnk zuyFZQVfesIHmIyoGn-3whLY)Zi;ef2N+eGU?ezhUu=k#WKYjHTEORX-Y_g8X^U;W~ z>-%&i76y9oXr0Nn9#51Jl=J4@n6-e!Gl%Ex(OQ3tWEd7YgOaKYVNxf)tL0xhOvlQ* z`zeWKokwDNSQ2eG=u&%#;owW$3=r1rx>~rbOg!XegT`}A}^XR)Gc0Vopfih-I{lGwF$Dk)d|Gl;^LQlRP-V=3Z&EBaNUBV_Z?6XQnbBzzg~Jx~4w$cPEyutt$`J^);hM=}AwEW3stRCsp%D$7i=~UZwT*+&;H| zR0HTeEtoqt>tJ|fysWI&m*3nv?~Scaa+N#io?7yAN7>X58J1VKFFoDXuCAUwFQ{p1 zFudLP1!}^uv#}3!M^IFv*$8TRM0^TJs)yR#GTO1l3jRnKoSdvKA|?{9bSY1|d7yAy zr_Fe={49#d99S_k+jtw%(nBf$xKg{R6 zg?Q)DQb>>bRzJ+QGnZe8GQx|)koP@MYTe?OHkL)gPUfJuC+?WG)*iUHtDL^!gE*uR z&QjlJe9v7)qNU;we%)$)PY!OZ)gw~oEoGpQVL`~|bpdIMT4w@l@MTr6GC=`*Bai4N4L!sgPn=8rU zJw+>MJ~c!hOT$#yQJ|{SI+3_P7`;wwcJv-=*9;uPvAZDN z-$N4FOH;>*N9-)`$3maSdKa9Mf*Jg{R$?%b33kj`Mz zxQ%!Iyh!XWrQzOo{CUoecS-NxPzb+QVxZ>QslrYASkSiN$Yo({9OO7%Wq+|r{?&A^ zV`>HJ)w>fKF5v*mU;`QsM%+%~mwNBQW*VQ9BfFgQ%8E$j(FH`6k1U}B`Mc){lbGnl zGz4Ci`zzx-ePS>5xOv**B#Ekn%*V<6#G&l^t_wA4b4?@?@RjXtGBR><;?JKkh>1JT z(cz4qdO?54_-BzZ+QFD{uRmMF-e%{^K5EQ-?7JKmo}r2tgJk$3tF$4z6!-ZczK|$S zX`N1CcvNx`cVTvM5|$l#LRsR9HPK*YRFAAle zjKte*09-X=XPwfUfj5tka)rw+temai0N*2we$Fqy&tz)0Q8H_6Nc_=%@hlz+@#G{< z3WDb*%}oZE;>HS9ue+}_?B`rao=Tvo@$ShM%}HVTwNg;D3Ud7NwCHM$)u~v+6{`&dts2;> zj&a>&ipvq>zmDmK6Num%qPgn$U#j*qGcz1+hk=2K{K1=DiV%+>hTEYNp<&;WIt`QW z`7e{cMa?u$j7B=B<(Xn0)Me3`NW5#z^itWybjO-8{)6AWxv{>g=BYXYMv!Yw{zGV zUR+ax76b_iRHcMPMT745teHr>Lxu$^{F&7aV^4G4%$^MR@cWrw7(%jtk|f$pwKP8& zG__w(h+I!nNY)<(fEBw<*2F3HP;K2Q_E1Y&>{-=n0C;MXr(UKPhgZwiN?(*q;%~mS zN_+3_192CJ9=9@b$dw-?%kTCi> z5G#gqb23NrbRO$AJLLwAt!Lz#SE=WNLP8>F{5G)oJRx#&b4P@c<5iC=00*mcCF{6< zd#^jJNg00vBZR_LW>lzXX?qTo3KTRI={s>Wza9$v-gAb>9w?I{p<$89A$jdc=7$_` zm>2wZ98Tw=RrQ|qJ2>U%B=jG8x4$vE!X#H_vfZ~9#WCMc$#D6yGMKYy^~`B|3F8kA z4asZAg%lkEQXUa|dc=r{?aBHgC6V6%27O&UqeBGJi)#;(U}Wo$5XWtb5$Zt+35m(x zsf1{HLS zI^CvvvPj+Jwz4hNWx-v=TP<%QfK#!MkazF7cGzO1fL zVc`C2lgw1A)B%oCJHo-7bJrJ=<;MqiVrrfqb((%eToX^vBK?2kHw500v8w#jot0}G za_|!8|pmyINvk# z2YHpD=K~gtkBTizF%+RvO)5SG3^YAz!Xzt&vY5(c|0sk77353ib}38g!@v3kTdVTy_4%`uFPuH4 zysl;-4h;3i*^1vrx8cr@0W5n;#zg}r(=b5O8e3!r+`n;iez+8j+Yp@1q+eaA9gBJv z98B%+#}&{dDVaFUd4l^XNw}y-)lGl-d_4I*|I~`Pk?GZXCpBdK2hEaUk}tMBl*ert z*fL~|N{fp{y#*02Vd;PTXoNNDkLt_`is&&lO}+^DNvb?$;}T7~M(Sb%l(`zxAgnIL zR(#F$OI+3#g2PiOTpxl-o#&|nMf-@UIF|3ll-jKi#Yd`QrW7rY#;YMKwcwjodFz*+ z7M4!r_8iaR``IKt^3UkxJalZc=Bj;c&C_9XBId{r8oNHVVsyVQvZQ> zO1GGIn>8C?dwp0~{_a|mb@02_}^`K70}5* zXb;6S7*)zIt_`adtAmG@OXni9fk4>ub3)XgEzyvWmS(lCsvAPvcD;%5g+m#KO5W9V z77h@3rlqCrz_o4hGolRTGDT)YR;1SK0VMe zAoNt-^bNRW7<-lY5wnI{IyjIPQ4dxaEm@kCF$ilOnhmG1%jH*4aMSMKwQh2Uy(Es| zviu#bI!DGx2H99u#r)OS*l=#N^;cPu_~E?cMM|vidBs3k^;eBvjn~p_xF9E0%WiEp3OBecpbV!o$&@5+kwXWENOs@enUoWsivMMk zUV#V>Br@glQ8axiDK17W=-P{N(r$G`>lQZZ!SnIsK)b~(hI28hD|f{kdux)k5BtNo zn7szAo(PC*g@nszzOEe z|3x&FrnlE{#T_H9-bVPkqEZ5f8@=*^bmL$r$~mmaLKl!#o#o_E@?^yD#iWK7uQZ#R zfMUOU=gXd*{v8HcRAkrBX|&;VHe66pP#tSKpYK6#e;Xj=Nf^l>I5TpJGDN&K3nr9Z zPM3p{^t>T0)p&yo<4uWK$%d^gF$r<{vL@u4z|_^=dCm?Qtd6Q6z(Y<>4taCg{_>jX zYj}c~jll;3pJV&s6qY&I%XKQ2QdaHl?Mf`+RNrbMm-BVdbPhKRjYjlj4r78oxpb4~ zcqix3VL)hxGPb4s? zB}M_QC5)&QrL2zhX=%+heTKE#I!a-97oS{?d%PpD(*ncHQ5ng-232yF^-a2(VttEI z$J-KNw+=n(3kzY&Tk8lgs{qJJ$=@Ktv;?S*&I`kT_-&vXb{Q z16?vA6U9;E!jgJarhnnTfW<-qSy^d6`+z3pNyYq?0bMoy4=z~$jD&>(+!8UQq@;Rm zwK3|f7GPcO^-oLkP-NIpyxU&$Q44uRoKbDN(R*p%fo~lH2I~vwZ{ek{wQ)3`==wfY zepm7VFjXR}x4N^DkdXBFcRyi7_pAW%#3lh4BVtYzQdOncaz9y&qEZVBm&hL;`pfnH z9vCu>;I0Q`mg1VTgq5&ZjU>;ZQCO%KgGv>XT%^Ci$vM$vfkfE zdjovmvbl5Weg1>KiO};~E>8ww2ndJ-t5KVA+C4o%MzhBn$s7iTb4*kNe_{+1n6uuO zv-U23Fg#8GG&W}*N(wm|%Pws|eRMg*&>`ba<=GCmDhI)SBD7gru?_fimZ_wD8#G`q z*2{(=kxnO4Gy)^dtk}xM7KX{?@2GTmO~Fxw?eXR1$Oz2p3YRlbJYG-j%;Qo)#Z9bx zF0QcrZb89s^?#Un8^}Ow4QGG(SmfDr-jM(REHUve1QD1FUH*`8kqn$3@@76wUq#ia zP_TYNSiv=>r(30jRp6_9)II-55DXJ<8fvy>PT(D0)txyD!u?i9RN$R>WKk@i>;X!N zVAaJNfob?VuJ`=ng2}qt>lI4&uHsI=>t$C*om6 zxH4e~%F1fL@R*pO=abguHz#|U``iZb$SaAEA5&Z!|SPybmW(koi(A~GiMr*f)?lz&0v>OGpt=hB)UE&8<;pXI-`f#r>o0 zt|9FCdN1DH(admBxLr~b=1GyJx-lPq^niuGcZ6&T#$S+)&(A#R+#UoTcX(AK#iQD0 zLJh^Fs52+`HO}&SOC@+PF&#w2`UKSyxhKTPYH3=j3YyN4rla^`!e7w&&hMcZ0oxLq z7VvQnBNp&HV0A?Ch5pMFUt-`Qeh{&rk8aP9fA&wm{?0a8t2uD+U4?XDBsDz9kQlQN zh%jVKdutiIhs6gMf2(QQgnoi_0~vf?IQ`LC0t$khVm;A)+cgK{zlt*=OWeKGpp@Rd zoIn?6#c^h@c)GNY<(ZkdurN3R!9rME6%S8^4V|K59MCan@*!AL`-6*}Uwj`4JT}l( z@?o#AZBXd66@n8rD#3qwy#-dC<`0hdd!=C9hv39bc1F58UWfvRLLly72ZJG1WOSd# zs;Q}ykEtfU0J^GxyaW%*W?A>aD+A@b=~`z7iZvTJ9L8v0AWWelc@i*gy(9e#h9e`; zoyeX%YT}|(hO+H0tAP&J7z!<`agyIl{?`HnZu9|CG1c5bj|+>7;dEN{`fsZN68PNs zq~c`6%p{t$+l#~5BT=ZTwx{76y6-GymjwMQFI}_UZ4j*pwcwjX&x|w~S+Bn0qKLFa zhJ@fLeFi3hvl(i|lP-`^8_ELs3QCF)IkjT8zRz?zO={r&IZtj`eR)^_7hNrIo5N+d z>G69BVe+|c#lpz)_4O5S-2bk^R$f5l($DajAm)9#HbK4!&nqh{y?W{OFvl_RNs#RV z`j^|1$$VZPARD#(hP))#DS#iuG)vmiw=Jn)07jKmJzxRpRfn6ValNE}f{8I$fMSfL zrDcMIr_+3sG0isu-Y{}FRZ01f4GN(wS*N%dgiCQB%rZ}dDy#RYj>ijx2*+F@3(`~G zpFK=FbBJR5rbq zgVN#jVrX&Rx0Y+s4*2J&pma>2tudCyUt3fLG(VK6-fY51-Nbm;cA5%_k2r*=w5Hu83jk{N%VwV9c~=nfvtz8y4Y(q*M< zC#;BgZ%SvXB&BKKijZ0xt;XkfCTd6o3LI|k?%5?RXb+H_0}ZZtQ~7e8g9$W1SCQpi zOC{TAJ7p6kR4RL4bfHd!ukP5(L)DY6Mhfb03H z${%`{&KTP`3NdM*=-a!)li3JYA~6xn{^?$?PkGRBpO)5eDVNsno}-dNJz_d;Q1>sd zMmryGgpCG4W!@Ru$;oM;DLJScDw>%84iCNq*;GRVKuHFAf&9U)daBAkBqY1T z(aQdSBLD$(A*HDguyJb)gb~%tLpDNJ#xx7_Z66;EW3Og3v}Hu^g%7pbPXOYgXfo*% z55!=uoxQFW+Z4j3`H}u$9iT{qjg4t{eJ+WH@jZg59!~*z0(`@>BJzEqyqoRzQMN@~ zi;K!Sc3L9l8(rYQp1oo@s3n(CT$BAm2kl!wzF4Qo)*np6Q(PxHfg~`Cd;R&iVFC-`jC? zUC(sRdGxkV&-B-uhjYHY<#9d7a?ay=(mQ;^>6BFs>X0u%9S&@N%~;48LC!H{wLh;d z`x@@8xCY%&7J2o)?gNZ+yA$_)ABX2^61XJ-di~nhaBmsCU%SxTK3qovu1sLi3UU`N zoX624r%*&e&Xun}mW>2RfCR3aK$jpV0$N2y8M0-7xNFZ=5zYcJDshbQ6MA(g&K|k; zeuxeU^3&1Yj@H%|G|GUpuD%xDzV0#=D-6jg$w)~VgWYRdxr_g zNL&Zw8mLOI$@jW0RS;{J>s$xu*QC=--upJWu8MieJ(-o2iA@{dfM>vPgvN}cd;UFZnCDV9@x17vu94hg86e19UU#f(mc(zbHf zdei*%_XHC=A)-LDf{qH^dchwbnuxvMXRt6$B=ievwO{w>N zUoZO}7%KOCUmUo8@DQLNH+atFkgJLI>&%eET5t?1bb`$Fzplx{-c>TWv7GE3Z|u_? zUph`*uRCO{STORa<#QDYA1ivG2e; zh>IP8^t4&VpOKqv@9gN18~FXN2<_B$bm*X^9nH;6sIRX>Q%gNs+nOW*P#c1S0}vM< zgNYL-AtF2+zA}|nU#4w%|Lk3W7>h7y2}lE|_k+I7;9Eqm`i45_3<3RX6kob6EiJ}6 zt=aKu4`LiYmbVFwDTquX_rR6nVw^aB6z~o~Ku|OyW8&l(ZX$ZOna|sFKxT6X3FvRT zwyCYHO{gp{M)rkcNKQ_|xN+m8eGD;E{@bO!wVK=8*(h4#u@215p9pi_KHdlj2$bUn z8}|b0T0pmH8SQKPZuCX&*y*tQiV9nn^>?dP#P+&6>z=QvsTSe187=aFsa4v8*49>Y z|6ApIuXAJfrrs;f9jj%J1F>v9fL!O-fym7&v-Yp_UiX%JTLpQ&&;0`eOnVa;7yw^i zzb=t}P~Y#@d8V0ca1fv%H#pAYkgkQ*giGhmP`I%Uh5eId0qp*E$HX{u;O^r(hWajh zKAlTyi=lVx2l48%+}}21I-jquu0oMSaLvj(kIL#2_yu@k?%cT;J9aGM8xo)dbR#t}c@(NT`R-&%9POLtgM3ie4vANk;%h&?m zZ7-zUQton3Xh5y5wHWSLy36M%UyRv#n8L$X7jM`ROkI~CBL2pzm>cO zLfNeLvCT|dt*@;RKbv6)3yZi~4C{yXP}^89FA?HoVD2LWbYEXzgoFgk!;uJtM}#9H zOv<4TN@TqXb9!IsK7+Mww(on@<@5nkoe1xGua{TIJumltd3iY+8XF}dZnJDxQBDLo z5$*UQfq_Io+eGcl`FML7mmz_H{zi<8kb6EdLhgOzQY84Q`(EoeSnvCRbnaNzn}nQmO^N9Cabxl_Q+&kI#<>@N z9r<2Q5<5%Fhm}l5Uhhr;%f}kBziRFuOZ({IX<4q=`Colh>)5ya-c=EQ<-{}6;l#E37{UUj)@v- ztE~H8EOdRnftaW;q)(ZO(W6HrHdd{$>tM#YBX%RlxZP>H>n_~&$*gd%s;aP}Q;OsJu#j+LTCQS+dHa2Y4h97aH(50XYFVD_9jGDSAdSY&AayzXv{GE?6q0Y}4X zw}HhnJ@oSBT%0{GLR_UxQEhIAhqp}U3yDIg1hEPT3=t~>U+aOBxu&H>)<)UR;3kXl zp1awHFu#{_Aag9|1HRX#JMW`MwAbr$&uzM{x0k)oji&D{FP2Tufwpz}XAu>? z_K$sU$ZmC=o<2E{_JNGAPZ8wQk6mp|C8{e*WPn}@v^PnA&kG}m#~?9b1d@_Q%aqoD zLDe?feL($Gi?`yUB5~D_BmPtKQCeOt)6`oKAoqN5sNDA=#QRBq%*#uJcsWn{u-g1S zUGFV$tLKdSlfZ2vVBPa7#J8hCeEZf)5HFoF-`rSj?)#ts3FMV93}aG8%glvgGKD?R zy4D@XH`o1bDhsnAfjdEfg4~^;%wya(0+uYM(_`FGTwI8Y7c-EPcga|lMMOkl(u8yj ziyJPH6CEO&bYglo%q9=%pr{|JI`J7*EYs62TsVv3k|HzR&0DN&!owpaugTCneSQ7S z(^>5uT0{1mua4;#NtxU|L<|&5IGrAM{=yk#WSx_aX9toJQ!q7srit$8A$8CnBdNeu z!;zam`pxgDok7cr&<&+BCFxRjCXSyxV*I!aA2w3_cTJN>mw_f?rPf1V{ZVS`{99Iy zYKfsflGHlSOP<)PUkSVOdh<2qo~}%wFF`JO)OZo(mWf4>PFZ!g?$;Zf6TO3L!^*yE3jPq~R^+LV30^=xBYnIX$I00~I@Ypyl9rZqr=PDwj@ z^azd~KZ#RkvM@rf|CI6R;_om~gt%bypv1Jl4o%9wPVYp`^*-uq`)y6^P8^uW=zjuo za_#m}4|YdRuTwj&*H)*vBT%1&)m3H4&%KEAXO6+Gts28(!?AGTLW~$80Yzj=t+vVb zU;l&YpCjmfYu~#n#_5#wzDqs7Noko3_U*09P+i`4zr zKLup2B+zdJ^!~Lnm)pRMh1%L$P+nS$0=e%`AK#B4KR1jUlZaWfW?|%r5h6zWca?^H zvMv-{7$5{F$PJJa#bR0ntj?gDaU^^`;|%uh+kw3Yc8W05jHFRxuy)l$MwIjN@-`hA z?abH>v(-0|?;_@T$e%jGJ$KQpcwuI4H!3XWFsR z{cp7cYRWHVQnAfE?GzF4&5f^M#ZD> znTm2bxtFke@4NWhOMekjA`jEq!$j%FMT0do$-w&Vc5rWl?t7 zmoMV7lqEo(2&*WVoHSParL-9_#y;n_c2w@|Y6SHDxz<8%r?HS*Fh>MA<3sM|1Uap% zb)7ku@(+%BlF^E3?CVT^z_Nn37p-9$GM&9TFC_xxD5pK+R~T)_NYIo zyu3UdI&=WpxmVEC=7|xBsS-RP9wB1U?I{+b+D7+meeL#B^SLvxTm7ZHGo|EFZk9lI zOL?<7T;G1zUPrn{kFL?Nn`H`Xz058s%+Er(xD}|cD!}YnGci-z<}mRurw>&0H4ys) z_I;j(Sn?PxA^H^=Kvoh$oz{3L-} zC*VAO=)QtAaxE+u zB+w58D9H5#RA$+K1e^uA(`QfMo$Z^kdFuu<^>fmsDR}gur;LS}cMn0%YS690y!t?C z76I>!?7#ouF1-EjCUJ^eCez@&MAS>hJ&RXj?wm!4l|hdBq`I9iQw|ZVRFG>CQK_gX zAJ4z|e|X`gKbtzN5kc`QU;Gz@$`nv9Z*R1VHH7pg&0y?ymg7e9(lV>no0eGzdlxTd zVC!2O@SCT9g%QI?8de{E^3#ZpiZvZz_1~pk=G#?j>)hET?i9!2^~kw=2}h0|FqVa> z<0gtII76)TrW=OpYi1yJ!0j6Hvu^_LDahTTg`D$It!qx+<-cA_I z5#v+GV%6$ZW_r9v0iz)2OpnXAlYo6~X}gw}my0uJ&Pin9L+}oWLR4%L#-vU$7S--z z@!iqhVSG%P3-{`Vv%5(40L6K`y-riv>uu%3-qTLwyxrcW>zuatOya!R-sQbMozpw# zWiP+izIHL}G|qYHIy(ol3YzGohG8pn41kfzwY zv`w}IDE$OVuM{FL=K?ZL??+s8D8`RV#`I~^CGdk4ctUp?Xng{`@9m&17cQI^UvVep z0rDmIhr}Ui%v8k2kA%Ni!|IvSnG}|QCzP!J-RH9>S3}V3W-nQv4$fUGuV+8!eH`be zYybCJu=l&3V`x5hdOOeS+0S_&mdzqJ5V>i|&H1zLb$h0cT8bAHpV zW=@}iQAtTM!zn^`a*RQ46bx4!AP4p6;FKN z3dt=dISIc+h1VZ*a^m(@Sz7kXj#Y!-`g+9Stmd{)Y|bZ zDlQNa_I2#oxy@MXsR(<|;uV;ZKEq65)lRGi%iwG95$H>hOEx~_Zf(kHZ?v4-8@0+T z6(1&VZhjf@!=v%Qy0wTGN8;+cMBABxHsI^6zFg;81e~uc^>zBz*3IH7;2iRbYcX%} zDvTLF1#U)&YnQfB9^OFxAKtDym=$*(AfG#b3Ojaf!yB7kHGafqOq+|fYaTJenzsl;ro$!; zvi>s>L8b9-6fy41xf9s6=Up5;yhog3XQNSqLo8pq3X2ym$BgN7OkfCau}-suC7YAg zu-o5Mp}QW*$0~34UQ!hEvIV&!@q_o=i+{okVkM^?EENZsGd11OD(f@{Iat}klXeKej|e1m@(?R>mEGv(3295 zT&Aq{BFJ@>*;=p);B8 za$16%PTS&Zuo2MvskbSs{U^v-1kK$iZ}sAHa_8=C@bc+I>ZBA*o}4b0q0wD}T+eHF zu<>Vo?i>NSBYHF;cish{$SKOZcJIplID_4q)6Zpi0 zWZCZ#%$dCaQ8MjPyK5@yn3pv8UEMcX&}Hc^S=%J<_k5XT-TQ0VbrSwON++IweY@b{RoVEaZOkyI&wBMWb6TF+SuXC9+>nLC(%c4`GgMj&GI6`LJEf zy&m66ug>~apv=p^jP)D-CjJArqev_aAAjV-BFKq_oCtF2>q|T4@5iL;cw87z1kCj= z*MSvfwL~l=vtUJ89ghXKamuPQ6zlqzDcce_q*a25oH%s^HT9+N3v|alOO_%rF|jK- zJAPd#xNwUE^mju4^tb5TxwF`_XAcUl)FC8tBxcUL*F3P%_S{%;OXJEm?-qe`_W?)1 z>R(vz`k=9jUFYMP_Cu zUVD85JbfcDEODYtRhQ6^sI`va6TU5w- zO@y2ShxQ;-qMG{n_+k3g+4#_tpF&FVI7CWNf_4#eECtG`{g!sz-OUoC^hvBeNK&W5 zeZCw6BqL(!4}tt?`gR#ysbJ)3f;#jr$bDIS$Z4`FRMB!3~#`@3E`O`Y6&}RQ&X}(=`lhv}p8o^?-ss@-iBrTp>>M38&^1?(0pN41dq zz@s0<(j_a6@4)8PW)p?b3{th|d<`lB&euX&xe9WbBFJe_2NC3MLr{m_VA=POrwDR- zedb6ok-UN|lvU;7!F3N|{P^+a-ZJ;8WT4kEUnFoV1ng@`Kh>f8jvd?a>MO4zZPrSR z9y<*&;y+6Li*~pFw{kS@O9BI%Kv#dk^e;M0B*u5QzKob~Kg^z;UdIt? z2+-J2XYTt0JJ!R`s})Z@^%Uab;t&uJ;CN_djWGsHn>X*GMFsuGwmeR)K;6nT8ZctAkziZ=UkX{@J#2 zjRLD8TaZLg_4V~N19)9mEEaNq6$`m%92Rox);@->{KL164?GnSRdA}Ut1-UOblPo@ zM12hl3pe7IMijR& zFoRmNX_wN^&(G8=LZ-Zi1c!)&@<6K!l83Qy6tPepxN20~D%oG7yzbonHjW)XWFq6P zy!U>wj+}$BV^WRK84wU?of|6`z7HY-djEG%S?wXn^`nKHirOloYg?c`470M&;Bx+X zJo3mR#$SnTeW9pLn=pu&vnqF?XayCmFed*Fg96Eelgy)l(y=W~GlEzCkVLx*% z>UGIs`JF#MJfdq6u=-x|F8{Tk($G+gGbav8)YUxkE7gvb_pL%gLW1SGM2qf%N|r6g zY4P-d>8_pI#b4xE)HHb^dE68vk4-ZIyp_(XfD2Ybi_aGc+z|ryeQyjU!~mmJ9?0+8 z@g|zQpn` zQ#&rTBI0CA5CZizw^RN!h=Ph~Daqr_^wx9<1P~>bT`Fp+IHf%`ZL>{7uY)47h*OI# zou-*3(M2z1XJWWmCyY)SBaMBU5u8*s(#GB@n_APk8!=9!fu1;d1i5)R;+VG*Q>V;A zvRLA&FsGfy=H^CIp1(f(2R!@2|H?W~tXjDapZVmMjL@V}9W|n9Rdt1kicLlkP!TXD zCQgo@f{`OeNhH`|CNEnAusdj4e!EQV@St|0CmKLK?@>FX*EpK>4 zq;QBqT7p*sQ=^BcRurw%>KqcJAA=8y7A~n_bn8X|tCgCQhv5 z1*rP7&U$_h9{&TT>59~XILuWa%Fd|D}kjMY6P@j=q?5e`q1>m z(LE?D%0j4r8|KcPYaW;?4_CY2huS$}eczt|1-bWU#1t+>z!JTjE#$UYKIEhWrWSH* zS3iQulcvL8I$mnkmMK2tUVrl?96xc$Oj%W-M=jzWSo0W?MAQlsUv1hE>N&WvJ9ipl zyICyR_8;7ZcXw11g#i9kvao>vjjTmOE%pBsA=A+YT)%r^Y!ztIenh^rCNb)?`$%{lh#2yXm%MrJlqi| z0#;(;XmMV;7z^huH3FTAXO=G^ha@L;QUOi<)Rjp&beiry@tt?}+$jDgauc$<+ydy_p`o z|G;kSJFwGOx3#rtbTGBPGn9=WsCj#OdSY_gbSznXFQ!hOiC7Wnv^-j_5)lv&9NZ(p zBsSpi(f!7{Pk($p#S&8UQ>!UoA73NJE?T(Eh^;C#nq%l;Y^BnLu4NYG#tB?4$dx*# ztnNVn3v$-|Bo~yi@;sk$0%tB95evD8C9uQfu1Kp|BX<05{Je6H-U(DyRmxP=mr-8b ziqP0`NE|&L!69MN=C$aRX8!fQC)bj|&?8`e>dh0?PGc=|;_wcfKe-1F-oHv7oJ>G; zbWB&j!`0ep?W<^+ni`wr0cHhWeQg7>b4xIP>B9(*ij!FjzK(~+D%P_@GxV-**0?VM z&VpQi-bEACr7-&lR^EFr=FXdM#v{6~eUJ5(57(2x-6TLk?rzfOv2U2bwSt@mby#mi znQ0=(J$V1)n3$SwIxa_#9l%}@f%eH%)!LeBv0@1{g4e8>^No1tFH=5M)aekh$r{{r z7sp6N(m`?;0ZgA(?iDdhr)h55@){P-UuL4RuD^(?L}TdtM@_?%MN? zvFQ5y&wdrFR;-h$6G?pvaxu}dBCy5dN{I%X@W!abWHUw9L&Peb;;PndI?YwB?_wq0 z1hLY)Px2g{G*;62o2j8%3l+rFsxCi2$B2k0P8}5svx}-0AUZNu%(zFwPeeR@s-%LS zTK%X+UPk6wbIchs1$5cc)#95g#aQ%d8qHJx)Z%bUUqKy2KvNDnWmg5q<6`5c+so<$rcE(ar#Ji}d7-QKtZtMi{4LHXVMkIf}1`h$fwyvJCdZ&UqbPIASXrB{7 z?)14sR|#@9Wmg;M+2!Krz#^c(J4HoBc4 zEeZ4+0nw{ev^sn8fc)*n%qipKVO=W5jT`Thf}H(uQhz%tMT}Gbal7^%MMX^;7A$=L zfx%&>?w{HJOByU{X%`PUtLv>yzH|$zJD{8-LnV_7tBXcaIhJ>Xw}$1 z8-OQxh!mNE+z>g@gQc3<@M>4<+Mo_?#*f$oYaca&j*3=qZh95lcWyP2Ox2-p>i9`` z?BNfI33Iv$;LvI;wPc{JPgHxnoCP@*!qmcRvj}o;Zh8gxEM6%M{VI9-A{KHYQ1vCq z=`_uk*FTG0yWcTB>^}c@Uo(PSZx(XT|Ly-oP?PXLQa|;#mOOearb)nwC5!Gg&WJVQ zYC~fKPM+0~4efZx$|HfG2 z`H0w+E*5B-uYLy0)Lpeo(|xjYE*hU~TerO-;@B1ODHn#ds~(mgvt?p&I8{2aYW1dp zE#6Czi-MP@xB0=-vZ}AXS6|m48oQBo@q($7ifjw!-Gi9uII$`UGQwSXMTwc3yY=mj z$jA_%DPk2kSF9KpFT5A`E?XnPH>@YawRPghue!=iUERKO8;*&On9|ZKavmPQ%o%eq zP9l)0c<1jIV3?VQ$kgM^^)Oi8?2cD=l+`;E)In|lb8YEomH1&icR>WXvkpNn-LjCg z8MDJ@li=r#5^x@vS65X@yPShp*1rzlpg7E0uok}Z8=mQ)tRQDw?-Yv&fB5i0WMr41%{>US<}HV>^l5m{ z5AN%hwYzx&_C4<=W0cmGM&xFn!_I9li=S{EZ_Gw~{4nDqT<}j?tvZ?r`^iMl9dn-LVDlY~NzUkJ)0$sMCDapPh2ibm~JT zU&^^*T{m=eUQzVfb*G00q^?t8K}TTDZ8>+gEfpd&x!@q#EY)T8X)&%Tvi(Zxh4!b8=Lmh zjMQNOa?eU_d;H~)zDo|NL%F#*+@MJ2Mo<`R9NaN<&LrFaFtc)v&IJ^UaeF?%3>W^-oUfkHX zRBg-v}RV ztKncHu9{Ll0onv~^Y!+}_;FLQaQ-qf=B%YCs_Yv#uT`wRl++{)=r>rg`hrJ@>^s6}7+-0>vWtE^E z8GZuB9U`!In82v8^#%+Wf@zcIPyx3;YzXejy;ZsRTPC5kHMMkUEl}#Iy9u@>k|`(d zx(lCM#=H+wpq#iCi|eeo)@~>B?pX9u#R3$-P*{uod7iKt(_BPF$qT^PQuo)D*?I5+{7?b{iPl+ zwCR}jbd=D@rD1_bYXLQ{;GDwJ(gNAnGLd%mB5F%B(WAR3#!r~^Xm9=lQ*UVZ%y(Kk z!;Bn0grcgpu(oqU4|*t=(epqykY#K!+WZeRvT@lnYXNOl$l|eaNE^A%bxhRJUFhxK zmEmi8QcTZ}A#$t?K<=5X0nbLk3_$MLc#i)trO*L1-DOpT7WN+4uD~Qw9+gQ;5#z;O zyPnC|V%-!7Co#&zg;jnFXg4lo3WVJz9kjUrw6wT+ARtFJmc&c9RaQ}n^o}+OyMsEa$66|un5eG``)=cwwF-a|*Un%5{6ENi(}EUD zdEfi+kBoV@U9s`z%vz|JZsH0nE}&He8D%#~9W1PXW-=+PqHOrCJzJGc&!0bop=2FO zT)qMQhCmcvWtUbMasmc^wDQmJ_4TK^AgS0)7TmdatkyCn`8Z4l% z*<>AYBRd1f!uG=7yE6v#@q=IY00WR~u$1wpwOYUcKG4j=-1?~dm=vH}@G2-^_ z-=SPLB~F~M;{+6PbnK)+n(kzoWl`ZY;@Dy3j@hAu9o0!kVb=8L(7k&v6>F@PARcFC zcTIHk&Rs+u1iZS7A@`60xpf=9z`BiJDqwBm`0054m0!Sxz?H<56Lz0I0h6+uk|9w` zmRiBhJjD#$yzLw0sclVfFDSKh-ELn25)aarD|JUEjzuEl6G(2Qca8{U+EbsjC*%n0gWO`A&R!b z((6rTod9$a?=F)runLfi(EvG#3n+kGe*$vio-8iJqOfWl&z=PgKc3QnO+edm^yX3nrn!SjH#8=Lj_v!L<$leT~X$UW&N zVBG(ESwMBVT!<)!oB(o)A-6-ZrYs29NI?It?jDMbHEif;cy{wvq7K67IuN>30e4+o z+{r{6uGC2b2+Fl>Yt4?j?yg0Stb3$$ZxN7tXfCVe1kDgeZ*G5VVRteO$T0o<4Ju zs;w>QVPF{3BIjzST-K!e;)AW-djY8jF8-@biQxy^=0 z9-@dvDY|)hoa2k1w=G)SxsfE zkQ1>H@bL^l@UU@O{pR-q%Cho36v(2nFJLT3_6ZF!%A7&!*qEhO+4S zX(_Ld$6`kELT93j41|at+tZJnB z$Sj~bT@C}y0l75BHIvCquO9u#<{C`~+Sy@4*Sh#Y7jE)H-D3?R}a$CId z>OZNtYMumrL@+?qO(hK(WYoYT3!|18aujvY-CiXh_Y-v}P@)bGiXlfpE|-AZH>(sw zPQb)zQ|73A*>tc~ao!}h8Z)KYlbO=rN?wJ*Ch^|RU5JN|m!FEaHi&FA$xjsHt8L%8 z0cX#hrmLxg3UDl}F#-7WiC@!)q<PWM>>#JUoM6IIsd=Dq+wAAbd?iMy=0 zlHon*icyFQuL9)AqPrK6o5&b)WXM$+fSfYsGy0-{hz39|4;mmB z{$v2TCZZ1Q+qZA9xbz{$VOZdYSU~zh`Dp;;E+ry5_HIB<^_S9RvYI{4nx^&A+G}Ik zz8mP>aBY3Q)%EJVR)WV_j>f!y`#WusC+BI#Zko@AGBqUg-E7ft`a^!xG(WA|st>u~ z&61P$A$_oU6F{!89*~>zv;lHt$oVkdaq9%+v>GREqiMTn_Bgan*Tz%pC)YfS&*)pP z(-ULZ7X9Q0U8A4=uzqXn4L!97=T|>V|E-E#Kev^l5kh`B{jL%!81+)ROiKv4xa7MYT+R|0mnl7+%G|Um|XEt~JO(!X9|9!ti9{1<<15!hoo8?pGnRybRM2aI^@47ne)5r2mn%kqfZJXt{`RUK{ z->Od19!(i?1|at^pLmmYEXhh;<4?;6KUZz3{u=$HhWaVj-Q8lel(h5ZQu$HI*Wc&f zEA&Jk@^5u-$(#J}Xvnkn=eNEx+S=v;uzX<*nreJ-d2esQ;GyiDyx3DUUXe zw7`(-K|n6Ra9M3F^~uP`{ViYsa`(55@l7kVfIj8bMICgN)eo7-fxS{a%(A6i{INIsw##`PQ$` zKng~5R;;}gx~#U$kkbIUq$?N6j-yZoK{;^;_NLowf4a;H=xIgIlL6Siy-mH#Dr3m)*<`q^s;Bpl^&<81zJOd1T~-O;3KO(x9s7GN zq$Z?nBofC*8jInw`uAGYxc+_?kUmg;bcUP`$l23nbr4;$weRI>sg+tEdcU;(p3fT> zVKUa#pt`aYr6px*9F=t2m|L-}wPT;$4(1$RWyENH=%2^}PK0)WVUy)3(JW#e6Q-Xv^>p+9u=O;VB-u5nI6x%(`7W zwecU6bz9}RAs47e#%mhtG~bt(7V?Mv zPI)EM@1X7@?N7wW^z-FD5BpGgV4`&_YgzGa6&|Ldx(*$#t*;|^FURBPC)AC8;EQGp=92$wYpPIDT8tuwl`*wy&zNlO zRsSzxZd&O6f8ZT|_+>ITl!tPU%c=p${cxiiS3Xt?7=YYkHMeoIzt;k))8*)(19IUJ zhp=b=Hs#)^1OTSZM<2#YGvfd#=c>sWe+v*)Mb_7Of>*ouZpDVpYt*7gfS$3VCt=)} z$twPuj68bBE_wZ7fSf58F6GG0y`k=NEG7(Bk}oSjZt}!g@aXEP*m&g?jSRW3*MH6l zj0t8^Y~r8Z`uF<)aL~gk@zu6b zUM3Lv71nQBt*#$S7UJu#{gV>VkQj0T^hvtS56P3Y-W^Ni% zt|TJmYBCw#Z3s4Wg{yZzc)B~ou7kD424@;~r}C&v+L*p7GyjzQRut#s=8daJIClXh zl_qfU?$3=S4>&v8bD>_V&XHAUdC^T&)sh|8hQNfi70h|$lc835#*m8e7O0OYi} zSxprIvfI~j?(A94!?Iy%(+R!-y(v7=9aiE2!Ad6Pm$o6}w9Mzqi*6u0>ng7~LvX4J z7Hw_Ot$Sa%cV&C()QNz9wdyCNe)1|_$36pfNV{?dsaLNcB|Q%wK0V>b`*e2h$T=)G zb=AiC!>`j?A0X-8K~+UDQqG@b%;GHM+^#_HLBr6^(;E)9HoU)tUm-iJS-aBv5CN%f z=VT&1F&4{|w`X4`p=i|A>Q}3L(aORnB5MKut0*o&M)CzD#73f> zvoAV(bVmT0XBOuCzTOs3vLITu6F{z+%c=p$J;}#n-1~c2zyRdFhp~)PpS%SWSjNGj z5s(Y52jproh>Dyurp_ZEH$XAD^u>*I)B@(n-y#}t{A46SxhKY8t!m`vACkFH*gfLy((g8*`J2t)3t6m@W9yfjNP2qd0P|m%316yL zT3e8nD*ZUKrsqlJk}qvcO;A~S6Iae2Moe@R$HOyf;oU7@2!@0#M!%k(1iHv*rx=kO zYFuhk5UsS@tM+m8Gn$FT4eE>T zp27mJK}E?;2Po zlP%-oaU`4!!~R2|=-Oi_292JMe!Y95Lpy8KF(#`#wC4E{_(LzVc0cWmd(Ue*H;vco z@4nylEvNeTf2!IC%WE*?{(f6Z3fj{ZK+cTpI5IH{vk|)fOT-?FMxnVQMsUtLX7V&R z+K}nWIhw>bmP458W}H9fq{iVag_m~i-h-0TajG8b99y;!l2S4ia7=(fQKjwF z$(am*cB*`0zora11;{aeow&3LP*PZQ8waRrD+;jb=_%+=<<|xCUc|uuL*UX`@+Xro zZOCuTfY`1Lfy*3q@BI8cwb+pRySa5!@%3~-E-NdeUew_z!M|%*K(J9%T>JGMM7O9a zH6avW&^Vqw3rH)wFGJ1%(srB&O)Itpk^V1P?;By=f3&*ij7Zhu&*Pw}* zwCGm|8qghX&h{MZ8UeXxqr(GhK}$XT_qo0yapqkn3g%?s6cwZ)GwB%CZ`gvIqBiI| z`bCTi8i*dg?qq}1ATR3@E}xCW)(xxS>>Gp$3w{Y7w~pvwZHel72Ds$w+w-BHp_Sr$ zl|^h_56GpTi$YvYhZSl*|VcCA($`f3zQu09j> zNiiKsiq{J;nQ`ejP90c_orl6;?%;tXZ~h(uzP@mBu;-ehQk|>j-RkPbYa8=*@4Mz@ z(a+FJp#S}#-`^(<0ZQ8_?-Uah<)q@!?u~fwPrrrxz)2V~b|!`7o`Wr!!Dc*9qb1zk z%RDF_5Boc11J)q}kbBscHPU-r7BB$0$7N~bJ`cqLKM0UhBeynWi93qKu(^?wjrAK> z)3q}U=~V3$P^&)yo!4IZITcI0lSyW$Vs;21C&CJ65@NCMzzzj~_3GIdqsfvJ<{X099XJ!9&4O_*L_{Jk{v=kf{aD3ulgY;Y067tU5OA%mtW3pfn?7wGMo@6VwM$oR zkwdng9I{9g_mrZ-+f-2v!`=hi`TK~7X=zs# z;HJB*3Lqzf5{{0}3XH7ff<)}Pi>|@31TsZ|a>(Fd#a`^$qYv$4senH{{*Ks878U{q zo)X}bOvH2N;*~n9fUFaE|Lzp&kjE&D!E4tt6;n~-Nw9AT#u6YMK)|o6vQnMH z0xFvsFVB_*9tg-iNtaa{s;t&mxyGIQXUq0RX&$`=WSme7Q}&1VW5_*@zDS^q$gna*MG#xb61d*U5UEVTj(_~1XCCP8bkW|qKlIb$nhF==>0br$4u|8HpP6^ zas1K`9RSq-)~?jA*FTltcc-Pg*V~gD zUJi7ptH#yyM{z20Cu7p?gWrHjc<$x56(C{LmgA^wcFAC+j;8sz`~Gr2{dsHWYS-vj z%4gcuP1BH1nGWj*1M|r{#-|dO)nsH`y?`@k6424j2i`pf!qcNG+A?O9=H90+lZ%@i zcju?U9_kE9`QAgziNOVo*?rNb!|feEvI#F>JR4=DTmnqX;xX)V#v{z zn<}fV0+6FkS?Ty(3DDdr$H_zM5gxi7p%JkNny?r%7QBW4Van1)S_9S@=A?~mXxHH6 zk&OuBoNmv7L#Vk^39AkOe?fr0j_BYz64PeP;|BU<*jSnIJk}fb9m1%qswg5uH4Ur& z`g?k&#KP8RBxcN6h>(yFv?mi+LYCEXqg{F#X|J+Dr!_aN!bv@pI-ni*);-m?-BZ;h z9qmWEwiac#a}d4jQye{V5HakxUL_zmYTOLCIyunBSp8I_Dhv-Pwmax6%&3+!<1n-2! zCF#q(1ehyj;M3zLBC+q_4yAG`YO8YG50Kl)cxw`KP4d*SqoWe15Et71bis6R=%j!+ zCeD1+;?}L3Dn{GR-J5atTpS8+<`XdEP9x*sjU?D6EHXVGp@;V%^zdH9oQQy(tvv)t z6jq-o&`KFh>*KOX-h>61m!C@)sdI|iCfA56>!b-YFl+h(#n`hU*eAic)5yLP2HZ!V z{29I!(g+?-msJ7en5F=GGC4|0x}@URZQ1^fQk!*gaaH#g!3}X;6;MuWE7J?HZ#j2P zv#zBhEJ9RscPQqd2vLZQ2MrtscQ+3;VG|o{< z#IEU-M9OF!Prn7E{oj`%_qYMMi>EMe{#^9!+gE|kx^){S)cOa;Z^HuL(E`$c>3!I} zfLv2i2Q9%z)yGLYlY9spt`U&?0!Jew(5bT$xbaYm4$*xd`Yt22)@7H3s+b_EURq5?L~q>K$A?cLXQGwqxVgJ?I`d1&e?DTX>Qo)Q;dnbu~B8n%r8( zBgu-4odP;2S2uMd`CRhA1uqZzUN5D(y#A$meh_>P8tqhnm7X`XK<8%ye8}~ZzItXX zr?@G~_fmhfLu@OcXVXvWzj{Q!RDM|4r{86@6#;Vk(`3~#GrfaLrw-uQk)7DIZ6|sR zosJ2!R;WI}&W0}1j0q=fx;u4MsH-Z%!S#Q^@#t_|$!o(pDSbj6G6~9$oxBip7A!-T zP90!b?}jS#$Fiavny}tvAkDsUjQ~(6KKt?m6_ZWeT)jN~7{_fk z#*CUkFw9W_M>0{)r7NYd%~pQ)E&;bvrCcgP5dHfPQVORcRv@k_B_&13$VfxPvBL`N zlYvxRKPwoQ?G46|o6>^Isxb97e15cq002M$NklHpe}lDIf90cBsl1&b|n6?0D%X9ei{(URBcGV2Bb0|o4qXDDJBhmP!}`_q10qKfRGz#xiQ z3{hep?b@|hG4sU5R!z!yzHvM|7LfMessOop1myY|fZVfF!=7wOr0}r06DTol*_7&fbv7|jH-U3%vxGpq6C?AP|nQ4 zN~tbdS~$!?tF^*poGt ztnat8vEjpiqsPMqSb9xjoJBG=%WvS|fddE}MTXq-KSO{|7qlbLEeu<8dY2T6_zUAr zuK8*$(sN5OcFtQEHDUyM`Fkm_j}=g5So()bZsbZGt|166tT{1`rBypBfU+L5U7M zea);lb3?L^>y69}rEk&zxoe1yH~?P{2gWI63^|HVSha1-ueGuDaplRlk70rDV*vw@ z`##n(&VAw*P@OJ2ei@uD5R3^6C!>mNDVfZRTji{o3+eV5cn?EP&$tX|`hXz=YVy@Y z90@ysBV@{5p*pAxTH-D$vD}6d$@7 zK$n1Lp-1*0`gjDAu3S`1Id}JN%FWfw(^rWs$Td!i zOfl*>A(Z%a2M_JShm4Qs?dijqdSeI*E~Cq;0CE~LQ6}SJ4*}Q?AKj+_G#i3?!pw8+ z;zmW=USz#>K8YA|b2UIt z*faWM`L2ci(`aNP&ri$(($DIP1_9(QUrt2yDJo|=b;F=xjVh~6$FWC|S!rjI550MRK z?b5O;0#oK>k#&T#t0!E$`oPP}i{nT;f?^tDrGhTCx5)?*QH`>yHq2`uxOMIb3%cuF zrSf7@Vk|CPjK}HIXVIlwPYfA71C9>PRF3q5pMOsReH1}5=K`8@j9YnBX}p$#)RZLT zuCOGVuZm^4aw#4Kw@XlC z<^We0vg2#Zk(qo}fxdY+3rXp*gpF-SI6Awb8x<{GX;){bjtzE|IwoUq4P%Iv-p)m4 zY9cbIwtnLV8IJ_!WHD}S+Xe2NhxiBhqcAUx;Ab&PYT6P|>Y>VJL1vX&GfQGT^m&-} z*TZ|2dMk4_1CV=oHkFk0u~%5Hx2|7g%)$eB_uW6ktWz)a88I6RXHJHv8|Q$mz;aG` zQ66qyzl4w9|6inBD?re+H{s=Ej+{}bv{YAt_ zY{m9ndr(+qf%z-m<~(=+Jls1Iq$eAWb+DQM+VzYp$Yea@^t4oNR`WB0X{@BM>*$Kk zY}cNwcg{{uuqD~MgB-<5WqPi5G&&@BU{5t{H?JOWvbR8596f(N z{WCfQPD7uuGcbG3+*Sn0i7j+ME~^ocGejL|7~^;vEMNd~Ps39(^4MSjnH0!CB!HZN zToOktlx!&(s6}OS3f&ib_3U?FKu!{p6r|%8cGm5}TLhSr=_a{Nfl|VL>+I}8m(@PX zT~mNAVUo!Jm`(N2^B2x4SJz94=M}5Wio5Kx!z}^~!h);d&Qv?@x(CqZwNJ19jCYnn z*V5B;uRM%5fBY{BkP|>m@-J$pxw+Y#cx+URH+y>r)EqRzdV}SzO1UwTa zgG>}e8vgo?EOlRbP9k6-Vi!_|j&#KpH(Fux6*4BCfNYY!D8jnAc2%+Ndh!{#^1Z&; zlIJGwJ+h;pk(tJLMh6riE9^zt(UWrc_;gn;$D;bG7=WbP3-Bt3OvjAl>9&BrC}>bw zeUgBjxU3osxu?5AwX)nxA0|K27v2lV2}6zJUC*x>LD*OkI!jjkCL{}Gkv?mZHOlD#9aJ5Ob#1ceo{{m5=`;b-D z4enk}@NhH5o^4yu!O0)f7XK>-_w_*+aak3Yv8poM<^uJ~g=0v(bP-omGjX%Hnv4@G z*l}T9QF4n+bh1HAEa23+2YdtiVaSM~aIm-KBGZE7>K$B9ji=y36vCt9QP;+ji%?G# zv0CAisc%W=C`-o7}{*8+!B^f+D zT!->1QvwZcsIADs&D<>3jSLQkR&e$1OQqTc=xkk$QUVR3hxWs*`#=l`o{Zi-0?^*l z1f@4Kadhu$Tuw?xepx%_tpiz1RcaA0z+@fA^y+egb!0Z0n73noe9)I+B8H6|1Dkf1 zbSI?yAqVv8@*?D>M%&!5+)prsP>6i2g0*DLiw7l>dF2x_kmmmBV z*GnAW&@BWny}E=O)Sgt`Btw+#|8{OFg$*LfjQtGxB_^1&;cBoi?sGFIov!$i zNH}*M8Q1b*>*xjlK7-JQUNc#4F{(#Om_(Udj)dy-;?VLEB12&#&Isp{_rLlg)syTlP+IW;bF|l5Hu(A z)`Xyc729lOC7Et@7HT7-3qiTz1k${`eJS`tP>yw@mhtSW%L|b}ubvC+t5P{lk$Zl;afuYkBPKZ7pu6E@m z?whzz`gnKeLc+X$;lfEoGayE#!AYAedSo|W;-^IrFiIeBmd9P862@Z@U~1ghsVbJ7 zYZrHwRy7CF^0G3-6WEgYZRakWQKA9@>d7H)D)#mrA&RZSEc0W0wX+FvWQiTcLB?}? zY1vQIcP=hn)V(VyKp^quqBtOn>Z^ciJ$v*;AX#w&HlB)&R&K8~+(lD!Ox{BjT7_LE z0u(*`dnsm|Og?2~RXbktUJhO$?gjFfQ0X(X7{`a|sppyJ3m4BSmYuX2{SbDW#Ay@p zgx&-+B{rNe^8~ci7!P7EiObOj*RE6koP+ZAog27-=!U*jwH1*I1+a1QuDKRzb{8Ap zD!hrz%yi|FdY<=|vK7;{SIRH>lL?5et%E90pI-eGpelLMKt_o{qY9_8DrJ(ttLXM4 z<%m5Uqsk;eqX;@U6HFCW;f$&C_$(ZhOM-x!ax||8>OAKl@*7x=gy;us6!Sg362GZ9KMhweL}TB!PjMkJ4cRyA(6*yD$8;YAc)Q|u zb~3Uul971zDmP|2!OMRL7QC_oy?arqm5dfM0$phrBgnwp!7vcJkWY}vmh2E2w*`E2 zBY7DNAKWGe=E?oeJ4yGt6NX5zUofLyQi1>ta zim~nO&#|?8KUkU8kljOY>+DJ8O6%U>rP-xt5le@L_&r1F|%aY{Y9>xJHIfWo26gh0MYt3S4=2btVJRS}oiQ zu3bh#3Cqt^xotB~!>6gNAklq!mK3h!| zX%~8FSRwybp_)ePYl4vJOEGrRJme+pWc<6M2#*y&?oSv!eg?X-pShKjf~16FR2^Nb z`l&*;nE}CbF??hQH>d*@>n@uy<_0%iy3@(BjgJY%H|y8Y zGbNAxlO6ne4JDxM4tt{4@h2mZP9|zO-NQZU-rp~1GR94q3U{_Q8*2^S&Q3j#izg4_ zn~m!^zfV?xc=tX-$qMccdz-e%&%QvG@da+8lbKso3afUujCc88%;$LcQiw;|iU5Q8 znHRBb<$H)ad=R(k2Jh_Ei<=BR(Z$gkS*h%&PM@HQI@NDE@0N{|UPGp0c*so5oHds* zXnq1 z5FEV0iAAb%Jry@j$&&zQ&YfJ;Z*kLz)mKzsH9)RH0h3ltL)=-VY@+09$9yO^RZjd=V$8!m2lFj4^=?XeXs2R6 zgKFMG+=zww=j!UtG%Qs5^6ZS`*|31rD*=UD1mqsG%c=p$JsWkZHI?GK19I%s*tfRO zGd`5!=wsczfZSC~T=Wb0dv<|2V?nL__^)Wwz6(Z9dl_TMRP%6Sc!gR5a%9$3mEA^O z+8L}{y^`wLXE9~zui@ox4-{X;=bwMUMQS}D#~5;5oNUR|sKBMzy*L%Mm+Y0pu(Iz4 z&mP0bI2np=?(SrcwO8(!!e+UAE(YNdCs0t*20nu(Vd|7A2o4G)Fw_PaNyiZzwVPn! z7Gz#4;v&@@!^e#!>no5OO+K*Xuu?|WU+U#Jgdg6IgbT^A^9;e{8M82N?i96M1 zyo!X_Fnqn{Q)CrXQxw7tW5QSebIp+Mlsz-cW-(hkr82tKbHnqpF!x}YY+wx9->@HZRx68Mc2D4 z7rD_G8-2BGHV03GVA*W`7@&vijdxs25x}(M%ScOAJPa-V`bjkc31`iEFHx~!Cr@WSm87ln^A^w(36-pIC@8i|%;&r*B~3z`k&_v!=UwI*uRNhBfd1 z4yG=_2p|({;i7ryOt7tvZt_>pF$BuN-3(O{2^(jB0?Gps7&wex6`dKjgzQ{0*HV+> zaV9nrp`i!p>g@r)o@21^M=zjPFF(4~)5GIZ1Od4%_>^F~l_l$_dw28=n!wHNF0dz< zSW;X@H&Jnicg2Mxs}UX^ieqOJ@#A0r6~Ut?z}cn^Vi+4PI$|GAojwOg_x|wjAEFqg z9$mYlBN?b9mO-hkil~DEZ}M$IW;Ng9Z?Gte(^C|%FVux(3Go}1ZZ>YhhjrkHj!3_z~s#%z3Q zSl|a(zyRcafYFRgT89M`%)&{G4*m!nB{(yV{i^@B{)_)72CA)NT zNZ?sXU)*5DC07740S5&Hlfb(4BVpQ1UrXw)bmgO_pEt1O2#!g5;$ADvK*^gh-$Y14 z@~_lS>+dgsp`_6?zgoJI;YO>glBts#%ck91yISlgAd1*R?kV>ccAVzg#GPycXL4VO zCnwBCQHoXfR(8|U(DR_B%R4enl^3!&DjCZ|Y*kBcy$DZ8dZq*~^=s6L#>+Ed0jYHc zAool>N}~`hSfEt_a_oN_TvqEDa`6|hV%)-CU|{b6vc*d1vi3HzZ?}O{_ZgT!e+K#x zC=zf+#<3y-PFGIv!r1g65)sTB0i%C{evc9?1Whi{m_FOHFk`jB<$!~6fv&ajkI&vx$SG5PPmAox{jE| zc&AgQOsCtd9j;$JMTXoiGEX+)R*^Z}JcBTE!8{BI?2pc!9Mt$)NwDzd^()x3@gp2M zun&2)Ju!LCLM(mhc{tg%rwVK)0l6rA^2x`@DKf#>xj)Cqpg{~k??#qQ6@juaoQ&8- zb@W~E8#oDzUi}YrqsnRrf&y}+5IBe=c(rED8rXFmfWAW~QDuBGfkju?+O$*SS5*aL ztda3^GJF$`MI54n?I{FLA+R}#Ou68}Xj94fR1BWK?#n-tz0Wv$6^@uVZyADugVDFA z4;R}d$~Cw>6;*FsIfb~WefVPSm*_EMA|}mQLGdO5w8a#O^#*G_An>wPpI2XIu{SA@fhjBH( zme8 z=cV-na$1&US|)%~@y#q;II#;mckM*NrF6_${x+FcW6;CT9TkOnICE?_cCCH~S=GL9 z?=cF?Us(#5j#enkPe$a8;8Mxft(XlAVu{Lb!4xlB9VaojxB5H zDV0O<6DKTw{Vm>OsJchm#Yi03BY@nejF0Avo&!c=+PtOk^l*V)drO8tsi0^KH{t0% zdt&z|R9QVrmDO~-{L9~=U%x)MQ z=cfvgJG`DMtD!Kn6+rGk(KEmgLLkf}J8s8UpX2cU{b=Xb2SXW~Zo>3A+?Wt`WJ$w> zOw&T-WG3S5iG2iU53mm{K(7&tFo~NFqlO2fw)h6(j_$#}jcZYCX3Lm-Lot=*a3zD! zhG}s6&Ut#3+I&cikHntcTX8fZ3c*uvf=tjP0ntR1Km)V{eB&H}qpaLR2^FY& z$cg$L^aLA!>v>l9=BeW9D{Za^JLI`fkR=bC@6Qt&;R3J z;Ml$tnHP`Z^Dn<5L(Z2jtG~w30eFqFCs!pwP#Fn8t*e#Z?i zy1vM#K?qsaE(-=4Bbxb8ItZz>*?bSWY~O(*5E%-P`}pIJ z6+>=}Fyw{_Amo+khIFJA)U4vzw!9!x+rJM;z^icwU->gN?A(QGEa{cN7xiswE zN-&KKx!AMmbRGO3Oq{j=-X5Km%WX{!H?rs=TPQ$Ad=%b)|No(u?yda6kSh2Bx575{nPKzY1nhQR zF=`CimI3ZaBdhMvKDLEbpJDXupJ43d1sFc456teABI^o4tX2PkQ)e=eU+s>Ue(`_U z7J^mmO4$^zqavupt~6^yAr;22I~BGG`}UF5Me&A-^WVZ4=4}Akxak+jklVclD?eR@ zUPI?$M96H`=jke@ni=~UnU{(xb8*2nMD6&9Dyz{1_RVaM7YQuB zM!QWS8+9Q2HHN2=`8}JqIn{})D{iA8>moi|`9Ag@41=ZfV9ZWJ=}Io@Ptni+ z_LTKIJovYso>-&hd-HmAl3ptLL$ii%lje8O($vqA)9cTq{f*<b^>x+VcWSkCO!943?0}DF3#dgSItC7?;#{cSyG%l z@DalI5HW?@{V8n9QJQSnBB*isrX{RA$KrJ|_yYU-!=l}V+=m{^Z%gA+zx>g7h@97>uhg{ z{FHdC{O~;_Bxa)L=oc|@;sgW@Bv3+ToZ3+1vk_&@8nSvy3evEFz{!bomr>YZI2Jtj z0wxeRkvMZwXAOp&di?ji+zZIHE|*owu--2SFkVCE)U9h5u#qn5p`nN2AF>o76Q?0$ zL?8tXVsUiOW_$mQ}?4|#T2{WEYPYOlUl;)9j8jY|2`a4{?X$o`CV60gBA_ny7K_HF7 zU2F?l>|(O_2p~yZw3LJ}Y}vdH$4;F=@QhawGJXn%1@=Z3T~Ap(zieQ)katyRW)zKUr+wn00IZ;`?Lig-}jB{s-tn@^bnApP2FA&c!ehvP< zR6up;z&r>b$IGQnvR&WBkRu?s^rwG7Pd_hM))nH^k#*R!cP}m^XS1CDj^V+hS)$1mOkE9y;>b?jv*FJKDtD5d>O!~n7qN(CccA-i9bJPm!ys99!U2z zK;r|$0#Dci1|au@AAoWDhhYJZg7pB--;;5?`8M*EHRh z7EujpHM_Fm^Y3tv#(Y2coi^0-oF-|?75B^gx25)d?f#%L-D|lA-(CNQL3^@akd+MuGt1CcDfLwIFsKel48bj`J0dkTT zErwhZK<@k%j1=a|7{+AtbED$kZtSNk)b_mx>3;evxbmJ=G8Dr_oKmP%C zy~bkz*;Z4=4n_6tD@ZuL2W!@@hoyrbrjj8yjDVbdTdE%>pTegrKSu2NtLQ)ON0>Nn z9EOn{(}rv|ZO2B~SlWV0K&aHShY@*rC%#;}1_Q<|#`qaa5X=Slt*q0CjnEi!4qXE= zO{J%{sx``$kAi9ru-I;?tG8&>B13lst$9Pt)R>7Y%Fz@snj_w+%x_icu)WJqKk|3O!Vi zxs-nC1U`P}zffjsi+&RpWAdbNaAM4?YjpEl_1P*UW!=Jv8E;}N-QD_;?Q@5W9wG>| zsZ4wbXwatB1W)#@`wgN_Cm^Y^Hx?~;5tB!cG61=6>20KL3z*Z$kP|@8i!tPSDCU;{ zED!Wr_?Gk^#@A~8#^-H9@aK*aZOOv!uRp*6vfb{uP9&pkCg#i-#rkqs0c&5b{RVSa z{01SD=cA9mC*%5>QTekNx2|8tw)Ly9XU{IU4_&ALxhbOt;dJO{hzvV~y~mQUm}djad^hp&p&E9#=TDRKCQZlQ<5 zBQcn6+9HTBk}(mp6B%Ew9*`S7`)3$4aUMno^;53fbp+LfEr&yrFq61VB#2H!rzv50_NKs_KQAz1hb)iZ1k$cd=KlD7!R`E-L>RW73Ue})60 zM{p&p1kbN{cK=3f{`3EVNsr0!A2~y* z%-f2n1M9?-7j@v{=L3-bFqcZP(GdsW>*0XD1|at^n!b_7W3Ye$$UO!l8@DhlU|7Jg zfMJ2Z-vajlav4`}A~pg(o&i)?9;adviVL$WG-YDl5&-^vbD`$>0tC?2S|)tAi*Dgk z;#nAg-1oJlasIbi;2uEkQX-;bFT&ob8wRs}Yu_^!ZRPh+>UT?dl6EFcjpm{bap#jT za@HFZCcRTvaPFmB!}7|`2` zE>hqXJ7!CE8{~LD7}9#GSWmPoB3hPRQYW} z_KBIP1+p$jP!(_|R(}2&`i*&>0nL|S)L;T~nWq_mTm$4fb{&KnFa8?+dvrr52T_34 zKn;~nT_w(hf29~A2cwD^Gi^4Oz4?j)g<@T_tYNo%Q42{|Bz!=>+G&v+&}aX#^pR)yiY1Q*kk` z7hYv7uW_S;;Al%FT!Mqd^)x`P@H#Rsox&%7`cDFK9nfdO^91C^qhs4zq@OuR;PY#w z=9XjZe8$ro7KC1Yo=pHbf(K+Cnoz~^4wYa-xBi7-0yK&lNw6q-4_UH1zrm>_AG(Ln#PT0cL-L6&jG?#}+x8y9OFw@H6X+t{ zm4LO3$u(6KB&X)!;Q9}+d-GSw?>q^^DVDHw>LA4IB||pu0#0Ri#*coqoXoXR6nmi1 z0#$%7$A#gGzx*$9&0XL!bQTuRn1WtDIv^+ggIJQ|G~MiL7|-x#=2?72QI&m%!!U3H zL1?n~#sm?NOCli07;?gp3z`2*j3yvAlKqA`T{OjAl$qo|0px@s_o)Kp!cN62piN># z+dJ4&psW~nPF@HhyDymR&z}B1Y>;HP)%VLS0dh;JG8^E{{-Z1#$9DY<2ag^@N^Uit zf8&1$$c=!v8)G#R)Dxzk4#=4ZAV(%|?BUN5ac~pvB0dm=llNm-p?xU3};UBb+s=I06CVL_SXQpYmI=M z5kpRDgK<0s7BB$0r{EzOSu`wQSirD=VF8(LYl~1Vh8!7k8Oa3X!VN&qs2tCP1?~al zE)$Sz#*kBsK3Q>b)utA1kD%mgDaXZ)5_KqU%8(-;D_>pbVMCoi!EQj zi%Q$E=tuRv<;&(EGhr_oTZge}dpzSey?{B37n4C|k9;nYY*ewDSevFD4oak0*qan~l}$1Cmz|47tzAkSnD7AD{oIU^3)<8UZ<}iNd6*6|f}_``7;tkyO@A ztmr|8+!BK!_Z`~kg8(@Z-V))eC(V$PVkodjm4`0v1k2CIkhvAgcx^{B(2wE<3zt2Q z%aN;b>g)wXC)W}Hev1I`SOUOS(&`8T6X>Ze#mUgMIJ|2eVl$o4CvXTB%^r@(b$`K? z^gI-I8H?xU%|sBDK&|P9S#~QONsMp!#XG-8wrOW{9zt+>_EhxrCOF-|kdvHgaWAVY z$Qq-<^Ve%v;lR;w1;`0QZcNYs+z>#no*@@9@1HPw(){}Za?v{}B60KpB2S-3uR-I; zR`h4gx(+x=_tEs!bhPv6&G?WnVD$KDWZ(+mu5AW3k0IB{kn@0PWiDd&eTw~zm3j4g zDHgx+zZg1nIJ{Z_o5|F>h0(KCV8M#l(aEY3$#LNb+qMo@Zd^k# z&1!Ai8BR{lu(x-hdvIG=S+}Fe84VpN&3OZ(MulKtukJ8mVDaDx5W0CzHmMT z8m2Jjkr{H*&)^JI1J|xy*Wj`mBr)XL)gm|TEI$6|eVjaV8NEj>!Nds@m5Z6FNo_qK zr`B6429O9MB%azwm(?Bkdc#Hpj(Y*)W{S&dFEV4ukfY1$*A#Vd6owp?T>JOx#sxDO zCH0_&^dthv#gicyMdr!DV)uhesDX3PKQ&lNfS>UlC*x)@|9%Yd9UT6`MZ(Eplvn!(+fyyu6gIvu)|Jnix%n z+;5Oo=coa4^XlF7ejp%sKBp&s{Mxc_0p$KKO6juNx1J%_+0Gn!S7Y(fM<3wamFpM~ zvJ4Z)kHe4wy_LX*s*h}b5?8FYvY6mW7PfuhOK-Cq!?mj9I{=vDs``h~c00Q*25>Y&AtquXxHO`JHimVy%p zk(gG11+V@dLBoUL*Ud%sPr~k(XDrM#5tpbbzm20?-@{RYh$OjU!u*%8VCf22RAi88 zw;mfldJk2$PUzy_A45h?hDTQqICXMDyY}tS-lhZloIA+RxPTpGGVj^9n}FPM#*mwi zu@rU4O^H>2+~5B8KKusHCPQvMrj8p4I~ys7=7KBzlx%`j+`dk+nvGcZ{@bwZJ_$XC z&7@#Uy~=8U5-x~z>sJAzMKa@UI(Nbqth5SrFe9q=2f ztnR>`gGUfN?Ilc_y$pl6(fN@PX=%Zv;6e5xoOJ+KuYzW2Xy z^cjgj#%5ad{9@ReQCafhF|1?^Ibp~-Jp_i_{Qx-?L$1MPwGoh;M3+@p$M(3Lc?s{m z`$wFJzW|SZlQDDVT!b)=TssQ^G3fS6G{lmskmV(L6z8~r&;I(~bUjXim0vIy?Jr>L za6@JF+d2Wgzio^m*Qm1Eniz6Y4n41C7UsxJKZk@9hv=UE39M|L(LZn`k_m{{SvtTq zcnPLX97VwbFSa*v>6EH(Le>_=5g0QvKAPbCH=AK<(GL9rhvHP^L9}yl$0WL$59!~N zLMhIwZdI4%A|vqxzJB*@oV!|$>JCA8{TDA|$k0CMMCM&pRSnOR*oA?&%kPTXKp$7 z+_H1O`OZ0`rrd^@8H>2q&Llu-N0WXDTw}q=$JQ*fn$c?$vG!8}a$C0{cG1HMkefbz z3eEe^5|H~0FEfx!zadjGZrU>3zTy`6dAY%c4?>!0(r(32tzv>(QIJMc-;eRipI;<+ zw}jE4moYl6DavZE0OUBhIKT{(Rd&5`^hpgEfLx#KHbZDb1BM0+4Sf4F(3=3c(`S$1 zcA9LAiW&uHXXlR2xH8x#yAe5hKcXcYF6}S_<4k9aw;QJc(Yw6N0l7|-RdYa&GH@8( zsF5V|OyuYe$Q@HrR=`oVweKP%IKgy?ZiI3_x78}F3d+rWF*QirozF|8xxj4 zi;3eW(D6AM)IsJ%fXuWUd6sWJ5k!?g2}UP z!JLIF=c zvMLNY26Yf0a>K90kbA!yLrx3o(BVVwU;jc;6&)}df3C;M(*oBlsgg2sE-R7Ou??L92ZaT#~c6sYX!)OBYQDf9nq7?DuX(R z&ps7pb>e)2lMiD|bQE049uogsn?8OK`^99na2TF=;>tecvdv9a8D(`YnQ$TW{nb>S zugsF;QZvJ2tGRNnddte1=WMid*lc z?hHWgTC0Z4x2{1QIsrKgvXpv5PzSvYvOdV_V@1GTqUvUxNx-Vt|A@Riy#sfpUDE~_ zb){dB z$~YD6*|7P1^(F(-0&#IiS+Ip!BW!$SoRN7QGJzQxp!VH_dv?efwrQ5$?LayH6VTwV z(6dNusFG>zFwVu&#PpM~Xa6aVnbLnNXv%1&heU#JvwS7yxAiD)a5`bdU{fd4Sg~7< zohky^a&6!;8I1`hjgx2Ow&3_)>c3Nxo-?Txkcs!vjQ1Dd^ZgckKMJPUj z!@_TAlceS1Nl!r2dT`;FrQbm1*w68v0uJD%ZJ$#KtMh^XyRbdYSaX0F3h%LJhmfo- z)JLOj}Oa_EyKb;&We#*eFWTYosO$2jVa!3Tj(Y{X*2 zzK@rI$8;#m0wvS1p~l8f#Mri;RYad|T@WjG+ylS27g$2HucQG2y)h)Midq^1sT0_p zFMg)77}A2Rh@KkFD@M0FlC6)SM+`m|kT0*Tc5hqJo#8{kM+^1K>V}HLX18Df@xrk4 z_sNC7{RD#IUNxNkE`-Fxi@ax6)f;HLKRdmJfbgVkFjTPNT973-*xZP zNp{umU(mRFaUys;A&80Vf9SuEYwuqIYCod}arnKYkL#j6ZlnU#{>RL3>*$_LAVxuz z8>k)b4la5m>o^uk0J1Qv$Ijll@Qs$Z`(`)BwY-t76bMW_YV>M7lEG*X=wcx7G2Ek) zPEbP-+`s9W!-FOKB(FWK`N`fU#kRlgEZ?k_o@_4NkNxKkq+zprpVx+ySW34)RGVGE zW+x()(WMEK;3Xb_cuCMs z6r{*BOKeQ`=p#nscK$}u!znZ~yO_g!Z=QXMVe%#_o;HEWcW9%Bpw%IuHbL7z|-5 zV3B!|YEZ2Ecj#JY|46p9`9@?h#gcJGCpMHP@5X2rgt%padCW@w#WL;BuKyFCNKsQi zbmUIWXo-d&0*lZ;%-nhR79w{KB@-;pG&Wpx4#ViVgTr)WHLiWa3*oGgks1?OE(u## zk5@XIBPwVPT41^(dS^p6L@ z^dks6c(Tx5=WuyhR^ZQt4IJpfEbLQb^x|e~Kw!VXAINgQYr=@mGR1hS?|r;k3Eq>{ zAP80gMILyfsMQ7qgPc~8wGNN^81MsIZ=hgDJ45qFEdTc`GBdI{V1Uxu5sM|3bwp@e zeeM|#jb0Z?YS3-HM-P?VJKF6A#xi#l(6d{EIdl3vFvT1^?a$uFP)=MNc=|@z7lISc z%?3_e2>NW;(6+chgU7!clC!P}XcrkdHi7m@31p$`S8{Xbnm(frMr~U{? z|9wC)FfeReFXqIM(P*To^b^9b(iIl4flY}EW;b!e@aks4cQ_%d9R1fdeHLt4M;$*8 zfxZ(H+VhhX(V!_u{(wF^#Qgivl7d7Suu}_Pe;0v)HZ5_j+CG-8Ul z2wyyvUp7OS-7}-n@PQzv8p&*xJ+#PwYfMBN(?( zo!z|Ra8ZJ>h8+1}H#<%TPc~U)kKN;WHQ$l6x5VS^zZP(1loG?$(OLpJLSRW#$MPAw zp(*Vsa-Rq90KFQcwhi+hWEHj;(06e_w62Kxx4YNBnMn>e2Bh+J(mQ;n?2=R|``c~T z!Np*NnlPH?IsPnC8M4g`Z264LfLGeeI`2Vl3JWKHwL1xsnCx)*fRP)c`4$${gQFg6 z4$n_S2dW4pG)`Q@((1mbbjLaVGW=BtF<9B{*z2d!e_S%Erdw2eM`OCh=aXEofLlB_Ojv9ED-v`NSE2PbULs4L4 z_{|#V*s(LQ{EpIWOAh0X*h!$a!O`{_w%DUTa>CrK`yWVb@?N z#0N4$-|{xL0y0LP=@v_kaE+0G3GpKjKEqwUpsEX-g@py9)u#~CQHsG^#AbWTW?=WY z??zOQ!sEN9qjE^fQ>4j%3FS4#^oJg|ivWJ+xrdLDgb7e%`sV!d{qb1lP~$F#6;zi? z65;k{YTJ9Dhu_lOuBTn+hoWt!wl)!YNr1i}5zjIieoZjOc9bt|PIvu1J8ALcQ@KW; zD8ER(aN;})QI)n%NJzL_zcDnz-S#(MG@X-+rNy<6Jf+RRIe&P*+rjP|#v8g|E-k`8 zGKL>>29%dX6*kd@G)<@Go>!`9RX_!Ti=!43+|cjpz1Zc*@xrTb{Q|0I(TK*v6Lbnj zlHbfo$}Irh+*K<{-TX&pFs42|I+rjEd$M;S0u&Lm)m~0F#T9In!P3)xp|j=*SHgKd zi-|*o^X0`mc4j6j>`bZQL@BXVk94}I7^kKf;DU|LMd9in*;tq%wam&&QC=48+p8xM zg%L>Em_p1!ftYi1(ANc!U=4Ek>^XM5e2d>fV-Ds)^9wJ{Ar3E?lYJ;jpOlHH|4CX7 ziml5n$?1$)CJ4#A{=nBQ2Wkh;a4;?*V~XqFRZxbTDtUaNL>?tD0FqH{f2Nt>40J60 zU3cEtJVs3+R+$WX8VX7@I%IIZ9ZNm(*V7wwK^9kFAwJM3DqB?2nHC3E$82R{5B^E{ z@2-6GLz+F5tPYE%rCBKNwAwZ#hq4i_m~-N<3-8josvq5{tluyP)E3wBGcW6)>{eF} zTN7MQGC)UL-UEz!cMKP8FCrSttEkp+4QG0_xSNewfTd@;UCJVT zrJq+?lpEbY%D3i7^ne;Rb~dwV49F}6taXl@ZJtPAYPi_gJHej{1z~3N7;uW&CusIj zZ(=8AzeWUZZ+>0n|M6dU<*5wdlE!2&pe7JcoPVD%0I{$&c)4*S!I>O(^?8tz&XmcG z;LEYVwK1?E!6$xt#9C90)@CcDsjvO)WycZ?O5%>Rjs z*|0wW+uB?#X;_=h9sUL7X}7Np9w9mWd@u-OT9ews!d*>Nw>>u}@us;kIfKry$-ag#4=}H5$s|&-Po!uPGU~z(Cu26NbfK%C%C+Xlibvn5#*aPMb);Das+KOKHLn zjlmJpaMuXk+W8t_&>JEViOvZM%a8hlwek0nP;^+`F$&FSK6bsn`_*Y$(+xa&C}6WU zHXjsZfB!_n(dtIiSs2-%gL5$z1Y)s*{~nC|h@ zyeNw&tPsNGK+y$0g4#kEQ z+E49pC>W<`^>u$`IFf;oD&b+h>{&dbzNx`DGt%6{3p#V>hx&qM3z6qWRyvCT-k$}% z@SxpDTY@*-3B(DVUPr{-9ZpO}Hv}oZkfE)Y{x|;zev$5!Q2M4* zLzp=cIx|!Z>;+*Y_D|(uNVHBdIygK7U@DT?O=CY7cOMVTKns`z(Ysyi2`8KWKtz>N zdZctT@8J}!S7p_!wv3&;l|X*f;pkCf)ODT5KU(^Qpue!>j=}CyWUxD7Tfmc&K$ko` z6VZ|-0BzIno^c7KIrtR|YyJ!Jr+4k74p*Gh>#XswMo-%1~V4-IFNsH+Ej^mhJEG#DL> zB`dCGsZC~83}`UQCck`{v$@*qSiQgqt2^UVuhYZJs2bz$nwk|pXApxMWd{$V(DR=a>{-*?4-$WPYA8L$^IijET$gMl))O;W4q^$5 z#fIj(+oH`&V_!$iAorDwYDC0*&EnjF4)7BRybr?`%UQ-Ew*3+}kd zlm~;u3e{*dr9{@K)CC^1kE_EKlZUXz!|?sc`47CfeNHE=|Np>?WURPMJ$KEWO(0Hm zaOXJQKpbf8L|m{REjwg+5no2~*sD=`pH|d3=^V5qLegLAuRSgzAJJ zEWVFC%H;nrQcniKxS&_6`K&q<4V-(tae<+7CdEJo2;H)2P*H;Z_S{zlPocI$N|5qId;a0Eb6EdJ3 z(e4I^UB(GsS4kyeYl}xr)hUR+pH;tSJ%ZS=MJmDq{gE6*fHm2;jDl8((7&dmgKN01 zzM&zcu#tPK>+{@l9A<{DrjA%xn%`)4yARIOSrqC423pVXwqjY(kqui3*F!UWOH)Z9 zC<1yyM@lTZGxb5mbg(Sonl{=@FSD_+ac(NRCzYSQxTeO=sjkrLQ=ILulp*hg)PuZ+ zMtH`CM}tGg{s0q*5IFOke>Mm~u}t(ct5IW8ej9^UadowATrlv8i)@{tmY4VE{<)yH z1Kj!3ve^Q+%r?wj(F5WDnp6ZF+pG-5R0N36&M_Rm-GV_2+P%_s&#Yd^6}7n$~1tO!#We;dO3 z^J+C@8|_WBB?wpQe0cHxRB#FnKY0txAYcjGn9-YznH$P`wJxtBw$W3GDA-e;l7nWs zz1e-bQHqsEDPfvANc2vMbCN%HwKRYg<7f>R8{a)#&+_nT|J7EZVr7##e=B*A_-TpP zSDofm8EMWhBS4SNDr&MKt+V=N>U#3>6pVi9>f|KPC*SP+2irc{S%rd{QiN?)Eqygd z7dA&QPI@H<9#fR9!Mt(;hU11>L3KVTk0E|K+pqm!C+(#l>8UR7DwKw8#KYsfi8%y> z8vVP<(;<#|@sG^=Ds_cla5654u$je7d*upxH&IQl3|w;=4ZW(LkGtqEEUfW}!WAo= ztnrjbzgk=ViPMo5j*4dGCxXyVS*XRD`W#?-Xh(TXMX+&ttd=7#b4w{^H+-hh_MWy5 zj=TOpzg8CwGDd}~^ZkLpmO3nrHKmKHLOLvxQql5?iqbBLFzc4en?WyK9!33X(XD9P z=^Ur6TFGE$$8q`i_$~;cp@P}HbSuUF9>+#eo(l{bJyZQ*qI-^R{M6amoNz?|{wpbK@rhkd^u1Uceqg}h*B zyAG4Fox&B@w$}VcN=$5QHpj&B(-AQ7{{3ruJjk~uT@wG!M_bw^XCDRw&&b4@Uz!Sw zcJiSeF?0~NFs%hP z&lk55l!qW7ZSMETGo;+d!>)II*oc{ zc9Ng7<5F9yaG6vxiLW^+YxN0UR8I(}6MwrCE|rOS{sc8-EM6fDgGZv?gjU3)r1fO0 zmU6mSa!;Y^{e!wK>94<_(oMl`%P$OO4=|ZS7Wl*}bO$HfKrVOO@3Q*ge=mUB2oOsG zWmNr>1qkre%8^Fu2_BWJ5tx2BXO{PtLv&wgE;`wM(qi3>xBfk4l0rQbagDa1`IUwD zW-|SxWiL)d9L}juQv%;Em$6OjQwon{B`BQ)PRwztb;OFR;Gb5HkxClJRCE**Eap#= z6uV3*=^~qSxujj_Pg~&XeM})N>y{)t*97~eeb%^qmpFLqX<4=NNp!?;y_OsP+H;?` zr^Y8>dBn?0e?egC9U5BCcr)@wQq8BaB+6|A!~nIf;OXFb!~NDMqJbJ9oD8pOJuqAl z`-H!XyIioT##ayF`gs0P@a~TRC|+xO>0zOIvH-8$&E)y?nDPJ3-T=6sT?5pCnU+1T zo2)DlDh}Bt(#MQ_*5QMOea4!j>lvBL)feF$K0Yjm1uk}%G4&sVvlo+Wh@>}lI%7;- zzFhglf)HPLt(dbn@)d6O+tE&a&qzTvrioD!W)VQe5<21CY_XnEGTPu-SquZU=+4L$aHq=xE8y zgtG*bvr`eP_bm~^<7Kc5XRWJ$3!0?&2F363cA;@PRd1%RsHx5vxj0J(VpInv#pO@f{`P-I|yQVzseX;^77B%Aw$5ZQ5T8 zk87Q-2++Kt25;9d`s)XzXQ$UA(Oj6pR*qUyy!~y+9Q}S+mh4ty&XLHV#$FJOCer

7Dz{#PJ;<5&e?itF5y7pl41*OIcy z`OK*mO6bxJWs1l2;!Tv*-IVK>Eui7-MSj5M%IXPwZ!dJq#%$NeqGuO zxx8dDbp*{~87t_N8anZulpTAW2|+>@50Y>^g{#%8rHb|7i&&%&6#8kh6G(X~@ZHfD zQmsr&?X~Bz7Np0F(yF~B@C+4S6IcMnU~QF9A<+NIdK)I7gR7AhkPYC{?#nOYfQ7}5 zpai1{IwoaLxG>SS5vUE6zhFyZ_b`AbX0Jz8IhM$0J~3hr$>Jm+SDAq8s9W90tgOGO zUcI01-4&Y4N)F3rMwcp$ElB)C=1BHJ#r_^KL z!)ZwEN~&4%LN#QJ%&@p6#>92&?hh6^I(iJT)^q#hNuieRm!;hC#p-vWYq=D?6yNFm zC&TlWI|+^~nGzYwp$u822NvarNrlR0j83;K0ANX;ZVJA#!hg=ktrGlNwOp9Z95?0~ zu2B{@g;ql1?b6ZBNIBCyeJ-d`4$bK$))D7Ef~~dqd7ixJ_S85rcIsUrEmSp#H9k9k zYUoktl%~~#NVmS8W?gH&aUPm~S@}-FsX=C1EhTVxm3Ld9Nw-6aaHJ<75t5Ij4ZbNc|KV7eEB>@b zF1z%w0Lb`iO4*_t{(nLx#5@lW7@D>J&nq-9xY0g~Nzkh{TzOg!fjY z>2-57pZ;F6{ehU87L+tal+n5|PoIR$J`9|>dd2&OqA%)(Q%Ey_Kt6~ z>)i=Z3LnF97LeV+Pep)_YePdrl6h=yEA1&78e&A_14ST>C-^( zfG5Obq;VKRyCc{UJf2i=sjYhGctwRAwn5VM39ja(3~J*>&IOy?;-a&TCaun_v6D<; z>C$XQZzfyJN$C{dC1)+Ixaq`=Id^Rus?|S*-FMfV3k|YrobINXrH#^@$Fb%auj~Y8 zp9{?x_l+BKu3E_)>Q!^Al$&AIi$3ydMV&QvAv;vUrfN@Pv0a5|1CM;O%22 zKMe06m1O~)qY_aDL+i$_w8034lH3e5MwJ|I2lF~?&JSGQ3Xg%0kC{MY?ej*?diabQ z$#hpZ+-mrS+nt*{x!NBEhDFSOUw+r>`kMC8XUHaA{BdwjDV@wOU8?ysb(Ez)yl~Da z?dbCPvM~MVC^_e;EnV8B|GW4^{iBijq|JV*(;VA74A8YTve+y+cC*g40&%9>zh}(J zAU_b((6{^7)YP0rTT#W}@5T&tYqJROZ`T8Je?6si$$KnUH5;!Ts?HH?W**u56{hm=y@a_V(8G0YXzmt z;tG>nwH^@9{AVyx@KNve#>C?^YPHtHPIx*%d8Ph{rfM4{Y@thQLf?tbY+#7UO9MNt z63o%!3)52Niy*#Ofyn28<@5BoOO&Co^6tJ?(9-~P`}s`j^*RC}QFAxMB9`3sv%iUm zw-=Cr6Tt7;qCb6lFEMWEm;GbL^ARX+{}ZvEG!E^#+7-fDxifM?43EKWO@-&_02T1H zH9uk&*B1Y;!{(_#AtVQD0b_56$Q z1^k^*FAK;XonCinz0uTuuMhZjas4Zc(~-f6LWAGQgnn;r8Hn@o;mM)*s&kCunH3N< z^T0TQoh>a^D=jH0%CsKA2OP-Yav;5oHebB)*1(xf``*Bc{RRuCtpRG`C_7T0HpDtl z>1D4Ao*;KMDk)|ut$%cu_32Ramqm+Qyrz2__X`46_~{6v;nV#m7cC+4t4;LTfCI3NB4Vok=8Y_4(rJdVSc$ zK;y+^KBeiSl|m<=8N-*2QdZYc4f=8_=rJGEEIMJIf7z1$ygKC%W~Q=xx8wP~``|Cw zSOEPB6+5iaN;O!^vwQVu%Zo0ldP|)-kXGbT?fyoJ$iQWIUlF(ac}T~=Jn-LIBKds0 zt<~SG84SyCW0XjSgd z^y**l++!~pVe4QIcs;g!JlW<%TPtB36--v!4Va~LMuj7UV3Q|uqf?TFdt(wY2Xe9k zB+NWlBhh@tzURQ#h;!1`b8jkrH5C<9C=Bl=Y@lRCrKQBV@%K-+gP{oIckMV2bn}N# zUJ+6RW2r&|T+picU?PdB9H{KR>A8s>+`6zq^CArLJunm$^uT*hvkpDMf*>SJeyC+tvss*foTK9mAC;1>^?qL&}3HGWwmahKS9 zM>WerhaLI;*roo|pbnsrV{m{^k6r3fcyw6=$S&`cjbMpj{2vvEUFl!rr(HiDs(lM` zgrYo9R*ovF5w>}U)q+Dkyk4RA`7Yi{OlCoFRkdNiPXXNSjD44xx;uD{;EnFO?MYuE z0_T?)Xr=e7t3klyL6GE1JF>UC9^MDE;BG+5H&o4&4}SEz@5SensGyX7w1N9(*!q!d zV0C-FX}ej#Q3rM6f%*OdhMwT&h*TL|ZeX_8m)$`8mH4?2?ep*&PJ&AzgZxi$>U2jhWl?z{KZqsFM^L)eng9uCv;4 za_i(qnsW3jEChXkI+4r^jR41n#bH6rCls`*WH_?HBPb0td#6CDtBfa52aLjhq@++0 z$*VZr!_zBxx+-gH)k-Q0#bZYrj3-eDPLGd^{g@p4WPWIz(?D&w(#V|0r65k8Sh!wG zdM^pG{!pLG_~qoN+3{P7wN_Qoh#MP|R^fD=$=SgIx0h=+a>@VhP9Ev}@3R0~w}n54 zgB2mR;PhLACz@N8k=IH8I2<_TRK}7PGHz@z#zle3sG~v!D=q9H9Wr3e$7 zRl8TR0&q<;i_8kK0F_$;)M9#n!|*lkQZ(Bj>;c~#&{}>IJ7b2!{ZFfNxzKm)r)|rm zvD}hBKxAH1+tDiJnZ|5S5#V+17(K5>Phw3@(3KHsKS2Tv&w6w_M9N= zy9U(pz0*h6kNwvQQd6SiN|Z9SUQJQrQa1E9kN)w^QS5Lk8^da^hdg^2%`hJc0J(t~sQb>x(|%<&!< z*_V{IZbUd=iV4gJY--f%#>*CTF_M!hEd^}*s;i(9ljKMqpXC77y6r+O7L8R5gtMM7 zp{wkdo{>Owc&uLi*^U;_c%z72NdBhfgwiAj(TArOynYrlRz-su@^p7h$7KnfO8H`CC1WTjyC1sN_Ha205GySutM}yUlD;sV&qgnZ&i> zjn$_=dlB9CF zHt>p=#;p7DOk3W|BE29gu?053m*zx|gIhGghs?T2kz@aTrzM9Piq9bGM%VK}W z05wYPEV|7pT?D)&iS_<7-hFniyZwk`2A~vA81k6Y;+fynB#S>Pa=Z62m z7JMuEA#JJu-DWzaaQgv(80P= zj!?svPXv%01PA3^CAIJkfK1{K&~>dit5Dq{hmm(Xuo&i!7Ms&j!ESfrmb zYUTtjHEVd^vi&=ZOC3!3!a)S_ya+IxIuwoLQZNK zee;U-EfPT-s&NiO#IOJ%6ebBFNkKe#a;t%M7;_36yOBXTzQE4gZv6aj0F`7$+7U1C zi~YgO#zIWNKHgxcxTJ(iUKWHc?6%DU#2ExD0<#*(T4%}8#-v896p z_N)M#++qSwNkQMY>HCdu6>HeEbYa(ZH~GOB$age@yXLpLvl*>~`TTn9`-8Pe7Auz4 zn>HU|=z@1W&C&FQJkf&v^C1iE^ZA#bz|$7$GdsiXVNXAc(;L2@c$C;m0P>yrud_3p zMMb5&j)s3xTk~3@DLdb`4-Nv~yJv-TYpX&l-R7r`TZT6mL%kHsN#mlkZY&0TEv_)y$N;9s-WdaIzb$7~ zGkoe9uPPlWC(K9(ir!kPLa?iInthL&+SLTn-W`ojmy^pl!PH{`AP4XASy+wE z{~(=?i@{fu|8-H_%AnntamW-xZ12hdAM)s_ z`RG}x^)^@6-6~+s_eyBp!M{#MYO>#WHL`WTL$GCJ@1 zXhzv1D6HapTtr7gWW-!Nr5*fgoe_!aWxpD$K-LrKYx{g+e%+-1!5*bg9(2Bd=8i1k32QpkFt*#CkHa(2JT)W=B{%;6#E3gQu{N>a{KmS&OwG4JjKR7)~)9ALIlJ*nd4%O$LG<6F+%SoM&o+Lny+4{u`@oZy#o9>!=Zb zS5In0(>67xMMei5_>&SUcEX2P?03n@R$K0(y0S81wr!Np&dMyr=*xV4g-en7N`EY> z^JDbrn79AWxHQO0pyjikr2cr)UexsR8t15w z2$T;4RkpmL9f|NQ;<6D^eWx*|2kmI8_g%Cfpjn>jX+9WSh(+)Mn5zOJKY*g}&?6!6 zdq4*vAO^SlK{PN+>)jX8s&?COzlF&SZvsSLZw6flN~*C=W$}i%f8Md-v!}%qs}VFD zUgpuaD1sn9@|*LaPv!814sN2?Uf%@8OyLHtKpM0ew2 z6?40i)*n%UI2B5)_-aDgmdQeXN!~>tY&jWa^G63X{8?ge?o$QQeXeaR2b>P&p69In zy(@5ZH3T=0dG>p*`9hZcEO{Ygndn$lgM<}|0@T+0j7MIjRJKo9G5Y6md z>`}43mzyqG0m8jw&CmZ|9VlM|0l?gj@98U1Rum1!xX9?`5L`j@9<=BV74aH$a+_6a+e=?!IEDP`0E?&J z%*Wf}l0#jv#bNPzp?dhDmTu1UG_`EIczDOxHfJeuA6fzXSUo)DFduXz0dI{f=`_aa z|GNG>HFJS&4_6?E17X>MDxWVwTql8=;(9da?_+Ixn>i{fZNO;U3!a)eazFFKE7c>eI4hPCojNoMJwAL&5sVv4{i=zmE zq%waZ9qAKzTXD5oM)%j&rQ2RZ2?63%{~q0~yA`5S1MnHr(!LFVI{1+Mu;v4A$WPCP zCChq#K|Z>THrL=|1a8ff1)I*NKP(Ij*w$6tCh1Z^KuNASeY{dwHJv=?W8C#_Z~GDP z=oij*XAZ$3`C4)uFtr*#Y*bWGEjloJhrVTbZT~uRseKTg~%WMnn{3CW$aGqYnk*#OS7w|4qY z%FqoCA6h?c?m%~(zVO#+j`Wo9h6;;c9!g2@s9_*Q2)}UZ7_E(Pv$Xfo5ktN~i5UsJ zfV{f9G4BSNfK7I&%cqxUc`u&+xOb4>&g8;Fc4Xa37y4dE z&%cd#1=Zv}YwOHf?AE0Goi)u7<6rHjd1TqHJ>RWOQmgTe|4g{~W1Mz+D?uC>fmiGP~6i`=T30of4&0|(XhbdkVvL>E`RM;yv=g;LiuH31GoEw6OaqvP(i4@xWwRn zPsP|G4A)d>Za0ayh^Vdgm-mW`Eh3_P_?_yeAYFxUsEd z;PQa=^74vHOOwDiTP~Td`9)M%s`oEov(9MW2^Jd%M2%c)S*d!O#k9P#uiv|~&iYcd zYNriZv=|k)+f0AIzx12X?ds!Y{?h?`L>w-^z3Ln-=k_>wy)7;)h!wvpylt@5o~c{n zxY^}7R7n8rB>EB}^4+E3vEjb(6tB>?Qxx)_y@0SNAzew%fGK`YKiQ>6)nd6doDp{uY z{NlN>lkcrn=sIcuu;Nhj!v&{@johlsnS*8==BgM&O+6KYJ@z-c_&-~JwWU8IqcnX* z_lEOgb0TXJyfZT013!CTnUG_Wb$Gyru!+k#08OUoZ!d_tmS(-V!s)QxH_R2=wV;X% z&1sZm^yYcWLPdN)R=l3(Xwdp4HV07Ttq*vjfdQkF1V_Jt{)ev56VG?Ela6WsvHLUg ziSd|I%3w&O`sF>F92Cq1s)^^neN6;`` zSWX*U?L-9ReZl20qWpaL?3`VceRh(B(*Ax9byGE)emt^?6Ri_|x|7E`9N zhrr>FndN`qITdnNZv>gSeoY$E2?Ppm{p|K*RtW<}7orL%V= z5TaqrA)T3x=MTyJ29}g4lm0+Tg58$W$KCkEeozSSRGtS#@@*3!uNIx>$rczI*14!p~JM1(5DkwBrT2(G+r~*pG zkl|>}gDhsfhQwloJ0zbSczAQ%zc3q}CY54!jH7#N4s?jTD)_52s#z!ja5=p z*3_j(CHyHs$$QsT!;hO3f3@vglv;Dd=&c|CF>NhMmYiyA?pM$bSe6$9mrWV{r#9if zL&Krk?0fl}+E*n($hP4Rm7|8O9D?x}Wn$PA<@F&{_clPS;ij0Ho=YN#&dD`7_eas1 zb&{IZOqxJf?-cX!v&c zHCT?wp-RdBFAM2Q25`wl`S$|8fC4H{ABh7J)fC z|8}wN%V@sb-}J>G8kH6``_ao-+O&^~_{(W+HKA@zDzB}h5Y#0_$>IJ0Rv4mI@b`{n zO3MfPgkA?sP7Pv_%LLkEXlnyy-Una0P#dcB#7|n@ef;x4-$$p%(oy20a@z1c#E@v5 z$d|^PDl^sRcj>>H{*39&c@cq|ol;$aqdO$XyJt2)Yjl7LU#xO*$0T6G0o)D=_?rP6 zQHucl5HO`iat$I5{|{oQsRC{fznS*awv{s@A7Y!rse^<83Tj4wF&B{m}CWaBK$bhq5HZI3DOZk#k{ zpQKKgkyh5!8kCH$R%-|6lCqj$I+ z9G1Tp{u?UM0LcF3e!-NNF-o|XHOSbqN`3=NE*}KK{?NP#2`+DdrdB|`p~+s4Ctknb z_tzdE)p-9=f@=Pm`cOiE;&H6%-C44*_%Lkw+tteAd7l0)T>`wGN*GwvA-)u#av8l+ z3|S~HV#TG(^-Ag5h9`{#`g3v&nJAP!_gKe=`Qw#NMNBQuc2Y7hb+l}pOzqLhy;1pB z`7LPO(7?)0XO6SUBfi4u5!%UGo(>px*^LY%KWowT)eNPZ0&1CJesXS7xepV0jGr@2 z3lv5pwn*XB8FSfHa(K{5htI+|?a3Ix84oB&mU{ueSG9k$F18w*pV)W3%wVrI(*r-= zyyBJ2q=lZ9#pC*E$6BX0{0s`82Q^^%ZTXh9@nvd{bcX-;3e(`zkX-Hf$*oom1AMIv zp5vfl5je6T?ZoLBU`NuAk|XX~mc$j9V3aQh=2zS8NTC>#T}4aa%&9wps4x6M{)Atz zdf_#AX|>dG)AjTxRTf#6jxtsz#x<5enHi$I7Rn1|mx)RF)B2bn4zdA9DDr5)M||5& zP|+(jZ9kp8{bBlp^Rs})cd67zkyhgh0W@xr)u8Kz^*;^g-%Cbe-T!aCl42!jZSVda z=ST=6a|7uvTxQcE^F^HdENqQ(90_s+@M!jaPj0^M{CMIa)OaNkgh2Gu!wDoBdFb-y ze(Rv>SBUdTWt)7MI{z8(dn}>1D6IC5KjN`X>6Ox5r%C%g;r`W_b&(K@{&XNS-n^6` zNSC%@ozu&#bNf+rsZPSY`Z%4Ud=!@oKUVxtuVEwbptmRuaPVYR{kG3X|GbJ_ExMLjf~H z_C6MIWl%{0EhQ1v97Nw>nctFeQ_`G4z$AWkxL=&%$SzH-R19*L=-w#i#EM>P8q9Sf zjnIhlu^}O1zwXA}wLHatNo+b8ZcfNFfm8<-uQJvcA5#B?3b+ph8RWpv%)C&C7km=S z_@yWtZgsYIHpSLb@ucV?B}E*hLq*WiB$@U%MwZS3nKsi-UoE1GDXn zY+NR~-Vj$)mGm^;G^7w|hZ3}%tOvpAE;{S)JuMBD{+}g#8TX2Wq z6n7~_f)^`=;_eg=?(P-}#T^R8i@RI!;_eiRTXDPTIp>@Ehsg~2v1e!PcdzxVN3^=( zqI;Oz%sVo;$z_hFjnPJod%|n?b&#(=8z4Z$}rA&StvqIV_m5)ZWw6;o;Q|nsqX4CR}AH-<(<-)V}q$Z4^2KGwO z3>$3d2@Oq?8a%j=k+UaQk9vRvwpTaXWY8I^Z<)*=4&Y%jkNZ-}DYYGc`_p5H490;P zh>RNLavazpA+D4Wb7Y87AM9cXQ5dGMvoywQ@E>l4UQ4YdEsAufn60JY6wNN1A*|F7 zmyZLngi^g6hlM419VX~ZN_Z*4F0J;rwX3HDdWOga3VKFhOriO!y@kJSuuo$R zroN|&|KQ=yS-tRz|B^QDh-@Vs3g*T+9b*+gbXg|N)yX-noHUuv{!ojZX0*(IPgy+9 z$7!<}+@2KYYFyXAPcRa%legoq;++>>vJ4pGnaZa`cZX(N*;N?kG=x3tiA&nCBU zL-bh+b70bzO~tw-hI;UOwS9B&Jt>AiQ1u#?om!2^YI9^B97;>CC|f_87hD@@z0u;& zBycE11V@=e?HOqH0c3G)IS<*$P_O1M6a8}%Tye-=g;}m};S>*|B3@49^A&mtU%gqS zm2`tFVu;Pgpz@1)HgFAa(#qGdc6wEPY{h!#{ph1j%(v2(8pT4T6hu--SK37snt`{+}0suZG54 zPtO3Np}!=b0eR^8d61KbvxK4n=|l;IobI8HxfM}&bYOOQ6Q`d_7#+PGE=a0xQy$+Q z&6u`=*biSN4U5nmkBHb@ZQhlD@LNG`L3k>f20+@S$j0mSyayE%-K6aq?FU+4c;#;S zH_M#4zbl?%zX^2ND7SV2a5xW%6)cl-M1@>?#6>T{q0p zPkSSj=47Sk`D}o{a`N1mGH?(Y4h$|S)hJ_2fBXQpcY#tDZ$EVt@I%tNE*sGB;)1F{qUdMhftn-7JCH#9FZ&v#QP{{S?w2u?2TTdipxi5?; zdD_ZiVt}A1M<_D%?!8cIie$GL6*3lSJlBnj@gJ_cNBp~MclBebh8F{$b3^VhUHsCn zP8=vHW4YGxE(dWadl@`9_;;@IA=0kwAlu**VFHb}MiGotEbgn{zB@3*e%?~ymtrk@ znaCcw(Lej#)M{3Ak zd;Z1AoOMN$C1%pG1&zSqnVj=9f6tS!tT!B3T`8fq&ai87HPG<0s0fw)1ZlwF30HDP zBlG4}m0n}Pz&zq@x{~JeFvOPI7wUH4b;UWId6{W$W*bouOhG?r-uPPqPp{DoxoMtMO+|2;|8-;pNRU9k*3VQ z1ybnHga162$5Ccz1DZ?OnSLd?V>))c;C-Fk?_KtwJ?*%KS4zmnJ^AA&(Vt)}2&74>E1qh23Y<cc0_G(`eVm>&pa^MN@LwdDwZoL_yiCn(26;KE z)dToi*syJm5oTYmQwU|QsR%Ax*w?HuWMB!>QH(bU!=JFr!{zxvemLvqjySF zw^v*EGze2?d_;{^ao6XVkfdal%(;?ENhGceqsHVl6b?$G0I9Y=GG}>*Al^5jWrf96 z={*Ke={kZLM+7wc6jU-U0>p3`le-@m5alM;rN&-s+cJhbH*Qk$g@DjQS&U}S2(C}H zSYKG9(PVSv_?73v49rX{Fi@;Kg26ykYEde>7AmYLR4YmZ0aTZ2z?)PRK%{8=j$A^1 zd+mo&MfdpcaflTs(D=HB2u}ExpFw@x-ujpi_c5h8(xcx+P>UNe&NJMDyMHSbWxbE_ z4F*_zx3I3LqF0Alo^a$iU7<@DzoKH2P{c(70H~$_OD#_mhi- z1P6GU79VC2>#v>7cV)dU{^Pn|Bju-_eZ@*5I96gkXY!}}2_t4~MwC~RXsol@5H7@p zLC8>5;$4i(9os~fQt$T|9pAi<`HS@kt)m6NybQ;@u^s>k_ZN!b;K%ZYh$Oi=^I>mR z#af6D3n5biW%s~eMP?``$c21?LJ=8I>mrpGxYX#%q?R2gB^Te@!>fG{Ay>$ofc0$0 zPw`3Ffm!VEEvqm>3hLpne7YT}v-$2OT*%QHrK!Bt|7}m++vah?fkmvRI^K{)=4Z2y zD@(}^GEk_F_i!!6Vv{1MdZ08!5lKjV1GXXW+-cfK3`VxQhU=>aX2s%!k(Jv2)>2Ez zP^Pdmb(NoIRMx~Fhi_pD12P3>-9dQMQ!)-UGO0D~B{za9auXvBQx&7&5 zLE87TJFd}UC_O=jv7-916)ti=cV@)#Wcsj0-4y&D+w(PB}Vd*G^Sjq zdIT{OxtmP(j)l{NIHCc;r8pxCpt@-dWT~hPDffdtW%CoA-WATYDUp&H@no#S1B^qZ zRgUD@+3x8X>Lg;(NCkDvX*Ql{e~RItQqKKi5v*6w-;;}Nwh=sa$zGQGn@AgZTj#e| z;hFE@i~25@X|Kw|8SBkVEz1HK?}we4>(9d)^l)kWo|X)G`fDeEUG-Fkz#UxS10uE@ zaeNpjV)(Go6k5zOtU6>PTea3{h7wQpuF6%&dQlrQE=zvTnDvr_p6=QS;fuBZ5xy9n zS@C-G;-U=+8F%P089ATEZ<=cj+Lwpvv&3)T6h6uZiXtda7&`q$@1uD*aH+L)N`1n3 z3;lqG$iA{DYr166WOi>5vvnjxQ`?~s6pWVpiXVmMpgW{3KKf|A!#MIqCY z$_x`rM@(l*8aVi!3&-Y?#GLp@@z2N5pRqTV zJVY3r+ZteWQYq8mcbK>D?`f1jnf(&~MY*rSNW)^n{@h2$`|?awqvt* zVR2Cpm*1Nr9OqQ^9AY_$V4X3zluEh=vjw-PpHIEgCxy(Ag3bPv|B4ILFXx%r3m$q! z5E#v(^&ld$cavYfWw|-gjydtcHvXfH;MF7+eqkopyS9XV{cS*~-H{z{$HT;^R}x_> z$NXEkDd^aGQLpK3Kt=@iKw)b!S(U?jq(L)GIlFIsOk)51DbL`YjwgyBugC+D-3npE zB|5hkPH(7}OMXi~oCQ*7)*hLOC#7_$WR^_jUh7RmxY$WgjQpRj3EIPmJGO zch~bhh2+7Jih_xadgKdP%%kaJhQHuowy?s3z17Y87PS>q(1SvzqeYs1AO_oeWx+sZ z%PjhKs^B9+vNJzfM3@F{EkeI!_-!WbyWu17UpS~+TE$o3?Hf4Z>B2v*u`iotS2gzI zijgbi2_Z~}P8;}>rZ2U6LY&WNqLlf$E#r&zFMhN2LipWe2~#^}xMZL~;w9S?K88x> z5!tO>_(Njx{=r9v;n2@};0S5K>;O?Hue9~hND#Y;Ind}-mJ<ihBuW66?j?p6 zf!CPVy!-}RO#Nch?AC-$@SMs4`v)^rf@gH;=bnN7ShaNdHw@YMqKZB_U{+#MCHsn6 ziU%OwD#?kF0WIwJXX~1q!PW0LPIThrTds^7`biNO!;cpa8vzNkvsdN_x^#S|6iBl% zB!D=7v7Dbxb|69>L8gRLxyu9d#x`tTqK&BU9_tY%0N_u%QdvV;9?j|p)`=2}o?b7w z(cBr!Rf4>qk$M#+|G6cY%64H89wn6f86cX+KCR* zTh6g_yZ?;hb9q8h?>t-j3L3CKTeJwt%uhz`SS4ml-agd9JbEu`WX~25wl6BzWe{&u%`x=&M8G3Ixq1`kKQm{7kqGzTp@_w{UT_enDn z0AS?L{&%QY00H?zPf09sFK_ zVMI-n3X(XTA63?@ZWx{sG|aA?7Be{Ty>%VDb*w@*$Al_cK@S46(kkL((hI9D5@?70 zuH){t;9+J*G;oqWbh<~1HMTpMi)}uv+xV)R@k6;<652>1pd!kRcqt!2V=G_0_D4Ch zr@wmK&Is@fMx2Dw63fflT0tLbE5rh>I3qVYFl;J&w0#%)nxCnHZPrzOaHzOR`sEnzM7a zDq*Qp494`dOk)F|f+Z1qA6Rj}LeWFLGz~K1`VFY*fDTOCI23(ZtX}*UZ-&L4_!!7f;-9$^#`3wR%+MOcf9+=zW=?-#y5)x|Dff!Wmg(2+ zNqL5=(6%{=owo0A1iL%@{8BE%J#M*Sa82fZ8fW$~;tUoTitI)*&RlMe0OL+v>@y5$ zQ7$})EZ@Qliz9%ykZG)Rzf?Uj+A>miIt$HwBcDivYvGTrB_k4k!(Hdt6A1)3>5~3C}K8OW3Fp)y}8_9X6e8L5)v~(xZA3eqO)|PWnvA!7yYt zSJnh^J*4O@ATqsK4NDVq<5@toTI444#-O&_Ev6g_G9a&c328!unTIpeX4uUT3mL&& zT8`>jU-{u$SdRvqr(t_R7>}kf7n9|``|I<{g}`83PsCMnU#Oo>c$RB{9oe-9W%tZR zHU4tJh~Ud#b}Uzv-A^PI*WG~eh}Gsyz<-u!=KE0O`7D>Ro?zEI$0-n31^S~vmsFlD zhWij@cXq-nx=ZS6p9BLu^MuL(Lxz>%7)OwmIFEmLoa8H9h5-+1@SPgI(}(W*;*3wn z22w7cY8SALoQ9s-sQM{!a3NPI#q4r1oinV&e`O~d5kA=E4Q3n!G$dhn736iA1 zE}wlv@x8X;phA|=PYlP7X8|^YU@nWE4`bQyv4X@9j=yhhZ~`DP;(;mtbU&XOQGVL> znBI9!Cy*5uH-Zft=LxoVUsQj3UFSOSj3ah#sn=XasBXR1-BQ8nSlDEo(+P)|6A;AG z>}9Fj=%jpW9YLqGEN=S(a=RUSc@?j#JJ?t{$gZz@S2x4EHe=%LBcgHZ`lBj~tzk^q zL_*>X5&;^maL8uo9zF_NUrbKvda?b_p-&uPoPD3jCrey7PpGQD)nJqMyZSK1qX z!<)`))kTj@+}dh^O`MmVSAuaK?wL4@p_=Tj!JLz`tq^-yVgfhtxzQJ(DD4wp6u457 zoR%98;B5>(?klKa+FeTsfTf7#^hXcn^tnt1U`zfO_=XX2K6v|rm%emueU%d?em7Gc zMS4m*)k@0B*tTtLC_o)G=6ioEMzQn=@P8>cG9LUojt9K_%%;bqwI~4GouC@@=(DK9UN%iBszvGy$H z|5x=DvB`9r%Wn(W_XVRXE^22RmuQ!XvA7D3$ZSxaO8IkvPBY@l`V0JoL7A-nB|`hd z^=s&G5}wS}IpYXtZqMY#o%mwI85~u>1JshsH8>RZ1r=68@x zHnCj|srZxS*S%kmq&)0>)#L6S1L{c5=G#qHc*Q{m)zl02pb!0gSwSEERDbf0@)e2Y z93;mxE>IckYyi7)!iYzGosjcMFW zoKWjO?>t?2)SL(gB&d5`$fwn+&;nnBAdzMOygy80zxs!kDzW(@-B(^bUPyiV$JpzB zB2>SY1oW5jlXHo^MfDNCBL*%tnk>Bd+WFsmT+Gf-nk^S06{=ZA^7X8)==t_4;HDl< zD;5x5ajf4>Y;4YZa-$f$@O3_Y=QOKuEVQnoB*I^Dq-k0uhL1Wre^~HWtlyaq#k>NT zLMC<t}{=CxIPwj+5^lGiCop#Z1?a}7m{kH3Ks*{jSwg?L$tj}=jH3uo9SXzP}(`fqTu=JO3)efs#FwHV>5!R7&`857s@v& z-(yX7+`To#6$hhjZ4)0Zx*vN!$_ZsT6LoH(X}6y00KPyh6{Y6PIP7f>=ak@EOfpQPW{9nG*T7g5=}$0&pT^Gq~EA+3Nb9;$q?uk%O;?K7)fj#R6+OomyIarQ z`jjWlMCj63?SJpq|3<-e7DMj*x$DJ|`7{M=*evv;tz&Z# z#T4{$H|{n3%3d8esg=~o=cGImg9vn5fC~;_2wknT?q~NV>U!>-N#l1bfWVtN?SCo< zfK*_S;MoHI>hjhg3b#d#Z`Y7_FAo3=vbL>~a$Z-^9}$alv6|TWI;Ll_F#2nY5c@Td z<__aVtg|yRIybh6#id5NU|uCx01M3-P~hdUC=3JU$%M(H7`a#w%T zNL0@^7b9R!$M~IdAg1efe;Y<-GVSwoes6@@BKR_wRw050D`A&$`*1cq+_n&rA2=;N z;}6&%mBFwJAQNM`W7ieO*O?UKiwySdGcFlg;>Vp7>))-~9;Cg&4Y@{vu|dX2C=o#I z2RCCH<%I#v+_4y3NZ9g#%6B;IhQ7!8N)yf1jq z3a>OWVE(f4vM&fRS_%4PF}X7^egrsC4^v<13Nt`q{dN4FwE8*V)ewPSNm5^fYgxK) zVeSURj6P++4$sJuyB3uD^hEr_mKbzu3xbXlfH-9NcTZ=j$BgI&fm&>U{H9TieEBhj z+}PP!QoLs!U(^w|2evt7z_~P1GUTdXbBc!rcGSa4elKH}QYXX|_T- zg)o#aY2XZ~6uB?&V&!Bfq#v>bP6f9dWz z;gzgpVz=O7p2GK_L951Ohpa#5-qK5rh$E7^P739graF)0n;Uy%T$H4>HZ#m3L7A!t zXcGBVKJ)jIj}yZy9{6bc=WhnI!}EL2X4DqCm7gb-)LYHC;B2v;g0%)|BvbLbC^%cb zU5dyyROeLE?+Mm3ZxS+thUjUeKG{X0F21=N>N=8vR_fF2rI@}fWkP(8s6!!z;rhft zV(M^QHD%k9jdxPeDf8kd=0U3DG-3EG1yZZyUpdEBv zc(%2Z`$Ssns3LP5JAPM&3%+OqfG5#_Ol06^Jn+hS_L*M^6Ofq5lwzp~okh#-nJgMZ z=8^H1t%{I1zqJufSvk(Sf*5O{3|#O2&?~6Thi>Hn=?2)=xIfbZA5$d=^ z_W|SQ5u47*WmrENM-bEJ`0#K-%5x8U)Qsng>!2JM$b^ z!e}b_p;;L3h*@^%clk!j%(OSQe#t0Mdbk0m#6O9VS-LKj}{Hq11=IYBBp%BES2$8YxC zw}-^(fcyKjyVIYgPO&Mw^*@0eXhQ$CmeA#eW|cHSQdD8BH>?BirrC53rQqM~KaSR= zbFV`veXjJ8G5(4AmvQ$2>+qLMB$hC6ALeE+g4S{o4r#Md*1VUvR7>{%VX}P|LlzaE zk?V#lewTU%TNxln)lv1uZ1dU=6ojE(+Yi}XU^E3hW-fX$BfbEJLB*B5zT72BIYNNM z#3@uf9uA4i3mMjU`$sEhC`Y31Vuvzjao z^4Mw(jS~#bO6%uY5kqZRc%2b9nLE5D5u7K^?RaDd?%o)`P6@Q1TTDTGe!JlL@oOlV z`2fJ58dF+%vQ}O>)*nxEf#S?qQKq#IC`Mi#Ot6Tr@4%)8YOEH}6y)7s1!ABaHMm*< zX+{{87_T6N9tlyNB+wzM)QOVpuq-UJEuNeZ#!U7myl1r@c9rNd=Fq5GynJt+>NEtt*RNImIbd&?R`fnyr_rry5|_s@Y8 z$K$Tb1@IQQ{*}4BE>)btPp4jnA;U54Dee?E*RiT=vP!sj&Q{@%LbB1@HfL~>eQa9i zOnpOP3y8Ml1(W)9FB4jt8^=Vd16^tlkYpMjaqgx0dR%tK&=mo)eKoXT8A zob>q%6sE4Q?h?sbzUIU;xkJxL4Bdc*n4}+oI^|#wc2pzl5Yzai0@Oh4ipBrZu?s}0 ztXT>y3C$`mJv+BwR@tNC*Xcl%_Z}_;d<0DtX3Ald{HGnJH3n=JjG8I^_sjNVYdG)- z9cV3b7PVyQJk-^`Cjm5mmqJk=Ni4Hc$w3iDv>~mb%POw*{4|_b5b14#q5Za-{5dA{ z7y*A$RnbnW19hfI3B9OE{|m}v-+g8CZ}(=W8BFK1qnswwp`M{J=}k?jo&NCf+tmue z@Awvshd5t#mEMc@+(#pc-fwH2Z?opgfsjH(j(a=udLn}hR$y1+J?PrJTt#B zlu~H~T27Xp`h(9ah-NNXle=fLe%V$lgo5JU8AI*2?+6fbeq&kfiQIMleFGHgh#1X) zaD?;nFgak(k6bfo4l8A06yW|P@Rp2-GYxUdNZKL_xA@JQ%WhnHr3^aVn0yc;s>=BI zV7{-58G9Lnsoh|{s zxG2o9+*@|;_e3u5Y~FJMpW3BIf3|LuRq0Pi8qBaGg~kqqDyWCKQesd8^;pr_fF5v} zhKJF$Z>1HOvX^IwwTKhHlz#Q0RMGTtp_kT)i%k5{PiEm3SS0~cMzw;~+IJfqki(KX zV>epieJkIt^o$nX`uY$XY@@urc|4uc#_&QvN#(CPw(zQ>bdkyBzx=lSCgPPa>8rF4 zH=l&Babr?|fFpC;8=rEcb#fgY92Ng6j!-T)ty4pO_9d% zKID~6jB4M^)U;yEsFEijk?R)EMJG?A0AK}GjP+nBaLsfKg`uu_*C!SNr7bj4Vg^)GXo-c7isa_i06GXMzdG2m5 z0F`R{Rj7kO?8{$Z@YUslZ332eQyRWXGc{}O0W$s>x|)4S^2Gmd4m4HPOz?ehv0L#V z0f4+ao*s;7m1#o;r9;WK!|uVN&Z1oMQhF|kZ>8bhyVx~Z7x~7vUt0E;jP>zycEpFd zSVc}2;_}UQ3!^`?6?C8%l5~i9(n1K_aa9f&2$^XCO|% zy*-7HC)`2@quJ<{Q3~@9P7{z4*9Vt`o&M9NiyOJzym4`C#oRjs(Z(-;PbI~u!wjFA zS<)ca)~OOmOVIb62dddY9!?a+AL$%l^rge^^R{HgUWW0&ga00f%B+n(^EupqNjEEc z8~q0b9Ms?dW-_odpU(I2ESgQmT^KY1tKGUkB8IOCAZXDnF>HwTdD#ccWG zx<&27()zRZL%n{8v~hOo~rF8EMNMP!ghfEYMrGEhqMIBO+a zK4T5l0jWH-hle2z`_e5JWU+a>@mNi|sJVcaxtA)5c*SrcSzfCUhc*S>@fv+ERLwER zzsi@RZ7U|$<&kPl!b(p@?@sQu{I5Fqxh3R`1mC#{l*gXmvYhmwm`#S_bXT z-~1JZ9Yh$G-!W>&0}1%xQ{g7#1f76p)b3r6>J+16AY-LyJaEV#c%|MHn#d1O0P0#e z9Rh6r8`7NNVg1+ra-jqM#6aHpU&1k}e!vGggy4Y-f2zh7y}f1J_0Fhp;6sW`Tn#Up z?m%scT@#`WhP`!uUGSc_aJ~{dM^h&JaN_n!rokleV&)^e{GLB3%>yfQCY5Z_=$Ulk zbMhtM_>6Gs7CAqmUd|(4j?WE)l0vMs`e%6X#4&!|;u&4r58bC; z_I_gN8HeYx-|_^xmahHlUUh`Z+mok%^KqP<_Vt8Zc`yJ`S2f_Pa!=nraBK{k^vSia zuO4bk5@`Xj=?|eOL;peJu@f(w47fsK~*gK~w;N4PfuH}L-FeE~s^V|+?RKdJO`m!j)SlK`y6jRZG( zWM#1}XD_M&;Zi6!oAR>Q0-~>H=Zi_4X7}4m&2yiE+IdkflDeMHn!`z?IsLJ_u3JiC z_e?fIvqmFeohMUH0O2Unq)hqdU?7P&A>P>4 zdu)Z;pXC-|Q|Ho?1e>p2xi$2;1}O#Z0|!;_jZuL5)0P1!#v>Mj*%e_iss(%xo0@mz zJ{1@scn}x}#h>K1$K^gBGfm44n!VHx!4RLj5_y0<6t0>G-{N}1|D}4d(}$W!^hT!V z5DmzZ+P$I02Lna^uzu|CaJ@>DhPEha&V&kG6V2E?h#x7o9T|QkQ@C~d_c}QgEY_1c zW#`s0Xp|Z3wZ$9PQql|&PH0FM6aQ7-%8{XrD(09>Y)N~xSaR3WuEAW{5mg!^5QBV9 z#FimWJ!RIn$sVffqexfw0qpF1R{hiCaWXMoD=s-bvp--rU|=;p33q!X`fI!T-4+f^ z&LyV`G`+;L^WJvx^xoOwF_H#yb*t|6Sn9(BYAB5zAx*E>k3R@rUGc5h0kF=AgRz{K zVdP8fl=W}=d9D-o#|KDYlNOex;=>IcY@k>dCT zn9VOh^$EDbS@bccuC1CS0Xclf1@D*@el*gFRmA)3K7`Umu=RvqMi#V-=E7xrqf``) z_AMdJXFl1WcW$*0Ix->UwnKs>tulbG+7-(%stI(~kCnD#lQ~_If)V@gkgMFK>D+sG zJx{({ad~)yaj=AqF3gS8AVE7Q;yoT+uLi(ZfoQtNYU6_fuk*IK$l9km&)0EkAn!XA z!Hj1vpPsi$s+n=S{m!O5Y|Bw@3(miLC3myL<9b;wBGcOeqYL6;Ou6g9A1{(Vdpz@S zSRVH>IliDT38&&hgb3BG*azxKuli#J$<~{6)r<_HW6e+?ZZDYV=omkpezR)Vyx7<+ z{!L3`#3)}dOeovFx?55W2=v$pz)?d>g7C3WCaLeEGsbY+k7y_*N48UfKtBUo_)_c= z+S)qsz#b6`=c;Qn5vyM5L)fsO7msx>>bg+K3T&KxW(j`-`z6|Fb|Yh&tOo=~@A7U= z8*lxCX7(oviePJ|CXW8u*`+jYVN%oQxZ;c>=r`h!7Fa&wi7cAw*HqJyQQ4G*> zSoh>n@veH%+KPY3^P^Z_%ad(n%8$Vr_5G-Tw)9BU3praeeif=UI^E)ukDdp#%b_M2 zB0emg=W~w6Hx)W0C84X7ZDp`)4VB}>MugQqIdWW)jK+T-1}+g1S;cNSq7lKj0~ANm z?cX%9gipxmkb-*fz?vaDFJ)^&S^@vGf~m~dV8@^YmbyDg8ds94@qNZJcuqutVM$?)Ml{@M0S(~Dqj^jFwQL8Sdg&Ik}BgxOpf#% z>-`30{n?5_%$E$=g<~7c!Mh)pBa@NBWRXx9jlzqg9Z<>ZbStR8Doe)+-&4Gvm>Y-B4zFGW#5-$kVHSy9fvzh+=dgE5qX71iBHRZe|~nc`!Fv!zS1AkaEMqH|;t z_)}X+Ln-n?b(UlZBySz4pxwGm1vP5ff!WurGr;7F# z;t!-!A7iC@7n`a6*S=?V@kq^_h>E0No`J^XH0jS&k2d0 z=J-@TH;QTE5oBNk#`1z35fUt6kX+KK9;N;EMy-nc1ErAL6I?unc)aDs5D5uh6xxOJ z`7J43aq)G5f;Sa=!38;PHccl{?ojXmE4NQ0(k_HFnL1;S80snJV@fTy(t!W_v+`i| zjw^Q?&flc_$`*iDwSkO_OUK2eww`*-#pU!?7;FK>Yh|507t~sd2Sx-IExf0MXV?|( z2&?z~4^+sEfDAtenThB63izW8z2?(dGp>&arAr!@8D2|ZOdJn8lqVpm*2f*MD_n8r zXhP+`R>r&682eEH^L3FlCEGiRfSk+6#>LC|>f_-JV%U63W}A4V!=)+KYLaGd_j<$jIeU+UJDrlEVn3Y{Bo~{vmljkE>r^z7o%%zF6D0@0py#fUSQ~p}fX-4t)$iz+*jcQeo#amg{a#svAi} zzm3*&Bb?O`n1S(Bdz4Q!3=QL@-unX``j4Txoppe0Zx;ftd>ZkT%SP# zEhTHm4_+7?IelScNkRd8^ypWd`R(-t>`lP{DsoO;)8PUeUZeWGJ(Ix-uSir30g_so zWwPqRqH|F(zgMf~DYD>S{R4~j{#c*B4x*uTcNYcMK`_L`{C{u^1CrK5JYOq~%zT%5 z*tB85+?N@^TmL$d6`2razMJUF$sPSc!0w)5@3&siDsx-73UC0SuPELbEsf7!;9m^u z-=!-6HF-=PoY4Yr5&wWG-nRvgLS{~k{Rs-m_3w5BgoJqopCa{gX+mZDO?^M17Z*(c zR#VYRnaLpBYPd1tOMlE%B#!K4s;sdrbMWlj75leDbafp}Pe=BDI^FBC8MI13ah$(a zhf*{;zDh5Lt7$SRCV%GFvEV!maOu#_BW>gbKCeyc1iGv%%1c8h&s|OB7MA zw?;G&+eMayUg%h6e0zVz5VSC@9rno!KF#HZq?U)*iA4}atBS}h))6um!OerCk_<;t z$89hO)_t(+kCx4}#cV-HfrL6b0+gqsP1A8yXpUgk=}_T_Bbch*=~ z21t1TWfnM|hR9;G_AP4M$Zq3{QX)KH?nk6Bq|Cn@D6axq=yjk$*L8xE1mxkzwR2O6ufF=91K}#?piFQg)!P5G(vJ(JvBypM|42_JKk?@HGnR{q_8KFaG|Qp6HED z^wr)l1#@1-F8T+>>imj&C1?jWpdUf{iWPp!IVuw7G4+Q85GjLt3-|>2#2-RTVq|qs ztfp?jscX1R?T}T3pX)$RAGgbX-Nw+bW^Y0Ip=z(Nh7L|Le@Z?ljm_!81g%XxWU%9_}2}`x{0$L1pJ>tvLBvi@_yDt z#^NhCcuw)f#P=;i<<&J)1AcIWsQ99UZ5X1_ISRh_5&Pri(Xu#;_Vyzsf9AixTEZ>z$9%_vMErcjFK;MVl`2o3oL5_b;MOqL{QEbGIFM&Z zHabD1hmFypeU-@*gOv3%|20I8guUrT;DVnC-u`V-!cR)ps?-=wv%>Q-kl!FyzVT! z<^R<~xLrx800_N%o+gX00HI(QB0(+!)>tQnl*a5S(_{vN$woRWct4JhG( z9KvBH^>FUk3XLp}Y(uAR>BQ0KRna%FxHF}!Q0Az=N36#`8GIO)@&tHimDi8CD6Jg` z*!6~U&03TOr{YFFcric1q}UdiLs0!eRcYyFuY8lo^yG=p66t+HjoA&+!`?Tx7I^6!6|e}@zemqw!E5R1F~Z5bB+wQG6vFc%kSt9u#( zQKts4(Htbo{e$V{1QUo<{s+_3ZmNaq-=Nv8Js|9jWz!W&N3s_H?pDSBN&uQMkeHLN zq`rP{zI*!v=y4}4FgVC)c5#^#x@sIYA}PLZF4U~A;F*??td7nWTqTXkZ;t+3MT?5V zBxN_UiTj!MKn5#80O;-zy_X%CcTO~;CC=@44VWY1Oe{9=f+Q!7j-^VIhUwG|*I3s~ zAx-O%uBSb;cYdV~QT+&a#wVTACtq3adn#)1=EOVPg=x}Fyfs03 zFGIQekzQGg$K#7viXivbxR-KRvhMdW!8iD&5y?|>PhI!uHiLo49GC`f?x{D}lU(T{ zU8~ov9Tdl^#T`X~C-xkxKc1m+@Q6y}zs_O?dS`jlF>8pNRWUJw?Kx?7cVNCmVIAasg}#uITFTK&9=!)v)<34r%RilS-{yVov>SO}JOw z6OEUdaHA~1@>U--C2v^wTwl?Gg|4ULTZlsc6e3r|NVG?Q5_$j^tZ{VHEZGgcg6mF#qIe_QtM6t#32U*22vp8-br&ShdTu3 zj%|O0rUr!EPAG^UAYqhRj-%^YkZQx-Oy!}c?4ha(A(W5(?goi8xmDwg$wvJ(k1G3W z2{VYJ2Lh^(m?y7Anq?OFOxAZy zH~TLq(GS>xtxOl31AhPXXgjO-Iu8~;9Z~eZrN7iq_1QQZ8Jdo-DnG3_mO6EIJf!*d zmwb>6ywZj$td;zE4$@Xq^=ppd>|otcQ24RBt&LatOog?};CaK+`0>uZulAO}*zwo% zds<^B4}35lzxS(q6dqNSFrG9MzdbSn0^+!+B1l6}rW^ks_K&Y8Gg|at?B9tT;Ta!X zs@-B&Xzl%L_5&ZE^)e8Yt|PjUGP;({72~Y)=Ym}*Duj%CWu(PZvw$e4JEjci;bHvc z@ExrLPY`uU_-Y~tR*TFiWoT9rY1zwKn?!Nf=C4|z#}juy-I911B_Yyfr7N{ouZXstHCmlIZW#IBv}4eV6((GM$j-KK zgX!0(G86D4a#&geu2UO_c%^qbtjJJlCt(WyA`*r?3gG((NLumnp>4LoAUeaV4k>T50JJMvF^W8>(yCdkcs765+1CB z!^L=ROUDKao-i}2>GieDBSR0emd*C%Y?XuuQ1_S^&uuf`ZYbm(3>!iM?t0rohaWx$ zonT15zx@Fq2@B22K6Negnax(st^RjsyVqzo@pSw7P6V)o@xbJ<2XlS2yA$Q%t80AO z#gs_@7AzQp=KL6d8Wz*q4bsjMA`V1%i+{So@kTQai>e0mR% z6}BE>%qZ3b^VXbDsD!Y1_Yp!gyQ-w5nEUAy!O1!|YD|g*=?uf4$TZ2urY1$Nfxma~ zL}o?iYimQu8zpDOr#N6to5yu!Mb{FyhA3R{HgcdCN5b(&Q0cH52&xP!yW7LS?JA)# z)2BY9IUH0@5Jd@6lZSd?-|6E0=h-C)>Y?kF(b`}v$1##pL2K!0$}Fa!Kp-HA{Y7KR z|D9pM>EaW|4W(Gz`Jbr42#V(-XWm35%4L&~Q9q|r<}oqm{9g>rw`_7oli=c`BM}#; z;)C>^?%&jhBG`;wFC!~P&vx0!Nw;f7C)E^VW_h(jxn>DIXDCT>XFQmDIqQ=LXM#fs zPl;SXEF%nGj|tJDr*vINZDzh++!c>o`d%0&0C$Sm+*j+AWMsk?J8YRU-Z5y8ETWk@ z2+BQO-sfe%j3h&js+Sz!1qkl!HD;m+O|`v>B;ho2-hLZ0K64XOO=ttq6#MGvX?nkj zxN(qLPWBwj<)wtt=7>QY-Oo)8kJ#@&A&H{=n@mdB>*@bDnRrO#1%Nmz6{SwM(kpT% z56};}i0WCn{D@hEBYHpn4+xyN%Mk*1-RUuG~!J~@-f9M@%8_fnDtZ>N$<{^I#d^_+i=o%1hJ5JHy3;!QgZy8iq z({v373GNWwArOMQyC-N!aCZrIaEIXT?he7--QE4*9^9RLn_TzvR()0H7gTZBvuC>3 zTD_+G1Fa$9%fQ_1_nbyj*ko#_t*RS~O7mR=prz|qT`b!h(k8c<;z#};%GUT*Ks}CA zKUJBw;9oc#6cK`Nik{0*Pvxah0A!uJH8)sJ^JO$*ULqPL6H+=p49*peT?zBS;s|g$ z`fN$=dk7r7eT2uJD3TM)GA<8yRM0qa=U0u)o-{R9^bbTQ$$n{UG3@kadS?IE3!pAP zK)x&r)ZucZweulC|E3_(FNnlsRGF8TC;8jJi|OI4`h+lB*1y6C|-8V4xIo$rIxq%Vn;Dv31E)DH>Txvcm~Bt_Ho)T4ezj0b1KWdn8&O&A?Zwfxki9+cCH zG`s$(bG}SNoYyLacbeSd*er!5f$reoK*-IF7m!vc4EJ`(7|gI^zI{Vaj4~Xz+i+7~ zl9WK5R!8E5rh}gVu`Z(5ZLma~iO=0YhJ_+@#^isEO5o@jMJ#7~TmUuJU6_8Z07^W? zb#>+c!UmGTo2J(vUMNn&1`x(vU2QtKwMb%KpO?T$gP~#iBra|uz@)UL^jj&XEJTXj zv+(;UE?aGi4K(=%)@WO6>y(0yFVL+jtL6blp8~2kp)-GcA)+3v|l%4gYH4$jR*pU9~xb^p4O z1O#}&54N@!0JofeWd{E)^8?#hFw~ z6@90lbWIc=w=8s&V{q%D9vjqmE)pXmv62-i2#TZ;yck;|7KY)k6}kg~f&;U0(0uKB zL@`R=&@eFcq3tlV6R!V62g5#BZfES$($n`X)$E_o^PcIMKeE7|p8LU{c3Kc&%=+UC z^PKW$P1V9hB0)sBMc@evdd)8U_-a2lGB^f~9AwgIy?kIKXJPqP{_q)SpR6uL;?4NgklX0(H^;)O14T1_?3ja~NuH+@`kez`2rA9CrmX(#f`E;>4xTiVX>A zcL}fPx4xEVWxXTudae@FKo%1FiSTU(hm?{HoL6J!0LJ8AmB56QkdND53*Bi>j5@dc zG&<20+>@!dbzhZ~%<&$WJgup#>+RO+cG*ZGYgy=ULISM%8+LCX7XCo9L-=|khMp~$p(wFLZ*`Jf`&M`+^0>c}2Zo8|Pd8KC=c4>)oZN7n*;b-VC% z+O=@o1Cco4YK*bYjbUyYtgDf7Z#zEyq`Xe~O~uw-BzvQFJxy}xo57N>k&8I!CPdvMDBBZ0>Lb!2feUFon%W@8 z7o*LPVk;ofjv?KIT*uB?>9qjcxb!U?Z-!cTY1$}>%?!ic!vh(i$7nRNl4|A;7z)S< zt5Bw{q5lp~NN0~^XD(dRPqLkQV0WIobsf0o%*AcDx3(hf*MP)?1flQ!NXdB=3EL;c zoyFqBqL46j`{5MHx`-*uLK|)L9iH&^f2vLfgk zn^U4gDYreFV-MgyO-;e?HPIA6xT>C<*Ypn#wpFci51tC!ZroQ@U^$iBmaTBXf6J)q zp{6eX%czfHofL3Q%jP?pJib>;)Kxd)WIKCB0h*cN`P6~X5D3`dQX55W?TFH=uq zpA25t8vAFtLR;@E{M{8$K>RSWftOAQ%3 zaK;?%o{c7&xmnkWXEp#IG)*|%{V-|aWoTJhU9+fIy1s3=ay_%)2w%O6pU<#cTX{-* zvAn7>d*Zd8;jUP5JFZ)MYM)-Vi*S3dv!LcSUT}yH%$cnNdXc-jRX??B`_59?96x=r znBcxT@fd%tS6ixmNpCnzTR7prRX_94F+1VjZ)=-aTIUc3T1`)NAJ zeq`9m5FPKEan?J!O5%6Btz-+uKk+bYoLfi0wbU<|SzHV{J|;9YGD&UIv0>8}v!J4J z;pvy?Bjut*YS*7O2!{K*$8AWca+3~HY$fDb}y=70%>`su&$1#wG|Jv>wp7Wf7X}Q>uU8?7P`fmXOY|%Xgd%eaNIe#3Cc5} zK0Of+8;9yz#V_eRi`UiFg$S*Ahg@2GVrcdoVL^@j8q_~aLzBd7!hwN-p_yVU5`pIB zM9?_G8HUmfM;hS~1Dg9W*XVqRF`h9ZrZ>fY5A8>$CZlTb@3sVtk8syHHm0_c$$a{c zy7N0VOSdV=Rg)ay48q~o`@!r{>!3@0!DExr7A6wP@BA^yic4S@6eCa3WE@1Upy%f1 z97N*<)Mf)yOG^m@-}`U$3}Qobd|))o#l-`-y!?Fq`BD3+FaqkMN(J9vFB*pdVyIX? zdfotb>dA_(4f-E#!8+4KY4vDrv(3HaL8#c-x*vi{;-f(ZTv=$yWP%O3I_=7JBOOm& z5nn|Z&hKSTX+Mud(<(k+BCuTi0f?`5)u-X z?1IhiFlO3v_+IBP+Wq@;OeC*|`v=&d3L?S#AVDHVM(gOnM_lyd4UaU>ta!Yid&J*4 z5TlcQp_wA=j@UF|IuKXN#nN0Bwe7ja`AaSoI8nP#>RnN*fBH@PlZ|~_@sBbW*RViT z*TC-+D-(_&n4FpqinxW5$>jJjv%_jOZFv9m)B;yr4vTvCkc7*{X+Egkp2jHl{QmnK zTjvNToWLvL5gE%K_bn7KBrCFlq}9V+b9*h>hj^U=a&`$6?s7}BQgMuXhNS`lP72VN zP-ZQ>wy1=Y$}FTJ9C(op&RSjuoA!ISm4v-u*HK%Fn-~hRsbj;L@H&03hE_m8K8Yab zm@N>JB3|+sg;wbi7HJ@uJ9D?UXS}n!yVdPa2n=H(AZx4hK!W@wqLnFx!@W-n*$ig8 zkHMGNK^ZzDFCj~mBN1LYrdWc}-ue#K7$rqcyG#{kZ*6^8d5>_nqsZeIwasqQf+v=q zH=AxlXkNUgoYP_4rljV&e&s!49P*h`vgJO=0^O%oT&j_3D(cYGI^ZsegR-|zcQ|f{ zD#Tny!n{wQ2kOO`l~f6ikdmm<&>^GJ`V7pqo<#<8VG#i zlDQR`4u)@OK)YwIpca1FDmb#z2HMWlJSh&MM>rxo$UuLN9?1F&3uuYARL%?WCI`af*>NQ)4yU@>$@F|y>+Xf%)y`D4BK2XId+o$ncH!uc zc|IcuypY}Au9&vUnQAMKxsXaE0ynb1X^EP{i1g#|tnFv->cE0zZLPYZnhVrINCn*9 zkG-?k`(8@sL>ZR7m}4i(z0>x;t8PmH2cLFSfY>AWP0ii#qX z@9|~1_vn|nGRRz7Uat%VQ;#0XL)%7-t*gu)TdZbQC))r0-G&a66}A_xvl5wdw;)b< z1uyhgygZ-9Y5DIqHbD=TwFz3@&8&EbB26E6>3&bs_TC0$@$m5a-J3;aK1;X14-6n< z;2=I^H6d4pGcfOK&hfcS_U+o#9^p6`UYG0+{K4@=xb<=1GV@eYsunf~-qF<5bfFQI zgEBqV-6;|l54M>GvIh^K5dn5bW=kL5T)4R6aE;jgIm~1`i#?ZQCY$+LDvVT0ypA40 zS-K>2>MRpUB@*J|1T20FlFdw}Rg-P|q`J^C4Bxt8Y|qoC!$)I|*E>iCB8XVKpfF-% z(1?h_IoI8lYE3@(W$se4l7ta(qR^_8vk1c!jb*P)QgpUYOqiy*t!``oJw@^u_!Cc2 zWo2&OU95z6e^cQVZZwiWX7mjK{|^D>V81v#*JMbdj;l1=ZhtC{Q=8R7rf8V=;ggoj zpA?IruDN4kJOCT=vmD%X{V$g}`F8eD?UYtZ+SS5H+<&I;pNe&3Vs_!na0k_(_nJu< z&8*65v6YcC8N%74gM6n3aH~xss>4jx)qiODvzm+tIcm0}PbM;G1&CdkiOu}p9+1Zs z^qkE|74#A?4(T7=8HyE8rCqd?Q&UzBz?iDu#70LaQ@6LZl4Z=WLr8fp)A$RgD(wD! zqK)uQWYDbRup<+E^g;iNtjgn|;rAntr(0>XbXq@xuL*R*AW(IaRM-6%yCkR~QGr|F=mZQ`@c1Im z!4levitS=5V}PgJLCtxhvp_ag9PN&Id{y>K`K*HyG%*?E=OjVZbG%K^*;-papUv@N zm1>o~KiRHXv$DE+NNFh@A;0T)nWY7Lvk8eNf4hWIfVBeCIOy~KItz}Dc*$@EPcTv^lyBfA+MaI+$L?(;Sw570dV+ebM>qr@j z)Dc&})T-W0#US*-!<8Ut{Fw{8mq&+OdQl%fDyn{>huFn$D*^bRL`EHsULy9x-{RX0 z3n-qOx zzr>mf+HOJDTdo+hZA?#3S6Z#|Y_ErHCvQjL+f)8=I$qT47YuGJ%y31(q?Thd$S_D; zAsQ%^&ej3;C{xNC7GP^=pZ^aF==ll#_0#;U%&cf0#F9c!?DmoLCI*jKjYpX>*UZv8ZdCuh(NF+lV#BZgpR~*d*?4-=<);Q~ta+o@@ebTH~xjZdJ)-!6UA# zO4fNXc2GMTMsd+U=t(({w%vZmOe+PkYSk(ict*K^`*BvfJi3(vPf|Ez0++G|yhs$L*Fbf{Mkx0%MR5;9CV!8^vjIs%6D6tA7C&(iV>Yf6g#CDVs|lS zad+>^+W+zU9zb64(|iv=X$0U#hZ0qx-rQyQDqyM#J?i>C@=CAk_XS}TtgewFPEn3v zGLha}H!TwOHLUB``>XICWAhGGR`$YkORHJNx8U3kHwYPR7q%J_8Y;XMwp{tF+Lf}v zed`wKg|I4deu~j-Htu+`%)X74(cL=tyXH`;H~M!CbjUz@=hlAO&h7(h`~?{a0#`dWNpKF~m< zGwxOl@l_`#)AO;I?2>CwrCif&R3*7X*5a&gVz%wy9m8BV%5pR>|}IA9L`(HCY8tRIA;#4A1HY*mOQ759p#2wjg5DF%^^y4Gl@St%sL+U>*o$ z!~S=OaWDKd)ucZvSAc_(iWaB9GFyQL{gq@DAmQ*=QK6;e6zMqn)t8vG5$i zo6aZfZIDWdU#D4=U2if$oI7{x&*XdPP#FXX5OFI@7ez;TJ?tjRip_OJ0CXm}4M>a|vGM}UU8Ieks&(e^7pT&*s;rVx zk1F5BMGAoHlCu;{`arc5hjHV&SSBh;qsE*fM|#k~;$!4vfXcgnx(%)soT|w9$_nfp zd%Vb?R`(jzO0T>ULAS_&u2;Ti;KUHAmTOlGc#{c;0;h`xnAG9hHxr;WEN~u ztSp2Fn`C+zkFFiydakv)1cikiUtDJ0wRZEV5}OZ9p%SrM|1K#(Ug~!<6B%K#HAuEF zHrV~Y_pm;(niOXh2t84pdd9dG1=}x6=d@vNTAm+9&9{6w`rga z_31~vs&N7F#Yh#B@L(JfULk=+YV2r3Q*LAy5WA-QTIPQMQPE0L*AN4Qd^6Z)4__#k zAues}4_sso4bV(GvJ|`HIdo*Z4*O3Z^d2CelpS;-n3>Kgap7_{q<)5SkB;LK_WMDC zE|P9c`O@)gFB8(*nvs(X2aAw0PaCeg58e)#1;?z22nWZuz>kgguaf|n6H+;d>M%Y! zTCaAyD7;>;2L>3h>>IIE<~7tMFuEr_#%{hwDCh|`ZB&G^UTt=e0_OVRvvO#8b+@;T z^9OUE7DMbKoeG^aiNK?Du>|`0B{hZS5wRageNz2vUw;f3ELs2vd<0M=34BOLBpW^u zIFrk^`##L#=TEjBygCJ7w(DxamM;+nhfd5PVMQP+35OqFE^X{aX0m{i_Puz|%D{@y z=h`Oo;qcn={2N8+QwSe)=|Of54pKoul7UF0jW2pM^JQz4=C2q1o|&;9-&ei%)w&5O zTL14hfb$02BIhvWnz@+hsktqgoC&dn`7&0iS`D^+^Qiw-nFiZBzH@?!I>IuRl`LgX zmTsc5^g@}V?N|u1qws5|@FeV;5g>|GcYt$%2W!&9T@ z*syJn*3541IwPskGPN3*(M$oFbfW_;8f`m)6*ZWBk2gdCL5f1eV>m2_0ZhGp4-|^o zJ&*2FuTohV-8%U9M_Zh@uN%mjV$gIm8(!M8v%8?RvyBPiPk=rPU1741?zILxRs#WT zkx9`TxetFTyk0D}AN9x6xciY|#&p{Zt#Bz6H^(^6L4EOZ9RO(86(eWThvTk~NY_1t z4Z=L?f|86%)bP70;iO=2Omit&q`_q7On*W``ggbi04dxlJ_zqakZ;?!esyxH%@qMnqDVaimv5sq8U{?kX!l&7|TfGdCuQbHFioI_{Iv_)Axj8^3e zC~Le!#2)Vn7~p8cnHU%6EHTsRTs&$jLU?^f2X+Y3+zF<365^5Sya?Sy`Q7J|Dj(B$1-H)rKescbIza=(HQcHH|ZeC$UIC$*{0+XJ59O z5us88$5P!=JFe1*X(2O$yiYp7HGf%SKrSv#@Zd_&?ibN7ykpIQ)z&K}Ghzu7d5520 z(v)2M^1yL4N;2mkLRS<7R`!bB0Q7PG6Iz0jY``Cdy4`Z6esgguR<+uO9%CRsNH9vl zKIBV>`Jjtq;q3H3Ic5?EQgbmPn>)FJkwJ4*WOGi_FY*SMzEsn@W7w{dD~eO=kzKft zUP=H%EqqxQ#24D=by4a zE!V)jS56rV2I8HufZ~~%Vmted*Xxz<_GE?HL!b}ZCad`OSKhekP2a->Iw;Nvmk7a> z3YJAE-X!EHSjW7_$%Ot1GG775GQ|-aSGa+CBRI^>WOgK~LUx|nLNAv~7#l`#GZ{FaT1&)MMegeY_ z_cDv%U^S9a8`~RYX!L@Xz#^06;)({^#>G4VtV=; z>!~yfsI)?-V=ZZ7tLJbp?Q;2i!JBx0G?KZBxUT~7Hf?Lwo0LC#nE49wQ= zwW5`ca;}OBCcFPvR=@W5CfjM=b1=7HW1HXJIrJ?mW$2p6(P1i}p53rv=zJQMoB+;H z=Yfc~9i+edX)&H7Ku~hyB~B`KM-mM-yZui;1&ZxuBXp)M8j^jf_U^?QJCKS})G&U& zzX-U-|HCb-yOC<4Jjd7K9iRg|TKeQz)Ald2 zO%#$58}}F6{q`ACDrOv~Z0KINyRJd>xsl%hawULZhdGV;5 zQR{4YUKf2hvfg-JUhraz>|XrGECNN2Q|>@I&$9j(FMoqBbMQU&^w8H__KEypB=x$$ z@j-B*-jNlV@Ta7~fK#wV=RobhrGSB;CR5SS2p=t-F|{fY{%&6s{0*CkC>Jtwpf&+p z4E_8awBdARL9!<5x5|$f;`+fNuI}!w7YkxFU#&7o&!@%WAb<`n5?)q55L@zJUik+v z)j(MtCX*9{7ddA1vPS^Rmwf=#nD7Ghm$B&MynZq$37b_}@@V{#>!E#ZqoWn;nTW?5 zU38mUlNA4NBX$!R{6%GD>^o0?=1OGW;S>t?N;2Q3?;0*~F;1l=Ky$In16n2m#+6*n zxuoJa?239y3y=&|p(O~(210CewtM^fR9sx})}F^wO)c7i`n#EwbOs%wKa>3+xhOpM z3bOrwR@rl*tlC!GCsfY>zh2Xezi}Z=S9@f1Y@_^VsFCWXG{9n%Ec6K)V zZ+J@8tBBz*q_q}W*7$yBfSC?{tBV0I7&jbFLDa7trd2$vysV^axBDxXjWeursb+}7 z(R_%~o+`z;?fAm`BhzCtbrbO{YDhp$rC(OW zr7DVxnLU?_Y$a;k6PD&HOv*^WjG>9E8c1yikO7Px{%mz^Y|K2rXsQrsr^@ukADKWm;jSXhRHKIZQ`7*Yn~=;raN{o z(_}n@{pfp2m24W<6w$$^UP7B>lb<&$0sH-Zwb-k}8YsDRdM80$ni5@_VG`&fs&R-D zicVilKhSy{_~6V8aPeo)q#Kr-$qKzl?;5Xfn8_&+95JxzRCUSymb=|@ge-#JYj8aN zd^*UD4Eswf!KGDW9F9I}_PWGdR<_`~wz7Z8U7yCc&qoyvjB?jo_O=wB`4N*d`^`{2 zV>{4~NSeodT&?V5>V$83;GQ4|&E{4*W-+YjabCkZxk{vFBAL}BL?cvT=1%h^l(N!f zZk;O_2qiuB>+Os#0RRepr2U2@al{r&yT z*u8I>qBlk7lX{Iq9-I@cEx+^*7fX?hu^9lSqNpeaQLJEZFbpL;fI_ z9h^a{_14mU2D>^A*7Y%8#V@ebDY81J_{KP#4RKc3D&<~`{m$#f07dD{XT_nd&F?hZTt86DXNV~)WA6ob$iyJd6v}hnoaZs}qSnZ`ON(@e_Yy`* zld9M7wv$$rma^UGr5`kAEQf}Hztm`2C?A)n9*u=f^>1^_Tk|?K-E8f3#n8aY}oS;_W56K z!196p^=^oZmt=>a4;PHh%}uM0&!6-7ql_nIKKSVQzVlb} zG%avF1#|E0?BK=(7Mxu7iDiRn&Rs!$s&ZCfrO>dOY(_c>-j60h`F!jjNurR*58dIZlC#)r$WCJqCR2FWl5{!`Jo_$jJ zvmv`&dVg~ysAT!g_D*C>o(c+cj7Nq+-$ZXmlUZ{VVyySxxEHQ|#I~=J-{A`nG+!M} zon}a<78z3xJU4mQ(3o6jxNP|ShVPxNA|xLhr(?=HRGJ~BO%}VTrEsr%BaGRHlk&$X zs{agqgJ>IU?q8+20CxxGV0J-0zR5Vz04zyIaABs)mr>67q#(0-;YQZSji?VItZ#Tk z&&OM9+gAS4e5Kx!>NmOU_x*`XYqsG4adFoVF*lomR|LM4llCVjf=|g)*GrAIxyev? zKzLa%w{tVPlJcyU0smb3Nv0~1k$a0#w^KCad^r74G)KGL9q+9$VJU%e!y(I^DviUi zN4;=#Ic0fGru&4ulBu3_EXj7ZM<|r(FE98~>tZHpm}bULM3WFtvQkleb64D`k(2OK zK_QB4TY7NiXuLK07#gw~D;{2>Ko4ESXiFmX{(;YP>)o(5Ru7|Y*hO|+MurvJ zXF7BfoC4GwzLY}XTbvmnjV%{Gw#Gni;YZ?wX5-#=YKpR)APRPUf8lOv!JXC~bfEu{t3 z1vs|yVr)H}($GEUZ(WpQ2d?oXul7erWen!Wf_@|Y(v_V}E_V{#;g(-@U5NC7XVh*r zt^JD&_U~n<7+7u!KMYiQ;rrl3pGbcG2_5%`AED1)YEv2__x;a(6gEx=-Jhz2dt+*0 zQ5#HGdsRwQ92DpXtc7{t+~btTpKqZ=77mxC++vN00wwh5kA;G=C$b4kWS8J10j)BF z=%4HF04_-uZ*&Wo4|Zj9z$_~v*G02IC^JSln2yu4m&f48Ql^PgQXm?KEGeVDE5%_q zzMm%l#5FiOp-ug%NBEOdy+1$Ip+tAM!2W%Xe;(9bDeX!uG59T^@5 zy7HZ%xSu~vc&$Y>$*qU3E1)wo@+KUI&LjHEVvqm)mg+AApziX>oEd=dMh?boA`UVhE+gBzIn zGbGyaKLh6}kq<-k=*wk~hTmrf9s>L$o6RkkI2BD%JB>Cvp8eopi4^qC+LUC=pxHS2G9AHA0B>n^G|E2!;^@QZ)0JT_K$tjf#PiQ(eKTD{Y;C4IBm}t*$T7ubiaB%R6G||32abGEq)Fjl%o2a0RJ=omv@zuKz z+BBvKm_uToZ?yW0H4xA5#!=YXbhF32AH*7X^v53&M<$L!Zt>CKsJoJ*;YYn)7Yd5% zm!=iaDRZcQ=x{RGhUNNd68iR_fXvT2pbwHs0+Qd;`q9#Ue&<9*xTwB>9BLLr z8=We&TIPEX6?3&iGz>FpzZ^b(%|>xRCZGJ^Q;oTUBz0VIuwfIrg?uzuqLRb?oPmpb zZI7$M%{^M8gN4609%-!}u(Bt=y^+_{R+$4FVm_hYrH6D!K^7$D~d* zhnw{@G(!#e2KZ)i<vyI}Y zXqit-fFrQvICj_?es?jutOYGbiV8if6cwt=+A*XU7phM{bTp38aq9 z^h;RLk+9gc*u0!Gy*b}0!7X)HRc$u3ElOvlMx*$Ye(jw+Jy{JGM*;!Hu8LXi@aj+t zB5jTOVS9VLq$kxEHA-6B+xHFB2awak)O(Sv7>|LH7OI3p7SgKk8z>5A$%s6_GosoE1V;=DFoLB+}C=G zFSHlf)@EHR2Q4N9{Ux)rri!U;v!;V3G`S;FBD4_}^)yhUK?7(zni+VcqZ!c+zEL2d z-&XEV5&|s7*(~Y;O!+UhWs_dO3L8m#3qSZDlrJtWnw|oNq)1ea2CKSz=^kxD<4tjv zZZEU#Y6n}hOd&%Q=h*bylKZK&`XlcEq zyAq~N@9mea8FLf#Q`TN|yqo~`OLXE;YlejHh zi^8p23S~<|yyRIHSV`FU7bdWwVB-~`#j@7n?pg6+4HZ29%obPL?aPJYaZ;;K&Ckvn zmUfk{2lFdPT%9#s;r#JQLwwnOdAjQX3h3SCS}k-<;;U)ROodhvYQvR8D{<)h8(;VI2;xgWu~lBhkt2il;!we$nyY5es+o*yziueiGJsf-6o;8>02Q0Lg^^d3iM z=(RQR|9PZ?X?9- zSkslUC$Oh&0A~l_abw2Z3`z_r;khvKXaSYrbXe^*md{Yf*e2{#)9s+qnau=^$?W!< zFfEsk(?EKVkqR?pOAaJBsv~^{BxGa3W$3ZCS$CS(%7%dG9!W{3-?n<)_tMN+bb=f4 zRKpjd@<^C_xApYx@wG$jAv>DtSZ@g=hIDd%Y)S`XVE?Fs)u#dPoV0z_vJF#9sRN0= z!K%08EYMoV8DA?%U*f3ALGL1`@51sfuGG!EzwurzF!^@iW7iiPAgoSWLJAxh!k!_j zO6v5mVjqDrSDHP}F_xIxJR9$KTJKj9XDmHhzNOlQ%Xp5RXpvy6G(MdyR`r10(KpbT zjmJ`q=2hVE4En=dPH_nr9+nWDc%|JW7n<8KY{mhCBjC;@14uF8h^lv2Lk%|_BW4-( z(tai}$*ou8yxIBrAD_I_Z;$4`SnTLl&$d_*V}G=C9x)HK0RzsSU+ zFr+h??b8!boi&_+Q5vjQ;mcZWL%r6`n~27?NCF1ri6tB6?@6!e{VD8p-4*h(Fm}Gh zsbfQ+e-ekZ^tfzT_r!#yn_^+`eBQJkj0!o}66}UN^T)ZrwCdR_TNI3udBn zZJ>I5iKnA=;;OTZg4nanePVExzwz-CoP(~-5yurxEg-{xQV$HBfphF77fZJ!Zf*RyIVt~Y%4A) zK^#e-uQ5V}CAV7p#fIb44IHNO*yeM&2yP-(w{+F#-}GF^6qv^uViw%QlrB&GPANcE z6w4xn)5ROrP$ho6XVTrA@$5)GB;-BP81YFi2SWD-9>gQm8D`LvKki+m*K?01{JQ6p zC1!lUKzm<9aQaA1dYz#rA=C?l&l);grI@j9JFxG6dZig1@S0lvBIqW_VI-%r((041}0h!LrLOC<&^5+PLd5sZR*Z%Omw9qe2&fgzTjzOG-O51L0S^1gc zw?q5^ufX<3^UPSUOC(A^wn4lP3LdMt7tPL$~RT;&;ZEC z22LvKNLXvZB4Oz90OfBFnbRjs(?*gw?tq9^%ctf*CqKnuhzL1^5l z0SYqDje;+?UtwY!HOe&_7~KCptv8g0EX7vY^1jI2KC$SWzhWoKh=qFrzu1ciwhtp3cCmL3PFCd6t*hsm|#bq@GyMxlGE8F(lXGc4vi% zS8X^HGdVe_%Qto-*nLs2E|+FsMy?P99r87bwllD@7U~+o$~xVvu;~qf#F6`qLpS|$ zJD}}ckNKIZuvGoYwU*S1zdL@_IjZU53d5tfCooc<>5_F5@a&ZIC5s&cu-~^&pofKF zl|$pTOC8tHDqY)=j-d2DFv~BW(DzdC^&(R5XuhmJE=kju`6zpTAin$BRO1D4Hn%8M7lBY6;Jq7FU-ZB{di@;5Sz$uZxsH=j~~V! zy^i=?jveA$DtoHK(GFErRm`NlKU7pSGzB7~VN|Lt4G3Jw2KhP3$oqqlw&3i7K&qh2 zt`{dD9q-8@_Y^X(f!{_yy?ckzBrPWVeF*nE2^qAH6@bj<6RL_>osOK-_Lo6?IxCwa zzkv&B-SM~5qk|_a4XHoqN-M+qQbsT>D$|!gVKrx@(YK;SOP^j2MN@2=+Uw-E>Dz|o zm$sg7_)wAxTag0&VgUU7|2`)egG7Afpf`mFJcq`rx#K0*YkDW8{y+q2 zsgHU&-S%`hh8$%%i1nra2TqWx3C8zwv_6~^mhzZrsA)Bm?)R2hw(zu!rTamFQeoWC zycoh8Tk2|RW+GDJ1Qs~kgmxwaca~rDP-y?6u}0+KQIcj`wmH$zYA%1msc#&(w z|Et%WrInWpP$RavKA5th3ju+jfQ?(5NEDPQ5L^{IsR?~455$(&sV^kq=oN$WRQQYFN44N)R!Jk>UE`e*?iGdMi>3}89%wj z8(@>KGb}zaokmO5MoZ8P41K>`c1wcgQ4bhJe_y5%NJH}wn%XgKdE16rn7ZBA@&1fR`Lu7KQlZ-38(cMTZxz- znizL4ssJ3Q5wZHjHwhxv6_4X*Qr*jbDfWtAbHvwgn(JJgj5jZ)b<&sEED)IMZ#jFf zAVfS{-aJq)=gdxwn{HQ1;c|#NGwEH3#(AsDRYpSseU;;a6Nu**91vWxDx&bv=G|OkN#=?w&xpjx;ejm@N9I63}{|Nbz<~f^j(C#p|Mz1`cqE( zb69W^8Q%R#++j5TWlCAuFj@=z5@wsf_OYra?3a(nAA)ka1-;X8keCwsuaIXLz{JFM z$|;mYvsC<|xNod)d#Ke|~29X@1kX@o9xS zV}fkLF1ME9$#?MeZ=3e!p#K&3P^e3|A3wfDZhIJg#rI@rwF#oqxR(lVC3F!UiM@cO zk)ubnU1zfx_=06~qM{#)DCU~0_f^cmlfu#n91_pHzjSXl;jBXcB9di@*pyIFZqBLd zdHWIYb;CfP9Sv>fSagv{mH;5OU!#K*|COhvnXRp@WH{pwlR3V>$N%4hPxROjN>Z)XvSnewui2G`W^es7nZ2tGhN!ddRL2vMu zxM2nOqXZD=V8Y3KNQ(0w;DITkKk-iqF|W+ImV@i{y4Ng{AGu*(-|0mZDW%8KDv5iLU?J#%~%V}2NpK=>bPJRkPO zH>qZoD|6K~pw}h+81Uke^YwggK*XPNAN5OhHu2bI)YSX* zA%3r#ji0cZj+liHJjTtuhfnGL7x|#rV?zF5z{$l7qU+8!%Y}s8Nze?YT~VxK-;;e< z?nO!RyDXDrlRuwV2$(?RM?UBHwD?JK>$ypW-BBVIO0I!eGCP&7knXztqTas6y`G8r zCO6mh8tE4v@`louJ+{*1m{YlR)=r_RcJn#icjtQ*_|G9jZEk^A2NdTOZMn(@^6)cIX-|sJpuZ(cvZQY{jWG0 zfx2wBdl2$q27L#s0ja$Uw9AHcci|MVd@J4h8bwm}I=+6W8dUTPqnbPRW8GX0W?G7G zCl?Eh79E+$#R|O`shN%-(lpTu?2N|AB6eNH5e900Iz{eY=-DC2p zJKk_%jmmtn4q2kAoQ~mmNfur3+`=n0rh6Id1rx2POyim_9OB>PpYEU08q@O9sq@oa zrkiYoAGL#F3w|EZs&lK67k}gDnp&*vm?7_(Au>hiW>{6V@V4RjQU!}Kw^V0p;BGHm9cdU`y*^QU2ncwIZ-1%qq`?I4Jq^Dxf)4+`SzmID*a{O- zXGNdRc*Cfm-NuyU}2zBJEXfL9J$(%F~A+(R@~Wv!?#f zQGN9lcH9^uJYt2vTeyT|8Ucf-X7Ii$S5bmZ>|Ca5ciq+IwWgRaq}}+Y580Qj0@5#I zT_!e@rF0IxC7&H(H~#^80sGSEao$c2}azpjtm#*tr+08M1ne)Hj+XIFV!^E~1&o<#!@o*~6(W`Uf zuRUG;#zccyJ;r!~RfC!1t4Gh5Cjq@pB8FI>(GGs|v-IuHp1@EijmZNl+X4rrE$RZc zR$*C=0-~j)^p79RTg`Nf4CG>|^Hz*|VqfQXBuV`|+L`AyNi5iUD^;ho9tI1uLvOiX zIR`l(jhhy{D8}e&{1vmeU#dG^Zwi@q`do-CFKHui~1rYoy~@?)uF3`e<{~IOF3Yp%)FOU1iSc*ZgUf?^p-a zm<2N4Nx&r#Uo$(~;@4XpfFJx^q-(fx+UjUs@6TD)3f|gR;>EXo+lO#y9JUY6 z0OXl3!*?qEPZf{_wLu(V;s(aFg5>ru&$e{h`hXy!J>!U8;=3*2SxQ%w&ye)1;qrhB zuQ}{9O)47P8&EtZfp_*!q2j%ss+$i}R~fD@Z0>pX>q&pRdvi2LcgRdZ#l{EoqIh67 zr}QQ98vIo(V_`TZ|1(tQ#YF#~y;61>KU+5%IrNeJdSNR@=@($FGrhka89f}9;`kcA zZ9kKW_M>-0HLs@nfUROacuE7V)+<3@2Cz`MMZG8zOyU($fP!32vKjxvIDg3(B(Eg< z8u5`Hv6@!^C$byg`XVy={RL?>=gW8bHkBhM<=OOA zT*uyC@)a6A>aUnt&5pjAu~|ufk#q+W%7aP#!&+>A{R_X)r^=TnUDdvGf-g4hzob2tMgTbt3S7mGXXLSQRIl*KHEbK;P1;d`b_dah@Mp%*{6 z++N%Ehbz9!6~`+e)J&aY1TW)wRq5_^SN>lhC&k=21MdH${OH6hwK-naUA+G~04x|X zEt((Nz^)s(Cm93H)-uzl6LT{v!myU82Uer1yw@91#(KXzY84Yc7E3wxTU#<9;O(iXW3)0!pZ!AUcI5w(B%Mv{oA9B-kT)e%8^DuA?;{|7ayQEPcGHQoJRFpmC;V}Umcut>H>5KF|jRN3f&lM7_nTikDf1u zCx*qUSx~m;i&0hP)GZEdE+t>I_Tnu58v7AMt{mP1A#rGb8os7hcc?K|{W#Sm{_@0N8FRDB6zq@c_yD}lSCqygD(5G!JrTlIxuAmTRv1lb${U&&fd z02gB#2|DnyoSe?@vs6@6&D55)5s!tM#I32>{MxMaIBrNBiDYp#Sj~FfbsVdAbw)_x z1W3bmtgZ7uq%^lJRc(Bq;d*l8mM4VannlC()KL3Z0i?k-!uj3#qa?J6I$DT*e#D!i zJ-taAlG{O+qsaapKL5O}I?(fjNRggh0tsuvn^h)<;_AR}Rr>VeU9IsgkX^0rJgcIU z)He_B8Y8sw{Y~A14_A+;>YP1W>E*-d%0Ac`Ehb2~*S{D$ah#awZ}?fujr$?-{_>@K z)U{Wu$A`9JIZvm;w=RIXI^n(xkR_?|LO-0PG&+?+H; z;(~I+F3!Ta{+1U$Y&ScSrJz-LjiW6lvyJ|Rf4HF(UnA}k`;{p%)km*%efT-o>UgM3 z->QZp=)0M@dipdREh6XtBlYI%(5B-`>-q8TOK5eK`T$pmc!#LQ^z(imgBikpyFK36{+j?96r1D>tA1y9cpGpcB86Ym6uZqpnak&mBgEt4HxA% zPTLYA%wzdj*rK&J+=N}NRK80(sI}Szn#Elk#dg{%{#>e+y+Oja&!UU1ww5lHJ+8Rw zkDCp^HV22k=rAxG*vxMIL%?#1228e?pA|RgbZ55j7?L+1{ByWv}kJGsvAY82H@oY6(6mE9I zuor;1CU7K&Yn^DwzGUh8Dpcqri_AmirAk%<9=T?mzrRmO&nQt#6BIs&_I-XI0m9EU zG$J1_AiFzsjZSr-B6mT0(|B;I{!gvxiuWMsDsl^h8(xh0@FW zMd+a+5|soY;>*jU20sA)zEH^Y2(jM@K(>3=u)T<}Hf>iArHJeq)4%wLyw`O#be4=K zWHlox^kMszkn^G0^BQ||L`r){1Y=<In{4npWA(L=(_s?BeTYk^YmF4UjV*ZL!CU zo}$Z4pP}Bp<28k`Gm>%XnSBuy8+lr!8`CxB44GnrUAiONZZl?I4WL-7P=gF5pab8* zblmDs6~l@57`?wJsoNsG33$cisvK1yajeFDz4Yhyw{U^KdVq;R7F8+K7suZ{r!>Ur z&;O;3dj9tx$73A^!do|O6}C)UUlbR(QA|EFysJ%nJw>25kZu>tNxr0+^OS+R5~>@1 z=8l1Zadj2eQ;YiFLd*3!heFL~^~*<$x;BImq|HN!Cxis?gw4;wvwD~#r$%g#Z=R~5 zsQbQVK5I<3``F^Wex;C?_R1{ItG)5t=ToL-)dx@2*|54u7!*7tANdD|d*CqyCe(^I z*t#!o+G3%*37B046KameoHxowPxGxtwrbo{x_!nMpRt=y`bo5^#KYkbX-OCi6N!L& zOWtO*T2#=cDi&Ecu-}=J1KoD4>*=4Y>zQt60B+1d+a_St5&l5>Wp%pu_&qwzE%Kb` zb@%ff`LpehMC+}ckpeEqRy7ABI_3)<5pD#CU(8(!d4$N z5u$ImRz90!oY`m&lRgC{-+BTd^rH|kukhRJ241bc(K3d@cYAiXnjC0GP~#7otq-%+ z{^4ws57j%pJ^nuHz!#WzIF0lU7`WK@m7~Gwktl52c4G}BcIOCq`5h}eLp57PNqF=>J36QD@r^8y~-LXQPkJ8@JXWB1OfjM*Ub3OQ_H zvc`c6F`G&x=d__n?TON9<2UL)Jy_dVD`+SO{w?7zzGQb=O@rOvMJ8fZCijEknS^XP z!_Dp47VLcz>wrVy_nOlJ;rG|F{cmo>J8TZ3VUH}s>@3l<8D`%7b?|5 z&zufc7t=R_Des#BhI@)UTedtb$~fccJ>(M_sBFh=90xJY|Hk0;bKLclgw4a|P!C>z z`kkdp&pcCYzp=U)!bei5kbfdlCrR*_v|a|C1YAO&7Zn&@RM&W@=&QN^*QaR?6Lo54J=-7sKa~a%ukUb{nd=C{kUj+N;a6Ly!uEBb@uijw(;y#WKq`+%pI` zKp~%ex_$wj#%d}5j;<=0(T$g|&%i-F9;5H}2XYKXX2D#m2k)dCnZq*Plw#-vmgPkwd#rU7_ zH5Pxx_EwlY{CF?ka{qQx6OGp)&0fzn7#DTee9s|r+T9vJ3cNpWH^bo4%<(u!yJF6q zpYMG3V;dK_?fHu^=BJ-E!PrgK3a5j2&dZ4owHLXZ?sL^+JKs#h(a6`HK_b+!yz|e2`Gc_vz&!8%g2$+u>f$=W82Fv3Rz%Xff3fm}- zbH`h1@XOf}atJ??@E3;B_B;^6ioKHQy6dB!t$%+=rmpD1>Qa+k) zYNaGy1YtQ2K*vo8hMh~!J{0*x{Q8|Fm#aVi_n|<-yr1|O(|C6|Z`Cbl%FFiEuI1O5 zo$mh`vRQ#IurX_#!i{i^`((#l4u+p4{zft|dvAh93av^JrzVyARAr;Pf{Ev_NaDx$ z{o{c7av-@))VtQ;7)#y{Mc^M}2W>cwb0v`;37pf}5_uD1B7es^3`85InZ*vu%oM35 zZ41U6nJf#Gy1j50A@)Qm(&2UnMz5O|)GbMgA+!cRG2W|qbfRK*ODxw64o5x{P|onW z`JbHppWptgD=|#!CX%w3qNhz9^a|hd^6Wx<<>?$-!PO)bM6at|6;sgnZeX60YV*Pt z;{`3t0c@%+zY7s=MGvINys6hV2-&ceWGJSXDD!(aDSWlN*gY9GAwwj#AbZa^%`E-x zmaxZiB=d!@FpNOBLr`FeR>`O;)R9e=izx#Ak*g-&qPp|!R)lN(y_n?<;S32@B6Hdx zj1PM$v^#g@!*NbYv`2s-UxVW;dB#(oInJK{mJ6DD1C!WhcxWg$>u=sgK&cQO+pTSM zo(@3s-E5^LO#_*bium@RbijL(uT&V>1wOEa>d3P_>26#JBOxbdCnjwhSv{~Ls^L@v z`A+VPY@P~oqxXJK@MxaSaysi$s?btDw$@6=4*eU<;14PZ^P-E4m91cH!xGhd*}X*> zxIa%?`|sEy!-Rw&XFN$CmR!-ng#)kFQ=2-Nth2R5>pkOd$H+T@oavkw0W%2bhQIO# z@gtOe9*CiDBhk<5{>G4Jt~>(DQmQc!I8kl)4X+l}CIx1)9#Y||XimS(Cy=CF!@Q7k zZ(^p1vpHsvy^pP2g_QAKIJ-retN)UEB=k{JWoVJItY$}Kn8fAp$5r4fj#zbsRn30x zu6npJR5s7olS;FmCebS1mtyx=7;qPBaka6(u6gOR;r+Ki&6~vV(961q;!FJXhD@~m zPmga@MH95dh&Mp6=Y5n&o ze~lxCVcz!qZ0OBg`eYmFwquLA%glrZ%Ty$ZI+=2tnZVBGdN%0uv8-_A97#qa4Le0uu6c^+e%zzb%sJdzGZ`pA1tSQrGVVxRJ#v z4ptaUOZ`wQr-Y(#1eg^`tbM+SsC}-moLDkm#UtmiA)N;We!1P9wM@0#l2{TdP56nh z*g^8j=;oJOCos6DJrh+!cysJyBDx2^dzplN)4OrJP>^`_T+7T4Z|qhsg7c%tKMF`= z?Saa@~X*EA0+)LnJZC9)uV5h(Jk3&mtObjtuhI?ng7FkCA(i% zaXf(gL!-cQNfA?|g$j*Gbs4x!k zg5$z*r;$;jD9lA6Z z%xZ~za_>5OevW=3{J*phu;G9wsAyUVX6{!PNBOie>CGVLR<}JuaX;o>ZS>79|4!OZ zY=m=hQ{U&>>;W{6nlRo|Ju_r%yTir=ktfB~LI=8(f?8FqeZindmPIMhhjebZJShW!238#3pQKncQ(dwWj00db3uL8QV|ZLVf5n6 z{N}QK1BN_m#3K3-jwAR+)z-)GrTkRI9rp}k$YQ7mtjfkx>a+g8@WiMjg6-C<4z4GR zAmpl{8WS%Z;@4&A7Ot18;^c0==}@lr!Y9_KToT)4V;nW6~d@W=eAlLvo(%0r$U*hi>*6LuvIx#J&U&g$Q|)Eoa&gD~W7sZksAmENqG zKE&}%5HB+x$O{h1)^Lqjym=i0<})7Er&OC`PJ>6>It1pgR;jpH#n0C73#MgS^3tak z`5Yp=cRVn$b}x7*?nO8xeB)bB)!Qf|szqV(k>fHIyInYKIm;gT(6prsm6H0HI3o*O z6evN~$v}(T`*%w;?jZ@2gbASTzRo;c{Z=r(|L5oAQ@C>YRGm8CkA2lW*?#U)!v`xFk#w~B znSm}4%V9$?AhuBUlDfWryR{gudM`n+(9pgv8sQWF^+~F~h*oC{gJL+H!XpsDegw3}ky%RRHCy!)j|ULJo{xWP8k*#siv)##I~UL* z_y<7TlSXt99>T(5JTIE4Sr|fkAm6eLqn>N-xpE)${}#eQHv190eo!jJ7;-rJ5QC;b zSLL~0{Q^}{EVc~8>zl{FG*pEnyxX3cX{x^eMQk%;&CfpYb)w8PMjqy)L?>kRHNGsA zf~VP+*}SDG;0gA#U4IvppD)*gIqez!5a&}AnV;+QW(kPT%vX&1mGo79bWR-~O+9#Y z$bP0_Jh@ z_yp>VhZ*XApIC6leR2@_6<_>Q*Rk7BZJx|-L;>2)EGKbiJYR0eSdm0QBWFM}Dv}cX zkQPc;zqHcwB30%0C^FtzVnJWhZMiRz&IK0IcU_r1UG{nfYesZSee{@akc>ZrT%XdE z+nP9kPwCfOV#z16jfP>WoJzl@+^<~8p;<~_<_2%cbR&ke_+RC^JVr_;8>JC#0c2Qz zJcsAJmRF%mA+P9*YCHzgy?=0KJR!cJnanL>{(a!bvxX4%<^hmh9ajH{ktV*ah~K1X z*Jdb=QK%EF_n_7Hikz_|oD1z3fh)n^AE(SO!qS1~mv6P-k*SbBgXOApri0A&dh;ip zFT=A z84dl|n!sb|3l^sIr~Q_O6y4Yv6k<+%iwp5|NY4n{oz0L(*`#LpXEHOzqFfC&1BKa$ z^8?0jHp!k1Fim9*b}C+#I6l)5m8;9S-(ZMBc+pbK*;#Cz3$~5wQx#ASM~R)A;mpJIl{^58cIWm%f{J z0ak0I++uRoEgjxAco@vL3gCR-oF@_IwpWz=&+Yu0O&e)K29_b~m_pMDj820uy{tiO zP};p6umTRfOvBWQ0_Z(ZzjeZ*rZ*rH092Eb>{a`&xtq}-3U^}^0ifC`k^o%jXf%Ox z75mf;#A*96 z=c0JvPbHKX#S)(OrwS}{BU16o90lv>5||?&>1;q8XKoOpUP(3Ao$q#U$`EpV$D#Ys z$X|q7H5(@}J1yo=pNU%wd%5P)e_IQOmoTqC@v*7nHJimtoCQiyrE(l!Cu7;CQ_xvX z`Ig?LU)o>S;&2t)POlG-Lv>t37Q!FDiwrmFjof;>ne=$y{4_2aDuS~xUq6Y4Y0me5 zJxR6_uK0NUVoaXRLWOL~)mRVzp`i%@+EWcyVzLv$QBFWN*Oo5f?h zs0XVls6Xv0Te;>OYo9jBQioLk-tB+%$5wCjp2kFkQ*n{}8mT%E*X=BtLyeIZ6tH6w z9l98yl)C@>6~LguA4>7!SISHu9tz!BT|lLvtMzFl2kS0){o}W#v{)B(i4x1&Y0!WUd3yr*Jy{vfT+$0#A)f6~QQoCtQeIQOxDIQ2uL61(};K zTxq-L$HVGOXgyQ$FIMD}T@c1uUum|$IyQd)`qS05bfj(8nc~OnmGKNyJ*=DsHoL?d z`0TM*h&i5l#z5v)n!e5D-uUI#+K$RKXl0~D%?M3M0Mh~*SkWg1SAaw^>B6s9J@brM z`lhXl3)G;xa|@$A*8bV}Inc^a=h$xVtrJO{4*+IvX+9a%{3`OG;@Mk@_v)j+3J&hEQ}Y zC1m}jTsQ4X`L$oK@8D9IcO^B_Ui<&zE9ai=fYlUbxUBv}o(zaA>Q6Qc5xl8}LM)5F z1+zbnG7e*KNcTJoV8IuV)o&}Hky2tHxXsb-_j+Ectwa`O@GWfb+bgoRdsXJL4n))FJ)467?@8O##yrE(wq09&UPi za4@RxAiudOvAm>XwjVpl`O49e&EK2l#<`~Nkd#MJqhFDSWT^4)Yq~KV4d{Y(*;ZiV z!+Y#M#CmBLb7u+T@E0`$Hh~nZs-4ccCrvpNRE}!9jivsTA*~rV~rcc7S3r9+Smglvc(*gt8b|pyb}If_FV`Ie9UG3MMf==ZoaOHCwC}q z8Q6bQm8n~sAZ<#v_mXeCwYykaM$TVq-ymDOGAiSjCz48 ztHF0(J30V?M2Jkq9{($&=1C*i*k9-R-nTr2Jw-{q-x`@D2-9VL7|4^?tQF8r>PbNw zMaLoRa!>jRvCk*f46`vO>=Qs@KO7Bj;oC`a-sI`H4U2umHkYEV-SFn1qg=F=#+wFH zY=97tfJbk}Y_fW|{_4_si}@oqflZ{=c^;46wp0v(Z@8%zP8Cx9L z^Onp)JQ3uqon|H-IoD#&Za)sNCO&hi<`werPD8IFX?JKJ8$C`KHB9pJH8YFDf&{FN z$i(W!)j)8Bzn}gPFJ9dZt=%k31WVp zXC~s6pjemzNi&~P-W4Fz47YnGXN&_@?5(5&2vNJ$s6@#~J~?K&ZmLhA)1;}kX>Y|o zY|lJEw!01ys%*czCy_`B`5Y=~{{XD<8|-~XDSG_5rAc%i zo8GkObG0PhK}y0eOa_Y|fwxt@D#Z)*uJHj)?SZHI>H#jgZ0iHG*p>N=Pa^q|9-5X$ z70TsJv%nu`6DuJvJCbJSP0REZ`Ve8jI_h+|^5y=8S>R8V6DDk~vq}}QObZtZ9H@A+ z3Eg-)RDx2%t@bQBfydR?uHX;n-mr=}rP%ija9&MW)fN8zA_zgGKk^9}zi!fug-~bb z`&klYKmG5dz>|a0hlr^<~Fl?Lu2&hlT6khv@pe;CK zZQY`QzT6i)wAL4~lFpC4;MR|R3b4^|bisquRc1EvqMD_t#fD@sA7`!a=qbn3J@Hg@ zMfc#EV{n?#<0t=HBov^Ya27ZTcTLkWkv0#CWd_d#EKa3UJHm3}_#_I4U6guiy6J<~<_T5Q>rbvx||g5idvWJdHA2*V$*{eUYImuMd0xvgQNvUX&FFdwfYPb*!r ztxRM&dgHN-tqU*akJisF$8~cpZI&7%?6p&9j_5TPq5LM#R8D_s8H((6sAd0g_9o6l2v6Tax2N$5v!mZQO z&f{ErqOc5TkxSoE?@8Z#Ta#(qTrXhQnPL81r9q{QGSshZ)0flVLD=lO0;Khs5S? zF+si(z*>a@d47DjIV)Nm!slZ7fn(_XFYz<8M>4RF(^r>A`JH}Pu3kc49c8NwI9IZZ zS@e+uw;)sUYD{_aIlG2;5*a;iYEPoRO7+cVg~0NFOQ2B4vThitZ1YU{3r(&k&eRWB z@&$z^IrSMW53fBUVAJpz4!z4vLlM~HUDi(Tj@EZlt9ulGbDXnZi%I(H|CK}q7#dTP z31*?l1R~>iu_xXo>mOuoAxgSHkAr!dGKSOI!WNI~n(rhK5PXT-C{(3-22BD8 zLp%AkZTAm=XXe3-WPp?=fX!LA8>8tJ81r%CAW?)7 z-6rTwA}1B~h&(@T2%YDL(4A;`WdOhlJc(tg&G6DH_VnIeTl+1Ab6qm5hw-j(H6 z-Q!35MbFxU%0@qc<`tuZ9H%G!4HsU?ckVGvBb!p2UgqHYXU%y`~?OMGV&HuDL z8KIIej4?S^Etvc(Pm1Gt`m1Xy#nwFbnx0`&Nr+`$C_ajIa@7<^KIwuPwKLYIBNp^r z4>XVN9&EP|)%fC%KNx#IcG~LLSN2|4z(Mu!!NLuu_dx8noik|m#=X{CsXd1kn5`<$T7ga!5Qf$FliKj3o4TR2vqK;pmIx; z8X{W2#U>ksQ#_RIqr+&?tx~DC=P5ZqlXN`c$t*Xc+~Iru`a)Y&B2a4&3d#F~>KN+v zI-?0+a%0lMNm2c&tX#+ednjVzK@3`-aL-6HLBW-RfhJO`RLcE$7Kf8 zsG(}B>NwGe=ygb&_K3TI_|_VWqdmKg(hCG^5G@l)By9l#D!+;R?Zj^F8cV804)88^ zXufUvHvTsXCC?Zd8N|tUk+Q80Nv%ACbP`wRwxa`0Z$=F=g#8RQ)29NmZK3CQJB&c(pX?kb_B2W~Vx!@jWj8@D6EnD1;1P&fks*vLqr zZL2G9cx#AV=~d^llRy{AV$=6%lN64itB2-xG%>@O!iE*Qi0vV6+bY58KXl^=>hcIi@od1@-CD#L~?A+q~You$+KD z2A>@_<&TEj(*c$KmfwKyj6B=`C`Rp$ZEtP89PJZis#9iVv|$y$E3YQ%rpIG+>famC zEguqz?T5>!;YW%M2^6C!u+|NccHJ&b6c-iEHh=GaC~BUDWG)q-LY&Hc==aRqz< z4fe$R|Lesu7TUI}gs}*swh@A^lzgagt_4RD*~$8?!zv=SsY{u*5DK2u3%nE>(6*q+ zFrlX915aB9ABbmwN;~*~DebXtMNq&~(RhdinCNN2743P9>>o_Rl@g;Pab&1Wo5UKc zaKCbEcmVF0TAQq?z}rK$y=JO#yYRiGWDq{-(%tLZ=@h+UikkxOAJ&6K;X%fDq`&M< zPexHE+y2o#oiVfke5ZvL;g{auuU%%Atz8&ae%o?B;@$1Ch#*>yqgLE88-k;62$Ec{ zOzOvi&(A*enzr1XIXVT0>W)KRT?C`N)0f)D2T$VRC@j!5j$#F6AOExY}x?*Nqor*Wc*69^{iyKRY!@Fg-8p+ z_TTcPCd0X!DnbvA(6$!EDsE%D@0CJ8L(W1AEuQyL|FOmRoksQ;CCasmxcqVbec`}mWl_R!JY`Kica`*tgO1mC`028`!Raq$gdn3LGa?}Y@K?d9 zv)H(WVDBaQz+l`7n3~*xQc;Pdzeb<_&WpT4j-Q0$(j3(RmufzTGjKFafL-{y-*7gB zlx7FYM9$Lnno7fYYy zTdezq1z?gr&%os-n}e~AWc^cBwpp%VQboQ zkU)L_)!?l{S zd0Zd9&fJp(gFFDKf$j2?+ykpx@FYe+GC z@iVLd)s7uO2>vRwyOQBn)iNCjyE9!Z@%Re2{u0zm<^P3uMW6;!{m)!}BRT*CZ*b5T zgyF*GQgHpa!N&vBrLHKpdg%P~+IGDea25tmUr`JCgLMT(9!P?qW#nd z4JYvpI~6Oj<=!WF5V4^5rIrH;Elp?FT{SWF;HMTfI~Z9+@*xO>_v{cJH_CX}HvFyo z4!Qd*75A|dK9c%%0w1zRCOw6AuY)nHlBklRCfLDWER|1s-Sy&Nl(RCDXq4eAo;QZE z<-*DG)p7queKLCa@@~oEpWkt84#+3M0HZ3yZG&Hgj#0RuWA7ze`!R`nQ+q}uhAGz0 z_3qQ{-1f6y2kpu$z-R0^BZeIxx^&!6+S~uBdWI*^qa~vw0CO37OA6tT0}Qlcgu2Mz z94!g+ker+QVA#))^urPLW5&|AV!77Q1TzdC_7J}vhArgVj^rDBhP&U$Fh#y?5h#%zvz(zRM6uP^GfT`o%S{! zBcTORsb>T4KUNx=rDfdY@q0)cXAPKyqz1`(x(<;;m*2;Agf?{MFZ2p$iFlVhKO`}a zfd2vvU3QegS?-elWre&YwXA%DWgao7{>OxX=SsF6Zuxqt8ItrvB=jpVJbp<~R<)ZJ zkoBIAA{$T7tAOhtN-9{G>>8&g9>BQ%L;N~jG#TZe34PE22pT*%L=1`_aEfS%&; ze6L@$%8&Bi9v1zk;rIFOz#VtRz#$RW(|wnyhyEw)wVzxwLjlsM6o5#@%5@>yg!*}$ zd-{mz#n+8gNYmJMVpwy@}6M;)k$e?R#kPlG^uYTis^j#*SK-E@A@G~i!Jtwxcb7T@OEphi zeZBoYn5>WfdheiqZECcM)MW0AXL$sFztBRF4ER2IT{#^AzWMnt%IJIz>93Ekfdg)k z%Kz#m3mv2=mR%2be_;u}T|S%V%&_obA~a`0|LQ=$Mn8^Qk(SrUUtax(DuFjm{X1?A z85yQ=t)RmtxW)9|VyNwY%%PlI6~8RP>fu0J0>S-}I_Jaj@{I{}Fn{S=#5%=tY|^|u zp}P&-32NsEPM;VHG=ky_7Glbx`VUhwRxBQ3LD-MdY`^=rAbVJS1sCul+V1xs%4K-j zc54?JcWgFBTw<`|yrpw)J1%~sXudIScd0|0xk{iGSnu6NJAXE2l5Cgv%%ziuyihLA z_h{95hnVF@IWh9txmya!{}N0GBOI^o_p(Iq@wK>h~w3#iW zLCy_)Xw~(HQb}Z7DharX1W~G0Sxh}sPuz3Ol$xX(W(!gkFh6uji(geS`Y9O0)F*%a zPaKWFKVjI)JRI9se%YTCbgpf!N;e%vWXOApPgN)%Mq@`h!X@B3n@*jX6K)U2gbJ_C zAy#DdhQ*i7cwCkCv|bOW?jHvj(ZvFvj_I`ILJ_jG{eFQ6&WF|gtek2-&3+;BqnGB% zz4x8y@?IldVk^!6E-;-PpOWg#^0O<9ew#W`K#%E-p%LP?bW4GoO|>ZG6>*hj5AZyAXCe()@h6)#gw zkxu^hJcc$^{p^go!G24TPm@VdRRod)iivfl4`lY&OJTsVt8|2 z+jKXmwnNleKLNzTvc9={*_pPEK$1p`ep77q_@3gyc$t-%Dw=_-utQw1&!oQ$TJUYM zy=-KG+_5av>`&5q?EDDDT5K-3fp8eCi(R8-`6gx2(kfb1*A8rARrCWEmA5f4HDA1=@ulVHllQ+bVzrnba%7q?uN7W z_xJUE-+S&D=bmx@(=kNWXRS5on)8{@eCC+fJd@eqv&j?tEQKOY&7dr~j-~Jwg4Z8g z^Sw+TFF;BVXAX)8$o=}1GzjKnBR|rVB0wK-M4?Q&Jc)OAPukTBmkwev0DoxVr1aFo zXiJ};Rx+AHpX;QA8I% znR_@H%-AZ}z`i7+9qLoYvD&4ZcAMfAxGNq&d!e3-Rgvy7Qug720uq7bhk{|<=^!w@ z-BMm8-EO!(Vxh?wKI;FnE~V)?mTR_AXHNNIM-Wv{NVFRNV-PW2e2@cpaky^j0P|iy zjrnhA`U1^MRkc`VO#sBySWbm!>3Hh%_OFyRkD(=E0E_crqyg{|nFSD}Qfy1XZl+0a zSZe<8DyS~!Lp}=Y{m~LaFHUOYzc2#5P^@_0XtbVwh$&JQ_SpqvwMf;~&Nw#{<3o$J z>b@VodH3~GK?%nI(EugH8czUDiwYC_?EgJ%zqb^b!g4PeOAMM)K2a=4t{peNxAN)A zb>ZzDFTu$YK68$4*%hsUR%AhbdJK>#mN~;(BRJWp;)r|(Yd0FjQ ztpC}J*O8ExrdTQRl`udNtgAhlG^c__sw0y1EoyEeRn>7Y|o`0-Wf5zAhd31;F>>mXtt0^=_9JUMB8vtH*v!I z3jwVaM2Lhr;SzL|N3nFw!fFfRqZRv0Ta~Mc#R9uEL#4|kO6I?&h2Ka+(7I`KfSQ3L z4-V8ntSQc_PEA~A)sf9puY2f-`(;u(kI!Xvnp|ZP_xqDq{OyAB4HP9LDtYRkkZKk> zw-;kOPE-n&cujJp?s_=MZg9v{xkY*XRhXwq5+iKi;OjhA*5@$smz8T~Z!%t)H23Dp zoRpJy-@A?c4!yv0XBB3tR5E#ib9XX~=hK$xM^4K!^NGbd=*sO@-%a-yhrNTJ@7h8j zm7$xsoofHq{6&NCAY!#K%BjRSSU8KTK5Wj}KwRJi) z%07DGV9~1zv7-;`{@s!=_Tba?&xRV7A5TVZh9h76=&CKz2{t)#{T9Q^wnn`SU7ra3 zW#1%(MFe_iqNLyR|0P)1F`z(Sr$N!77En_ zBuP*+7Xn2N4itO&coFWgv1a*4C~=VJGnA%40kWly7^B2Oe%qDrVShG0sT9AeqYJBg zF80x%l3U1ptD?{{v>KF7#-bBqN(`-JS8{|l6);x zU{`i-;b;H&dmlED_hE!Gw-m6gUpze>W=nz{KJ-SPm&4p9;X>%)_qs!9_Z{}CDD&fd zL}RG&+$k)ghc~xDxM4Yp;ib@`5x{rFRQSX{`pdirFqW=waDhZF#D`qf1w&pT*AqLL z9pYY{-+jWj-F>I8!tW$qw6cABe7S~r?e;mYU@({l(fN}zC)z@sdIhEX9T}6;{}wm)w{aUz_BcKo@;^OTB&{ajQ?ya-h7I=2RUkyv%rUa8t!Mx{`>Kv(#iPH zaweG$eC)5SJS$IYw!dhu&U5_L0cJ#Kk*N)G&oxqZdrXSpapPa?q?b4!T1&^O-ZL)EkieL;cS&l$&?8hXKH( zklLLRqwu-=0jWPwlshlZ2}vxjd`cNE82 zE6|7hSdufb5{Cw-=N#0w`gFR{O#GiRM+1h1q`T{>G?0iu)uT*S;_QV^dVgnZAXHC{ z&e5;xHQQh|d63K>n#1x+^ExANzNU5JZt8=F9 zb$Z&DjI$E1U+hE9kOL3HgF&FiXriNHipW$0L$<>?m6Zb*l|QC+H}*3#pzgduB^f(1 z;c4S__W*3|GJ#6#`AblBNq~Fj>QAFX+mBy82iFG2Q`H!pg&5Ckr7|F&%>UFMgZU7} z!_ZmHaY%vp-2SHJDq1Av9`v;zq(5vT8cP)`4cZsB9*ckj=2)v5MFI8_(pX*2| zL&V$~z0r2eFtKAA3dpClKM|p*p{BAO3cO5`;e4pD4@kfQPjR8`yT!P_f<<0kNHPN3W;AU86P6gRaQCD6b_VZR(6GuONj>GizI!E2&~E|+H|{^i*6k5& zi0(-Lr1-HXo)Iw^WGSV_(u|W#^S3gy_7b(oCtgNPL5u>AuOE&j9@^^Y5H4oG|L)kC zGvE(qBb8xqyb0i3!%}=o+)D23c0?-AQh13T9pcfgZywps`lL}{vil}I=`i9^N}8s# z-~Kj~{M1UE6{9zcb&Li%{%p%{?(VPpiwtJlSQ zjcP4QdtW3Q4m+|ak#^Soah{ke-QQ9-wZ^pp+CI+t0xe>l17^HoxdK z6%mqwfVh(#S5n8{nDKKnkcT@YEvoTJoipMc*zsz~ zCKt!SuGCiO_@#R;Z<#=aEt5tpw@MxS~mxWgwcoJ2P~P=BD|fbnK)Yn)31#&`l8vJ8I%&Y5Sk^tXK?K}WZT4Av9af( zz&GO8XCX+Pmbh%f>1P*qWuEO79cCR*GbQ-BD?6F~+U6l1ME5cGm7g$z)U>0p0kZI= z+zY~VdAeIZrtR8Os!zRaeMiTtSLQc*Otzi2*@o;`km%8-s_Ibr5(^(GJ7fa*(8Dd+ zI4vjJ;Jw}tH>9vJ21L=}o#XptR~urgA3H;DGl2xfI4!4mubeDOnIr~+5776)nE%q@rs+tMR6wo@1TjB+s2j@OZbN~&Op8F3-=J6lmGsSIm#pm#d zhn78fmMNev0W`hr#mKwyv?-kt_+ydH<{{_4mC|6l?NRZ5;upoBQ!fc$?MaNmeSc=K zooyz3Yt z^`u;MFbs3K{!@*yo>qgZmF1E!$hcGfN3XjmrPn4sqKFQ)i7(W`1{RcsY3N=)=TIF& z!r#P=sn?k3nTg{gia{eP(t7o+eD3VcKlLsJNyX-?qDmG4qHORw{thU_e(FzjmqEz5 z{bSQt>d;6QoZ01BL$vJD_SqhcYJD5w7;E313uPVr4l>$H4-ndlaBV2vXY=q2cMKUw^#Uf8wou zL`}VIYl>;*l_a-n#HVw{5(YUF8=6VnW_^5^u(pK{`MiP6)HZV4d;dWXxBz3|C)Inrj&d`czXZ)=P1+URYfj@*GniWJ!y&{=P#7ky{xK z3QS(5pOKMm1}I&xerKp3l*A@9?k<<;IM9`zj0 zsj74slyYjk?)%%23LXa^YnxhzoC!1xVSQ^41;l&QgQv>rXGX|+a2^UZlV*btzga@r zU7c$@l%IJ0-j^I>Z#(Z}Y}Ta@@zeW#hstgo^l0U|YEQ@HM<_LN9-NQ<>OrIwjp%D8 zR*2CpU(mRp0S%XYe2IF1X%t)vdc)0n<+-b{U3Ur$#aW+!#Ki$$&>?CmZm!o^1)@I2 z)y9Z$hjWfESsp`tJ;$wrG>@I~h3c0tI8GUMH7lR#b(%hZvuwlg-o^BCMk#F8BF@&!4Ki4zE?5hwF4dMDUGxy5*S*AIfJNpU>xE@6{ z$@&T1-aYN>KW|7`KKhdZ@VT9=CTaGcyE}ppVo#VZ2i^D zA)kt)&;gT^A7hT(=K5gL(fd!#R@151seJ@bNeH=5;6tcS#3BG-me0$59mR!c{t!Y6 z^Lq8s*Y5#YxJjV&DG;r3`YGkJk54Oo7H$3wox3YpBjsFQpUeV7Ov!`EGVffA*5!Uld6r#B3>X#V5)@{MqH66=0LApripRrnMF(0CgObt za*YQTN+4-MG?bp@b@qmD9YE;XKp zq5WW)GfKnd7c@zI{n#Yawx)oH$Rlm>{UN)!IirTq3Rz3wPIEc#`#!! z1T0WpvLnl!I_|T={AhUWasZioP+bcO88$0<#Skxakvhcto#~&ZI4-pXLXoe*IYx=j zZPyvPi{EyO&v9bD6n?+a7Bge{v3s_!Px+nzhVm9=o5u&g!{PbT&~#*h5ougE8afW8 zwTPyqp5IzDm&v!JFuQOiVY!R%ZCTAI&X4q&t+T7)m$5N(MYf;hWZ5|OuQp?gB_Ng4 z60l_jPq}pSbAshgRGeTnnvk>wS1UOc1gST_|xi@zs=zz1ds@eCu zTt|@8p_`EQp&cK}ov3%?Pt;NN9k@?Nwn>@O56!(RGydj%!uo?J#6#LsDk6f|>`WMO zY6Xm$Wfb0{!a>pB9wYGo+Ty!J51x@vzUl~P4jm)RX4c7bL2xr{y;uJg zw7caQX*z^=b`2|DHB;p&BHIB2NIR9Jr?>HBteKG2 zpEaRL%Mb5ap{7g^dXPH5$us3q3o%5)Edz>@-weAS6F1Dc9V)c16t+{^rrsN*LA41# z^ol=82oyb1_Q)aGH7-I93bL%i!ACdo@q2Jx!fopXsl52`AhkXUY!gR{zY0qw}F~? z{>jI@Jk8Rfgi#tgNWIPpiy65 zdIkmGS&C$l>p+q)Dd7QiSWtf|S$tSub!0y>ue{6JkX}khD%sxqGqC1hNXfkpK|fP- zeh5_0oFA<1^P}pqCR;5vp@8@F8A^3B)KQ3Zh6XWQ{ntf8yoiu3ZBoylzVU_P(UHcI zp;AJ`L!X%9!QN*o=ik_fd4!wNbNgfBhPHv3b1F}U#(Qi6*zunR@(QOMN$!>7P# zy-T4-&@o{?X5zmoy?8PP$N|W4@-X%lB}+C3;S$LOL!tUqq_7%YNeM-U90jh=ijUCl z63x$4r9j7M3!v!i#H6tIavi^Hf<%h|Co7B(Lw6!J8E2x+{ACAp-rtYhTL}*~;cE8` z^#!5Vv>=>QjehSADeO$>m**>qe0>N%gpUic(wDTWz#^W{=~|O$&y9N4vv|su1NHay zhg9aIq?`SBI0%9@I)o`9bnJe_h#4O2S<|PY$@G=Mo^78y-cF+ik8IzQR|Ua0`H&Gh zW1>@2zxa1QO#yp@Pqs4(aX*t78QI9r`wLFd(Do<#kO!SpFM*3$ zse62ugQTId3vNqw{4#0a#fOEkkH!p&Q_FPND~M^bPJoVnghamO-ofPzJ}E3IU(-b8 z?Q8UNICGv&@*n~btD~&(pcxC)e-jW}f`Ne%ixNUN|>0y|7X zn2==-r~r@3tYipb%n^R%W;iAtj~4T-ej$m^!#F_6E{!w$;eYPPYaz%(0+>ZeQFb!U z$dGMkbvg}#w45rsMCLVmOfFB`2cuU&SQM;=Mm!%6*FA?7)f+xlYgW#pRW|%^IHhV* zr}Qsn^YueiQbO3*BK7Zn{SpF?z)yuNSn`VJvu?)jd@Y(J`IPXK{-1UEK`O-skMgRJ z+cK#^3L6<&f3NZHX9@q8yP_A*Kg&xcu;T*9MM@j|hp8?tw3NNmR7)NmTxSyfgr_X1 zFdxnGhrszQJ+PlOr8{$fK{K!@ORf=Aa@<)g7zmq8`-6h z%C>D5DsYlO0A3oLmk|HEC{L&PuU1e%-((zt@OeNtzt~5CsKv$Jt&>sz_L|dd7 zIU?H}N%esVvNOC;o&dLq*<1(glhc}pJva*1(sD@U#>Ua#8}*RN>x3QwHtdWgo1g?0 zxi@c2*~ELl^#H*&Zter{LH}$I%qL#{Lz;qQ2T~1#7W|60IY2k1Ex+K!e?SLOcKi+k z7(W%vf*olF-DShY8psy*Hq}yMXvUMAkiwCeLFDRntHFv|B<8ZQ!0*bc1$Lp5pp_-@nt;?+YKsPsU~pjXJ07HAOsV`&!vNn`^`h4F-}kXq2H@3y{5AKdBqtQ}N|d^mk0!T+`^djVp|63Wk#Mt|Kc>TJ za#5^pM(cyW${csK<3PBh0Pu9_5YkUT8ibSRT62s6^{X#(VI7whC9DoxXY3kH66plgAQUC#&1p(<=`u|Y`rA|+ITC^IbO@ZTba>Rg?>5L7e%aNd$x2cl2yYH9cSy5 zxHI>Wo_Wbb>^8j3O;Gha3o?NikB-z#Z-BAAL1V-$?z6|~)lO>^^`%I)Tj2|-4lTCt zRewbf8jhhzcPFy4RvQSft}E-;O7OoEWQM%X`bC}NKm0VItQQ|DAqWV+lv)T8&Y+l& zCUvSiHx$o@JT|2(9xec!Pwb1&8~+8ckRWf^{S6nxLS$P~1zH2$<2Z239)$G1dxF9* z4j#sV8X5!&#&!-q@_vr|f~tgQ>DUvYAia{89!-C~kLKI(=Ir;RuvYUoLe=!(|1%5z zMhG+RDE;z>sgid3V-vD7Wb!^St0s~VQ?2%VEZTKEnym!GOOF~X2M?g{|FK3qq)p}I z%>4B+cqmd*;2u*5s+#3|(5lC+#9NcjoA zRmFif^1q)OmWYx6r*C)$Rfz+In=)C6-eu>QT%vll_ugj6uV5ENdYM$tA0eWlU_`sW z@h1TH_?(P@DFT(l8$fHOa5Ja(Ur#QNbid4iM^#Fh2xxQbqd+UR8c=V8#7l~!ac$q9 z0JA%`-i=^TC<5vEIFPH|ny$2E>CB0aUYq#wk0-Er_Sc_*qein2_&@|D2I`L?;QQqA zK-@%HUAOVCo?olvKYQr(yVoCye3u0#&g}nlNQFp`vL^qD7A*g_JJ{L96sr-WISNJ2H{@ebkNwWOR|dIj-BSNPeqQ8I#)y&s^Ou63By<<5R{iHU*8KgAa9V^x z5$XTY2Z43yr4|?wBi&+1cppA2GBua79888A2lT;Q0C<%F00E>J(U+bNsKP^b^F<;w zWiLJ`56vJg7K}Lp#cz&kpuW$dT{C_khujz<+%05|KqfcHE^^<@p#SN1g5{0seLGiIFdmD|mtO6$>W+;|N9ffkmra@w~=(L518y_9)!{>+>%1(cErS*Qhl8 zl?SGdM?O>21ETZg!tNL2plwy%pw55y$+VbnQWp5zB#{2G82l;A^QrS88Mo>8%M`tV zIm4maMTrc8@9bb%q`ZlLkNyAeMMIv~HuK-OMzZ7A2@zC9D?$6;h{kJ?7EX`Ap%gUE z`H*M&#ZOc5Pyx6jE0rJf8~@z9u>bo7fLLu(vg3~dz&ZXar1>vf1J2|BBX(%>At!~I zfe73FuShZ`60WG)? zh~Z8F!}->MAVumw9&e0v1ul`0jb-0kUps~ORXgsM0rUGu0vvD<4wpJI-pLwwwo9M) zCW%;8J8TyL>|z%58ybV;z5x3%M@u2JU)gNq4g=75ES zW2r|N$^5JZuVh~t@|B#u074chhRaX?hL6r5)zf6{+&DJtXjKMzb5{409F;+FCezrd za_Q$!Yl`{iHhftVsSGrAYxCb{bTr$(w4l(iU0rg?+Iq?uWX{#VV>xXMYSQI^j#P1i zoQtF>%GgtCoh%$q+>ZAe!~+MuXPkY4`bdSiMqz6cSr3GAaL?ux4k_%-$twm#s!&>f zA=~mv2uGXnM*r__n?yV8g4Wue?ONPVD_>Rye{?!`PUXcxDviU8T_?eTCc{eI7j_MQ znr~MGUVbeM<5``UfblxkWpNOtAIBg3!7LalcyxgAYK>&wh1 z|8djQs7zpd4NQU8%yL4t-04V5Zvl22S8>-bzl1ne;bE1Q;+xH9B9EUK^p$pfndB$* zK?PQoyeNU=m7B+q6K+NiLb8I#tFowJOzG~Le-gViS-&(N6f_=x>Ha6htEX0y>=@A} zkWnjQ;zi?1#OQP+>gX{TQ});i=-Yk?8xzJbF@_B0ydFP7lGQHKoGS+JoJlT#wlX1RrU!{Le_j% z_xcjrs$i1kQ-v2%-Qg9H1|#0QEAJk7<;e{`1I6rW`)%<=mA4n)d9?0{_-H6Oo`2JN zH4gXmqFz!7y7h+vH*bz^H8t!vVp+6tC`x#b-_K!VAWP|smSykSXkLz)q;{3v0PC;9 zd6n3TIkxW&Nz)`dkt@&JY?uU=gm(K1a>91){;+Dv>+@+9ix5__5U_8;va@2C^ zJwIQuWb!)vuH>WXE+Og4em`47f|a)|?qXYy>#Wb6!hCjl=yS?0ry}cxAiPb1us-Sd zWmNB*@)F9IpuMvqV{U6Y`q%80a8Z4em2>PEYsRLp)6WtQ4PxHoEop|Q*tUTgzrJe0 z4rOBv-4Ytq1J8%pmK{7anLNGW&C}%d8JDMB2Bq&NrI-H>LwH>XdB+BAf6Kv=Oo(BB zbA%yabAxP9tya)nl$KeHJb9AjuSl2Eq8EtG52mpEFkqytD9Nylc@}^YJ}hp5LCaQ!dByBYok)J&$HDu^(ugo^=r`PVFQJY)`pgT8wAP^5`M3dGy8` z=zgw3zOEcR8FlVN;!y5;AJaTl$e_g6(NX46tntOWr#pobCg$(S4hD!LS&mE@lJiCrO-B4RX^{@&hRK%Y7e_`nO`eh0_5e1cbBZA z%nO5_4WiWxehWNK^Pjn7PGrxPwdeU~?a#ks@`!aT2;d_l_g{k?O#Xj?5=`l2A&g4Z zkAvGG8OOY^?60`qm(r16C%5q0&D^j`)u*#dJX&$1%=3MJc)Weuhq z?%p%s>kpTmuld8EL}?~*|Fl>;@H350eW?La>@Y1Oj^+!`HXOIx1o!I^qN!5bD0k1~ z(a@w9aa}Xq?^JpSnfdXm&Qv8Lx<1_~>_uvA{@W~Vc;r!nw)+L+T{lsh-{|8C z`fZbI?E2co)a#k$b!|(6eg0)7L|H{KJMK#x8}~V|?%mmg`XNzBlV%wo=Tt zJ&G1KwO!s*IKdkxD~9up$cE-cJZffr?V3#YJ%FaiHG0+$s!V2)V(?$=F9#8CU1brL z>78>-Rd}RP)P46jC7@iVc>m?SSSvG4kcT*_`ICN-T$kX_KkM(R-jK|9i&uB%RouajSjENKiIx_S(E5ImJZb zd2f2Uee3r>5xG{old2B;qXOutf5hs4g3V#xVWs;?MR|I*D`nAuE=_` z+x-Ha5zj2qA0Ef}5ZBESO4pN28TdMm$0%{8c1_py%Ilm5if`&}TE(!o{@ogL%v9cJa2D0v&fEOsi^QK3qR{s+G`Tq2;cCO@8&UQnY-Py_Zn!88lA7 zH5Pk2iRMvy`Qk5wIwo;emzUR+@^6()iv7s>If%cbL!-!YOkQT(q0%xRnpE1lc8r?Z z)mD#0?a~(x8=-yYiLlkI!WgnIS(8?Zw=C~YG{Y4+`rH%EF)NL&q^=w7sx7r<&WA3! zqmqP0GNlruN)vJ4bw_Wu%56VB;e|(su-Z*}?d<}ltK&!;7x58nyKaB!V(R9L|F$vB z_yCHB-9DSeK3ig0OoUaDN3CnsxvBd^0}Jn%<1$*?vaQ3<6Ag{SeT|cixZSBqg}KRZ zMz@7R2mS62ebY|^rz>AK`Dn&24Pv25sePIrREBM#7O z=Mfi-JInmqr%FN}#1-11j7F!nTe(HxSD$+MTQpLXzX%-RytX`;8jGz=_K4^9Fx+{- zjAH0L+JiP*msO)EII>f`9XB?Gb-Qk5-mEgGYC)RDJI&W-O0e#5QeAtZufB9tryJZ8 zeMsnfRd~5Ii)L#sx@#~So9Oyfh@9mj&A+agLdWX&?G-QEL~LJ-T(8FMQ7TN-MRuV6 z(nP@StYYNGnyH6TXe-~9@^^cpTiZ^R{nrqAwyVJ@p#rgd;a~dzJTnE1j9&wf-(&s< z(afa$-_mkfvRtL!u>SX`U82m4$;(8C&z{I7!M_-6=*rYh87386_1~O&o?Dssg%^+B zw(awnb*hpHXX?<*4#pwgv2U~yoY62OWhhOCHS&a8+O|{2~J}gW!Q=tU3$hYm(9e#)tT)AI>YpFRlUC=_B6<)xAdgHl!vE}4KA8gcTX?6;M0u3j**YAf6v z-wgmenC;>-Jqcy{ThQ05kV>{u5A!bN+nbNN@GGsrQ$egobuT}20=F(yj3+@ zMiCPyf%-CA4UTh@e-33kwgtK^>&`7**BYfx=D!@8ize-`mb~rZqFCW2{(7wuS`v0~ zNm3AJRzbdc$U7<|bSe~~>+a1EcI6CNkd0d%PqDICRoUD=WxGnSxG+pgs2OZ$2um_0 zY@0RKmp)cnNuRRVj4asdq65RSo%3hx=k#1xV*D*SeZogG(A8P^i+)_}!BFH`wfT}( z!YsI+Q$y@e^seMTElGI%AsE z+d5MQL~kOWdEYHiRMU1ne}B0sE<(oZ{EB9hQLSEkU5b2W*7M_jROD3-eMl8yd#L)h z*RJ_ksFnGeg0lJKma~b%Ui1vRtDnMSM}1N*``Ay|9#l>AnqkE4>9{Nxye>%ET`g;up(MK;n-b*5y3DS!uz05 zc&2yaW|u&>+``{NtG?0Y0jX}puBx$;$RTs}^{9q<%e?UVC!OBh^5tSR3A)MCYDlF| z2Bh+2`(3BPzf`A&Qapf#qetizYQFXd93dD31crXj4rbT|c-%y~`377R%a`Am^4Yq->a-K6XlYEA5DbjjwA%C=$bwYph zxf6wx-J2-SPe~qS%^qvqjW=V+u-5VF=2F91k5m1r3io=UldYtT zP24G3tX0HpK$6I(RS!XfzT0Jya^5+0)3_7+QkkTyJQi6}uHy8N;+xv4$qA}3zECR` z_jYZUL#^uTS)Fl-uBV{$H=gqtmJUUN$+6!*4%9rvBe;Z?Y5DK zCxb~`Cs)HHDfecY$9y8f?KMt$lE|Ul<)P<+ z5s$@mzhvjJ-F6PS&r&KrI zRJ>Vnm{`F!+n)JVFj*$#zvb5R zv3j#nXFMW^s#s>Xddh{~*6Ga5&*Om!Ro6P!Tx0dks~7Ubwm&saLhWYDr%{`(6UW{& zcp3LqaLU8_$VEO{)tpgnwa(p^TI6l(m#1_0S%G#N^Ocf99y?LCYNwO$?qvt=uD7*E z8aEf96@T=e!(5uuM6nWU5j!uALj5xFc7L7K)`&=*@$HJvjfTLCtM?3SOy~snc1mZe zC!&2kq#6CEee;i>+yE{3>3iDgd7)J1a`@r$=55Hehsb&%6r&&n=n~He6B6Cu3(^_9PxkGEw)Wo=zbi+_PlPKJF@d6s< zOq?#$ihU0dge%^a^4Y!i!U7?;m+{6RyzGD=Vowym2goY20=nVVo{ zV=K-trYuSlKIgpL^*pS=epP4Po8U7%_3?J)_WZQWbjg8C1UQfLZ%LE1A~8nyBB;ZZ zNK)k~1uEKwop%*3o9C{Gr)>4U_f%YKUsBy>+)lR5@{M1d=G%BB!gQqkp5%T&cb9k# zijxq_YQR&;S84N^jthieR^KMoZr;h<=qw8grA~%;kGFoseuQ;0+o(#YUlsHH4_%Bb z2WQNmt3PxRCbvp*3=y+jC$p`yt*n_J+gTxBlaFXTw+|~Y^$0@Hj<$1l_dDHB6RQ;~ zFLR4eW{st}+XG}MWeWDnGPOtIFtE&h;x!X7t`rBg2!3k56!f*vN&W3ILTWza8oMM) z{D5@-x!(znL@l)l-vD>lmGrz}b5!&vj&PpBY(65yYDCQ{`nO8eht;g|51?~$p5LfC ztt^&4=UK_kg&)p2k^kPd;t+<(@GIgAR6J47NBq=p{%R7<>yGka*G_t=Ki_GeSSi)H znfl!+{X)ln=5rCUK*mtLnQzX~_2!%>Np(JqI&Lxf8CnDR&O+G>(e&Z%1RON<`*b*M z7VTBsw!d9>W$EHy$xyZz1b3;)uPyq@Bwe80$KLn?knlT~x2Wp@d<2hAz!iJ0sfTq0^DhUy9fC~!-Fa#AqmDM?!xnU{JUJ%oSVA0}ex z+0oY{eGn5tcf_lAliNC8WPv-cLDAe6+&pd*Mq5GjNdMgg=00>u=z~QpuBl~FXs%Fi;935>CPJ<=-Act~jdjy`S)Y6SDyDz-&e+d(k~G*P3gjro7r zxw3EUC+V*Bi>;02aTn&RcB;`MRLx#>#N4DRef><640(d`wLwTi6oX$yQ_zeSaYN%1 zFNe*wMHHygjxBy^Xg|N+hHIyC-#FQ?;G zk=D=J3&wBT!|s=%a+KqXERKGQNRU+-d$`mT1rz=e)4|thB(1_*g@%5A^m$Cj)wP=m z-c(Vsj5O9m4Yq`7>MOGgIFkoMaoI$Oa8qSm?QRNzz21is`*2!2BAGUG|Om zOZVmCaAU%Fg*j_oVln2Adt^(0l4=84Q?TEJy%M(JwWSuLjxdMLL@LGvt3{;iI))Ng z4ZZYS`epQnw*g&^SP|-Qh{urK}nuOobivU3jVc6MuVpaE)O<#}*s%gECV zaZBYwaZ93DfBWW48>JMW)dQ;&enJyyImypnH0dXwj&%t8ZPk81SEurUve7f?d^0@K z(#Q`6E*mI?lN!?ijB2J)$oo<*Uw}>;oso z%GJV;qo{72x+ol)lPNOwP^aT%nb$MzJ#>~GX%{`M6Bsdcv^d+d0R;^5%|+PN1GWfG z5{?Ry`+@3_V_jGb{4pURSi~Q%CqJpm5j17N@M^M04K$4Of@$0N+djAglTW4#;`4WLpz9l$psRpj}0maQ3O@Q z)#wtEP0jB|K2!gyC8Lyb_<4ckdfds*Vhr_0IFW84=D8Sz1A6eXLPx%~!F>78%T&jv zUtRA~BK9K9mpO3GF46lL=C2cDWa;%Q(jBLS zq+jV*6B7@3R5ZETzIsbDDEnR75%w=c9FR&(5lHxb!(~`UEqX~CfV@$ zWSLbMT$;NQQ|nJ|rd+t>BSxm`+#}oWcqfvav3!Z%M^tAc#y;9w8uMFTd8+J21VrY+ z64#Lldz&Ix7>#0enXi`P3`8E@(`GpC<@)KEui^daFkOG8GXb(bPR4e9;Mt$;CBn)` z*}8$o$!;=>*_M#)L#*u@M7SNPd49UOQCE@n2UQBfYP3XIZ80M5_Tm%%!L%Fu&B)wq zZW8bN@33Sa2y=d_NR)cgcA|Y<_>zkrkq^zsw?vFH_H))KJoSw~BA$>Z z)2p{lsXB&Xj<9R+F3fpe2{=&cwY{B7KbvtaNLJcC$=p_nVYOWR%49Lzm!zH z+#={?d#Yh7q!A(8IWY_?Q*}ZNTRZKtZUs(!VX4M}(&ZAK;`%BLNM-A#FD_wl_Lor+ z@;rF#Z4>T3-{#S`X6?uI&{z9zF+)20Ku-phd#H(RRLX}jf4s-+Bw^U=I7*I2d(mf>-1E zPAi4snOY+h`F0{dZZtQD+FX;4BzUW8cc)8Gx+0&os0>A=N=H0D3Une#yKgVyUgh$l z@HPmOO@!A!g^u-i*iIWID`b1d^Uj~(vB>ZQEJr0O1`X2&`DLi_SUv?Qm|Kv%@jh#< zu89s)mQS9zKcVo_2AXz9VbWfgXoY}JhYRu$cDbfIQ>_EbnisCX;c^S zZ;NA;?&xyVLzP_v!^WhK9q>ky>5N)-u1~PIA0Cu(qdo0y*k-?18_*C9_kPp>ey8Un z(w`F*@v*@MO!MS5C~s}pGfm?pOQaw$zOSMb9)7MeEsD_rl5=Ba+}%V3eogZGl$9>lGU592-#ME`BQG8SFE zg@-xwWv@-6fHv1&VmNoFXI#%tKMf|mF+I|Xwz|GiSKjKcQp*{F)w-*Wz)~4>UkfK_9$A*<)ty&-K33q42jj!Yh*s!xu+}st* z#D5o*O*a3mn1V{cgH-r^cCxcEi3={dw6B(aD4|_ck78>l+MM3<*C$&-F=6@F{`xIz zGX1{|-&Zx+c(dhOKl8uWj`}8xHR&4TL!PErkBv!y)0xSGKyu8eZslkW`xkXFWsrN) z`<$W5`0g(z8CqNQ1LYAx6?pIj4ID_6TcTPQJIQNNDy9|L^gz9klaS1*!9GSkr6VRcerFzHG^NEq zt2z?5!ZY}jxvcHQ53^5);L@Lxo*cWmxxJ2I=Ul$ecB)bsqxn*M#UP!Xb(upxt`yHU zl}CSkoOrG16TRq`1I)>}1cKH_YYZE6HnVC>JChpGZI0##TWr z9rzY&4$Ou+AExU`968)~%@2Ih$kI>ulb_UvdxAabv1}iCduVhmpA!#7V5K$*uOS~L zX@5kax_5Y@6NvyX=gpK16)kr?=|&m(XX19-)Y%$grs{9czBgIh+AuX)lGb*`Ko1U0 zD6;Eq!vu{G;KeDv|6;)Td^^hGNVEJJb5kFzM7Wxn8iPo#!5GW2 z#avDch$2OKz!K2ggZ2|D-^&KRQ;>8WJdBRmHb=arYFkM2!od70>-7S^4WB!@;>#ru z{!q_{KcE95uAv{TY?@ULqzSfRy=OhDW;~_-Kz>UJX*QzYIBa+S8)CDoO`j!vh}%U` z(3<)(n~^&ef1T~?^PM?-E`spw(XLcAhV=E2|9Sy9TC7_0l72hqbG9QvHLzD6-0tpA zW-DrV_5Sr@`{SviW}Oq$&+|8@(A%A}u?kTLZ*^k8lDzz%W-LlF&rrL9H)Hua47#zX z1!kXz*rIau$8o^5gKgjWR=q+9RLs^ylo7;H!#m0iLd0=c+_H0q&Bt!AX%#3rXvtOp z@I0();AFf_&yi+udE1{Kxz?`qu0?K>7B$*b-Wt5|19hX3h(hTB zr$DhS!h+QjoZlSPo`3fBAuUM(w++09VUgXHzdmwW5(Kds_hm^1Zx^f&KO7|c-$Ex@ zD%^*;v3$t!d0eST$vECl(>LSCr!l^7`b?A3Wuk`QTG}lvoE(<@QDHS!xU*vANU4tl z1x3g+*sdVok-Zsx<@tbRywzG~>OFy`h-nJb4>inbTV`EG`Oep7Y0u6Zs^TYnewCZP zV2PkKi`6Ei<(b}AwX((SE_-R-uR5`qu`dluN$JA@%K6x=_S>p}dO`Dy*6mPXY4hv! z-y2w=NxDYp_ITI)lF&-I{GbTf%54DZ_7IeB{-5(||JQl_IrRml&VE%=LY(S1w=FUT zm4ahaMKyt@X@Hw zHGbnt5NGNONLIF3INnkOo7UX#z4g7)#E((viEc$7E5{7^W~ONO5N+__)ZdiL^VZydF z1?S*u({PRen1kWBP7iK|lM5dncLwKA%U5wXeY%p^N?~@Znh-c>pAh6`ce+chP?|Pd zAq@^(_;`Jhj_YNn`tK5_!~1C+IqgtZ9{P58hpkB;A&Qvu^@0nZ9Y0iF{)(yAR_?vG z28<@t;6A{ADWGE-B))eW6L-~fEnb9XOq!w70#WPhwE7a_J?}3w7u`3;1ySF&zqNna z@-}IP%d$K`cRwo(#+=ED?brSg;4Z0+45S*qe^Y5Uy52sD5RDH@)PE6_j35qmC3kU% zI7?M$*75W8`iRMuQqz|a46ZV8$#Tl0C&o8dSo&1W{HL!G`{A^&-8#xkjm*!qAX54NQ2Z)U=sVGUb0ZY)mkWp*@koE4<;>4iI z;pO3k4hbxQq>Rftacl+ES$#9^9d7|1!>$}H&AKRLzW%Br=3*t#hz}y46xNq{yip~! zy4No^!oHnpo9GVZ1VL^u*DxNgD56}^6eaq+Bq+Gdoxk7?3f#$pR-WLE4bw+xR09#J zW963WH>r;5Y_-D`X-2?zEwUC1u_%s;s8X}sk!zyOMrRQ$m4?qoC3CT|y#&ja>7Fo= z$-G^EP>iw?TpZi{j33-M_y(Qj^($V(9Z#Q~m#>IE#56fbD|SGAAF&wfaw(9Q&Q@Mp z!;bZ|yQ3>D<*=Q~BwKyQ-a1Y4rV)1~nd^6T__U5yx~O2?sWuNuTt7Fw> z5XCp|C=hpD?_S+r2n&loW;(ln6fzSXs}e1x{Iz314Gn3-a@v}Q zy;}O$-d%@$H$|0!@q>Qt4{1XKm1(jX@dTtc1nSa3a#LpXy*Mn9h3?GwwI@4Bu`omP zrKGZUCu9!8^uv8054@?&H9$%Z)*qjsyfyJMytLz8^8K<^JqfaW-uNlA5?>~G(kbZb zN%wh9Mqn`&GnARg-s$s4QdhTiJQk45IkFN7dvD_5kChW?b0M?uw|*=Gndeh)6e|jW zCvb>jj+KdwNeRNGq|hbQ^5ry}ohfL%p6F<2A_OD?m&o+L;rpyGQ$dL>zZ41Nz+RB5?79vy4a`a}<1DvV+H1j)t0 zcJieH6t%99@$SdKSh40zF$>myu~01y#)Hk;#MwOL#wy67Ai0zuzuitLmXpmesy=go zs@VeHp=SHr$!$i_sUY5nZ}NzZKXwO0Z%5FSQ$<)heB0APXO`i!M>D?QvsDoJJ$fmH z%IXjxec)p|)?1uq>GgsSeEBJ>;dl~8%nc*<;36_}hdtNm!zFY(DI9zF?)$7C5`1Z6_*r@L{&28aASh$Kk>$Vl8>VRB#{mVUG z7WZ*aS&6K>#}e;H@%rQK2$X}7UdH)=r2(o+pY2;w`DEVLDQ-u7g>q3f2uW1AzKT=j z$1-lSaPq{Jh}b(e;_mH;*E_TY3AWO;jM!2!j4Tk@?x<;JZ0{Fu8=S>#Q-qeg{n0Vr z5TxH&H^vLW?S1FF;;Bp)--REK5_iXQ(O|sFG$2UiiGKd_niqQkg_`XT?}LQyiQzGJ z{Yk$t;frZZ9oOC3*XcAZ%~FSRa+Gn{Em1c$m+1{vI&@N$EH{&>S#yiIM}Kj5S2d`y z(T-jh!EgL2T=_Jh>(MAoN8U%T1S(rv%)}MJRQel5=@@zYK@K9JLSFwQMF(XZ9MFH~ z#0_GOW;4G2(p9f=x@w=7Wg3l$<I{ZaMYK9FbC2j@s<+CNba-PHjk9I7>rTecFl zPQ$S9>JrUfR71t=I;V<;?F-BE)rn%I&%6`s0lQ=vk{w5v)~(aRuNVfDmR4*h zo+$DgF(61{o_HI67`)d%*XYQWH=-XweQ@pc^AVXM_&Og{hM6$@M-~)ivfNc0;$`xY zLMlSCPaSQ2TRfhggJe)#oyI?PaN}}Zb7-^8_vvP5cft)7r@ng^yh3)Y3a08&VtQ!z z?F%wajMXY-^SJD9`rn!$mxIF{7Eg zx(zzcsm4Vnmr9%_=T1~3B9|&G{h%k?P%`q809c0i-gWTsQG`I*u2+zqZCa4XFGn%% z%{=hP;l8Zt+c%KDBPgFVM50s;bliaDlott!69keo$<7xMq2NAWAH2m4mhsXWxaZ5! z)l+?a1c}1@v*`Mj-X=jLi0!)|JW?|MOhNvR=;J)2@MIIr8idp&3u;L*DW%es-$~!&zizK( zyS?CjEA^zb>3G|6J@o;W6~$?wQZVU?PH%xHy)!vg+x@}59fZ+T0>2UyBL^1!d6@3Q zfp*|Z)*%9hkjR3{G=kM>5^~6)@=SvhS*YZw*`n;nU5%4-t)|!sL;By*4(dBHJ>GUb zpo1%vF|yJ6dE4pZhc}3W6`so;4_~QVVkyc(Fj1+YvNed_g@4lnf6q)yZ(spd*%?{3 zOHkv;=a5XsH@jZ1`aRf#QmL9I-)oLt=(9&1pi7lzO589-Ij&i2gSm3oho_oSD{i5w zftpopsYd1oZ;*h*H0_ud#Yd3;I!!u$scaWVv;ByZUac^CcGc?*$zpKKrBgQ&joa;G zvHe-^)Sbnw`MV(Y_Yc{zt%VVeBH9ydJ>un1`fD3v{;x>c>EGbqc(~<;Tj)XAcpnBN zRt?YV(<$3BN<+zSuH~qp_~DX>d^)InWrveAb&VxPz#OH$4LbN`HU9W}6ou$Njbn8}1iB-@zU!FzLKW$%pn&e$hat z<5?3_7Q!dHXAu-JB~Ig>9JzOq_!Z{U4RceVB&+)8@+cQpH+thiCd~+mVmCvP9>mMT zWjq)B9z9((ltKkuMB>0ybE%f0h@t}?n+`mx+ink3iI+}H_s3Z2re;3&2TK@rrlhX5 zT_Q}+Lkj)JyOg1rIqXuxSt>R~kVChT{0p=^MBz-THc0Pm#(Hy4TOXTLfp1RkD*Xd= zn~{S2#=R00bzB2r_RsOf?2civoK_XOS5SsoouOj4)8!^h4(2e(^o9{2h5J}0pI?TF zy@r<$VMvXpvJg?EM(frEA%N0#7pZcg5xEUWFJ32#bKb0YBR-k87w!5|DKR1@Y;8*~ zkL&hxE~l_oY}`v7q98nd`fd z+e%9rq`5j*>J{G|-`L&Gxvzf^)?A8A7r6`HC?-;vX+?pT_%2R;PkaM~vippcpbn_C zUv|{R0qW=_UCbNsN>Z=O>kBqbKKn5jXBIpISa`s6iVcx}yzEhA3t=wSBXIJ6gMh-g zF0W}An%*}JiwF3rq&;Si7kL&LY3&dtMoxlrWu`ySHv~t2vx7f);NEp_u_BG1Uj3KR2X{E&+gZn~5 zzd;~7TW;OrfHk)h_8?+C^`~OiAYGY6wV$k(bP?ou?Kme-PaLT=Mi90Gn?*AhX-FvM zXgIS5mgE|3WLAK#<3aUPqcKnZH9M3N(x_~mynM+> z>UqY4ztE1r&r=>m5GQ23RFJD#=SXHXjUsuZ?aXoYo=tJr*0{nMX<)NqYsYkbXuf(5 z&+S!Ymq#|wG}EXsA0d~wpmI#CU+dzmQP(d%%>iE9*v+KMn0|tL_VBYnm4`}xD^j7` zoA$Nw4BCYWuIt81G5qY2V1(9)+vOA)$Z*f0gtZKAn~|=%r;DYJapH8UDwfj=8yj?k zeSyMAoXY2E9}yh$)zphVJO-P6WG3-f42POI7$T)Ww(Xj@Q*z zKltYP(T!Nh0O^?u{Bl0x&RKpE8J@p!CP3pk*TjG>^!%ehhXZlC$ekm><}5>|#HL>A znyD!*Z~W-ua9%uBL7{h(<@tBN8Yw8cE>bzh8#DOku%l*Fs4K6V4swm!bx_{sXGfxq zpJLcOF`v}@9(i?0Km4q`Hy@rmJIJablSV zhLXZ#9TF8EqFwXK_raYV--$$DU+DC@q$l1)p*wO~Pq&_0U+0(zjgTidY>U=nvWO0e z&*0ret_y;(9Mc~jk_&Y*$<4au(|dd0aE~^0Ud;LgEu7WPHkH?>rIT;$pO5JRILji7 z(i9+Dus+j2`>CKpeQASCW6WN!R_^$!OFSk`v4!?8GD0QhonThSwEg_ zl#kUmlEv|}4(?AW7M#iiR%;lyT#YbTkbExY4N5i9s-2%@jwnt9BlRnnjkVvDvp6PH z+EWlL`AFZ?SuFF0SiPr)9@|AfpGn~Xs?$!}gAfRR1x!t;X1_mNsAYJ3e2hs+@vOD? zUDe9*gy0h*G%;XID{DZ1eg-lQ3~;4jJBU~ z!(SamjPV~QJsl&m{i9+*kjm z`X7p>Zcz5TsZ7B|)*mv2W{jGV%FdoVTI$U;AoBj~gX)rP(?5NOC7Zl09OW zw_9Ju){oXv&7%x{_A4)h5un^Ti-C>_Xj}}vN=Cj!+JsUTg#21n&G{69K-+{Ui#mOH zXd^BmK`tbeW;+X)mX_w==Ef6Hc<9Dqn)n1bqB`9e=;S*J)QwD2{xt~2TslW$U7D!^ zxKi&ZDfC5-BN)hdV@o> zNg^W=CeH55eM7%=!)N1{!`NiuCXU&PtjCoV);oNiEpDgU}@Rb#KZZ268BnS&Ev0E2B_A0 zOrRog4Xl(~>0yB7H1Y%SnExG13S%)ABS}z9HDZ48ts~ZPfLENBvedK0o?W3ys) z`n$2GtzkPC7sKZ@mpk}gMV+jMG94tuGNvG;XVAFs=a*+|y{Zs4<9I$@F~FRPD5Gkn zJf+(F1gCzHH?F{w)P-uJ%a`6c-`*MIZD%pxCh&ZEjDnc6kmp2g4nS3DY90T?@oFNt zmi0E7UYy+x#TQIgp`>|V@$Am^kR`^Ue>p1&O=>j}Kwf@49jsrGY@Uh4gr0l~B&NOW z#dc1HqzSv=pDk)^o}?>u26|z9JbxtGoh+pOJ&gvO^!zZfG!{7wl4PhCyN*2|RXG3!BV92%6NO9~1eI{R)Bu75d=LT8UwIGe>KM+7+!qL_yZ^c8J# zG=Z3c?54Da5jbm5K_IgKZ%9fZ?sbUC%x=2S1V;Swp8lwxH_%3a{%ubp6<*vlwqf@Nlz_HbXn; ziVdhBcy&u<#le^Mi0#=?m0xrZmsM2Gg5#3bGucn&!%N&ukgk{%gp+b@^sZa(@^}e1 zQX1lYdYlf-CMPB)3fk<=m%8|hb#YAGT%e@L@A9^I+sp56(Cz*45YFTIk#MG4w8Ip} zDK~-kmOgWe$sYyt?cJnL3}--cbIxTA)i#P}tX@N-<_m8G3^*!2K=s2wxBgGpVvSO8 zP2*t9FDJO^qS@YEM~qDCS#*o}h~zKHj?*&moJ2T)8jD5ZQ?8dy3he0-hebdj;%be! zsjuq43iW0Zf9a2-#Uv%QGvXNBNO=1+^R%fR^^ND6Nm|Pi{U9d2rAs#x%gODHnPA@k z@K)a`PL~lskZa7C)_$3lZea%^m~pLR+;@zYVWFASLFZd2GQ3T~@CLqjINY|veo(pi z(+L)XJQOXK8k9nRV@I6|=QE0yhv-qIdI`77L$c7ySV1MRU(Bd2x;8fhj7iD`$g#TpmSOC#++=d4Gmo=8x$d%f6m%vp+#r{IIrs^=uO8AZNkqg6WHwJ zEW`fpMW5d@ETMa>%c~XZ?v|1;+N)8Wuo-6lKF#yUZCCufj5OZoE{mNaY0EYuoUMep zIJXauLv)Sm)D?-(dd12219Xmfp42vA$%VQ2%QEY}GL6d`mBu@#z;C%oeB4G^y{n&B zoHoWtZFK69(|tK#?^G>gO2a(IC#FlfYhtSw|B4Q*rWrGJ;oB|`>1#L}{W7&1YthNr z531SOnWx#L2_nWw>MrTWQ(>W?yMy`IT9koIyZ-w1vl*7%c_lmgR2dpdrA;T}kggBz zr-hon+Z`Z^Fxpu*_oV4t@K)G!PvRqIjL6Ih?XVdoHU^TI_xCJ;4^?>L$^H-{$uiy`8vG z@~6-6>|asV$V6^ttkf*A8;I1*eH3UukCOK0l(%i$uRc_KGA6?8d}oFrsVU3VxDzT@-ki5<*dBlGrT>l@Xg>5q>7 zg42;d{5|r8ldQ(;9>k{LOFRQ#l-4E}@#_26l4`#dh;|P{-)PoYAlYVk&-vc7|K_y$ zp>QN%*s(@hV2}^*<^8djWmU;>_Lw)TtNFSttEK91z^vcT>GS8GSWY;(PBp~;rHDKH z!$f32BP((Ik5{8Fl2s@;PRr5|L4M%Gs0wLxQch0DHvKpNt2V3cCgq$#RA5po{CZTIYa*5B2TK;rzIb}xR^m+8X&w*9T%iTL- z*`bc_m7~TMt7W@$>~r$sHc(ikur9{Kl_vCyyiX=|b7H5(M1Hd?kAm8qC7(WbPZsRu zu*9bh{gPS*TF)}>Uz3U{yd!r+&GJzrmjdur4YcDAMT7M5CRFrgc3$4S@?DdarccNv z8O@t5I67-O_0&xm_&=nQoT&r6$A{_git$FlU4h|jrYlyc-T^WSlFF0D>`JH|JWFTE>+W5| z5WK(Y?4RqEZu5dm^nTdLr6uip1r9uSsQXlgA~Uj+M{Bg6gOv2RB~Eo4l%>=D<91k) z)Qr`Q2VQ&U7StPVA~!7G{@tBkzs(3HWJ~ATXe`N`%~{D8JAb6JV2`(PyEdgV1}?G9 z8Gsq*?^W^d`Z#E*fkvz*Wg&oOv{Hc#zYQc_9=gd8B4w6=$aKM#<>?V2<*?{x8Xdum z5HCj0$F)%z*>>$;44u_J|SgZQ3RA=!|ckfVk zhCqIvDA_r-(31!Wx!I0#b;^%d8wb1cc)+|%wV_sx4Pi6Aw(s5%VtlcVAF}a-*^L1F zlDm@d^+^JEy%(EnYSI-KEt=GZo8d_POYZ^+ZOl6U_gS9{T>g6dNPblPl*E)!{|8s2 zr*pWZI*T`(y|`IE;Uhx@La&~h+(cTnb;Z~G{2Tn`zRB4esq`1PJ?-S)G|iqcf)qk5 zlp%EFZspb@qxt`Z9_Psa!BNG(i=5o(dxBOGVz-jM$bp#q=gC|IFuE?X?=x*TwKLob zwQ3Wlt>??$K~vUxW%8prd}7~Bwya&qTLQ67*NnnVjg*-^(BR@>`vto6uHZQXF8(iWK@-t68)=F zV;Hq-5Xro`e`HGk&M>ZDalg8wEu1PGa`(bTqHB@7BisN$Y9xn;X)(rmV+~l$#gSs& zY&Ju@@Ur%BzGN)#aQb36HedDmKc?E`uvDqm*sDoxho79!2q@Zwmrtd`H=6`X7G(vT$5^yyXWs`B?zxGd*N!0728b7Vh`+F zw%s{TUXSa&VDi@PwUPN!`Nuzcy2;Qj*yu($vgfVUIo}Obr%)APQBQc!a=q^8Fnk0P^PG*_bzVl} zl7U?7EJsG_V9|BoaG%!Z@uync-y+9#&kWs0G9c!tV~)4bza;&lr^8j}f$_q(Q%1>YH$}ovJwd!1ha6lPsxXFb~6KSQjbv zhh1l16P2pJ@u2#C!0HaZ%q9FIt46QG!JO8e8k%mjw;!qL_8yK>QYehvA3j^|VOzCL zjXkINvg8sal-I+7OlZ@aGofFv!6wMuz=Op5{#xQqD4bO9JPwU_%;914tkjpS&)^C@ zyx{Oe4g#}oxWYTNw=1QzE4O!F5zDl2)OvypSK~FE;ix9Cu&>usSZItUB6nfRPwf0Cx$-doM~W zI!@KC$jpSP<-52pGsmy39c1#vFRGSjm6g0{4lqJ4gqdHuT8;R z3OFupMc7C-m&#E8jzQ1XkkVuG6Q2*!!j!IvJ&oW`j zDsgxK2Lb*W5HXo*r)>)6;s|mfA59sIzuGhK38iM3F{a(@sW}*nWpm)qenWeyhJPsd za4sQkZ^D>d>t!<+WG4n5XJUrQMsP7cqysO-CAk{K>dbuOy9NNt1Ag}REQ?LvjU}?e znJE16#98MH&Bkxy?c`4P0{Bjm3;elNa|2*!zby61s`_n*yYclqM!im+S51YkeI`_6 zqm4FFT%x1OgJx+B&fsIQA;xy&a}*T~FQ+=O=g^Rvu4)FewBO@OO_X;`(}o~7+U?HO z5&Y&VwER^ZT_vYbBVzw?)o*gb!a1YXNTh!JDWYK+i>F{HT~Frg`wTX@O&~nCb@|U+1>9 zC66Sz8(+MZ)off$N}#FgN<=ouu7V!Q8AQCe`Xmkc^zh)R$?1z}gzPn5XH4sSG=<)l zHpD*Ufa4^Ln>g{1$Qt)b^jGOr=T}h{ zA^~p3-t%5L)~{eJSnjP2T}^Z6gM~l>jpFPgH){IJs@Mu)bb)LhM@JhpX0`z_|Ckx~ z`{c9Tm0WC`(&OG8^Y+cIRT*&5620t`BJHL~myE8XBQ2n{{oye>2S=mWZ_GkHX~Vpb zyp?<4Iu0+X7}EssILwEomU=0s$dhNv-Rzw$=3j}nk*Xe=8(rjGX}0?as+TSL&FH}! zi9jt-4;GQQ8eeH7c_ImXBl)_`1Wuex=o+u4A>^_gq2kuf*yJT2FbJ)tO`+@~RbH3- zoS{p9Zp~v60pHnaK|D0~jp}*myU{h{%ik0R0$>$<#ip?S&GyaV!I&a7GR?JlryvO} z)>x{zySpd3vzb--#EFMV3@q~mEG3K0VYZ^%b8s(yA*@m0)GoeL7t59XiK(Vaht5e= z9pl4C(8wo|`fC7IL-!NO+5z78*WIKNzD*G>l%YG@J#!{DAYixw*onJ3`j1RVHv*Y& zMXWAZ#omcs^=pn=We>_Yg3DF~g!3T6<` zk!w{R(XI+@`AEMYKvyfER46UM)l*Bolv2)fcwhkJy)-lq+oxVF7}`1z%04h zx9)KjLh0_r!5hYv;W^)a6tk!mEuS4WtncEGA`7!L#he+cv%`_sbI7cfCJA7oB$V`Y zaaB_76J}|&zaIMj2(ypCHuFwzSptXB)DSbY5ruu?r-P9%qtL@(dxfPrqr%tJ{TVkz z?OK~33(usIF7?qUXb%cG8I}(#yMh+5lB}+}N3RT+Nm)Y#`rdUH;%OuiFH%6+17jB3 zqLOuGAf?frKn*KmW7!cAfg9g}zKV~F-u2LD*WoG;G`vnR?!CBcA~EJZDwm|kK4IhW zlKGHahWfaCp6VRW?&bJ1-T8DlS{a|8$;qK8mV59laS?$Hfi*`zm<8`um=uA~@%~{j z^I>pAqm*eZTMBBi#1?~dea0<7GZBxRwnQq7NZmF~XsyvUf zRL$-bb~l-4XG6nm`5rC1H+FX{ZSF%812Y>b8Wf+jD$FQ)t_=|E%s6R z?M{H$!`?s@sesX@<0VuJ>$L*aQv)^`dYOKKTD_2Va8Q$P;^A+CIWD>cHTonx&+SGn~7P&_!(<0cD=JSMEth4Km`onhUFXhNb z+c&1m{A)}%^Jf{P6OPMzRy1y#X*|yxuf|S&RWb;P3?e2&f<(8?X!ljMvgbrI8m@Z# z3%EwYV(bU6x}mhGg9C70anLJ}B85!qvi`jgp=GI&-+ zMt7hwb?sOS?rNV06dbi~u_}bxNrm%qd9Rtp`?2ZS+CLA{Q#&{!-<>I_lhp6RpHQ+A zm7k>d&G1Ek_w7OlRawO`7d!;{oXUM5D;(fRwU9OPln9k;83@}l)=6-quCxy48AFLy zBUW&=G;XYP9P2yo1?hV_(G7~Y0_*UkcZI)wU2Y%ls!tFyzQn!dw2{ZrTo!R}Xijdk z2df*=1EV!fDfggk*UP1IwQd+2=%l@&n>$L-F8Lhi&0j+M&_ndmfi{adMp)bKh3v11 zBQylR@*@~PhB&jaF=_xF(_ud@&aMzkl^lc$?Gd#)jAG%Tqvp=h)AL6xMQVJUrR!y?buDzMpB7H16h9-GN!w1#l@Us{YjXt0kTOfPJHlnZ^fBnB ze)L8DYOc_`edOt|2783a+}2R_$c(Dz7+4pSI?4!-Max&t(cUb-!S2soyZ#h3epQD7 ze{+J2faPRlsLBaaFoyJh$VmAwo(uqVuwfa+hF1{zj9n&LaPguJFW)uU(6C+);_5d1 ziUc8;eaNk3nklyRpim>vYk0FHNZ&me9H8ssyC|O8lbUX?hAkGkeXQoM;qxWJ?Aayj zD#eiwXJ;fWPfm{b`Z%(0y&DO#b!J&dxFzc^$ut%KcKeFuRBNRwg#(Uf$6njmg#3u4 zkA^?SDY{Z%Z|puM(UFF{7V@cO&EV0Kcx*w#d>4`phwCZpkELW3nce9|Y?{L}zXl|6GrKCA}N$b&{PJQ)kdrZzKd z+o3%eW3QS0O@do$Nt&Qb>RBGT5eDrhQp8Jwv(PZ{Ozls+mLk<1*akQd=y#^frex}? z=B~)LJatsL`Ef}KwpIFQ>Y^r+l&s1x)9{=YtAF-WT`d-y=;CYZsxPJ{Y=_NizY)mw z2wu;{`iDf4W0Lsdhwd;ZRe9XQXTXQ{)|G0<$(ys@E^ygY9+)h}9#o*42|%YekqhG! zQ%pmCs9E#GTJR1f{f@O*F5-*tnEp2JJj>C}a@LJ}IuVqM<)p5LNLnQ$xJXG(3!8Y! zK;CRzZwv19M~F#f62}eIapbG*H13pOpCuS6JJ!uGe%S#=iR?d5E9HjqAQc%=llYok z5#2S;z1i6R{YhevyeSWSvfSsnr>{Gd#a`YJt%gw&*wp!n4?SkdTBNGo?3I`h z@MqX>eF!+GS_GEPc&lM^{L?syp%%j$dlZdW!fHfE_EIQ5~H*<;moQ-iISQX`V(Ew~sJFKS}`=0-6ClBxh!9hvY%c zp!%bHZjhpo+ct8u7cIdOI|qAY7=3#T_yd{&t+_^a78ahC8@+M~j+vJCj-sr6FMM-q zc?`Hb`TZ$AbJk~$hlQb|10RzCnymzOCED&J9^Fzi#ui3!5BBGY;ZiIdVf})hi@{3d z#v(f!b86)GCunq#aMz8U`DB8Y1XPo;FwMSMl`-&M)@=3V)8bxO{_SxpEV|-gI z^%E@z%6w|h0Pp+0SRc*CDq18TzPt}hbA591yX7R~*RoLzo8NmH-Z_crZlp@Doo#M} zy7e1C=H3%M(BH(dLnmt)BkfG)=NoBKYEqgJ9$4^5T0TZ1D}Inrh8;MQ1$rA%#`|o$ z_j#LsX1?vmr`w73QCH^aRK#(bwURoG`Lw^Vg4k&NVNSnaP-(#tiT?Rs50>sC`7PhM zLnfB|PbS@1ww|Tb!E2&U&HI2Qw@(S%y5OvqUtczgaVlPT9d+5BVg{_DW$ny}W8gsK zHMt(LH)4e>2|s+x#^TlPi&AF;jYCs6JuW(%UeWni!kK*BP-v7_igUcfT0W~L(DvKP z_VhGmVR2_Sk)bYnG!X@r^-CfRDDyHqJicv~8E|GuiAed(z2}Bws{)GR%3_1kYgbR5 z|9e9ExQqCU3Th`@=#L-H?XMis8b&O39CSqwe}dNDaJ{Z(+|U!S_`64UvG}ssC~n?N z`hwW3iv^mFf9OOkR1#X;@|?LD|FKDJ<%GSZ{K&KRU0zg4e-KXG06rvDDa3Jv!Ye=4 z`|86|KlfP$CjRzU!kZbFkmi$8-M(6K@~TCG9#)1;G=_AEiET%vLPmc7yB zZb$d!tyQ1A%3Isd7_1p9o(J@KCbvtUhD}!Gmuyvh_BbYJY_Zk%#?|>s^xZa{G-QZ*mOWMu*m{T5wpX6?L zOrY7f;SHqKeU2Aey*ep*l1~nV#8pCK?3`XXhSNIIU>y9mbJw+wXnNjVeOl4Iar4zH zTm3*Tbqf@_&vF;gYW!R1E(YN181(k)Lap{jOWfGGa2_;mHi7h$@FV$~xdnp=WjRxt zJ{-6(n=HRrHH*RHXQ6Dh>sY6`wA&`z4;x(HSpNL)d9^* z@12-Uoe$otK3jKx*4~FBX1yI98Ie>~eYdf>8QCRmB;3To7x@X!MCIL+lGc_xdto9h zOD1FH`ktfQWNPVNB1l4w!|@l zIjh>9&mFDN0@}?3wS%qF+$ac^QZ(vI(@!R;4X%eLJ}%a+3L}&$sk2S#I(>But+mnb zGE6W_W;M#Y@5x`Z)3wO7+J6-%9DEQey>bb>D-Iwo1|c;fPmi0KImiCi> zslcQ6v<9`$nkLuOmGJ8#ei_gG(Xg)>huR=vPTj>)>bUoj&5WbnotqQlLEkL8xxQAM z-+@ru`eHHo-eq-VfUWFdPw*SVmO7}6b4nJXMEv z8t2^?p;yn3C@mV^_lo2E%%g;T+3w|Oe5+CG^mxqYvjR}m|3jiHCy#{EuEi&qC&y1O|w~ z^xj8dIyqU$QXQ}2JDFCFE0W6p!|dh2Z(y<2c|71xm2L4c)#Z}q8pZ$1kSIO>ql$P6 z{pGuQ%|+E`w=$6%&&v&%IwLUw&8gydKog+se$-;1B)yrj z7*u9dtHw0EEY(2)jUp3>G965$q@%;^?Cg~MWFHG0W{@j?^tL59ZbAFwXv~aEOsD|R zn!JrHU)rI{ijL@jtO{)KBNWGJ71*{GYw^+Y|Ew9fG1+V*XCrsZVbso{cW z+_wXo2!!J-fNZmV$D=5~B{r?gbRY%r>v^DfZ9QWY2M-{K>};e2KcaF*fUc#@<+6V? zz+iTKNR8suP|`=)S%!aW29;n3h<*TlxH*v;j{x$x_3qxC(ElZ3paxQ7Rnjgk2KV1@ zWk5ZY>}KZ4Agh-JbeHJjGWMtzl=j5 z`e!ZWSWdZTV{X@h-z6X<0RA0G&Xns7AskB&--i^Br7%EBOAKD0=DpZ1k-4W4o~$N^IA@hkts zeIsqa&7!VK15&-YJX*E?1!ta10q^OysHGmxBK3~te2lSp%b;D`kBAbuQcL%kikwzT zBT!c>;wlapxDpxj)hJ;aCJv2_o*wz^>`Y#I14dC%F%C`nIJRna_yeD*aPm|*;pOew zCIBB2*VM%4ciA`5*Xe6aHjYR5{8?x|$Lsf0=0_`$QLQvY&3~#9*@(8_}T#t~2g@vKp+rLBahkqimH!3Gi zhbdKS2c3XK7Fy!sC?7llOb%=zls6afEoup$9z`X99!N7K^ia~N?b6xYe`QM<6Ub;- zehv=PmeVd1i2N@95imxPMdZ+e2pKsQfZ*)+$A7PEoZu=3*!AP(A8&F)OsC&doo)Mi z-i-=%;(D*CH8n;)_tpMP)O@9F8cl6K!nC$eA6@QUHO;&$z3v?Z20sd#~T?`s& zBW%?#{hy;Ma`$(a?q+`^tgZaBUqdIVsEr$}suA6}%*Ce4Gm7+B|8P3mf1D05h~}y+ zWL_hCwpi_dR`Y}JU#MVx%9JS0#-)2Rp}A}v|1aMsD z8m7)Op}IOeG_!~edQ5%o!TcYJv18M|E|+17x<;<}Zh5rGK3Jhd4g}5(f_; z&R2+{{ud>sz|>Ywk5+|$xjW2H#1h0zpi?Jq{BV5~5)mOjnfGaZef>vQ7bqn2`2BOi zYPHq_#OGWoar)%7Tsyr6?2!1eKyRVf?1$e14(*m&oX1LvgvfnaTwL7V z$^86$NLU!i%d5q*dBT2qdHIt;-Lb8(v+lg&(#rY8h2!I`BP={T1tTLWFyMo|ymV7_ z%28y1Hsu!!3kycpyWi}l$b_60-+^^?&(6*oQgU~e>iQf0jEVWayKCWZuB7y~tGj!+ z(e6rfTk1XsaY-2WF1zWDwEOx$FF< zdF*g;$V+-vw+oVAlk1|9!kioiu_PM6X-iU>*Y|7qM}R3W^0- zyYz)whJW}tzc#Pq)hnPQp17#$U)1>k5}?$9*)`3f7yAj?Dfw6HT>YQc`RiTi0N#bw<^Nfwt!O})w+s-p{XGAEGGzn& zlmCB({Qs9t#BwUJrv{Ab_`&qQ@BB*`h8n5S#7rx4B@0jp?dmnKZhtN50EG=D^!w$d zv&}*cQek1CgNuvAY?sk}me49!#6>YMz#QI|j*98O1*)ZJ}W?U}<~T;+KcpL5MR8v=#2kD+U8hMZPY5d3xa!uDk2dAHKt=~Y|U95jA@ ze!?y~Zf;y)9Eqg7JSt$X-@bkO-OtZ2#V&uQGG|CjOA9hI6mVJ0W(YJE-nIy0Le%IzjL}7lLV7fozyYg?X; zDMbs#UVsV!I9B3yfKtArqN2jmr&}9aqWUphUDIIbl@AvZoYe*R{GIo@6qNZka8;J) zS;-? zD*#T}Qa+R~{2Kx-z<{zLtxN%atwqL8KShu)OVeARcjUG9ucuB;@IIuFWu-vg1!R}$ zGyQ2=jMO?H(~tv$R*d>;q)>*n;LmS`a6(At9#A|SU_yUDjaI-=Ss-8tp22DDqcW}H#;U`B=T3}s?X{UU}z?g)Y+o#{SPp=wwyrV_Q8`6{9xe3 zlR3Y760u&}i0(=VV-jinN6Ta!osl)K#OH_G30y^((!v{KMz~k^?}?~vJ6;E_ zk*s_#2}>$on5g~y7O=cwP)msCx8?DffZ2g3A5_oGj=ef;vAQhzw;KE@i{`-9=^v42 zz$$$7H_R5(q1cqW-&*nFgn71$jSc89ljl79!HgW(qo0H;yXU0yBJx}I6V zWOwGF{{YHkh;|^14~9ZKc))fgFW`9KlX2dke9>Mb8)FVkjj#PM)?0-jEPEtPFvq7L zWHSc%!%&sx3RJ&)^_}oHUWL3itBX3Fr1)$}>hnxY|6ABLO7zTb9v+S3;~c1{xMLow zCK~(qFLNIOoDX$y^z-v0qoh;@CWv&}Ez3whDd4&~G`?^AoAqLIjYU>#6Z{ z-T(1}?Gd=hu#%*K2MQ(Z?d>J`@*4r4jDIibjM`SCs|X+?W93f)WGsRal_Rnk`^S#Q zUuY|&1Cc}kxUrZAF3itQY~xye>&g9-)UAb_85mxBlBA~I{Jc9mRY*|L-rNs7{g&w7 z%18jPkF`Y?Af)$y;0_#7P#|n+ZJn&PaJHAl#`chJmzTdvk-F^DX+CKJCZAw+^_pD~ zEOGT3<*})k*^U}3DbUOf<^{Fa@ZoSPuoQh8TFE(jlTB5A1tn_W?u@@HyG6g_ZbhH)*d^3R11G4sD z-|Yf0w`5V;PRtM+Qz`(paeGL#-(`JY#PHgWFn~^IF-~wYw-+)RFc_c)kuPWy0X3QT)~EbeZbh*8yfCnqO;qkH3HV*^$@ z)WGo|q^Q&VczhoWm$e4yi*?S7h4QllS>&=Wlal^g(P!n(8lUI@uDdWqXzcxN3$(#2 zEI<=I#`I{i_8jb;`vvZ1xqDD%ZmMzy zWzAL)tAwR62Cvr||2gqeih(mQ-cVwvp!rDNe$C_kIs(4p2WX2_g=cJrNsje%L5I-Fq_wLd%@q#7}6nXjt3 zvs}dJH>z6S&_JiDiMD1uY7C;h(ZGubpe}H1l@8T+8q`Uvq@*p z2CflR&MH9=ps=sEsnHXu$w9;+c3%s~0af20?C2tl`S?zaquFKrYk3PNriUPenxipU z((dub6e9ELqk-J$yr+OlD&1MG6ai7H5*8~)YmT}I(edMcvSE6)Y6o#D=T zsmaOehcKUrDy=?=1vA!Vaa>#C#g+GL?kPu+`hcYeH^T5NtoJ!5Z-sX;)~ch$aTkVZG{5)6^DjTU2?x<*e8E@MAz;!7 z%uDYdd7R4BG?kPLxZ*c-(qizxj8r0K**mp^ToHF07b0Jv8#g|NbHkH)jbKc@w~3Y6 z8$vr^oW?q=T*Se%nKQCq{l`X(Z=|Og-A~jr&?#hB^p+!cBBkNHRoVd@xw=QmF1bwVZ`0g zLA?a?KnTeJ6OY63C}P}u2kQCY{U!K zkZIj>oqU!UC`b3$gd5HW!&7)OLL$r;%QG^4Z=v4jLlhvool#pR!zX z@U`2Wo_c0cioEQ$Z#BAHn1L1|pt`5mY`H13bmV1)X!l3P5mm1b4bHZv71Ts5zOC{( zJsF5hba+cePVj|nbXQ{U2mN34kYiZ4#2Cn;bCcSz&ik4Arz^wRC`cHJU3OR({X{!m zpiOe=hvCn7@j(2D!D1|8>z?(MD5>33_*_zYT zE1rX^Gzkzd!fw}|o*dqVzIg;sGEv{t>+{U>M{?|VEX4=K5nXxgbugEh=Z7Yj0AAdU z3v>@I?BQGV5ZySr*>p=KP%KIeYso`p+d!J)TdnD_F7kZUzr}wnZAV)yiZ?|D9kpkj zQs$#rsc7Wg<;XvwR&rnZ_>0s!)=uMBN``Y6BN3uSfx3PTrJ)XQ-I%oT6Q5iiP1@>< zouc7GRP6y^)oAIA9p zOgW?qs1h=iVzqM=dsW2>91tj8UVHLmd4K{q3bAgD@9){Fb1SrM{YLzVNMlq9VMm>V5`&6T z$J}A8fph&q6gTCh>v(&3Xl>)1)n$E)n>+KTp#k*~<;c5VxxG?DCbP*=%`bw?E&>Mu zQd-g3DO}@s&721H^m)yUX-01HdPk8G_PJFX6=hWN)q!ifbnS>LLx>?CWfs*)cl z#&`Hp%Ue5M2XT|De52N(jvBGRqO)B&4%p2E*K3nsMp$Uj;Wpixf-c9tj}f=DO>I(u z*IORl1XDEz)iR_K+OGl1AhjvCxxN&{vR`U{wtNyqZBTZ$O zN1KSs+@&*YpvS;Rz>V;nJCU!%A13JCG_x$$#@9=rMFjzVSA(&S-)-7xRpx8VAv)ss z6NkX7tP#FVhp{DDxu%=9T_sx)GuImF5_V$1vNN4Zse;n9!U{hYGr#w|QqH?Z!zm7^ z8Fj$jP1yGt*v`{g1f)-RDZ!bOv((wdYLrnQ89m|ByK#OgWmcU57kZ5gEYpfUnhKza zvB9UgPQ0j|V}0@*1xrG!Qf!Fw_He_iBKNLI5n2%_mtk_2YSoFHh24p+xPuPAsd4zD zC(oe#4DzUWFq9|_Jf=y^Y+kn7OyTrs>-%DFW}XHGW89b+tDCsAx@iQNX{d$s>Hcg~ zyK*p|4j+?wC^Y`npiNQOtXRt? z={yK`%&@Zp+%Fd)sLFliDdA)ud+uS-0KJR)9tA3Pb09M07h;<-lAom)lUM=%e53v8 zR71eA!`mSvSEILqsx6j`jzhW{Q?F^spkY_E@?|V;_6nh=Zd_G$etjs!c&AY_5TcI_ z2yebrTE`P5EjJlDTl?(rj`Rf~uI98LR6xlG+W8j*0qXm}q}P}QT5MK0`9kSsZ=Jq; z=KCBVcUgEcRu{dNAG&q79)HsDsfa#Z&L4C7vg(5L>+#j{N#kjeRuAvm!OGeAwD>~{ z=;UQl9=z95cH*7#eqesOv^$wZ1M$o?D^4ZebIxv9SR1r+_3ib87cXAm)H>Z8TMb6i z+{?h-avcjq{3Ez6L|jO&XxZmo@2 ztU~p%@m>*&n#==8Ow%DFg1RK~y??_RAkS8LTE%miW>tFi;y1z8UNVW#!L4Zowl9LV zz1n&0@^#;MYsNdtS>9X+CdjTl-#SWnMxZw_Zm>?B8<38=gZY%fFN&wgahD;Z_G{?N zge9UC*^H-Zrk&*4Oe(V%qzL^bXL;XGNk-ZHRed_#TIJ8qgZxd%^epNGP08Umv@qAi zrGv*BzW1tfzT5B`-AFvwo|_S)NeqUf!`O4)ywQEGNHp*O&lx_%!JtIY#5NsS7R5|9 zInB`|edDS-`Rs)#y00%izUNUiBp6@!=lt=m8My#cKuBjcQT?Q4g$^|MMZ}$(l zM7hCkLbRo@UsEuuj#qek_~9oI8kIdgwvx8>YSJcMY6P`-c*j*`*;~mWNVobv7iRI9 zqjhM%t-oYI}Me1lAUB*rzz!Fid#Sl@ai1zGpnUhWUrs zs|5rVA-|!LFP?yesC5g5C`>;`fk59=e9++Z1uH?l4rvZaai|iEe97=`F17>frUoI? z?rkNaCQ1#v^_tQq;>C?x7EhYWO3{2SpChMDw^yi0h^ke}{vAAIP27)Y{4PG?ISQgu zV>(|B<_m&ntr z0vhJjyHESHB}>k87V5`G*g@DQn~tKgX((p0dH4liHx#KGAu_^H_=PWp0D*Q`j*{O^ zDlL#g8231`N$phEK`coU;4k5cTTy#oeQq(A!OAHc2WiF-4rVgkZP1U;Hrx5z59jb$ zF0C6y0x>|d+P;z%CFGY0WO;aUuZK$eqlQKzka>pWm7JGP>ulUsI z0O|35EyZK3XWKh-R@B-`Y6wz37)ge5*2sjR_h@EqdT+;5$jsm*hmf&yzB5iCrgU}3 z3H4cYf8{t?Gw~{l6$<%F&Rm%zSik;J%RdAu+Sbb(C8N8m!!$(~!7RqP73wrhCk%a{ z`E5&Dfu0OxMzfI;EF*_y)ru!ROsZB=sDFaqL?A?8;r~{Tw?WX{APDo!1rc|{hXFGx ztLK`fstI%BOx)+<+xMvhE@U=e2W8Vj#$)I4zF~#=xN}sGH%Teu?{4fCSzcq+f6m>-clkq)|q*S767 zJsMK(x;`;rWRK)`fn!F2wU6YnpkNX{N7D$kW{=hcfcL8XUXOa)F4gZR-1bHJxTr+$3ncV4RJkt9sXC9~&+he^2F832>^M0Y^KjnRYc^Zrb`gD+8;< zdd=R1#<)E#>u{^NtTxhiK9(0hXC3}zLA$39=GLjnRm zvuZBEFh*6(pB=zRZi`mBA%QI>KU4si0zzwk1#}FI!A@aYE~aU_Fx>6dCo$cg86|he zzOY8kb}{^Nmc3lv%dwXZWBz3U`?KFft^-CPsGSJK(GK~5#L|Ef5$X0{ zcLDajp3y+4$eGFGG$C@9Nk$kirJz(|Gjsx;Kiv(cXMR6Qu1Va;s8M;X^To)3JqHaJ zpBvn(c`M}Jsa;WxluHW~-7GjWI4I+8LT_LX!r6ia<>nT1)Q23ZHJ086@3Ewddzq88 z(&FzO)+RhTY5St{ar$8Idwx+)FiC6lnK~f>U!74N$q}ey@8guP1-D6%J&7Z7>kvN_ z192P#0DCgE&jz{4P%a90Feznk9KC+SDJ&H``p}{aO*0LGt?OQi2de6VGiP0B)hjYI!Z8Ma;gTyE&y%C;DSO_V0Q5iEB%2)-ve*Q1F5emW+AIls4`aXfy!B6%0v+RB-Mol z+X;;=SI$CrG}#5S&2@ws^P|rbx8sQ8h{%SWtyJ3@b>~|zI2I(`$FF@_*DQ^}ekwgU z=`0$Z_rTe%(TEfJ;e(is7hUyKZ)PmpcjmCABgURI+Y)krv{_#XHGJ$C%<<93U|(ke z{bX*kYdP|2Evr;_e|6&gx*T$goldF|HyO}K{jF8JYt<=T#%IOxq`T>Ql9yqDbRB6B zM_J@-^5`tG%hMM4Sn>;<8TYLdd4ZJ-d-nb@&V{fo?8(`40`C`#l!le$E!BqW%kC1K zdy2~@<#dBc_6fET%hvJ!YAWe(o@HB;pI@?x=jw;Ml^OKikKU3!aciF<_U+{ec14Rx z-)T&0-@|$Ya^I@$KH2Z`@bS6pF@L4@WLJ)g)KX*XM;EY!!CY{oVqTK${Gq}6`rbr+ zuTB5LWvsv?*2CvC>v4YMWAmVLmVm4MEwO7zoM4rU!r@A(8s@?!no1!(K58xnWX)#B z#lhvGI^%ICEXN?Qa9{$g{^To_W%h9%_`Qd`)9R4mef5>nR?-Ak8?bwhVn}Owr&~sU zi=Fwoq4#*jDPnYZXpD3Ez&h+WV5a#*ZsN!~thmO6@)UbuzMMOoVkXO{=(-YRkM|T@ zK#Lvh-9Z=mZ8L9zK#b}0&PG-A)b`beZ+!EFJSdHIRfjk)g`T;Vn@?o>#G;CJQITr2(t}sy5LwHO_Kd)bi6h4LcZeA-2L-j2}DL- z;S;)s;2#H`Ya{}sENgz32``O=aC!)g3^*S;1lupCb0`;zY#QtT!s;G~Z-cL){OpZh zp>D^7#h6CN$aRt{KI$2KzGk--rje!i6{(;sy}Q}1DB+oNb#t9N@1p1&Xrf+t zT4XZv+Kwnsk36VaqJ7=VU~xVYu0>?Dvh08R9b~AcY?edqXS4JQ{Q7mhYp7GuYq4+i z2I7QNtNR7}mLh4sC^)p1ci;Faj7*zE`+#$Sw<_YjKd#L&ce8M5g*qf&5^*nLJ2}E08`X$MQL*V+K z35hG` zWw>2;%Rp{TZ1(XE`-7trm3&Y3{?S%h4?=Sv3c0;YtKnNH>KiY(N}4Ncq)og0Z1fxi z2eYMy)bHvQCvQ%FdHS8Sldg$K3Vy?yfEt7+{CqAY$N^XkVj5; zt8peyZtcL?<>iuBWo;7D)9^g*o5gzkAEfzzP4xv+@MJ*rrc>uOWncg8ysuKO*|yNdF@}flU8zdjCi5 z{eNrPG#WBA@y_kv>ynT>PTBNKPs{3SI!EUHYjOI5zwu^3hD3deME~R4&%i;O1*rT+ n&Whgne-!<%|Nbkn{**A>-b4S>bz>s};7{$krb?lbssH}~_h5HX literal 0 HcmV?d00001 From c08c5cdcf9dd808b4e35fd7e04ec1a6d611d8b2c Mon Sep 17 00:00:00 2001 From: Ben Swartzlander Date: Wed, 16 Dec 2020 15:23:58 -0500 Subject: [PATCH 136/258] Add Project Astra to list of snapshot-supporting products --- .../_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md b/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md index 19f7ae5e77..5699c0a669 100644 --- a/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md +++ b/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md @@ -54,6 +54,7 @@ As of the publishing of this blog, the following participants from the [Kubernet - [Dell-EMC: PowerProtect](https://www.delltechnologies.com/en-us/data-protection/powerprotect-data-manager.htm) - [Druva](https://www.druva.com/) - [Kasten K10](https://www.kasten.io/) +- [NetApp: Project Astra](https://cloud.netapp.com/project-astra) - [Portworx (PX-Backup)](https://portworx.com/products/px-backup/) - [Pure Storage (Pure Service Orchestrator)](https://github.com/purestorage/pso-csi) - [Red Hat OpenShift Container Storage](https://www.redhat.com/en/technologies/cloud-computing/openshift-container-storage) From 980d7f124315124c35cde888cb7ac95fcd254551 Mon Sep 17 00:00:00 2001 From: jiajie Date: Sun, 6 Dec 2020 23:31:12 +0800 Subject: [PATCH 137/258] [zh] Update node-conformance.md --- .../setup/best-practices/node-conformance.md | 70 ++++++++++++------- 1 file changed, 46 insertions(+), 24 deletions(-) diff --git a/content/zh/docs/setup/best-practices/node-conformance.md b/content/zh/docs/setup/best-practices/node-conformance.md index 9a5f72fe24..942ff09aec 100644 --- a/content/zh/docs/setup/best-practices/node-conformance.md +++ b/content/zh/docs/setup/best-practices/node-conformance.md @@ -59,18 +59,24 @@ To run the node conformance test, perform the following steps: 要运行节点一致性测试，请执行以下步骤： -1. 因为测试框架会启动一个本地的 master 来测试 Kubelet，所以将 Kubelet 指向本机 `--api-servers="http://localhost:8080"。 - 还有一些其他 Kubelet 参数可能需要注意： - * `--pod-cidr`： 如果使用 `kubenet`， 需要为 Kubelet 任意指定一个 CIDR， 例如 `--pod-cidr=10.180.0.0/24`。 - * `--cloud-provider`： 如果使用 `--cloud-provider=gce`，需要移除这个参数来运行测试。 +1. 得出 kubelet 的 `--kubeconfig` 的值；例如：`--kubeconfig=/var/lib/kubelet/config.yaml`. + 由于测试框架启动了本地控制平面来测试 kubelet， 因此使用 `http://localhost:8080` + 作为API 服务器的 URL。 + 一些其他的 kubelet 命令行参数可能会被用到： + * `--pod-cidr`： 如果使用 `kubenet`， 需要为 Kubelet 任意指定一个 CIDR， + 例如 `--pod-cidr=10.180.0.0/24`。 + * `--cloud-provider`： 如果使用 `--cloud-provider=gce`，需要移除这个参数 + 来运行测试。 2. 使用以下命令运行节点一致性测试： -```shell -# $CONFIG_DIR is the pod manifest path of your Kubelet. -# $LOG_DIR is the test output path. -sudo docker run -it --rm --privileged --net=host \ - -v /:/rootfs -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \ - k8s.gcr.io/node-test:0.2 -``` + ```shell + # $CONFIG_DIR 是您 Kubelet 的 pod manifest 路径。 + # $LOG_DIR 是测试的输出路径。 + sudo docker run -it --rm --privileged --net=host \ + -v /:/rootfs -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \ + k8s.gcr.io/node-test:0.2 + ``` Kubernetes 也为其他硬件体系结构的系统提供了节点一致性测试的 Docker 镜像： - Arch | Image | ---------|:-----------------:| - amd64 | node-test-amd64 | - arm | node-test-arm | - arm64 | node-test-arm64 | + +| 架构 | 镜像 | | +| ----- | :-------------: | ---- | +| amd64 | node-test-amd64 | | +| arm | node-test-arm | | +| arm64 | node-test-arm64 | | 要跳过特定的测试，请使用您希望跳过的测试的常规表达式覆盖环境变量 `SKIP`。 + +```shell +sudo docker run -it --rm --privileged --net=host \ + -v /:/rootfs:ro -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \ + -e SKIP=MirrorPod \ # 运行除 MirrorPod 测试外的所有一致性测试内容 +k8s.gcr.io/node-test:0.2 +``` + * 测试会在节点上遗留一些 Docker 镜像， 包括节点一致性测试本身的镜像和功能测试相关的镜像。 -* 测试会在节点上遗留一些死的容器。这些容器是在功能测试的过程中创建的。 +* 测试会在节点上遗留一些死的容器。这些容器是在功能测试的过程中创建的。 \ No newline at end of file From 6c1870fb844a9856e2daea9a5480b33a1e50835c Mon Sep 17 00:00:00 2001 From: wangxy518 <40482095+wangxy518@users.noreply.github.com> Date: Thu, 17 Dec 2020 09:27:31 +0800 Subject: [PATCH 138/258] Update 2016-01-00-Why-Kubernetes-Doesnt-Use-Libnetwork.md --- .../_posts/2016-01-00-Why-Kubernetes-Doesnt-Use-Libnetwork.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/blog/_posts/2016-01-00-Why-Kubernetes-Doesnt-Use-Libnetwork.md b/content/en/blog/_posts/2016-01-00-Why-Kubernetes-Doesnt-Use-Libnetwork.md index 590548aea2..553bd6ad96 100644 --- a/content/en/blog/_posts/2016-01-00-Why-Kubernetes-Doesnt-Use-Libnetwork.md +++ b/content/en/blog/_posts/2016-01-00-Why-Kubernetes-Doesnt-Use-Libnetwork.md @@ -26,7 +26,7 @@ On the other hand, CNI is more philosophically aligned with Kubernetes. It's far Additionally, it's trivial to wrap a CNI plugin and produce a more customized CNI plugin — it can be done with a simple shell script. CNM is much more complex in this regard. This makes CNI an attractive option for rapid development and iteration. Early prototypes have proven that it's possible to eject almost 100% of the currently hard-coded network logic in kubelet into a plugin. -We investigated [writing a "bridge" CNM driver](https://groups.google.com/forum/#!topic/kubernetes-sig-network/5MWRPxsURUw) for Docker that ran CNI drivers. This turned out to be very complicated. First, the CNM and CNI models are very different, so none of the "methods" lined up. We still have the global vs. local and key-value issues discussed above. Assuming this driver would declare itself local, we have to get info about logical networks from Kubernetes. +We investigated [writing a "bridge" CNM driver](https://groups.google.com/g/kubernetes-sig-network/c/5MWRPxsURUw) for Docker that ran CNI drivers. This turned out to be very complicated. First, the CNM and CNI models are very different, so none of the "methods" lined up. We still have the global vs. local and key-value issues discussed above. Assuming this driver would declare itself local, we have to get info about logical networks from Kubernetes. Unfortunately, Docker drivers are hard to map to other control planes like Kubernetes. Specifically, drivers are not told the name of the network to which a container is being attached — just an ID that Docker allocates internally. This makes it hard for a driver to map back to any concept of network that exists in another system. @@ -34,6 +34,6 @@ This and other issues have been brought up to Docker developers by network vendo For all of these reasons we have chosen to invest in CNI as the Kubernetes plugin model. There will be some unfortunate side-effects of this. Most of them are relatively minor (for example, `docker inspect` will not show an IP address), but some are significant. In particular, containers started by `docker run` might not be able to communicate with containers started by Kubernetes, and network integrators will have to provide CNI drivers if they want to fully integrate with Kubernetes. On the other hand, Kubernetes will get simpler and more flexible, and a lot of the ugliness of early bootstrapping (such as configuring Docker to use our bridge) will go away. -As we proceed down this path, we’ll certainly keep our eyes and ears open for better ways to integrate and simplify. If you have thoughts on how we can do that, we really would like to hear them — find us on [slack](http://slack.k8s.io/) or on our [network SIG mailing-list](https://groups.google.com/forum/#!forum/kubernetes-sig-network). +As we proceed down this path, we’ll certainly keep our eyes and ears open for better ways to integrate and simplify. If you have thoughts on how we can do that, we really would like to hear them — find us on [slack](http://slack.k8s.io/) or on our [network SIG mailing-list](https://groups.google.com/g/kubernetes-sig-network). Tim Hockin, Software Engineer, Google From 2db6f8673789d07cb4cb8aa98973a84d06ccdddb Mon Sep 17 00:00:00 2001 From: wangxy518 <40482095+wangxy518@users.noreply.github.com> Date: Thu, 17 Dec 2020 09:31:45 +0800 Subject: [PATCH 139/258] Update _index.html --- content/de/community/_index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/de/community/_index.html b/content/de/community/_index.html index d636807134..adff754f03 100644 --- a/content/de/community/_index.html +++ b/content/de/community/_index.html @@ -8,7 +8,7 @@ cid: community

Die Gewissheit, dass Kubernetes überall und für alle gut funktioniert.

-

Verbinden Sie sich mit der Kubernetes-Community in unserem Slack Kanal, Diskussionsforum, oder beteiligen Sie sich an der Kubernetes-dev-Google-Gruppe. Eine wöchentliches Community-Meeting findet per Videokonferenz statt, um den Stand der Dinge zu diskutieren, folgen Sie +

Verbinden Sie sich mit der Kubernetes-Community in unserem Slack Kanal, Diskussionsforum, oder beteiligen Sie sich an der Kubernetes-dev-Google-Gruppe. Eine wöchentliches Community-Meeting findet per Videokonferenz statt, um den Stand der Dinge zu diskutieren, folgen Sie diesen Anweisungen für Informationen wie Sie teilnehmen können.

Sie können Kubernetes auch auf der ganzen Welt über unsere Kubernetes Meetup Community und der From aec2737f36c8946b3122035f6daf58b482ff03be Mon Sep 17 00:00:00 2001 From: Cweiping Date: Tue, 15 Dec 2020 11:54:10 +0800 Subject: [PATCH 140/258] add note to kubectl port-forward Signed-off-by: Weiping Cai --- .../port-forward-access-application-cluster.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md b/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md index 3eceb4f6d2..a2fd01a3d7 100644 --- a/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md +++ b/content/en/docs/tasks/access-application-cluster/port-forward-access-application-cluster.md @@ -162,6 +162,12 @@ for database debugging. I0710 14:43:38.274797 3655 portforward.go:225] Forwarding from [::1]:7000 -> 6379 ``` +{{< note >}} + +`kubectl port-forward` does not return. To continue with the exercises, you will need to open another terminal. + +{{< /note >}} + 2. Start the Redis command line interface: ```shell From 4bd7d06de9e7a536be78717c97c686851c9592ad Mon Sep 17 00:00:00 2001 From: Arhell Date: Thu, 17 Dec 2020 03:46:11 +0200 Subject: [PATCH 141/258] [zh] sync networking.md --- content/zh/docs/concepts/cluster-administration/networking.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/concepts/cluster-administration/networking.md b/content/zh/docs/concepts/cluster-administration/networking.md index 847e5a81ea..4af04d60ee 100644 --- a/content/zh/docs/concepts/cluster-administration/networking.md +++ b/content/zh/docs/concepts/cluster-administration/networking.md @@ -228,7 +228,7 @@ AWS VPC CNI 项目是开源的，请查看 [GitHub 上的文档](https://github. ### Azure CNI for Kubernetes [Azure CNI](https://docs.microsoft.com/en-us/azure/virtual-network/container-networking-overview) is an [open source](https://github.com/Azure/azure-container-networking/blob/master/docs/cni.md) plugin that integrates Kubernetes Pods with an Azure Virtual Network (also known as VNet) providing network performance at par with VMs. Pods can connect to peered VNet and to on-premises over Express Route or site-to-site VPN and are also directly reachable from these networks. Pods can access Azure services, such as storage and SQL, that are protected by Service Endpoints or Private Link. You can use VNet security policies and routing to filter Pod traffic. The plugin assigns VNet IPs to Pods by utilizing a pool of secondary IPs pre-configured on the Network Interface of a Kubernetes node. -Azure CNI is available natively in the [Azure Kubernetes Service (AKS)] (https://docs.microsoft.com/en-us/azure/aks/configure-azure-cni). +Azure CNI is available natively in the [Azure Kubernetes Service (AKS)](https://docs.microsoft.com/en-us/azure/aks/configure-azure-cni). --> ### Kubernetes 的 Azure CNI From b877acd8ed8adfc53010c0f4044ae860b3284883 Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Thu, 17 Dec 2020 00:33:18 +0800 Subject: [PATCH 142/258] Update install-kubectl.md sync with English version. Update install-kubectl.md apply suggestion Update install-kubectl.md apply suggestion --- .../zh/docs/tasks/tools/install-kubectl.md | 29 ++++++++++++++----- 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/content/zh/docs/tasks/tools/install-kubectl.md b/content/zh/docs/tasks/tools/install-kubectl.md index 589b89b336..afa5758861 100644 --- a/content/zh/docs/tasks/tools/install-kubectl.md +++ b/content/zh/docs/tasks/tools/install-kubectl.md @@ -234,7 +234,7 @@ If you are on macOS and using [Homebrew](https://brew.sh/) package manager, you --> ### 在 macOS 上使用 Homebrew 安装 {#install-with-homebrew-on-macos} -如果你在 macOS 上且使用 [Homebrew](https://brew.sh/) 包管理器， +如果你使用的是 macOS 系统且使用 [Homebrew](https://brew.sh/) 包管理器， 你可以使用 Homebrew 来安装 kubectl。 1. 运行安装命令： + ```bash + brew install kubectl ``` + + + 或者 + + ```bash brew install kubernetes-cli ``` @@ -269,8 +278,9 @@ If you are on macOS and using [Macports](https://macports.org/) package manager, --> 1. 运行安装命令： - ``` - port install kubectl + ```bash + sudo port selfupdate + sudo port install kubectl ``` 1. 从[此链接](https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe) - 下载最新发型版本。 + 下载最新发行版本 {{< param "fullversion" >}}。 或者如何你安装了 `curl`，使用下面的命令： @@ -385,10 +395,15 @@ Updating the installation is performed by rerunning the two commands listed in s {{< /note >}} +### 在 Windows 系统上用 Chocolatey 或者 Scoop 安装 + + + + 1. 要在 Windows 上用 [Chocolatey](https://chocolatey.org) 或者 [Scoop](https://scoop.sh) 命令行安装程序安装 kubectl： From 220d8d0b927465a9645ce6c1c6313ca1eb7ee690 Mon Sep 17 00:00:00 2001 From: jiajie Date: Thu, 17 Dec 2020 14:54:18 +0800 Subject: [PATCH 143/258] Update connect-applications-service.md [zh] sync content with en master --- .../connect-applications-service.md | 86 ++++++++++++------- 1 file changed, 56 insertions(+), 30 deletions(-) diff --git a/content/zh/docs/concepts/services-networking/connect-applications-service.md b/content/zh/docs/concepts/services-networking/connect-applications-service.md index 06d1744eb2..e20bf10dce 100644 --- a/content/zh/docs/concepts/services-networking/connect-applications-service.md +++ b/content/zh/docs/concepts/services-networking/connect-applications-service.md @@ -11,11 +11,11 @@ weight: 30 Now that you have a continuously running, replicated application you can expose it on a network. Before discussing the Kubernetes approach to networking, it is worthwhile to contrast it with the "normal" way networking works with Docker. -By default, Docker uses host-private networking, so containers can talk to other containers only if they are on the same machine. In order for Docker containers to communicate across nodes, there must be allocated ports on the machine’s own IP address, which are then forwarded or proxied to the containers. This obviously means that containers must either coordinate which ports they use very carefully or ports must be allocated dynamically. +By default, Docker uses host-private networking, so containers can talk to other containers only if they are on the same machine. In order for Docker containers to communicate across nodes, there must be allocated ports on the machine's own IP address, which are then forwarded or proxied to the containers. This obviously means that containers must either coordinate which ports they use very carefully or ports must be allocated dynamically. -Coordinating ports across multiple developers is very difficult to do at scale and exposes users to cluster-level issues outside of their control. Kubernetes assumes that pods can communicate with other pods, regardless of which host they land on. We give every pod its own cluster-private-IP address so you do not need to explicitly create links between pods or map container ports to host ports. This means that containers within a Pod can all reach each other's ports on localhost, and all pods in a cluster can see each other without NAT. The rest of this document will elaborate on how you can run reliable services on such a networking model. +Coordinating port allocations across multiple developers or teams that provide containers is very difficult to do at scale, and exposes users to cluster-level issues outside of their control. Kubernetes assumes that pods can communicate with other pods, regardless of which host they land on. Kubernetes gives every pod its own cluster-private IP address, so you do not need to explicitly create links between pods or map container ports to host ports. This means that containers within a Pod can all reach each other's ports on localhost, and all pods in a cluster can see each other without NAT. The rest of this document elaborates on how you can run reliable services on such a networking model. -This guide uses a simple nginx server to demonstrate proof of concept. The same principles are embodied in a more complete [Jenkins CI application](https://kubernetes.io/blog/2015/07/strong-simple-ssl-for-kubernetes). +This guide uses a simple nginx server to demonstrate proof of concept. --> ## Kubernetes 连接容器模型 @@ -26,14 +26,13 @@ This guide uses a simple nginx server to demonstrate proof of concept. The same 默认情况下，Docker 使用私有主机网络连接，只能与同在一台机器上的容器进行通信。 为了实现容器的跨节点通信，必须在机器自己的 IP 上为这些容器分配端口，为容器进行端口转发或者代理。 -多个开发人员之间协调端口的使用很难做到规模化，那些难以控制的集群级别的问题，都会交由用户自己去处理。 +多个开发人员或是提供容器的团队之间协调端口的分配很难做到规模化，那些难以控制的集群级别的问题，都会交由用户自己去处理。 Kubernetes 假设 Pod 可与其它 Pod 通信，不管它们在哪个主机上。 -我们给 Pod 分配属于自己的集群私有 IP 地址，所以没必要在 Pod 或映射到的容器的端口和主机端口之间显式地创建连接。 +Kubernetes 给 Pod 分配属于自己的集群私有 IP 地址，所以没必要在 Pod 或映射到的容器的端口和主机端口之间显式地创建连接。 这表明了在 Pod 内的容器都能够连接到本地的每个端口，集群中的所有 Pod 不需要通过 NAT 转换就能够互相看到。 -文档的剩余部分将详述如何在一个网络模型之上运行可靠的服务。 +文档的剩余部分详述如何在一个网络模型之上运行可靠的服务。 -该指南使用一个简单的 Nginx server 来演示并证明谈到的概念。同样的原则也体现在一个更加完整的 -[Jenkins CI 应用](https://kubernetes.io/blog/2015/07/strong-simple-ssl-for-kubernetes.html) 中。 +该指南使用一个简单的 Nginx server 来演示并证明谈到的概念。 @@ -307,15 +306,17 @@ kube-dns ClusterIP 10.0.0.10 53/UDP,53/TCP 8m 如果没有在运行，可以[启用它](https://releases.k8s.io/{{< param "githubbranch" >}}/cluster/addons/dns/kube-dns/README.md#how-do-i-configure-it)。 本段剩余的内容，将假设已经有一个 Service，它具有一个长久存在的 IP（my-nginx）， -一个为该 IP 指派名称的 DNS 服务器（kube-dns 集群插件），所以可以通过标准做法， -使在集群中的任何 Pod 都能与该 Service 通信（例如：gethostbyname）。 +一个为该 IP 指派名称的 DNS 服务器。 这里我们使用 CoreDNS 集群插件（应用名为 `kube-dns`）， +所以可以通过标准做法，使在集群中的任何 Pod 都能与该 Service 通信（例如：`gethostbyname()`）。 +如果 CoreDNS 没有在运行，你可以参照 +[CoreDNS README](https://github.com/coredns/deployment/tree/master/kubernetes) 或者 +[安装 CoreDNS](/docs/tasks/administer-cluster/coredns/#installing-coredns) 来启用它。 让我们运行另一个 curl 应用来进行测试： ```shell @@ -377,7 +378,38 @@ kubectl get secrets ``` NAME TYPE DATA AGE default-token-il9rc kubernetes.io/service-account-token 1 1d -nginxsecret Opaque 2 1m +nginxsecret kubernetes.io/tls 2 1m +``` + + +以下是 configmap： +```shell +kubectl create configmap nginxconfigmap --from-file=default.conf +``` +``` +configmap/nginxconfigmap created +``` +```shell +kubectl get configmaps +``` +``` +NAME DATA AGE +nginxconfigmap 1 114s ``` + + +**作者**: Michael Taufen (Google) + + +**编者注：这篇文章是[一系列深度文章](https://kubernetes.io/blog/2018/06/27/kubernetes-1.11-release-announcement/) 的一部分，这个系列介绍了 Kubernetes 1.11 中的新增功能** + + +## 为什么要进行动态 Kubelet 配置？ + + +Kubernetes 提供了以 API 为中心的工具，可显着改善用于管理应用程序和基础架构的工作流程。 +但是，在大多数的 Kubernetes 安装中，kubelet 在每个主机上作为本机进程运行，因此 +未被标准 Kubernetes API 覆盖。 + + +过去，这意味着集群管理员和服务提供商无法依靠 Kubernetes API 在活动集群中重新配置 Kubelets。 +实际上，这要求操作员要 SSH 登录到计算机以执行手动重新配置，要么使用第三方配置管理自动化工具， +或创建已经安装了所需配置的新 VM，然后将工作迁移到新计算机上。 +这些方法是特定于环境的，并且可能很耗时费力。 + + +动态 Kubelet 配置使集群管理员和服务提供商能够通过 Kubernetes API 在活动集群中重新配置 Kubelet。 + + +## 什么是动态 Kubelet 配置？ + + +Kubernetes v1.10 使得可以通过 Beta 版本的[配置文件](/zh/docs/tasks/administer-cluster/kubelet-config-file/) +API 配置 kubelet。 +Kubernetes 已经提供了用于在 API 服务器中存储任意文件数据的 ConfigMap 抽象。 + + +动态 Kubelet 配置扩展了 Node 对象，以便 Node 可以引用包含相同类型配置文件的 ConfigMap。 +当节点更新为引用新的 ConfigMap 时，关联的 Kubelet 将尝试使用新的配置。 + + +## 它是如何工作的？ + + +动态 Kubelet 配置提供以下核心功能： + + +* Kubelet 尝试使用动态分配的配置。 +* Kubelet 将其配置已检查点的形式保存到本地磁盘，无需 API 服务器访问即可重新启动。 +* Kubelet 在 Node 状态中报告已指定的、活跃的和最近已知良好的配置源。 +* 当动态分配了无效的配置时，Kubelet 会自动退回到最后一次正确的配置，并在 Node 状态中报告错误。 + + +要使用动态 Kubelet 配置功能，群集管理员或服务提供商将首先发布包含所需配置的 ConfigMap， +然后设置每个 Node.Spec.ConfigSource.ConfigMap 引用以指向新的 ConfigMap。 +运营商可以以他们喜欢的速率更新这些参考，从而使他们能够执行新配置的受控部署。 + + +每个 Kubelet 都会监视其关联的 Node 对象的更改。 +更新 Node.Spec.ConfigSource.ConfigMap 引用后， +Kubelet 将通过将其包含的文件通过检查点机制写入本地磁盘保存新的 ConfigMap。 +然后，Kubelet 将退出，而操作系统级进程管理器将重新启动它。 +请注意，如果未设置 Node.Spec.ConfigSource.ConfigMap 引用， +则 Kubelet 将使用其正在运行的计算机本地的一组标志和配置文件。 + + +重新启动后，Kubelet 将尝试使用来自新检查点的配置。 +如果新配置通过了 Kubelet 的内部验证，则 Kubelet 将更新 +Node.Status.Config 用以反映它正在使用新配置。 +如果新配置无效，则 Kubelet 将退回到其最后一个正确的配置，并在 Node.Status.Config 中报告错误。 + + +请注意，默认的最后一次正确配置是 Kubelet 命令行标志与 Kubelet 的本地配置文件的组合。 +与配置文件重叠的命令行标志始终优先于本地配置文件和动态配置，以实现向后兼容。 + + +有关单个节点的配置更新的高级概述，请参见下图： + +![kubelet-diagram](/images/blog/2018-07-11-dynamic-kubelet-configuration/kubelet-diagram.png) + + +## 我如何了解更多？ + + +请参阅/docs/tasks/administer-cluster/reconfigure-kubelet/上的官方教程， +其中包含有关用户工作流，某配置如何成为“最新的正确的”配置，Kubelet 如何对配置执行“检查点”操作等， +更多详细信息，以及可能的故障模式。 From 9d6c1af320d20a3f05d1c1cb9dea76ece5375fb7 Mon Sep 17 00:00:00 2001 From: jiajie Date: Thu, 17 Dec 2020 15:43:03 +0800 Subject: [PATCH 145/258] Update service-topology.md [zh] update content to match en master --- .../services-networking/service-topology.md | 141 +++++++++++++++++- 1 file changed, 134 insertions(+), 7 deletions(-) diff --git a/content/zh/docs/concepts/services-networking/service-topology.md b/content/zh/docs/concepts/services-networking/service-topology.md index ea84fddfab..1791e45f7e 100644 --- a/content/zh/docs/concepts/services-networking/service-topology.md +++ b/content/zh/docs/concepts/services-networking/service-topology.md @@ -1,17 +1,26 @@ --- -reviewers: -- johnbelamaric -- imroc -title: Service 拓扑 +title: 服务拓扑（Service Topology） feature: - title: Service 拓扑 + title: 服务拓扑（Service Topology） description: > 基于集群拓扑的服务流量路由。 content_type: concept weight: 10 --- + @@ -160,12 +169,130 @@ traffic as follows. * 通配符：`"*"`，如果要用，则必须是拓扑键值的最后一个值。 -## {{% heading "whatsnext" %}} + +## 示例 + +以下是使用服务拓扑功能的常见示例。 + + +### 仅节点本地端点 + + +仅路由到节点本地端点的一种服务。 如果节点上不存在端点，流量则被丢弃： + +```yaml +apiVersion: v1 +kind: Service +metadata: + name: my-service +spec: + selector: + app: my-app + ports: + - protocol: TCP + port: 80 + targetPort: 9376 + topologyKeys: + - "kubernetes.io/hostname" +``` + + +### 首选节点本地端点 + + +首选节点本地端点，如果节点本地端点不存在，则回退到集群范围端点的一种服务： + +```yaml +apiVersion: v1 +kind: Service +metadata: + name: my-service +spec: + selector: + app: my-app + ports: + - protocol: TCP + port: 80 + targetPort: 9376 + topologyKeys: + - "kubernetes.io/hostname" + - "*" +``` + + +### 仅地域或区域端点 + +首选地域端点而不是区域端点的一种服务。 如果以上两种范围内均不存在端点，流量则被丢弃。 + + +```yaml +apiVersion: v1 +kind: Service +metadata: + name: my-service +spec: + selector: + app: my-app + ports: + - protocol: TCP + port: 80 + targetPort: 9376 + topologyKeys: + - "topology.kubernetes.io/zone" + - "topology.kubernetes.io/region" +``` + + +### 优先选择节点本地端点，地域端点，然后是区域端点 + + +优先选择节点本地端点，地域端点，然后是区域端点，然后才是集群范围端点的一种服务。 + +```yaml +apiVersion: v1 +kind: Service +metadata: + name: my-service +spec: + selector: + app: my-app + ports: + - protocol: TCP + port: 80 + targetPort: 9376 + topologyKeys: + - "kubernetes.io/hostname" + - "topology.kubernetes.io/zone" + - "topology.kubernetes.io/region" + - "*" +``` + + +## {{% heading "whatsnext" %}} * 阅读关于[启用服务拓扑](/zh/docs/tasks/administer-cluster/enabling-service-topology/) * 阅读[用服务连接应用程序](/zh/docs/concepts/services-networking/connect-applications-service/) - From fcef54f2c836f3d923b8f6f9682159f3c15b5166 Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Thu, 17 Dec 2020 16:02:16 +0800 Subject: [PATCH 146/258] Update namespaces.md update the unnumbered format --- content/en/docs/tasks/administer-cluster/namespaces.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/namespaces.md b/content/en/docs/tasks/administer-cluster/namespaces.md index 00dec41774..08b2868806 100644 --- a/content/en/docs/tasks/administer-cluster/namespaces.md +++ b/content/en/docs/tasks/administer-cluster/namespaces.md @@ -13,7 +13,7 @@ This page shows how to view, work in, and delete {{< glossary_tooltip text="name ## {{% heading "prerequisites" %}} * Have an [existing Kubernetes cluster](/docs/setup/). -2. You have a basic understanding of Kubernetes {{< glossary_tooltip text="Pods" term_id="pod" >}}, {{< glossary_tooltip term_id="service" text="Services" >}}, and {{< glossary_tooltip text="Deployments" term_id="deployment" >}}. +* You have a basic understanding of Kubernetes {{< glossary_tooltip text="Pods" term_id="pod" >}}, {{< glossary_tooltip term_id="service" text="Services" >}}, and {{< glossary_tooltip text="Deployments" term_id="deployment" >}}. From fa4f27b2388093be5b6555402c516b3044db74da Mon Sep 17 00:00:00 2001 From: jiajie Date: Thu, 17 Dec 2020 16:04:18 +0800 Subject: [PATCH 147/258] Update persistent-volumes.md [zh] update content to match en master --- .../concepts/storage/persistent-volumes.md | 78 ++++++++++++++----- 1 file changed, 58 insertions(+), 20 deletions(-) diff --git a/content/zh/docs/concepts/storage/persistent-volumes.md b/content/zh/docs/concepts/storage/persistent-volumes.md index 7c58f225d5..c7718e708c 100644 --- a/content/zh/docs/concepts/storage/persistent-volumes.md +++ b/content/zh/docs/concepts/storage/persistent-volumes.md @@ -612,26 +612,64 @@ PersistentVolume types are implemented as plugins. Kubernetes currently support PV 持久卷是用插件的形式来实现的。Kubernetes 目前支持以下插件： -* GCEPersistentDisk -* AWSElasticBlockStore -* AzureFile -* AzureDisk -* CSI -* FC （光纤通道） -* FlexVolume -* Flocker -* NFS -* iSCSI -* RBD （Ceph 块设备） -* CephFS -* Cinder （OpenStack 块存储） -* Glusterfs -* VsphereVolume -* Quobyte 卷 -* HostPath （仅供单节点测试用，本地存储都是不支持的，在多节点集群中无法工作） -* Portworx 卷 -* ScaleIO 卷 -* StorageOS + +* [`awsElasticBlockStore`](/docs/concepts/storage/volumes/#awselasticblockstore) - AWS 弹性块存储（EBS） +* [`azureDisk`](/docs/concepts/sotrage/volumes/#azuredisk) - Azure Disk +* [`azureFile`](/docs/concepts/storage/volumes/#azurefile) - Azure File +* [`cephfs`](/docs/concepts/storage/volumes/#cephfs) - CephFS volume +* [`cinder`](/docs/concepts/storage/volumes/#cinder) - Cinder （OpenStack 块存储） + (**弃用**) +* [`csi`](/docs/concepts/storage/volumes/#csi) - 容器存储接口 (CSI) +* [`fc`](/docs/concepts/storage/volumes/#fc) - Fibre Channel (FC) 存储 +* [`flexVolume`](/docs/concepts/storage/volumes/#flexVolume) - FlexVolume +* [`flocker`](/docs/concepts/storage/volumes/#flocker) - Flocker 存储 +* [`gcePersistentDisk`](/docs/concepts/storage/volumes/#gcepersistentdisk) - GCE 持久化盘 +* [`glusterfs`](/docs/concepts/storage/volumes/#glusterfs) - Glusterfs 卷 +* [`hostPath`](/docs/concepts/storage/volumes/#hostpath) - HostPath 卷 + （仅供单节点测试使用；不适用于多节点集群； + 尝试使用 `本地` 卷替换） +* [`iscsi`](/docs/concepts/storage/volumes/#iscsi) - iSCSI (SCSI over IP) 存储 +* [`local`](/docs/concepts/storage/volumes/#local) - 节点上挂载的本地存储设备 +* [`nfs`](/docs/concepts/storage/volumes/#nfs) - 网络文件系统 (NFS) 存储 +* `photonPersistentDisk` - Photon 控制器持久化盘。 + （这个卷类型已经因对应的云提供商被移除而被弃用）。 +* [`portworxVolume`](/docs/concepts/storage/volumes/#portworxvolume) - Portworx 卷 +* [`quobyte`](/docs/concepts/storage/volumes/#quobyte) - Quobyte 卷 +* [`rbd`](/docs/concepts/storage/volumes/#rbd) - Rados 块设备 (RBD) 卷 +* [`scaleIO`](/docs/concepts/storage/volumes/#scaleio) - ScaleIO 卷 + (**弃用**) +* [`storageos`](/docs/concepts/storage/volumes/#storageos) - StorageOS 卷 +* [`vsphereVolume`](/docs/concepts/storage/volumes/#vspherevolume) - vSphere VMDK 卷 -[`kubeadm`](/zh/docs/tasks/tools/install-kubeadm/) 是一个命令行工具， +[`kubeadm`](/zh/docs/setup/production-environment/tools/kubeadm/install-kubeadm/) 是一个命令行工具， 可以用来在物理机、云服务器或虚拟机（目前处于 alpha 阶段） 上轻松部署一个安全可靠的 Kubernetes 集群。 From b7fbfd355af2e3b664dfdf87a8c8e0da9c2ccad0 Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Thu, 17 Dec 2020 17:00:19 +0800 Subject: [PATCH 150/258] Create 2015-11-00-Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community.md --- ...mproved-Tooling-And-A-Growing-Community.md | 140 ++++++++++++++++++ 1 file changed, 140 insertions(+) create mode 100644 content/zh/blog/_posts/2015-11-00-Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community.md diff --git a/content/zh/blog/_posts/2015-11-00-Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community.md b/content/zh/blog/_posts/2015-11-00-Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community.md new file mode 100644 index 0000000000..5ce36abee0 --- /dev/null +++ b/content/zh/blog/_posts/2015-11-00-Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community.md @@ -0,0 +1,140 @@ +--- +title: " Kubernetes 1.1 性能升级，工具改进和社区不断壮大 " +date: 2015-11-09 +slug: kubernetes-1-1-performance-upgrades-improved-tooling-and-a-growing-community +url: /blog/2015/11/Kubernetes-1-1-Performance-Upgrades-Improved-Tooling-And-A-Growing-Community +--- + + +自从 Kubernetes 1.0 在七月发布以来，我们已经看到大量公司采用建立分布式系统来管理其容器集群。 +我们也对帮助 Kubernetes 社区变得更好，迅速发展的人感到钦佩。 +我们已经看到诸如 CoreOS 的 Tectonic 和 RedHat Atomic Host 之类的商业产品应运而生，用以提供 Kubernetes 的部署和支持。 +一个不断发展的生态系统增加了 Kubernetes 的支持，包括 Sysdig 和 Project Calico 等工具供应商。 + + +在数百名贡献者的帮助下，我们自豪地宣布 Kubernetes 1.1 的可用性，它提供了主要的性能升级、改进的工具和新特性，使应用程序更容易构建和部署。 + + +我们想强调的一些工作包括: + + +- **实质性的性能提升** ：从第一天开始，我们就设计了 Kubernetes 来处理 Google 规模的工作负载，而我们的客户已经按照自己的进度进行了调整。 + 在 Kubernetes 1.1 中，我们进行了进一步的投资，以确保您可以在超大规模环境中运行； + 本周晚些时候，我们将分享运行数千个节点集群，并针对单个集群运行超过一百万个 QPS 的示例。 + + +- **网络吞吐量显着提高** : 运行 Google 规模的工作负载也需要 Google 规模的网络。 + 在 Kubernetes 1.1 中，我们提供了使用本机IP表的选项，可将尾部延迟减少80％，几乎完全消除了CPU开销，并提高了可靠性和系统架构，从而确保Kubernetes可以很好地处理未来的大规模吞吐量。 + + +- **水平 Pod 自动缩放 (测试版)**：许多工作负载可能会经历尖峰的使用期，从而给用户带来不均匀的体验。 + Kubernetes 现在支持水平 Pod 自动缩放，这意味着您的 Pod 可以根据 CPU 使用率进行缩放。 + 阅读有关[水平 Pod 自动缩放](http://kubernetes.io/v1.1/docs/user-guide/horizontal-pod-autoscaler.html)的更多信息。 + + +- **HTTP 负载均衡器 (测试版)**：Kubernetes 现在具有基于数据包自省功能来路由 HTTP 流量的内置功能。 + 这意味着您可以让 ‘http://foo.com/bar’ 使用一项服务，而 ‘http://foo.com/meep’ 使用一项完全独立的服务。 + 阅读有关[Ingress对象](http://kubernetes.io/v1.1/docs/user-guide/ingress.html)的更多信息。 + + +- **Job 对象 (测试版)**：我们也经常需要集成的批处理 Job ，例如处理一批图像以创建缩略图，或者将特别大的数据文件分解成很多块。 + [Job 对象](https://github.com/kubernetes/kubernetes/blob/master/docs/user-guide/jobs.md#writing-a-job-spec)引入了一个新的 API 对象，该对象运行工作负载， +如果失败，则重新启动它，并继续尝试直到成功完成。 + 阅读有关[Job 对象](http://kubernetes.io/v1.1/docs/user-guide/jobs.html)的更多信息。 + + +- **新功能可缩短开发人员的测试周期** :我们将继续致力于快速便捷地为 Kubernetes 开发应用程序。 + 加快开发人员工作流程的两项新功能包括以交互方式运行容器的功能，以及改进的架构验证功能，可在部署配置文件之前让您知道配置文件是否存在任何问题。 + + +- **滚动更新改进** : DevOps 运动的核心是能够发布新更新，而不会影响正在运行的服务。 + 滚动更新现在可确保在继续更新之前，已更新的 Pod 状况良好。 + + +- 还有很多。有关更新的完整列表，请参见[1.1. 发布](https://github.com/kubernetes/kubernetes/releases)在GitHub上的笔记 + + +今天，我们也很荣幸地庆祝首届Kubernetes会议[KubeCon](https://kubecon.io/)，约有400个社区成员以及数十个供应商参加支持 Kubernetes 项目的会议。 + + +我们想强调几个使 Kuberbetes 变得更好的众多合作伙伴中的几位： + + +> “我们押注我们的主要产品 Tectonic-它能使任何公司都能在任何地方部署、管理和保护其容器-在 Kubernetes 上使用，因为我们认为这是数据中心的未来。 + Kubernetes 1.1 的发布是另一个重要的里程碑，它将使分布式系统和容器得到更广泛的采用，并使我们走上一条必将导致新一代产品和服务的道路。” – CoreOS 首席执行官Alex Polvi + + +> “Univa 的客户正在寻找可扩展的企业级解决方案，以简化企业中容器和非容器工作负载的管理。 + 我们选择Kubernetes作为我们新的 Navops 套件的基础，它将帮助 IT 和 DevOps 将容器化工作负载快速集成到他们的生产系统中，并将这些工作负载扩展到云服务中。” – Univa 首席执行官 Gary Tyreman + + +> “我们看到通过 Kubernetes 大规模运行容器的巨大客户需求是推动 Redapt 专业服务业务增长的关键因素。 + 作为值得信赖的顾问，在我们的工具带中有像 Kubernetes 这样的工具能够帮助我们的客户实现他们的目标，这是非常棒的。“ – Redapt SR 云解决方案副总裁 Paul Welch +> + +如上所述，我们希望得到您的帮助: + + +- 在 [GitHub](https://github.com/kubernetes/kubernetes)上参与 Kubernetes 项目； +- 通过 [Slack](http://slack.kubernetes.io/) 与社区联系； +- 关注我们的 Twitter [@Kubernetesio](https://twitter.com/kubernetesio) 获取最新信息； +- 在 Stackoverflow 上发布问题（或回答问题） +- 开始运行，部署和使用 Kubernetes [指南](/docs/tutorials/kubernetes-basics/)； + + +但是，最重要的是，请让我们知道您是如何使用 Kubernetes 改变您的业务的，以及我们如何可以帮助您更快地做到这一点。谢谢您的支持! + + + - David Aronchick, Kubernetes 和谷歌容器引擎的高级产品经理 + From 503022930cb23b3d82f9a7202be4637be165b392 Mon Sep 17 00:00:00 2001 From: jiajie Date: Thu, 17 Dec 2020 17:03:57 +0800 Subject: [PATCH 151/258] Update volume-snapshots.md [zh] update content to match en master --- .../docs/concepts/storage/volume-snapshots.md | 38 ++++++++++++------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/content/zh/docs/concepts/storage/volume-snapshots.md b/content/zh/docs/concepts/storage/volume-snapshots.md index fe9360264a..67a7afff0a 100644 --- a/content/zh/docs/concepts/storage/volume-snapshots.md +++ b/content/zh/docs/concepts/storage/volume-snapshots.md @@ -44,7 +44,7 @@ A `VolumeSnapshot` is a request for snapshot of a volume by a user. It is simila `VolumeSnapshot` 是用户对于卷的快照的请求。它类似于持久卷声明。 `VolumeSnapshotClass` 允许指定属于 `VolumeSnapshot` 的不同属性。在从存储系统的相同卷上获取的快照之间，这些属性可能有所不同，因此不能通过使用与 `PersistentVolumeClaim` 相同的 `StorageClass` 来表示。 @@ -63,14 +63,26 @@ Users need to be aware of the following when using this feature: -* API 对象 `VolumeSnapshot`，`VolumeSnapshotContent` 和 `VolumeSnapshotClass` 是 {{< glossary_tooltip term_id="CustomResourceDefinition" text="CRDs" >}}，不是核心 API 的部分。 +* API 对象 `VolumeSnapshot`，`VolumeSnapshotContent` 和 `VolumeSnapshotClass` + 是 {{< glossary_tooltip term_id="CustomResourceDefinition" text="CRDs" >}}， + 不是核心 API 的部分。 * `VolumeSnapshot` 支持仅可用于 CSI 驱动。 -* 作为 beta 版本 `VolumeSnapshot` 部署过程的一部分，Kubernetes 团队提供了一个部署于控制平面的快照控制器，并且提供了一个叫做 `csi-snapshotter` 的 sidecar 帮助容器，它和 CSI 驱动程序部署在一起。快照控制器监视 `VolumeSnapshot` 和 `VolumeSnapshotContent` 对象，并且负责动态的创建和删除 `VolumeSnapshotContent` 对象。sidecar csi-snapshotter 监视 `VolumeSnapshotContent` 对象，并且触发针对 CSI 端点的 `CreateSnapshot` 和 `DeleteSnapshot` 的操作。 -* CSI 驱动可能实现，也可能没有实现卷快照功能。CSI 驱动可能会使用 csi-snapshotter 来提供对卷快照的支持。详见 [CSI 驱动程序文档](https://kubernetes-csi.github.io/docs/) +* 作为 `VolumeSnapshot` 部署过程的一部分，Kubernetes 团队提供了一个部署于控制平面的快照控制器， + 并且提供了一个叫做 `csi-snapshotter` 的 sidecar 帮助容器，它和 CSI 驱动程序部署在一起。 + 快照控制器监视 `VolumeSnapshot` 和 `VolumeSnapshotContent` 对象， + 并且负责动态供应中的创建和删除 `VolumeSnapshotContent` 对象。 + sidecar csi-snapshotter 监视 `VolumeSnapshotContent` 对象， + 并且触发针对 CSI 端点的 `CreateSnapshot` 和 `DeleteSnapshot` 的操作。 +* 还有一个验证 webhook服务器，它可以对快照对象进行更严格的验证。 + Kubernetes 发行版应将其与快照控制器和 CRD（而非 CSI 驱动程序）一起安装。 + 它应该安装在所有启用了快照功能的 Kubernetes 集群中。 +* CSI 驱动可能实现，也可能没有实现卷快照功能。CSI 驱动可能会使用 csi-snapshotter + 来提供对卷快照的支持。详见 [CSI 驱动程序文档](https://kubernetes-csi.github.io/docs/) * Kubernetes 负责 CRDs 和快照控制器的安装。 ### 快照源的持久性卷声明保护 -这种保护的目的是确保在从系统中获取快照时，不会将正在使用的 `PersistentVolumeClaim` API 对象从系统中删除（因为这可能会导致数据丢失）。 +这种保护的目的是确保在从系统中获取快照时，不会将正在使用的 {{< glossary_tooltip text="PersistentVolumeClaim" term_id="persistent-volume-claim" >}} API 对象从系统中删除（因为这可能会导致数据丢失）。 更多详细信息，请参阅 [卷快照和从快照还原卷](/zh/docs/concepts/storage/persistent-volumes/#volume-snapshot-and-restore-volume-from-snapshot-support)。 - From d2bf36047f680375f8b889423cb7e77a5350c68c Mon Sep 17 00:00:00 2001 From: CooperLi Date: Thu, 17 Dec 2020 19:07:38 +0800 Subject: [PATCH 152/258] Update debug-application.md Fix typo --- .../docs/tasks/debug-application-cluster/debug-application.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/debug-application-cluster/debug-application.md b/content/zh/docs/tasks/debug-application-cluster/debug-application.md index 57863d4146..10c7264e4f 100644 --- a/content/zh/docs/tasks/debug-application-cluster/debug-application.md +++ b/content/zh/docs/tasks/debug-application-cluster/debug-application.md @@ -150,7 +150,7 @@ The first thing to do is to delete your pod and try creating it again with the ` For example, run `kubectl apply --validate -f mypod.yaml`. If you misspelled `command` as `commnd` then will give an error like this: --> -可以做的第一件事是删除你的 Pod，并尝试才有 `--validate` 选项重新创建。 +可以做的第一件事是删除你的 Pod，并尝试带有 `--validate` 选项重新创建。 例如，运行 `kubectl apply --validate -f mypod.yaml`。 如果 `command` 被误拼成 `commnd`，你将会看到下面的错误信息： From 88dae3183d06598b3ffe34360d5274cfb16b13b9 Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Thu, 17 Dec 2020 23:24:14 +0800 Subject: [PATCH 153/258] Update safely-drain-node.md sync with English version --- content/zh/docs/tasks/administer-cluster/safely-drain-node.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/zh/docs/tasks/administer-cluster/safely-drain-node.md b/content/zh/docs/tasks/administer-cluster/safely-drain-node.md index 51f38b4924..06fdf6a07d 100644 --- a/content/zh/docs/tasks/administer-cluster/safely-drain-node.md +++ b/content/zh/docs/tasks/administer-cluster/safely-drain-node.md @@ -106,6 +106,8 @@ First, identify the name of the node you wish to drain. You can list all of the 然后就可以安全地关闭节点， 比如关闭物理机器的电源，如果它运行在云平台上，则删除它的虚拟机。 +首先，确定想要清空的节点的名称。可以用以下命令列出集群中的所有节点: + ```shell kubectl get nodes ``` From f93a709d4e99e73733f1832266c9eb04faf2cb18 Mon Sep 17 00:00:00 2001 From: Slava Semushin Date: Thu, 17 Dec 2020 22:55:42 +0700 Subject: [PATCH 154/258] chore(content/ru/main_index.temp.txt): delete unused temporary file --- content/ru/main_index.temp.txt | 82 ---------------------------------- 1 file changed, 82 deletions(-) delete mode 100644 content/ru/main_index.temp.txt diff --git a/content/ru/main_index.temp.txt b/content/ru/main_index.temp.txt deleted file mode 100644 index 17c643c8e4..0000000000 --- a/content/ru/main_index.temp.txt +++ /dev/null @@ -1,82 +0,0 @@ -Документация Kubernetes -Kubernetes - открытое программное обеспечение для автоматизации развёртывания, масштабирования и управления контейнеризированными приложениями. Проект находится под управлением Cloud Native Computing Foundation (CNCF). - -* Основы -Узнайте о Kubernetes и его фундаментальных концепциях. -- Что такое Kubernetes -- Компоненты Kubernetes -- Kubernetes API -- Понимая Kubernetes -- Объекты -- Оброз Подов - -Перейти к изучению концепций - - -* Попробуйте Kubernetes -С помощью обучающих примеров узнаете, как развернуть приложение в Kubernetes. -- Hello Minikube -- Обзор основ -- Пример Stateless приложения: PHP -- Гостевая книга с использованием Redis -- Пример: добавление логирования и метрик для PHP/Redis приложения -- Гостевая книга -- Пример Stateful приложения: Wordpress c Persistent Volume(?) - -Перейти к просмотру уроков - -* Настройка кластера -Запустите Kubernetes с требуемыми ресурсами. -- (!hosterd)CNCF решения -- Решения Turnkey Cloud -- Решения On-Premises -- Пользовательские решения -- Локальная машина -- Установка инструментов для настройки kubeadm - -Перейти к настройке Kubernetes - - -* Узнайте об использовании Kubernetes -Обзор общих решений и коротких путей их реализации. -- Установка Minikube -- Установка kubectl -- Использование дашборда Web UI -- Настройка доступа к нескольким кластерам -- ... - -Перейти к просмотру задач - -* Просмотр справочной информации -Обзор терминологии, синтаксиса командной строки, типов ресурсов API и документации по настройке инструментов -- Словарь -- Обзор kubectl -- Справочник полезных команд kubectl -- Обзор kubectl -- Обзор API - -Перейти к просмотру справочной информации - -* Внести вклад в документацию -(! исправить)Внести свой вклад может любой человек, как начинающий, так и тот, кто уже давно пользуется продуктом. -- Как начать участие -- Инструкция по оформлению документации -- Использование шаблона страниц -- Перевод документации -- Участие в SIG документации -- Intermediate contributing (что это?) - -Внести свой вклад в документацию - -* Загрузка Kubernetes -Если вы хотите установить Kubernetes или обновить Kubernetes до последней версии, обратитесь к списку актуальных версий. -- Список актуальных версий -- Заметки для срочного обновления -- Сборка релиза - -* О документации -На сайте содержится документация для актуальной и четырёх прошлых версий Kubernetes -- Список версий с документацией - - -(! исправить)Создать задачу From 3b0c7985f7257424f775c9c208626f0c33d2da88 Mon Sep 17 00:00:00 2001 From: Slava Semushin Date: Thu, 17 Dec 2020 22:57:13 +0700 Subject: [PATCH 155/258] chore(content/ru/setup.temp.txt): delete unused temporary file --- content/ru/setup.temp.txt | 23 ----------------------- 1 file changed, 23 deletions(-) delete mode 100644 content/ru/setup.temp.txt diff --git a/content/ru/setup.temp.txt b/content/ru/setup.temp.txt deleted file mode 100644 index e1a7d4a809..0000000000 --- a/content/ru/setup.temp.txt +++ /dev/null @@ -1,23 +0,0 @@ -Настройка -Используйте информацию на этой странице, чтобы найти наиболее подходящее для вас решение по установке и настройке. - -Решение о том, как запускать Kubernetes, зависит от доступных ресурсов и необходимого уровня гибкости использования (?). Запуск Kubernetes возмомжен практически на чём угодно, от вашего ноутбука или виртуальных машины у облачного провайдера и до физических серверов. (!исправить)Решения позволяют как настроить полностью управляемый кластер запуском единственной команды так и создать пользовательский кластер на физических серверах. -- Решения для запуска на локальной машине -- (!hosterd)CNCF решения -- Turnkey - облачные решения -- Turnkey - On-Premises решения -- Пользовательские решения -- Что дальше? - -* Решения для запуска на локальной машине -Запуск на локальной машине позволяет легко начать работу с Kubernetes. Можно создавать и тестировать кластер Kubernetes не беспокоясь о трате облачных ресурсов и квотах. -Вам следует выбрать запуск на локальной машине, если вы: -- Пробуете или начинаете работу с Kubernetes -- Локально разрабатываете и тестируете кластер - -Выбрать решение для запуска на локальной машине - -* Hosted (Нативные?) решения -Hosted решения позволяют надёжно и удобно создавать и поддерживать кластеры Kubernetes. Они настраивают и управляют кластером самостоятельно, не требуя ручного вмешательства. -Вам следует выбрать hosted решение, если вы: -- \ No newline at end of file From 815fe37905c6aec04add239295f1bacc833fe6bf Mon Sep 17 00:00:00 2001 From: Pavel Nosov <62751738+pnosov@users.noreply.github.com> Date: Thu, 17 Dec 2020 20:43:17 +0300 Subject: [PATCH 156/258] Fix typo in manage-resources-containers.md --- .../docs/concepts/configuration/manage-resources-containers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/configuration/manage-resources-containers.md b/content/en/docs/concepts/configuration/manage-resources-containers.md index d267b83dd2..2668050d26 100644 --- a/content/en/docs/concepts/configuration/manage-resources-containers.md +++ b/content/en/docs/concepts/configuration/manage-resources-containers.md @@ -396,7 +396,7 @@ The kubelet supports different ways to measure Pod storage use: {{< tabs name="resource-emphemeralstorage-measurement" >}} {{% tab name="Periodic scanning" %}} -The kubelet performs regular, schedules checks that scan each +The kubelet performs regular, scheduled checks that scan each `emptyDir` volume, container log directory, and writeable container layer. The scan measures how much space is used. From 3b6584c9220e65441e1e4c5a1684384a6c9a8036 Mon Sep 17 00:00:00 2001 From: Kaitlyn Barnard Date: Thu, 17 Dec 2020 11:28:02 -0800 Subject: [PATCH 157/258] Update index.md --- .../en/blog/_posts/2020-09-30-writing-crl-scheduler/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/index.md b/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/index.md index a3a8680c79..0fab185f98 100644 --- a/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/index.md +++ b/content/en/blog/_posts/2020-09-30-writing-crl-scheduler/index.md @@ -1,7 +1,7 @@ --- layout: blog title: "A Custom Kubernetes Scheduler to Orchestrate Highly Available Applications" -date: 2020-09-30 +date: 2020-12-21 slug: writing-crl-scheduler --- From 08144e6ffa2b713b09ae0d8f9664a71199d46714 Mon Sep 17 00:00:00 2001 From: Ripul Patel Date: Thu, 17 Dec 2020 16:10:51 -0800 Subject: [PATCH 158/258] Adding ROBIN to list as it supports CSI snapshot features. --- .../_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md b/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md index 00ab78b578..0e844c882d 100644 --- a/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md +++ b/content/en/blog/_posts/2020-12-10-Kubernetes-Volume-Snapshot-Moves-to-GA.md @@ -57,6 +57,7 @@ As of the publishing of this blog, the following participants from the [Kubernet - [Portworx (PX-Backup)](https://portworx.com/products/px-backup/) - [Pure Storage (Pure Service Orchestrator)](https://github.com/purestorage/pso-csi) - [Red Hat OpenShift Container Storage](https://www.redhat.com/en/technologies/cloud-computing/openshift-container-storage) +- [Robin Cloud Native Storage](https://robin.io/storage/) - [TrilioVault for Kubernetes](https://docs.trilio.io/kubernetes/) - [Velero plugin for CSI](https://github.com/vmware-tanzu/velero-plugin-for-csi) From fbbd5b4f7533f1121c1c3670096806592f408ad8 Mon Sep 17 00:00:00 2001 From: jiajie Date: Thu, 17 Dec 2020 16:44:52 +0800 Subject: [PATCH 159/258] [zh] update content to match en master --- .../docs/concepts/storage/storage-classes.md | 107 ++++++++++++------ 1 file changed, 74 insertions(+), 33 deletions(-) diff --git a/content/zh/docs/concepts/storage/storage-classes.md b/content/zh/docs/concepts/storage/storage-classes.md index 0edc83cd0b..ae2dbf89b9 100644 --- a/content/zh/docs/concepts/storage/storage-classes.md +++ b/content/zh/docs/concepts/storage/storage-classes.md @@ -42,13 +42,14 @@ Kubernetes 本身并不清楚各种类代表的什么。这个类的概念在其 ## The StorageClass Resource Each StorageClass contains the fields `provisioner`, `parameters`, and -`reclaimPolicy`, which are used when a `PersistentVolume` belonging to the +`reclaimPolicy`, which are used when a PersistentVolume belonging to the class needs to be dynamically provisioned. + --> ## StorageClass 资源 每个 StorageClass 都包含 `provisioner`、`parameters` 和 `reclaimPolicy` 字段， -这些字段会在 StorageClass 需要动态分配 `PersistentVolume` 时会使用到。 +这些字段会在 StorageClass 需要动态分配 PersistentVolume 时会使用到。 PersistentVolume 可以配置为可扩展。将此功能设置为 `true` 时，允许用户通过编辑相应的 PVC 对象来调整卷大小。 -当基础存储类的 `allowVolumeExpansion` 字段设置为 true 时，以下类型的卷支持卷扩展。 +当下层 StorageClass 的 `allowVolumeExpansion` 字段设置为 true 时，以下类型的卷支持卷扩展。 {{< table caption = "Table of Volume types and the version of Kubernetes they require" >}} -| 卷类型 | Kubernetes 版本要求 | +| 卷类型 | Kubernetes 版本要求 | |:---------------------|:--------------------------| | gcePersistentDisk | 1.11 | | awsElasticBlockStore | 1.11 | @@ -261,19 +262,19 @@ A cluster administrator can address this issue by specifying the `WaitForFirstCo will delay the binding and provisioning of a PersistentVolume until a Pod using the PersistentVolumeClaim is created. PersistentVolumes will be selected or provisioned conforming to the topology that is specified by the Pod's scheduling constraints. These include, but are not limited to, [resource -requirements](/docs/concepts/configuration/manage-compute-resources-container), -[node selectors](/docs/concepts/configuration/assign-pod-node/#nodeselector), +requirements](/docs/concepts/configuration/manage-resources-containers/), +[node selectors](/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector), [pod affinity and -anti-affinity](/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity), -and [taints and tolerations](/docs/concepts/configuration/taint-and-toleration). +anti-affinity](/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity), +and [taints and tolerations](/docs/concepts/scheduling-eviction/taint-and-toleration). --> 集群管理员可以通过指定 `WaitForFirstConsumer` 模式来解决此问题。 该模式将延迟 PersistentVolume 的绑定和制备，直到使用该 PersistentVolumeClaim 的 Pod 被创建。 PersistentVolume 会根据 Pod 调度约束指定的拓扑来选择或制备。这些包括但不限于 [资源需求](/zh/docs/concepts/configuration/manage-resources-containers/)、 [节点筛选器](/zh/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector)、 -[pod 亲和性和互斥性](/zh/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity)、 -以及[污点和容忍度](/zh/docs/concepts/scheduling-eviction/taint-and-toleration/)。 +[pod 亲和性和互斥性](/zh/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity/)、 +以及[污点和容忍度](/zh/docs/concepts/scheduling-eviction/taint-and-toleration)。 ## 参数 -Storage class 具有描述属于卷的参数。取决于制备器，可以接受不同的参数。 +Storage Classes 的参数描述了存储类的卷。取决于制备器，可以接受不同的参数。 例如，参数 type 的值 io1 和参数 iopsPerGB 特定于 EBS PV。 当参数被省略时，会使用默认值。 @@ -387,7 +388,7 @@ parameters: 如果 `replication-type` 设置为 `regional-pd`，会制备一个 [区域性持久化磁盘（Regional Persistent Disk）](https://cloud.google.com/compute/docs/disks/#repds)。 -在这种情况下，用户必须使用 `zones` 而非 `zone` 来指定期望的复制区域（zone）。 -如果指定来两个特定的区域，区域性持久化磁盘会在这两个区域里制备。 -如果指定了多于两个的区域，Kubernetes 会选择其中任意两个区域。 -如果省略了 `zones` 参数，Kubernetes 会在集群管理的区域中任意选择。 + +强烈建议设置 `volumeBindingMode: WaitForFirstConsumer`，这样设置后， +当你创建一个 Pod，它使用的 PersistentVolumeClaim 使用了这个 StorageClass， +区域性持久化磁盘会在两个区域里制备。 其中一个区域是 Pod 所在区域。 +另一个区域是会在集群管理的区域中任意选择。磁盘区域可以通过 `allowedTopologies` 加以限制。 @@ -670,6 +674,44 @@ OpenStack 的内部驱动已经被弃用。请使用 ### vSphere + +vSphere 存储类有两种制备器 + +- [CSI 制备器](#csi-provisioner): `csi.vsphere.vmware.com` +- [vCP 制备器](#vcp-provisioner): `kubernetes.io/vsphere-volume` + +树内制备器已经被 +[弃用](/blog/2019/12/09/kubernetes-1-17-feature-csi-migration-beta/#why-are-we-migrating-in-tree-plugins-to-csi)。 +更多关于 CSI 制备器的详情，请参阅 +[Kubernetes vSphere CSI 驱动](https://vsphere-csi-driver.sigs.k8s.io/) +和 [vSphereVolume CSI 迁移](/docs/concepts/storage/volumes/#csi-migration-5)。 + + +#### CSI 制备器 {#vsphere-provisioner-csi} + +vSphere CSI StorageClass 制备器在 Tanzu Kubernetes 集群下运行。示例请参 +[vSphere CSI 仓库](https://raw.githubusercontent.com/kubernetes-sigs/vsphere-csi-driver/master/example/vanilla-k8s-file-driver/example-sc.yaml)。 + + +#### vCP 制备器 + +以下示例使用 VMware Cloud Provider (vCP) StorageClass 调度器 + @@ -1314,5 +1356,4 @@ scheduling constraints when choosing an appropriate PersistentVolume for a PersistentVolumeClaim. --> 延迟卷绑定使得调度器在为 PersistentVolumeClaim 选择一个合适的 -PersistentVolume 时能考虑到所有 Pod 的调度限制。 - +PersistentVolume 时能考虑到所有 Pod 的调度限制。 \ No newline at end of file From e3e199f41696bfc2834437527c462ac5da77182c Mon Sep 17 00:00:00 2001 From: jiajie Date: Fri, 18 Dec 2020 08:36:01 +0800 Subject: [PATCH 160/258] Update volume-snapshots.md --- .../zh/docs/concepts/storage/volume-snapshots.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/content/zh/docs/concepts/storage/volume-snapshots.md b/content/zh/docs/concepts/storage/volume-snapshots.md index 67a7afff0a..8f7db23c70 100644 --- a/content/zh/docs/concepts/storage/volume-snapshots.md +++ b/content/zh/docs/concepts/storage/volume-snapshots.md @@ -70,17 +70,17 @@ Users need to be aware of the following when using this feature: --> * API 对象 `VolumeSnapshot`，`VolumeSnapshotContent` 和 `VolumeSnapshotClass` 是 {{< glossary_tooltip term_id="CustomResourceDefinition" text="CRDs" >}}， - 不是核心 API 的部分。 + 不属于核心 API。 * `VolumeSnapshot` 支持仅可用于 CSI 驱动。 * 作为 `VolumeSnapshot` 部署过程的一部分，Kubernetes 团队提供了一个部署于控制平面的快照控制器， - 并且提供了一个叫做 `csi-snapshotter` 的 sidecar 帮助容器，它和 CSI 驱动程序部署在一起。 + 并且提供了一个叫做 `csi-snapshotter` 的边车（Sidecar）辅助容器，和 CSI 驱动程序一起部署。 快照控制器监视 `VolumeSnapshot` 和 `VolumeSnapshotContent` 对象， - 并且负责动态供应中的创建和删除 `VolumeSnapshotContent` 对象。 - sidecar csi-snapshotter 监视 `VolumeSnapshotContent` 对象， + 并且负责创建和删除 `VolumeSnapshotContent` 对象。 + 边车 csi-snapshotter 监视 `VolumeSnapshotContent` 对象， 并且触发针对 CSI 端点的 `CreateSnapshot` 和 `DeleteSnapshot` 的操作。 -* 还有一个验证 webhook服务器，它可以对快照对象进行更严格的验证。 +* 还有一个验证性质的 Webhook 服务器，可以对快照对象进行更严格的验证。 Kubernetes 发行版应将其与快照控制器和 CRD（而非 CSI 驱动程序）一起安装。 - 它应该安装在所有启用了快照功能的 Kubernetes 集群中。 + 此服务器应该安装在所有启用了快照功能的 Kubernetes 集群中。 * CSI 驱动可能实现，也可能没有实现卷快照功能。CSI 驱动可能会使用 csi-snapshotter 来提供对卷快照的支持。详见 [CSI 驱动程序文档](https://kubernetes-csi.github.io/docs/) * Kubernetes 负责 CRDs 和快照控制器的安装。 @@ -145,7 +145,9 @@ API objects are not removed from the system while a snapshot is being taken from --> ### 快照源的持久性卷声明保护 -这种保护的目的是确保在从系统中获取快照时，不会将正在使用的 {{< glossary_tooltip text="PersistentVolumeClaim" term_id="persistent-volume-claim" >}} API 对象从系统中删除（因为这可能会导致数据丢失）。 +这种保护的目的是确保在从系统中获取快照时，不会将正在使用的 + {{< glossary_tooltip text="PersistentVolumeClaim" term_id="persistent-volume-claim" >}} + API 对象从系统中删除（因为这可能会导致数据丢失）。 +从 1.15 版本开始，PDB 支持启用 +[scale 子资源](/zh/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#scale-subresource) +的自定义控制器。 + + +## PID 限制 {#pid-limiting} + +进程 ID（PID）限制允许对 kubelet 进行配置，以限制给定 Pod 可以消耗的 PID 数量。 +有关信息，请参见 [PID 限制](/zh/docs/concepts/policy/pid-limiting/)。 + + +新年伊始，我们进行了一项调查，以评估集容器世界的状况。 +我们已经准备好发送[2月版](https://docs.google.com/forms/d/13yxxBqb5igUhwrrnDExLzZPjREiCnSs-AH-y4SSZ-5c/viewform)但在此之前，让我们从119条回复中看一下1月的数据（感谢您的参与！）。 + + +关于这些数字的注释： +首先，您可能会注意到，这些数字加起来并不是100％，在大多数情况 下，选择不是唯一的，因此给出的百分比是选择特定选择的所有受访者的百分比。 +其次，虽然我们尝试覆盖广泛的云社区，但调查最初是通过Twitter发送给[@brendandburns](https://twitter.com/brendandburns)，[@kelseyhightower](https://twitter.com/kelseyhightower)，[@sarahnovotny](https://twitter.com/sarahnovotny)，[@juliaferraioli](https://twitter.com/juliaferraioli)，[@thagomizer\_rb](https://twitter.com/thagomizer_rb)，因此观众可能不是一个完美的覆盖。 +我们正在努力扩大样本量（我是否提到过2月份的调查？[立即参加](https://docs.google.com/forms/d/13yxxBqb5igUhwrrnDExLzZPjREiCnSs-AH-y4SSZ-5c/viewform))。 + + +#### 现在，言归正传，数据： + +首先，很多人正在使用容器！目前有71％的人正在使用容器，而其中有24％的人正在考虑尽快使用它们。 +显然，这表明样本集有些偏颇。 +在更广泛的社区中，容器使用的数量有所不同，但绝对低于71％。 +因此，对这些数字的其余部分要持怀疑态度。 + + +那么人们在使用容器做什么呢？ +超过80％的受访者使用容器进行开发，而只有50％的人使用容器进行生产。 +但是你们计划很快进入到生产，因为78%的容器用户表示你们计划很快进入生产阶段。 + + +你们在哪里部署容器？ +你的笔记本电脑显然是赢家，53%的人使用笔记本电脑。 +接下来是44％的人在自己的 VM 上运行（Vagrant？OpenStack？我们将在2月的调查中尝试深入研究），然后是33％的人在物理基础架构上运行，而31％的人在公共云 VM 上运行。 + + +如何部署容器？ +你们当中有 54% 的人使用 Kubernetes，虽然看起来有点受样本集的偏见（请参阅上面的注释），但真是令人惊讶，但有45％的人在使用 shell 脚本。 +是因为 Kubernetes 存储库中正在运行大量（且很好）的 Bash 脚本吗？ +继续下去，我们可以看到真相…… +数据显示，25%使用 CAPS (Chef/Ansible/Puppet/Salt)系统，约13%使用 Docker Swarm、Mesos 或其他系统。 + + +最后，我们让人们自由回答使用容器的挑战。 +这儿有一些进行了分组和复制的最有趣的答案： + + +###### 开发复杂性 + + +- “孤立的开发环境/工作流程可能是零散的，调试容器时可以轻松访问日志等工具，但有时不直观，需要大量知识来掌握整个基础架构堆栈和部署/ 更新 kubernetes，到基础网络等。” +- “迁移开发者的工作流程。 那些不熟悉容器、卷等的人只是想工作。” + + +###### 安全 + + +- “网络安全” +- “秘密” + + +###### 不成熟 + + +- “缺乏全面的非专有标准（例如，非 Docker），例如 runC / OCI” +- “仍处于早期阶段，只有很少的工具和许多缺少的功能。” +- “糟糕的 CI 支持，很多工具仍然处于非常早期的阶段。” +- "我们以前从未那样做过。" + + +###### 复杂性 + + +- “网络支持， 为 kubernetes 在裸机上为每个 Pod 提供 Ip” +- “集群化还是太难了” +- “设置 Mesos 和 Kubernetes 太他妈复杂了！！” + + +###### 数据 + + +- “卷缺乏灵活性（与 VM，物理硬件等相同的问题）” +- “坚持不懈” +- “存储” +- “永久数据” + + +_下载完整的调查结果 [此处](https://docs.google.com/spreadsheets/d/18wZe7wEDvRuT78CEifs13maXoSGem_hJvbOSmsuJtkA/pub?gid=530616014&single=true&output=csv) (CSV 文件）。_ + + +_Up-- Brendan Burns，Google 软件工程师 From f853e23497e3b6863ed2db37466a5659f55abbe7 Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Fri, 18 Dec 2020 16:48:19 +0800 Subject: [PATCH 165/258] Create 2015-04-00-Weekly-Kubernetes-Community-Hangout.md --- ...-00-Weekly-Kubernetes-Community-Hangout.md | 231 ++++++++++++++++++ 1 file changed, 231 insertions(+) create mode 100644 content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout.md diff --git a/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout.md b/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout.md new file mode 100644 index 0000000000..4c70f2c85b --- /dev/null +++ b/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout.md @@ -0,0 +1,231 @@ +--- +title: " 每周 Kubernetes 社区聚会笔记 - 2015年4月3日 " +date: 2015-04-04 +slug: weekly-kubernetes-community-hangout +url: /blog/2015/04/Weekly-Kubernetes-Community-Hangout +--- + + +# Kubernetes: 每周 Kubernetes 社区聚会笔记 + + +每周，Kubernetes 贡献社区几乎都会通过 Google Hangouts 开会。 +我们希望任何有兴趣的人都知道本论坛讨论的内容。 + + +议程： + + +* Quinton - 集群联邦 +* Satnam - 性能基准测试更新 + + +*会议记录：* + + +1. Quinton - 集群联邦 +* 在旧金山见面会后，想法浮出水面 +* * 请阅读并评论 +* 不是 1.0，而是将文档放在一起以显示路线图 +* 可以在 Kubernetes 之外构建 +* 用于控制多个集群中事物的 API ，包括一些逻辑 + + +1. Auth(n)(z) + +2. 调度策略 + +3. …… + +* 集群联邦的不同原因 + +1. 区域(非)可用性:对区域故障的弹性 + +2. 混合云：有些在云中，有些在本地。 由于各种原因 + +3. 避免锁定云提供商。 由于各种原因 + +4. "Cloudbursting" - 自动溢出到云中 + + + * 困难的问题 + + 1. 位置的吸引力。Pod 需要多近？ + + 1. 工作负载的耦合 + + 2. 绝对位置(例如欧盟数据需要在欧盟内) + +2. 跨集群服务发现 + + 1. 服务/DNS 如何跨集群工作 + +3. 跨集群工作负载迁移 + + 1. 如何在跨集群中逐块移动应用程序? + +4. 跨集群调度 + + 1. 如何充分了解集群以知道在哪里进行调度 + + 2. 可能使用成本函数以最小的复杂性获得关联 + + 3. 还可以使用成本来确定计划的时间（使用不足的集群比过度使用的集群便宜） + + + * 隐含要求 + +1. 跨集群集成不应创建跨集群故障模式 + + 1. 在 Ubernetes 死亡的灾难情况下可以独立使用。 + +2. 统一可见性 + + 1. 希望有统一的监控，报警，日志，内省，用户体验等。 + +3. 统一的配额和身份管理 + + 1. 希望将用户数据库和 auth（n）/（z）放在一个位置 + + + + * 需要注意的是，导致软件故障的大多数原因不是基础架构 + +1. 拙劣的软件升级 + +2. 拙劣的配置升级 + +3. 拙劣的密钥分发 + +4. 过载 + +5. 失败的外部依赖项 + + + * 讨论： + +1. 在哪里画 ”ubernetes“ 线 + + 1. 可能在可用区，但也可能在机架，或地区 + +2. 重要的是不要鸽子洞并防止其他用户 + + + 2. Satnam - 浸泡测试 +* 想要测量长时间运行的事务，以确保集群在一段时间内是稳定的。性能不会降低，不会发生内存泄漏等。 +* github.com/GoogleCloudPlatform/kubernetes/test/soak/… +* 单个二进制文件，在每个节点上放置许多 Pod，并查询每个 Pod 以确保其正在运行。 +* Pod 的创建速度越来越快（即使在过去一周内），也可以使事情进展得更快。 +* Pod 运行起来后，我们通过代理点击 Pod。决定使用代理是有意的，因此我们测试了 kubernetes apiserver。 +* 代码已经签入。 +* 将 Pod 固定在每个节点上，练习每个 Pod，确保你得到每个节点的响应。 +* 单个二进制文件，永远运行。 +* Brian - v1beta3 默认启用， v1beta1 和 v1beta2 不支持，在6月关闭。仍应与升级现有集群等一起使用。 From de69cbc9e2fc7e06593cda28a1378748b2878ccf Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Fri, 18 Dec 2020 20:22:01 +0800 Subject: [PATCH 166/258] Update calico-network-policy.md sync with english version. --- .../network-policy-provider/calico-network-policy.md | 1 - 1 file changed, 1 deletion(-) diff --git a/content/zh/docs/tasks/administer-cluster/network-policy-provider/calico-network-policy.md b/content/zh/docs/tasks/administer-cluster/network-policy-provider/calico-network-policy.md index 1089591a98..2b5e260c5c 100644 --- a/content/zh/docs/tasks/administer-cluster/network-policy-provider/calico-network-policy.md +++ b/content/zh/docs/tasks/administer-cluster/network-policy-provider/calico-network-policy.md @@ -31,7 +31,6 @@ Decide whether you want to deploy a [cloud](#creating-a-calico-cluster-with-goog -1. To launch a GKE cluster with Calico, just include the `--enable-network-policy` flag. 1. 启动一个带有 Calico 的 GKE 集群，只需加上参数 `--enable-network-policy`。 **语法** From e18cff823b7e6eddbdd8e8873a853cb77a84cb1a Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Fri, 18 Dec 2020 21:04:18 +0800 Subject: [PATCH 167/258] Update 2015-04-00-Weekly-Kubernetes-Community-Hangout.md --- .../2015-04-00-Weekly-Kubernetes-Community-Hangout.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout.md b/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout.md index 4c70f2c85b..9253f48813 100644 --- a/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout.md +++ b/content/zh/blog/_posts/2015-04-00-Weekly-Kubernetes-Community-Hangout.md @@ -115,7 +115,7 @@ Agenda: --> * 困难的问题 - 1. 位置的吸引力。Pod 需要多近？ + 1. 位置亲和性。Pod 需要多近？ 1. 工作负载的耦合 @@ -133,9 +133,9 @@ Agenda: 1. 如何充分了解集群以知道在哪里进行调度 - 2. 可能使用成本函数以最小的复杂性获得关联 + 2. 可能使用成本函数以最小的复杂性得出亲和性 - 3. 还可以使用成本来确定计划的时间（使用不足的集群比过度使用的集群便宜） + 3. 还可以使用成本来确定调度位置（使用不足的集群比过度使用的集群便宜） * 讨论： -1. 在哪里画 ”ubernetes“ 线 +1. ”ubernetes“ 的边界确定 1. 可能在可用区，但也可能在机架，或地区 From 3442b894881ccf9bb67e0caadc633c0bdba9d24f Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Fri, 18 Dec 2020 20:44:02 +0800 Subject: [PATCH 168/258] Update developing-cloud-controller-manager.md sync with english version Update developing-cloud-controller-manager.md apply suggestion --- .../administer-cluster/developing-cloud-controller-manager.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/administer-cluster/developing-cloud-controller-manager.md b/content/zh/docs/tasks/administer-cluster/developing-cloud-controller-manager.md index 445dd4ac48..af70cd3b6f 100644 --- a/content/zh/docs/tasks/administer-cluster/developing-cloud-controller-manager.md +++ b/content/zh/docs/tasks/administer-cluster/developing-cloud-controller-manager.md @@ -63,7 +63,8 @@ To build an out-of-tree cloud-controller-manager for your cloud, follow these st 2. 使用来自 Kubernetes 核心代码库的 [cloud-controller-manager 中的 main.go](https://github.com/kubernetes/kubernetes/blob/master/cmd/cloud-controller-manager/controller-manager.go) 作为 main.go 的模板。如上所述，唯一的区别应该是将导入的云包。 -3. 在 `main.go` 中导入你的云包，确保你的包有一个 `init` 块来运行 cloudprovider.RegisterCloudProvider。 +3. 在 `main.go` 中导入你的云包，确保你的包有一个 `init` 块来运行 + [cloudprovider.RegisterCloudProvider](https://github.com/kubernetes/kubernetes/blob/master/pkg/cloudprovider/plugins.go#L42-L52)。 -Garbage collection is a helpful function of kubelet that will clean up unused images and unused containers. Kubelet will perform garbage collection for containers every minute and garbage collection for images every five minutes. +Garbage collection is a helpful function of kubelet that will clean up unused [images](/docs/concepts/containers/#container-images) and unused [containers](/docs/concepts/containers/). Kubelet will perform garbage collection for containers every minute and garbage collection for images every five minutes. External garbage collection tools are not recommended as these tools can potentially break the behavior of kubelet by removing containers expected to exist. From 83220137337feb1c877672ac0d0cd851bc52357c Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Sat, 19 Dec 2020 00:20:44 +0800 Subject: [PATCH 170/258] Update static-pod.md sync with english version --- content/zh/docs/tasks/configure-pod-container/static-pod.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/configure-pod-container/static-pod.md b/content/zh/docs/tasks/configure-pod-container/static-pod.md index 8ed0c78338..582e94616d 100644 --- a/content/zh/docs/tasks/configure-pod-container/static-pod.md +++ b/content/zh/docs/tasks/configure-pod-container/static-pod.md @@ -155,7 +155,8 @@ For example, this is how to start a simple web server as a static Pod: ``` or add the `staticPodPath: ` field in the [KubeletConfiguration file](/docs/tasks/administer-cluster/kubelet-config-file). --> -3. 配置这个节点上的 kubelet，使用这个参数执行 `--pod-manifest-path=/etc/kubelet.d/`： +3. 配置这个节点上的 kubelet，使用这个参数执行 `--pod-manifest-path=/etc/kubelet.d/`。 +在 Fedora 上编辑 `/etc/kubernetes/kubelet` 以包含下行： ``` KUBELET_ARGS="--cluster-dns=10.254.0.10 --cluster-domain=kube.local --pod-manifest-path=/etc/kubelet.d/" From 8852b8cb8f1f771520785ad607d4226e8279f75c Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Sat, 19 Dec 2020 00:39:36 +0800 Subject: [PATCH 171/258] Update translate-compose-kubernetes.md sync with english version --- .../configure-pod-container/translate-compose-kubernetes.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/zh/docs/tasks/configure-pod-container/translate-compose-kubernetes.md b/content/zh/docs/tasks/configure-pod-container/translate-compose-kubernetes.md index 175bdac0da..6250e452a8 100644 --- a/content/zh/docs/tasks/configure-pod-container/translate-compose-kubernetes.md +++ b/content/zh/docs/tasks/configure-pod-container/translate-compose-kubernetes.md @@ -877,6 +877,8 @@ Please note that changing service name might break some `docker-compose` files. 那么将会被替换为 `-`，服务也相应的会重命名(例如 `web-service`)。 Kompose 这样做的原因是 "Kubernetes" 不允许对象名称中包含 `_`。 +请注意，更改服务名称可能会破坏一些 `docker-compose` 文件。 + -Usa la herramienta de línea de comandos de Kubernetes, [kubectl](/docs/user-guide/kubectl/), para desplegar y gestionar aplicaciones en Kubernetes. Usando kubectl, puedes inspeccionar recursos del clúster; crear, eliminar, y actualizar componentes; explorar tu nuevo clúster; y arrancar aplicaciones de ejemplo. +Usa la herramienta de línea de comandos de Kubernetes, [kubectl](/docs/reference/kubectl/kubectl/), para desplegar y gestionar aplicaciones en Kubernetes. Usando kubectl, puedes inspeccionar recursos del clúster; crear, eliminar, y actualizar componentes; explorar tu nuevo clúster; y arrancar aplicaciones de ejemplo. Para ver la lista completa de operaciones de kubectl, se puede ver [el resumen de kubectl](/docs/reference/kubectl/overview/). ## {{% heading "prerequisites" %}} @@ -22,21 +20,55 @@ Debes usar una versión de kubectl que esté a menos de una versión menor de di -## Instalar kubectl +## Instalar kubectl en Linux -Estos son algunos métodos para instalar kubectl. +### Instalar el binario de kubectl con curl en Linux -## Instalar el binario de kubectl usando gestión nativa de paquetes +1. Descargar la última entrega: + + ``` + curl -LO "https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl" + ``` + +Para descargar una versión específica, remplaza el comando `$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)` con la versión específica. + +Por ejemplo, para descarga la versión {{< param "fullversion" >}} en Linux, teclea: + + ``` + curl -LO https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/linux/amd64/kubectl + ``` + +2. Habilita los permisos de ejecución del binario `kubectl`. + + ``` + chmod +x ./kubectl + ``` + +3. Mueve el binario dentro de tu PATH. + + ``` + sudo mv ./kubectl /usr/local/bin/kubectl + ``` + +4. Comprueba que la versión que se ha instalado es la más reciente. + + ``` + kubectl version --client + ``` + + +## Instalar mediante el gestor de paquetes del sistema {{< tabs name="kubectl_install" >}} -{{< tab name="Ubuntu, Debian o HypriotOS" codelang="bash" >}} -sudo apt-get update && sudo apt-get install -y apt-transport-https +{{< tab name="Ubuntu, Debian or HypriotOS" codelang="bash" >}} +sudo apt-get update && sudo apt-get install -y apt-transport-https gnupg2 curl curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add - echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee -a /etc/apt/sources.list.d/kubernetes.list sudo apt-get update sudo apt-get install -y kubectl {{< /tab >}} -{{< tab name="CentOS, RHEL o Fedora" codelang="bash" >}}cat < /etc/yum.repos.d/kubernetes.repo + +{{< tab name="CentOS, RHEL or Fedora" codelang="bash" >}}cat < /etc/yum.repos.d/kubernetes.repo [kubernetes] name=Kubernetes baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64 @@ -49,65 +81,146 @@ yum install -y kubectl {{< /tab >}} {{< /tabs >}} +### Instalar usando otro gestor de paquetes -## Instalar con snap en Ubuntu - +{{< tabs name="other_kubectl_install" >}} +{{% tab name="Snap" %}} Si usas Ubuntu o alguna de las otras distribuciones de Linux que soportan el gestor de paquetes [snap](https://snapcraft.io/docs/core/install), kubectl está disponible como una aplicación [snap](https://snapcraft.io/). -1. Cambia al usuario de snap y ejecuta el comando de instalación: +```shell +snap install kubectl --classic - ``` - sudo snap install kubectl --classic +kubectl version --client +``` + +{{% /tab %}} + +{{% tab name="Homebrew" %}} +Si usas alguna de las otras distribuciones de Linux que soportan el gestor de paquetes [Homebrew](https://docs.brew.sh/Homebrew-on-Linux), kubectl está disponible como una aplicación de [Homebrew]((https://docs.brew.sh/Homebrew-on-Linux#install). + +```shell +brew install kubectl + +kubectl version --client +``` + +{{% /tab %}} + +{{< /tabs >}} + + +## Instalar kubectl en macOS + +### Instalar el binario de kubectl usando curl en macOS + +1. Descarga la última entrega: + + ```bash + curl -LO "https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/darwin/amd64/kubectl" + ``` + + Para descargar una versión específica, remplaza el comando `$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)` con la versión específica. + + Por ejemplo, para descargar la versión {{< param "fullversion" >}} en macOS, teclea: + + ```bash + curl -LO https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/darwin/amd64/kubectl + ``` + +2. Habilita los permisos de ejecución del binario `kubectl`. + + ```bash + chmod +x ./kubectl + ``` + +3. Mueve el binario dentro de tu PATH. + + ```bash + sudo mv ./kubectl /usr/local/bin/kubectl ``` -2. Para asegurar que la versión utilizada sea la más actual puedes probar: +4. Para asegurar que la versión utilizada sea la más actual puedes probar: - ``` - kubectl version - ``` + ```bash + kubectl version --client + ``` -## Instalar con Homebrew en macOS +### Instalar con Homebrew en macOS -Si estás usando macOS y el gestor de paquetes es [Homebrew](https://brew.sh/), puedes instalar kubectl con Homebrew. +Si estás usando macOS y el gestor de paquetes es [Homebrew](https://brew.sh/), puedes instalar `kubectl` con `brew`. 1. Ejecuta el comando de instalación: + ```bash + brew install kubectl ``` + + o + + ```bash brew install kubernetes-cli ``` -2. Para asegurar que la versión utilizada sea la más actual puedes probar: +2. Para asegurar que la versión utilizada sea la más actual, puedes ejecutar: - ``` - kubectl version + ```bash + kubectl version --client ``` -## Instalar con Macports en macOS +### Instalar con Macports en macOS -Si estás en macOS y usando el gestor de paquetes [Macports](https://macports.org/), puedes instalar kubectl con Macports. +Si estás en macOS y utilizas el gestor de paquetes [Macports](https://macports.org/), puedes instalar `kubectl` con `port`. 1. Ejecuta los comandos de instalación: - ``` + ```bash sudo port selfupdate sudo port install kubectl ``` -2. Para asegurar que la versión utilizada sea la más actual puedes probar: +2. Para asegurar que la versión utilizada sea la más actual puedes ejecutar: - ``` - kubectl version + ```bash + kubectl version --client ``` -## Instalar con Powershell desde PSGallery +# Instalar kubectl en Windows -Si estás en Windows y usando el gestor de paquetes [Powershell Gallery](https://www.powershellgallery.com/), puedes instalar y actualizar kubectl con Powershell. +### Instalar el binario de kubectl con curl en Windows + +1. Descargar la última entrega {{< param "fullversion" >}} de [este link]((https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe). + + o si tiene `curl` instalada, utiliza este comando: + + ```bash + curl -LO https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe + ``` + + Para averiguar la última versión estable (por ejemplo, para secuencias de comandos), echa un vistazo a [https://storage.googleapis.com/kubernetes-release/release/stable.txt](https://storage.googleapis.com/kubernetes-release/release/stable.txt). + +2. Añade el binario a tu PATH. + +3. Para asegurar que la versión utilizada sea la más actual, puedes ejecutar: + + ```bash + kubectl version --client + ``` + +{{< note >}} +[Docker Desktop para Windows](https://docs.docker.com/docker-for-windows/#kubernetes) añade su propia versión de `kubectl` a PATH. + +Si tienes Docker Desktop instalado, es posible que tengas que modificar tu PATH al PATH añadido por Docker Desktop o eliminar la versión de `kubectl` proporcionada por Docker Desktop. +{{< /note >}} + +### Instalar con Powershell desde PSGallery + +Si estás en Windows y utilizas el gestor de paquetes [Powershell Gallery](https://www.powershellgallery.com/), puedes instalar y actualizar kubectl con Powershell. 1. Ejecuta los comandos de instalación (asegurándote de especificar una `DownloadLocation`): - ``` - Install-Script -Name install-kubectl -Scope CurrentUser -Force - install-kubectl.ps1 [-DownloadLocation ] + ```powershell + Install-Script -Name 'install-kubectl' -Scope CurrentUser -Force + install-kubectl.ps1 [-DownloadLocation ] ``` {{< note >}}Si no especificas una `DownloadLocation`, `kubectl` se instalará en el directorio temporal del usuario.{{< /note >}} @@ -116,57 +229,66 @@ Si estás en Windows y usando el gestor de paquetes [Powershell Gallery](https:/ 2. Para asegurar que la versión utilizada sea la más actual puedes probar: - ``` - kubectl version + ```powershell + kubectl version --client ``` - {{< note >}}Actualizar la instalación se realiza mediante la re-ejecución de los dos comandos listados en el paso 1.{{< /note >}} +{{< note >}} +Actualizar la instalación se realiza mediante la re-ejecución de los dos comandos listados en el paso 1.{{< /note >}} -## Instalar en Windows usando Chocolatey o scoop +### Instalar en Windows usando Chocolatey o scoop -Para instalar kubectl en Windows puedes usar bien el gestor de paquetes [Chocolatey](https://chocolatey.org) o el instalador de línea de comandos [scoop](https://scoop.sh). -{{< tabs name="kubectl_win_install" >}} -{{% tab name="choco" %}} +1. Para instalar kubectl en Windows puedes usar el gestor de paquetes [Chocolatey](https://chocolatey.org) o el instalador de línea de comandos [scoop](https://scoop.sh). + {{< tabs name="kubectl_win_install" >}} + {{% tab name="choco" %}} +Using [Chocolatey](https://chocolatey.org). + + ```powershell choco install kubernetes-cli + ``` + {{% /tab %}} + {{% tab name="scoop" %}} +Using [scoop](https://scoop.sh). -{{% /tab %}} -{{% tab name="scoop" %}} - + ```powershell scoop install kubectl + ``` + {{% /tab %}} + {{< /tabs >}} -{{% /tab %}} -{{< /tabs >}} 2. Para asegurar que la versión utilizada sea la más actual puedes probar: - ``` - kubectl version + ```powershell + kubectl version --client ``` 3. Navega a tu directorio de inicio: + ```powershell + # Si estas usando cmd.exe, ejecuta: cd %USERPROFILE% + cd ~ ``` - cd %USERPROFILE% - ``` + 4. Crea el directorio `.kube`: - ``` + ```powershell mkdir .kube ``` 5. Cambia al directorio `.kube` que acabas de crear: - ``` + ```powershell cd .kube ``` 6. Configura kubectl para usar un clúster remoto de Kubernetes: - ``` + ```powershell New-Item config -type file ``` - {{< note >}}Edita el fichero de configuración con un editor de texto de tu elección, como Notepad.{{< /note >}} +{{< note >}}Edita el fichero de configuración con un editor de texto de tu elección, como Notepad.{{< /note >}} ## Descarga como parte del Google Cloud SDK @@ -175,107 +297,32 @@ Puedes instalar kubectl como parte del Google Cloud SDK. 1. Instala el [Google Cloud SDK](https://cloud.google.com/sdk/). 2. Ejecuta el comando de instalación de `kubectl`: - ``` + ```shell gcloud components install kubectl ``` 3. Para asegurar que la versión utilizada sea la más actual puedes probar: - ``` - kubectl version + ```shell + kubectl version --client ``` -## Instalar el binario de kubectl usando curl - -{{< tabs name="kubectl_install_curl" >}} -{{% tab name="macOS" %}} -1. Descarga la última entrega: - - ``` - curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/darwin/amd64/kubectl - ``` - - Para descargar una versión específica, remplaza el comando `$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)` con la versión específica. - - Por ejemplo, para descargar la versión {{< param "fullversion" >}} en macOS, teclea: - - ``` - curl -LO https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/darwin/amd64/kubectl - ``` - -2. Haz el binario de kubectl ejecutable. - - ``` - chmod +x ./kubectl - ``` - -3. Mueve el binario dentro de tu PATH. - - ``` - sudo mv ./kubectl /usr/local/bin/kubectl - ``` -{{% /tab %}} -{{% tab name="Linux" %}} - -1. Descarga la última entrega con el comando: - - ``` - curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl - ``` - - Para descargar una versión específica, remplaza el trozo del comando `$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)` con la versión específica. - - Por ejemplo, para descargar la versión {{< param "fullversion" >}} en Linux, teclea: - - ``` - curl -LO https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/linux/amd64/kubectl - ``` - -2. Haz el binario de kubectl ejecutable. - - ``` - chmod +x ./kubectl - ``` - -3. Mueve el binario dentro de tu PATH. - - ``` - sudo mv ./kubectl /usr/local/bin/kubectl - ``` -{{% /tab %}} -{{% tab name="Windows" %}} -1. Descarga la última entrega {{< param "fullversion" >}} desde [este enlace](https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe). - - O si tienes `curl` instalado, usa este comando: - - ``` - curl -LO https://storage.googleapis.com/kubernetes-release/release/{{< param "fullversion" >}}/bin/windows/amd64/kubectl.exe - ``` - - Para averiguar la última versión estable (por ejemplo, para secuencias de comandos), echa un vistazo a [https://storage.googleapis.com/kubernetes-release/release/stable.txt](https://storage.googleapis.com/kubernetes-release/release/stable.txt). - -2. Añade el binario a tu PATH. -{{% /tab %}} -{{< /tabs >}} - - - -## Configurar kubectl +## Comprobar la configuración kubectl Para que kubectl pueda encontrar y acceder a un clúster de Kubernetes, necesita un [fichero kubeconfig](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/), que se crea de forma automática cuando creas un clúster usando [kube-up.sh](https://github.com/kubernetes/kubernetes/blob/master/cluster/kube-up.sh) o despliegas de forma satisfactoria un clúster de Minikube. Revisa las [guías para comenzar](/docs/setup/) para más información acerca de crear clústers. Si necesitas acceso a un clúster que no has creado, ver el [documento de Compartir Acceso a un Clúster](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/). Por defecto, la configuración de kubectl se encuentra en `~/.kube/config`. -## Comprobar la configuración kubectl Comprueba que kubectl está correctamente configurado obteniendo el estado del clúster: ```shell kubectl cluster-info ``` + Si ves una respuesta en forma de URL, kubectl está correctamente configurado para acceder a tu clúster. Si ves un mensaje similar al siguiente, kubectl no está correctamente configurado o no es capaz de conectar con un clúster de Kubernetes. -```shell +``` The connection to the server was refused - did you specify the right host or port? ``` @@ -287,7 +334,9 @@ Si kubectl cluster-info devuelve la respuesta en forma de url, pero no puedes ac kubectl cluster-info dump ``` -## Habilitar el auto-completado en el intérprete de comandos +## kubectl configuraciones opcionales + +### Habilitar el auto-completado en el intérprete de comandos kubectl provee de soporte para auto-completado para Bash y Zsh, ¡que te puede ahorrar mucho uso del teclado! @@ -323,16 +372,23 @@ Debes asegurarte que la secuencia de comandos de completado de kubectl corre en - Corre la secuencia de comandos de completado en tu `~/.bashrc`: - ```shell + ```bash echo 'source <(kubectl completion bash)' >>~/.bashrc ``` - Añade la secuencia de comandos de completado al directorio `/etc/bash_completion.d`: - ```shell + ```bash kubectl completion bash >/etc/bash_completion.d/kubectl ``` +Si tienes un alias para `kubectl`, puedes extender los comandos de shell para funcionar con ese alias: + +```bash +echo 'alias k=kubectl' >>~/.bashrc +echo 'complete -F __start_kubectl k' >>~/.bashrc +``` + {{< note >}} bash-completion corre todas las secuencias de comandos de completado en `/etc/bash_completion.d`. {{< /note >}} @@ -344,21 +400,43 @@ Ambas estrategias son equivalentes. Tras recargar tu intérprete de comandos, el {{% tab name="Bash en macOS" %}} -{{< warning>}} -macOS incluye Bash 3.2 por defecto. La secuencia de comandos de completado de kubectl requiere Bash 4.1+ y no funciona con Bash 3.2. Una posible alternativa es instalar una nueva versión de Bash en macOS (ver instrucciones [aquí](https://itnext.io/upgrading-bash-on-macos-7138bd1066ba)). Las instrucciones de abajo sólo funcionan si estás usando Bash 4.1+. -{{< /warning >}} - ### Introducción La secuencia de comandos de completado de kubectl para Bash puede generarse con el comando `kubectl completion bash`. Corriendo la secuencia de comandos de completado en tu intérprete de comandos habilita el auto-completado de kubectl. Sin embargo, la secuencia de comandos de completado depende de [*bash-completion**](https://github.com/scop/bash-completion), lo que significa que tienes que instalar primero este programa (puedes probar si ya tienes bash-completion instalado ejecutando `type _init_completion`). +{{< warning>}} +macOS incluye Bash 3.2 por defecto. La secuencia de comandos de completado de kubectl requiere Bash 4.1+ y no funciona con Bash 3.2. Una posible alternativa es instalar una nueva versión de Bash en macOS (ver instrucciones [aquí](https://itnext.io/upgrading-bash-on-macos-7138bd1066ba)). Las instrucciones de abajo sólo funcionan si estás usando Bash 4.1+. +{{< /warning >}} + +### Actualizar bash + +Las instrucciones asumen que usa Bash 4.1+. Puedes comprobar tu versión de bash con: + +```bash +echo $BASH_VERSION +``` + +Si no es 4.1+, puede actualizar bash con Homebrew: + +```bash +brew install bash +``` + +Recarga tu intérprete de comandos y verifica que estás usando la versión deseada: + +```bash +echo $BASH_VERSION $SHELL +``` + +Usualmente, Homebrew lo instala en `/usr/local/bin/bash`. + ### Instalar bash-completion Puedes instalar bash-completion con Homebrew: -```shell +```bash brew install bash-completion@2 ``` @@ -368,9 +446,9 @@ El `@2` simboliza bash-completion 2, que es requerido por la secuencia de comand Como se indicaba en la salida de `brew install` (sección "Caveats"), añade las siguientes líneas a tu `~/.bashrc` o `~/.bash_profile`: -```shell -export BASH_COMPLETION_COMPAT_DIR=/usr/local/etc/bash_completion.d -[[ -r /usr/local/etc/profile.d/bash_completion.sh ]] && . /usr/local/etc/profile.d/bash_completion.sh +```bash +export BASH_COMPLETION_COMPAT_DIR="/usr/local/etc/bash_completion.d" +[[ -r "/usr/local/etc/profile.d/bash_completion.sh" ]] && . "/usr/local/etc/profile.d/bash_completion.sh" ``` Recarga tu intérprete de comandos y verifica que bash-completion está correctamente instalado tecleando `type _init_completion`. @@ -407,25 +485,31 @@ La secuencia de comandos de completado de kubectl para Zsh puede ser generada co Para hacerlo en todas tus sesiones de tu intérprete de comandos, añade lo siguiente a tu `~/.zshrc`: -```shell +```zsh source <(kubectl completion zsh) ``` +Si tienes alias para kubectl, puedes extender el completado de intérprete de comandos para funcionar con ese alias. + +```zsh +echo 'alias k=kubectl' >>~/.zshrc +echo 'complete -F __start_kubectl k' >>~/.zshrc +``` + Tras recargar tu intérprete de comandos, el auto-completado de kubectl debería funcionar. Si obtienes un error como `complete:13: command not found: compdef`, entonces añade lo siguiente al principio de tu `~/.zshrc`: -```shell +```zsh autoload -Uz compinit compinit ``` {{% /tab %}} {{< /tabs >}} - - ## {{% heading "whatsnext" %}} - -[Aprender cómo lanzar y exponer tu aplicación.](/docs/tasks/access-application-cluster/service-access-application-cluster/) - - +* [Instalar Minikube](https://minikube.sigs.k8s.io/docs/start/) +* Ver las [guías](/docs/setup/) para ver mas información sobre como crear clusteres. +* [Aprender cómo lanzar y exponer tu aplicación.](/docs/tasks/access-application-cluster/service-access-application-cluster/). +* Si necesita acceso a un clúster que no se creó, ver el documento de [compartiendo acceso a clúster](/docs/tasks/access-application-cluster/configure-access-multiple-clusters/). +* Leer ´la documentación de kubectl reference](/docs/reference/kubectl/kubectl/) diff --git a/content/es/docs/tasks/tools/install-minikube.md b/content/es/docs/tasks/tools/install-minikube.md deleted file mode 100644 index e19912e636..0000000000 --- a/content/es/docs/tasks/tools/install-minikube.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: Instalar Minikube -content_type: task -weight: 20 -card: - name: tasks - weight: 10 ---- - - - -Esta página muestra cómo instalar [Minikube](/docs/tutorials/hello-minikube), una herramienta que despliega un clúster de Kubernetes con un único nodo en una máquina virtual. - - - -## {{% heading "prerequisites" %}} - - -La virtualización VT-x o AMD-v debe estar habilitada en la BIOS de tu ordenador. En Linux, puedes comprobar si la tienes habilitada buscando 'vmx' o 'svm' en el fichero `/proc/cpuinfo`: -```shell -egrep --color 'vmx|svm' /proc/cpuinfo -``` - - - - - -## Instalar un Hipervisor - -Si todavía no tienes un hipervisor instalado, puedes instalar uno de los siguientes: - -Sistema Operativo | Hipervisores soportados -:-----------------|:------------------------ -macOS | [VirtualBox](https://www.virtualbox.org/wiki/Downloads), [VMware Fusion](https://www.vmware.com/products/fusion), [HyperKit](https://github.com/moby/hyperkit) -Linux | [VirtualBox](https://www.virtualbox.org/wiki/Downloads), [KVM](http://www.linux-kvm.org/) -Windows | [VirtualBox](https://www.virtualbox.org/wiki/Downloads), [Hyper-V](https://msdn.microsoft.com/en-us/virtualization/hyperv_on_windows/quick_start/walkthrough_install) - -{{< note >}} -Minikube también soporta una opción `--vm-driver=none` que ejecuta los componentes de Kubernetes directamente en el servidor y no en una máquina virtual (MV). Para usar este modo, se requiere Docker y un entorno Linux, pero no es necesario tener un hipervisor. -{{< /note >}} - -## Instalar kubectl - -* Instala kubectl siguiendo las instrucciones disponibles en [Instalar y Configurar kubectl](/docs/tasks/tools/install-kubectl/). - -## Instalar Minikube - -### macOS - -La forma más fácil de instalar Minikube en macOS es usar [Homebrew](https://brew.sh): - -```shell -brew install minikube -``` - -También puedes instalarlo en macOS descargando un ejecutable autocontenido: - -```shell -curl -Lo minikube https://storage.googleapis.com/minikube/releases/latest/minikube-darwin-amd64 \ - && chmod +x minikube -``` - -Para tener disponible en la consola el comando `minikube`, puedes añadir el comando al $PATH o moverlo por ejemplo a `/usr/local/bin`: - -```shell -sudo mv minikube /usr/local/bin -``` - -### Linux - -{{< note >}} -Este documento muestra cómo instalar Minikube en Linux usando un ejecutable autocontenido. Para métodos alternativos de instalación en Linux, ver [Otros métodos de Instalación](https://github.com/kubernetes/minikube#other-ways-to-install) en el repositorio GitHub oficial de Minikube. -{{< /note >}} - -Puedes instalar Minikube en Linux descargando un ejecutable autocontenido: - -```shell -curl -Lo minikube https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64 \ - && chmod +x minikube -``` - -Para tener disponible en la consola el comando `minikube`, puedes añadir el comando al $PATH o moverlo por ejemplo a `/usr/local/bin`: - -```shell -sudo cp minikube /usr/local/bin && rm minikube -``` - -### Windows - -{{< note >}} -Para ejecutar Minikube en Windows, necesitas instalar [Hyper-V](https://docs.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v) primero, que puede ejecutarse en las tres versiones de Windows 10: Windows 10 Enterprise, Windows 10 Professional, y Windows 10 Education. -{{< /note >}} - -La forma más fácil de instalar Minikube en Windows es usando [Chocolatey](https://chocolatey.org/) (ejecutar como administrador): - -```shell -choco install minikube kubernetes-cli -``` - -Una vez Minikube ha terminado de instalarse, cierra la sesión cliente actual y reinicia. Minikube debería haberse añadido a tu $PATH automáticamente. - -#### Instalación manual en Windows - -Para instalar Minikube manualmente en Windows, descarga [`minikube-windows-amd64`](https://github.com/kubernetes/minikube/releases/latest), renómbralo a `minikube.exe`, y añádelo a tu PATH. - -#### Instalador de Windows - -Para instalar Minikube manualmente en Windows usando [Windows Installer](https://docs.microsoft.com/en-us/windows/desktop/msi/windows-installer-portal), descarga [`minikube-installer.exe`](https://github.com/kubernetes/minikube/releases/latest) y ejecuta el instalador. - - -## Limpiar todo para comenzar de cero - -Si habías instalado previamente minikube, y ejecutas: -```shell -minikube start -``` - -Y dicho comando devuelve un error: -```shell -machine does not exist -``` - -Necesitas eliminar permanentemente los siguientes archivos de configuración: -```shell -rm -rf ~/.minikube -``` - -## {{% heading "whatsnext" %}} - - -* [Ejecutar Kubernetes Localmente via Minikube](/docs/setup/minikube/) \ No newline at end of file From 1f648b54adaae4a96e09e9920022acc929305584 Mon Sep 17 00:00:00 2001 From: Arhell Date: Sat, 19 Dec 2020 02:18:48 +0200 Subject: [PATCH 173/258] [zh] update http to https (readme.md) --- README-zh.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README-zh.md b/README-zh.md index a1532f37a3..4dd4de269f 100644 --- a/README-zh.md +++ b/README-zh.md @@ -228,8 +228,8 @@ For more information about contributing to the Kubernetes documentation, see: 有关为 Kubernetes 文档做出贡献的更多信息，请参阅： * [贡献 Kubernetes 文档](https://kubernetes.io/docs/contribute/) -* [页面内容类型](http://kubernetes.io/docs/contribute/style/page-content-types/) -* [文档风格指南](http://kubernetes.io/docs/contribute/style/style-guide/) +* [页面内容类型](https://kubernetes.io/docs/contribute/style/page-content-types/) +* [文档风格指南](https://kubernetes.io/docs/contribute/style/style-guide/) * [本地化 Kubernetes 文档](https://kubernetes.io/docs/contribute/localization/) # 中文本地化 From 21c57500869878d40f97dfa5228ff916f8c81d17 Mon Sep 17 00:00:00 2001 From: Ader Date: Sat, 19 Dec 2020 14:13:40 +0800 Subject: [PATCH 174/258] Fix some typo in init-containers.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixed a typo in manage-resources-containers.md (Kubelet → kubelet) --- content/en/docs/concepts/workloads/pods/init-containers.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/workloads/pods/init-containers.md b/content/en/docs/concepts/workloads/pods/init-containers.md index 5c92f07423..08d6e0fa0f 100644 --- a/content/en/docs/concepts/workloads/pods/init-containers.md +++ b/content/en/docs/concepts/workloads/pods/init-containers.md @@ -49,9 +49,9 @@ as documented in [Resources](#resources). Also, init containers do not support `lifecycle`, `livenessProbe`, `readinessProbe`, or `startupProbe` because they must run to completion before the Pod can be ready. -If you specify multiple init containers for a Pod, Kubelet runs each init +If you specify multiple init containers for a Pod, kubelet runs each init container sequentially. Each init container must succeed before the next can run. -When all of the init containers have run to completion, Kubelet initializes +When all of the init containers have run to completion, kubelet initializes the application containers for the Pod and runs them as usual. ## Using init containers From fd0234299b766f04306d4f44f1e2aa8a8f691031 Mon Sep 17 00:00:00 2001 From: Sophy417 <53026875+Sophy417@users.noreply.github.com> Date: Sat, 19 Dec 2020 15:33:27 +0800 Subject: [PATCH 175/258] Update 2016-02-00-State-Of-Container-World-January-2016.md --- ...0-State-Of-Container-World-January-2016.md | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/content/zh/blog/_posts/2016-02-00-State-Of-Container-World-January-2016.md b/content/zh/blog/_posts/2016-02-00-State-Of-Container-World-January-2016.md index d19909ffdf..a6983a9a8a 100644 --- a/content/zh/blog/_posts/2016-02-00-State-Of-Container-World-January-2016.md +++ b/content/zh/blog/_posts/2016-02-00-State-Of-Container-World-January-2016.md @@ -1,5 +1,5 @@ --- -title: " 容器世界情况，2016年1月 " +title: " 容器世界现状，2016年1月 " date: 2016-02-01 slug: state-of-container-world-january-2016 url: /blog/2016/02/State-Of-Container-World-January-2016 @@ -15,51 +15,51 @@ url: /blog/2016/02/State-Of-Container-World-January-2016 -新年伊始，我们进行了一项调查，以评估集容器世界的状况。 -我们已经准备好发送[2月版](https://docs.google.com/forms/d/13yxxBqb5igUhwrrnDExLzZPjREiCnSs-AH-y4SSZ-5c/viewform)但在此之前，让我们从119条回复中看一下1月的数据（感谢您的参与！）。 +新年伊始，我们进行了一项调查，以评估容器世界的现状。 +我们已经准备好发送[ 2 月版](https://docs.google.com/forms/d/13yxxBqb5igUhwrrnDExLzZPjREiCnSs-AH-y4SSZ-5c/viewform)但在此之前，让我们从 119 条回复中看一下 1 月的数据（感谢您的参与！）。 关于这些数字的注释： -首先，您可能会注意到，这些数字加起来并不是100％，在大多数情况 下，选择不是唯一的，因此给出的百分比是选择特定选择的所有受访者的百分比。 -其次，虽然我们尝试覆盖广泛的云社区，但调查最初是通过Twitter发送给[@brendandburns](https://twitter.com/brendandburns)，[@kelseyhightower](https://twitter.com/kelseyhightower)，[@sarahnovotny](https://twitter.com/sarahnovotny)，[@juliaferraioli](https://twitter.com/juliaferraioli)，[@thagomizer\_rb](https://twitter.com/thagomizer_rb)，因此观众可能不是一个完美的覆盖。 -我们正在努力扩大样本量（我是否提到过2月份的调查？[立即参加](https://docs.google.com/forms/d/13yxxBqb5igUhwrrnDExLzZPjREiCnSs-AH-y4SSZ-5c/viewform))。 +首先，您可能会注意到，这些数字加起来并不是 100％，在大多数情况下，选择不是唯一的，因此给出的百分比是选择特定选择的所有受访者的百分比。 +其次，虽然我们尝试覆盖广泛的云社区，但调查最初是通过 Twitter 发送给[@brendandburns](https://twitter.com/brendandburns)，[@kelseyhightower](https://twitter.com/kelseyhightower)，[@sarahnovotny](https://twitter.com/sarahnovotny)，[@juliaferraioli](https://twitter.com/juliaferraioli)，[@thagomizer\_rb](https://twitter.com/thagomizer_rb)，因此受众覆盖可能并不完美。 +我们正在努力扩大样本数量（我是否提到过2月份的调查？[点击立即参加](https://docs.google.com/forms/d/13yxxBqb5igUhwrrnDExLzZPjREiCnSs-AH-y4SSZ-5c/viewform))。 -#### 现在，言归正传，数据： +#### 言归正传，来谈谈数据： -首先，很多人正在使用容器！目前有71％的人正在使用容器，而其中有24％的人正在考虑尽快使用它们。 +首先，很多人正在使用容器！目前有 71％ 的人正在使用容器，而其中有 24％ 的人正在考虑尽快使用它们。 显然，这表明样本集有些偏颇。 -在更广泛的社区中，容器使用的数量有所不同，但绝对低于71％。 +在更广泛的社区中，容器使用的数量有所不同，但绝对低于 71％。 因此，对这些数字的其余部分要持怀疑态度。 那么人们在使用容器做什么呢？ -超过80％的受访者使用容器进行开发，而只有50％的人使用容器进行生产。 -但是你们计划很快进入到生产，因为78%的容器用户表示你们计划很快进入生产阶段。 +超过 80％ 的受访者使用容器进行开发，但只有 50％ 的人在生产环境下使用容器。 +但是他们有计划很快投入到生产环境之中，78% 的容器用户表示了意愿。 你们在哪里部署容器？ -你的笔记本电脑显然是赢家，53%的人使用笔记本电脑。 -接下来是44％的人在自己的 VM 上运行（Vagrant？OpenStack？我们将在2月的调查中尝试深入研究），然后是33％的人在物理基础架构上运行，而31％的人在公共云 VM 上运行。 +你的笔记本电脑显然是赢家，53% 的人使用笔记本电脑。 +接下来是 44％ 的人在自己的 VM 上运行（Vagrant？OpenStack？我们将在2月的调查中尝试深入研究），然后是 33％ 的人在物理基础架构上运行，而 31％ 的人在公共云 VM 上运行。 如何部署容器？ -你们当中有 54% 的人使用 Kubernetes，虽然看起来有点受样本集的偏见（请参阅上面的注释），但真是令人惊讶，但有45％的人在使用 shell 脚本。 +你们当中有 54% 的人使用 Kubernetes，虽然看起来有点受样本集的偏见（请参阅上面的注释），但真是令人惊讶，但有 45％ 的人在使用 shell 脚本。 是因为 Kubernetes 存储库中正在运行大量（且很好）的 Bash 脚本吗？ 继续下去，我们可以看到真相…… -数据显示，25%使用 CAPS (Chef/Ansible/Puppet/Salt)系统，约13%使用 Docker Swarm、Mesos 或其他系统。 +数据显示，25% 使用 CAPS (Chef/Ansible/Puppet/Salt)系统，约 13% 使用 Docker Swarm、Mesos 或其他系统。 -- “孤立的开发环境/工作流程可能是零散的，调试容器时可以轻松访问日志等工具，但有时不直观，需要大量知识来掌握整个基础架构堆栈和部署/ 更新 kubernetes，到基础网络等。” +- “孤立的开发环境/工作流程可能是零散的，调试容器时可以轻松访问日志等工具，但有时却不太直观，需要大量知识来掌握整个基础架构堆栈和部署/ 更新 kubernetes，到底层网络等。” - “迁移开发者的工作流程。 那些不熟悉容器、卷等的人只是想工作。” - “网络安全” -- “秘密” +- “Secrets” -- “网络支持， 为 kubernetes 在裸机上为每个 Pod 提供 Ip” +- “网络支持， 为 kubernetes 在裸机上为每个 Pod 提供 IP” - “集群化还是太难了” -- “设置 Mesos 和 Kubernetes 太他妈复杂了！！” +- “设置 Mesos 和 Kubernetes 太复杂了！！” -_下载完整的调查结果 [此处](https://docs.google.com/spreadsheets/d/18wZe7wEDvRuT78CEifs13maXoSGem_hJvbOSmsuJtkA/pub?gid=530616014&single=true&output=csv) (CSV 文件）。_ +_下载完整的调查结果 [链接](https://docs.google.com/spreadsheets/d/18wZe7wEDvRuT78CEifs13maXoSGem_hJvbOSmsuJtkA/pub?gid=530616014&single=true&output=csv) (CSV 文件）。_ 1. Quinton - 集群联邦 * 在旧金山见面会后，想法浮出水面 -* * 请阅读并评论 +* * 请阅读、评论 * 不是 1.0，而是将文档放在一起以显示路线图 * 可以在 Kubernetes 之外构建 * 用于控制多个集群中事物的 API ，包括一些逻辑 @@ -119,7 +119,7 @@ Agenda: 1. 工作负载的耦合 - 2. 绝对位置(例如欧盟数据需要在欧盟内) + 2. 绝对位置(例如，欧盟数据需要在欧盟内) 2. 跨集群服务发现 @@ -188,7 +188,7 @@ Agenda: 4. 过载 -5. 失败的外部依赖项 +5. 失败的外部依赖 +## 通过 Pod 副本调试 + + +有些时候 Pod 的配置参数使得在某些情况下很难执行故障排查。 +例如，在容器镜像中不包含 shell 或者你的应用程序在启动时崩溃的情况下， +就不能通过运行 `kubectl exec` 来排查容器故障。 +在这些情况下，你可以使用 `kubectl debug` 来创建 Pod 的副本，通过更改配置帮助调试。 + + +### 在添加新的容器时创建 Pod 副本 + + +当应用程序正在运行但其表现不符合预期时，你会希望在 Pod 中添加额外的调试工具， +这时添加新容器是很有用的。 + + +例如，应用的容器镜像是建立在 `busybox` 的基础上， +但是你需要 `busybox` 中并不包含的调试工具。 +你可以使用 `kubectl run` 模拟这个场景: + +```shell +kubectl run myapp --image=busybox --restart=Never -- sleep 1d +``` + +通过运行以下命令，建立 `myapp` 的一个名为 `myapp-copy` 的副本， +新增了一个用于调试的 Ubuntu 容器， + +```shell +kubectl debug myapp -it --image=ubuntu --share-processes --copy-to=myapp-debug +``` + +``` +Defaulting debug container name to debugger-w7xmf. +If you don't see a command prompt, try pressing enter. +root@myapp-debug:/# +``` + +{{< note >}} +* 如果你没有使用 `--container` 指定新的容器名，`kubectl debug` 会自动生成的。 +* 默认情况下，`-i` 标志使 `kubectl debug` 附加到新容器上。 + 你可以通过指定 `--attach=false` 来防止这种情况。 + 如果你的会话断开连接，你可以使用 `kubectl attach` 重新连接。 +* `--share-processes` 允许在此 Pod 中的其他容器中查看该容器的进程。 + 参阅[在 Pod 中的容器之间共享进程命名空间](/zh/docs/tasks/configure-pod-container/share-process-namespace/) + 获取更多信息。 +{{< /note >}} + + +不要忘了清理调试 Pod： + +```shell +kubectl delete pod myapp myapp-debug +``` + + +### 在改变 Pod 命令时创建 Pod 副本 + + +有时更改容器的命令很有用，例如添加调试标志或因为应用崩溃。 + + +为了模拟应用崩溃的场景，使用 `kubectl run` 命令创建一个立即退出的容器： + +``` +kubectl run --image=busybox myapp -- false +``` + + +使用 `kubectl describe pod myapp` 命令，你可以看到容器崩溃了： + +``` +Containers: + myapp: + Image: busybox + ... + Args: + false + State: Waiting + Reason: CrashLoopBackOff + Last State: Terminated + Reason: Error + Exit Code: 1 +``` + + +你可以使用 `kubectl debug` 命令创建该 Pod 的一个副本， +在该副本中命令改变为交互式 shell： + +``` +kubectl debug myapp -it --copy-to=myapp-debug --container=myapp -- sh +``` + +``` +If you don't see a command prompt, try pressing enter. +/ # +``` + + +现在你有了一个可以执行类似检查文件系统路径或者手动运行容器命令的交互式 shell。 + + +{{< note >}} +* 要更改指定容器的命令，你必须用 `--container` 命令指定容器的名字， + 否则 `kubectl debug` 将建立一个新的容器运行你指定的命令。 +* 默认情况下，标志 `-i` 使 `kubectl debug` 附加到容器。 + 你可通过指定 `--attach=false` 来防止这种情况。 + 如果你的断开连接，可以使用 `kubectl attach` 重新连接。 +{{< /note >}} + + +不要忘了清理调试 Pod： + +```shell +kubectl delete pod myapp myapp-debug +``` + +### 在更改容器镜像时创建 Pod 副本 + +在某些情况下，你可能想从正常生产容器镜像中 +把行为异常的 Pod 改变为包含调试版本或者附加应用的镜像。 + +下面的例子，用 `kubectl run`创建一个 Pod： + +``` +kubectl run myapp --image=busybox --restart=Never -- sleep 1d +``` + +现在可以使用 `kubectl debug` 创建一个副本 +并改变容器镜像为 `ubuntu`： + +``` +kubectl debug myapp --copy-to=myapp-debug --set-image=*=ubuntu +``` + + +`--set-image` 与 `container_name=image` 使用相同的 `kubectl set image` 语法。 +`*=ubuntu` 表示把所有容器的镜像改为 `ubuntu`。 + +```shell +kubectl delete pod myapp myapp-debug +``` #### .Net 客户端 {#dotnet-client} -要使用 [.Net 客户端](https://github.com/kubernetes-client/csharp)，运行下面的命令： +要使用[.Net 客户端](https://github.com/kubernetes-client/csharp)，运行下面的命令： `dotnet add package KubernetesClient --version 1.6.1`。 -参见 [.Net 客户端库页面](https://github.com/kubernetes-client/csharp)了解更多安装选项。 +参见[.Net 客户端库页面](https://github.com/kubernetes-client/csharp)了解更多安装选项。 关于可支持的版本，参见[https://github.com/kubernetes-client/csharp/releases](https://github.com/kubernetes-client/csharp/releases)。 +.Net 客户端可以使用与 kubectl CLI 相同的 [kubeconfig 文件](/zh/docs/concepts/configuration/organize-cluster-access-kubeconfig/) +来定位并验证 API 服务器。 +参见[样例](https://github.com/kubernetes-client/csharp/blob/master/examples/simple/PodList.cs): + ```csharp using System; using k8s; From cb901fdeb1a5321901af2de63788b02dea639963 Mon Sep 17 00:00:00 2001 From: guzj11 <67083623+guzj11@users.noreply.github.com> Date: Sat, 19 Dec 2020 18:27:14 +0800 Subject: [PATCH 179/258] Update memory-default-namespace.md sync with english version --- .../manage-resources/memory-default-namespace.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/content/zh/docs/tasks/administer-cluster/manage-resources/memory-default-namespace.md b/content/zh/docs/tasks/administer-cluster/manage-resources/memory-default-namespace.md index c3fa12783f..2a1345364c 100644 --- a/content/zh/docs/tasks/administer-cluster/manage-resources/memory-default-namespace.md +++ b/content/zh/docs/tasks/administer-cluster/manage-resources/memory-default-namespace.md @@ -82,6 +82,9 @@ does not specify a memory request and limit. 现在，如果在 default-mem-example 命名空间创建容器，并且该容器没有声明自己的内存请求和限制值， 它将被指定默认的内存请求 256 MiB 和默认的内存限制 512 MiB。 +下面是具有一个容器的 Pod 的配置文件。 +容器未指定内存请求和限制。 + {{< codenew file="admin/resource/memory-defaults-pod.yaml" >}} + + +**作者：** Marek Siarkowicz（谷歌），Nathan Beach（谷歌） + + +日志是可观察性的一个重要方面，也是调试的重要工具。 但是Kubernetes日志传统上是非结构化的字符串，因此很难进行自动解析，以及任何可靠的后续处理、分析或查询。 + +在Kubernetes 1.19中，我们添加结构化日志的支持，该日志本身支持（键，值）对和对象引用。 我们还更新了许多日志记录调用，以便现在将典型部署中超过99％的日志记录量迁移为结构化格式。 + +为了保持向后兼容性，结构化日志仍将作为字符串输出，其中该字符串包含这些“键” =“值”对的表示。 从1.19的Alpha版本开始，日志也可以使用`--logging-format = json`标志以JSON格式输出。 + +## 使用结构化日志 + + +我们在klog库中添加了两个新方法：InfoS和ErrorS。 例如，InfoS的此调用： + +```golang +klog.InfoS("Pod status updated", "pod", klog.KObj(pod), "status", status) +``` + + +将得到下面的日志输出： + +``` +I1025 00:15:15.525108 1 controller_utils.go:116] "Pod status updated" pod="kube-system/kubedns" status="ready" +``` + + +或者, 如果 --logging-format=json 模式被设置, 将会产生如下结果: + +```json +{ + "ts": 1580306777.04728, + "msg": "Pod status updated", + "pod": { + "name": "coredns", + "namespace": "kube-system" + }, + "status": "ready" +} +``` + + +这意味着下游日志记录工具可以轻松地获取结构化日志数据，而无需使用正则表达式来解析非结构化字符串。这也使处理日志更容易，查询日志更健壮，并且分析日志更快。 + +使用结构化日志，所有对Kubernetes对象的引用都以相同的方式进行结构化，因此您可以过滤输出并且仅引用特定Pod的日志条目。您还可以发现指示调度程序如何调度Pod，如何创建Pod，监测Pod的运行状况以及Pod生命周期中的所有其他更改的日志。 + +假设您正在调试Pod的问题。使用结构化日志，您可以只过滤查看感兴趣的Pod的日志条目，而无需扫描可能成千上万条日志行以找到相关的日志行。 + +结构化日志不仅在手动调试问题时更有用，而且还启用了更丰富的功能，例如日志的自动模式识别或日志和所跟踪数据的更紧密关联性（分析）。 + +最后，结构化日志可以帮助降低日志的存储成本，因为大多数存储系统比非结构化字符串更有效地压缩结构化键值数据。 + +## 参与其中 + + +虽然在典型部署中，我们已按日志量更新了99％以上的日志条目，但仍有数千个日志需要更新。 选择一个您要改进的文件或目录，然后[迁移现有的日志调用以使用结构化日志]（https://github.com/kubernetes/community/blob/master/contributors/devel/sig-instrumentation/migration-to-structured-logging.md）。这是对Kubernetes做出第一笔贡献的好方法! From d6138a0db23b85cdcf3be80c152f51565da2eac2 Mon Sep 17 00:00:00 2001 From: Arhell Date: Sun, 20 Dec 2020 00:52:04 +0200 Subject: [PATCH 182/258] update http to https (readme.md) --- README-de.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README-de.md b/README-de.md index 9efc1fb597..b570f43671 100644 --- a/README-de.md +++ b/README-de.md @@ -14,9 +14,9 @@ Sobald Ihre Pull-Anfrage erstellt wurde, übernimmt ein Rezensent von Kubernetes Weitere Informationen zum Beitrag zur Kubernetes-Dokumentation finden Sie unter: * [Mitwirkung beginnen](https://kubernetes.io/docs/contribute/start/) -* [Ihre Dokumentationsänderungen bereitstellen](http://kubernetes.io/docs/contribute/intermediate#view-your-changes-locally) -* [Seitenvorlagen verwenden](http://kubernetes.io/docs/contribute/style/page-content-types/) -* [Dokumentationsstil-Handbuch](http://kubernetes.io/docs/contribute/style/style-guide/) +* [Ihre Dokumentationsänderungen bereitstellen](https://kubernetes.io/docs/contribute/intermediate#view-your-changes-locally) +* [Seitenvorlagen verwenden](https://kubernetes.io/docs/contribute/style/page-content-types/) +* [Dokumentationsstil-Handbuch](https://kubernetes.io/docs/contribute/style/style-guide/) * [Übersetzung der Kubernetes-Dokumentation](https://kubernetes.io/docs/contribute/localization/) ## `README.md`'s Localizing Kubernetes Documentation @@ -65,7 +65,7 @@ Dadurch wird der lokale Hugo-Server an Port 1313 gestartet. Öffnen Sie Ihren Br ## Community, Diskussion, Beteiligung und Unterstützung -Erfahren Sie auf der [Community-Seite](http://kubernetes.io/community/) wie Sie mit der Kubernetes-Community interagieren können. +Erfahren Sie auf der [Community-Seite](https://kubernetes.io/community/) wie Sie mit der Kubernetes-Community interagieren können. Sie können die Betreuer dieses Projekts unter folgender Adresse erreichen: From 25d0f62174f3b10745a7f689a93836370b989833 Mon Sep 17 00:00:00 2001 From: lis102 Date: Wed, 16 Dec 2020 22:45:53 +0800 Subject: [PATCH 183/258] 2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Update content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Co-authored-by: Qiming Teng Update content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Co-authored-by: Qiming Teng Update content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Co-authored-by: Qiming Teng Update content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Co-authored-by: Qiming Teng Update 2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Update 2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Update content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Co-authored-by: Qiming Teng Update 2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Update content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Co-authored-by: Qiming Teng Update content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Co-authored-by: Qiming Teng Update content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Co-authored-by: Qiming Teng Update content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Co-authored-by: Qiming Teng Update content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Co-authored-by: Qiming Teng Update content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Co-authored-by: Qiming Teng Update content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md Co-authored-by: Qiming Teng --- ...-and-Short-lived-Volumes-in-CSI-Drivers.md | 136 ++++++++++++++++++ 1 file changed, 136 insertions(+) create mode 100644 content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md diff --git a/content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md b/content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md new file mode 100644 index 0000000000..f05fb58efa --- /dev/null +++ b/content/zh/blog/_posts/2020-12-10-Pod-Impersonation-and-Short-lived-Volumes-in-CSI-Drivers.md @@ -0,0 +1,136 @@ +--- +layout: blog +title: 'Kubernetes 1.20：CSI 驱动程序中的 Pod 身份假扮和短时卷' +date: 2020-12-18 +slug: kubernetes-1.20-pod-impersonation-short-lived-volumes-in-csi +--- + + + +**作者**: Shihang Zhang（谷歌） + + +通常，当 [CSI](https://github.com/container-storage-interface/spec/blob/baa71a34651e5ee6cb983b39c03097d7aa384278/spec.md) 驱动程序挂载 +诸如 Secret 和证书之类的凭据时，它必须通过存储提供者的身份认证才能访问这些凭据。 +然而，对这些凭据的访问是根据 Pod 的身份而不是 CSI 驱动程序的身份来控制的。 +因此，CSI 驱动程序需要某种方法来取得 Pod 的服务帐户令牌。 + + +当前，有两种不是那么理想的方法来实现这一目的，要么通过授予 CSI 驱动程序使用 TokenRequest API 的权限，要么直接从主机文件系统中读取令牌。 + + +两者都存在以下缺点： + + +- 违反最少特权原则 +- 每个 CSI 驱动程序都需要重新实现获取 Pod 的服务帐户令牌的逻辑 + + +第二种方式问题更多，因为： + + +- 令牌的受众默认为 kube-apiserver +- 该令牌不能保证可用（例如，`AutomountServiceAccountToken=false`） +- 该方法不适用于以与 Pod 不同的（非 root 用户）用户身份运行的 CSI 驱动程序。请参见 + [服务帐户令牌的文件许可权部分](https://github.com/kubernetes/enhancements/blob/f40c24a5da09390bd521be535b38a4dbab09380c/keps/sig-storage/20180515-svcacct-token-volumes.md#file-permission) +- 该令牌可能是旧的 Kubernetes 服务帐户令牌，如果 `BoundServiceAccountTokenVolume=false`，该令牌不会过期。 + + +Kubernetes 1.20 引入了一个内测功能 `CSIServiceAccountToken` 以改善安全状况。这项新功能允许 CSI 驱动程序接收 Pod 的[绑定服务帐户令牌](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/1205-bound-service-account-tokens/README.md)。 + + +此功能还提供了一个重新发布卷的能力，以便可以刷新短时卷。 + + +## Pod 身份假扮 + +### 使用 GCP APIs + + +使用 [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity)，Kubernetes 服务帐户可以在访问 Google Cloud API 时验证为 Google 服务帐户。 +如果 CSI 驱动程序要代表其为挂载卷的 Pod 访问 GCP API，则可以使用 Pod 的服务帐户令牌来 +[交换 GCP 令牌](https://cloud.google.com/iam/docs/reference/sts/rest)。启用功能 `CSIServiceAccountToken` 后， +可通过 `NodePublishVolume` RPC 调用中的卷上下文来访问 Pod 的服务帐户令牌。例如：通过 [Secret 存储 CSI 驱动](https://github.com/GoogleCloudPlatform/secrets-store-csi-driver-provider-gcp) +访问 [Google Secret Manager](https://cloud.google.com/secret-manager/)。 + + +### 使用Vault + +如果用户将 [Kubernetes 作为身份验证方法](https://www.vaultproject.io/docs/auth/kubernetes)配置， +则 Vault 使用 `TokenReview` API 来验证 Kubernetes 服务帐户令牌。 +对于使用 Vault 作为资源提供者的 CSI 驱动程序，它们需要将 Pod 的服务帐户提供给 Vault。 +例如，[Secret 存储 CSI 驱动](https://github.com/hashicorp/secrets-store-csi-driver-provider-vault)和 +[证书管理器 CSI 驱动](https://github.com/jetstack/cert-manager-csi)。 + + +## 短时卷 + +为了使诸如证书之类的短时卷保持有效，CSI 驱动程序可以在其 `CSIDriver` 对象中指定 `RequiresRepublish=true`， +以使 kubelet 定期针对已挂载的卷调用 `NodePublishVolume`。 +这些重新发布操作使 CSI 驱动程序可以确保卷内容是最新的。 + + +## 下一步 + +此功能是 Alpha 版，预计将在 1.21 版中移至 Beta 版。 请参阅以下 KEP 和 CSI 文档中的更多内容： + + +- [KEP-1855: CSI 驱动程序的服务帐户令牌](https://github.com/kubernetes/enhancements/blob/master/keps/sig-storage/1855-csi-driver-service-account-token/README.md) +- [令牌请求](https://kubernetes-csi.github.io/docs/token-requests.html) + + +随时欢迎您提供反馈! +- SIG-Auth [定期开会](https://github.com/kubernetes/community/tree/master/sig-auth#meetings)，可以通过 [Slack 和邮件列表](https://github.com/kubernetes/community/tree/master/sig-auth＃contact)加入 +- SIG-Storage [定期开会](https://github.com/kubernetes/community/tree/master/sig-storage#meetings)，可以通过 [Slack 和邮件列表](https://github.com/kubernetes/community/tree/master/sig-storage＃contact)加入 From 1141c3b8a0c99c85c1d7cab718beecd0974ee35e Mon Sep 17 00:00:00 2001 From: Arhell Date: Mon, 21 Dec 2020 01:35:00 +0200 Subject: [PATCH 184/258] [zh] sync kubernetes-api.md --- content/zh/docs/concepts/overview/kubernetes-api.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/concepts/overview/kubernetes-api.md b/content/zh/docs/concepts/overview/kubernetes-api.md index bd97b47361..17e0c45000 100644 --- a/content/zh/docs/concepts/overview/kubernetes-api.md +++ b/content/zh/docs/concepts/overview/kubernetes-api.md @@ -19,7 +19,7 @@ is the {{< glossary_tooltip text="API server" term_id="kube-apiserver" >}}. The exposes an HTTP API that lets end users, different parts of your cluster, and external components communicate with one another. -The Kubernetes API lets you query and manipulate the state of objects in the Kubernetes API +The Kubernetes API lets you query and manipulate the state of API objects in Kubernetes (for example: Pods, Namespaces, ConfigMaps, and Events). Most operations can be performed through the From db55c7c07183b3458b618505f48fc2e98158a4a5 Mon Sep 17 00:00:00 2001 From: Xu Yuandong Date: Fri, 18 Dec 2020 11:06:06 +0800 Subject: [PATCH 185/258] Resync finshed, also I have reviewed the codes. --- .../concepts/services-networking/service.md | 520 +++++++++++------- 1 file changed, 306 insertions(+), 214 deletions(-) diff --git a/content/zh/docs/concepts/services-networking/service.md b/content/zh/docs/concepts/services-networking/service.md index 5090d7d660..37fdeaa6ea 100644 --- a/content/zh/docs/concepts/services-networking/service.md +++ b/content/zh/docs/concepts/services-networking/service.md @@ -10,12 +10,11 @@ weight: 10 --- Kubernetes Service 定义了这样一种抽象：逻辑上的一组 Pod，一种可以访问它们的策略 —— 通常称为微服务。 Service 所针对的 Pods 集合通常是通过{{< glossary_tooltip text="选择算符" term_id="selector" >}}来确定的。 -要了解如何定义服务端点，请参阅[不带选择算符的服务](#services-without-selectors)。 +要了解定义服务端点的其他方法，请参阅[不带选择算符的服务](#services-without-selectors)。 上述配置创建一个名称为 "my-service" 的 Service 对象，它会将请求代理到使用 TCP 端口 9376，并且具有标签 `"app=MyApp"` 的 Pod 上。 + Kubernetes 为该服务分配一个 IP 地址（有时称为 "集群IP"），该 IP 地址由服务代理使用。 (请参见下面的 [VIP 和 Service 代理](#virtual-ips-and-service-proxies)). + 服务选择算符的控制器不断扫描与其选择器匹配的 Pod，然后将所有更新发布到也称为 “my-service” 的 Endpoint 对象。 @@ -206,7 +208,7 @@ Pod 中的端口定义是有名字的，你可以在服务的 `targetPort` 属 这为部署和发展服务提供了很大的灵活性。 例如，你可以更改 Pods 在新版本的后端软件中公开的端口号，而不会破坏客户端。 -服务的默认协议是TCP。 你还可以使用任何其他[受支持的协议](#protocol-support)。 +服务的默认协议是 TCP；你还可以使用任何其他[受支持的协议](#protocol-support)。 由于许多服务需要公开多个端口，因此 Kubernetes 在服务对象上支持多个端口定义。 每个端口定义可以具有相同的 `protocol`，也可以具有不同的协议。 @@ -222,7 +224,7 @@ For example: test environment you use your own databases. * You want to point your Service to a Service in a different {{< glossary_tooltip term_id="namespace" >}} or on another cluster. - * You are migrating a workload to Kubernetes. Whilst evaluating the approach, +* You are migrating a workload to Kubernetes. While evaluating the approach, you run only a proportion of your backends in Kubernetes. In any of these scenarios you can define a Service _without_ a Pod selector. @@ -287,8 +289,9 @@ because {{< glossary_tooltip term_id="kube-proxy" >}} doesn't support virtual IP as a destination. --> {{< note >}} -端点 IPs _必须不可以_ 是：本地回路（IPv4 的 `127.0.0.0/8`, IPv6 的 `::1/128`）或 -本地链接（IPv4 的 `169.254.0.0/16` 和 `224.0.0.0/24`，IPv6 的 `fe80::/64`)。 +端点 IPs _必须不可以_ 是：本地回路（IPv4 的 127.0.0.0/8, IPv6 的 ::1/128）或 +本地链接（IPv4 的 169.254.0.0/16 和 224.0.0.0/24，IPv6 的 fe80::/64)。 + 端点 IP 地址不能是其他 Kubernetes 服务的集群 IP，因为 {{< glossary_tooltip term_id ="kube-proxy">}} 不支持将虚拟 IP 作为目标。 {{< /note >}} @@ -307,7 +310,7 @@ selectors and uses DNS names instead. For more information, see the [ExternalName](#externalname) section later in this document. --> ExternalName Service 是 Service 的特例，它没有选择算符，但是使用 DNS 名称。 -有关更多信息，请参阅本文档后面的[`ExternalName`](#externalname)。 +有关更多信息，请参阅本文档后面的[ExternalName](#externalname)。 ### 应用程序协议 {#application-protocol} -{{< feature-state for_k8s_version="v1.19" state="beta" >}} - +{{< feature-state for_k8s_version="v1.20" state="stable" >}} `appProtocol` 字段提供了一种为每个 Service 端口指定应用协议的方式。 -此字段的取值会被映射到对应的 Endpoints 和 EndpointSlices 资源。 +此字段的取值会被映射到对应的 Endpoints 和 EndpointSlices 对象。 +该字段遵循标准的 Kubernetes 标签语法。 +其值可以是 [IANA 标准服务名称](http://www.iana.org/assignments/service-names)或以域名前缀的名称， +如 `mycompany.com/my-custom-protocol`。 -在 `ipvs` 模式下，kube-proxy监视Kubernetes服务和端点，调用 `netlink` 接口相应地创建 IPVS 规则， +在 `ipvs` 模式下，kube-proxy 监视 Kubernetes 服务和端点，调用 `netlink` 接口相应地创建 IPVS 规则， 并定期将 IPVS 规则与 Kubernetes 服务和端点同步。 该控制循环可确保IPVS 状态与所需状态匹配。访问服务时，IPVS 将流量定向到后端Pod之一。 @@ -511,25 +522,25 @@ IPVS代理模式基于类似于 iptables 模式的 netfilter 挂钩函数， 重定向通信的延迟要短，并且在同步代理规则时具有更好的性能。 与其他代理模式相比，IPVS 模式还支持更高的网络流量吞吐量。 -IPVS提供了更多选项来平衡后端Pod的流量。 这些是： +IPVS 提供了更多选项来平衡后端 Pod 的流量。 这些是： -- `rr`: round-robin -- `lc`: least connection (smallest number of open connections) -- `dh`: destination hashing -- `sh`: source hashing -- `sed`: shortest expected delay -- `nq`: never queue +* `rr`：轮替（Round-Robin） +* `lc`：最少链接（Least Connection），即打开链接数量最少者优先 +* `dh`：目标地址哈希（Destination Hashing） +* `sh`：源地址哈希（Source Hashing） +* `sed`：最短预期延迟（Shortest Expected Delay） +* `nq`：从不排队（Never Queue） {{< note >}} -要在 IPVS 模式下运行 kube-proxy，必须在启动 kube-proxy 之前使 IPVS Linux 在节点上可用。 +要在 IPVS 模式下运行 kube-proxy，必须在启动 kube-proxy 之前使 IPVS 在节点上可用。 当 kube-proxy 以 IPVS 代理模式启动时，它将验证 IPVS 内核模块是否可用。 如果未检测到 IPVS 内核模块，则 kube-proxy 将退回到以 iptables 代理模式运行。 @@ -538,13 +549,13 @@ falls back to running in iptables proxy mode. @@ -667,7 +677,7 @@ variables: 简单的 `{SVCNAME}_SERVICE_HOST` 和 `{SVCNAME}_SERVICE_PORT` 变量。 这里 Service 的名称需大写，横线被转换成下划线。 -举个例子，一个名称为 `"redis-master"` 的 Service 暴露了 TCP 端口 6379， +举个例子，一个名称为 `redis-master` 的 Service 暴露了 TCP 端口 6379， 同时给它分配了 Cluster IP 地址 10.0.0.11，这个 Service 生成了如下环境变量： ```shell @@ -715,35 +725,35 @@ Services by their DNS name. 如果在整个集群中都启用了 DNS，则所有 Pod 都应该能够通过其 DNS 名称自动解析服务。 -例如，如果你在 Kubernetes 命名空间 `"my-ns"` 中有一个名为 `"my-service"` 的服务， -则控制平面和 DNS 服务共同为 `"my-service.my-ns"` 创建 DNS 记录。 -`"my-ns"` 命名空间中的 Pod 应该能够通过简单地对 `my-service` 进行名称查找来找到它 -（`"my-service.my-ns"` 也可以工作）。 +例如，如果你在 Kubernetes 命名空间 `my-ns` 中有一个名为 `my-service` 的服务， +则控制平面和 DNS 服务共同为 `my-service.my-ns` 创建 DNS 记录。 +`my-ns` 命名空间中的 Pod 应该能够通过简单地按名检索 `my-service` 来找到它 +（`my-service.my-ns` 也可以工作）。 其他命名空间中的 Pod 必须将名称限定为 `my-service.my-ns`。 这些名称将解析为为服务分配的集群 IP。 Kubernetes 还支持命名端口的 DNS SRV（服务）记录。 -如果 `"my-service.my-ns"` 服务具有名为 `"http"`　的端口，且协议设置为 TCP， +如果 `my-service.my-ns` 服务具有名为 `http`　的端口，且协议设置为 TCP， 则可以对 `_http._tcp.my-service.my-ns` 执行 DNS SRV 查询查询以发现该端口号, `"http"` 以及 IP 地址。 @@ -755,7 +765,7 @@ Kubernetes DNS 服务器是唯一的一种能够访问 `ExternalName` 类型的 ## Headless Services {#headless-services} Sometimes you don't need load-balancing and a single Service IP. In -this case, you can create what are termed “headless” Services, by explicitly +this case, you can create what are termed "headless" Services, by explicitly specifying `"None"` for the cluster IP (`.spec.clusterIP`). You can use a headless Service to interface with other service discovery mechanisms, @@ -784,12 +794,12 @@ DNS 如何实现自动配置，依赖于 Service 是否定义了选择算符。 For headless Services that define selectors, the endpoints controller creates `Endpoints` records in the API, and modifies the DNS configuration to return -records (addresses) that point directly to the `Pods` backing the Service. +records (addresses) that point directly to the `Pods` backing the `Service`. --> -### 带选择算符的服务 {#with-selectors} +### 带选择算符的服务 {#with-selectors} 对定义了选择算符的无头服务，Endpoint 控制器在 API 中创建了 Endpoints 记录， -并且修改 DNS 配置返回 A 记录（地址），通过这个地址直接到达 Service 的后端 Pod 上。 +并且修改 DNS 配置返回 A 记录（地址），通过这个地址直接到达 `Service` 的后端 Pod 上。 @@ -922,15 +931,17 @@ to configure environments that are not fully supported by Kubernetes, or even to just expose one or more nodes' IPs directly. Note that this Service is visible as `:spec.ports[*].nodePort` -and `.spec.clusterIP:spec.ports[*].port`. (If the `-nodeport-addresses` flag in kube-proxy is set, would be filtered NodeIP(s).) +and `.spec.clusterIP:spec.ports[*].port`. (If the `--nodeport-addresses` flag in kube-proxy is set, would be filtered NodeIP(s).) For example: --> -使用 NodePort 可以让你自由设置自己的负载均衡解决方案，配置 Kubernetes 不完全支持的环境， +使用 NodePort 可以让你自由设置自己的负载均衡解决方案， +配置 Kubernetes 不完全支持的环境， 甚至直接暴露一个或多个节点的 IP。 需要注意的是，Service 能够通过 `:spec.ports[*].nodePort` 和 -`spec.clusterIp:spec.ports[*].port` 而对外可见。 +`spec.clusterIp:spec.ports[*].port` 而对外可见 +（如果 kube-proxy 的 `--nodeport-addresses` 参数被设置了， 将被过滤 NodeIP。）。 例如： @@ -969,7 +980,7 @@ For example: 负载均衡器是异步创建的，关于被提供的负载均衡器的信息将会通过 Service 的 `status.loadBalancer` 字段发布出去。 -实例: +实例： ```yaml apiVersion: v1 @@ -984,26 +995,18 @@ spec: port: 80 targetPort: 9376 clusterIP: 10.0.171.239 - loadBalancerIP: 78.11.24.19 type: LoadBalancer status: loadBalancer: ingress: - - ip: 146.148.47.155 + - ip: 192.0.2.127 ``` 来自外部负载均衡器的流量将直接重定向到后端 Pod 上，不过实际它们是如何工作的，这要依赖于云提供商。 -对于 LoadBalancer 类型的服务，当所定义的端口不止一个时，所有端口都必须 -使用相同的协议，并且其协议必须是 `TCP`、`UDP` 和 `SCTP` 之一。 - -{{< note >}} -如果你使用的是 SCTP，请参阅下面有关 `LoadBalancer` 服务类型的 -[注意事项](#caveat-sctp-loadbalancer-service-type)。 -{{< /note >}} +#### 混合协议类型的负载均衡器 + +{{< feature-state for_k8s_version="v1.20" state="alpha" >}} + +默认情况下，对于 LoadBalancer 类型的服务，当定义了多个端口时，所有 +端口必须具有相同的协议，并且该协议必须是受云提供商支持的协议。 + +如果为 kube-apiserver 启用了 `MixedProtocolLBService` 特性门控， +则当定义了多个端口时，允许使用不同的协议。 + + +{{< note >}} +可用于 LoadBalancer 类型服务的协议集仍然由云提供商决定。 +{{< /note >}} + +### 禁用负载均衡器节点端口分配 {#load-balancer-nodeport-allocation} + +{{< feature-state for_k8s_version="v1.20" state="alpha" >}} + +从 v1.20 版本开始， 你可以通过设置 `spec.allocateLoadBalancerNodePorts` 为 `false` +对类型为 LoadBalancer 的服务禁用节点端口分配。 +这仅适用于直接将流量路由到 Pod 而不是使用节点端口的负载均衡器实现。 +默认情况下，`spec.allocateLoadBalancerNodePorts` 为 `true`， +LoadBalancer 类型的服务继续分配节点端口。 +如果现有服务已被分配节点端口，将参数 `spec.allocateLoadBalancerNodePorts` 设置为 `false` 时， +这些服务上已分配置的节点端口不会被自动释放。 +你必须显式地在每个服务端口中删除 `nodePorts` 项以释放对应端口。 +你必须启用 `ServiceLBNodePortControl` 特性门控才能使用该字段。 -#### 内部负载均衡器 {#internal-load-balancer} +#### 内部负载均衡器 {#internal-load-balancer} 在混合环境中，有时有必要在同一(虚拟)网络地址块内路由来自服务的流量。 在水平分割 DNS 环境中，你需要两个服务才能将内部和外部流量都路由到你的端点（Endpoints）。 -你可以通过向服务添加以下注解之一来实现此目的。 -要添加的注解取决于你使用的云服务提供商。 + +如要设置内部负载均衡器，请根据你所使用的云运营商，为服务添加以下注解之一。 {{< tabs name="service_tabs" >}} {{% tab name="Default" %}} @@ -1207,7 +1254,7 @@ SSL, the ELB expects the Pod to authenticate itself over the encrypted connection, using a certificate. HTTP and HTTPS selects layer 7 proxying: the ELB terminates -the connection with the user, parse headers and inject the `X-Forwarded-For` +the connection with the user, parses headers, and injects the `X-Forwarded-For` header with the user's IP address (Pods only see the IP address of the ELB at the other end of its connection) when forwarding requests. @@ -1240,9 +1287,12 @@ In the above example, if the Service contained three ports, `80`, `443`, and `8443`, then `443` and `8443` would use the SSL certificate, but `80` would just be proxied HTTP. -From Kubernetes v1.9 onwards you can use [predefined AWS SSL policies](http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html) with HTTPS or SSL listeners for your Services. +From Kubernetes v1.9 onwards you can use [predefined AWS SSL policies](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html) with HTTPS or SSL listeners for your Services. To see which policies are available for use, you can use the `aws` command line tool: --> +在上例中，如果服务包含 `80`、`443` 和 `8443` 三个端口， 那么 `443` 和 `8443` 将使用 SSL 证书， +而 `80` 端口将仅仅转发 HTTP 数据包。 + 从 Kubernetes v1.9 起可以使用 [预定义的 AWS SSL 策略](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html) 为你的服务使用 HTTPS 或 SSL 侦听器。 @@ -1292,44 +1342,6 @@ Since version 1.3.0, the use of this annotation applies to all ports proxied by and cannot be configured otherwise. --> 从 1.3.0 版开始，此注解的使用适用于 ELB 代理的所有端口，并且不能进行其他配置。 - - -### 外部 IP - -如果有一些外部 IP 地址能够路由到一个或多个集群节点，Kubernetes 服务可以在这些 -`externalIPs` 上暴露出来。 -通过外部 IP 进入集群的入站请求，如果指向的是服务的端口，会被路由到服务的末端之一。 -`externalIPs` 不受 Kubernets 管理；它们由集群管理员管理。 -在服务规约中，`externalIPs` 可以和 `ServiceTypes` 一起指定。 -在上面的例子中，客户端可以通过 "`80.11.12.10:80`" (`externalIP:port`) 访问 "`my-service`" -服务。 - -```yaml -kind: Service -apiVersion: v1 -metadata: - name: my-service -spec: - selector: - app: MyApp - ports: - - name: http - protocol: TCP - port: 80 - targetPort: 9376 - externalIPs: - - 80.11.12.10 -``` - -#### AWS 上负载均衡器支持 {#aws-nlb-support} +#### AWS 上网络负载均衡器支持 {#aws-nlb-support} {{< feature-state for_k8s_version="v1.15" state="beta" >}} @@ -1555,6 +1567,78 @@ in those modified security groups. 如果节点具有公共 IP 地址，请注意，非 NLB 流量也可以到达那些修改后的安全组中的所有实例。 {{< /note >}} + +#### 腾讯 Kubernetes 引擎（TKE）上的 CLB 注解 + +以下是在 TKE 上管理云负载均衡器的注解。 + +```yaml + metadata: + name: my-service + annotations: + # 绑定负载均衡器到指定的节点。 + service.kubernetes.io/qcloud-loadbalancer-backends-label: key in (value1, value2) + + # 为已有负载均衡器添加 ID。 + service.kubernetes.io/tke-existed-lbid：lb-6swtxxxx + + # 负载均衡器（LB）的自定义参数尚不支持修改 LB 类型。 + service.kubernetes.io/service.extensiveParameters: "" + + # 自定义负载均衡监听器。 + service.kubernetes.io/service.listenerParameters: "" + + # 指定负载均衡类型。 + # 可用参数: classic (Classic Cloud Load Balancer) 或 application (Application Cloud Load Balancer) + service.kubernetes.io/loadbalance-type: xxxxx + + # 指定公用网络带宽计费方法。 + # 可用参数: TRAFFIC_POSTPAID_BY_HOUR(bill-by-traffic) 和 BANDWIDTH_POSTPAID_BY_HOUR (bill-by-bandwidth). + service.kubernetes.io/qcloud-loadbalancer-internet-charge-type: xxxxxx + + # 指定带宽参数 (取值范围： [1,2000] Mbps). + service.kubernetes.io/qcloud-loadbalancer-internet-max-bandwidth-out: "10" + + # 当设置该注解时，负载平衡器将只注册正在运行 Pod 的节点， + # 否则所有节点将会被注册。 + service.kubernetes.io/local-svc-only-bind-node-with-pod: true +``` +{{< warning >}} +对于一些常见的协议，包括 HTTP 和 HTTPS， +你使用 ExternalName 可能会遇到问题。 +如果你使用 ExternalName，那么集群内客户端使用的主机名 +与 ExternalName 引用的名称不同。 + +对于使用主机名的协议，此差异可能会导致错误或意外响应。 +HTTP 请求将具有源服务器无法识别的 `Host:` 标头；TLS 服 +务器将无法提供与客户端连接的主机名匹配的证书。 +{{< /warning >}} + 你可以将 UDP 用于大多数服务。 对于 type=LoadBalancer 服务，对 UDP 的支持取决于提供此功能的云提供商。 + +### SCTP + +{{< feature-state for_k8s_version="v1.20" state="stable" >}} + +一旦你使用了支持 SCTP 流量的网络插件，你就可以使用 SCTP 于更多的服务。 +对于 type = LoadBalancer 的服务，SCTP 的支持取决于提供此设施的云供应商（多大数不支持）。 + + +#### 警告 {#caveat-sctp-overview} + +##### 支持多宿主 SCTP 关联 {#caveat-sctp-multihomed} + + +{{< warning >}} +支持多宿主SCTP关联要求 CNI 插件能够支持为一个 Pod 分配多个接口和IP地址。 + +用于多宿主 SCTP 关联的 NAT 在相应的内核模块中需要特殊的逻辑。 +{{< /warning >}} + + +##### Windows {#caveat-sctp-windows-os} + +{{< note >}} +基于 Windows 的节点不支持 SCTP。 +{{< /note >}} + + +##### 用户空间 kube-proxy {#caveat-sctp-kube-proxy-userspace} + +{{< warning >}} +当 kube-proxy 处于用户空间模式时，它不支持 SCTP 关联的管理。 +{{< /warning >}} + ### HTTP -接下来是来自客户端的数据。 - -### SCTP - -{{< feature-state for_k8s_version="v1.19" state="beta" >}} - - -Kubernetes 支持 SCTP 作为 Service、Endpoint、EndpointSlice, NetworkPolicy -和 Pod 定义中的 `protocol` 值。 -作为一种 Beta 特性，此功能默认是启用的。集群管理员需要在 API 服务器上使用 -`--feature-gates=SCTPSupport=false,...` 来关闭 -`SCTPSupport` [特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/) -来在集群级别禁用 SCTP。 - -启用特性门控后，你可以将 Service、Endpoints、EndpointSlice、NetworkPolicy 或 -Pod 的 `protocol` 字段设置为 `SCTP`。 -Kubernetes 相应地为 SCTP 关联设置网络，就像为 TCP 连接所做的一样。 - - - -#### 警告 {#caveat-sctp-overview} - -##### 支持多宿主SCTP关联 {#caveat-sctp-multihomed} - - -{{< warning >}} -对多宿主 SCTP 关联的支持要求 CNI 插件可以支持将多个接口和 IP 地址分配给 Pod。 -用于多宿主 SCTP 关联的 NAT 在相应的内核模块中需要特殊的逻辑。 -{{< /warning >}} - - -##### Service 类型为 LoadBalancer 的服务 {#caveat-sctp-loadbalancer-service-type} - -{{< warning >}} -如果云提供商的负载平衡器实现支持将 SCTP 作为协议，则只能使用 `type` LoadBalancer 加上 -`protocol` SCTP 创建服务。否则，服务创建请求将被拒绝。 -当前的云负载平衡器提供商（Azure、AWS、CloudStack、GCE、OpenStack）都缺乏对 SCTP 的支持。 -{{< /warning >}} - -##### Windows {#caveat-sctp-windows-os} - - -{{< warning >}} -基于 Windows 的节点不支持 SCTP。 -{{< /warning >}} - - -##### 用户空间 kube-proxy {#caveat-sctp-kube-proxy-userspace} - -{{< warning >}} - -当 kube-proxy 处于用户空间模式时，它不支持 SCTP 关联的管理。 -{{< /warning >}} +上述是来自客户端的数据。 ## {{% heading "whatsnext" %}} From 369b94cadc3335d38ad597108a36f054435ddf21 Mon Sep 17 00:00:00 2001 From: Arhell Date: Tue, 22 Dec 2020 03:17:24 +0200 Subject: [PATCH 186/258] [zh] sync kubelet-garbage-collection.md --- .../cluster-administration/kubelet-garbage-collection.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/content/zh/docs/concepts/cluster-administration/kubelet-garbage-collection.md b/content/zh/docs/concepts/cluster-administration/kubelet-garbage-collection.md index 5bc6c0b8d4..23a6bce400 100644 --- a/content/zh/docs/concepts/cluster-administration/kubelet-garbage-collection.md +++ b/content/zh/docs/concepts/cluster-administration/kubelet-garbage-collection.md @@ -1,11 +1,11 @@ --- -title: 配置 kubelet 垃圾回收策略 +title: 容器镜像的垃圾收集 content_type: concept weight: 70 --- @@ -13,13 +13,12 @@ weight: 70 -垃圾回收是 kubelet 的一个有用功能，它将清理未使用的镜像和容器。 +垃圾回收是 kubelet 的一个有用功能，它将清理未使用的[镜像](/zh/docs/concepts/containers/#container-images)和[容器](/zh/docs/concepts/containers/)。 Kubelet 将每分钟对容器执行一次垃圾回收，每五分钟对镜像执行一次垃圾回收。 不建议使用外部垃圾收集工具，因为这些工具可能会删除原本期望存在的容器进而破坏 kubelet 的行为。 From 8febf98cbb008fe576cddc71ead2dc469a70aa32 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E4=B8=80=E6=9E=9A=E5=B0=8F=E7=8C=BF?= Date: Tue, 22 Dec 2020 11:34:48 +0800 Subject: [PATCH 187/258] Sync with the English version. --- content/zh/docs/tasks/administer-cluster/sysctl-cluster.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/tasks/administer-cluster/sysctl-cluster.md b/content/zh/docs/tasks/administer-cluster/sysctl-cluster.md index 8091f60b2b..b8bffbc61b 100644 --- a/content/zh/docs/tasks/administer-cluster/sysctl-cluster.md +++ b/content/zh/docs/tasks/administer-cluster/sysctl-cluster.md @@ -147,7 +147,7 @@ For {{< glossary_tooltip term_id="minikube" >}}, this can be done via the `extra 如果你使用 {{< glossary_tooltip term_id="minikube" >}}，可以通过 `extra-config` 参数来配置： ```shell -minikube start --extra-config="kubelet.AllowedUnsafeSysctls=kernel.msg*,net.core.somaxconn"... +minikube start --extra-config="kubelet.allowed-unsafe-sysctls=kernel.msg*,net.core.somaxconn"... ``` -LHC 是世界上最大，功能最强大的粒子加速器。，是来自世界各地成千上万科学家合作的结果。所有这些合作都是为了促进科学的发展。以类似的方式，Kubernetes 已经成为一个聚集了来自数百个组织的数千名贡献者–所有人都朝着在各个方面改善云计算的相同目标努力的项目！ 发布名称“ A Bit Quarky” 的意思是提醒我们，非常规的想法可以带来巨大的变化，对开放性保持开放态度将有助于我们进行创新。 +LHC 是世界上最大，功能最强大的粒子加速器。它是由来自世界各地成千上万科学家合作的结果，所有这些合作都是为了促进科学的发展。以类似的方式，Kubernetes 已经成为一个聚集了来自数百个组织的数千名贡献者–所有人都朝着在各个方面改善云计算的相同目标努力的项目！ 发布名称“ A Bit Quarky” 的意思是提醒我们，非常规的想法可以带来巨大的变化，对开放性保持开放态度将有助于我们进行创新。 -作为公开测试版特性添加到v1.2，v1.7中可以看到云提供商标签达到基本可用。 +作为公开测试版特性添加到v1.2，v1.17中可以看到云提供商标签达到基本可用。 @@ -36,7 +36,7 @@ Added as a beta feature way back in v1.2, v1.17 sees the general availability of -在v1.7中，Kubernetes卷快照特性是公开测试版。这个特性是在v1.12中以内部测试版引入的，第二个有重大变化的内部测试版是v1.13。 +在v1.17中，Kubernetes卷快照特性是公开测试版。这个特性是在v1.12中以内部测试版引入的，第二个有重大变化的内部测试版是v1.13。 @@ -44,7 +44,7 @@ The Kubernetes Volume Snapshot feature is now beta in Kubernetes v1.17. It was i -在v1.7中，Kubernetes树内存储插件到容器存储接口(CSI)的迁移基础架构是公开测试版。容器存储接口迁移最初是在Kubernetes v1.14中以内部测试版引入的。 +在v1.17中，Kubernetes树内存储插件到容器存储接口(CSI)的迁移基础架构是公开测试版。容器存储接口迁移最初是在Kubernetes v1.14中以内部测试版引入的。 @@ -80,7 +80,7 @@ The labels are reaching general availability in this release. Kubernetes compone -在v1.7中，Kubernetes卷快照是是公开测试版。最初是在v1.12中以内部测试版引入的，第二个有重大变化的内部测试版是v1.13。这篇文章总结它在公开版本中的变化。 +在v1.17中，Kubernetes卷快照是是公开测试版。最初是在v1.12中以内部测试版引入的，第二个有重大变化的内部测试版是v1.13。这篇文章总结它在公开版本中的变化。 From fc2344b82762d2428c0ab06dc1faa5e65ba189a7 Mon Sep 17 00:00:00 2001 From: bianca rosa Date: Tue, 22 Dec 2020 14:53:26 -0300 Subject: [PATCH 192/258] Fix: typo on portuguese operator page --- content/pt/docs/concepts/extend-kubernetes/operator.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/pt/docs/concepts/extend-kubernetes/operator.md b/content/pt/docs/concepts/extend-kubernetes/operator.md index c1ed3ed47e..ba20161490 100644 --- a/content/pt/docs/concepts/extend-kubernetes/operator.md +++ b/content/pt/docs/concepts/extend-kubernetes/operator.md @@ -107,7 +107,7 @@ kubectl edit SampleDB/example-database # mudar manualmente algumas definições …e é isso! O Operador vai tomar conta de aplicar as mudanças assim como manter o serviço existente em boa forma. -## Escrevendo o seu prórpio Operador {#escrevendo-operador} +## Escrevendo o seu próprio Operador {#escrevendo-operador} Se não existir no ecosistema um Operador que implementa o comportamento que pretende, pode codificar o seu próprio. From 7e4e475611f6fecc54ea4ce703d31f5c2df59a17 Mon Sep 17 00:00:00 2001 From: Sergey Shevelev Date: Tue, 22 Dec 2020 13:58:55 -0500 Subject: [PATCH 193/258] Fix examples for http probe headers --- ...igure-liveness-readiness-startup-probes.md | 24 ++++++++++++------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md b/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md index 5896ab8357..42e2e3d468 100644 --- a/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md +++ b/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md @@ -389,24 +389,32 @@ You can override the default headers by defining `.httpHeaders` for the probe; f ```yaml livenessProbe: - httpHeaders: - Accept: application/json + httpGet: + httpHeaders: + - name: Accept + value: application/json startupProbe: - httpHeaders: - User-Agent: MyUserAgent + httpGet: + httpHeaders: + - name: User-Agent + value: MyUserAgent ``` You can also remove these two headers by defining them with an empty value. ```yaml livenessProbe: - httpHeaders: - Accept: "" + httpGet: + httpHeaders: + - name: Accept + value: "" startupProbe: - httpHeaders: - User-Agent: "" + httpGet: + httpHeaders: + - name: User-Agent + value: "" ``` ### TCP probes From 75f42c42f2b53a45e56db486484d5e6ddf0ec6b1 Mon Sep 17 00:00:00 2001 From: Umesh Date: Wed, 23 Dec 2020 04:28:27 +0900 Subject: [PATCH 194/258] removed duplicate step numbers (#24718) * corrected-steps * keeping content same * added missing line --- ...tainerd-Container-Runtime-Options-Kubernetes.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/content/en/blog/_posts/2017-11-00-Containerd-Container-Runtime-Options-Kubernetes.md b/content/en/blog/_posts/2017-11-00-Containerd-Container-Runtime-Options-Kubernetes.md index 3edf5625c2..2a105c6396 100644 --- a/content/en/blog/_posts/2017-11-00-Containerd-Container-Runtime-Options-Kubernetes.md +++ b/content/en/blog/_posts/2017-11-00-Containerd-Container-Runtime-Options-Kubernetes.md @@ -56,13 +56,13 @@ Cri-containerd uses containerd to manage the full container lifecycle and all co Let’s use an example to demonstrate how cri-containerd works for the case when Kubelet creates a single-container pod: -1. 1.Kubelet calls cri-containerd, via the CRI runtime service API, to create a pod; -2. 2.cri-containerd uses containerd to create and start a special [pause container](https://www.ianlewis.org/en/almighty-pause-container) (the _sandbox container_) and put that container inside the pod’s cgroups and namespace (steps omitted for brevity); -3. 3.cri-containerd configures the pod’s network namespace using CNI; -4. 4.Kubelet subsequently calls cri-containerd, via the CRI image service API, to pull the application container image; -5. 5.cri-containerd further uses containerd to pull the image if the image is not present on the node; -6. 6.Kubelet then calls cri-containerd, via the CRI runtime service API, to create and start the application container inside the pod using the pulled container image; -7. 7.cri-containerd finally calls containerd to create the application container, put it inside the pod’s cgroups and namespace, then to start the pod’s new application container. +1. Kubelet calls cri-containerd, via the CRI runtime service API, to create a pod; +2. cri-containerd uses containerd to create and start a special [pause container](https://www.ianlewis.org/en/almighty-pause-container) (the _sandbox container_) and put that container inside the pod’s cgroups and namespace (steps omitted for brevity); +3. cri-containerd configures the pod’s network namespace using CNI; +4. Kubelet subsequently calls cri-containerd, via the CRI image service API, to pull the application container image; +5. cri-containerd further uses containerd to pull the image if the image is not present on the node; +6. Kubelet then calls cri-containerd, via the CRI runtime service API, to create and start the application container inside the pod using the pulled container image; +7. cri-containerd finally calls containerd to create the application container, put it inside the pod’s cgroups and namespace, then to start the pod’s new application container. After these steps, a pod and its corresponding application container is created and running. From 5d2a72b8076ae78df7c827c7c4f4a00ce6fbdadb Mon Sep 17 00:00:00 2001 From: Arhell Date: Wed, 23 Dec 2020 01:43:32 +0200 Subject: [PATCH 195/258] update http to https --- README-es.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README-es.md b/README-es.md index cc4a6cefa0..f5b1e870dd 100644 --- a/README-es.md +++ b/README-es.md @@ -17,9 +17,9 @@ Los revisores harán todo lo posible para proporcionar toda la información nece Para obtener más información sobre cómo contribuir a la documentación de Kubernetes, puede consultar: * [Empezando a contribuir](https://kubernetes.io/docs/contribute/start/) -* [Visualizando sus cambios en su entorno local](http://kubernetes.io/docs/contribute/intermediate#view-your-changes-locally) -* [Utilizando las plantillas de las páginas](http://kubernetes.io/docs/contribute/style/page-content-types/) -* [Guía de estilo de la documentación](http://kubernetes.io/docs/contribute/style/style-guide/) +* [Visualizando sus cambios en su entorno local](https://kubernetes.io/docs/contribute/intermediate#view-your-changes-locally) +* [Utilizando las plantillas de las páginas](https://kubernetes.io/docs/contribute/style/page-content-types/) +* [Guía de estilo de la documentación](https://kubernetes.io/docs/contribute/style/style-guide/) * [Traduciendo la documentación de Kubernetes](https://kubernetes.io/docs/contribute/localization/) ## Levantando el sitio web kubernetes.io en su entorno local con Docker From ab4b004d6930cfaa3041b9fe9d9ced58904c9c79 Mon Sep 17 00:00:00 2001 From: Tim Bannister Date: Tue, 22 Dec 2020 23:57:16 +0000 Subject: [PATCH 196/258] Switch to Hugo v0.79.1 The improvements include: - timezone-aware date formatting - if getJSON() errors during a build, we can now ignore it - You can set Hugo configuration via environment variables even if snake_case. --- netlify.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/netlify.toml b/netlify.toml index db0604fad3..da51edfc94 100644 --- a/netlify.toml +++ b/netlify.toml @@ -7,7 +7,7 @@ functions = "functions" command = "git submodule update --init --recursive --depth 1 && make non-production-build" [build.environment] -HUGO_VERSION = "0.74.3" +HUGO_VERSION = "0.79.1" NODE_VERSION = "10.20.0" RUBY_VERSION = "2.7.1" From b537556b2df43048b0a0b4552f04e55d2a986819 Mon Sep 17 00:00:00 2001 From: Johnny Lim Date: Wed, 23 Dec 2020 15:21:12 +0900 Subject: [PATCH 197/258] Fix typo --- content/en/docs/concepts/configuration/configmap.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/configuration/configmap.md b/content/en/docs/concepts/configuration/configmap.md index d9889604ce..9a134dfc99 100644 --- a/content/en/docs/concepts/configuration/configmap.md +++ b/content/en/docs/concepts/configuration/configmap.md @@ -40,7 +40,7 @@ separate database or file service. A ConfigMap is an API [object](/docs/concepts/overview/working-with-objects/kubernetes-objects/) that lets you store configuration for other objects to use. Unlike most Kubernetes objects that have a `spec`, a ConfigMap has `data` and `binaryData` -fields. These fields accepts key-value pairs as their values. Both the `data` +fields. These fields accept key-value pairs as their values. Both the `data` field and the `binaryData` are optional. The `data` field is designed to contain UTF-8 byte sequences while the `binaryData` field is designed to contain binary data. From fe8b7a2d7a78326a613502c975506d50b2dc9e97 Mon Sep 17 00:00:00 2001 From: Weiping Cai Date: Wed, 23 Dec 2020 15:24:27 +0800 Subject: [PATCH 198/258] support reserved pid for kube and system Signed-off-by: Weiping Cai --- .../en/docs/reference/command-line-tools-reference/kubelet.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/reference/command-line-tools-reference/kubelet.md b/content/en/docs/reference/command-line-tools-reference/kubelet.md index 501a62fb9c..7d77159b65 100644 --- a/content/en/docs/reference/command-line-tools-reference/kubelet.md +++ b/content/en/docs/reference/command-line-tools-reference/kubelet.md @@ -778,7 +778,7 @@ WindowsEndpointSliceProxying=true|false (ALPHA - default=false)

 - + @@ -1282,7 +1282,7 @@ WindowsEndpointSliceProxying=true|false (ALPHA - default=false)
 - + From 89b3cc978b006a633901a442a4860f3aace14789 Mon Sep 17 00:00:00 2001 From: lostsquirrel Date: Wed, 23 Dec 2020 16:48:01 +0800 Subject: [PATCH 199/258] change token_id to token-id --- content/en/docs/concepts/configuration/secret.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/configuration/secret.md b/content/en/docs/concepts/configuration/secret.md index aa50bc6df5..3674c3ce4c 100644 --- a/content/en/docs/concepts/configuration/secret.md +++ b/content/en/docs/concepts/configuration/secret.md @@ -358,7 +358,7 @@ data: A bootstrap type Secret has the following keys specified under `data`: -- `token_id`: A random 6 character string as the token identifier. Required. +- `token-id`: A random 6 character string as the token identifier. Required. - `token-secret`: A random 16 character string as the actual token secret. Required. - `description`: A human-readable string that describes what the token is used for. Optional. From 64594a4c605d1f9f7babc333c565af21c4b788e7 Mon Sep 17 00:00:00 2001 From: Dan Roscigno Date: Wed, 23 Dec 2020 09:22:27 -0500 Subject: [PATCH 200/258] Correct camelcase of DaemonSet --- content/en/docs/contribute/style/style-guide.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/contribute/style/style-guide.md b/content/en/docs/contribute/style/style-guide.md index c0efac7959..b4864dbabf 100644 --- a/content/en/docs/contribute/style/style-guide.md +++ b/content/en/docs/contribute/style/style-guide.md @@ -143,7 +143,7 @@ Do | Don't :--| :----- Set the value of the `replicas` field in the configuration file. | Set the value of the "replicas" field in the configuration file. The value of the `exec` field is an ExecAction object. | The value of the "exec" field is an ExecAction object. -Run the process as a Daemonset in the `kube-system` namespace. | Run the process as a Daemonset in the kube-system namespace. +Run the process as a DaemonSet in the `kube-system` namespace. | Run the process as a DaemonSet in the kube-system namespace. {{< /table >}} ### Use code style for Kubernetes command tool and component names From 8fcb55007b2a32cd11cfe0c1cb17d55a76cd733c Mon Sep 17 00:00:00 2001 From: Sam Culley Date: Wed, 23 Dec 2020 20:40:32 +0000 Subject: [PATCH 201/258] moved drain the node step to after call kubeadm upgrade step for worker nodes --- .../kubeadm/kubeadm-upgrade.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md index 0164d5aea1..5af9d27b82 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md @@ -231,6 +231,14 @@ without compromising the minimum required capacity for running your workloads. {{% /tab %}} {{< /tabs >}} +### Call "kubeadm upgrade" + +- For worker nodes this upgrades the local kubelet configuration: + + ```shell + sudo kubeadm upgrade node + ``` + ### Drain the node - Prepare the node for maintenance by marking it unschedulable and evicting the workloads: @@ -240,14 +248,6 @@ without compromising the minimum required capacity for running your workloads. kubectl drain --ignore-daemonsets ``` -### Call "kubeadm upgrade" - -- For worker nodes this upgrades the local kubelet configuration: - - ```shell - sudo kubeadm upgrade node - ``` - ### Upgrade kubelet and kubectl - Upgrade the kubelet and kubectl: From 378292786e00c8162b27b3fe184a385e14867150 Mon Sep 17 00:00:00 2001 From: Arhell Date: Thu, 24 Dec 2020 00:50:53 +0200 Subject: [PATCH 202/258] [zh] sync style-guide.md --- content/zh/docs/contribute/style/style-guide.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/contribute/style/style-guide.md b/content/zh/docs/contribute/style/style-guide.md index f03833cfaa..eefeb1d3c6 100644 --- a/content/zh/docs/contribute/style/style-guide.md +++ b/content/zh/docs/contribute/style/style-guide.md @@ -286,7 +286,7 @@ Do | Don't :--| :----- Set the value of the `replicas` field in the configuration file. | Set the value of the "replicas" field in the configuration file. The value of the `exec` field is an ExecAction object. | The value of the "exec" field is an ExecAction object. -Run the process as a Daemonset in the `kube-system` namespace. | Run the process as a Daemonset in the kube-system namespace. +Run the process as a DaemonSet in the `kube-system` namespace. | Run the process as a DaemonSet in the kube-system namespace. {{< /table >}} --> ### 为对象字段名和名字空间使用代码风格 @@ -296,7 +296,7 @@ Run the process as a Daemonset in the `kube-system` namespace. | Run the process :--| :----- 在配置文件中设置 `replicas` 字段的值。 | 在配置文件中设置 "replicas" 字段的值。 `exec` 字段的值是一个 ExecAction 对象。 | "exec" 字段的值是一个 ExecAction 对象。 -在 `kube-system` 名字空间中以 Daemonset 形式运行此进程。 | 在 kube-system 名字空间中以 DaemonSet 形式运行此进程。 +在 `kube-system` 名字空间中以 DaemonSet 形式运行此进程。 | 在 kube-system 名字空间中以 DaemonSet 形式运行此进程。 {{< /table >}} -用户使用 `kubectl`、客户端库或构造 REST 请求访问来 [Kubernetes API](/zh/docs/concepts/overview/kubernetes-api/)。 +用户使用 `kubectl`、客户端库或构造 REST 请求来访问 [Kubernetes API](/zh/docs/concepts/overview/kubernetes-api/)。 人类用户和 [Kubernetes 服务账户](/zh/docs/tasks/configure-pod-container/configure-service-account/)都可以被鉴权访问 API。 当请求到达 API 时，它会经历多个阶段，如下图所示： From 9e876d557d256c0f1e98b46e094ce9e4f004723e Mon Sep 17 00:00:00 2001 From: yuandongx Date: Fri, 18 Dec 2020 10:04:54 +0000 Subject: [PATCH 206/258] update content/zh/docs/reference/kubectl/kubectl.md --- content/zh/docs/reference/kubectl/kubectl.md | 49 +++++++++++++------- 1 file changed, 31 insertions(+), 18 deletions(-) diff --git a/content/zh/docs/reference/kubectl/kubectl.md b/content/zh/docs/reference/kubectl/kubectl.md index 5fcf0780ef..f6656feccc 100644 --- a/content/zh/docs/reference/kubectl/kubectl.md +++ b/content/zh/docs/reference/kubectl/kubectl.md @@ -44,9 +44,9 @@ kubectl [flags] @@ -94,14 +94,14 @@ kubectl [flags] - + @@ -137,15 +137,24 @@ kubectl [flags] TLS 使用的客户端密钥文件路径 + + + + + + @@ -312,6 +321,15 @@ kubectl [flags] --> 如果存在，CLI 请求将使用此命名空间 + + + + + + @@ -476,7 +494,6 @@ kubectl [flags] ## {{% heading "seealso" %}} - * [kubectl convert](/docs/reference/generated/kubectl/kubectl-commands#convert) - 在不同的 API 版本之间转换配置文件 * [kubectl cordon](/docs/reference/generated/kubectl/kubectl-commands#cordon) - 标记节点为不可调度的 -* [kubectl cp](/docs/reference/generated/kubectl/kubectl-commands#cp) - 将文件和目录拷入/拷出容器。 +* [kubectl cp](/docs/reference/generated/kubectl/kubectl-commands#cp) - 将文件和目录拷入/拷出容器 * [kubectl create](/docs/reference/generated/kubectl/kubectl-commands#create) - 通过文件或标准输入来创建资源 +* [kubectl debug](/docs/reference/generated/kubectl/kubectl-commands#debug) - 创建用于排查工作负载和节点故障的调试会话 * [kubectl delete](/docs/reference/generated/kubectl/kubectl-commands#delete) - 通过文件名、标准输入、资源和名字删除资源，或者通过资源和标签选择器来删除资源 - * [kubectl get](/docs/reference/generated/kubectl/kubectl-commands#get) - 显示一个或者多个资源信息 * [kubectl kustomize](/docs/reference/generated/kubectl/kubectl-commands#kustomize) - 从目录或远程 URL 中构建 kustomization @@ -549,7 +564,6 @@ kubectl [flags] * [kubectl logs](/docs/reference/generated/kubectl/kubectl-commands#logs) - 输出 pod 中某容器的日志 * [kubectl options](/docs/reference/generated/kubectl/kubectl-commands#options) - 打印所有命令都支持的共有参数列表 * [kubectl patch](/docs/reference/generated/kubectl/kubectl-commands#patch) - 基于策略性合并修补（Stategic Merge Patch）规则更新某资源中的字段 - -* [kubectl scale](/docs/reference/generated/kubectl/kubectl-commands#scale) - 为一个 Deployment、ReplicaSet、ReplicationController 或 Job 设置一个新的规模尺寸值 +* [kubectl scale](/docs/reference/generated/kubectl/kubectl-commands#scale) - 为一个 Deployment、ReplicaSet 或 ReplicationController 设置一个新的规模尺寸值 * [kubectl set](/docs/reference/generated/kubectl/kubectl-commands#set) - 为对象设置功能特性 * [kubectl taint](/docs/reference/generated/kubectl/kubectl-commands#taint) - 在一个或者多个节点上更新污点配置 * [kubectl top](/docs/reference/generated/kubectl/kubectl-commands#top) - 显示资源（CPU /内存/存储）使用率 From 182963af87b6550908b7fc040e72f2358ab39f34 Mon Sep 17 00:00:00 2001 From: howieyuen Date: Thu, 24 Dec 2020 18:56:30 +0800 Subject: [PATCH 207/258] Add basic cron syntax in documentation sync from https://github.com/kubernetes/website/pull/25078 --- .../workloads/controllers/cron-jobs.md | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/content/zh/docs/concepts/workloads/controllers/cron-jobs.md b/content/zh/docs/concepts/workloads/controllers/cron-jobs.md index 11e9752bac..153934afac 100644 --- a/content/zh/docs/concepts/workloads/controllers/cron-jobs.md +++ b/content/zh/docs/concepts/workloads/controllers/cron-jobs.md @@ -85,6 +85,54 @@ This example CronJob manifest prints the current time and a hello message every [使用 CronJob 运行自动化任务](/zh/docs/tasks/job/automated-tasks-with-cron-jobs/) 一文会为你详细讲解此例。 + +### Cron 时间表语法 + +``` +# ┌───────────── 分钟 (0 - 59) +# │ ┌───────────── 小时 (0 - 23) +# │ │ ┌───────────── 月的某天 (1 - 31) +# │ │ │ ┌───────────── 月份 (1 - 12) +# │ │ │ │ ┌───────────── 周的某天 (0 - 6) （周日到周一；在某些系统上，7 也是星期日） +# │ │ │ │ │ +# │ │ │ │ │ +# │ │ │ │ │ +# * * * * * +``` + + + +| 输入 | 描述 | 相当于 | +| ------------- | ------------- |------------- | +| @yearly (or @annually) | 每年 1 月 1 日的午夜运行一次 | 0 0 1 1 * | +| @monthly | 每月第一天的午夜运行一次 | 0 0 1 * * | +| @weekly | 每周的周日午夜运行一次 | 0 0 * * 0 | +| @daily (or @midnight) | 每天午夜运行一次 | 0 0 * * * | +| @hourly | 每小时的开始一次 | 0 * * * * | + + + +例如，下面这行指出必须在每个星期五的午夜以及每个月 13 号的午夜开始任务： + +`0 0 13 * 5` + + +要生成 CronJob 时间表表达式，你还可以使用 [crontab.guru](https://crontab.guru/) 之类的 Web 工具。 + -这种差异有其优点和缺点。在这里，我们将讨论一些有趣的区别，并且基于 VM 的方法和非 VM 方法的好处。第一个因素是跨平台的移植性。虽然 Minikube VM 可以跨操作系统移植——它不仅支持 Linux，还支持 Windows、macOS、甚至 FreeBSD，但 Microk9s 需要 Linux，而且只在[那些支持 snaps](https://snapcraft.io/docs/installing-snapd) 的发行版上。支持大多数流行的 Linux 发行版。 +这种差异有其优点和缺点。在这里，我们将讨论一些有趣的区别，并且基于 VM 的方法和非 VM 方法的好处。第一个因素是跨平台的移植性。虽然 Minikube VM 可以跨操作系统移植——它不仅支持 Linux，还支持 Windows、macOS、甚至 FreeBSD，但 Microk8s 需要 Linux，而且只在[那些支持 snaps](https://snapcraft.io/docs/installing-snapd) 的发行版上。支持大多数流行的 Linux 发行版。 -另一个考虑到的因素是资源消耗。虽然 VM 设备为您提供了更好的可移植性，但它确实意味着您将消耗更多资源来运行 VM，这主要是因为 VM 提供了一个完整的操作系统，并且运行在管理程序之上。当 VM 处于休眠时你将消耗更多的磁盘空间。当它运行时，你将会消耗更多的 RAM 和 CPU。因为 MIcrok8s 不需要创建虚拟机，你将会有更多的资源去运行你的工作负载和其他设备。考虑到所占用的空间更小，MIcroK8s 是物联网设备的理想选择-你甚至可以在 Paspberry Pi 和设备上使用它！ +另一个考虑到的因素是资源消耗。虽然 VM 设备为您提供了更好的可移植性，但它确实意味着您将消耗更多资源来运行 VM，这主要是因为 VM 提供了一个完整的操作系统，并且运行在管理程序之上。当 VM 处于休眠时你将消耗更多的磁盘空间。当它运行时，你将会消耗更多的 RAM 和 CPU。因为 Microk8s 不需要创建虚拟机，你将会有更多的资源去运行你的工作负载和其他设备。考虑到所占用的空间更小，MicroK8s 是物联网设备的理想选择-你甚至可以在 Paspberry Pi 和设备上使用它！ @@ -119,7 +119,7 @@ One of the biggest benefits of using Microk8s is the fact that it also supports The full list of extensions can be checked by running the `microk8s.status` command: --> ## MicroK8s 插件 -使用 MIcroK8s 其中最大的好处之一事实上是也支持各种各样的插件和扩展。更重要的是它们是开箱即用的，用户仅仅需要启动它们。通过运行 `microk8s.status` 命令检查出扩展的完整列表。 +使用 MicroK8s 其中最大的好处之一事实上是也支持各种各样的插件和扩展。更重要的是它们是开箱即用的，用户仅仅需要启动它们。通过运行 `microk8s.status` 命令检查出扩展的完整列表。 ``` sudo microk8s.status ``` From 75c231d1928506ec2a87721beafc941ada55e8ba Mon Sep 17 00:00:00 2001 From: Arhell Date: Sat, 26 Dec 2020 05:24:37 +0200 Subject: [PATCH 211/258] [zh] sync configmap.md --- content/zh/docs/concepts/configuration/configmap.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/zh/docs/concepts/configuration/configmap.md b/content/zh/docs/concepts/configuration/configmap.md index a9240bff7f..1fe9f0c2bf 100644 --- a/content/zh/docs/concepts/configuration/configmap.md +++ b/content/zh/docs/concepts/configuration/configmap.md @@ -49,7 +49,7 @@ debug the exact same code locally if needed. @@ -63,7 +63,7 @@ ConfigMap 在设计上不是用来保存大量数据的。在 ConfigMap 中保 A ConfigMap is an API [object](/docs/concepts/overview/working-with-objects/kubernetes-objects/) that lets you store configuration for other objects to use. Unlike most Kubernetes objects that have a `spec`, a ConfigMap has `data` and `binaryData` -fields. These fields accepts key-value pairs as their values. Both the `data` +fields. These fields accept key-value pairs as their values. Both the `data` field and the `binaryData` are optional. The `data` field is designed to contain UTF-8 byte sequences while the `binaryData` field is designed to contain binary data. @@ -141,7 +141,7 @@ data: There are four different ways that you can use a ConfigMap to configure a container inside a Pod: -1. Command line arguments to the entrypoint of a container +1. Inside a container command and args 1. Environment variables for a container 1. Add a file in read-only volume, for the application to read 1. Write code to run inside the Pod that uses the Kubernetes API to read a ConfigMap @@ -154,7 +154,7 @@ the ConfigMap when it launches container(s) for a Pod. --> 你可以使用四种方式来使用 ConfigMap 配置 Pod 中的容器： -1. 容器 entrypoint 的命令行参数 +1. 在容器命令和参数内 1. 容器的环境变量 1. 在只读卷里面添加一个文件，让应用来读取 1. 编写代码在 Pod 中运行，使用 Kubernetes API 来读取 ConfigMap From 7add440eeb0010e1f0b07d0b7f8546580c241f0b Mon Sep 17 00:00:00 2001 From: Ader Date: Sat, 26 Dec 2020 11:40:21 +0800 Subject: [PATCH 212/258] install-kubeadm.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Uniform case and adjustment description for smoother writing.(Kubelet → kubelet) --- .../tools/kubeadm/install-kubeadm.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index fc93d46cd2..8ff56de29f 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -26,9 +26,9 @@ For information how to create a cluster with kubeadm once you have performed thi - Fedora 25+ - HypriotOS v1.0.1+ - Flatcar Container Linux (tested with 2512.3.0) -* 2 GB or more of RAM per machine (any less will leave little room for your apps) -* 2 CPUs or more -* Full network connectivity between all machines in the cluster (public or private network is fine) +* 2 GB or more of RAM per machine (any less will leave little room for your apps). +* 2 CPUs or more. +* Full network connectivity between all machines in the cluster (public or private network is fine). * Unique hostname, MAC address, and product_uuid for every node. See [here](#verify-mac-address) for more details. * Certain ports are open on your machines. See [here](#check-required-ports) for more details. * Swap disabled. You **MUST** disable swap in order for the kubelet to work properly. @@ -76,7 +76,7 @@ For more details please see the [Network Plugin Requirements](/docs/concepts/ext |----------|-----------|------------|-------------------------|---------------------------| | TCP | Inbound | 6443* | Kubernetes API server | All | | TCP | Inbound | 2379-2380 | etcd server client API | kube-apiserver, etcd | -| TCP | Inbound | 10250 | Kubelet API | Self, Control plane | +| TCP | Inbound | 10250 | kubelet API | Self, Control plane | | TCP | Inbound | 10251 | kube-scheduler | Self | | TCP | Inbound | 10252 | kube-controller-manager | Self | @@ -84,7 +84,7 @@ For more details please see the [Network Plugin Requirements](/docs/concepts/ext | Protocol | Direction | Port Range | Purpose | Used By | |----------|-----------|-------------|-----------------------|-------------------------| -| TCP | Inbound | 10250 | Kubelet API | Self, Control plane | +| TCP | Inbound | 10250 | kubelet API | Self, Control plane | | TCP | Inbound | 30000-32767 | NodePort Services† | All | † Default port range for [NodePort Services](/docs/concepts/services-networking/service/). @@ -160,7 +160,7 @@ need to ensure they match the version of the Kubernetes control plane you want kubeadm to install for you. If you do not, there is a risk of a version skew occurring that can lead to unexpected, buggy behaviour. However, _one_ minor version skew between the kubelet and the control plane is supported, but the kubelet version may never exceed the API -server version. For example, kubelets running 1.7.0 should be fully compatible with a 1.8.0 API server, +server version. For example, the kubelet running 1.7.0 should be fully compatible with a 1.8.0 API server, but not vice versa. For information about installing `kubectl`, see [Install and set up kubectl](/docs/tasks/tools/install-kubectl/). @@ -299,7 +299,7 @@ Please mind, that you **only** have to do that if the cgroup driver of your CRI is not `cgroupfs`, because that is the default value in the kubelet already. {{< note >}} -Since `--cgroup-driver` flag has been deprecated by kubelet, if you have that in `/var/lib/kubelet/kubeadm-flags.env` +Since `--cgroup-driver` flag has been deprecated by the kubelet, if you have that in `/var/lib/kubelet/kubeadm-flags.env` or `/etc/default/kubelet`(`/etc/sysconfig/kubelet` for RPMs), please remove it and use the KubeletConfiguration instead (stored in `/var/lib/kubelet/config.yaml` by default). {{< /note >}} From 9a0fc83075a836f167a1b98e2bb145b74641c88d Mon Sep 17 00:00:00 2001 From: jornshen Date: Wed, 23 Dec 2020 10:27:20 +0800 Subject: [PATCH 213/258] sync zh dual-stack.md --- .../services-networking/dual-stack.md | 336 +++++++++++++++--- .../networking/dual-stack-default-svc.yaml | 3 +- .../dual-stack-preferred-ipfamilies-svc.yaml | 16 + .../networking/dual-stack-preferred-svc.yaml | 13 + 4 files changed, 319 insertions(+), 49 deletions(-) create mode 100644 content/zh/examples/service/networking/dual-stack-preferred-ipfamilies-svc.yaml create mode 100644 content/zh/examples/service/networking/dual-stack-preferred-svc.yaml diff --git a/content/zh/docs/concepts/services-networking/dual-stack.md b/content/zh/docs/concepts/services-networking/dual-stack.md index c0c4402813..4c44d75016 100644 --- a/content/zh/docs/concepts/services-networking/dual-stack.md +++ b/content/zh/docs/concepts/services-networking/dual-stack.md @@ -49,11 +49,11 @@ Enabling IPv4/IPv6 dual-stack on your Kubernetes cluster provides the following * 双协议栈 pod 网络 (每个 pod 分配一个 IPv4 和 IPv6 地址) - * IPv4 和 IPv6 启用的服务 (每个服务必须是一个单独的地址族) + * IPv4 和 IPv6 启用的服务 * Pod 的集群外出口通过 IPv4 和 IPv6 路由 - * Kubernetes 1.16 版本及更高版本 + * Kubernetes 1.20 版本及更高版本，有关更早 Kubernetes 版本的使用双栈服务的信息，请参考那个版本的 Kubernetes 文档。 * 提供商支持双协议栈网络（云提供商或其他提供商必须能够为 Kubernetes 节点提供可路由的 IPv4/IPv6 网络接口） * 支持双协议栈的网络插件（如 Kubenet 或 Calico） @@ -101,63 +104,296 @@ To enable IPv4/IPv6 dual-stack, enable the `IPv6DualStack` [feature gate](/docs/ * `--cluster-cidr=,` * `--feature-gates="IPv6DualStack=true"` + +{{< note >}} + +IPv4 CIDR 的一个例子：`10.244.0.0/16`（尽管你会提供你自己的地址范围） + +IPv6 CIDR 的一个例子：`fdXY:IJKL:MNOP:15::/64`（这里演示的是格式而非有效地址 - 请看 [RFC 4193](https://tools.ietf.org/html/rfc4193)） + +{{< /note >}} + ## 服务 如果你的集群启用了 IPv4/IPv6 双协议栈网络，则可以使用 IPv4 或 IPv6 地址来创建 {{< glossary_tooltip text="Service" term_id="service" >}}。 -你可以通过设置服务的 `.spec.ipFamily` 字段来选择服务的集群 IP 的地址族。 -你只能在创建新服务时设置该字段。`.spec.ipFamily` 字段的设置是可选的， -并且仅当你计划在集群上启用 IPv4 和 IPv6 的 {{< glossary_tooltip text="Service" term_id="service" >}} -和 {{< glossary_tooltip text="Ingress" term_id="ingress" >}}。 -对于[出口](#出口流量)流量，该字段的配置不是必须的。 +服务的地址族默认为第一个服务集群 IP 范围的地址族（通过 kube-controller-manager 的 `--service-cluster-ip-range` 参数配置） +当你定义服务时，可以选择将其配置为双栈。若要指定所需的行为，你可以设置 `.spec.ipFamilyPolicy` 字段为以下值之一： + +* `SingleStack`：单栈服务。控制面使用第一个配置的服务集群 IP 范围为服务分配集群 IP。 +* `PreferDualStack`： + * 仅当集群启用了双栈时使用。为服务分配 IPv4 和 IPv6 集群 IP。 + * 如果集群没有启用双堆栈，则此设置与 `SingleStack` 行为相同。 +* `RequireDualStack`：从 IPv4 和 IPv6 的地址范围分配服务的 `.spec.ClusterIPs` + * 从基于在 `.spec.ipFamilies` 数组中第一个元素的地址族的 `.spec.ClusterIPs` 列表中选择 `.spec.ClusterIP` + * 集群必须配置双栈网络 + + +如果你想要定义哪个 IP 族用于单栈或定义双栈 IP 族的顺序，可以通过设置服务上的可选字段 `.spec.ipFamilies` 来选择地址族。 + + {{< note >}} -集群的默认地址族是第一个服务集群 IP 范围的地址族，该地址范围通过 -`kube-controller-manager` 上的 `--service-cluster-ip-range` 标志设置。 +`.spec.ipFamilies` 字段是不可变的，因为系统无法为已经存在的服务重新分配 `.spec.ClusterIP`。 +如果你想改变 `.spec.ipFamilies`，则需要删除并重新创建服务。 {{< /note >}} -你可以设置 `.spec.ipFamily` 为： +你可以设置 `.spec.ipFamily` 为以下任何数组值： - * `IPv4`：API 服务器将从 `service-cluster-ip-range` 中分配 `ipv4` 地址 - * `IPv6`：API 服务器将从 `service-cluster-ip-range` 中分配 `ipv6` 地址 +- `["IPv4"]` +- `["IPv6"]` +- `["IPv4","IPv6"]` （双栈） +- `["IPv6","IPv4"]` （双栈） -以下服务规约不包含 `ipFamily` 字段。Kubernetes 将从最初配置的 `service-cluster-ip-range` 范围内分配一个 IP 地址（也称作“集群 IP”）给该服务。 -{{< codenew file="service/networking/dual-stack-default-svc.yaml" >}} +你所列出的第一个地址族用于原来的 `.spec.ClusterIP` 字段。 -以下服务规约包含 `ipFamily` 字段。Kubernetes 将从已配置的 `service-cluster-ip-range` 范围内分配一个 IPv6 地址（也称作“集群 IP”）给该服务。 +### Dual-stack Service configuration scenarios -{{< codenew file="service/networking/dual-stack-ipv6-svc.yaml" >}} +These examples demonstrate the behavior of various dual-stack Service configuration scenarios. +--> + +### 双栈服务配置场景 + +以下示例演示多种双栈服务配置场景下的行为。 -为了进行比较，将从已配置的 `service-cluster-ip-range` 向该服务分配以下 IPV4 地址（也称为“集群 IP”）。 +#### 新服务的双栈选项 -{{< codenew file="service/networking/dual-stack-ipv4-svc.yaml" >}} + + +1. 此服务规约中没有显式设定 `.spec.ipFamilyPolicy`。当你创建此服务时，Kubernetes + 从所配置的第一个 `service-cluster-ip-range` 种为服务分配一个集群IP，并设置 + `.spec.ipFamilyPolicy` 为 `SingleStack`。 + （[无选择算符的服务](/zh/docs/concepts/services-networking/service/#services-without-selectors)和 + [无头服务](/zh/docs/concepts/services-networking/service/#headless-services)的行为方式 + 与此相同。） + + {{< codenew file="service/networking/dual-stack-default-svc.yaml" >}} + + +2. 此服务规约显式地将 `.spec.ipFamilyPolicy` 设置为 `PreferDualStack`。 + 当你在双栈集群上创建此服务时，Kubernetes 会为该服务分配 IPv4 和 IPv6 地址。 + 控制平面更新服务的 `.spec` 以记录 IP 地址分配。 + 字段 `.spec.ClusterIPs` 是主要字段，包含两个分配的 IP 地址；`.spec.ClusterIP` 是次要字段， + 其取值从 `.spec.ClusterIPs` 计算而来。 + + {{< codenew file="service/networking/dual-stack-preferred-svc.yaml" >}} + + +3. 下面的服务规约显式地在 `.spec.ipFamilies` 中指定 `IPv6` 和 `IPv4`，并 + 将 `.spec.ipFamilyPolicy` 设定为 `PreferDualStack`。 + 当 Kubernetes 为 `.spec.ClusterIPs` 分配一个 IPv6 和一个 IPv4 地址时， + `.spec.ClusterIP` 被设置成 IPv6 地址，因为它是 `.spec.ClusterIPs` 数组中的第一个元素， + 覆盖其默认值。 + + {{< codenew file="service/networking/dual-stack-preferred-ipfamilies-svc.yaml" >}} + + +#### 现有服务的双栈默认值 + + +下面示例演示了在服务已经存在的集群上新启用双栈时的默认行为。 + + +1. 在集群上启用双栈时，控制面会将现有服务（无论是 `IPv4` 还是 `IPv6`）配置 `.spec.ipFamilyPolicy` + 设置为 `SingleStack` 并设置 `.spec.ipFamilies` 为服务的当前地址族。 + + {{< codenew file="service/networking/dual-stack-default-svc.yaml" >}} + + + 你可以通过使用 kubectl 检查现有服务来验证此行为。 + + ```shell + kubectl get svc my-service -o yaml + ``` + + ```yaml + apiVersion: v1 + kind: Service + metadata: + labels: + app: MyApp + name: my-service + spec: + clusterIP: 10.0.197.123 + clusterIPs: + - 10.0.197.123 + ipFamilies: + - IPv4 + ipFamilyPolicy: SingleStack + ports: + - port: 80 + protocol: TCP + targetPort: 80 + selector: + app: MyApp + type: ClusterIP + status: + loadBalancer: {} + ``` + + +2. 在集群上启用双栈时，带有选择算符的现有 + [无头服务](/zh/docs/concepts/services-networking/service/#headless-services) + 由控制面设置 `.spec.ipFamilyPolicy` 为 `SingleStack` + 并设置 `.spec.ipFamilies` 为第一个服务群集 IP 范围的地址族（通过配置 kube-controller-manager 的 + `--service-cluster-ip-range` 参数），即使 `.spec.ClusterIP` 的设置值为 `None` 也如此。 + + {{< codenew file="service/networking/dual-stack-default-svc.yaml" >}} + + + 你可以通过使用 kubectl 检查带有选择算符的现有无头服务来验证此行为。 + + ```shell + kubectl get svc my-service -o yaml + ``` + + ```yaml + apiVersion: v1 + kind: Service + metadata: + labels: + app: MyApp + name: my-service + spec: + clusterIP: None + clusterIPs: + - None + ipFamilies: + - IPv4 + ipFamilyPolicy: SingleStack + ports: + - port: 80 + protocol: TCP + targetPort: 80 + selector: + app: MyApp + ``` + + +#### 在单栈和双栈之间切换服务 + + +服务可以从单栈更改为双栈，也可以从双栈更改为单栈。 + + +1. 要将服务从单栈更改为双栈，根据需要将 `.spec.ipFamilyPolicy` 从 `SingleStack` 改为 + `PreferDualStack` 或 `RequireDualStack`。 + 当你将此服务从单栈更改为双栈时，Kubernetes 将分配缺失的地址族，以便现在该服务具有 IPv4 和 IPv6 地址。 + 编辑服务规约将 `.spec.ipFamilyPolicy` 从 `SingleStack` 改为 `PreferDualStack`。 + + + 之前： + ```yaml + spec: + ipFamilyPolicy: SingleStack + ``` + + 之后： + ```yaml + spec: + ipFamilyPolicy: PreferDualStack + ``` + + + +2. 要将服务从双栈更改为单栈，请将 `.spec.ipFamilyPolicy` 从 `PreferDualStack` 或 `RequireDualStack` + 改为 `SingleStack`。 + 当你将此服务从双栈更改为单栈时，Kubernetes 只保留 `.spec.ClusterIPs` 数组中的第一个元素，并设置 `.spec.ClusterIP` 为那个 IP 地址， + 并设置 `.spec.ipFamilies` 为 `.spec.ClusterIPs` 地址族。 + + +### 无选择算符的无头服务 + + +对于[不带选择算符的无头服务](/zh/docs/concepts/services-networking/service/#without-selectors)， +若没有显式设置 `.spec.ipFamilyPolicy`，则 `.spec.ipFamilyPolicy` 字段默认设置为 `RequireDualStack`。 -在支持启用了 IPv6 的外部服务均衡器的云驱动上，除了将 `ipFamily` 字段设置为 `IPv6`， -将 `type` 字段设置为 `LoadBalancer`，为你的服务提供云负载均衡。 + +要为你的服务提供双栈负载均衡器： + * 将 `.spec.type` 字段设置为 `LoadBalancer` + * 将 `.spec.ipFamilyPolicy` 字段设置为 `PreferDualStack` 或者 `RequireDualStack` + + +{{< note >}} +为了使用双栈的负载均衡器类型服务，你的云驱动必须支持 IPv4 和 IPv6 的负载均衡器。 +{{< /note >}} -## 出口流量 +## 出站流量 -可以使用可公共路由和非可公共路由的 IPv6 地址块，前提是下层的 -{{< glossary_tooltip text="CNI" term_id="cni" >}} 提供程序可以实现这种传输。 -如果你拥有使用非公共路由 IPv6 地址的 Pod，并且希望该 Pod 到达集群外目的 -（比如，公共网络），你必须为出口流量和任何响应消息设置 IP 伪装。 -[ip-masq-agent](https://github.com/kubernetes-sigs/ip-masq-agent) 可以感知双栈， -所以你可以在双栈集群中使用 ip-masq-agent 来进行 IP 伪装。 +如果你要启用出口流量，以便使用非公开路由 IPv6 地址的 Pod 到达集群外地址（例如公网），则需要通过透明代理或 IP 伪装等机制使 Pod 使用公共路由的 IPv6 地址。 +[ip-masq-agent](https://github.com/kubernetes-sigs/ip-masq-agent)项目支持在双栈集群上进行 IP 伪装。 -## 已知问题 - - -* Kubenet 强制 IPv4，IPv6 的 IPs 位置报告 (`--cluster-cidr`) +{{< note >}} +确认你的 {{< glossary_tooltip text="CNI" term_id="cni" >}} 驱动支持 IPv6。 +{{< /note >}} ## {{% heading "whatsnext" %}} diff --git a/content/zh/examples/service/networking/dual-stack-default-svc.yaml b/content/zh/examples/service/networking/dual-stack-default-svc.yaml index 00ed87ba19..86eadd5478 100644 --- a/content/zh/examples/service/networking/dual-stack-default-svc.yaml +++ b/content/zh/examples/service/networking/dual-stack-default-svc.yaml @@ -2,10 +2,11 @@ apiVersion: v1 kind: Service metadata: name: my-service + labels: + app: MyApp spec: selector: app: MyApp ports: - protocol: TCP port: 80 - targetPort: 9376 \ No newline at end of file diff --git a/content/zh/examples/service/networking/dual-stack-preferred-ipfamilies-svc.yaml b/content/zh/examples/service/networking/dual-stack-preferred-ipfamilies-svc.yaml new file mode 100644 index 0000000000..c31acfec58 --- /dev/null +++ b/content/zh/examples/service/networking/dual-stack-preferred-ipfamilies-svc.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: my-service + labels: + app: MyApp +spec: + ipFamilyPolicy: PreferDualStack + ipFamilies: + - IPv6 + - IPv4 + selector: + app: MyApp + ports: + - protocol: TCP + port: 80 diff --git a/content/zh/examples/service/networking/dual-stack-preferred-svc.yaml b/content/zh/examples/service/networking/dual-stack-preferred-svc.yaml new file mode 100644 index 0000000000..8fb5bfa3d3 --- /dev/null +++ b/content/zh/examples/service/networking/dual-stack-preferred-svc.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: my-service + labels: + app: MyApp +spec: + ipFamilyPolicy: PreferDualStack + selector: + app: MyApp + ports: + - protocol: TCP + port: 80 From 7a175d551a83521a64ee908ec9ec57e01f9f3979 Mon Sep 17 00:00:00 2001 From: Rajesh Jain <73859950+rjain21@users.noreply.github.com> Date: Sat, 26 Dec 2020 13:41:02 -0800 Subject: [PATCH 214/258] Update rbac.md The language "For all service accounts in the "qa" namespace" in the example is confusing namespaces and groups. Language fixed to disambiguate between group and namespace. An additional example provided which uses both the group ("dev") AND the namespace ("development") to further illustrate this point --- content/en/docs/reference/access-authn-authz/rbac.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/content/en/docs/reference/access-authn-authz/rbac.md b/content/en/docs/reference/access-authn-authz/rbac.md index 8ff03a171c..d3e6dc118e 100644 --- a/content/en/docs/reference/access-authn-authz/rbac.md +++ b/content/en/docs/reference/access-authn-authz/rbac.md @@ -514,7 +514,7 @@ subjects: namespace: kube-system ``` -For all service accounts in the "qa" namespace: +For all service accounts in the "qa" group in any namespace: ```yaml subjects: @@ -522,6 +522,15 @@ subjects: name: system:serviceaccounts:qa apiGroup: rbac.authorization.k8s.io ``` +For all service accounts in the "dev" group in the "development" namespace: + +```yaml +subjects: +- kind: Group + name: system:serviceaccounts:dev + apiGroup: rbac.authorization.k8s.io + namespace: development +``` For all service accounts in any namespace: From 83900902e06b8a3a2336929dad8e17be2674ba34 Mon Sep 17 00:00:00 2001 From: timyinshi Date: Sun, 27 Dec 2020 09:48:59 +0800 Subject: [PATCH 215/258] Put a space between Chinese and English and the number Signed-off-by: timyinshi --- .../2019-12-09-kubernetes-1.17-release-announcement.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/zh/blog/_posts/2019-12-09-kubernetes-1.17-release-announcement.md b/content/zh/blog/_posts/2019-12-09-kubernetes-1.17-release-announcement.md index 458dd31529..0fddf3dea4 100644 --- a/content/zh/blog/_posts/2019-12-09-kubernetes-1.17-release-announcement.md +++ b/content/zh/blog/_posts/2019-12-09-kubernetes-1.17-release-announcement.md @@ -28,7 +28,7 @@ We’re pleased to announce the delivery of Kubernetes 1.17, our fourth and fina -作为公开测试版特性添加到v1.2，v1.17中可以看到云提供商标签达到基本可用。 +作为公开测试版特性添加到 v1.2 ，v1.17 中可以看到云提供商标签达到基本可用。 @@ -36,7 +36,7 @@ Added as a beta feature way back in v1.2, v1.17 sees the general availability of -在v1.17中，Kubernetes卷快照特性是公开测试版。这个特性是在v1.12中以内部测试版引入的，第二个有重大变化的内部测试版是v1.13。 +在 v1.17 中，Kubernetes卷快照特性是公开测试版。这个特性是在 v1.12 中以内部测试版引入的，第二个有重大变化的内部测试版是 v1.13 。 @@ -44,7 +44,7 @@ The Kubernetes Volume Snapshot feature is now beta in Kubernetes v1.17. It was i -在v1.17中，Kubernetes树内存储插件到容器存储接口(CSI)的迁移基础架构是公开测试版。容器存储接口迁移最初是在Kubernetes v1.14中以内部测试版引入的。 +在 v1.17 中，Kubernetes树内存储插件到容器存储接口(CSI)的迁移基础架构是公开测试版。容器存储接口迁移最初是在Kubernetes v1.14 中以内部测试版引入的。 @@ -80,7 +80,7 @@ The labels are reaching general availability in this release. Kubernetes compone -在v1.17中，Kubernetes卷快照是是公开测试版。最初是在v1.12中以内部测试版引入的，第二个有重大变化的内部测试版是v1.13。这篇文章总结它在公开版本中的变化。 +在 v1.17 中，Kubernetes卷快照是是公开测试版。最初是在 v1.12 中以内部测试版引入的，第二个有重大变化的内部测试版是 v1.13 。这篇文章总结它在公开版本中的变化。 From 6f9a31a1fc7304ab0b2b8ae6b7e7f3a52a75aae4 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Tue, 22 Dec 2020 16:25:08 +0800 Subject: [PATCH 216/258] Update Pod overview This PR adds some clarifications about Pod update and Pod replacement, which can be pretty confusing to new users. --- .../en/docs/concepts/workloads/pods/_index.md | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/content/en/docs/concepts/workloads/pods/_index.md b/content/en/docs/concepts/workloads/pods/_index.md index 5bd954dcef..af548a79cb 100644 --- a/content/en/docs/concepts/workloads/pods/_index.md +++ b/content/en/docs/concepts/workloads/pods/_index.md @@ -191,6 +191,35 @@ details are abstracted away. That abstraction and separation of concerns simplif system semantics, and makes it feasible to extend the cluster's behavior without changing existing code. +## Pod update and replacement + +As mentioned in the previous section, when the Pod template for a workload +resource is changed, the controller creates new Pods based on the updated +template instead of updating or patching the existing Pods. + +Kubernetes doesn't prevent you from managing Pods directly. It is possible to +update some fields of a running Pod, in place. However, Pod update operations +like +[`patch`](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#patch-pod-v1-core), and +[`replace`](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#replace-pod-v1-core) +have some limitations: + +- Most of the metadata about a Pod is immutable. For example, you cannot + change the `namespace`, `name`, `uid`, or `creationTimestamp` fields; + the `generation` field is unique. It only accepts updates that increment the + field's current value. +- If the `metadata.deletionTimestamp` is set, no new entry can be added to the + `metadata.finalizers` list. +- Pod updates may not change fields other than `spec.containers[*].image`, + `spec.initContainers[*].image`, `spec.activeDeadlineSeconds` or + `spec.tolerations`. For `spec.tolerations`, you can only add new entries. +- When updating the `spec.activeDeadlineSeconds` field, two types of updates + are allowed: + + 1. setting the unassigned field to a positive number; + 1. updating the field from a positive number to a smaller, non-negative + number. + ## Resource sharing and communication Pods enable data sharing and communication among their constituent From aa571fbf8dd537a68658d2444ff71e5f6947a968 Mon Sep 17 00:00:00 2001 From: Ader Date: Sun, 27 Dec 2020 12:45:46 +0800 Subject: [PATCH 217/258] Add content in job.md * Add description to make it easy to read. * Distinguish between 'command'and 'output'. * Add the code blocks to the Markdown spec. --- content/en/docs/concepts/workloads/controllers/job.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/workloads/controllers/job.md b/content/en/docs/concepts/workloads/controllers/job.md index b65ed27ae2..14f218ddc8 100644 --- a/content/en/docs/concepts/workloads/controllers/job.md +++ b/content/en/docs/concepts/workloads/controllers/job.md @@ -38,6 +38,7 @@ You can run the example with this command: ```shell kubectl apply -f https://kubernetes.io/examples/controllers/job.yaml ``` +The output is similar to this: ``` job.batch/pi created ``` @@ -47,6 +48,7 @@ Check on the status of the Job with `kubectl`: ```shell kubectl describe jobs/pi ``` +The output is similar to this: ``` Name: pi Namespace: default @@ -91,6 +93,7 @@ To list all the Pods that belong to a Job in a machine readable form, you can us pods=$(kubectl get pods --selector=job-name=pi --output=jsonpath='{.items[*].metadata.name}') echo $pods ``` +The output is similar to this: ``` pi-5rwd7 ``` @@ -398,10 +401,11 @@ Therefore, you delete Job `old` but _leave its pods running_, using `kubectl delete jobs/old --cascade=false`. Before deleting it, you make a note of what selector it uses: -``` +```shell kubectl get job old -o yaml ``` -``` +The output is similar to this: +```yaml kind: Job metadata: name: old @@ -420,7 +424,7 @@ they are controlled by Job `new` as well. You need to specify `manualSelector: true` in the new Job since you are not using the selector that the system normally generates for you automatically. -``` +```yaml kind: Job metadata: name: new From cd8ba39567213adacac23eb880fc473a2819d65f Mon Sep 17 00:00:00 2001 From: yuandongx Date: Fri, 18 Dec 2020 10:04:54 +0000 Subject: [PATCH 218/258] sync en. --- .../zh/docs/reference/kubectl/conventions.md | 129 +++++++----------- 1 file changed, 51 insertions(+), 78 deletions(-) diff --git a/content/zh/docs/reference/kubectl/conventions.md b/content/zh/docs/reference/kubectl/conventions.md index 6313e27451..de8232d75b 100644 --- a/content/zh/docs/reference/kubectl/conventions.md +++ b/content/zh/docs/reference/kubectl/conventions.md @@ -18,7 +18,7 @@ content_type: concept -`kubectl` 的推荐用法约定 +`kubectl` 的推荐用法约定。 @@ -36,13 +36,11 @@ For a stable output in a script: * 请求一个面向机器的输出格式，例如 `-o name`、`-o json`、`-o yaml`、`-o go template` 或 `-o jsonpath`。 * 完全限定版本。例如 `jobs.v1.batch/myjob`。这将确保 kubectl 不会使用其默认版本，该版本会随着时间的推移而更改。 -* 在使用基于生成器的命令（例如 `kubectl run` 或者 `kubectl expose`）时，指定 `--generator` 参数以固定到特定行为。 * 不要依赖上下文、首选项或其他隐式状态。 * 使用特定版本的标签标记镜像，不要将该标签移动到新版本。例如，使用 `:v1234`、`v1.2.3`、`r03062016-1-4`，而不是 `:latest`（有关详细信息，请参阅[配置的最佳实践](/zh/docs/concepts/configuration/overview/#container-images))。 -* 固定到特定的[生成器](#生成器)版本，例如 `kubectl run --generator=run-pod/v1`。 -* 使用基于版本控制的脚本来记录所使用的参数，或者至少使用 `--record` 参数以便为所创建的对象添加注解，在使用轻度参数化的镜像时，记录下所使用的命令行。 * 使用基于版本控制的脚本来运行包含大量参数的镜像。 * 对于无法通过 `kubectl run` 参数来表示的功能特性，使用基于源码控制的配置文件，以记录要使用的功能特性。 + +你可以使用 `--dry-run=client` 参数来预览而不真正提交即将下发到集群的对象实例： + +{{< note >}} + +所有的 `kubectl run` 生成器已弃用。 +查阅 Kubernetes v1.17 文档中的生成器[列表](https://v1-17.docs.kubernetes.io/docs/reference/kubectl/conventions/#generators)以及它们的用法。 +{{< /note >}} + #### 生成器 - -您可以使用带有 `--generator` 参数的 `kubectl run` 命令创建如下资源： - - -{{< table caption="可以使用 kubectl run 创建的资源" >}} -| 资源 | API 组 | kubectl 命令 | -|----------------------------------|--------------------|-------------------------------------------------- | -| Pod | v1 | `kubectl run --generator=run-pod/v1` | -| ReplicationController _(已弃用)_ | v1 | `kubectl run --generator=run/v1` | -| Deployment _(已弃用)_ | extensions/v1beta1 | `kubectl run --generator=deployment/v1beta1` | -| Deployment _(已弃用)_ | apps/v1beta1 | `kubectl run --generator=deployment/apps.v1beta1` | -| Job _(已弃用)_ | batch/v1 | `kubectl run --generator=job/v1` | -| CronJob _(已弃用)_ | batch/v2alpha1 | `kubectl run --generator=cronjob/v2alpha1` | -| CronJob _(已弃用)_ | batch/v1beta1 | `kubectl run --generator=cronjob/v1beta1` | -{{< /table >}} - -{{< note >}} - -不推荐使用 `run-pod/v1` 以外的其他生成器. -{{< /note >}} - - -如果您显式设置了 `--generator` 参数，kubectl 将使用您指定的生成器。如果使用 `kubectl run` 命令但是未指定生成器，kubectl 会根据您设置的其他参数自动选择要使用的生成器。下表列出了如果您自己未指定参数自动使用与之相匹配的生成器： - - -{{< table caption="kubectl run 参数及其对应的资源" >}} -| 参数 | 相匹配的资源 | -|-------------------------|-----------------------| -| `--schedule=` | CronJob | -| `--restart=Always` | Deployment | -| `--restart=OnFailure` | Job | -| `--restart=Never` | Pod | -{{< /table >}} - - -如果不指定生成器，kubectl 将按以下顺序考虑其他参数： - -1. `--schedule` -1. `--restart` - - -您可以使用 `--dry-run` 参数预览要发送到集群的对象，而无需真正提交。 +你可以使用 kubectl 命令生成以下资源， `kubectl create --dry-run=client -o yaml`： +``` + clusterrole 创建 ClusterRole。 + clusterrolebinding 为特定的 ClusterRole 创建 ClusterRoleBinding。 + configmap 使用本地文件、目录或文本值创建 Configmap。 + cronjob 使用指定的名称创建 Cronjob。 + deployment 使用指定的名称创建 Deployment。 + job 使用指定的名称创建 Job。 + namespace 使用指定的名称创建名称空间。 + poddisruptionbudget 使用指定名称创建 Pod 干扰预算。 + priorityclass 使用指定的名称创建 Priorityclass。 + quota 使用指定的名称创建配额。 + role 使用单一规则创建角色。 + rolebinding 为特定角色或 ClusterRole 创建 RoleBinding。 + secret 使用指定的子命令创建 Secret。 + service 使用指定的子命令创建服务。 + serviceaccount 使用指定的名称创建服务帐户。 +``` ### `kubectl apply` - * 您可以使用 `kubectl apply` 命令创建或更新资源。有关使用 kubectl apply 更新资源的详细信息，请参阅 [Kubectl 文档](https://kubectl.docs.kubernetes.io)。 From 8ebfea611ef539f3453d60d5b3e25f8986187052 Mon Sep 17 00:00:00 2001 From: yuandongx Date: Mon, 28 Dec 2020 03:00:35 +0000 Subject: [PATCH 219/258] versioning... --- content/zh/docs/reference/kubernetes-api/api-index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/reference/kubernetes-api/api-index.md b/content/zh/docs/reference/kubernetes-api/api-index.md index 140233e659..a9fca7e581 100644 --- a/content/zh/docs/reference/kubernetes-api/api-index.md +++ b/content/zh/docs/reference/kubernetes-api/api-index.md @@ -1,6 +1,6 @@ --- -title: v1.19 +title: v1.20 weight: 50 --- -[Kubernetes API v1.19](/docs/reference/generated/kubernetes-api/v1.19/) \ No newline at end of file +[Kubernetes API v1.20](/docs/reference/generated/kubernetes-api/v1.20/) \ No newline at end of file From a784cb42f855660d79a6d058c1cfb93021d1eb11 Mon Sep 17 00:00:00 2001 From: Dmitry Shurupov Date: Mon, 28 Dec 2020 10:41:28 +0700 Subject: [PATCH 220/258] Translating code comments in Russian README --- README-ru.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README-ru.md b/README-ru.md index 2527c52e39..348f92a82e 100644 --- a/README-ru.md +++ b/README-ru.md @@ -24,10 +24,10 @@ git clone https://github.com/kubernetes/website.git cd website ``` -Сайт Kubernetes использует [тему для Hugo под названием Docsy](https://github.com/google/docsy). Даже если вы планируете запускать сайт в контейнере, мы настоятельно рекомендуем загрузить соответствующий сабмодуль и другие зависимости для разработки, выполнив следующую команду: +Сайт Kubernetes использует [тему для Hugo под названием Docsy](https://github.com/google/docsy). Даже если вы планируете запускать сайт в контейнере, мы настоятельно рекомендуем загрузить соответствующий подмодуль и другие зависимости для разработки, выполнив следующую команду: ``` -# pull in the Docsy submodule +# загружаем Git-подмодуль Docsy git submodule update --init --recursive --depth 1 ``` @@ -79,7 +79,7 @@ make: *** [serve] Error 1 ```shell #!/bin/sh -# These are the original gist links, linking to my gists now. +# Ссылки на оригинальные gist-файлы закомментированы в пользу моих адаптированных. # curl -O https://gist.githubusercontent.com/a2ikm/761c2ab02b7b3935679e55af5d81786a/raw/ab644cb92f216c019a2f032bbf25e258b01d87f9/limit.maxfiles.plist # curl -O https://gist.githubusercontent.com/a2ikm/761c2ab02b7b3935679e55af5d81786a/raw/ab644cb92f216c019a2f032bbf25e258b01d87f9/limit.maxproc.plist @@ -135,7 +135,7 @@ sudo launchctl load -w /Library/LaunchDaemons/limit.maxfiles.plist # Кодекс поведения -Участие в сообществе Kubernetes регулируется [кодексом поведения CNCF](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). +Участие в сообществе Kubernetes регулируется [кодексом поведения CNCF](https://github.com/cncf/foundation/blob/master/code-of-conduct-languages/ru.md). # Спасибо! From 1f4b65209f5a1eb77245536b3c1b0c1eb3b30e84 Mon Sep 17 00:00:00 2001 From: yuandongx Date: Mon, 28 Dec 2020 07:15:26 +0000 Subject: [PATCH 221/258] update --- content/zh/docs/concepts/containers/images.md | 28 ++++++++++++++++--- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/content/zh/docs/concepts/containers/images.md b/content/zh/docs/concepts/containers/images.md index 463705f659..08b70bdbaf 100644 --- a/content/zh/docs/concepts/containers/images.md +++ b/content/zh/docs/concepts/containers/images.md @@ -175,7 +175,7 @@ Credentials can be provided in several ways: 向容器仓库认证的机制 下面将详细描述每一项。 @@ -195,11 +195,11 @@ This approach is suitable if you can control node configuration. 此方法适用于能够对节点进行配置的场合。 {{< note >}} -Kubernetes 仅支持 Docker 配置中的 `auths` 和 `HttpHeaders` 部分， +Kubernetes 默认仅支持 Docker 配置中的 `auths` 和 `HttpHeaders` 部分， 不支持 Docker 凭据辅助程序（`credHelpers` 或 `credsStore`）。 {{< /note >}} @@ -300,6 +300,26 @@ EOF pod/private-image-test-1 created ``` + +如果一切顺利，那么一段时间后你可以执行： +```shell +kubectl logs private-image-test-1 +``` +然后可以看到命令的输出： +``` +SUCCESS +``` + @@ -474,7 +494,7 @@ EOF This needs to be done for each pod that is using a private registry. However, setting of this field can be automated by setting the imagePullSecrets -in a [ServiceAccount](/docs/tasks/configure-pod-container/configure-service-accounts/) resource. +in a [ServiceAccount](/docs/tasks/configure-pod-container/configure-service-account/) resource. Check [Add ImagePullSecrets to a Service Account](/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account) for detailed instructions. From 1962f7dae94e43c1cb3689579434e59864a268ca Mon Sep 17 00:00:00 2001 From: yuandongx Date: Thu, 24 Dec 2020 10:28:28 +0000 Subject: [PATCH 222/258] remove 'shell' form fence. --- content/zh/docs/reference/using-api/health-checks.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/reference/using-api/health-checks.md b/content/zh/docs/reference/using-api/health-checks.md index 7422ea0063..4def388ccc 100644 --- a/content/zh/docs/reference/using-api/health-checks.md +++ b/content/zh/docs/reference/using-api/health-checks.md @@ -65,7 +65,7 @@ kubectl get --raw='/readyz?verbose' 输出将如下所示： -```shell +``` [+]ping ok [+]log ok [+]etcd ok @@ -101,7 +101,7 @@ curl -k 'https://localhost:6443/readyz?verbose&exclude=etcd' 输出显示排除了 `etcd` 检查： -```shell +``` [+]ping ok [+]log ok [+]etcd excluded: ok From 540d43d3b728131d36ac3ce6eab79c4d109c68d9 Mon Sep 17 00:00:00 2001 From: wangyamei Date: Fri, 25 Dec 2020 17:10:50 +0800 Subject: [PATCH 223/258] zh-trans: update CronJob --- .../workloads/controllers/cron-jobs.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/content/zh/docs/concepts/workloads/controllers/cron-jobs.md b/content/zh/docs/concepts/workloads/controllers/cron-jobs.md index 11e9752bac..a22c5f615f 100644 --- a/content/zh/docs/concepts/workloads/controllers/cron-jobs.md +++ b/content/zh/docs/concepts/workloads/controllers/cron-jobs.md @@ -157,6 +157,25 @@ the Job in turn is responsible for the management of the Pods it represents. --> CronJob 仅负责创建与其调度时间相匹配的 Job，而 Job 又负责管理其代表的 Pod。 + +## 新控制器 + +CronJob 控制器有一个替代的实现，自 Kubernetes 1.20 开始以 alpha 特性引入。 +如果选择 CronJob 控制器的 v2 版本，请在 {{< glossary_tooltip term_id="kube-controller-manager" text="kube-controller-manager" >}} +中设置以下[特性门控](/zh/docs/reference/command-line-tools-reference/feature-gates/) 标志。 + +``` +--feature-gates="CronJobControllerV2=true" +``` + ## {{% heading "whatsnext" %}} + + +_作者标注：今天的邀请帖子是 Travis Newhouse 的 [系列](https://kubernetes.io/blog/2016/06/bringing-end-to-end-testing-to-azure) 中的第二部分，他是 AppFormix 的首席架构师，这篇文章介绍了他们对 Kubernetes 的贡献。_ + + + +历史上，Kubernetes 测试一直由谷歌托管，在 [谷歌计算引擎](https://cloud.google.com/compute/) (GCE) 和 [谷歌容器引擎](https://cloud.google.com/container-engine/) (GKE) 上运行端到端测试。实际上，提交队列的选通检查是在这些测试平台上执行测试的子集。联合测试旨在通过使组织托管各种平台的测试作业并贡献测试结果，从而让 Kubernetes 项目受益来扩大测试范围。谷歌和 SIG-Testing 的 Kubernetes 测试小组成员已经创建了一个 [Kubernetes 测试历史记录仪表板](http://storage.googleapis.com/kubernetes-test-history/static/index.html)，可以发布所有联合测试作业（包括谷歌托管的作业）的全部结果。 + +在此博客文章中，我们介绍了扩展 Azure 的端到端测试工作，并展示了如何为 Kubernetes 项目贡献联合测试。 + + +**Azure 的端到端集成测试** + +成功实现 [在 Azure 上自动部署 Kubernetes 的 “development distro” 脚本](https://kubernetes.io/blog/2016/06/bringing-end-to-end-testing-to-azure) 之后，我们的下一个目标是运行端到端集成测试，并与 Kubernetes 社区共享结果。 + + +通过在私有 Jenkins 服务器中定义夜间工作，我们自动化了在 Azure 上执行 Kubernetes 端到端测试的工作流程。图2显示了使用 kube-up.sh 在运行于 Azure 的 Ubuntu 虚拟机上部署 Kubernetes，然后执行端到端测试的工作流程。测试完成后，该作业将测试结果和日志上传到 Google Cloud Storage 目录中，其格式可以由 [生成测试历史记录仪表板的脚本](https://github.com/kubernetes/test-infra/tree/master/jenkins/test-history) 进行处理。我们的 Jenkins 作业使用 hack/jenkins/e2e-runner.sh 和 hack/jenkins/upload-to-gcs.sh 脚本生成正确格式的结果。 + + +| ![Kubernetes on Azure - Flow Chart - New Page.png](https://lh6.googleusercontent.com/TZiUu4sQ7G0XDvJgv9a1a4UEdxntOZDT9I3S42c8BOAyigxaysKmhJMen8vLaJ3UYaYKPIG9h-cyBOvTSI6kBgqnUQabe4xxZXhrUyVxinKGEaCDUnmNlBo__HNjzoYc_U7zM77_Dxe) | +| 图 2 - 夜间测试工作流程 | + + +**如何进行端到端测试** + +在创建 Azure 端到端测试工作的整个过程中，我们与 [SIG-Testing](https://github.com/kubernetes/community/tree/master/sig-testing) 的成员进行了合作，找到了一种将结果发布到 Kubernetes 社区的方法。合作的结果是以文档和简化的流程从联合测试工作中贡献结果。贡献端到端测试结果的过程可以归纳为4个步骤。 + + +1. 创建一个 [Google Cloud Storage](https://cloud.google.com/storage/) 空间用来发布结果。 +2. 定义一个自动化作业来运行端到端测试，通过设置一些环境变量，使用 hack/jenkins/e2e-runner.sh 部署 Kubernetes 二进制文件并执行测试。 +3. 使用 hack/jenkins/upload-to-gcs.sh 上传结果。 +4. 通过提交对 [kubernetes/test-infra](https://github.com/kubernetes/test-infra) 中的几个文件进行修改的请求，将结果合并到测试历史记录仪表板中。 + + +联合测试文档更详细地描述了这些步骤。运行端到端测试并上传结果的脚本简化了贡献新联合测试作业的工作量。设置自动化测试作业的具体步骤以及在其中部署 Kubernetes 的合适环境将留给读者进行选择。对于使用 Jenkins 的组织，用于 GCE 和 GKE 测试的 jenkins-job-builder 配置可能会提供有用的示例。 + + + +**回顾** + +Azure 上的端到端测试已经运行了几周。在此期间，我们在 Kubernetes 中发现了两个问题。Weixu Zhuang 立即发布了修补程序并已合并到 Kubernetes master 分支中。 + + +当我们想用 Ubuntu VM 在 Azure 上用 SaltStack 打开 Kubernetes 集群时，发生了第一个问题。一个提交 (07d7cfd3) 修改了 OpenVPN 证书生成脚本，使用了一个仅由集群或者ubuntu中的脚本初始化的变量。证书生成脚本对参数是否存在进行严格检查会导致其他使用该脚本的平台失败（例如，为支持 Azure 而进行的更改）。我们提交了一个[解决问题的请求](https://github.com/kubernetes/kubernetes/pull/21357) ，通过使用默认值初始化变量让证书生成脚本在所有平台类型上都更加健壮，。 + + +第二个 [清理未使用导入的请求](https://github.com/kubernetes/kubernetes/pull/22321) 在 Daemonset 单元测试文件中。import 语句打破了 golang 1.4 的单元测试。我们的夜间 Jenkins 工作帮助我们找到错误并且迅速完成修复。 + + +**结论与未来工作** + + +在 Azure 上为 Kubernetes 添加了夜间端到端测试工作，这有助于定义为 Kubernetes 项目贡献联合测试的过程。在工作过程中，当 Azure 测试工作发现兼容性问题时，我们还发现了将测试覆盖范围扩展到更多平台的直接好处。 + + +我们要感谢 Aaron Crickenberger, Erick Fejta, Joe Finney 和 Ryan Hutchinson 的帮助，将我们的 Azure 端到端测试结果纳入了 Kubernetes 测试历史。如果您想参与测试来创建稳定的、高质量的 Kubernetes 版本，请加入我们的 [Kubernetes Testing SIG (sig-testing)](https://github.com/kubernetes/community/tree/master/sig-testing)。 + + + +_--Travis Newhouse, AppFormix 首席架构师_ From 1c2c75b2d8fa0928789f5c63fde37aa1b4712414 Mon Sep 17 00:00:00 2001 From: seokho-son Date: Fri, 18 Dec 2020 14:19:46 +0900 Subject: [PATCH 228/258] Update release/notes 1.20 for Korean --- content/ko/docs/setup/release/notes.md | 4322 +++++++++++------------- 1 file changed, 1930 insertions(+), 2392 deletions(-) diff --git a/content/ko/docs/setup/release/notes.md b/content/ko/docs/setup/release/notes.md index 9fec5907b9..f833d27094 100644 --- a/content/ko/docs/setup/release/notes.md +++ b/content/ko/docs/setup/release/notes.md @@ -1,5 +1,5 @@ --- -title: v1.19 릴리스 노트 +title: v1.20 릴리스 노트 weight: 10 card: name: release-notes @@ -13,1401 +13,2073 @@ card: -# v1.19.0 +# v1.20.0 [문서](https://docs.k8s.io) -## v1.19.0 다운로드 +## v1.20.0 다운로드 파일명 | sha512 해시 -------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes.tar.gz) | `448b941e973a519a500eb24786f6deb7eebd0e1ecb034941e382790ff69dfc2838715a222cfc53bea7b75f2c6aedc7425eded4aad69bf88773393155c737f9c0` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-src.tar.gz) | `47d253e6eb1f6da730f4f3885e205e6bfde88ffe66d92915465108c9eaf8e3c5d1ef515f8bf804a726db057433ecd25008ecdef624ee68ad9c103d1c7a615aad` +[kubernetes.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes.tar.gz) | `ebfe49552bbda02807034488967b3b62bf9e3e507d56245e298c4c19090387136572c1fca789e772a5e8a19535531d01dcedb61980e42ca7b0461d3864df2c14` +[kubernetes-src.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-src.tar.gz) | `bcbd67ed0bb77840828c08c6118ad0c9bf2bcda16763afaafd8731fd6ce735be654feef61e554bcc34c77c65b02a25dae565adc5e1dc49a2daaa0d115bf1efe6` ### 클라이언트 바이너리 파일명 | sha512 해시 -------- | ----------- -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-client-darwin-amd64.tar.gz) | `7093a34298297e46bcd1ccb77a9c83ca93b8ccb63ce2099d3d8cd8911ccc384470ac202644843406f031c505a8960d247350a740d683d8910ca70a0b58791a1b` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-client-linux-386.tar.gz) | `891569cff7906732a42b20b86d1bf20a9fe873f87b106e717a5c0f80728b5823c2a00c7ccea7ec368382509f095735089ddd582190bc51dcbbcef6b8ebdbd5cc` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-client-linux-amd64.tar.gz) | `1590d4357136a71a70172e32820c4a68430d1b94cf0ac941ea17695fbe0c5440d13e26e24a2e9ebdd360c231d4cd16ffffbbe5b577c898c78f7ebdc1d8d00fa3` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-client-linux-arm.tar.gz) | `bc0fb19fb6af47f591adc64b5a36d3dffcadc35fdfd77a4a222e037dbd2ee53fafb84f13c4e307910cfa36b3a46704063b42a14ceaad902755ec14c492ccd51d` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-client-linux-arm64.tar.gz) | `6ff47f4fdfb3b5f2bfe18fd792fe9bfc747f06bf52de062ee803cda87ac4a98868d8e1211742e32dd443a4bdb770018bbdde704dae6abfc6d80c02bdfb4e0311` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-client-linux-ppc64le.tar.gz) | `d8816518adc3a7fc00f996f23ff84e6782a3ebbba7ef37ba44def47b0e6506fefeeaf37d0e197cecf0deb5bd1a8f9dd1ba82af6c29a6b9d21b8e62af965b6b81` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-client-linux-s390x.tar.gz) | `662fd4618f2b747d2b0951454b9148399f6cd25d3ca7c40457b6e02cb20df979138cad8cccd18fc8b265d9426c90828d3f0b2a6b40d9cd1a1bdc17219e35ed33` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-client-windows-386.tar.gz) | `d90cb92eb33ecbfab7a0e3a2da60ab10fc59132e4bc9abe0a1461a13222b5016704a7cfe0bf9bcf5d4ec55f505ffbbf53162dfe570e8f210e3f68b0d3a6bf7e3` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-client-windows-amd64.tar.gz) | `6ec32a8a62b69363a524c4f8db765ff4bd16ea7e5b0eb04aa5a667f8653eda18c357a97513d9e12f0ba1612516acb150deffb6e3608633c62b97a15b6efa7cc0` +[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-client-darwin-amd64.tar.gz) | `3609f6483f4244676162232b3294d7a2dc40ae5bdd86a842a05aa768f5223b8f50e1d6420fd8afb2d0ce19de06e1d38e5e5b10154ba0cb71a74233e6dc94d5a0` +[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-client-linux-386.tar.gz) | `e06c08016a08137d39804383fdc33a40bb2567aa77d88a5c3fd5b9d93f5b581c635b2c4faaa718ed3bb2d120cb14fe91649ed4469ba72c3a3dda1e343db545ed` +[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-client-linux-amd64.tar.gz) | `081472833601aa4fa78e79239f67833aa4efcb4efe714426cd01d4ddf6f36fbf304ef7e1f5373bff0fdff44a845f7560165c093c108bd359b5ab4189f36b1f2f` +[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-client-linux-arm.tar.gz) | `037f84a2f29fe62d266cab38ac5600d058cce12cbc4851bcf062fafba796c1fbe23a0c2939cd15784854ca7cd92383e5b96a11474fc71fb614b47dbf98a477d9` +[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-client-linux-arm64.tar.gz) | `275727e1796791ca3cbe52aaa713a2660404eab6209466fdc1cfa8559c9b361fe55c64c6bcecbdeba536b6d56213ddf726e58adc60f959b6f77e4017834c5622` +[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-client-linux-ppc64le.tar.gz) | `7a9965293029e9fcdb2b7387467f022d2026953b8461e6c84182abf35c28b7822d2389a6d8e4d8e532d2ea5d5d67c6fee5fb6c351363cb44c599dc8800649b04` +[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-client-linux-s390x.tar.gz) | `85fc449ce1980f5f030cc32e8c8e2198c1cc91a448e04b15d27debc3ca56aa85d283f44b4f4e5fed26ac96904cc12808fa3e9af3d8bf823fc928befb9950d6f5` +[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-client-windows-386.tar.gz) | `4c0a27dba1077aaee943e0eb7a787239dd697e1d968e78d1933c1e60b02d5d233d58541d5beec59807a4ffe3351d5152359e11da120bf64cacb3ee29fbc242e6` +[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-client-windows-amd64.tar.gz) | `29336faf7c596539b8329afbbdceeddc843162501de4afee44a40616278fa1f284d8fc48c241fc7d52c65dab70f76280cc33cec419c8c5dbc2625d9175534af8` ### 서버 바이너리 파일명 | sha512 해시 -------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-server-linux-amd64.tar.gz) | `7c268bd58e67d3c5016f3fcc9f4b6d2da7558af5a2c708ff3baf767b39e847e3d35d4fd2fa0f640bedbfb09a445036cafbe2f04357a88dada405cfc2ded76972` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-server-linux-arm.tar.gz) | `fcbf8d9004f1cd244a82b685abaf81f9638c3cc1373d78e705050042cfa6a004f8eed92f4721539dcd169c55b662d10416af19cff7537a8dfef802dc41b4088b` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-server-linux-arm64.tar.gz) | `e21f54a35ff29e919e98fe81758f654ea735983d5a9d08dab9484598b116843830a86ceb5cf0a23d27b7f9aba77e5f0aa107c171a0837ba781d508ebbea76f55` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-server-linux-ppc64le.tar.gz) | `c7014c782683f8f612c7805654b632aab4c5dce895ee8f9ef24360616e24240ce59ddf3cf27c3170df5450d8fe14fbca3fb7cddfc9b74ae37943081f0fa4b6b3` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-server-linux-s390x.tar.gz) | `3ac2d6b273e5b650f63260aae164fc6781ad5760f63cca911f5db9652c4bf32e7e7b25728987befc6dfda89c5c56969681b75f12b17141527d4e1d12f3d41f3c` +[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-server-linux-amd64.tar.gz) | `fb56486a55dbf7dbacb53b1aaa690bae18d33d244c72a1e2dc95fb0fcce45108c44ba79f8fa04f12383801c46813dc33d2d0eb2203035cdce1078871595e446e` +[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-server-linux-arm.tar.gz) | `735ed9993071fe35b292bf06930ee3c0f889e3c7edb983195b1c8e4d7113047c12c0f8281fe71879fc2fcd871e1ee587f03b695a03c8512c873abad444997a19` +[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-server-linux-arm64.tar.gz) | `ffab155531d5a9b82487ee1abf4f6ef49626ea58b2de340656a762e46cf3e0f470bdbe7821210901fe1114224957c44c1d9cc1e32efb5ee24e51fe63990785b2` +[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-server-linux-ppc64le.tar.gz) | `9d5730d35c4ddfb4c5483173629fe55df35d1e535d96f02459468220ac2c97dc01b995f577432a6e4d1548b6edbfdc90828dc9c1f7cf7464481af6ae10aaf118` +[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-server-linux-s390x.tar.gz) | `6e4c165306940e8b99dd6e590f8542e31aed23d2c7a6808af0357fa425cec1a57016dd66169cf2a95f8eb8ef70e1f29e2d500533aae889e2e3d9290d04ab8721` ### 노드 바이너리 파일명 | sha512 해시 -------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-node-linux-amd64.tar.gz) | `d5e21432a4ab019f00cd1a52bbbdb00feb3db2ce96b41a58b1ee27d8847c485f5d0efe13036fd1155469d6d15f5873a5a892ecc0198f1bae1bf5b586a0129e75` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-node-linux-arm.tar.gz) | `bd57adf060813b06be2b33439d6f60d13630c0251ef96ba473274073200ea118f5622ec31ed714cc57bd9da410655e958a7700a5742ae7e4b6406ab12fbf21f3` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-node-linux-arm64.tar.gz) | `3ee70abc0a5cbf1ef5dde0d27055f4d17084585c36a2cf41e3fd925d206df0b583f50dc1c118472f198788b65b2c447aa40ad41646b88791659d2dfb69b3890b` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-node-linux-ppc64le.tar.gz) | `0f4368f229c082b2a75e7089a259e487d60b20bc8edf650dd7ca0fe23c51632397c2ef24c9c6cef078c95fce70d9229a5b4ff682c34f65a44bc4be3329c8ccde` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-node-linux-s390x.tar.gz) | `8f0b6839fc0ad51300221fa7f32134f8c687073715cc0839f7aacb21a075c66dab113369707d03e9e0e53be62ca2e1bdf04d4b26cff805ae9c7a5a4b864e3eae` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0/kubernetes-node-windows-amd64.tar.gz) | `587651158c9999e64e06186ef2e65fe14d46ffdae28c5d8ee6261193bfe4967717f997ebe13857fa1893bbf492e1cc1f816bce86a94c6df9b7a0264848391397` +[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-node-linux-amd64.tar.gz) | `3e6c90561dd1c27fa1dff6953c503251c36001f7e0f8eff3ec918c74ae2d9aa25917d8ac87d5b4224b8229f620b1830442e6dce3b2a497043f8497eee3705696` +[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-node-linux-arm.tar.gz) | `26db385d9ae9a97a1051a638e7e3de22c4bbff389d5a419fe40d5893f9e4fa85c8b60a2bd1d370fd381b60c3ca33c5d72d4767c90898caa9dbd4df6bd116a247` +[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-node-linux-arm64.tar.gz) | `5b8b63f617e248432b7eb913285a8ef8ba028255216332c05db949666c3f9e9cb9f4c393bbd68d00369bda77abf9bfa2da254a5c9fe0d79ffdad855a77a9d8ed` +[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-node-linux-ppc64le.tar.gz) | `60da7715996b4865e390640525d6e98593ba3cd45c6caeea763aa5355a7f989926da54f58cc5f657f614c8134f97cd3894b899f8b467d100dca48bc22dd4ff63` +[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-node-linux-s390x.tar.gz) | `9407dc55412bd04633f84fcefe3a1074f3eaa772a7cb9302242b8768d6189b75d37677a959f91130e8ad9dc590f9ba8408ba6700a0ceff6827315226dd5ee1e6` +[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0/kubernetes-node-windows-amd64.tar.gz) | `9d4261af343cc330e6359582f80dbd6efb57d41f882747a94bbf47b4f93292d43dd19a86214d4944d268941622dfbc96847585e6fec15fddc4dbd93d17015fa8` -## v1.18.0 이후 체인지로그 +## v1.19.0 이후 변경로그(Changelog) -## 새로운 소식 (주요 테마) +## 새로운 소식(주요 테마) -### 사용 중단 경고 +### Dockershim 사용 중단(deprecation) -SIG API Machinery는 `kubectl` 사용자 및 API 사용자에게 표시되는 [사용 중단된 API 사용 시 경고](https://kubernetes.io/docs/reference/using-api/deprecation-policy/#rest-resources-aka-api-objects)와 -클러스터 관리자에게 표시되는 메트릭을 구현하였다. -사용 중단된 API에 대한 요청은 대상 제거 릴리스 및 대체 API를 포함하는 경고와 함께 반환된다. -경고는 [어드미션 웹훅](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#admissionreview-response-warning)에서도 -반환될 수 있으며, [사용자 정의 리소스의 사용 중단된 버전](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning/#version-deprecation)에 대해 지정된다. +Docker as an underlying runtime is being deprecated. Docker-produced images will continue to work in your cluster with all runtimes, as they always have. +The Kubernetes community [has written a blog post about this in detail](https://blog.k8s.io/2020/12/02/dont-panic-kubernetes-and-docker/) with [a dedicated FAQ page for it](https://blog.k8s.io/2020/12/02/dockershim-faq/). -### 영구적인 베타(beta) 회피하기 +### client-go를 위한 외부 자격증명(credential) 제공자 -쿠버네티스 1.20에서부터, SIG Architecture는 9개월 이내에 모든 REST API들을 베타에서 안정 버전으로 전환하는 새로운 정책을 구현한다. 새로운 정책의 이면에 있는 아이디어는 기능이 오랫동안 베타 상태로 유지되는 것을 피하기 위함이다. 일단 새로운 API가 베타 단계에 진입하면, 9개월 동안 다음 중 하나를 수행하게 된다. +The client-go credential plugins can now be passed in the current cluster information via the `KUBERNETES_EXEC_INFO` environment variable. Learn more about this on [client-go credential plugins documentation](https://docs.k8s.io/reference/access-authn-authz/authentication/#client-go-credential-plugins/). - - GA에 도달하여, 베타 지원 중단 혹은 - - 새로운 베타 버전을 보유 _(및 이전 베타 지원 중단)_. +### 기능 게이트(feature gate)를 통해 크론잡(CronJob) 컨트롤러 v2 활성화 가능 -REST API가 9개월의 카운트 다운이 끝나면, 다음 쿠버네티스 릴리스에서 해당 API 버전이 사용 중단된다. 더 자세한 내용은 [쿠버네티스 블로그](https://kubernetes.io/blog/2020/08/21/moving-forward-from-beta/)에서 확인할 수 있다. +An alternative implementation of `CronJob` controller is now available as an alpha feature in this release, which has experimental performance improvement by using informers instead of polling. While this will be the default behavior in the future, you can [try them in this release through a feature gate](https://docs.k8s.io/concepts/workloads/controllers/cron-jobs/). -### 워크로드 및 노드 디버깅을 위한 확장된 CLI 지원 +### PID 제한(PID Limits)이 안정 기능(General Availability)으로 전환 -SIG CLI는 `kubectl` 로 디버깅을 확장하여, 다음의 두 가지 새로운 디버깅 워크플로(workflows)를 지원한다. 복사본을 생성하여 워크로드를 디버깅하고, 호스트 네임스페이스에 컨테이너를 생성하여 노드를 디버깅한다. 이는 아래의 작업을 할 때 유용하다. - - 임시(Ephemeral) 컨테이너가 활성화되지 않은 클러스터에서 디버그 컨테이너 삽입 - - busybox와 같은 이미지나 `sleep 1d` 와 같은 명령어를 변경하여 쉽게 디버깅할 수 있도록, 손상된 컨테이너를 수정하여 `kubectl exec` 를 사용할 수 있는 시간 확보 - - 노드의 호스트 파일시스템에서 구성 파일 검사 +PID Limits features are now generally available on both `SupportNodePidsLimit` (node-to-pod PID isolation) and `SupportPodPidsLimit` (ability to limit PIDs per pod), after being enabled-by-default in beta stage for a year. -이러한 새로운 워크플로에는 신규 클러스터 기능이 필요하지 않으므로, `kubectl alpha debug` 를 통해 기존 클러스터로 테스트할 수 있다. `kubectl` 을 사용한 디버깅에 대해 사용자의 의견을 기대한다. 이슈를 열거나, [#sig-cli](https://kubernetes.slack.com/messages/sig-cli)를 방문하거나 기능 개선에 대한 이슈 [#1441](https://features.k8s.io/1441)에 코멘트를 남겨서 SIG CLI와 연락할 수 있다. +### API 우선순위 및 공정성(API Priority and Fairness)이 베타 단계로 전환 -### 구조화된 로깅 +Initially introduced in 1.18, Kubernetes 1.20 now enables API Priority and Fairness (APF) by default. This allows `kube-apiserver` to [categorize incoming requests by priority levels](https://docs.k8s.io/concepts/cluster-administration/flow-control/). -SIG Instrumentation은 로그 메시지의 구조와 쿠버네티스 오브젝트에 대한 참조를 표준화했다. 구조화된 로깅을 사용하면 로그를 더 쉽게 구문 분석, 처리, 저장, 질의 및 분석할 수 있다. klog 라이브러리의 새 메소드는 로그 메시지 구조를 강제 적용한다. +### IPv4/IPv6이 작동 -### 엔드포인트슬라이스(EndpointSlices)가 기본적으로 활성화 +IPv4/IPv6 dual-stack has been reimplemented for 1.20 to support dual-stack Services, based on user and community feedback. If your cluster has dual-stack enabled, you can create Services which can use IPv4, IPv6, or both, and you can change this setting for existing Services. Details are available in updated [IPv4/IPv6 dual-stack docs](https://docs.k8s.io/concepts/services-networking/dual-stack/), which cover the nuanced array of options. -엔드포인트슬라이스는 엔드포인트(EndPoint) API에 대한 스케일 및 확장 가능한 대안을 제공하는 훌륭한 신규 API이다. 엔드포인트슬라이스는 서비스를 지원하는 파드에 대한 IP 주소, 포트, 준비성 게이트(readiness gate) 상태 및 토폴로지 정보를 추적한다. +We expect this implementation to progress from alpha to beta and GA in coming releases, so we’re eager to have you comment about your dual-stack experiences in [#k8s-dual-stack](https://kubernetes.slack.com/messages/k8s-dual-stack) or in [enhancements #563](https://features.k8s.io/563). -쿠버네티스 1.19에서 이 기능은, 엔드포인트 대신 엔드포인트슬라이스에서 읽는 kube-proxy와 함께 기본적으로 활성화된다. 이는 대부분 눈에 띄지 않는 변경이지만, 대규모 클러스터에서는 눈에 띄게 확장성이 향상된다. 또한 토폴로지 인식 라우팅과 같은 향후 쿠버네티스 릴리스에서 중요한 신규 기능을 사용할 수 있다. +### go1.15.5 -### 인그레스(ingress)를 안정 기능(General Availability)으로 전환 +go1.15.5 has been integrated to Kubernets project as of this release, [including other infrastructure related updates on this effort](https://github.com/kubernetes/kubernetes/pull/95776). -SIG Network는 널리 사용되고 있는 [인그레스 API](https://kubernetes.io/ko/docs/concepts/services-networking/ingress/)를 쿠버네티스 1.19의 안정 기능으로 전환했다. 이 변경은 쿠버네티스 기여자들의 수 년간의 노력을 인정하고, 쿠버네티스의 향후 네트워킹 API에 대한 추가 작업을 위한 기반을 마련한다. +### CSI 볼륨 스냅샷(CSI Volume Snapshot)이 안정 기능으로 전환 -### seccomp를 안정 기능으로 전환 +CSI Volume Snapshot moves to GA in the 1.20 release. This feature provides a standard way to trigger volume snapshot operations in Kubernetes and allows Kubernetes users to incorporate snapshot operations in a portable manner on any Kubernetes environment regardless of supporting underlying storage providers. +Additionally, these Kubernetes snapshot primitives act as basic building blocks that unlock the ability to develop advanced, enterprise grade, storage administration features for Kubernetes: including application or cluster level backup solutions. +Note that snapshot support will require Kubernetes distributors to bundle the Snapshot controller, Snapshot CRDs, and validation webhook. In addition, a CSI driver supporting the snapshot functionality must also be deployed on the cluster. -쿠버네티스에 대한 seccomp(보안 컴퓨팅 모드) 지원이 안정 기능(GA)로 전환되었다. 이 기능은 파드(모든 컨테이너에 적용) 또는 단일 컨테이너에 대한 시스템 호출을 제한하여 워크로드 보안을 강화하는 데 사용될 수 있다. +### 비재귀적 볼륨 소유(Non-recursive Volume Ownership (FSGroup))가 베타 단계로 전환 -기술적으로 이것은 일급 객체(first class)인 `seccompProfile` 필드가 파드 및 컨테이너 `securityContext` 오브젝트에 추가되었음을 의미한다. +By default, the `fsgroup` setting, if specified, recursively updates permissions for every file in a volume on every mount. This can make mount, and pod startup, very slow if the volume has many files. +This setting enables a pod to specify a `PodFSGroupChangePolicy` that indicates that volume ownership and permissions will be changed only when permission and ownership of the root directory does not match with expected permissions on the volume. -```yaml -securityContext: - seccompProfile: - type: RuntimeDefault|Localhost|Unconfined # 셋 중 하나를 선택 - localhostProfile: my-profiles/profile-allow.json # type == Localhost 일때만 필요 -``` +### FSGroup를 위한 CSIDriver 정책이 베타 단계로 전환 -`seccomp.security.alpha.kubernetes.io/pod` 및 `container.seccomp.security.alpha.kubernetes.io/...` 어노테이션에 대한 지원은 이제 사용 중단되었으며, 쿠버네티스 v1.22.0에서 제거된다. 현재 자동 버전 차이(skew)에 대한 처리는 새로운 필드를 어노테이션으로 변환하며 그 반대의 경우도 동일하게 동작한다. 즉, 클러스터의 기존 워크로드를 변환하는데 별도의 조치가 필요하지 않다. +The FSGroup's CSIDriver Policy is now beta in 1.20. This allows CSIDrivers to explicitly indicate if they want Kubernetes to manage permissions and ownership for their volumes via `fsgroup`. -새로운 [Kubernetes.io의 문서 페이지][seccomp-docs]에서 seccomp로 컨테이너 시스템 호출을 제한하는 방법에 대한 자세한 정보를 찾을 수 있다. +### CSI 드라이버의 보안성 향상(알파) -[seccomp-docs]: https://kubernetes.io/docs/tutorials/clusters/seccomp/ +In 1.20, we introduce a new alpha feature `CSIServiceAccountToken`. This feature allows CSI drivers to impersonate the pods that they mount the volumes for. This improves the security posture in the mounting process where the volumes are ACL’ed on the pods’ service account without handing out unnecessary permissions to the CSI drivers’ service account. This feature is especially important for secret-handling CSI drivers, such as the secrets-store-csi-driver. Since these tokens can be rotated and short-lived, this feature also provides a knob for CSI drivers to receive `NodePublishVolume` RPC calls periodically with the new token. This knob is also useful when volumes are short-lived, e.g. certificates. +### 그레이스풀 노드 종료(Graceful Node Shutdown) 기능 소개(알파) -### 운영용 이미지가 커뮤니티 제어로 이동 +The `GracefulNodeShutdown` feature is now in Alpha. This allows kubelet to be aware of node system shutdowns, enabling graceful termination of pods during a system shutdown. This feature can be [enabled through feature gate](https://docs.k8s.io/concepts/architecture/nodes/#graceful-node-shutdown). -쿠버네티스 v1.19부터 쿠버네티스 컨테이너 이미지는 `{asia,eu,us}.gcr.io/k8s-artifacts-prod` 에 있는 -커뮤니티 제어 기반의 스토리지 버킷에 저장된다. `k8s.gcr.io` 가상 도메인(vanity domain)이 새 버킷으로 -업데이트되었다. 이는 커뮤니티 제어 하에 운영 아티팩트(production artifacts)를 가져온다. +### 런타임 로그 관리(sanitation) -### KubeSchedulerConfiguration를 베타로 전환 +Logs can now be configured to use runtime protection from leaking sensitive data. [Details for this experimental feature is available in documentation](https://docs.k8s.io/concepts/cluster-administration/system-logs/#log-sanitization). -SIG Scheduling은 `KubeSchedulerConfiguration` 를 베타로 전환했다. [KubeSchedulerConfiguration](https://kubernetes.io/docs/reference/scheduling/config) 기능을 사용하면 kube-scheduler의 알고리즘 및 기타 설정을 조정할 수 있다. 남은 구성을 다시 작성하지 않고도, 선택한 일정 단계에서 특정 기능(플러그인에 포함된)을 쉽게 활성화하거나 비활성화할 수 있다. 또한 단일 kube-scheduler 인스턴스는 프로파일이라고 불리는 다양한 구성을 제공한다. 파드는 `.spec.schedulerName` 필드를 통해 스케줄링하려는 프로파일을 선택할 수 있다. +### 파드 리소스 메트릭 -### CSI 마이그레이션 - AzureDisk 및 vSphere (베타) - -인-트리(In-tree) 볼륨 플러그인 및 모든 클라우드 공급자의 의존성이 쿠버네티스 코어 밖으로 이동된다. CSI 마이그레이션 기능을 사용하면 모든 볼륨 작업을 해당 CSI 드라이버로 라우팅하여 코드가 제거된 경우에도 레거시 API를 사용하는 기존 볼륨이 계속 동작할 수 있다. 이 기능의 AzureDisk 및 vSphere 구현이 베타로 승격되었다. +On-demand metrics calculation is now available through `/metrics/resources`. [When enabled]( +https://docs.k8s.io/concepts/cluster-administration/system-metrics#kube-scheduler-metrics), the endpoint will report the requested resources and the desired limits of all running pods. -### 스토리지 용량 추적 +### `RootCAConfigMap` 소개 -전통적으로 쿠버네티스 스케줄러는 추가 퍼시스턴트 스토리지가 클러스터의 모든 곳에서 사용할 수 있고 그 용량이 무한하다고 가정했다. 토폴로지 제약 사항은 첫 번째 요점을 다루었지만, 남은 스토리지 용량이 새 파드를 시작하기에 충분하지 않을 수 있다는 점을 고려하지 않은 채로 파드 스케줄링이 수행되었다. 새로운 알파(alpha) 기능인 [스토리지 용량 추적](https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1472-storage-capacity-tracking)은 CSI 드라이버에 API를 추가하여, 스토리지 용량을 전달하고 파드의 노드를 선택할 때 쿠버네티스 스케줄러에서 해당 정보를 사용한다. 이 기능은 용량이 더 제한된 로컬 볼륨 및 기타 볼륨 유형에 대한 동적 프로비저닝을 지원하기 위한 디딤돌 역할이다. +`RootCAConfigMap` graduates to Beta, seperating from `BoundServiceAccountTokenVolume`. The `kube-root-ca.crt` ConfigMap is now available to every namespace, by default. It contains the Certificate Authority bundle for verify kube-apiserver connections. -### CSI 볼륨 상태 모니터링 +### `kubectl debug` 이 베타 단계로 전환 -CSI 상태 모니터링의 알파 버전은 쿠버네티스 1.19와 함께 릴리스된다. 이 기능을 사용하면 CSI 드라이버가 기본 스토리지 시스템의 비정상적인 볼륨 조건을 쿠버네티스와 공유하여 PVC 또는 파드의 이벤트를 전달할 수 있다. 이 기능은 쿠버네티스 개별 볼륨 상태 문제를 프로그래밍 방식으로 감지하고 해결하기 위한 디딤돌 역할이다. +`kubectl alpha debug` graduates from alpha to beta in 1.20, becoming `kubectl debug`. +`kubectl debug` provides support for common debugging workflows directly from kubectl. Troubleshooting scenarios supported in this release of `kubectl` include: +Troubleshoot workloads that crash on startup by creating a copy of the pod that uses a different container image or command. +Troubleshoot distroless containers by adding a new container with debugging tools, either in a new copy of the pod or using an ephemeral container. (Ephemeral containers are an alpha feature that are not enabled by default.) +Troubleshoot on a node by creating a container running in the host namespaces and with access to the host’s filesystem. +Note that as a new builtin command, `kubectl debug` takes priority over any `kubectl` plugin named “debug”. You will need to rename the affected plugin. +Invocations using `kubectl alpha debug` are now deprecated and will be removed in a subsequent release. Update your scripts to use `kubectl debug` instead of `kubectl alpha debug`! +For more information about kubectl debug, see Debugging Running Pods on the Kubernetes website, kubectl help debug, or reach out to SIG CLI by visiting #sig-cli or commenting on [enhancement #1441](https://features.k8s.io/1441). -### 일반적인 임시 볼륨 +### kubeadm에서 사용 중단된 플래그 삭제 -쿠버네티스는 라이프사이클이 파드에 연결되어 있고 스크래치 공간(예: 기본 제공되는 "empty dir" 볼륨 타입)으로 사용되거나 일부 데이터를 파드에 로드(예: 기본 제공되는 컨피그맵(ConfigMap) 및 시크릿(Secret) 볼륨 유형 또는 "CSI 인라인 볼륨")할 수 있는 볼륨 플러그인을 제공한다. 새로운 [일반적인 임시 볼륨](https://github.com/kubernetes/enhancements/tree/master/keps/sig-storage/1698-generic-ephemeral-volumes) 알파 기능은 동적 프로비저닝을 지원하는 기존 스토리지 드라이버를 볼륨의 라이프사이클이 포함된 파드에 바인딩된 임시 볼륨으로 사용한다. - - 예를 들어 퍼시스턴트 메모리나 해당 노드의 별도 로컬 디스크와 같은, 루트 디스크와는 다른 스크래치 스토리지를 제공하는데 사용 - - 볼륨 프로비저닝을 위한 모든 스토리지클래스(StorageClass) 파라미터 지원 - - 스토리지 용량 추적, 스냅샷 및 복원, 볼륨 크기 조정과 같이 퍼시스턴트볼륨클레임(PersistentVolumeClaim)에서 지원하는 모든 기능을 지원 +`kubeadm` applies a number of deprecations and removals of deprecated features in this release. More details are available in the Urgent Upgrade Notes and Kind / Deprecation sections. -### 변경할 수 없는(immutable) 시크릿 및 컨피그맵 (베타) +### 파드의 호스트네임을 FQDN으로 사용하는 것이 베타 단계로 전환 -시크릿 및 컨피그맵 볼륨은 immutable로 표시될 수 있으므로, 클러스터에 시크릿 및 컨피그맵 볼륨이 많은 경우 API 서버의 로드가 크게 줄어든다. -자세한 내용은 [컨피그맵](https://kubernetes.io/ko/docs/concepts/configuration/configmap/) 및 [시크릿](https://kubernetes.io/ko/docs/concepts/configuration/secret/)을 참고한다. +Previously introduced in 1.19 behind a feature gate, `SetHostnameAsFQDN` is now enabled by default. More details on this behavior is available in [documentation for DNS for Services and Pods](https://docs.k8s.io/concepts/services-networking/dns-pod-service/#pod-sethostnameasfqdn-field) -### 윈도우에 대한 CSI 프록시 +### `TokenRequest` / `TokenRequestProjection` 이 안정 기능으로 전환 -윈도우용 CSI 프록시는 1.19 릴리스와 함께 베타로 승격되었다. 이 CSI 프록시를 사용하면 윈도우의 컨테이너가 권한 있는 스토리지 작업을 수행할 수 있도록 CSI 드라이버를 윈도우에서 실행할 수 있다. 베타에서 윈도우용 CSI 프록시는 직접 연결된 디스크 및 SMB를 사용하는 스토리지 드라이버를 지원한다. +Service account tokens bound to pod is now a stable feature. The feature gates will be removed in 1.21 release. For more information, refer to notes below on the changelogs. -### 대시보드 v2 +### 런타임클래스(RuntimeClass)가 안정 기능으로 전환 -SIG UI는 쿠버네티스 대시보드 애드온 v2를 릴리스했다. [쿠버네티스/대시보드](https://github.com/kubernetes/dashboard/releases) 리포지터리에서 최신 릴리스를 찾을 수 있다. 쿠버네티스 대시보드에는 이제 CRD 지원, 새로운 번역 및 AngularJS의 업데이트된 버전이 포함된다. +The `node.k8s.io` API groups are promoted from `v1beta1` to `v1`. `v1beta1` is now deprecated and will be removed in a future release, please start using `v1`. ([#95718](https://github.com/kubernetes/kubernetes/pull/95718), [@SergeyKanzhelev](https://github.com/SergeyKanzhelev)) [SIG Apps, Auth, Node, Scheduling and Testing] -### 윈도우 컨테이너 지원을 베타로 전환 +### 클라우드 컨트롤러 관리자(Cloud Controller Manager)가 이제 각 클라우드 공급자를 통해서만 제공 -쿠버네티스 1.18에서 처음 도입된 윈도우 컨테이너 지원이 이번 릴리스에서 베타로 전환된다. 여기에는 윈도우 서버 버전 2004에 대한 추가 지원이 포함된다(전체 버전 호환성은 [윈도우용 문서](https://kubernetes.io/docs/setup/production-environment/windows/intro-windows-in-kubernetes/#cri-containerd)에서 찾을 수 있다). - -SIG Windows는 이번 릴리스에 대한 몇 가지 추가 사항도 포함한다. - - DSR(Direct Server Return) 모드 지원으로 많은 서비스를 효율적으로 확장 가능 - - 윈도우 컨테이너가 CPU 한계를 준수 - - 메트릭 및 요약 모음에 대한 성능 개선 - -### 쿠버네티스 지원 기간을 1년으로 늘림 - -쿠버네티스 1.19부터, 쿠버네티스 마이너(minor) 릴리스에 대한 패치 릴리스를 통한 버그 수정 지원이 9개월에서 1년으로 늘었다. - -2019년 초에 워킹그룹(WG) 장기 지원(LTS)에서 실시한 설문 조사에 따르면 쿠버네티스 최종 사용자의 상당 부분이 이전 9개월 지원 기간 내에 업그레이드에 실패한 것으로 보인다. -연간 지원 기간은 최종 사용자가 원하는 대로 '추가적인 기간(쿠션)'을 제공하며, 이러한 방식을 통해 연간 계획 주기와도 더 적절하게 어울린다. +Kubernetes will no longer ship an instance of the Cloud Controller Manager binary. Each Cloud Provider is expected to ship their own instance of this binary. Details for a Cloud Provider to create an instance of such a binary can be found under [here](https://github.com/kubernetes/kubernetes/tree/master/staging/src/k8s.io/cloud-provider/sample). Anyone with questions on building a Cloud Controller Manager should reach out to SIG Cloud Provider. Questions about the Cloud Controller Manager on a Managed Kubernetes solution should go to the relevant Cloud Provider. Questions about the Cloud Controller Manager on a non managed solution can be brought up with SIG Cloud Provider. ## 알려진 이슈 -새로운 스토리지 용량 추적 알파 기능은 WaitForFirstConsumer 볼륨 바인딩 모드 제한의 영향을 받는 것으로 알려져 있다. [#94217](https://github.com/kubernetes/kubernetes/issues/94217) +### kubelet의 요약(Summary) API는 가속기(accelerator) 메트릭을 가지고 있지 않음 +Currently, cadvisor_stats_provider provides AcceleratorStats but cri_stats_provider does not. As a result, when using cri_stats_provider, kubelet's Summary API does not have accelerator metrics. [There is an open work in progress to fix this](https://github.com/kubernetes/kubernetes/pull/96873). ## 긴급 업그레이드 노트 -### (업그레이드 전에 반드시 읽어야 함) +### (주의. 업그레이드 전에 반드시 읽어야 함) -- 조치 필요: 코어 마스터 기본 이미지(kube-controller-manager)를 debian에서 distroless로 전환한다. 스크립트를 사용하여 Flex 볼륨 지원이 필요한 경우 필요한 패키지(bash와 같은)로 자체 이미지를 빌드하라. ([#91329](https://github.com/kubernetes/kubernetes/pull/91329), [@dims](https://github.com/dims)) [SIG Cloud Provider, Release, Storage 및 Testing] -- 조치 필요: --basic-auth-file 플래그를 통한 기본 인증 지원이 제거되었다. 사용자는 유사한 기능을 위해 --token-auth-file 플래그로 마이그레이션해야 한다. ([#89069](https://github.com/kubernetes/kubernetes/pull/89069), [@enj](https://github.com/enj)) [SIG API Machinery] - - Azure blob 디스크 기능(`kind`: `Shared`, `Dedicated`)이 더 이상 사용되지 않는다. `kubernetes.io/azure-disk` 스토리지 클래스에 있는 `kind`: `Managed` 를 사용해야 한다. ([#92905](https://github.com/kubernetes/kubernetes/pull/92905), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider 및 Storage] - - CVE-2020-8559(Medium): 손상된 노드에서 클러스터로 권한 상승. 자세한 내용은 https://github.com/kubernetes/kubernetes/issues/92914 를 참고한다. - API 서버는 더이상 업그레이드 요청에 대해 101이 아닌 응답을 프록시하지 않는다. 이로 인해 101이 아닌 응답 코드로 업그레이드 요청에 응답하는 프록시된 백엔드(확장 API 서버와 같은)가 손상될 수 있다. ([#92941](https://github.com/kubernetes/kubernetes/pull/92941), [@tallclair](https://github.com/tallclair)) [SIG API Machinery] - - Kubeadm은 /var/lib/kubelet/kubeadm-flags.env에서 사용 중단된 '--cgroup-driver' 플래그를 설정하지 않으며, kubelet의 config.yaml 파일에 설정한다. /var/lib/kubelet/kubeadm-flags.env 파일이나 /etc/default/kubelet 파일에 (RPM의 경우 /etc/sysconfig/kubelet) 이 플래그가 있는 경우 제거 후에 KubeletConfiguration을 사용하여 값을 지정해야 한다. ([#90513](https://github.com/kubernetes/kubernetes/pull/90513), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] - - Kubeadm은 이제 ClusterConfiguration에서 사용자가 지정한 etcd 버전을 준수하고 올바르게 사용한다. 사용자가 ClusterConfiguration에 지정된 버전을 유지하지 않으려면, kubeadm-config 컨피그맵을 편집하고 삭제해야 한다. ([#89588](https://github.com/kubernetes/kubernetes/pull/89588), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] - - Kubeadm은 systemd-resolved 서비스가 활성화된 경우에도 사용자가 설정한 resolvConfg 값을 따른다. kubeadm은 더이상 /var/lib/kubelet/kubeadm-flags.env 파일에 있는 '--resolv-conf' 플래그를 설정하지 않는다. /var/lib/kubelet/kubeadm-flags.env 파일이나 /etc/default/kubelet 파일에(RPM의 경우 /etc/sysconfig/kubelet) 이 플래그가 있는 경우 제거 후에 KubeletConfiguration을 사용하여 값을 지정해야 한다. ([#90394](https://github.com/kubernetes/kubernetes/pull/90394), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] - - Kubeadm: "kubeadm init 단계: kubelet-start"가 "kubeconfig" 단계 이후인, 초기화 워크 플로의 후반부로 이동한다. 이렇게 하면 kubeadm이 KubeletConfiguration 구성 설정 파일이 생성된 후에만 kubelet을 시작하고, OpenRC와 같은 초기화 시스템이 kubelet 서비스를 크래시루프(crashloop)할 수 없는 문제가 해결된다. - - 'kubeadm config upload' 명령어는 전체 GA 사용 중단 주기 후에 최종적으로 제거되었다. 만약 그래도 사용해야 할 경우, 대안으로 'kubeadm init phase upload-config'를 사용한다. ([#92610](https://github.com/kubernetes/kubernetes/pull/92610), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] - - kubescheduler.config.k8s.io/v1alpha2를 kubescheduler.config.k8s.io/v1beta1로 업그레이드 - - - `.bindTimeoutSeconds` 가 `VolumeBinding` 에 대한 플러그인 인수의 일부로 이동되었으며, - [프로파일](#profiles)별로 별도 구성할 수 있다. - - `.extenders` 가 API 표준을 충족하도록 업데이트되었다. 다음을 참고한다. - - `.extenders` 디코딩은 대소문자를 구분한다. 모든 필드가 영향을 받는다. - - `.extenders[*].httpTimeout` 은 `metav1.Duration` 유형이다. - - `.extenders[*].enableHttps` 가 `.extenders[*].enableHTTPS` 로 이름이 변경되었다. - - `RequestedToCapacityRatio` 인수 디코딩은 대소문자를 구분한다. 모든 필드가 영향을 받는다. - - `DefaultPodTopologySpread` [플러그인](#scheduling-plugins)이 `SelectorSpread` 로 이름이 변경되었다. - - `Unreserve` 익스텐션 포인트가 프로파일 정의에서 제거되었다. 모든 `Reserve` - 플러그인은 `Unreserve` 호출을 구현한다. - - `.disablePreemption` 이 제거되었다. 사용자는 "DefaultPreemption" PostFilter 플러그인을 - 비활성화하여 선점에 대해 비활성화할 수 있다. ([#91420](https://github.com/kubernetes/kubernetes/pull/91420), [@pancernik](https://github.com/pancernik)) [SIG Scheduling] - -## 종류(Kind)별 변경 +- A bug was fixed in kubelet where exec probe timeouts were not respected. This may result in unexpected behavior since the default timeout (if not specified) is `1s` which may be too small for some exec probes. Ensure that pods relying on this behavior are updated to correctly handle probe timeouts. See [configure probe](https://docs.k8s.io/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes) section of the documentation for more details. + + - This change in behavior may be unexpected for some clusters and can be disabled by turning off the `ExecProbeTimeout` feature gate. This gate will be locked and removed in future releases so that exec probe timeouts are always respected. ([#94115](https://github.com/kubernetes/kubernetes/pull/94115), [@andrewsykim](https://github.com/andrewsykim)) [SIG Node and Testing] +- RuntimeClass feature graduates to General Availability. Promote `node.k8s.io` API groups from `v1beta1` to `v1`. `v1beta1` is now deprecated and will be removed in a future release, please start using `v1`. ([#95718](https://github.com/kubernetes/kubernetes/pull/95718), [@SergeyKanzhelev](https://github.com/SergeyKanzhelev)) [SIG Apps, Auth, Node, Scheduling and Testing] +- API priority and fairness graduated to beta. 1.19 servers with APF turned on should not be run in a multi-server cluster with 1.20+ servers. ([#96527](https://github.com/kubernetes/kubernetes/pull/96527), [@adtac](https://github.com/adtac)) [SIG API Machinery and Testing] +- For CSI drivers, kubelet no longer creates the target_path for NodePublishVolume in accordance with the CSI spec. Kubelet also no longer checks if staging and target paths are mounts or corrupted. CSI drivers need to be idempotent and do any necessary mount verification. ([#88759](https://github.com/kubernetes/kubernetes/pull/88759), [@andyzhangx](https://github.com/andyzhangx)) [SIG Storage] +- Kubeadm: http://git.k8s.io/enhancements/keps/sig-cluster-lifecycle/kubeadm/2067-rename-master-label-taint/README.md ([#95382](https://github.com/kubernetes/kubernetes/pull/95382), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] + - The label applied to control-plane nodes "node-role.kubernetes.io/master" is now deprecated and will be removed in a future release after a GA deprecation period. + - Introduce a new label "node-role.kubernetes.io/control-plane" that will be applied in parallel to "node-role.kubernetes.io/master" until the removal of the "node-role.kubernetes.io/master" label. + - Make "kubeadm upgrade apply" add the "node-role.kubernetes.io/control-plane" label on existing nodes that only have the "node-role.kubernetes.io/master" label during upgrade. + - Please adapt your tooling built on top of kubeadm to use the "node-role.kubernetes.io/control-plane" label. + - The taint applied to control-plane nodes "node-role.kubernetes.io/master:NoSchedule" is now deprecated and will be removed in a future release after a GA deprecation period. + - Apply toleration for a new, future taint "node-role.kubernetes.io/control-plane:NoSchedule" to the kubeadm CoreDNS / kube-dns managed manifests. Note that this taint is not yet applied to kubeadm control-plane nodes. + - Please adapt your workloads to tolerate the same future taint preemptively. + +- Kubeadm: improve the validation of serviceSubnet and podSubnet. + ServiceSubnet has to be limited in size, due to implementation details, and the mask can not allocate more than 20 bits. + PodSubnet validates against the corresponding cluster "--node-cidr-mask-size" of the kube-controller-manager, it fail if the values are not compatible. + kubeadm no longer sets the node-mask automatically on IPv6 deployments, you must check that your IPv6 service subnet mask is compatible with the default node mask /64 or set it accordenly. + Previously, for IPv6, if the podSubnet had a mask lower than /112, kubeadm calculated a node-mask to be multiple of eight and splitting the available bits to maximise the number used for nodes. ([#95723](https://github.com/kubernetes/kubernetes/pull/95723), [@aojea](https://github.com/aojea)) [SIG Cluster Lifecycle] +- The deprecated flag --experimental-kustomize is now removed from kubeadm commands. Use --experimental-patches instead, which was introduced in 1.19. Migration infromation available in --help description for --exprimental-patches. ([#94871](https://github.com/kubernetes/kubernetes/pull/94871), [@neolit123](https://github.com/neolit123)) +- Windows hyper-v container featuregate is deprecated in 1.20 and will be removed in 1.21 ([#95505](https://github.com/kubernetes/kubernetes/pull/95505), [@wawa0210](https://github.com/wawa0210)) [SIG Node and Windows] +- The kube-apiserver ability to serve on an insecure port, deprecated since v1.10, has been removed. The insecure address flags `--address` and `--insecure-bind-address` have no effect in kube-apiserver and will be removed in v1.24. The insecure port flags `--port` and `--insecure-port` may only be set to 0 and will be removed in v1.24. ([#95856](https://github.com/kubernetes/kubernetes/pull/95856), [@knight42](https://github.com/knight42), [SIG API Machinery, Node, Testing]) +- Add dual-stack Services (alpha). This is a BREAKING CHANGE to an alpha API. + It changes the dual-stack API wrt Service from a single ipFamily field to 3 + fields: ipFamilyPolicy (SingleStack, PreferDualStack, RequireDualStack), + ipFamilies (a list of families assigned), and clusterIPs (inclusive of + clusterIP). Most users do not need to set anything at all, defaulting will + handle it for them. Services are single-stack unless the user asks for + dual-stack. This is all gated by the "IPv6DualStack" feature gate. ([#91824](https://github.com/kubernetes/kubernetes/pull/91824), [@khenidak](https://github.com/khenidak)) [SIG API Machinery, Apps, CLI, Network, Node, Scheduling and Testing] +- `TokenRequest` and `TokenRequestProjection` are now GA features. The following flags are required by the API server: + - `--service-account-issuer`, should be set to a URL identifying the API server that will be stable over the cluster lifetime. + - `--service-account-key-file`, set to one or more files containing one or more public keys used to verify tokens. + - `--service-account-signing-key-file`, set to a file containing a private key to use to sign service account tokens. Can be the same file given to `kube-controller-manager` with `--service-account-private-key-file`. ([#95896](https://github.com/kubernetes/kubernetes/pull/95896), [@zshihang](https://github.com/zshihang)) [SIG API Machinery, Auth, Cluster Lifecycle] +- kubeadm: make the command "kubeadm alpha kubeconfig user" accept a "--config" flag and remove the following flags: + - apiserver-advertise-address / apiserver-bind-port: use either localAPIEndpoint from InitConfiguration or controlPlaneEndpoint from ClusterConfiguration. + - cluster-name: use clusterName from ClusterConfiguration + - cert-dir: use certificatesDir from ClusterConfiguration ([#94879](https://github.com/kubernetes/kubernetes/pull/94879), [@knight42](https://github.com/knight42)) [SIG Cluster Lifecycle] +- Resolves non-deterministic behavior of the garbage collection controller when ownerReferences with incorrect data are encountered. Events with a reason of `OwnerRefInvalidNamespace` are recorded when namespace mismatches between child and owner objects are detected. The [kubectl-check-ownerreferences](https://github.com/kubernetes-sigs/kubectl-check-ownerreferences) tool can be run prior to upgrading to locate existing objects with invalid ownerReferences. + - A namespaced object with an ownerReference referencing a uid of a namespaced kind which does not exist in the same namespace is now consistently treated as though that owner does not exist, and the child object is deleted. + - A cluster-scoped object with an ownerReference referencing a uid of a namespaced kind is now consistently treated as though that owner is not resolvable, and the child object is ignored by the garbage collector. ([#92743](https://github.com/kubernetes/kubernetes/pull/92743), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Apps and Testing] + + +## 종류(Kind)별 변경 사항 ### 사용 중단 -- vSphere CSI 드라이버로의 vSphere 인-트리 볼륨 마이그레이션에 대한 지원이 추가되었다. 인-트리 vSphere 볼륨 플러그인은 더이상 사용되지 않으며, 향후 릴리스에서 제거된다. - - vSphere에 쿠버네티스를 자체 배포하는 사용자는 CSIMigration + CSIMigrationSphere 기능을 활성화하고 vSphere CSI 드라이버(https://github.com/kubernetes-sigs/vsphere-csi-driver)를 설치하여 기존 파드 및 PVC 오브젝트에 대한 중단을 방지해야 한다. 사용자는 새 볼륨에 대해 vSphere CSI 드라이버를 직접 사용하기 시작해야 한다. - - vSphere 볼륨용 CSI 마이그레이션 기능을 사용하려면 최소 vSphere vCenter/ESXi 버전이 7.0u1이고 최소 HW 버전이 VM 버전 15여야 한다. - - vSAN 원시 정책 파라미터는 인-트리 vSphere 볼륨 플러그인에서 더이상 사용되지 않으며 향후 릴리스에서 제거될 예정이다. ([#90911](https://github.com/kubernetes/kubernetes/pull/90911), [@divyenpatel](https://github.com/divyenpatel)) [SIG API Machinery, Node 및 Storage] -- Apiextensions.k8s.io/v1beta1은 사용 중단되었으며, apiextensions.k8s.io/v1을 사용한다. ([#90673](https://github.com/kubernetes/kubernetes/pull/90673), [@deads2k](https://github.com/deads2k)) [SIG API Machinery] -- Apiregistration.k8s.io/v1beta1은 사용 중단되었으며, apiregistration.k8s.io/v1을 사용한다. ([#90672](https://github.com/kubernetes/kubernetes/pull/90672), [@deads2k](https://github.com/deads2k)) [SIG API Machinery] -- Authentication.k8s.io/v1beta1 및 authorization.k8s.io/v1beta1은 1.19에서 사용 중단되었으며, v1 level을 사용하고, 1.22에서 제거될 예정이다. ([#90458](https://github.com/kubernetes/kubernetes/pull/90458), [@deads2k](https://github.com/deads2k)) [SIG API Machinery 및 Auth] -- Autoscaling/v2beta1은 사용 중단되었으며, autoscaling/v2beta2를 사용한다. ([#90463](https://github.com/kubernetes/kubernetes/pull/90463), [@deads2k](https://github.com/deads2k)) [SIG Autoscaling] -- Coordination.k8s.io/v1beta1은 1.19에서 사용 중단되어, 1.22에서 제거될 예정이며, 대신 v1을 사용한다. ([#90559](https://github.com/kubernetes/kubernetes/pull/90559), [@deads2k](https://github.com/deads2k)) [SIG Scalability] -- nodeExpansion CSI 호출에 볼륨 기능 및 스테이징 대상 필드가 있는지 확인해야 한다. +- Docker support in the kubelet is now deprecated and will be removed in a future release. The kubelet uses a module called "dockershim" which implements CRI support for Docker and it has seen maintenance issues in the Kubernetes community. We encourage you to evaluate moving to a container runtime that is a full-fledged implementation of CRI (v1alpha1 or v1 compliant) as they become available. ([#94624](https://github.com/kubernetes/kubernetes/pull/94624), [@dims](https://github.com/dims)) [SIG Node] +- Kubeadm: deprecate self-hosting support. The experimental command "kubeadm alpha self-hosting" is now deprecated and will be removed in a future release. ([#95125](https://github.com/kubernetes/kubernetes/pull/95125), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubeadm: graduate the "kubeadm alpha certs" command to a parent command "kubeadm certs". The command "kubeadm alpha certs" is deprecated and will be removed in a future release. Please migrate. ([#94938](https://github.com/kubernetes/kubernetes/pull/94938), [@yagonobre](https://github.com/yagonobre)) [SIG Cluster Lifecycle] +- Kubeadm: remove the deprecated "kubeadm alpha kubelet config enable-dynamic" command. To continue using the feature please defer to the guide for "Dynamic Kubelet Configuration" at k8s.io. This change also removes the parent command "kubeadm alpha kubelet" as there are no more sub-commands under it for the time being. ([#94668](https://github.com/kubernetes/kubernetes/pull/94668), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubeadm: remove the deprecated --kubelet-config flag for the command "kubeadm upgrade node" ([#94869](https://github.com/kubernetes/kubernetes/pull/94869), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubectl: deprecate --delete-local-data ([#95076](https://github.com/kubernetes/kubernetes/pull/95076), [@dougsland](https://github.com/dougsland)) [SIG CLI, Cloud Provider and Scalability] +- Kubelet's deprecated endpoint `metrics/resource/v1alpha1` has been removed, please adopt `metrics/resource`. ([#94272](https://github.com/kubernetes/kubernetes/pull/94272), [@RainbowMango](https://github.com/RainbowMango)) [SIG Instrumentation and Node] +- Removes deprecated scheduler metrics DeprecatedSchedulingDuration, DeprecatedSchedulingAlgorithmPredicateEvaluationSecondsDuration, DeprecatedSchedulingAlgorithmPriorityEvaluationSecondsDuration ([#94884](https://github.com/kubernetes/kubernetes/pull/94884), [@arghya88](https://github.com/arghya88)) [SIG Instrumentation and Scheduling] +- Scheduler alpha metrics binding_duration_seconds and scheduling_algorithm_preemption_evaluation_seconds are deprecated, Both of those metrics are now covered as part of framework_extension_point_duration_seconds, the former as a PostFilter the latter and a Bind plugin. The plan is to remove both in 1.21 ([#95001](https://github.com/kubernetes/kubernetes/pull/95001), [@arghya88](https://github.com/arghya88)) [SIG Instrumentation and Scheduling] +- Support 'controlplane' as a valid EgressSelection type in the EgressSelectorConfiguration API. 'Master' is deprecated and will be removed in v1.22. ([#95235](https://github.com/kubernetes/kubernetes/pull/95235), [@andrewsykim](https://github.com/andrewsykim)) [SIG API Machinery] +- The v1alpha1 PodPreset API and admission plugin has been removed with no built-in replacement. Admission webhooks can be used to modify pods on creation. ([#94090](https://github.com/kubernetes/kubernetes/pull/94090), [@deads2k](https://github.com/deads2k)) [SIG API Machinery, Apps, CLI, Cloud Provider, Scalability and Testing] - NodeStage 및 NodePublish 간에 호출되는 NodeExpandVolume의 동작은 CSI 볼륨에 대해 사용 중단된다. CSI 드라이버는 노드 EXPAND_VOLUME 기능이 있는 경우 NodePublish 후 NodeExpandVolume 호출을 지원해야 한다. ([#86968](https://github.com/kubernetes/kubernetes/pull/86968), [@gnufied](https://github.com/gnufied)) [SIG Storage] -- 기능: azure 디스크 마이그레이션이 1.19에서 베타 버전으로 변경된다. 기능 게이트 CSIMigration이 베타(기본적으로 설정되는)로 전환되며, CSIMigrationAzureDisk가 베타(AzureDisk CSI 드라이버가 설치되야 하므로 기본적으로 설정되어 있지 않은)로 전환된다. - 인-트리 AzureDisk 플러그인 "kubernetes.io/azure-disk"는 이제 사용 중단되며, 1.23에서 제거된다. 사용자는 CSIMigration + CSIMigrationAzureDisk 기능을 사용하도록 설정하고 AzureDisk CSI 드라이버(https://github.com/kubernetes-sigs/azuredisk-csi-driver)를 설치하여 해당 시점에 기존 파드 및 PVC 오브젝트가 중단되지 않도록 해야 한다. - 사용자는 모든 새 볼륨에 대해 AzureDisk CSI 드라이버를 직접 사용해야 한다. ([#90896](https://github.com/kubernetes/kubernetes/pull/90896), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider 및 Storage] -- Kube-apiserver: componentstatus API가 사용 중단된다. 이 API는 etcd, kube-scheduler 및 kube-controller-manager 컴포넌트의 상태를 제공했지만, 해당 컴포넌트가 API 서버에 대해 로컬이며, kube-scheduler 및 kube-controller-manager가 보안되지 않은 상태의 엔드포인트를 노출한 경우에만 동작했다. 이 API 대신 etcd의 상태 확인은 kube-apiserver의 상태 확인에 포함되고, kube-scheduler/kube-controller-manager 상태 확인은 해당 컴포넌트의 상태 엔드포인트에 대해 직접 수행될 수 있다. ([#93570](https://github.com/kubernetes/kubernetes/pull/93570), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Apps 및 Cluster Lifecycle] -- Kubeadm: `kubeadm config view` 명령은 사용 중단되며, 기능 릴리스에서 제거될 예정이다. `kubectl get cm -o yaml -n kube-system kubeadm-config` 를 사용하여 kubeadm 설정을 직접 가져와야 한다. ([#92740](https://github.com/kubernetes/kubernetes/pull/92740), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] -- Kubeadm: "kubeadm alpha kubelet config enable-dynamic" 명령이 사용 중단된다. 이 기능을 계속 사용하려면 k8s.io에서 "동적 Kubelet 구성"을 참조한다. ([#92881](https://github.com/kubernetes/kubernetes/pull/92881), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Kubeadm: `--experimental-kustomize` 기능이 사용 중단되며, 대신 `--experimental-patches` 기능을 사용한다. 지원되는 패치 형식은 "kubectl patch"와 동일하다. 디렉터리에서 파일로 읽히며, 초기화/조인/업그레이드 도중에 kubeadm 컴포넌트에 적용될 수 있다. 당분간은 정적 파드의 패치만 지원된다. ([#92017](https://github.com/kubernetes/kubernetes/pull/92017), [@neolit123](https://github.com/neolit123)) -- Kubeadm: "kubeadm alpha certs renew" 명령어에 대해 사용 중단된 "--use-api" 플래그가 제거되었다. ([#90143](https://github.com/kubernetes/kubernetes/pull/90143), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- 쿠버네티스는 더이상 hyperkube 이미지 빌드를 지원하지 않는다. ([#88676](https://github.com/kubernetes/kubernetes/pull/88676), [@dims](https://github.com/dims)) [SIG Cluster Lifecycle 및 Release] -- kubectl get 명령어에서 --export 플래그가 제거되었다. ([#88649](https://github.com/kubernetes/kubernetes/pull/88649), [@oke-py](https://github.com/oke-py)) [SIG CLI 및 Testing] -- 스케줄러의 알파 기능인 'ResourceLimitsPriorityFunction'은 사용을 많이 하지 않아 완전히 제거되었다. ([#91883](https://github.com/kubernetes/kubernetes/pull/91883), [@SataQiu](https://github.com/SataQiu)) [SIG Scheduling 및 Testing] -- Storage.k8s.io/v1beta1은 사용 중단되었으며, 대신 storage.k8s.io/v1이 사용된다. ([#90671](https://github.com/kubernetes/kubernetes/pull/90671), [@deads2k](https://github.com/deads2k)) [SIG Storage] ### API 변경 -- CSI드라이버(CSIDriver)가 볼륨 소유권 및 권한 수정을 지원하는지 여부를 지정할 수 있도록, 새로운 알파 수준의 필드인, `SupportsFsGroup` 가 도입되었다. 이 필드를 사용하려면 `CSIVolumeSupportFSGroup` 기능 게이트를 활성화해야 한다. ([#92001](https://github.com/kubernetes/kubernetes/pull/92001), [@huffmanca](https://github.com/huffmanca)) [SIG API Machinery, CLI 및 Storage] -- 사용 중단된 어노테이션을 신규 API 서버의 필드와 동기화하기 위해 seccomp 프로파일에 대한 파드 버전 비대칭 전략이 추가되었다. 자세한 설명은 [KEP의](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/20190717-seccomp-ga.md#version-skew-strategy) 해당 섹션을 참고한다. ([#91408](https://github.com/kubernetes/kubernetes/pull/91408), [@saschagrunert](https://github.com/saschagrunert)) [SIG Apps, Auth, CLI 및 Node] -- Kubelet에서 수집한 가속기/GPU 메트릭을 비활성화하는 기능이 추가되었다. ([#91930](https://github.com/kubernetes/kubernetes/pull/91930), [@RenaudWasTaken](https://github.com/RenaudWasTaken)) [SIG Node] -- 이제 어드미션 웹훅은 어드미션 리뷰 응답의 `.response.warnings` 필드를 사용하여 API 클라이언트에 표시되는 경고 메시지를 반환할 수 있다. ([#92667](https://github.com/kubernetes/kubernetes/pull/92667), [@liggitt](https://github.com/liggitt)) [SIG API Machinery 및 Testing] -- CertificateSigningRequest API의 조건이 업데이트되었다. - - `status` 필드가 추가되었다. 이 필드의 기본값은 `True` 이며 `Approved`, `Denied` 및 `Failed` 조건에 대해서만 `True` 로 설정될 수 있다. - - `lastTransitionTime` 필드가 추가되었다. - - 서명자가 영구적인 실패를 표시할 수 있도록 `Failed` 조건 유형이 추가되었다. 이 조건은 `certificatesigningrequests/status` 하위 리소스를 통해 추가될 수 있다. - - `Approved` 및 `Denied` 조건은 상호 배타적이다. - - `Approved`, `Denied` , `Failed` 조건은 더이상 CSR에서 제거할 수 없다. ([#90191](https://github.com/kubernetes/kubernetes/pull/90191), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Apps, Auth, CLI 및 Node] -- 클러스터 관리자는 이제 kubelet 구성 파일에서 enableSystemLogHandler를 false로 설정하여 kubelet에서 /logs 엔드포인트를 끌 수 있다. enableSystemLogHandler는 오직 enableDebuggingHandlers도 true로 설정된 경우에만 true로 설정할 수 있다. ([#87273](https://github.com/kubernetes/kubernetes/pull/87273), [@SaranBalaji90](https://github.com/SaranBalaji90)) [SIG Node] -- 사용자 정의 엔드포인트는 이제 새로운 EndpointSliceMirroring 컨트롤러에 의해 엔드포인트슬라이스에 미러링된다. ([#91637](https://github.com/kubernetes/kubernetes/pull/91637), [@robscott](https://github.com/robscott)) [SIG API Machinery, Apps, Auth, Cloud Provider, Instrumentation, Network 및 Testing] -- CustomResourceDefinitions은 `spec.versions[*].deprecated` 를 `true` 로 설정하여 버전을 사용 중단됨으로 표시하고, 선택적으로 `spec.versions[*].deprecationWarning` 필드로 기본 지원 중단 경고를 재정의할 수 있도록 지원한다. ([#92329](https://github.com/kubernetes/kubernetes/pull/92329), [@liggitt](https://github.com/liggitt)) [SIG API Machinery] -- EnvVarSource api 문서의 버그가 수정되었다. ([#91194](https://github.com/kubernetes/kubernetes/pull/91194), [@wawa0210](https://github.com/wawa0210)) [SIG Apps] -- "Too large resource version" 오류에서 복구할 수 없는 리플렉터(reflector)의 버그를 수정하였다. ([#92537](https://github.com/kubernetes/kubernetes/pull/92537), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery] -- 고침: 이제 로그 타임스탬프에 고정 너비를 유지하기 위해 후행에 0이 포함된다. ([#91207](https://github.com/kubernetes/kubernetes/pull/91207), [@iamchuckss](https://github.com/iamchuckss)) [SIG Apps 및 Node] -- `GenericEphemeralVolume` 기능 게이트의 새로운 알파 기능인 일반 임시 볼륨은 `EmptyDir` 볼륨에 대한 보다 유연한 대안을 제공한다. `EmptyDir` 과 마찬가지로 쿠버네티스에 의해 각 파드에 대한 볼륨이 자동으로 생성되고 삭제된다. 그러나 일반적인 프로비저닝 프로세스(`PersistentVolumeClaim`)를 사용하기 때문에, 스토리지는 타사 스토리지 공급 업체에서 제공할 수 있으며, 일반적인 모든 볼륨 기능이 작동한다. 볼륨은 비워둘 필요가 없다. 예를 들어, 스냅샷으로부터의 복원이 지원된다. ([#92784](https://github.com/kubernetes/kubernetes/pull/92784), [@pohly](https://github.com/pohly)) [SIG API Machinery, Apps, Auth, CLI, Instrumentation, Node, Scheduling, Storage 및 Testing] -- 이제 쿠버네티스 빌드를 위하여 최소 Go1.14.4 이상의 버전이 필요하다. ([#92438](https://github.com/kubernetes/kubernetes/pull/92438), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Release, Storage 및 Testing] -- kubectl edit 명령어에서 managedFields가 숨겨졌다. ([#91946](https://github.com/kubernetes/kubernetes/pull/91946), [@soltysh](https://github.com/soltysh)) [SIG CLI] -- K8s.io/apimachinery - scheme.Convert()는 이제 명시적으로 등록된 변환만을 사용한다. 기본 리플렉션 기반 변환은 더이상 사용할 수 없다. `+k8s:conversion-gen` 태그는 `k8s.io/code-generator` 컴포넌트와 함께 사용하여 변환을 생성할 수 있다. ([#90018](https://github.com/kubernetes/kubernetes/pull/90018), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery, Apps 및 Testing] -- Kube-proxy: 포트 바인딩 실패를 치명적인 오류로 처리하기 위해 `--bind-address-hard-fail` 플래그가 추가되었다. ([#89350](https://github.com/kubernetes/kubernetes/pull/89350), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle 및 Network] -- Kubebuilder 유효성 검사 태그는 CRD 생성을 위해 metav1.Condition에 설정된다. ([#92660](https://github.com/kubernetes/kubernetes/pull/92660), [@damemi](https://github.com/damemi)) [SIG API Machinery] -- Kubelet의 --runonce 옵션은 이제 Kubelet의 설정 파일에서 `runOnce` 로도 사용할 수 있다. ([#89128](https://github.com/kubernetes/kubernetes/pull/89128), [@vincent178](https://github.com/vincent178)) [SIG Node] -- Kubelet: 구조화된 로깅을 지원하기 위해 '--logging-format' 플래그가 추가되었다. ([#91532](https://github.com/kubernetes/kubernetes/pull/91532), [@afrouzMashaykhi](https://github.com/afrouzMashaykhi)) [SIG API Machinery, Cluster Lifecycle, Instrumentation 및 Node] -- 쿠버네티스는 이제 golang 1.15.0-rc.1로 빌드된다. - - 주체 대체 이름(Subject Alternative Names)이 없을 때, 인증서를 제공하는 X.509의 CommonName 필드를 호스트 이름으로 처리하는, 더이상 사용되지 않는 레거시 동작은 이제 기본적으로 비활성화된다. GODEBUG 환경 변수에 x509ignoreCN=0 값을 추가하여 일시적으로 다시 활성화할 수도 있다. ([#93264](https://github.com/kubernetes/kubernetes/pull/93264), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Release, Scalability, Storage 및 Testing] -- 변경할 수 없는 시크릿/컨피그맵 기능을 베타로 승격하고 기본적으로 기능이 활성화된다. - 이를 통해 시크릿 또는 컨피그맵 오브젝트의 `Immutable` 필드를 설정하여 내용을 immutable로 표시할 수 있다. ([#89594](https://github.com/kubernetes/kubernetes/pull/89594), [@wojtek-t](https://github.com/wojtek-t)) [SIG Apps 및 Testing] -- 스케줄 구성 `KubeSchedulerConfiguration` 에서 `BindTimeoutSeconds` 가 제거되었다. ([#91580](https://github.com/kubernetes/kubernetes/pull/91580), [@cofyc](https://github.com/cofyc)) [SIG Scheduling 및 Testing] -- kubescheduler.config.k8s.io/v1alpha1이 제거되었다. ([#89298](https://github.com/kubernetes/kubernetes/pull/89298), [@gavinfish](https://github.com/gavinfish)) [SIG Scheduling] -- 예약에 실패한 예약 플러그인은 예약 해제 익스텐션 포인트를 트리거하게 된다. ([#92391](https://github.com/kubernetes/kubernetes/pull/92391), [@adtac](https://github.com/adtac)) [SIG Scheduling 및 Testing] -- 예전 API 클라이언트가 제출한 업데이트/패치 요청에서 처리하는 `metadata.managedFields` 의 회귀 문제가 해결되었다. ([#91748](https://github.com/kubernetes/kubernetes/pull/91748), [@apelisse](https://github.com/apelisse)) -- 스케줄러: 바인딩되지 않은 볼륨이 있는 파드를 예약하기 전에 선택적으로 사용 가능한 스토리지 용량을 확인한다. (신규 기능 게이트인 `CSIStorageCapacity` 가 있는 알파 기능, CSI 드라이버에서만 작동하며, CSI 드라이버 배포의 기능 지원에 따라 상이하다.) ([#92387](https://github.com/kubernetes/kubernetes/pull/92387), [@pohly](https://github.com/pohly)) [SIG API Machinery, Apps, Auth, Scheduling, Storage 및 Testing] -- Seccomp 지원이 GA로 전환되었다. 새로운 `seccompProfile` 필드가 파드 및 컨테이너의 securityContext 오브젝트에 추가된다. `seccomp.security.alpha.kubernetes.io/pod` 및 `container.seccomp.security.alpha.kubernetes.io/...` 어노테이션에 대한 지원은 사용 중단되며, v1.22에서 제거된다. ([#91381](https://github.com/kubernetes/kubernetes/pull/91381), [@pjbgf](https://github.com/pjbgf)) [SIG Apps, Auth, Node, Release, Scheduling 및 Testing] -- ServiceAppProtocol 기능 게이트는 이제 베타 버전이며 기본적으로 활성화되어 서비스 및 엔드포인트에 새 AppProtocol 필드를 추가한다. ([#90023](https://github.com/kubernetes/kubernetes/pull/90023), [@robscott](https://github.com/robscott)) [SIG Apps 및 Network] -- SetHostnameAsFQDN은 PodSpec의 새 필드이다. true로 설정하면, - 파드의 정규화된 도메인 이름(FQDN)이 해당 컨테이너의 호스트 이름으로 설정된다. - 리눅스 컨테이너에서 이는 커널의 hostname 필드(utsname 구조체의 nodename 필드)에 - FQDN을 설정하는 것을 의미한다. 윈도우 컨테이너에서 이는 - 레지스트리 키 HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters에 대한 호스트 이름의 레지스트리 값을 FQDN으로 설정하는 것을 의미한다. - 파드에 FQDN이 없는 경우에는 아무런 효과가 없다. ([#91699](https://github.com/kubernetes/kubernetes/pull/91699), [@javidiaz](https://github.com/javidiaz)) [SIG Apps, Network, Node 및 Testing] -- The CertificateSigningRequest API는 다음의 변경 사항과 함께 certificates.k8s.io/v1로 승격되었다. - - 이제 `spec.signerName` 이 필요하며, `certificates.k8s.io/v1` API를 통해 `kubernetes.io/legacy-unknown` 요청을 생성하는것이 허용되지 않는다. - - `spec.usages` 가 필요하며, 중복값을 포함할 수 없으며, 알려진 사용법만 포함해야 한다. - - `status.conditions` 는 중복 유형을 포함할 수 없다. - - `status.conditions[*].status` 가 필요하다. - - `status.certificate` 는 PEM으로 반드시 인코딩되어야 하며, CERTIFICATE 블록만을 포함해야 한다. ([#91685](https://github.com/kubernetes/kubernetes/pull/91685), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Architecture, Auth, CLI 및 Testing] -- 이제 HugePageStorageMediumSize 기능 게이트는 기본적으로 켜져 있으며, 컨테이너 수준에서 여러 크기의 huge page 리소스를 사용할 수 있다. ([#90592](https://github.com/kubernetes/kubernetes/pull/90592), [@bart0sh](https://github.com/bart0sh)) [SIG Node] -- Kubelet의 --node-status-max-images 옵션은 이제 Kubelet 구성 파일의 nodeStatusMaxImage 필드를 통해 사용할 수 있다. ([#91275](https://github.com/kubernetes/kubernetes/pull/91275), [@knabben](https://github.com/knabben)) [SIG Node] -- Kubelet의 --seccomp-profile-root 옵션은 사용 중단된 것으로 표시된다. ([#91182](https://github.com/kubernetes/kubernetes/pull/91182), [@knabben](https://github.com/knabben)) [SIG Node] -- Kubelet의 `--bootstrap-checkpoint-path` 옵션이 제거되었다. ([#91577](https://github.com/kubernetes/kubernetes/pull/91577), [@knabben](https://github.com/knabben)) [SIG Apps 및 Node] -- Kubelet의 `--cloud-provider` 및 `--cloud-config` 옵션은 사용 중단된 것으로 표시된다. ([#90408](https://github.com/kubernetes/kubernetes/pull/90408), [@knabben](https://github.com/knabben)) [SIG Cloud Provider 및 Node] -- Kubelet의 `--enable-server` 및 `--provider-id` 옵션은 이제 각각 Kubelet 구성 파일의 `enableServer` 및 `providerID` 필드를 통해 사용할 수 있다. ([#90494](https://github.com/kubernetes/kubernetes/pull/90494), [@knabben](https://github.com/knabben)) [SIG Node] -- Kubelet의 `--kernel-memcg-notification` 옵션은 이제 Kubelet 구성 파일의 kernelMemcgNotification 필드를 통해 사용할 수 있다. ([#91863](https://github.com/kubernetes/kubernetes/pull/91863), [@knabben](https://github.com/knabben)) [SIG Cloud Provider, Node 및 Testing] -- Kubelet의 `--really-crash-for-testing` 및 `--chaos-chance` 옵션은 사용 중단된 것으로 표시된다. ([#90499](https://github.com/kubernetes/kubernetes/pull/90499), [@knabben](https://github.com/knabben)) [SIG Node] -- Kubelet의 `--volume-plugin-dir` 옵션은 이제 Kubelet 구성 파일의 `VolumePluginDir` 필드를 통해 사용할 수 있다. ([#88480](https://github.com/kubernetes/kubernetes/pull/88480), [@savitharaghunathan](https://github.com/savitharaghunathan)) [SIG Node] -- `DefaultIngressClass` 기능은 이제 GA로 전환되었다. `--feature-gate` 파라미터는 1.20에서 제거된다. ([#91957](https://github.com/kubernetes/kubernetes/pull/91957), [@cmluciano](https://github.com/cmluciano)) [SIG API Machinery, Apps, Network 및 Testing] -- 알파 `DynamicAuditing` 기능 게이트 및 `auditregistration.k8s.io/v1alpha1` API가 제거되었으며 더이상 지원되지 않는다. ([#91502](https://github.com/kubernetes/kubernetes/pull/91502), [@deads2k](https://github.com/deads2k)) [SIG API Machinery, Auth 및 Testing] -- kube-controller-manager 관리 서명자는 이제 고유한 서명 인증서와 키를 소유할 수 있다. `--cluster-signing-[signer-name]-{cert,key}-file` 에 대한 도움말을 참고한다. `--cluster-signing-{cert,key}-file` 는 여전히 기본값이다. ([#90822](https://github.com/kubernetes/kubernetes/pull/90822), [@deads2k](https://github.com/deads2k)) [SIG API Machinery, Apps 및 Auth] -- v1.14부터 사용 중단된, 사용하지 않는 `series.state` 필드는 `events.k8s.io/v1beta1` 및 `v1` 이벤트 유형에서 삭제되었다. ([#90449](https://github.com/kubernetes/kubernetes/pull/90449), [@wojtek-t](https://github.com/wojtek-t)) [SIG Apps] -- 스케줄러 플러그인에 대한 예약 해제 익스텐션 포인트가 예약 익스텐션 포인트로 병합되었다. ([#92200](https://github.com/kubernetes/kubernetes/pull/92200), [@adtac](https://github.com/adtac)) [SIG Scheduling 및 Testing] -- Golang 버전이 v1.14.4로 변경되었다. ([#88638](https://github.com/kubernetes/kubernetes/pull/88638), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery, Cloud Provider, Release 및 Testing] -- Service.Spec.IPFamily에 대한 API 문서를 변경하여, 이중 스택 기능이 - GA 되기 전에 정확한 의미가 변경될 수 있으며, 사용자는 - 기존 서비스가 IPv4, IPv6 혹은 이중 스택인지 확인하기 위해 - IPFamily가 아닌 ClusterIP 또는 엔드포인트를 살펴봐야 한다. ([#91527](https://github.com/kubernetes/kubernetes/pull/91527), [@danwinship](https://github.com/danwinship)) [SIG Apps 및 Network] -- 사용자는 리소스 그룹을 무시하도록 리소스 접두사를 구성할 수 있다. ([#88842](https://github.com/kubernetes/kubernetes/pull/88842), [@angao](https://github.com/angao)) [SIG Node 및 Scheduling] -- `Ingress` 및 `IngressClass` 리소스가 `networking.k8s.io/v1` 로 변경되었다. `extensions/v1beta1` 및 `networking.k8s.io/v1beta1` API 버전의 인그레스 및 인그레스클래스 유형은 사용 중단되었으며, 더이상 1.22 이상에서 제공되지 않는다. 지속형 오브젝트는 `networking.k8s.io/v1` API를 통해 접근할 수 있다. v1 인그레스 오브젝트의 주목할만한 변경 사항은 다음과 같다. (v1beta1 필드 이름은 변경되지 않았다.) - - `spec.backend` -> `spec.defaultBackend` - - `serviceName` -> `service.name` - - `servicePort` -> `service.port.name` (string 값에 대하여) - - `servicePort` -> `service.port.number` (numeric 값에 대하여) - - `pathType` 은 더이상 v1에서 기본값을 갖지 않는다. "Exact", "Prefix" 또는 "ImplementationSpecific" 중에서 지정되어야 한다. - 기타 인그레스 API 변경 사항: - - 백엔드는 이제 리소스 또는 서비스 백엔드가 될 수 있다. - - `path` 는 더이상 유효한 정규 표현식이 아니어도 된다. ([#89778](https://github.com/kubernetes/kubernetes/pull/89778), [@cmluciano](https://github.com/cmluciano)) [SIG API Machinery, Apps, CLI, Network 및 Testing] -- `NodeResourcesLeastAllocated` 및 `NodeResourcesMostAllocated` 플러그인은 이제 CPU 및 메모리에 대한 사용자 정의 가중치를 지원한다. [#90544](https://github.com/kubernetes/kubernetes/pull/90544), [@chendave](https://github.com/chendave)) [SIG Scheduling] -- v1beta1 버전의 스케줄러 구성 설정 API에 `PostFilter` 유형이 추가되었다. ([#91547](https://github.com/kubernetes/kubernetes/pull/91547), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling] -- `RequestedToCapacityRatioArgs` 인코딩은 이제 엄격하게 작동한다. ([#91603](https://github.com/kubernetes/kubernetes/pull/91603), [@pancernik](https://github.com/pancernik)) [SIG Scheduling] -- `v1beta1` 스케줄러의 `Extender` 인코딩은 대소문자를 구분하며(`v1alpha1`/`v1alpha2` 는 대소문자를 구분하지 않았다.), `httpTimeout` 필드는 기간 인코딩을 사용하며(예를 들어, 1초는 `"1s"` 로 지정된다.), `v1alpha1`/`v1alpha2` 의 `enableHttps` 필드 이름이 `enableHTTPS` 로 변경되었다. ([#91625](https://github.com/kubernetes/kubernetes/pull/91625), [@pancernik](https://github.com/pancernik)) [SIG Scheduling] +- `TokenRequest` and `TokenRequestProjection` features have been promoted to GA. This feature allows generating service account tokens that are not visible in Secret objects and are tied to the lifetime of a Pod object. See https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection for details on configuring and using this feature. The `TokenRequest` and `TokenRequestProjection` feature gates will be removed in v1.21. + - kubeadm's kube-apiserver Pod manifest now includes the following flags by default "--service-account-key-file", "--service-account-signing-key-file", "--service-account-issuer". ([#93258](https://github.com/kubernetes/kubernetes/pull/93258), [@zshihang](https://github.com/zshihang)) [SIG API Machinery, Auth, Cluster Lifecycle, Storage and Testing] +- A new `nofuzz` go build tag now disables gofuzz support. Release binaries enable this. ([#92491](https://github.com/kubernetes/kubernetes/pull/92491), [@BenTheElder](https://github.com/BenTheElder)) [SIG API Machinery] +- Add WindowsContainerResources and Annotations to CRI-API UpdateContainerResourcesRequest ([#95741](https://github.com/kubernetes/kubernetes/pull/95741), [@katiewasnothere](https://github.com/katiewasnothere)) [SIG Node] +- Add a `serving` and `terminating` condition to the EndpointSlice API. + `serving` tracks the readiness of endpoints regardless of their terminating state. This is distinct from `ready` since `ready` is only true when pods are not terminating. + `terminating` is true when an endpoint is terminating. For pods this is any endpoint with a deletion timestamp. ([#92968](https://github.com/kubernetes/kubernetes/pull/92968), [@andrewsykim](https://github.com/andrewsykim)) [SIG Apps and Network] +- Add dual-stack Services (alpha). This is a BREAKING CHANGE to an alpha API. + It changes the dual-stack API wrt Service from a single ipFamily field to 3 + fields: ipFamilyPolicy (SingleStack, PreferDualStack, RequireDualStack), + ipFamilies (a list of families assigned), and clusterIPs (inclusive of + clusterIP). Most users do not need to set anything at all, defaulting will + handle it for them. Services are single-stack unless the user asks for + dual-stack. This is all gated by the "IPv6DualStack" feature gate. ([#91824](https://github.com/kubernetes/kubernetes/pull/91824), [@khenidak](https://github.com/khenidak)) [SIG API Machinery, Apps, CLI, Network, Node, Scheduling and Testing] +- Add support for hugepages to downward API ([#86102](https://github.com/kubernetes/kubernetes/pull/86102), [@derekwaynecarr](https://github.com/derekwaynecarr)) [SIG API Machinery, Apps, CLI, Network, Node, Scheduling and Testing] +- Adds kubelet alpha feature, `GracefulNodeShutdown` which makes kubelet aware of node system shutdowns and result in graceful termination of pods during a system shutdown. ([#96129](https://github.com/kubernetes/kubernetes/pull/96129), [@bobbypage](https://github.com/bobbypage)) [SIG Node] +- AppProtocol is now GA for Endpoints and Services. The ServiceAppProtocol feature gate will be deprecated in 1.21. ([#96327](https://github.com/kubernetes/kubernetes/pull/96327), [@robscott](https://github.com/robscott)) [SIG Apps and Network] +- Automatic allocation of NodePorts for services with type LoadBalancer can now be disabled by setting the (new) parameter + Service.spec.allocateLoadBalancerNodePorts=false. The default is to allocate NodePorts for services with type LoadBalancer which is the existing behavior. ([#92744](https://github.com/kubernetes/kubernetes/pull/92744), [@uablrek](https://github.com/uablrek)) [SIG Apps and Network] +- Certain fields on Service objects will be automatically cleared when changing the service's `type` to a mode that does not need those fields. For example, changing from type=LoadBalancer to type=ClusterIP will clear the NodePort assignments, rather than forcing the user to clear them. ([#95196](https://github.com/kubernetes/kubernetes/pull/95196), [@thockin](https://github.com/thockin)) [SIG API Machinery, Apps, Network and Testing] +- Document that ServiceTopology feature is required to use `service.spec.topologyKeys`. ([#96528](https://github.com/kubernetes/kubernetes/pull/96528), [@andrewsykim](https://github.com/andrewsykim)) [SIG Apps] +- EndpointSlice has a new NodeName field guarded by the EndpointSliceNodeName feature gate. + - EndpointSlice topology field will be deprecated in an upcoming release. + - EndpointSlice "IP" address type is formally removed after being deprecated in Kubernetes 1.17. + - The discovery.k8s.io/v1alpha1 API is deprecated and will be removed in Kubernetes 1.21. ([#96440](https://github.com/kubernetes/kubernetes/pull/96440), [@robscott](https://github.com/robscott)) [SIG API Machinery, Apps and Network] +- External facing API podresources is now available under k8s.io/kubelet/pkg/apis/ ([#92632](https://github.com/kubernetes/kubernetes/pull/92632), [@RenaudWasTaken](https://github.com/RenaudWasTaken)) [SIG Node and Testing] +- Fewer candidates are enumerated for preemption to improve performance in large clusters. ([#94814](https://github.com/kubernetes/kubernetes/pull/94814), [@adtac](https://github.com/adtac)) +- Fix conversions for custom metrics. ([#94481](https://github.com/kubernetes/kubernetes/pull/94481), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Instrumentation] +- GPU metrics provided by kubelet are now disabled by default. ([#95184](https://github.com/kubernetes/kubernetes/pull/95184), [@RenaudWasTaken](https://github.com/RenaudWasTaken)) +- If BoundServiceAccountTokenVolume is enabled, cluster admins can use metric `serviceaccount_stale_tokens_total` to monitor workloads that are depending on the extended tokens. If there are no such workloads, turn off extended tokens by starting `kube-apiserver` with flag `--service-account-extend-token-expiration=false` ([#96273](https://github.com/kubernetes/kubernetes/pull/96273), [@zshihang](https://github.com/zshihang)) [SIG API Machinery and Auth] +- Introduce alpha support for exec-based container registry credential provider plugins in the kubelet. ([#94196](https://github.com/kubernetes/kubernetes/pull/94196), [@andrewsykim](https://github.com/andrewsykim)) [SIG Node and Release] +- Introduces a metric source for HPAs which allows scaling based on container resource usage. ([#90691](https://github.com/kubernetes/kubernetes/pull/90691), [@arjunrn](https://github.com/arjunrn)) [SIG API Machinery, Apps, Autoscaling and CLI] +- Kube-apiserver now deletes expired kube-apiserver Lease objects: + - The feature is under feature gate `APIServerIdentity`. + - A flag is added to kube-apiserver: `identity-lease-garbage-collection-check-period-seconds` ([#95895](https://github.com/kubernetes/kubernetes/pull/95895), [@roycaihw](https://github.com/roycaihw)) [SIG API Machinery, Apps, Auth and Testing] +- Kube-controller-manager: volume plugins can be restricted from contacting local and loopback addresses by setting `--volume-host-allow-local-loopback=false`, or from contacting specific CIDR ranges by setting `--volume-host-cidr-denylist` (for example, `--volume-host-cidr-denylist=127.0.0.1/28,feed::/16`) ([#91785](https://github.com/kubernetes/kubernetes/pull/91785), [@mattcary](https://github.com/mattcary)) [SIG API Machinery, Apps, Auth, CLI, Network, Node, Storage and Testing] +- Migrate scheduler, controller-manager and cloud-controller-manager to use LeaseLock ([#94603](https://github.com/kubernetes/kubernetes/pull/94603), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery, Apps, Cloud Provider and Scheduling] +- Modify DNS-1123 error messages to indicate that RFC 1123 is not followed exactly ([#94182](https://github.com/kubernetes/kubernetes/pull/94182), [@mattfenwick](https://github.com/mattfenwick)) [SIG API Machinery, Apps, Auth, Network and Node] +- Move configurable fsgroup change policy for pods to beta ([#96376](https://github.com/kubernetes/kubernetes/pull/96376), [@gnufied](https://github.com/gnufied)) [SIG Apps and Storage] +- New flag is introduced, i.e. --topology-manager-scope=container|pod. + The default value is the "container" scope. ([#92967](https://github.com/kubernetes/kubernetes/pull/92967), [@cezaryzukowski](https://github.com/cezaryzukowski)) [SIG Instrumentation, Node and Testing] +- New parameter `defaultingType` for `PodTopologySpread` plugin allows to use k8s defined or user provided default constraints ([#95048](https://github.com/kubernetes/kubernetes/pull/95048), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] +- NodeAffinity plugin can be configured with AddedAffinity. ([#96202](https://github.com/kubernetes/kubernetes/pull/96202), [@alculquicondor](https://github.com/alculquicondor)) [SIG Node, Scheduling and Testing] +- Promote RuntimeClass feature to GA. + Promote node.k8s.io API groups from v1beta1 to v1. ([#95718](https://github.com/kubernetes/kubernetes/pull/95718), [@SergeyKanzhelev](https://github.com/SergeyKanzhelev)) [SIG Apps, Auth, Node, Scheduling and Testing] +- Reminder: The labels "failure-domain.beta.kubernetes.io/zone" and "failure-domain.beta.kubernetes.io/region" are deprecated in favor of "topology.kubernetes.io/zone" and "topology.kubernetes.io/region" respectively. All users of the "failure-domain.beta..." labels should switch to the "topology..." equivalents. ([#96033](https://github.com/kubernetes/kubernetes/pull/96033), [@thockin](https://github.com/thockin)) [SIG API Machinery, Apps, CLI, Cloud Provider, Network, Node, Scheduling, Storage and Testing] +- Server Side Apply now treats LabelSelector fields as atomic (meaning the entire selector is managed by a single writer and updated together), since they contain interrelated and inseparable fields that do not merge in intuitive ways. ([#93901](https://github.com/kubernetes/kubernetes/pull/93901), [@jpbetz](https://github.com/jpbetz)) [SIG API Machinery, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Storage and Testing] +- Services will now have a `clusterIPs` field to go with `clusterIP`. `clusterIPs[0]` is a synonym for `clusterIP` and will be syncronized on create and update operations. ([#95894](https://github.com/kubernetes/kubernetes/pull/95894), [@thockin](https://github.com/thockin)) [SIG Network] +- The ServiceAccountIssuerDiscovery feature gate is now Beta and enabled by default. ([#91921](https://github.com/kubernetes/kubernetes/pull/91921), [@mtaufen](https://github.com/mtaufen)) [SIG Auth] +- The status of v1beta1 CRDs without "preserveUnknownFields:false" now shows a violation, "spec.preserveUnknownFields: Invalid value: true: must be false". ([#93078](https://github.com/kubernetes/kubernetes/pull/93078), [@vareti](https://github.com/vareti)) +- The usage of mixed protocol values in the same LoadBalancer Service is possible if the new feature gate MixedProtocolLBService is enabled. The feature gate is disabled by default. The user has to enable it for the API Server. ([#94028](https://github.com/kubernetes/kubernetes/pull/94028), [@janosi](https://github.com/janosi)) [SIG API Machinery and Apps] +- This PR will introduce a feature gate CSIServiceAccountToken with two additional fields in `CSIDriverSpec`. ([#93130](https://github.com/kubernetes/kubernetes/pull/93130), [@zshihang](https://github.com/zshihang)) [SIG API Machinery, Apps, Auth, CLI, Network, Node, Storage and Testing] +- Users can try the cronjob controller v2 using the feature gate. This will be the default controller in future releases. ([#93370](https://github.com/kubernetes/kubernetes/pull/93370), [@alaypatel07](https://github.com/alaypatel07)) [SIG API Machinery, Apps, Auth and Testing] +- VolumeSnapshotDataSource moves to GA in 1.20 release ([#95282](https://github.com/kubernetes/kubernetes/pull/95282), [@xing-yang](https://github.com/xing-yang)) [SIG Apps] +- WinOverlay feature graduated to beta ([#94807](https://github.com/kubernetes/kubernetes/pull/94807), [@ksubrmnn](https://github.com/ksubrmnn)) [SIG Windows] -### 기능 +### 기능(feature) -- defaultpreemption 플러그인은 기존 하드코딩된 파드 선점 로직을 대체하는 스케줄러에 등록되고 활성화된다. ([#92049](https://github.com/kubernetes/kubernetes/pull/92049), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling 및 Testing] -- 스케줄링 필터 실패를 해결하기 위해, 필터 단계 후에 실행되는 스케줄러 프레임워크에 새로운 익스텐션 포인트인 `PostFilter` 가 도입되었다. 전형적인 구현은 선점 로직을 실행하는 것이다. ([#91314](https://github.com/kubernetes/kubernetes/pull/91314), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling 및 Testing] -- 조치 필요: CoreDNS v1.7.0에서, [메트릭의 이름이 변경되어](https://github.com/coredns/coredns/blob/master/notes/coredns-1.7.0.md#metric-changes) 이전 메트릭의 이름을 사용하는 기존 리포팅 공식과 역호환(backward incompatible)되지 않는다. 업그레이드하기 전에 공식을 새 이름으로 조정해야 한다. - - Kubeadm은 이제 CoreDNS 버전 v1.7.0이 포함된다. 주요 변경 사항은 다음과 같다. - - CoreDNS가 서비스 기록 업데이트를 중단할 수 있는 버그가 수정되었다. - - 어떤 정책이 설정되어 있어도 항상 첫 번째 업스트림 서버만 선택되는 포워드 플러그인의 버그가 수정되었다. - - 쿠버네티스 플러그인에서 이미 사용 중단된 `resyncperiod` 및 `upstream` 이 제거되었다. - - 프로메테우스(Prometheus) 메트릭 이름 변경을 포함한다. (표준 프로메테우스 메트릭 명명 규칙에 맞게 변경). 이전 메트릭의 이름을 사용하는 기존 리포팅 공식과 역호환된다. - - 페더레이션 플러그인(v1 쿠버네티스 페더레이션을 허용)이 제거되었다. - 자세한 내용은 https://coredns.io/2020/06/15/coredns-1.7.0-release/ 에서 확인할 수 있다. ([#92651](https://github.com/kubernetes/kubernetes/pull/92651), [@rajansandeep](https://github.com/rajansandeep)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle 및 Instrumentation] -- 사용 중단된 버전에 대한 API 요청은 이제 API 응답에서 경고 헤더를 수신하고, 사용 중단된 API의 사용을 나타내는 메트릭이 표시되도록 한다. - - `kubectl` 은 표준 에러 출력으로 경고를 출력하며, `--warnings-as-errors` 옵션을 허용하여 경고를 치명적인 오류로 처리한다. - - `k8s.io/client-go` 은 기본적으로 표준 에러 출력에 경고를 출력한다. `config.WarningHandler` 를 설정하여 클라이언트 별로 재정의하거나, `rest.SetDefaultWarningHandler()` 로 프로세스별로 재정의한다. - - `kube-apiserver` 는 요청된, 사용 중단된 API에 대해 `group`, `version`, `resource`, `subresource` 및 `removed_release` 레이블을 표시하고 `apiserver_requested_deprecated_apis` 게이지 메트릭을 `1` 로 설정한다. ([#73032](https://github.com/kubernetes/kubernetes/pull/73032), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, CLI, Instrumentation 및 Testing] -- component-base에 --logging-format 플래그가 추가되었다. 기본값은 변경되지 않은 klog를 사용하는 "text"이다. ([#89683](https://github.com/kubernetes/kubernetes/pull/89683), [@yuzhiquan](https://github.com/yuzhiquan)) [SIG Instrumentation] -- kubectl create deployment 명령어에 --port 플래그가 추가되었다. ([#91113](https://github.com/kubernetes/kubernetes/pull/91113), [@soltysh](https://github.com/soltysh)) [SIG CLI 및 Testing] -- cmd/cloud-controller-manager에 .import-restrictions 파일이 추가되었다. ([#90630](https://github.com/kubernetes/kubernetes/pull/90630), [@nilo19](https://github.com/nilo19)) [SIG API Machinery 및 Cloud Provider] -- CRI-API ImageSpec 오브젝트에 어노테이션이 추가되었다. ([#90061](https://github.com/kubernetes/kubernetes/pull/90061), [@marosset](https://github.com/marosset)) [SIG Node 및 Windows] -- 스케줄러의 PodSchedulingDuration 메트릭에 시도(attempts)에 대한 레이블이 추가되었다. ([#92650](https://github.com/kubernetes/kubernetes/pull/92650), [@ahg-g](https://github.com/ahg-g)) [SIG Instrumentation 및 Scheduling] -- kubectl scale 명령어에 클라이언트측과 서버측에 대한 드라이런(dry-run) 지원이 추가되었다. ([#89666](https://github.com/kubernetes/kubernetes/pull/89666), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG CLI 및 Testing] -- kubectl diff에 셀렉터가 추가되었다. ([#90857](https://github.com/kubernetes/kubernetes/pull/90857), [@sethpollack](https://github.com/sethpollack)) [SIG CLI] -- cgroups v2 노드의 유효성 검사에 대한 지원이 추가되었다. ([#89901](https://github.com/kubernetes/kubernetes/pull/89901), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle 및 Node] -- 노드 수준에서, 다른 크기로 사전 할당된 huge page에 대한 지원이 추가되었다. ([#89252](https://github.com/kubernetes/kubernetes/pull/89252), [@odinuge](https://github.com/odinuge)) [SIG Apps 및 Node] -- Azure 파일 드라이버에 대한 태그 지원이 추가되었다. ([#92825](https://github.com/kubernetes/kubernetes/pull/92825), [@ZeroMagic](https://github.com/ZeroMagic)) [SIG Cloud Provider 및 Storage] -- azure 디스크 드라이버에 대한 태그 지원이 추가되었다. ([#92356](https://github.com/kubernetes/kubernetes/pull/92356), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider 및 Storage] -- kubectl run 명령어에 --privileged 플래그가 추가되었다. ([#90569](https://github.com/kubernetes/kubernetes/pull/90569), [@brianpursley](https://github.com/brianpursley)) [SIG CLI] -- `v1beta1` 장비 플러그인 API에 새로운 `GetPreferredAllocation()` 호출이 추가되었다. ([#92665](https://github.com/kubernetes/kubernetes/pull/92665), [@klueska](https://github.com/klueska)) [SIG Node 및 Testing] -- 쿠버네티스 서비스의 세션 어피니티를 설정하기 위해 윈도우에 대한 기능 지원이 추가되었다. - 필요: [윈도우 서버 vNext Insider Preview Build 19551](https://blogs.windows.com/windowsexperience/2020/01/28/announcing-windows-server-vnext-insider-preview-build-19551/)(또는 그 이상) ([#91701](https://github.com/kubernetes/kubernetes/pull/91701), [@elweb9858](https://github.com/elweb9858)) [SIG Network 및 Windows] -- kube-apiserver 메트릭 추가: apiserver_current_inflight_request_measures. (API 우선순위(Priority) 및 공정성(Fairness)이 활성화된 경우, windowed_request_stats). ([#91177](https://github.com/kubernetes/kubernetes/pull/91177), [@MikeSpreitzer](https://github.com/MikeSpreitzer)) [SIG API Machinery, Instrumentation 및 Testing] -- AWS 로드밸런서 서비스의 대상 노드에 service.beta.kubernetes.io/aws-load-balancer-target-node-labels 어노테이션이 추가되었다. ([#90943](https://github.com/kubernetes/kubernetes/pull/90943), [@foobarfran](https://github.com/foobarfran)) [SIG Cloud Provider] -- 서로 다른 세분성을 갖는 흐름-제어 시스템의 내부 상태를 덤프하기 위해 접두사 "/debug/flowcontrol/*" 아래에 디버깅 엔드포인트 집합이 추가되었다. ([#90967](https://github.com/kubernetes/kubernetes/pull/90967), [@yue9944882](https://github.com/yue9944882)) [SIG API Machinery] -- kube-scheduler의 메트릭인 framework_extension_point_duration_seconds에 프로파일 레이블이 추가되었다.([#92268](https://github.com/kubernetes/kubernetes/pull/92268), [@alculquicondor](https://github.com/alculquicondor)) [SIG Instrumentation 및 Scheduling] -- kube-scheduler의 메트릭인 schedule_attempts_total에 프로파일 레이블이 추가되었다. - - e2e_scheduling_duration_seconds에 결과 및 프로파일 레이블이 추가되었다. 이제 스케줄링 불가능 및 오류 시도 횟수가 기록된다. ([#92202](https://github.com/kubernetes/kubernetes/pull/92202), [@alculquicondor](https://github.com/alculquicondor)) [SIG Instrumentation 및 Scheduling] -- 사용 중단된 API 버전에 대한 API 요청의 감사(audit) 이벤트는 이제 `"k8s.io/deprecated": "true"` 감사 어노테이션을 포함한다. 대상에 대한 제거 릴리스(removal release)가 식별되면, 해당 감사 이벤트는 `"k8s.io/removal-release": "."` 감사 어노테이션도 포함한다. ([#92842](https://github.com/kubernetes/kubernetes/pull/92842), [@liggitt](https://github.com/liggitt)) [SIG API Machinery 및 Instrumentation] -- 대시보드가 v2.0.1로 격상되었다. ([#91526](https://github.com/kubernetes/kubernetes/pull/91526), [@maciaszczykm](https://github.com/maciaszczykm)) [SIG Cloud Provider] -- 클라우드 노드-컨트롤러는 InstancesV2를 사용한다. ([#91319](https://github.com/kubernetes/kubernetes/pull/91319), [@gongguan](https://github.com/gongguan)) [SIG Apps, Cloud Provider, Scalability 및 Storage] -- 의존성: Golang 버전이 1.13.9로 변경되었다. - - 빌드: kube-cross 이미지 빌드가 제거되었다. ([#89275](https://github.com/kubernetes/kubernetes/pull/89275), [@justaugustus](https://github.com/justaugustus)) [SIG Release 및 Testing] -- 세부 스케줄러 점수 결과는 레벨(verbose) 10에서 표시된다. ([#89384](https://github.com/kubernetes/kubernetes/pull/89384), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling] -- E2e.test는 클러스터가 적합하다고 평가되기 위해, 통과해야 하는 적합성 테스트 목록을 표시할 수 있다. ([#88924](https://github.com/kubernetes/kubernetes/pull/88924), [@dims](https://github.com/dims)) [SIG Architecture 및 Testing] -- PodTopologySpread 플러그인을 사용하여 defaultspreading을 수행하려면 DefaultPodTopologySpread 기능 게이트를 활성화해야 한다. 이렇게 하면, 레거시 DefaultPodTopologySpread 플러그인이 비활성화된다. ([#91793](https://github.com/kubernetes/kubernetes/pull/91793), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- EndpointSlice 컨트롤러가 실패한 동기화를 재시도하기 위해 더 오래 대기하게 된다. ([#89438](https://github.com/kubernetes/kubernetes/pull/89438), [@robscott](https://github.com/robscott)) [SIG Apps 및 Network] -- 로컬 영역(AWS local zone)을 지원하기 위해, AWS azToRegion 메서드가 확장된다. ([#90874](https://github.com/kubernetes/kubernetes/pull/90874), [@Jeffwan](https://github.com/Jeffwan)) [SIG Cloud Provider] -- 기능: azure 공유 디스크 지원이 추가되었다. ([#89511](https://github.com/kubernetes/kubernetes/pull/89511), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider 및 Storage] -- 기능: azure 디스크 api-version이 변경되었다. ([#89250](https://github.com/kubernetes/kubernetes/pull/89250), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider 및 Storage] -- 기능: [Azure 공유 디스크](https://docs.microsoft.com/ko-kr/azure/virtual-machines/disks-shared-enable?tabs=azure-cli)를 지원하며, azure 디스크 스토리지 클래스에 새로운 필드(`maxShares`)가 추가되었다. +- **Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.**: +- A new metric `apiserver_request_filter_duration_seconds` has been introduced that + measures request filter latency in seconds. ([#95207](https://github.com/kubernetes/kubernetes/pull/95207), [@tkashem](https://github.com/tkashem)) [SIG API Machinery and Instrumentation] +- A new set of alpha metrics are reported by the Kubernetes scheduler under the `/metrics/resources` endpoint that allow administrators to easily see the resource consumption (requests and limits for all resources on the pods) and compare it to actual pod usage or node capacity. ([#94866](https://github.com/kubernetes/kubernetes/pull/94866), [@smarterclayton](https://github.com/smarterclayton)) [SIG API Machinery, Instrumentation, Node and Scheduling] +- Add --experimental-logging-sanitization flag enabling runtime protection from leaking sensitive data in logs ([#96370](https://github.com/kubernetes/kubernetes/pull/96370), [@serathius](https://github.com/serathius)) [SIG API Machinery, Cluster Lifecycle and Instrumentation] +- Add a StorageVersionAPI feature gate that makes API server update storageversions before serving certain write requests. + This feature allows the storage migrator to manage storage migration for built-in resources. + Enabling internal.apiserver.k8s.io/v1alpha1 API and APIServerIdentity feature gate are required to use this feature. ([#93873](https://github.com/kubernetes/kubernetes/pull/93873), [@roycaihw](https://github.com/roycaihw)) [SIG API Machinery, Auth and Testing] +- Add a metric for time taken to perform recursive permission change ([#95866](https://github.com/kubernetes/kubernetes/pull/95866), [@JornShen](https://github.com/JornShen)) [SIG Instrumentation and Storage] +- Add a new `vSphere` metric: `cloudprovider_vsphere_vcenter_versions`. It's content show `vCenter` hostnames with the associated server version. ([#94526](https://github.com/kubernetes/kubernetes/pull/94526), [@Danil-Grigorev](https://github.com/Danil-Grigorev)) [SIG Cloud Provider and Instrumentation] +- Add a new flag to set priority for the kubelet on Windows nodes so that workloads cannot overwhelm the node there by disrupting kubelet process. ([#96051](https://github.com/kubernetes/kubernetes/pull/96051), [@ravisantoshgudimetla](https://github.com/ravisantoshgudimetla)) [SIG Node and Windows] +- Add feature to size memory backed volumes ([#94444](https://github.com/kubernetes/kubernetes/pull/94444), [@derekwaynecarr](https://github.com/derekwaynecarr)) [SIG Storage and Testing] +- Add foreground cascading deletion to kubectl with the new `kubectl delete foreground|background|orphan` option. ([#93384](https://github.com/kubernetes/kubernetes/pull/93384), [@zhouya0](https://github.com/zhouya0)) +- Add metrics for azure service operations (route and loadbalancer). ([#94124](https://github.com/kubernetes/kubernetes/pull/94124), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider and Instrumentation] +- Add network rule support in Azure account creation. ([#94239](https://github.com/kubernetes/kubernetes/pull/94239), [@andyzhangx](https://github.com/andyzhangx)) +- Add node_authorizer_actions_duration_seconds metric that can be used to estimate load to node authorizer. ([#92466](https://github.com/kubernetes/kubernetes/pull/92466), [@mborsz](https://github.com/mborsz)) [SIG API Machinery, Auth and Instrumentation] +- Add pod_ based CPU and memory metrics to Kubelet's /metrics/resource endpoint ([#95839](https://github.com/kubernetes/kubernetes/pull/95839), [@egernst](https://github.com/egernst)) [SIG Instrumentation, Node and Testing] +- Added `get-users` and `delete-user` to the `kubectl config` subcommand ([#89840](https://github.com/kubernetes/kubernetes/pull/89840), [@eddiezane](https://github.com/eddiezane)) [SIG CLI] +- Added counter metric "apiserver_request_self" to count API server self-requests with labels for verb, resource, and subresource. ([#94288](https://github.com/kubernetes/kubernetes/pull/94288), [@LogicalShark](https://github.com/LogicalShark)) [SIG API Machinery, Auth, Instrumentation and Scheduling] +- Added new k8s.io/component-helpers repository providing shared helper code for (core) components. ([#92507](https://github.com/kubernetes/kubernetes/pull/92507), [@ingvagabund](https://github.com/ingvagabund)) [SIG Apps, Node, Release and Scheduling] +- Adds `create ingress` command to `kubectl` ([#78153](https://github.com/kubernetes/kubernetes/pull/78153), [@amimof](https://github.com/amimof)) [SIG CLI and Network] +- Adds a headless service on node-local-cache addon. ([#88412](https://github.com/kubernetes/kubernetes/pull/88412), [@stafot](https://github.com/stafot)) [SIG Cloud Provider and Network] +- Allow cross compilation of kubernetes on different platforms. ([#94403](https://github.com/kubernetes/kubernetes/pull/94403), [@bnrjee](https://github.com/bnrjee)) [SIG Release] +- Azure: Support multiple services sharing one IP address ([#94991](https://github.com/kubernetes/kubernetes/pull/94991), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- CRDs: For structural schemas, non-nullable null map fields will now be dropped and defaulted if a default is available. null items in list will continue being preserved, and fail validation if not nullable. ([#95423](https://github.com/kubernetes/kubernetes/pull/95423), [@apelisse](https://github.com/apelisse)) [SIG API Machinery] +- Changed: default "Accept: */*" header added to HTTP probes. See https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#http-probes (https://github.com/kubernetes/website/pull/24756) ([#95641](https://github.com/kubernetes/kubernetes/pull/95641), [@fonsecas72](https://github.com/fonsecas72)) [SIG Network and Node] +- Client-go credential plugins can now be passed in the current cluster information via the KUBERNETES_EXEC_INFO environment variable. ([#95489](https://github.com/kubernetes/kubernetes/pull/95489), [@ankeesler](https://github.com/ankeesler)) [SIG API Machinery and Auth] +- Command to start network proxy changes from 'KUBE_ENABLE_EGRESS_VIA_KONNECTIVITY_SERVICE ./cluster/kube-up.sh' to 'KUBE_ENABLE_KONNECTIVITY_SERVICE=true ./hack/kube-up.sh' ([#92669](https://github.com/kubernetes/kubernetes/pull/92669), [@Jefftree](https://github.com/Jefftree)) [SIG Cloud Provider] +- Configure AWS LoadBalancer health check protocol via service annotations. ([#94546](https://github.com/kubernetes/kubernetes/pull/94546), [@kishorj](https://github.com/kishorj)) +- DefaultPodTopologySpread graduated to Beta. The feature gate is enabled by default. ([#95631](https://github.com/kubernetes/kubernetes/pull/95631), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling and Testing] +- E2e test for PodFsGroupChangePolicy ([#96247](https://github.com/kubernetes/kubernetes/pull/96247), [@saikat-royc](https://github.com/saikat-royc)) [SIG Storage and Testing] +- Ephemeral containers now apply the same API defaults as initContainers and containers ([#94896](https://github.com/kubernetes/kubernetes/pull/94896), [@wawa0210](https://github.com/wawa0210)) [SIG Apps and CLI] +- Gradudate the Pod Resources API to G.A + Introduces the pod_resources_endpoint_requests_total metric which tracks the total number of requests to the pod resources API ([#92165](https://github.com/kubernetes/kubernetes/pull/92165), [@RenaudWasTaken](https://github.com/RenaudWasTaken)) [SIG Instrumentation, Node and Testing] +- In dual-stack bare-metal clusters, you can now pass dual-stack IPs to `kubelet --node-ip`. + eg: `kubelet --node-ip 10.1.0.5,fd01::0005`. This is not yet supported for non-bare-metal + clusters. - kind: StorageClass - apiVersion: storage.k8s.io/v1 - metadata: - name: shared-disk - provisioner: kubernetes.io/azure-disk - parameters: - skuname: Premium_LRS # 현재는 프리미엄 SSD만 사용 가능하다. - cachingMode: None # 읽기전용 호스트 캐싱은 maxShares>1 인 프리미엄 SSD에 사용할 수 없다. - maxShares: 2 ([#89328](https://github.com/kubernetes/kubernetes/pull/89328), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider 및 Storage] -- 가상 서버 주소가 이미 바인딩되지 않은 경우, `EnsureDummyInterface` 만 실행하여 IPVS 프록시 성능을 향상시킬 수 있다. ([#92609](https://github.com/kubernetes/kubernetes/pull/92609), [@andrewsykim](https://github.com/andrewsykim)) [SIG Network] -- 이제 Kube-Proxy는 EndpointSliceProxying 기능 게이트를 통해 윈도우에서 엔드포인트슬라이스를 지원한다. ([#90909](https://github.com/kubernetes/kubernetes/pull/90909), [@kumarvin123](https://github.com/kumarvin123)) [SIG Network 및 Windows] -- 이제 Kube-Proxy는 IPv6DualStack 기능 게이트를 사용하여 윈도우에서 IPv6DualStack 기능을 지원한다. ([#90853](https://github.com/kubernetes/kubernetes/pull/90853), [@kumarvin123](https://github.com/kumarvin123)) [SIG Network, Node 및 Windows] -- Kube-addon-manager가 v9.1.1로 변경되어, 허용된 리소스의 기본 목록을 재정의할 수 있다. (https://github.com/kubernetes/kubernetes/pull/91018) ([#91240](https://github.com/kubernetes/kubernetes/pull/91240), [@tosi3k](https://github.com/tosi3k)) [SIG Cloud Provider, Scalability 및 Testing] -- etcd3에서 지원하는 Kube-apiserver는 데이터베이스 파일 크기를 표시하는 메트릭을 추출할 수 있다. ([#89151](https://github.com/kubernetes/kubernetes/pull/89151), [@jingyih](https://github.com/jingyih)) [SIG API Machinery] -- Kube-apiserver, kube-scheduler 및 kube-controller manager는 이제 유닉스 시스템에서 실행되는 경우 --bind-address 및 --secure-port 플래그로 정의된 주소에서 수신 대기할 때, SO_REUSEPORT 소켓 옵션을 사용한다(윈도우는 지원되지 않는다). 이를 통해 동일한 구성으로 단일 호스트에서 이러한 프로세스의 여러 인스턴스를 실행할 수 있으므로, 다운타임 없이 정상적으로 변경/재시작이 가능하다. ([#88893](https://github.com/kubernetes/kubernetes/pull/88893), [@invidian](https://github.com/invidian)) [SIG API Machinery, Scheduling 및 Testing] -- Kube-apiserver: NodeRestriction 어드미션 플러그인은 이제 새 노드를 만들 때, kubelet이 설정할 수 있는 노드 레이블을 1.16 이상에서 kubelet이 허용하는, `--node-labels` 파라미터로 제한한다. ([#90307](https://github.com/kubernetes/kubernetes/pull/90307), [@liggitt](https://github.com/liggitt)) [SIG Auth 및 Node] -- Kube-controller-manager: 구조화된 로깅을 지원하기 위해 '--logging-format' 플래그가 추가되었다. ([#91521](https://github.com/kubernetes/kubernetes/pull/91521), [@SataQiu](https://github.com/SataQiu)) [SIG API Machinery 및 Instrumentation] -- Kube-controller-manager: `--experimental-cluster-signing-duration` 플래그는 v1.22에서 사용 중단된 것으로 표시되며, `--cluster-signing-duration` 으로 대체된다. ([#91154](https://github.com/kubernetes/kubernetes/pull/91154), [@liggitt](https://github.com/liggitt)) [SIG Auth 및 Cloud Provider] -- 이제 Kube-proxy는 리눅스에서 기본적으로 엔드포인트 대신 엔드포인트슬라이스를 사용한다. 새로운 알파 `WindowsEndpointSliceProxying` 기능 게이트를 통해 윈도우에서 기능을 활성화할 수 있다. ([#92736](https://github.com/kubernetes/kubernetes/pull/92736), [@robscott](https://github.com/robscott)) [SIG Network] -- Kube-scheduler: 구조화된 로깅을 지원하기 위해 '--logging-format' 플래그가 추가되었다. ([#91522](https://github.com/kubernetes/kubernetes/pull/91522), [@SataQiu](https://github.com/SataQiu)) [SIG API Machinery, Cluster Lifecycle, Instrumentation 및 Scheduling] -- Kubeadm은 이제 생성된 컴포넌트와 사용자 제공 컴포넌트의 설정을 구분하여, 구성 업그레이드가 필요한 경우 이전 컴포넌트를 다시 생성한다. ([#86070](https://github.com/kubernetes/kubernetes/pull/86070), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] -- Kubeadm: 수동으로 업그레이드된 컴포넌트의 설정이, 업그레이드 계획 및 적용 중에 --config 옵션을 통해 YAML 파일에서 적용될 수 있다. 클러스터에 저장된 모든 것을 덮어쓰는 kubeadm 구성 및 컴포넌트의 설정이 보존되는 기존의 --config 동작도 유지된다. --config와 함께 사용되는 동작은 이제 kubeadm 설정 API 오브젝트(API group "kubeadm.kubernetes.io")가 파일에 제공되었는지의 여부에 따라 결정된다. ([#91980](https://github.com/kubernetes/kubernetes/pull/91980), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] -- Kubeadm: 구동이 느린 컨테이너를 보호하기 위해 정적 파드에 대한 시작 프로브가 추가되었다. ([#91179](https://github.com/kubernetes/kubernetes/pull/91179), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] -- Kubeadm: "kubeadm init phase certs" 하위 명령어의 "--csr-only" 및 "--csr-dir" 플래그는 사용 중단되었다. 대신 "kubeadm alpha certs generate-csr" 를 사용해야 한다. 이 신규 명령어를 사용하면 모든 컨트롤 플레인 컴포넌트에 대한 새로운 개인키 및 인증서 서명 요청을 생성할 수 있으므로, 외부 CA로 인증서에 서명할 수 있다. ([#92183](https://github.com/kubernetes/kubernetes/pull/92183), [@wallrj](https://github.com/wallrj)) [SIG Cluster Lifecycle] -- Kubeadm: 'upgrade apply' 도중에, kube-proxy 컨피그맵이 누락된 경우, kube-proxy가 업그레이드되지 않아야 한다고 가정한다. DNS 서버 애드온에서 kube-dns/coredns 컨피그맵이 누락된 경우에도 동일하게 적용된다. 이는 'upgrade apply' 지원 단계까지의 일시적인 해결 방법이다. 해당 단계가 지원되면, kube-proxy/dns 수동으로 넘겨져야 한다. ([#89593](https://github.com/kubernetes/kubernetes/pull/89593), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Kubeadm: 컨트롤-플레인 정적 파드는 "시스템-노드-크리티컬" 우선순위 클래스로 전환되었다. ([#90063](https://github.com/kubernetes/kubernetes/pull/90063), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Kubeadm: upgrade plan은 이제 업그레이드 전에, 알려진 컴포넌트의 설정 상태를 나타내는 표를 출력한다. ([#88124](https://github.com/kubernetes/kubernetes/pull/88124), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] -- Kubectl 명령어는 지정하지 않고(전체 리소스 이름을 입력할 필요 없음) 바로 taint no와 같이 사용할 수 있다. ([#88723](https://github.com/kubernetes/kubernetes/pull/88723), [@wawa0210](https://github.com/wawa0210)) [SIG CLI] -- Kubelet: 다음의 메트릭 이름이 변경되었다. - kubelet_running_container_count --> kubelet_running_containers - kubelet_running_pod_count --> kubelet_running_pods ([#92407](https://github.com/kubernetes/kubernetes/pull/92407), [@RainbowMango](https://github.com/RainbowMango)) [SIG API Machinery, Cluster Lifecycle, Instrumentation 및 Node] -- 클라이언트 인증서를 교체하도록 설정된 kubelet은 이제 인증서 만료까지 남은 시간(초)을 나타내는 `certificate_manager_server_ttl_seconds` 게이지 메트릭을 표시한다. ([#91148](https://github.com/kubernetes/kubernetes/pull/91148), [@liggitt](https://github.com/liggitt)) [SIG Auth 및 Node] -- PodTopologySpreading이 더 잘 확산될 수 있도록 새로운 점수 계산 함수가 도입되었다. ([#90475](https://github.com/kubernetes/kubernetes/pull/90475), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- 유틸리티 라이브러리가 소폭 향상되었으며, 별도의 조치가 필요하진 않다. ([#92440](https://github.com/kubernetes/kubernetes/pull/92440), [@luigibk](https://github.com/luigibk)) [SIG Network] -- PodTolerationRestriction: 에러에서 네임스페이스 허용 목록이 표시된다. ([#87582](https://github.com/kubernetes/kubernetes/pull/87582), [@mrueg](https://github.com/mrueg)) [SIG Scheduling] -- 공급자별 참고 사항: vsphere: vsphere.conf - 성능 문제를 위해 자격증명 시크릿 관리를 비활성화하는 새로운 옵션 ([#90836](https://github.com/kubernetes/kubernetes/pull/90836), [@Danil-Grigorev](https://github.com/Danil-Grigorev)) [SIG Cloud Provider] -- pod_preemption_metrics의 이름이 preemption_metrics로 변경되었다. ([#93256](https://github.com/kubernetes/kubernetes/pull/93256), [@ahg-g](https://github.com/ahg-g)) [SIG Instrumentation 및 Scheduling] -- Rest.Config는 이제, 이전에는 환경 변수를 통해서만 구성할 수 있었던 프록시 구성을 재정의하는 플래그를 지원한다. ([#81443](https://github.com/kubernetes/kubernetes/pull/81443), [@mikedanese](https://github.com/mikedanese)) [SIG API Machinery 및 Node] -- PodTopologySpreading의 점수는 maxSkew가 증가함에 따라 차이가 감소되었다. ([#90820](https://github.com/kubernetes/kubernetes/pull/90820), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- 적용된 구성으로부터 필드가 제거된 경우 서버측 적용 동작이 정규화되었다. 다른 소유자가 없는 제거된 필드는 생성된 오브젝트에서 제거되거나 기본값이 있는 경우, 기본값으로 재설정된다. 기본값으로 재설정하지 않고 HPA로 `replicas` 필드를 이전하는 것과 같은 안전한 소유권 이전은 [소유권 이전](https://kubernetes.io/docs/reference/using-api/api-concepts/#transferring-ownership)에 설명되어 있다. ([#92661](https://github.com/kubernetes/kubernetes/pull/92661), [@jpbetz](https://github.com/jpbetz)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation 및 Testing] -- 서비스 컨트롤러: 노드의 관련 필드가 변경될 때에만 LB 노드 풀이 동기화된다. ([#90769](https://github.com/kubernetes/kubernetes/pull/90769), [@andrewsykim](https://github.com/andrewsykim)) [SIG Apps 및 Network] -- CSIMigrationvSphere 기능 게이트가 베타로 전환되었다. - 사용자는 CSIMigration + CSIMigrationvSphere 기능을 활성화하고 vSphere CSI 드라이버(https://github.com/kubernetes-sigs/vsphere-csi-driver)를 설치하여 인-트리 vSphere 플러그인 "kubernetes.io/vsphere-volume" 에서 vSphere CSI 드라이버로 워크로드를 이동해야 한다. + In dual-stack clusters where nodes have dual-stack addresses, hostNetwork pods + will now get dual-stack PodIPs. ([#95239](https://github.com/kubernetes/kubernetes/pull/95239), [@danwinship](https://github.com/danwinship)) [SIG Network and Node] +- Introduce api-extensions category which will return: mutating admission configs, validating admission configs, CRDs and APIServices when used in kubectl get, for example. ([#95603](https://github.com/kubernetes/kubernetes/pull/95603), [@soltysh](https://github.com/soltysh)) [SIG API Machinery] +- Introduces a new GCE specific cluster creation variable KUBE_PROXY_DISABLE. When set to true, this will skip over the creation of kube-proxy (whether the daemonset or static pod). This can be used to control the lifecycle of kube-proxy separately from the lifecycle of the nodes. ([#91977](https://github.com/kubernetes/kubernetes/pull/91977), [@varunmar](https://github.com/varunmar)) [SIG Cloud Provider] +- Kube-apiserver now maintains a Lease object to identify itself: + - The feature is under feature gate `APIServerIdentity`. + - Two flags are added to kube-apiserver: `identity-lease-duration-seconds`, `identity-lease-renew-interval-seconds` ([#95533](https://github.com/kubernetes/kubernetes/pull/95533), [@roycaihw](https://github.com/roycaihw)) [SIG API Machinery] +- Kube-apiserver: The timeout used when making health check calls to etcd can now be configured with `--etcd-healthcheck-timeout`. The default timeout is 2 seconds, matching the previous behavior. ([#93244](https://github.com/kubernetes/kubernetes/pull/93244), [@Sh4d1](https://github.com/Sh4d1)) [SIG API Machinery] +- Kube-apiserver: added support for compressing rotated audit log files with `--audit-log-compress` ([#94066](https://github.com/kubernetes/kubernetes/pull/94066), [@lojies](https://github.com/lojies)) [SIG API Machinery and Auth] +- Kubeadm now prints warnings instead of throwing errors if the current system time is outside of the NotBefore and NotAfter bounds of a loaded certificate. ([#94504](https://github.com/kubernetes/kubernetes/pull/94504), [@neolit123](https://github.com/neolit123)) +- Kubeadm: Add a preflight check that the control-plane node has at least 1700MB of RAM ([#93275](https://github.com/kubernetes/kubernetes/pull/93275), [@xlgao-zju](https://github.com/xlgao-zju)) [SIG Cluster Lifecycle] +- Kubeadm: add the "--cluster-name" flag to the "kubeadm alpha kubeconfig user" to allow configuring the cluster name in the generated kubeconfig file ([#93992](https://github.com/kubernetes/kubernetes/pull/93992), [@prabhu43](https://github.com/prabhu43)) [SIG Cluster Lifecycle] +- Kubeadm: add the "--kubeconfig" flag to the "kubeadm init phase upload-certs" command to allow users to pass a custom location for a kubeconfig file. ([#94765](https://github.com/kubernetes/kubernetes/pull/94765), [@zhanw15](https://github.com/zhanw15)) [SIG Cluster Lifecycle] +- Kubeadm: make etcd pod request 100m CPU, 100Mi memory and 100Mi ephemeral_storage by default ([#94479](https://github.com/kubernetes/kubernetes/pull/94479), [@knight42](https://github.com/knight42)) [SIG Cluster Lifecycle] +- Kubeadm: make the command "kubeadm alpha kubeconfig user" accept a "--config" flag and remove the following flags: + - apiserver-advertise-address / apiserver-bind-port: use either localAPIEndpoint from InitConfiguration or controlPlaneEndpoint from ClusterConfiguration. + - cluster-name: use clusterName from ClusterConfiguration + - cert-dir: use certificatesDir from ClusterConfiguration ([#94879](https://github.com/kubernetes/kubernetes/pull/94879), [@knight42](https://github.com/knight42)) [SIG Cluster Lifecycle] +- Kubectl create now supports creating ingress objects. ([#94327](https://github.com/kubernetes/kubernetes/pull/94327), [@rikatz](https://github.com/rikatz)) [SIG CLI and Network] +- Kubectl rollout history sts/sts-name --revision=some-revision will start showing the detailed view of the sts on that specified revision ([#86506](https://github.com/kubernetes/kubernetes/pull/86506), [@dineshba](https://github.com/dineshba)) [SIG CLI] +- Kubectl: Previously users cannot provide arguments to a external diff tool via KUBECTL_EXTERNAL_DIFF env. This release now allow users to specify args to KUBECTL_EXTERNAL_DIFF env. ([#95292](https://github.com/kubernetes/kubernetes/pull/95292), [@dougsland](https://github.com/dougsland)) [SIG CLI] +- Kubemark now supports both real and hollow nodes in a single cluster. ([#93201](https://github.com/kubernetes/kubernetes/pull/93201), [@ellistarn](https://github.com/ellistarn)) [SIG Scalability] +- Kubernetes E2E test image manifest lists now contain Windows images. ([#77398](https://github.com/kubernetes/kubernetes/pull/77398), [@claudiubelu](https://github.com/claudiubelu)) [SIG Testing and Windows] +- Kubernetes is now built using go1.15.2 + - build: Update to k/repo-infra@v0.1.1 (supports go1.15.2) + - build: Use go-runner:buster-v2.0.1 (built using go1.15.1) + - bazel: Replace --features with Starlark build settings flag + - hack/lib/util.sh: some bash cleanups - 요구사항: vSphere vCenter/ESXi 버전: 7.0u1, HW 버전: VM 버전 15 ([#92816](https://github.com/kubernetes/kubernetes/pull/92816), [@divyenpatel](https://github.com/divyenpatel)) [SIG Cloud Provider 및 Storage] -- `kubectl create deployment` 명령에 대하여 --replicas 플래그가 지원된다. ([#91562](https://github.com/kubernetes/kubernetes/pull/91562), [@zhouya0](https://github.com/zhouya0)) -- 클라이언트측 적용에서 서버측 적용으로의 원활한 업그레이드를 지원하며, 해당하는 다운그레이드 또한 지원한다. ([#90187](https://github.com/kubernetes/kubernetes/pull/90187), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG API Machinery 및 Testing] -- VMSS의 비동기식 생성/변경을 지원한다. ([#89248](https://github.com/kubernetes/kubernetes/pull/89248), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] -- cgroups v2 통합 모드를 사용하는 호스트에서의 실행을 지원한다. ([#85218](https://github.com/kubernetes/kubernetes/pull/85218), [@giuseppe](https://github.com/giuseppe)) [SIG Node] -- 코어 마스터 베이스 이미지(kube-apiserver, kube-scheduler)를 debian에서 distroless로 전환하였다. ([#90674](https://github.com/kubernetes/kubernetes/pull/90674), [@dims](https://github.com/dims)) [SIG Cloud Provider, Release 및 Scalability] -- etcd 이미지(마이그레이션 스크립트 포함)를 debian에서 distroless로 전환하였다. ([#91171](https://github.com/kubernetes/kubernetes/pull/91171), [@dims](https://github.com/dims)) [SIG API Machinery 및 Cloud Provider] -- RotateKubeletClientCertificate 기능 게이트가 GA로 승격되었으며, kubelet --feature-gate RotateKubeletClientCertificate 파라미터는 1.20에서 제거된다. ([#91780](https://github.com/kubernetes/kubernetes/pull/91780), [@liggitt](https://github.com/liggitt)) [SIG Auth 및 Node] -- SCTPSupport 기능이 기본적으로 활성화된다. ([#88932](https://github.com/kubernetes/kubernetes/pull/88932), [@janosi](https://github.com/janosi)) [SIG Network] -- `certificatesigningrequests/approval` 하위 리소스는 이제 패치 API 요청을 지원한다. ([#91558](https://github.com/kubernetes/kubernetes/pull/91558), [@liggitt](https://github.com/liggitt)) [SIG Auth 및 Testing] -- `kubernetes_build_info` 의 메트릭 레이블 이름이 `camel case` 에서 `snake case` 로 변경되었다. - - gitVersion --> git_version - - gitCommit --> git_commit - - gitTreeState --> git_tree_state - - buildDate --> build_date - - goVersion --> go_version + - switched one spot to use kube::logging + - make kube::util::find-binary return an error when it doesn't find + anything so that hack scripts fail fast instead of with '' binary not + found errors. + - this required deleting some genfeddoc stuff. the binary no longer + exists in k/k repo since we removed federation/, and I don't see it + in https://github.com/kubernetes-sigs/kubefed/ either. I'm assuming + that it's gone for good now. - 이 변경 사항은 `kube-apiserver`、`kube-scheduler`、`kube-proxy` 및 `kube-controller-manager` 에서 발생한다. ([#91805](https://github.com/kubernetes/kubernetes/pull/91805), [@RainbowMango](https://github.com/RainbowMango)) [SIG API Machinery, Cluster Lifecycle 및 Instrumentation] -- apiserver 로그의 추적 출력이 더 체계적이고 포괄적으로 변경되었다. 추적은 중첩되며, 오래 실행되지 않은 모든 요청 엔드포인트에 대해 전체 필터 체인이 계측된다(예: 인증 확인이 포함된다.). ([#88936](https://github.com/kubernetes/kubernetes/pull/88936), [@jpbetz](https://github.com/jpbetz)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation 및 Scheduling] -- 시간 초과 직전에 감시 북마크를 보내는 것 외에도, 주기적으로(요청된 경우) 보내도록 변경되었다. ([#90560](https://github.com/kubernetes/kubernetes/pull/90560), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery] -- cri-tools이 v1.18.0으로 변경되었다. ([#89720](https://github.com/kubernetes/kubernetes/pull/89720), [@saschagrunert](https://github.com/saschagrunert)) [SIG Cloud Provider, Cluster Lifecycle, Release 및 Scalability] -- etcd 클라이언트측이 v3.4.4로 변경되었다. ([#89169](https://github.com/kubernetes/kubernetes/pull/89169), [@jingyih](https://github.com/jingyih)) [SIG API Machinery 및 Cloud Provider] -- etcd 클라이언트측이 v3.4.7로 변경되었다. ([#89822](https://github.com/kubernetes/kubernetes/pull/89822), [@jingyih](https://github.com/jingyih)) [SIG API Machinery 및 Cloud Provider] -- etcd 클라이언트측이 v3.4.9로 변경되었다. ([#92075](https://github.com/kubernetes/kubernetes/pull/92075), [@jingyih](https://github.com/jingyih)) [SIG API Machinery, Cloud Provider 및 Instrumentation] -- azure-sdk가 v40.2.0으로 변경되었다. ([#89105](https://github.com/kubernetes/kubernetes/pull/89105), [@andyzhangx](https://github.com/andyzhangx)) [SIG CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Storage 및 Testing] -- 이제 `kubectl port-forward` 가 UDP를 지원하지 않음을 사용자에게 경고하게 된다. ([#91616](https://github.com/kubernetes/kubernetes/pull/91616), [@knight42](https://github.com/knight42)) [SIG CLI] -- PodTopologySpread의 가중치 확산 스케줄링 점수가 2배로 늘어났다. ([#91258](https://github.com/kubernetes/kubernetes/pull/91258), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- `EventRecorder()` 는 `FrameworkHandle` 인터페이스에 노출되어 스케줄러 플러그인 개발자가 클러스터 수준 이벤트를 기록하도록 선택할 수 있다. ([#92010](https://github.com/kubernetes/kubernetes/pull/92010), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling] -- `kubectl alpha debug` 명령어는 이제 원본을 복사하여 파드 디버깅을 지원한다. ([#90094](https://github.com/kubernetes/kubernetes/pull/90094), [@aylei](https://github.com/aylei)) [SIG CLI] -- `kubectl alpha debug` 명령어는 이제 노드의 호스트 네임스페이스에서 실행되는 디버깅 컨테이너를 생성하여 노드를 디버깅하는 방식을 지원한다. ([#92310](https://github.com/kubernetes/kubernetes/pull/92310), [@verb](https://github.com/verb)) [SIG CLI] -- `local-up-cluster.sh` 는 이제 기본적으로 CSI snapshotter를 설치하며, `ENABLE_CSI_SNAPSHOTTER=false` 로 비활성화할 수 있다. ([#91504](https://github.com/kubernetes/kubernetes/pull/91504), [@pohly](https://github.com/pohly)) -- `ImageLocality` 플러그인의 `maxThreshold` 는 이제 파드의 이미지 수에 따라 크기가 조정되어, 여러 이미지가 있는 파드의 노드 우선순위를 구분하는데 도움을 줄 수 있다. ([#91138](https://github.com/kubernetes/kubernetes/pull/91138), [@chendave](https://github.com/chendave)) [SIG Scheduling] + - bazel: output go_binary rule directly from go_binary_conditional_pure + + From: [@mikedanese](https://github.com/mikedanese): + Instead of aliasing. Aliases are annoying in a number of ways. This is + specifically bugging me now because they make the action graph harder to + analyze programmatically. By using aliases here, we would need to handle + potentially aliased go_binary targets and dereference to the effective + target. + + The comment references an issue with `pure = select(...)` which appears + to be resolved considering this now builds. + + - make kube::util::find-binary not dependent on bazel-out/ structure + + Implement an aspect that outputs go_build_mode metadata for go binaries, + and use that during binary selection. ([#94449](https://github.com/kubernetes/kubernetes/pull/94449), [@justaugustus](https://github.com/justaugustus)) [SIG Architecture, CLI, Cluster Lifecycle, Node, Release and Testing] +- Kubernetes is now built using go1.15.5 + - build: Update to k/repo-infra@v0.1.2 (supports go1.15.5) ([#95776](https://github.com/kubernetes/kubernetes/pull/95776), [@justaugustus](https://github.com/justaugustus)) [SIG Cloud Provider, Instrumentation, Release and Testing] +- New default scheduling plugins order reduces scheduling and preemption latency when taints and node affinity are used ([#95539](https://github.com/kubernetes/kubernetes/pull/95539), [@soulxu](https://github.com/soulxu)) [SIG Scheduling] +- Only update Azure data disks when attach/detach ([#94265](https://github.com/kubernetes/kubernetes/pull/94265), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Promote SupportNodePidsLimit to GA to provide node-to-pod PID isolation. + Promote SupportPodPidsLimit to GA to provide ability to limit PIDs per pod. ([#94140](https://github.com/kubernetes/kubernetes/pull/94140), [@derekwaynecarr](https://github.com/derekwaynecarr)) +- SCTP support in API objects (Pod, Service, NetworkPolicy) is now GA. + Note that this has no effect on whether SCTP is enabled on nodes at the kernel level, + and note that some cloud platforms and network plugins do not support SCTP traffic. ([#95566](https://github.com/kubernetes/kubernetes/pull/95566), [@danwinship](https://github.com/danwinship)) [SIG Apps and Network] +- Scheduler now ignores Pod update events if the resourceVersion of old and new Pods are identical. ([#96071](https://github.com/kubernetes/kubernetes/pull/96071), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling] +- Scheduling Framework: expose Run[Pre]ScorePlugins functions to PreemptionHandle which can be used in PostFilter extention point. ([#93534](https://github.com/kubernetes/kubernetes/pull/93534), [@everpeace](https://github.com/everpeace)) [SIG Scheduling and Testing] +- SelectorSpreadPriority maps to PodTopologySpread plugin when DefaultPodTopologySpread feature is enabled ([#95448](https://github.com/kubernetes/kubernetes/pull/95448), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] +- Send GCE node startup scripts logs to console and journal. ([#95311](https://github.com/kubernetes/kubernetes/pull/95311), [@karan](https://github.com/karan)) +- SetHostnameAsFQDN has been graduated to Beta and therefore it is enabled by default. ([#95267](https://github.com/kubernetes/kubernetes/pull/95267), [@javidiaz](https://github.com/javidiaz)) [SIG Node] +- Support [service.beta.kubernetes.io/azure-pip-ip-tags] annotations to allow customers to specify ip-tags to influence public-ip creation in Azure [Tag1=Value1, Tag2=Value2, etc.] ([#94114](https://github.com/kubernetes/kubernetes/pull/94114), [@MarcPow](https://github.com/MarcPow)) [SIG Cloud Provider] +- Support custom tags for cloud provider managed resources ([#96450](https://github.com/kubernetes/kubernetes/pull/96450), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- Support customize load balancer health probe protocol and request path ([#96338](https://github.com/kubernetes/kubernetes/pull/96338), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- Support for Windows container images (OS Versions: 1809, 1903, 1909, 2004) was added the pause:3.4 image. ([#91452](https://github.com/kubernetes/kubernetes/pull/91452), [@claudiubelu](https://github.com/claudiubelu)) [SIG Node, Release and Windows] +- Support multiple standard load balancers in one cluster ([#96111](https://github.com/kubernetes/kubernetes/pull/96111), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- The beta `RootCAConfigMap` feature gate is enabled by default and causes kube-controller-manager to publish a "kube-root-ca.crt" ConfigMap to every namespace. This ConfigMap contains a CA bundle used for verifying connections to the kube-apiserver. ([#96197](https://github.com/kubernetes/kubernetes/pull/96197), [@zshihang](https://github.com/zshihang)) [SIG API Machinery, Apps, Auth and Testing] +- The kubelet_runtime_operations_duration_seconds metric buckets were set to 0.005 0.0125 0.03125 0.078125 0.1953125 0.48828125 1.220703125 3.0517578125 7.62939453125 19.073486328125 47.6837158203125 119.20928955078125 298.0232238769531 and 745.0580596923828 seconds ([#96054](https://github.com/kubernetes/kubernetes/pull/96054), [@alvaroaleman](https://github.com/alvaroaleman)) [SIG Instrumentation and Node] +- There is a new pv_collector_total_pv_count metric that counts persistent volumes by the volume plugin name and volume mode. ([#95719](https://github.com/kubernetes/kubernetes/pull/95719), [@tsmetana](https://github.com/tsmetana)) [SIG Apps, Instrumentation, Storage and Testing] +- Volume snapshot e2e test to validate PVC and VolumeSnapshotContent finalizer ([#95863](https://github.com/kubernetes/kubernetes/pull/95863), [@RaunakShah](https://github.com/RaunakShah)) [SIG Cloud Provider, Storage and Testing] +- Warns user when executing kubectl apply/diff to resource currently being deleted. ([#95544](https://github.com/kubernetes/kubernetes/pull/95544), [@SaiHarshaK](https://github.com/SaiHarshaK)) [SIG CLI] +- `kubectl alpha debug` has graduated to beta and is now `kubectl debug`. ([#96138](https://github.com/kubernetes/kubernetes/pull/96138), [@verb](https://github.com/verb)) [SIG CLI and Testing] +- `kubectl debug` gains support for changing container images when copying a pod for debugging, similar to how `kubectl set image` works. See `kubectl help debug` for more information. ([#96058](https://github.com/kubernetes/kubernetes/pull/96058), [@verb](https://github.com/verb)) [SIG CLI] ### 문서 -- 샘플 앱 배포 지침이 변경되었다. ([#82785](https://github.com/kubernetes/kubernetes/pull/82785), [@ashish-billore](https://github.com/ashish-billore)) [SIG API Machinery] +- Fake dynamic client: document that List does not preserve TypeMeta in UnstructuredList ([#95117](https://github.com/kubernetes/kubernetes/pull/95117), [@andrewsykim](https://github.com/andrewsykim)) [SIG API Machinery] +- Kubelet: remove alpha warnings for CNI flags. ([#94508](https://github.com/kubernetes/kubernetes/pull/94508), [@andrewsykim](https://github.com/andrewsykim)) [SIG Network and Node] +- Updates docs and guidance on cloud provider InstancesV2 and Zones interface for external cloud providers: + - removes experimental warning for InstancesV2 + - document that implementation of InstancesV2 will disable calls to Zones + - deprecate Zones in favor of InstancesV2 ([#96397](https://github.com/kubernetes/kubernetes/pull/96397), [@andrewsykim](https://github.com/andrewsykim)) [SIG Cloud Provider] ### 실패 테스트 -- Kube-proxy iptables min-sync-period 의 기본값은 1초로 변경되었다. (이전 값은 0 이다.) ([#92836](https://github.com/kubernetes/kubernetes/pull/92836), [@aojea](https://github.com/aojea)) [SIG Network] +- Resolves an issue running Ingress conformance tests on clusters which use finalizers on Ingress objects to manage releasing load balancer resources ([#96742](https://github.com/kubernetes/kubernetes/pull/96742), [@spencerhance](https://github.com/spencerhance)) [SIG Network and Testing] +- The Conformance test "validates that there is no conflict between pods with same hostPort but different hostIP and protocol" now validates the connectivity to each hostPort, in addition to the functionality. ([#96627](https://github.com/kubernetes/kubernetes/pull/96627), [@aojea](https://github.com/aojea)) [SIG Scheduling and Testing] -### 버그 또는 회귀(Regression) +### 버그 또는 회귀(regression) -- 인-트리 소스의 PV 집합은 CSIPersistentVolumeSource로 변환될 때 노드 어피니티에서 주문된 요구사항 값을 갖는다. ([#88987](https://github.com/kubernetes/kubernetes/pull/88987), [@jiahuif](https://github.com/jiahuif)) [SIG Storage] -- `informer-sync` 헬스 체커로 인한 apiserver의 패닉이 수정되었다. ([#93600](https://github.com/kubernetes/kubernetes/pull/93600), [@ialidzhikov](https://github.com/ialidzhikov)) [SIG API Machinery] -- 이제 GCP cloud-controller-manager 가 클러스터 외부에서 실행되어 새 노드를 초기화하지 못하는 문제가 수정되었다. ([#90057](https://github.com/kubernetes/kubernetes/pull/90057), [@ialidzhikov](https://github.com/ialidzhikov)) [SIG Apps 및 Cloud Provider] -- Kubelets 용 GCE CloudProvider를 초기화 할 때 GCE API 호출을 하지 않는다. ([#90218](https://github.com/kubernetes/kubernetes/pull/90218), [@wojtek-t](https://github.com/wojtek-t)) [SIG Cloud Provider 및 Scalability] -- IP 별칭을 추가하거나 GCE 클라우드 제공 업체의 노드 객체에 반영할 때, 불필요한 GCE API 호출을 하지 않는다. ([#90242](https://github.com/kubernetes/kubernetes/pull/90242), [@wojtek-t](https://github.com/wojtek-t)) [SIG Apps, Cloud Provider 및 Network] -- 파드가 스케줄 되는 동안, 어노테이션이 변경될 때 불필요한 스케줄링 변동을 방지한다. ([#90373](https://github.com/kubernetes/kubernetes/pull/90373), [@fabiokung](https://github.com/fabiokung)) [SIG Scheduling] -- kubectl 용 Azure 인증 모듈은 이제 갱신 토큰이 만료된 후에 로그인을 요청한다. ([#86481](https://github.com/kubernetes/kubernetes/pull/86481), [@tdihp](https://github.com/tdihp)) [SIG API Machinery 및 Auth] -- Azure: lb 생성시 발생하는 동시성 해결 ([#89604](https://github.com/kubernetes/kubernetes/pull/89604), [@aramase](https://github.com/aramase)) [SIG Cloud Provider] -- Azure: 연결된 VMSS 가 많은 클러스터에서 스로틀링(throttling)을 방지하기 위해 전역 VMSS VMs 캐시를 VMSS 별 VM 캐시로 전환하였다. ([#93107](https://github.com/kubernetes/kubernetes/pull/93107), [@bpineau](https://github.com/bpineau)) [SIG Cloud Provider] -- Azure: IPv6 인바운드 보안 규칙에 대한 대상 접두사 및 포트를 설정하였다. ([#91831](https://github.com/kubernetes/kubernetes/pull/91831), [@aramase](https://github.com/aramase)) [SIG Cloud Provider] -- 베이스-이미지: kube-cross:v1.13.9-5 으로 업데이트 되었다. ([#90963](https://github.com/kubernetes/kubernetes/pull/90963), [@justaugustus](https://github.com/justaugustus)) [SIG Release 및 Testing] -- 기존 servicePort의 nodePort가 수동으로 변경된 경우 AWS NLB 서비스에 대한 버그가 수정되었다. ([#89562](https://github.com/kubernetes/kubernetes/pull/89562), [@M00nF1sh](https://github.com/M00nF1sh)) [SIG Cloud Provider] -- APIServer에 연결할 수 없거나 kubelet에 아직 올바른 자격증명이 없는 경우, CSINode 초기화는 시작할때 kubelet을 중단하지 않는다. ([#89589](https://github.com/kubernetes/kubernetes/pull/89589), [@jsafrane](https://github.com/jsafrane)) [SIG Storage] -- CVE-2020-8557 (Medium): 컨테이너의 /etc/hosts 파일을 통한 노드-로컬 간 서비스 거부. 자세한 내용은 https://github.com/kubernetes/kubernetes/issues/93032 을 참조한다. ([#92916](https://github.com/kubernetes/kubernetes/pull/92916), [@joelsmith](https://github.com/joelsmith)) [SIG Node] -- Client-go: watch를 재구성하는 대신 타임아웃이 발생하면, 정보 제공자가 전체 목록 요청으로 돌아가는 문제가 해결되었다. ([#89652](https://github.com/kubernetes/kubernetes/pull/89652), [@liggitt](https://github.com/liggitt)) [SIG API Machinery 및 Testing] -- CloudNodeLifecycleController는 노드 모니터링을 할 때, 셧다운 상태 전에 노드의 존재 상태를 확인하게 된다. ([#90737](https://github.com/kubernetes/kubernetes/pull/90737), [@jiahuif](https://github.com/jiahuif)) [SIG Apps 및 Cloud Provider] -- `startupProbe` 는 지정하지만 `readinessProbe` 는 지정하지 않은 컨테이너는 이전에는 `startupProbe` 가 완료되기 전에 "준비(ready)"된 것으로 간주되었지만 이제는 "준비되지 않은(not-ready)" 것으로 간주된다. ([#92196](https://github.com/kubernetes/kubernetes/pull/92196), [@thockin](https://github.com/thockin)) [SIG Node] -- 이제 Cordon 된 노드가 AWS 대상 그룹에서 등록 취소된다. ([#85920](https://github.com/kubernetes/kubernetes/pull/85920), [@hoelzro](https://github.com/hoelzro)) [SIG Cloud Provider] -- kubernetes.azure.com/managed=false 레이블이 지정된 노드를 로드 밸런서의 백엔드 풀에 추가하지 않는다. ([#93034](https://github.com/kubernetes/kubernetes/pull/93034), [@matthias50](https://github.com/matthias50)) [SIG Cloud Provider] -- CSI 드라이버가 FailedPrecondition 오류를 반환하는 경우 볼륨 확장을 재시도 하지 않는다. ([#92986](https://github.com/kubernetes/kubernetes/pull/92986), [@gnufied](https://github.com/gnufied)) [SIG Node 및 Storage] -- Dockershim 보안: 이제 파드 샌드박스가 항상 `no-new-privileges` 및 `runtime/default` seccomp 프로필로 실행된다. - dockershim seccomp: 이제 파드 수준에서 설정할 때 사용자 지정 프로필이 더 작은 seccomp 프로필을 가질 수 있다. ([#90948](https://github.com/kubernetes/kubernetes/pull/90948), [@pjbgf](https://github.com/pjbgf)) [SIG Node] -- 이중-스택: 서비스 clusterIP가 지정된 ipFamily를 따르지 않는 버그가 수정되었다. ([#89612](https://github.com/kubernetes/kubernetes/pull/89612), [@SataQiu](https://github.com/SataQiu)) [SIG Network] -- EndpointSliceMirroring 컨트롤러는 이제 엔드포인트에서 엔드포인트슬라이스로 레이블을 복사한다. ([#93442](https://github.com/kubernetes/kubernetes/pull/93442), [@robscott](https://github.com/robscott)) [SIG Apps 및 Network] -- Azure 가용성 영역(availability zone)이 항상 소문자인지 확인한다. ([#89722](https://github.com/kubernetes/kubernetes/pull/89722), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- DeletionTimestamp가 0이 아닌 파드에 대한 축출 요청이 항상 성공하게 된다. ([#91342](https://github.com/kubernetes/kubernetes/pull/91342), [@michaelgugino](https://github.com/michaelgugino)) [SIG Apps] -- 리소스 이름이 내장 오브젝트와 동일한 CRD를 설명한다. ([#89505](https://github.com/kubernetes/kubernetes/pull/89505), [@knight42](https://github.com/knight42)) [SIG API Machinery, CLI 및 Testing] -- 내부 정보가 동기화 되었는지를 확인하는 새로운 "informer-sync" 검사로 kube-apiserver의 /readyz 를 확장한다. ([#92644](https://github.com/kubernetes/kubernetes/pull/92644), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery 및 Testing] -- winkernel kube-proxy 에 있는 DSR 로드밸런서 버전이 HNS 버전 9.3-9.max, 10.2+ 로 확장되었다. ([#93080](https://github.com/kubernetes/kubernetes/pull/93080), [@elweb9858](https://github.com/elweb9858)) [SIG Network] -- 필수 어피니티 용어가 있는 첫번째 파드는 토폴로지 키가 일치하는 노드에서만 예약할 수 있게 된다. ([#91168](https://github.com/kubernetes/kubernetes/pull/91168), [@ahg-g](https://github.com/ahg-g)) [SIG Scheduling] -- 연결 해제된 상태의 CIDR이 존재하는 경우에 대한 AWS 로드밸런서 VPC CIDR 계산이 수정되었다. ([#92227](https://github.com/kubernetes/kubernetes/pull/92227), [@M00nF1sh](https://github.com/M00nF1sh)) [SIG Cloud Provider] -- 관리되지 않는 노드에 대한 InstanceMetadataByProviderID 가 수정되었다. ([#92572](https://github.com/kubernetes/kubernetes/pull/92572), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- 고객이 VMSS orchestrationMode를 설정한 경우 `VirtualMachineScaleSets.virtualMachines.GET` 이 허용되지 않았던 문제가 수정되었다. ([#91097](https://github.com/kubernetes/kubernetes/pull/91097), [@feiskyer](https://github.com/feiskyer)) -- 앞에 0이 있는 IPv6 주소 사용을 허용하지 않던 버그가 수정되었다. ([#89341](https://github.com/kubernetes/kubernetes/pull/89341), [@aojea](https://github.com/aojea)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle 및 Instrumentation] -- ExternalTrafficPolicy 가 ExternalIPs 서비스에 적용되지 않던 버그를 수정하였다. ([#90537](https://github.com/kubernetes/kubernetes/pull/90537), [@freehan](https://github.com/freehan)) [SIG Network] -- VMSS 캐시에서 nil VM 항목이 만료될 때의 조건이 수정되었다. ([#92681](https://github.com/kubernetes/kubernetes/pull/92681), [@ArchangelSDY](https://github.com/ArchangelSDY)) [SIG Cloud Provider] -- 스케줄러가 불필요한 스케줄 시도를 수행할 수 있는 레이싱(racing) 이슈가 수정되었다. ([#90660](https://github.com/kubernetes/kubernetes/pull/90660), [@Huang-Wei](https://github.com/Huang-Wei)) -- 수정된 컨피그맵 또는 시크릿 하위 경로(subpath)의 볼륨 마운트를 사용하여 컨테이너가 다시 시작되는 문제가 수정되었다. ([#89629](https://github.com/kubernetes/kubernetes/pull/89629), [@fatedier](https://github.com/fatedier)) [SIG Architecture, Storage 및 Testing] -- 다중 마스터 HA 클러스터에서 정적으로 할당 된 portNumber가 있는 NodePort 생성이 충돌하는 포트 할당 로직 버그가 수정되었다. ([#89937](https://github.com/kubernetes/kubernetes/pull/89937), [@aojea](https://github.com/aojea)) [SIG Network 및 Testing] -- xfs_repair가 xfs 마운트를 중지하는 버그가 수정되었다. ([#89444](https://github.com/kubernetes/kubernetes/pull/89444), [@gnufied](https://github.com/gnufied)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation 및 Storage] -- 클러스터 덤프 정보에 대한 네임스페이스 플래그가 작동하지 않는 문제가 수정되었다. ([#91890](https://github.com/kubernetes/kubernetes/pull/91890), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] -- OOM 으로 컨테이너가 손상된 경우, SystemOOM 감지에 대한 버그가 수정되었다. ([#88871](https://github.com/kubernetes/kubernetes/pull/88871), [@dashpole](https://github.com/dashpole)) [SIG Node] -- 이미지 파일 시스템 감지, devicemapper에 대한 디스크 메트릭, 5.0+ 리눅스 커널에서 OOM Kill 감지에 대한 버그가 수정되었다. ([#92919](https://github.com/kubernetes/kubernetes/pull/92919), [@dashpole](https://github.com/dashpole)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation 및 Node] -- etcd 이미지에서 etcd 버전 마이그레이션 스크립트가 수정되었다. ([#91925](https://github.com/kubernetes/kubernetes/pull/91925), [@wenjiaswe](https://github.com/wenjiaswe)) [SIG API Machinery] -- Azure 파일 CSI 번역의 결함이 수정되었다. ([#90162](https://github.com/kubernetes/kubernetes/pull/90162), [@rfranzke](https://github.com/rfranzke)) [SIG Release 및 Storage] -- 짧은 시간에 Azure 노드를 다시 만들 경우, 인스턴스를 찾을 수 없는 문제가 수정되었다. ([#93316](https://github.com/kubernetes/kubernetes/pull/93316), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- 지원되는 거대 페이지의 크기를 변경할 시 발생하는 문제가 수정되었다. ([#80831](https://github.com/kubernetes/kubernetes/pull/80831), [@odinuge](https://github.com/odinuge)) [SIG Node 및 Testing] -- 준비 상태(readiness)를 보고하기 전까지 APIServices가 HTTP 핸들러에 설치될 때까지 기다리도록 kube-apiserver 시작 작업이 수정되었다. ([#89147](https://github.com/kubernetes/kubernetes/pull/89147), [@sttts](https://github.com/sttts)) [SIG API Machinery] -- kubectl create --dryrun 클라이언트가 네임스페이스를 무시하는 문제가 수정되었다. ([#90502](https://github.com/kubernetes/kubernetes/pull/90502), [@zhouya0](https://github.com/zhouya0)) -- kubectl create secret docker-registry 명령어의 --from-file 플래그를 사용할 수 없는 문제가 수정되었다. ([#90960](https://github.com/kubernetes/kubernetes/pull/90960), [@zhouya0](https://github.com/zhouya0)) [SIG CLI 및 Testing] -- kubectl describe CSINode 명령어의 nil pointer 에러가 수정되었다. ([#89646](https://github.com/kubernetes/kubernetes/pull/89646), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] -- 리스(Lease) 정보에 접근할 수 없는 사용자를 위해 kubectl describe node 명령어가 수정되었다. ([#90469](https://github.com/kubernetes/kubernetes/pull/90469), [@uthark](https://github.com/uthark)) [SIG CLI] -- 빈 어노테이션에 대한 kubectl describe 명령어의 출력 형식이 수정되었다. ([#91405](https://github.com/kubernetes/kubernetes/pull/91405), [@iyashu](https://github.com/iyashu)) [SIG CLI] -- 실제로 패치를 지속하지 않도록 kubectl diff 명령어가 수정되었다. ([#89795](https://github.com/kubernetes/kubernetes/pull/89795), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG CLI 및 Testing] -- kubectl run 명령어의 --dry-run=client 플래그가 네임스페이스를 무시하는 문제가 수정되었다. ([#90785](https://github.com/kubernetes/kubernetes/pull/90785), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] -- kubectl version 명령이 설정 파일 없이 버전 정보를 표시하도록 변경되었다. ([#89913](https://github.com/kubernetes/kubernetes/pull/89913), [@zhouya0](https://github.com/zhouya0)) [SIG API Machinery 및 CLI] -- `kubectl alpha debug` 명령어의 `--container` 플래그에 대하여 `-c` 축약표현이 누락된 문제가 수정되었다. ([#89674](https://github.com/kubernetes/kubernetes/pull/89674), [@superbrothers](https://github.com/superbrothers)) [SIG CLI] -- 오브젝트의 평균 값이 무시되어 출력되는 문제가 수정되었다. ([#89142](https://github.com/kubernetes/kubernetes/pull/89142), [@zhouya0](https://github.com/zhouya0)) [SIG API Machinery] -- Azure VMs에 공용 IP를 할당 한 후 공용 IP가 표시되지 않는 문제가 수정되었다. ([#90886](https://github.com/kubernetes/kubernetes/pull/90886), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- 파드보다 먼저 노드를 제거할 때 스케줄러의 충돌이 일어나는 문제를 수정하였다. ([#89908](https://github.com/kubernetes/kubernetes/pull/89908), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- 로드밸런서 backendPools 에 대해 Azure VMSS를 업데이트 할 때 VMSS 이름 및 리소스 그룹의 이름 수정에 대한 버그가 수정되었다. ([#89337](https://github.com/kubernetes/kubernetes/pull/89337), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- Azure VM 컴퓨터 이름의 접두사가 VMSS 이름과 다른 경우의 스로틀링 문제가 해결되었다. ([#92793](https://github.com/kubernetes/kubernetes/pull/92793), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- 수정: Azure 할당 해제 노드가 종료된 것으로 간주 ([#92257](https://github.com/kubernetes/kubernetes/pull/92257), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] -- 수정: azure 디스크 PV에 대한 GetLabelsForVolume 패닉 문제 ([#92166](https://github.com/kubernetes/kubernetes/pull/92166), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] -- 수정: 어노테이션 지원에 Azure 파일 마이그레이션 지원 추가 ([#91093](https://github.com/kubernetes/kubernetes/pull/91093), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider 및 Node] -- 수정: API 스로틀링(throttling)을 유발할 수 있는 Azure 디스크 댕글링(dangling) 연결 문제 ([#90749](https://github.com/kubernetes/kubernetes/pull/90749), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] -- 수정: ip 제품군을 기반으로 올바른 ip 결정 ([#93043](https://github.com/kubernetes/kubernetes/pull/93043), [@aramase](https://github.com/aramase)) [SIG Cloud Provider] -- 수정: 비어있는 경우 도커 구성 캐시를 사용하지 않음 ([#92330](https://github.com/kubernetes/kubernetes/pull/92330), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] -- 수정: Azure 디스크 스토리지 클래스 마이그레이션에서 토폴로지 문제 수정 ([#91196](https://github.com/kubernetes/kubernetes/pull/91196), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] -- 수정: 최대 개수 테이블에 항목이 누락되어 디스크 연결 오류 발생 ([#89768](https://github.com/kubernetes/kubernetes/pull/89768), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider 및 Storage] -- 수정: 잘못된 최대 Azure 디스크 최대 개수 ([#92331](https://github.com/kubernetes/kubernetes/pull/92331), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider 및 Storage] -- 수정: Azure 디스크 및 파일 마운트 시 초기 지연 ([#93052](https://github.com/kubernetes/kubernetes/pull/93052), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider 및 Storage] -- 수정: Azure에서 삭제된 비 VMSS 인스턴스에 의해 지원되는 노드 제거 지원 ([#91184](https://github.com/kubernetes/kubernetes/pull/91184), [@bpineau](https://github.com/bpineau)) [SIG Cloud Provider] -- 수정: Azure 디스크에 강제 분리 사용 ([#91948](https://github.com/kubernetes/kubernetes/pull/91948), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] -- wait.Forever에서 첫 번째 반복에서 백오프 기간을 건너 뛰는 1.18 회귀 문제가 수정되었다. ([#90476](https://github.com/kubernetes/kubernetes/pull/90476), [@zhan849](https://github.com/zhan849)) [SIG API Machinery] -- 엔드포인트 슬라이스 업데이트에서 newObj 를 oldObj 로 잘못 사용하는 버그가 수정되었다. ([#92339](https://github.com/kubernetes/kubernetes/pull/92339), [@fatkun](https://github.com/fatkun)) [SIG Apps 및 Network] -- 중첩 범위가 있는 jsonpath 출력 표현식으로 kubectl 명령을 실행하면, 중첩 범위 다음의 표현식이 무시되는 버그가 수정되었다. ([#88464](https://github.com/kubernetes/kubernetes/pull/88464), [@brianpursley](https://github.com/brianpursley)) [SIG API Machinery] -- TopologyManager가 활성화 되었을 때, 재사용 가능한 CPU 및 장치 할당이 적용되지 않는 버그가 수정되었다. ([#93189](https://github.com/kubernetes/kubernetes/pull/93189), [@klueska](https://github.com/klueska)) [SIG Node] -- 깊이 중첩된 오브젝트에 json 패치를 적용하는 성능 문제가 수정되었다. ([#92069](https://github.com/kubernetes/kubernetes/pull/92069), [@tapih](https://github.com/tapih)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle 및 Instrumentation] -- RBAC 역할 및 바인딩 오브젝트의 가비지 수집을 방지하는 회귀 문제가 수정되었다. ([#90534](https://github.com/kubernetes/kubernetes/pull/90534), [@apelisse](https://github.com/apelisse)) [SIG Auth] -- kubeconfig 파일이 없을 때 --local 또는 --dry-run 플래그를 사용하여 kubectl 명령을 실행하는 회귀 문제가 수정되었다. ([#90243](https://github.com/kubernetes/kubernetes/pull/90243), [@soltysh](https://github.com/soltysh)) [SIG API Machinery, CLI 및 Testing] -- 베어러 토큰(kubectl --token=..)과 exec 자격증명 플러그인이 동일한 컨텍스트로 구성되었을 때 모호하게 동작하는 문제가 수정되었다. 이제 전달자 토큰이 우선하게 된다. ([#91745](https://github.com/kubernetes/kubernetes/pull/91745), [@anderseknert](https://github.com/anderseknert)) [SIG API Machinery, Auth 및 Testing] -- 이름에 `.` 문자가 포함된 서비스 어카운트의 사용자 인증 정보 마운트 문제가 수정되었다. ([#89696](https://github.com/kubernetes/kubernetes/pull/89696), [@nabokihms](https://github.com/nabokihms)) [SIG Auth] -- 노드 삭제 시 파드의 nominatedNodeName을 지울 수 없는 문제가 수정되었다. ([#91750](https://github.com/kubernetes/kubernetes/pull/91750), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling 및 Testing] -- zsh 완료가 성공적으로 초기화되었지만 zsh 완료를 초기화 할때 0이 아닌 종료 코드가 반환되는 버그가 수정되었다. ([#88165](https://github.com/kubernetes/kubernetes/pull/88165), [@brianpursley](https://github.com/brianpursley)) [SIG CLI] -- endpointSliceTracker의 메모리 누수 문제가 수정되었다. ([#92838](https://github.com/kubernetes/kubernetes/pull/92838), [@tnqn](https://github.com/tnqn)) [SIG Apps 및 Network] -- iSCSI 및 FibreChannel 볼륨 플러그인의 고정 마운트 옵션이 수정되었다. ([#89172](https://github.com/kubernetes/kubernetes/pull/89172), [@jsafrane](https://github.com/jsafrane)) [SIG Storage] -- 영역 전체의 노드 수에 불균형이 있는 클러스터의 kube-scheduler 에서 손실된 노드 데이터에 대한 문제가 수정되었다. ([#93355](https://github.com/kubernetes/kubernetes/pull/93355), [@maelk](https://github.com/maelk)) -- IPv6DualStack 기능 게이트가 활성화된 클러스터에서 서비스를 생성하거나 - 변경할 때 IPFamily 필드와 관련된 몇 가지 버그가 수정되었다. - - IPFamily 필드의 동작이 이상하고 일관성이 없으며, 이중-스택 - 기능이 GA가 되기 전에 변경될 가능성이 있다. 사용자는 현재 - 이 필드를 "쓰기 전용" 으로 취급해야 하며 현재 IPFamily 값을 - 기반으로 서비스에 대한 어떤 가정도 하지 않아야 한다. ([#91400](https://github.com/kubernetes/kubernetes/pull/91400), [@danwinship](https://github.com/danwinship)) [SIG Apps 및 Network] -- OwnerReferencesPermissionEnforcement 유효성 검사 승인 플러그인이 활성화된 클러스터에서 엔드포인트슬라이스 컨트롤러가 오류없이 실행되도록 수정되었다. ([#89741](https://github.com/kubernetes/kubernetes/pull/89741), [@marun](https://github.com/marun)) [SIG Auth 및 Networking] -- IPv6-전용 파드에 대한 엔드포인트를 올바르게 생성하도록 엔드포인트슬라이스컨트롤러가 수정되었다. +- Add kubectl wait --ignore-not-found flag ([#90969](https://github.com/kubernetes/kubernetes/pull/90969), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] +- Added support to kube-proxy for externalTrafficPolicy=Local setting via Direct Server Return (DSR) load balancers on Windows. ([#93166](https://github.com/kubernetes/kubernetes/pull/93166), [@elweb9858](https://github.com/elweb9858)) [SIG Network] +- Alter wording to describe pods using a pvc ([#95635](https://github.com/kubernetes/kubernetes/pull/95635), [@RaunakShah](https://github.com/RaunakShah)) [SIG CLI] +- An issues preventing volume expand controller to annotate the PVC with `volume.kubernetes.io/storage-resizer` when the PVC StorageClass is already updated to the out-of-tree provisioner is now fixed. ([#94489](https://github.com/kubernetes/kubernetes/pull/94489), [@ialidzhikov](https://github.com/ialidzhikov)) [SIG API Machinery, Apps and Storage] +- Azure ARM client: don't segfault on empty response and http error ([#94078](https://github.com/kubernetes/kubernetes/pull/94078), [@bpineau](https://github.com/bpineau)) [SIG Cloud Provider] +- Azure armclient backoff step defaults to 1 (no retry). ([#94180](https://github.com/kubernetes/kubernetes/pull/94180), [@feiskyer](https://github.com/feiskyer)) +- Azure: fix a bug that kube-controller-manager would panic if wrong Azure VMSS name is configured ([#94306](https://github.com/kubernetes/kubernetes/pull/94306), [@knight42](https://github.com/knight42)) [SIG Cloud Provider] +- Both apiserver_request_duration_seconds metrics and RequestReceivedTimestamp fields of an audit event now take into account the time a request spends in the apiserver request filters. ([#94903](https://github.com/kubernetes/kubernetes/pull/94903), [@tkashem](https://github.com/tkashem)) +- Build/lib/release: Explicitly use '--platform' in building server images - IPv6DualStack 기능 게이트가 활성화된 경우 서비스에서 - `ipFamily: IPv6` 을 지정하여 IPv6 헤드리스 서비스를 허용하도록 - 엔드포인트컨트롤러가 수정되었다. (이것은 이미 엔드포인트슬라이스컨트롤러와 함께 작동되었다.) ([#91399](https://github.com/kubernetes/kubernetes/pull/91399), [@danwinship](https://github.com/danwinship)) [SIG Apps 및 Network] -- 여러 파드에서 읽기 전용 iSCSI 볼륨을 사용할 때 발생하는 문제가 수정되었다. ([#91738](https://github.com/kubernetes/kubernetes/pull/91738), [@jsafrane](https://github.com/jsafrane)) [SIG Storage 및 Testing] -- 정보제공자(informer)를 사용하는 CSI 볼륨 첨부 스케일링의 문제가 수정되었다. ([#91307](https://github.com/kubernetes/kubernetes/pull/91307), [@yuga711](https://github.com/yuga711)) [SIG API Machinery, Apps, Node, Storage 및 Testing] -- 스케일 하위리소스가 활성화된 사용자 지정 리소스 정의의 복제본 필드에 대한 기본값을 수정하는 버그가 수정되었다. ([#89833](https://github.com/kubernetes/kubernetes/pull/89833), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle 및 Instrumentation] -- 디렉토리가 아닌 hostpath 타입이 HostPathFile로 인식될 수 있는 버그가 수정되었으며, HostPathType에 대한 e2e 테스트가 추가되었다. ([#64829](https://github.com/kubernetes/kubernetes/pull/64829), [@dixudx](https://github.com/dixudx)) [SIG Apps, Storage 및 Testing] -- 1.16 에서 처음 널리 알려졌던, 일부 VXLAN-기반 네트워크 - 플러그인에서 63-초 또는 1-초 연결 지연 문제가 수정되었다. - (일부 사용자는 특정 네트워크 플러그인에서 이 문제를 더 일찍 확인했다.) - 이전에 ethtool 을 사용하여 기본 네트워크 인터페이스에서 체크섬 오프로드를 - 비활성화한 경우 이제 그 작업을 중지할 수 있다. ([#92035](https://github.com/kubernetes/kubernetes/pull/92035), [@danwinship](https://github.com/danwinship)) [SIG Network 및 Node] -- API 요청에서 캐시-제어 헤더가 삭제된 1.17 의 회귀문제가 수정되었다. ([#90468](https://github.com/kubernetes/kubernetes/pull/90468), [@liggitt](https://github.com/liggitt)) [SIG API Machinery 및 Testing] -- 잘못된 주석이 있는 HorizontalPodAutoscaler 오브젝트의 변환 오류가 수정되었다. ([#89963](https://github.com/kubernetes/kubernetes/pull/89963), [@liggitt](https://github.com/liggitt)) [SIG Autoscaling] -- 오류가 발생했을 경우, 중지하는 대신 올바르게 빌드된 모든 오브젝트에 적용하도록 kubectl 이 수정되었다. ([#89848](https://github.com/kubernetes/kubernetes/pull/89848), [@seans3](https://github.com/seans3)) [SIG CLI 및 Testing] -- 부정확한 시간에 독점 CPU를 해제하는 CPUManager 의 회귀 문제가 수정되었다. ([#90377](https://github.com/kubernetes/kubernetes/pull/90377), [@cbf123](https://github.com/cbf123)) [SIG Cloud Provider 및 Node] -- 초기화(init) 컨테이너로부터 상속된 앱 컨테이너에서 독점 CPU를 해제할 가능성이 거의 없는 CPUManager 의 회귀 문제가 수정되었다. ([#90419](https://github.com/kubernetes/kubernetes/pull/90419), [@klueska](https://github.com/klueska)) [SIG Node] -- 로컬 및 원격 포트를 지정할 때 `kubectl port-forward` 에서 v1.18.0-rc.1 로의 회귀문제가 수정되었다. ([#89401](https://github.com/kubernetes/kubernetes/pull/89401), [@liggitt](https://github.com/liggitt)) -- 엔드포인트슬라이스 컨트롤러 가비지 수집에 대한 경합(race) 조건이 수정되었다. ([#91311](https://github.com/kubernetes/kubernetes/pull/91311), [@robscott](https://github.com/robscott)) [SIG Apps, Network 및 Testing] -- GCE 클러스터 공급자의 경우, 단일 영역에서 노드가 1000 개 이상인 클러스터에 대해 내부 유형의 로드 밸런서를 만들수 없는 버그가 수정되었다. ([#89902](https://github.com/kubernetes/kubernetes/pull/89902), [@wojtek-t](https://github.com/wojtek-t)) [SIG Cloud Provider, Network 및 Scalability] -- 외부 스토리지 e2e 테스트 스위트(suite) 의 경우, VolumeSnapshotClass가 입력으로 명시적으로 제공되는 경우, VolumeSnapshotClass에서 스냅샷 프로비저닝 도구를 선택하도록 외부 드라이버가 변경되었다. ([#90878](https://github.com/kubernetes/kubernetes/pull/90878), [@saikat-royc](https://github.com/saikat-royc)) [SIG Storage 및 Testing] -- Get-kube.sh: 올바른 버킷에서 바이너리를 가져오도록 순서가 수정되었다. ([#91635](https://github.com/kubernetes/kubernetes/pull/91635), [@cpanato](https://github.com/cpanato)) [SIG Release] -- firstTimestamp가 설정되지 않은 경우 이벤트를 출력할 때, eventTime 을 사용하도록 수정되었다. ([#89999](https://github.com/kubernetes/kubernetes/pull/89999), [@soltysh](https://github.com/soltysh)) [SIG CLI] -- 파라미터 cgroupPerQos=false 및 cgroupRoot=/docker 를 설정하면 이 함수는 nodeAllocatableRoot=/docker/kubepods 를 반환하는데 이는 옳지 않다. 올바른 반환은 /docker.cm.NodeAllocatableRoot(s.CgroupRoot, s.CgroupDriver) - 이어야 한다. + When we switched to go-runner for building the apiserver, + controller-manager, and scheduler server components, we no longer + reference the individual architectures in the image names, specifically + in the 'FROM' directive of the server image Dockerfiles. - kubeDeps.CAdvisorInterface, err = cadvisor.New(imageFsInfoProvider, s.RootDirectory, cgroupRoots, cadvisor.UsingLegacyCadvisorStats(s.ContainerRuntime, s.RemoteRuntimeEndpoint)) - 위 함수는 cgroupRoots를 사용하여 cadvisor 인터페이스를 만들 때, 잘못된 파라미터 cgroupRoots 로 인해 제거 관리자가 /docker 에서 메트릭을 수집하지 않도록 유도하고 kubelet은 이러한 오류를 자주 표시하게된다. - E0303 17:25:03.436781 63839 summary_sys_containers.go:47] Failed to get system container stats for "/docker": failed to get cgroup stats for "/docker": failed to get container info for "/docker": unknown container "/docker" - E0303 17:25:03.436809 63839 helpers.go:680] eviction manager: failed to construct signal: "allocatableMemory.available" error: system container "pods" not found in metrics ([#88970](https://github.com/kubernetes/kubernetes/pull/88970), [@mysunshine92](https://github.com/mysunshine92)) [SIG Node] -- HA 환경에서, 대기 스케줄러가 API 서버와의 연결이 끊어진 기간 동안 파드를 삭제하고 다시 생성한 후 대기 스케줄러가 마스터가 되면 스케줄러 캐시가 손상될 수 있다. 이 PR은 이 문제를 해결한다. ([#91126](https://github.com/kubernetes/kubernetes/pull/91126), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling] -- /metrics/resource 의 kubelet 리소스 메트릭 엔드포인트에서 다음 메트릭의 이름이 변경되었다. - - node_cpu_usage_seconds --> node_cpu_usage_seconds_total - - container_cpu_usage_seconds --> container_cpu_usage_seconds_total - 이것은 1.18.0에서 추가된 #86282의 부분적인 되돌리기이며, 처음에는 _total 접미사가 제거되었다. ([#89540](https://github.com/kubernetes/kubernetes/pull/89540), [@dashpole](https://github.com/dashpole)) [SIG Instrumentation 및 Node] -- Ipvs: 지원되는 커널에서만 sysctlconnreuse 설정을 시도한다. ([#88541](https://github.com/kubernetes/kubernetes/pull/88541), [@cmluciano](https://github.com/cmluciano)) [SIG Network] -- kubectl/client-go의 Jsonpath 지원은 복잡한 유형(맵/슬라이스/구조체)을 Go-구문 대신 json으로 직렬화 한다. ([#89660](https://github.com/kubernetes/kubernetes/pull/89660), [@pjferrell](https://github.com/pjferrell)) [SIG API Machinery, CLI 및 Cluster Lifecycle] -- Kube-aggregator 인증서는 디스크에서 변경시 동적으로 로드된다. ([#92791](https://github.com/kubernetes/kubernetes/pull/92791), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery] -- Kube-apiserver: 불필요한 409 충돌 오류를 클라이언트에 반환하지 않도록 스케일 하위 리소스 패치 처리가 수정되었다. ([#90342](https://github.com/kubernetes/kubernetes/pull/90342), [@liggitt](https://github.com/liggitt)) [SIG Apps, Autoscaling 및 Testing] -- Kube-apiserver: 연속적인 재귀 하강 연산자가 있는 jsonpath 표현식은 더 이상 사용자 정의 리소스 표시 열에 대해 해석되지 않는다. ([#93408](https://github.com/kubernetes/kubernetes/pull/93408), [@joelsmith](https://github.com/joelsmith)) [SIG API Machinery] -- Kube-apiserver: 단일 X-Stream-Protocol-Version 헤더의 여러 쉼표로 구분된 프로토콜이 이제 RFC2616을 준수하는 여러 헤더와 함께 인식된다. ([#89857](https://github.com/kubernetes/kubernetes/pull/89857), [@tedyu](https://github.com/tedyu)) [SIG API Machinery] -- Kube-proxy IP 군은 프록시가 사용하는 nodeIP에 의해 결정된다. 우선순위는: - 1. 바인드 주소가 0.0.0.0 또는 ::가 아닌 경우 구성된 --bind-address 의 값 - 2. 설정된 경우, 노드 개체의 기본 IP - 3. IP를 찾을 수 없는 경우, NodeIP 의 기본값은 127.0.0.1 이며 IP 군은 IPv4 이다. ([#91725](https://github.com/kubernetes/kubernetes/pull/91725), [@aojea](https://github.com/aojea)) [SIG Network] -- 이중-스택 모드에서 Kube-proxy는 `Service.Spec.IPFamily` 필드를 사용하는 대신 ClusterIP에서 서비스 IP 계열을 유추한다. ([#91357](https://github.com/kubernetes/kubernetes/pull/91357), [@aojea](https://github.com/aojea)) -- 이제 Kube-up에 CoreDNS 버전 v1.7.0이 포함된다. 주요 변경 사항은 다음과 같다. - - CoreDNS가 서비스 기록 업데이트를 중단할 수 있는 버그가 수정되었다. - - 어떤 정책이 설정되어도 항상 첫 번째 업스트림 서버만 선택되는 포워드 플러그인의 버그가 수정되었다. - - 쿠버네티스 플러그인에서 이미 사용 중단된 옵션 `resyncperiod` 및 `upstream` 가 제거되었다. - - Prometheus 메트릭 이름 변경을 포함한다(표준 Prometheus 메트릭 명명 규칙에 맞게 변경). 이전 메트릭의 이름을 사용하는 기존 보고 공식과 역호환 된다. - - 페더레이션 플러그인 (v1 쿠버네티스 페더레이션 허용) 이 제거되었다. - 자세한 내용은 https://coredns.io/2020/06/15/coredns-1.7.0-release/ 에서 확인할 수 있다. ([#92718](https://github.com/kubernetes/kubernetes/pull/92718), [@rajansandeep](https://github.com/rajansandeep)) [SIG Cloud Provider] -- Kube-up: 승인 웹훅 자격증명 구성의 확인 설정이 수정되었다. ([#91995](https://github.com/kubernetes/kubernetes/pull/91995), [@liggitt](https://github.com/liggitt)) [SIG Cloud Provider 및 Cluster Lifecycle] -- Kubeadm의 TLS 부트스트랩 프로세스가 조인 시 완료되는 시간 제한이 5 분으로 증가하였다. ([#89735](https://github.com/kubernetes/kubernetes/pull/89735), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] -- Kubeadm: 이 작업을 반복 재시도 함으로써, 업데이트 상태를 보다 탄력적으로 만들기 위하여, join / UpdateStatus에 대한 재시도를 추가하였다. ([#91952](https://github.com/kubernetes/kubernetes/pull/91952), [@xlgao-zju](https://github.com/xlgao-zju)) [SIG Cluster Lifecycle] -- Kubeadm: 안전하지 않은 서비스를 비활성화하기 위하여 사용 중단된 플래그인 --port=0 을 kube-controller-manager 및 kube-scheduler 매니페스트에 추가하였다. 이 플래그가 없으면 기본적으로 구성 요소(예: /metrics)가 (--adress에 의해 제어되는)기본노드 인터페이스에서 안전하지 않게 제공된다. 이 동작을 재정의하고 안전하지 않은 서비스를 활성화하려는 사용자의 경우, 이러한 구성 요소에 대한 kubeadm의 "extraArgs" 메커니즘을 통해 사용자 정의 포트로 --port=X 를 전달할 수 있다. ([#92720](https://github.com/kubernetes/kubernetes/pull/92720), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Kubeadm: "조인" 과정에서, 이미 클러스터에 존재하는 경우 etcd 구성원을 다시 추가하지 않는다. ([#92118](https://github.com/kubernetes/kubernetes/pull/92118), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Kubeadm: "리셋" 과정에서, 클러스터에 남아서 쌓여있는 etcd 멤버만 제거하지 않고, 로컬 etcd 스토리지의 정리를 계속 진행한다. ([#91145](https://github.com/kubernetes/kubernetes/pull/91145), [@tnqn](https://github.com/tnqn)) [SIG Cluster Lifecycle] -- Kubeadm: 조인 중에 동일한 이름의 노드가 클러스터에 이미 존재하는지 확인하는 경우 NodeReady 조건이 올바르게 검증되었는지를 확인한다. ([#89602](https://github.com/kubernetes/kubernetes/pull/89602), [@kvaps](https://github.com/kvaps)) [SIG Cluster Lifecycle] -- Kubeadm: 업그레이드 단계에서 `image-pull-timeout` 플래그가 준수되었는지 확인한다. ([#90328](https://github.com/kubernetes/kubernetes/pull/90328), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] -- Kubeadm: 1.18.x로 업그레이드 후 RBAC 누락으로 인해 노드가 클러스터에 조인할 수 없는 버그가 수정되었다. ([#89537](https://github.com/kubernetes/kubernetes/pull/89537), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Kubeadm: 'kubeadm join'에서 컨트롤 플레인과 관련된 플래그 전달에 대한 잘못된 경고가 수정되었다. ([#89596](https://github.com/kubernetes/kubernetes/pull/89596), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Kubeadm: 느린 설정에서 etcd 멤버를 추가할 때 "kubeadm join" 에 대한 견고성이 향상되었다. ([#90645](https://github.com/kubernetes/kubernetes/pull/90645), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Kubeadm: 생성된 인증서에서 중복된 DNS 이름 및 IP 주소가 제거된다. ([#92753](https://github.com/kubernetes/kubernetes/pull/92753), [@QianChenglong](https://github.com/QianChenglong)) [SIG Cluster Lifecycle] -- Kubectl azure 인증: 1.18.0에서 "spn:" 접두사가 예기치 않게 kubeconfig 파일의 `apiserver-id` 구성에 추가되는 회귀현상을 수정하였다. ([#89706](https://github.com/kubernetes/kubernetes/pull/89706), [@weinong](https://github.com/weinong)) [SIG API Machinery 및 Auth] -- Kubectl: 오토스케일이 '--name' 플래그를 따르지 않던 버그가 수정되었다. ([#91855](https://github.com/kubernetes/kubernetes/pull/91855), [@SataQiu](https://github.com/SataQiu)) [SIG CLI] -- Kubectl: kubectl scale이 '--timeout' 플래그를 따르지 않던 버그가 수정되었다. ([#91858](https://github.com/kubernetes/kubernetes/pull/91858), [@SataQiu](https://github.com/SataQiu)) [SIG CLI] -- Kubelet: kubelet 도움말 정보가 올바른 유형의 플래그를 표시할 수 없던 버그가 수정되었다. ([#88515](https://github.com/kubernetes/kubernetes/pull/88515), [@SataQiu](https://github.com/SataQiu)) [SIG Docs 및 Node] -- Kuberuntime 보안: 파드 샌드박스는 이제 항상 `runtime/default` seccomp 프로필로 실행된다. - kuberuntime seccomp: 사용자 정의 프로필은 이제 파드 수준에서 설정할 때 더 작은 seccomp 프로필을 가질 수 있다. ([#90949](https://github.com/kubernetes/kubernetes/pull/90949), [@pjbgf](https://github.com/pjbgf)) [SIG Node] -- Kubelet 부트 스트랩 인증서 신호를 인식하게 되었다. ([#92786](https://github.com/kubernetes/kubernetes/pull/92786), [@answer1991](https://github.com/answer1991)) [SIG API Machinery, Auth 및 Node] -- 노드 ([#89677](https://github.com/kubernetes/kubernetes/pull/89677), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] -- 여러 네트워크 인터페이스가 있는 AWS 노드에서, kubelet은 이제 보조 인터페이스의 주소를 보다 안정적으로 보고해야 한다. ([#91889](https://github.com/kubernetes/kubernetes/pull/91889), [@anguslees](https://github.com/anguslees)) [SIG Cloud Provider] -- 리스케줄링 시도를 위한 파드의 조건 업데이트는 생략된다. ([#91252](https://github.com/kubernetes/kubernetes/pull/91252), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- 이제 이전에 지정된 노드가 예약 및 확인할 수 없게 된 후 파드를 선점 대상으로 고려할 수 있게 된다. ([#92604](https://github.com/kubernetes/kubernetes/pull/92604), [@soulxu](https://github.com/soulxu)) -- 볼륨을 확장하거나 생성할 때 PVC 요청크기에 대한 오버플로를 방지한다. ([#90907](https://github.com/kubernetes/kubernetes/pull/90907), [@gnufied](https://github.com/gnufied)) [SIG Cloud Provider 및 Storage] -- 프라이빗 Azure 클라우드의 클러스터가 동일한 클라우드의 ACR에 인증할 수 있도록 수정을 허용한다. ([#90425](https://github.com/kubernetes/kubernetes/pull/90425), [@DavidParks8](https://github.com/DavidParks8)) [SIG Cloud Provider] -- AWS 로드밸런서 워커 노드의 SG 규칙 논리를 결정적으로 변경하였다. ([#92224](https://github.com/kubernetes/kubernetes/pull/92224), [@M00nF1sh](https://github.com/M00nF1sh)) [SIG Cloud Provider] -- 서버측 적용을 사용하지 않는 생성/업데이트/패치 요청에서 처리되는 metadata.managedFields의 회귀 문제가 해결되었다. ([#91690](https://github.com/kubernetes/kubernetes/pull/91690), [@apelisse](https://github.com/apelisse)) [SIG API Machinery 및 Testing] -- 윈도우 볼륨을 마운트하는 v1.18.0-rc.1의 회귀 문제가 해결되었다. ([#89319](https://github.com/kubernetes/kubernetes/pull/89319), [@mboersma](https://github.com/mboersma)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation 및 Storage] -- v1 CSR API를 제공하는 서버에 대해 `kubectl certificate approve/deny` 를 사용하는 문제가 해결되었다. ([#91691](https://github.com/kubernetes/kubernetes/pull/91691), [@liggitt](https://github.com/liggitt)) [SIG Auth 및 CLI] -- --namespace 플래그 없이 `kubectl apply --prune` 기능이 복원되었다. 1.17부터 `kubectl apply --prune` 은 기본 네임스페이스(또는 kubeconfig에서) 또는 명령줄 플래그에 명시적으로 지정된 리소스만 제거하였다. 그러나 이것은 구성 파일의 모든 네임스페이스에서 리소스를 제거할 수 있는 kubectl 1.16의 변경사항을 호환되지 않는다. 이 패치는 kubectl 1.16 의 동작을 복원한다. ([#89551](https://github.com/kubernetes/kubernetes/pull/89551), [@tatsuhiro-t](https://github.com/tatsuhiro-t)) [SIG CLI 및 Testing] -- 클러스터/gce/매니페스트의 컨트롤 플레인 매니페스트에서 정적 컨트롤 플레인 파드의 우선순위를 복원한다. ([#89970](https://github.com/kubernetes/kubernetes/pull/89970), [@liggitt](https://github.com/liggitt)) [SIG Cluster Lifecycle 및 Node] -- 1.19-rc1에 추가된, 윈도우 노드를 위한 devicemanager 가 복귀되었다. ([#93263](https://github.com/kubernetes/kubernetes/pull/93263), [@liggitt](https://github.com/liggitt)) Node 및 Windows] -- 스케줄러 v1 정책 구성 또는 알고리즘 제공 업체 설정을 v1beta1 컴포넌트컨피그(ComponentConfig)와 함께 전달하여 정책에서 CC로의 전환을 지원한다. ([#92531](https://github.com/kubernetes/kubernetes/pull/92531), [@damemi](https://github.com/damemi)) [SIG Scheduling] -- 사용 가능한 노드가 없어서 발생하는 스케줄링 실패의 경우 이제 ```schedule_attempts_total``` 메트릭 하위에 스케줄링 불가능으로 보고된다. ([#90989](https://github.com/kubernetes/kubernetes/pull/90989), [@ahg-g](https://github.com/ahg-g)) [SIG Scheduling] -- 이제 파드에 바인딩 된 서비스 어카운트 토큰을 파드 삭제 유예 기간 동안 사용할 수 있다. ([#89583](https://github.com/kubernetes/kubernetes/pull/89583), [@liggitt](https://github.com/liggitt)) [SIG Auth] -- 서비스 로드 밸런서는 더 이상 스케줄링 불가능으로 표시된 노드를 후보 노드에서 제외하지 않는다. 대신 서비스 로드 밸런서 제외 레이블을 사용해야 한다. + As a result, server images for non-amd64 images copy in the go-runner + amd64 binary instead of the go-runner that matches that architecture. - 코돈(cordon) 노드를 보유하고 있는 1.18 클러스터에서 업그레이드 하려는 사용자는, 해당 노드가 서비스 로드 밸런서에서 제외시키려 할 경우, 업그레이드 하기 전에 영향을 받는 노드에 `node.kubernetes.io/exclude-from-external-load-balancers` 레이블을 설정해야 한다. ([#90823](https://github.com/kubernetes/kubernetes/pull/90823), [@smarterclayton](https://github.com/smarterclayton)) [SIG Apps, Cloud Provider 및 Network] -- kubectl annotate 명령어의 --list 옵션이 지원된다. ([#92576](https://github.com/kubernetes/kubernetes/pull/92576), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] -- 노드 추가/삭제 이벤트에서 서비스 `Type=LoadBalancer`에 대한 LB 백엔드 노드를 동기화한다. ([#81185](https://github.com/kubernetes/kubernetes/pull/81185), [@andrewsykim](https://github.com/andrewsykim)) -- 비어있지 않고, 인수가 필요하지 않는 다음의 구성요소는 이제 인수가 지정된 경우 오류 메세지를 출력하고 종료된다. cloud-controller-manager, kube-apiserver, kube-controller-manager, kube-proxy, kubeadm {alpha|config|token|version}, kubemark. 플래그는 짦은 형식의 경우 단일 대시 "-" (0x45), 긴 형식의 경우 이중 대시 "--"로 시작해야 한다. 이 변경 이전에는 잘못된 플래그 (예를 들어, 0x8211: "–" 와 같은 아스키가 아닌 대시문자로 시작)가 위치 인수로 처리되고 무시되었다. ([#91349](https://github.com/kubernetes/kubernetes/pull/91349), [@neolit123](https://github.com/neolit123)) [SIG API Machinery, Cloud Provider, Cluster Lifecycle, Network 및 Scheduling] -- 파드 사양의 terminationGracePeriodSeconds가 미러 파드에 적용된다. ([#92442](https://github.com/kubernetes/kubernetes/pull/92442), [@tedyu](https://github.com/tedyu)) [SIG Node 및 Testing] -- 이전 커널과의 IPVS 호환성 문제를 해결하기 위해 github.com/moby/ipvs를 v1.0.1로 변경하였다. ([#90555](https://github.com/kubernetes/kubernetes/pull/90555), [@andrewsykim](https://github.com/andrewsykim)) [SIG Network] -- status 하위 리소스를 경유하는 파드의 상태 업데이트는 이제 `status.podIP` 및 `status.podIPs` 필드의 형식이 올바른지 확인한다. ([#90628](https://github.com/kubernetes/kubernetes/pull/90628), [@liggitt](https://github.com/liggitt)) [SIG 앱 및 Node] -- 준비상태(readiness)를 보고하기 전에 모든 CRD는 디스커버리 엔드포인트가 확인될 때까지 기다린다. ([#89145](https://github.com/kubernetes/kubernetes/pull/89145), [@sttts](https://github.com/sttts)) [SIG API Machinery] -- 파드를 제거할 때, PDB를 확인하지 않고 Pending 상태의 파드가 제거된다. ([#83906](https://github.com/kubernetes/kubernetes/pull/83906), [@michaelgugino](https://github.com/michaelgugino)) [SIG API Machinery, Apps, Node 및 Scheduling] -- [보안] golang.org/x/text/encoding/unicode 의 취약성 ([#92219](https://github.com/kubernetes/kubernetes/pull/92219), [@voor](https://github.com/voor)) Cloud Provider, Cluster Lifecycle, Instrumentation 및 Node + This commit explicitly sets the '--platform=linux/${arch}' to ensure + we're pulling the correct go-runner arch from the manifest list. -### 기타 (정리(Cleanup) or Flake(플레이크)) + Before: + `FROM ${base_image}` -- --cache-dir은 http 및 디스커버리 모두에 대해 캐시 디렉토리를 설정하며 기본값은 $HOME/.kube/cache이다. ([#92910](https://github.com/kubernetes/kubernetes/pull/92910), [@soltysh](https://github.com/soltysh)) [SIG API Machinery 및 CLI] -- 이미지 로그에 `pod.Namespace` 가 추가되었다. ([#91945](https://github.com/kubernetes/kubernetes/pull/91945), [@zhipengzuo](https://github.com/zhipengzuo)) -- DISABLE_KUBECONFIG_LOCK 환경 변수를 통해 kubeconfig 파일 잠금을 비활성화 하는 기능이 추가되었다. ([#92513](https://github.com/kubernetes/kubernetes/pull/92513), [@soltysh](https://github.com/soltysh)) [SIG API Machinery 및 CLI] -- udp 파드의 conntrack 모듈이 정리되었는지 확인하기 위한 별도의 테스트가 추가되었다. ([#90180](https://github.com/kubernetes/kubernetes/pull/90180), [@JacobTanenbaum](https://github.com/JacobTanenbaum)) [SIG Architecture, Network 및 Testing] -- fsType이 지정되지 않은 경우, cinder 값의 fsType 을 `ext4` 로 조정한다. ([#90608](https://github.com/kubernetes/kubernetes/pull/90608), [@huffmanca](https://github.com/huffmanca)) [SIG Storage] -- 베이스-이미지(base-image): debian-base:v2.1.0를 사용한다. ([#90697](https://github.com/kubernetes/kubernetes/pull/90697), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery 및 Release] -- 베이스-이미지: debian-iptables:v12.1.0를 사용한다. ([#90782](https://github.com/kubernetes/kubernetes/pull/90782), [@justaugustus](https://github.com/justaugustus)) [SIG Release] -- Beta.kubernetes.io/arch는 v1.14 이후 이미 사용 중단되었으며, v1.18은 제거 대상이다. ([#89462](https://github.com/kubernetes/kubernetes/pull/89462), [@wawa0210](https://github.com/wawa0210)) [SIG Testing] -- 빌드: debian-base@v2.1.2 및 debian-iptables@v12.1.1로 변경되었다. ([#93667](https://github.com/kubernetes/kubernetes/pull/93667), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery, Release 및 Testing] -- beta.kubernetes.io/os를 kubernetes.io/os로 변경하였다. ([#89460](https://github.com/kubernetes/kubernetes/pull/89460), [@wawa0210](https://github.com/wawa0210)) [SIG Testing 및 Windows] -- beta.kubernetes.io/os를 kubernetes.io/os로 변경하였다. ([#89461](https://github.com/kubernetes/kubernetes/pull/89461), [@wawa0210](https://github.com/wawa0210)) [SIG Cloud Provider 및 Cluster Lifecycle] -- `kubectl get` 을 사용하여 네임스페이스가 지정되지 않는 리소스를 검색할 때, 리소스가 없을 때의 출력 메세지가 변경되었다. ([#89861](https://github.com/kubernetes/kubernetes/pull/89861), [@rccrdpccl](https://github.com/rccrdpccl)) [SIG CLI] -- CoreDNS는 더 이상 kube-dns 컨피그맵에 대한 페더레이션 데이터 변환을 지원하지 않는다. ([#92716](https://github.com/kubernetes/kubernetes/pull/92716), [@rajansandeep](https://github.com/rajansandeep)) [SIG Cluster Lifecycle] -- 힙스터와 관련된 kubectl top 명령어의 플래그가 사용 중단 되었다. - kubectl top 에서 힙스터 지원이 중단 되었다. ([#87498](https://github.com/kubernetes/kubernetes/pull/87498), [@serathius](https://github.com/serathius)) [SIG CLI] -- 더 이상 사용되지 않는 `--target-ram-md` 플래그가 사용 중단되었다. ([#91818](https://github.com/kubernetes/kubernetes/pull/91818), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery] -- Kubelet API에 직접 의존하는 일부 적합성 테스트가 삭제되었다. ([#90615](https://github.com/kubernetes/kubernetes/pull/90615), [@dims](https://github.com/dims)) [SIG Architecture, Network, Release 및 Testing] -- 바인딩 되지 않은 PVC가 지연 바인딩 모드에 있지만 파드에서 사용하는 경우, `WaitingForPodScheduled` 이벤트를 보내게 된다. ([#91455](https://github.com/kubernetes/kubernetes/pull/91455), [@cofyc](https://github.com/cofyc)) [SIG Storage] -- 수정: blob 디스크 기능의 라이선스 문제 ([#92824](https://github.com/kubernetes/kubernetes/pull/92824), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] -- 전용 kubectl 하위명령어의 필드 관리자를 설정하여 서버측 적용의 충돌 오류를 개선하였다. ([#88885](https://github.com/kubernetes/kubernetes/pull/88885), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG CLI 및 Testing] -- IsFullyQualifiedDomainName()은 IsDNS1123Label을 기반으로 각 레이블의 유효성을 검사한다. ([#90172](https://github.com/kubernetes/kubernetes/pull/90172), [@nak3](https://github.com/nak3)) [SIG API Machinery 및 Network] -- 이제 서비스 어노테이션 `cloud.google.com/network-tier: Standard` 을 사용하여 GCE 로드밸런서의 네트워크 등급을 구성할 수 있다. ([#88532](https://github.com/kubernetes/kubernetes/pull/88532), [@zioproto](https://github.com/zioproto)) [SIG Cloud Provider, Network 및 Testing] -- Kube-aggregator: aggregator_unavailable_apiservice_count 메트릭의 이름을 aggregator_unavailable_apiservice_total로 변경하였다. ([#88156](https://github.com/kubernetes/kubernetes/pull/88156), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery] -- Kube-apiserver: 사용자 정의 리소스 용으로 게시된 openapi 스키마는 이제 표준 ListMeta 스키마 정의를 참조한다. ([#92546](https://github.com/kubernetes/kubernetes/pull/92546), [@liggitt](https://github.com/liggitt)) [SIG API Machinery] -- Kube-proxy는 kube-proxy에 대한 변경 사항이 적용되기 위해 대기열에 마지막으로 대기한 시간을 나타내는 새로운 메트릭인, `kubeproxy_sync_proxy_rules_last_queued_timestamp_seconds` 를 노출해야 한다. ([#90175](https://github.com/kubernetes/kubernetes/pull/90175), [@squeed](https://github.com/squeed)) [SIG Instrumentation 및 Network] -- Kube-scheduler: 메트릭 항목 `scheduler_total_preemption_attempts` 의 이름이 `scheduler_preemption_attempts_total` 로 변경되었다. ([#91448](https://github.com/kubernetes/kubernetes/pull/91448), [@RainbowMango](https://github.com/RainbowMango)) [SIG API Machinery, Cluster Lifecycle, Instrumentation 및 Scheduling] -- Kube-up: 1.17 이전의 동작과 일치하도록 중요 파드를 kube-system 네임스페이스로 기본적으로 제한한다. ([#93121](https://github.com/kubernetes/kubernetes/pull/93121), [@liggitt](https://github.com/liggitt)) [SIG Cloud Provider 및 Scheduling] -- Kubeadm은 이제 kubelet 명령줄 대신 kubelet 구성 요소 설정을 사용하여 IPv6DualStack 기능 게이트를 전달한다. ([#90840](https://github.com/kubernetes/kubernetes/pull/90840), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] -- Kubeadm: "kubeadm upgrade apply" 중에 컨트롤 플레인 이미지를 미리 가져오기 위하여 데몬셋(DaemonSet)을 사용하지 않는다. 개별 노드의 업그레이드는 이제 사전 구동 검사를 하여 필요한 이미지를 가져온다. "kubeadm upgrade apply" 에 대한 "--image-pull-timeout" 플래그는 이제 사용 중단되었으며, GA 지원 중단 정책에 따라 향후 릴리스에서 제거된다. ([#90788](https://github.com/kubernetes/kubernetes/pull/90788), [@xlgao-zju](https://github.com/xlgao-zju)) [SIG Cluster Lifecycle] -- Kubeadm: /healthz 를 사용하는 대신 kube-apiserver의 스태틱(static) 파드에 대해 /livez 및 /readyz 에 대해 두 개의 개별 검사를 사용한다. ([#90970](https://github.com/kubernetes/kubernetes/pull/90970), [@johscheuer](https://github.com/johscheuer)) [SIG Cluster Lifecycle] -- 없음 ([#91597](https://github.com/kubernetes/kubernetes/pull/91597), [@elmiko](https://github.com/elmiko)) [SIG Autoscaling 및 Testing] -- Openapi-controller: 등급 제한 메트릭 `APIServiceOpenAPIAggregationControllerQueue1` 에서 후행의 `1` 문자리터럴을 제거하고, 프로메테우스의 모범 사례를 준수하도록 이름을 `open_api_aggregation_controller` 로 변경하였다. ([#77979](https://github.com/kubernetes/kubernetes/pull/77979), [@s-urbaniak](https://github.com/s-urbaniak)) [SIG API Machinery] -- 볼륨 작동 오류시 이벤트 스팸이 감소하였다. ([#89794](https://github.com/kubernetes/kubernetes/pull/89794), [@msau42](https://github.com/msau42)) [SIG Storage] -- 로컬 nodeipam 범위 할당자를 리팩토링하고 다음의 메트릭을 사용하여, 할당된 CIDR을 저장하는데 사용된 cidr집합을 계측한다. - "cidrset_cidrs_allocations_total", - "cidrset_cidrs_releases_total", - "cidrset_usage_cidrs", - "cidrset_allocation_tries_per_request", ([#90288](https://github.com/kubernetes/kubernetes/pull/90288), [@aojea](https://github.com/aojea)) [SIG 앱, Instrumentation, Network 및 확장성] -- kubectl apply 명령어에서 사용 중단된 --server-dry-run 플래그가 제거되었다. ([#91308](https://github.com/kubernetes/kubernetes/pull/91308), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG CLI 및 Testing] -- 기능 게이트 DefaultPodTopologySpread와의 이름 충돌을 피하기 위해 DefaultPodTopologySpread 플러그인의 이름을 SelectorSpread 플러그인으로 변경하였다. ([#92501](https://github.com/kubernetes/kubernetes/pull/92501), [@rakeshreddybandi](https://github.com/rakeshreddybandi)) [SIG Release, Scheduling 및 Testing] -- framework.Failf가 ExpectNoError로 변경되었다. ([#91811](https://github.com/kubernetes/kubernetes/pull/91811), [@lixiaobing1](https://github.com/lixiaobing1)) [SIG Instrumentation, Storage 및 Testing] -- 필터링 된 노드가 하나 이하인 경우, 스케줄러 PreScore 플러그인이 실행되지 않는다. ([#89370](https://github.com/kubernetes/kubernetes/pull/89370), [@ahg-g](https://github.com/ahg-g)) [SIG Scheduling] -- "HostPath는 볼륨에 올바른 모드를 제공해야 한다."는 이제 적합성 테스트에서 제외된다. ([#90861](https://github.com/kubernetes/kubernetes/pull/90861), [@dims](https://github.com/dims)) [SIG Architecture 및 Testing] -- Kubelet의 `--experimental-allocatable-ignore-eviction` 옵션은 이제 사용 중단된 것으로 표시된다. ([#91578](https://github.com/kubernetes/kubernetes/pull/91578), [@knabben](https://github.com/knabben)) [SIG Node] -- Kubelet의 `--experimental-mounter-path` 및 `--experimental-check-node-capabilities-before-mount` 옵션은 이제 사용 중단된 것으로 표시된다. ([#91373](https://github.com/kubernetes/kubernetes/pull/91373), [@knabben](https://github.com/knabben)) -- PR은 PV 또는 PVC 처리에서 특정 실패가 발생할 때 이벤트를 생성하는 기능을 추가한다. 이 이벤트는 사용자가 사용 실패 이유를 파악하여 필요한 복구 조치를 취할 수 있도록 도와준다. ([#89845](https://github.com/kubernetes/kubernetes/pull/89845), [@yuga711](https://github.com/yuga711)) [SIG Apps] -- PodShareProcessNamespace 기능 게이트가 제거되고, PodShareProcessNamespace 는 항상 활성화된다. ([#90099](https://github.com/kubernetes/kubernetes/pull/90099), [@tanjunchen](https://github.com/tanjunchen)) [SIG Node] -- kube-apiserver의 `--kubelet-https` 플래그가 사용 중단 된다. kubelet에 대한 kube-apiserver의 연결은 이제 항상 `https` 를 사용한다. (kubelet은 v1.0 이전부터 apiserver가 통신하는 엔드포인트를 제공하기 위해 언제나 `https` 를 사용하였다.) ([#91630](https://github.com/kubernetes/kubernetes/pull/91630), [@liggitt](https://github.com/liggitt)) [SIG API Machinery 및 Node] -- CNI가 v0.8.6로 변경되었다. ([#91370](https://github.com/kubernetes/kubernetes/pull/91370), [@justaugustus](https://github.com/justaugustus)) [SIG Cloud Provider, Network, Release 및 Testing] -- Golang이 v1.14.5로 변경되었다. - - Update repo-infra to 0.0.7 (go1.14.5 및 go1.13.13을 지원하기 위해) - - 포함: - - bazelbuild/bazel-toolchains@3.3.2 - - bazelbuild/rules_go@v0.22.7 ([#93088](https://github.com/kubernetes/kubernetes/pull/93088), [@justaugustus](https://github.com/justaugustus)) [SIG Release 및 Testing] -- Golang이 v1.14.6로 변경되었다. - - repo-infra가 0.0.8로 변경되었다. (go1.14.6 및 go1.13.14을 지원하기 위해) - - 포함: - - bazelbuild/bazel-toolchains@3.4.0 - - bazelbuild/rules_go@v0.22.8 ([#93198](https://github.com/kubernetes/kubernetes/pull/93198), [@justaugustus](https://github.com/justaugustus)) [SIG Release 및 Testing] -- corefile-migration 라이브러리가 1.0.8로 변경되었다. ([#91856](https://github.com/kubernetes/kubernetes/pull/91856), [@wawa0210](https://github.com/wawa0210)) [SIG Node] -- 기본 etcd 서버 버전이 3.4.4로 변경되었다. ([#89214](https://github.com/kubernetes/kubernetes/pull/89214), [@jingyih](https://github.com/jingyih)) [SIG API Machinery, Cluster Lifecycle 및 Testing] -- 기본 etcd 서버 버전이 3.4.7로 변경되었다. ([#89895](https://github.com/kubernetes/kubernetes/pull/89895), [@jingyih](https://github.com/jingyih)) [SIG API Machinery, Cluster Lifecycle 및 Testing] -- 기본 etcd 서버 버전이 3.4.9로 변경되었다. ([#92349](https://github.com/kubernetes/kubernetes/pull/92349), [@jingyih](https://github.com/jingyih)) [SIG API Machinery, Cloud Provider, Cluster Lifecycle 및 Testing] -- go.etcd.io/bbolt가 v1.3.5로 변경되었다. ([#92350](https://github.com/kubernetes/kubernetes/pull/92350), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery 및 Cloud Provider] -- opencontainers/runtime-spec 의존성이 v1.0.2로 변경되었다. ([#89644](https://github.com/kubernetes/kubernetes/pull/89644), [@saschagrunert](https://github.com/saschagrunert)) [SIG Node] -- `beta.kubernetes.io/os` 및 `beta.kubernetes.io/arch` 노드 레이블은 사용 중단되었다. `kubernetes.io/os` 및 `kubernetes.io/arch` 를 사용하도록 노드 셀렉터를 변경해야한다. ([#91046](https://github.com/kubernetes/kubernetes/pull/91046), [@wawa0210](https://github.com/wawa0210)) [SIG Apps 및 Node] -- `kubectl config view` 는 이제 클라이언트 인증서와 유사하게 기본적으로 베어러 토큰을 수정한다. `--raw` 플래그는 여전히 전체 컨텐츠를 출력하는데 사용될 수 있다. ([#88985](https://github.com/kubernetes/kubernetes/pull/88985), [@puerco](https://github.com/puerco)) + After: + `FROM --platform=linux/${arch} ${base_image}` ([#94552](https://github.com/kubernetes/kubernetes/pull/94552), [@justaugustus](https://github.com/justaugustus)) [SIG Release] +- Bump node-problem-detector version to v0.8.5 to fix OOM detection in with Linux kernels 5.1+ ([#96716](https://github.com/kubernetes/kubernetes/pull/96716), [@tosi3k](https://github.com/tosi3k)) [SIG Cloud Provider, Scalability and Testing] +- CSIDriver object can be deployed during volume attachment. ([#93710](https://github.com/kubernetes/kubernetes/pull/93710), [@Jiawei0227](https://github.com/Jiawei0227)) [SIG Apps, Node, Storage and Testing] +- Ceph RBD volume expansion now works even when ceph.conf was not provided. ([#92027](https://github.com/kubernetes/kubernetes/pull/92027), [@juliantaylor](https://github.com/juliantaylor)) +- Change plugin name in fsgroupapplymetrics of csi and flexvolume to distinguish different driver ([#95892](https://github.com/kubernetes/kubernetes/pull/95892), [@JornShen](https://github.com/JornShen)) [SIG Instrumentation, Storage and Testing] +- Change the calculation of pod UIDs so that static pods get a unique value - will cause all containers to be killed and recreated after in-place upgrade. ([#87461](https://github.com/kubernetes/kubernetes/pull/87461), [@bboreham](https://github.com/bboreham)) [SIG Node] +- Change the mount way from systemd to normal mount except ceph and glusterfs intree-volume. ([#94916](https://github.com/kubernetes/kubernetes/pull/94916), [@smileusd](https://github.com/smileusd)) [SIG Apps, Cloud Provider, Network, Node, Storage and Testing] +- Changes to timeout parameter handling in 1.20.0-beta.2 have been reverted to avoid breaking backwards compatibility with existing clients. ([#96727](https://github.com/kubernetes/kubernetes/pull/96727), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Testing] +- Clear UDP conntrack entry on endpoint changes when using nodeport ([#71573](https://github.com/kubernetes/kubernetes/pull/71573), [@JacobTanenbaum](https://github.com/JacobTanenbaum)) [SIG Network] +- Cloud node controller: handle empty providerID from getProviderID ([#95342](https://github.com/kubernetes/kubernetes/pull/95342), [@nicolehanjing](https://github.com/nicolehanjing)) [SIG Cloud Provider] +- Disable watchcache for events ([#96052](https://github.com/kubernetes/kubernetes/pull/96052), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery] +- Disabled `LocalStorageCapacityIsolation` feature gate is honored during scheduling. ([#96092](https://github.com/kubernetes/kubernetes/pull/96092), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling] +- Do not fail sorting empty elements. ([#94666](https://github.com/kubernetes/kubernetes/pull/94666), [@soltysh](https://github.com/soltysh)) [SIG CLI] +- Dual-stack: make nodeipam compatible with existing single-stack clusters when dual-stack feature gate become enabled by default ([#90439](https://github.com/kubernetes/kubernetes/pull/90439), [@SataQiu](https://github.com/SataQiu)) [SIG API Machinery] +- Duplicate owner reference entries in create/update/patch requests now get deduplicated by the API server. The client sending the request now receives a warning header in the API response. Clients should stop sending requests with duplicate owner references. The API server may reject such requests as early as 1.24. ([#96185](https://github.com/kubernetes/kubernetes/pull/96185), [@roycaihw](https://github.com/roycaihw)) [SIG API Machinery and Testing] +- Endpoint slice controller now mirrors parent's service label to its corresponding endpoint slices. ([#94443](https://github.com/kubernetes/kubernetes/pull/94443), [@aojea](https://github.com/aojea)) +- Ensure getPrimaryInterfaceID not panic when network interfaces for Azure VMSS are null ([#94355](https://github.com/kubernetes/kubernetes/pull/94355), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] +- Exposes and sets a default timeout for the SubjectAccessReview client for DelegatingAuthorizationOptions ([#95725](https://github.com/kubernetes/kubernetes/pull/95725), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery and Cloud Provider] +- Exposes and sets a default timeout for the TokenReview client for DelegatingAuthenticationOptions ([#96217](https://github.com/kubernetes/kubernetes/pull/96217), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery and Cloud Provider] +- Fix CVE-2020-8555 for Quobyte client connections. ([#95206](https://github.com/kubernetes/kubernetes/pull/95206), [@misterikkit](https://github.com/misterikkit)) [SIG Storage] +- Fix IP fragmentation of UDP and TCP packets not supported issues on LoadBalancer rules ([#96464](https://github.com/kubernetes/kubernetes/pull/96464), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- Fix a bug that DefaultPreemption plugin is disabled when using (legacy) scheduler policy. ([#96439](https://github.com/kubernetes/kubernetes/pull/96439), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling and Testing] +- Fix a bug where loadbalancer deletion gets stuck because of missing resource group. ([#93962](https://github.com/kubernetes/kubernetes/pull/93962), [@phiphi282](https://github.com/phiphi282)) +- Fix a concurrent map writes error in kubelet ([#93773](https://github.com/kubernetes/kubernetes/pull/93773), [@knight42](https://github.com/knight42)) [SIG Node] +- Fix a panic in `kubectl debug` when a pod has multiple init or ephemeral containers. ([#94580](https://github.com/kubernetes/kubernetes/pull/94580), [@kiyoshim55](https://github.com/kiyoshim55)) +- Fix a regression where kubeadm bails out with a fatal error when an optional version command line argument is supplied to the "kubeadm upgrade plan" command ([#94421](https://github.com/kubernetes/kubernetes/pull/94421), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] +- Fix azure disk attach failure for disk size bigger than 4TB ([#95463](https://github.com/kubernetes/kubernetes/pull/95463), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fix azure disk data loss issue on Windows when unmount disk ([#95456](https://github.com/kubernetes/kubernetes/pull/95456), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] +- Fix azure file migration panic ([#94853](https://github.com/kubernetes/kubernetes/pull/94853), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fix bug in JSON path parser where an error occurs when a range is empty ([#95933](https://github.com/kubernetes/kubernetes/pull/95933), [@brianpursley](https://github.com/brianpursley)) [SIG API Machinery] +- Fix client-go prometheus metrics to correctly present the API path accessed in some environments. ([#74363](https://github.com/kubernetes/kubernetes/pull/74363), [@aanm](https://github.com/aanm)) [SIG API Machinery] +- Fix detach azure disk issue when vm not exist ([#95177](https://github.com/kubernetes/kubernetes/pull/95177), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fix etcd_object_counts metric reported by kube-apiserver ([#94773](https://github.com/kubernetes/kubernetes/pull/94773), [@tkashem](https://github.com/tkashem)) [SIG API Machinery] +- Fix incorrectly reported verbs for kube-apiserver metrics for CRD objects ([#93523](https://github.com/kubernetes/kubernetes/pull/93523), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Instrumentation] +- Fix k8s.io/apimachinery/pkg/api/meta.SetStatusCondition to update ObservedGeneration ([#95961](https://github.com/kubernetes/kubernetes/pull/95961), [@KnicKnic](https://github.com/KnicKnic)) [SIG API Machinery] +- Fix kubectl SchemaError on CRDs with schema using x-kubernetes-preserve-unknown-fields on array types. ([#94888](https://github.com/kubernetes/kubernetes/pull/94888), [@sttts](https://github.com/sttts)) [SIG API Machinery] +- Fix memory leak in kube-apiserver when underlying time goes forth and back. ([#96266](https://github.com/kubernetes/kubernetes/pull/96266), [@chenyw1990](https://github.com/chenyw1990)) [SIG API Machinery] +- Fix missing csi annotations on node during parallel csinode update. ([#94389](https://github.com/kubernetes/kubernetes/pull/94389), [@pacoxu](https://github.com/pacoxu)) [SIG Storage] +- Fix network_programming_latency metric reporting for Endpoints/EndpointSlice deletions, where we don't have correct timestamp ([#95363](https://github.com/kubernetes/kubernetes/pull/95363), [@wojtek-t](https://github.com/wojtek-t)) [SIG Network and Scalability] +- Fix paging issues when Azure API returns empty values with non-empty nextLink ([#96211](https://github.com/kubernetes/kubernetes/pull/96211), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] +- Fix pull image error from multiple ACRs using azure managed identity ([#96355](https://github.com/kubernetes/kubernetes/pull/96355), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fix race condition on timeCache locks. ([#94751](https://github.com/kubernetes/kubernetes/pull/94751), [@auxten](https://github.com/auxten)) +- Fix regression on `kubectl portforward` when TCP and UCP services were configured on the same port. ([#94728](https://github.com/kubernetes/kubernetes/pull/94728), [@amorenoz](https://github.com/amorenoz)) +- Fix scheduler cache snapshot when a Node is deleted before its Pods ([#95130](https://github.com/kubernetes/kubernetes/pull/95130), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] +- Fix the `cloudprovider_azure_api_request_duration_seconds` metric buckets to correctly capture the latency metrics. Previously, the majority of the calls would fall in the "+Inf" bucket. ([#94873](https://github.com/kubernetes/kubernetes/pull/94873), [@marwanad](https://github.com/marwanad)) [SIG Cloud Provider and Instrumentation] +- Fix vSphere volumes that could be erroneously attached to wrong node ([#96224](https://github.com/kubernetes/kubernetes/pull/96224), [@gnufied](https://github.com/gnufied)) [SIG Cloud Provider and Storage] +- Fix verb & scope reporting for kube-apiserver metrics (LIST reported instead of GET) ([#95562](https://github.com/kubernetes/kubernetes/pull/95562), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Testing] +- Fix vsphere detach failure for static PVs ([#95447](https://github.com/kubernetes/kubernetes/pull/95447), [@gnufied](https://github.com/gnufied)) [SIG Cloud Provider and Storage] +- Fix: azure disk resize error if source does not exist ([#93011](https://github.com/kubernetes/kubernetes/pull/93011), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fix: detach azure disk broken on Azure Stack ([#94885](https://github.com/kubernetes/kubernetes/pull/94885), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fix: resize Azure disk issue when it's in attached state ([#96705](https://github.com/kubernetes/kubernetes/pull/96705), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fix: smb valid path error ([#95583](https://github.com/kubernetes/kubernetes/pull/95583), [@andyzhangx](https://github.com/andyzhangx)) [SIG Storage] +- Fix: use sensitiveOptions on Windows mount ([#94126](https://github.com/kubernetes/kubernetes/pull/94126), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] +- Fixed a bug causing incorrect formatting of `kubectl describe ingress`. ([#94985](https://github.com/kubernetes/kubernetes/pull/94985), [@howardjohn](https://github.com/howardjohn)) [SIG CLI and Network] +- Fixed a bug in client-go where new clients with customized `Dial`, `Proxy`, `GetCert` config may get stale HTTP transports. ([#95427](https://github.com/kubernetes/kubernetes/pull/95427), [@roycaihw](https://github.com/roycaihw)) [SIG API Machinery] +- Fixed a bug that prevents kubectl to validate CRDs with schema using x-kubernetes-preserve-unknown-fields on object fields. ([#96369](https://github.com/kubernetes/kubernetes/pull/96369), [@gautierdelorme](https://github.com/gautierdelorme)) [SIG API Machinery and Testing] +- Fixed a bug that prevents the use of ephemeral containers in the presence of a validating admission webhook. ([#94685](https://github.com/kubernetes/kubernetes/pull/94685), [@verb](https://github.com/verb)) [SIG Node and Testing] +- Fixed a bug where aggregator_unavailable_apiservice metrics were reported for deleted apiservices. ([#96421](https://github.com/kubernetes/kubernetes/pull/96421), [@dgrisonnet](https://github.com/dgrisonnet)) [SIG API Machinery and Instrumentation] +- Fixed a bug where improper storage and comparison of endpoints led to excessive API traffic from the endpoints controller ([#94112](https://github.com/kubernetes/kubernetes/pull/94112), [@damemi](https://github.com/damemi)) [SIG Apps, Network and Testing] +- Fixed a regression which prevented pods with `docker/default` seccomp annotations from being created in 1.19 if a PodSecurityPolicy was in place which did not allow `runtime/default` seccomp profiles. ([#95985](https://github.com/kubernetes/kubernetes/pull/95985), [@saschagrunert](https://github.com/saschagrunert)) [SIG Auth] +- Fixed bug in reflector that couldn't recover from "Too large resource version" errors with API servers 1.17.0-1.18.5 ([#94316](https://github.com/kubernetes/kubernetes/pull/94316), [@janeczku](https://github.com/janeczku)) [SIG API Machinery] +- Fixed bug where kubectl top pod output is not sorted when --sort-by and --containers flags are used together ([#93692](https://github.com/kubernetes/kubernetes/pull/93692), [@brianpursley](https://github.com/brianpursley)) [SIG CLI] +- Fixed kubelet creating extra sandbox for pods with RestartPolicyOnFailure after all containers succeeded ([#92614](https://github.com/kubernetes/kubernetes/pull/92614), [@tnqn](https://github.com/tnqn)) [SIG Node and Testing] +- Fixes an issue proxying to ipv6 pods without specifying a port ([#94834](https://github.com/kubernetes/kubernetes/pull/94834), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Network] +- Fixes code generation for non-namespaced create subresources fake client test. ([#96586](https://github.com/kubernetes/kubernetes/pull/96586), [@Doude](https://github.com/Doude)) [SIG API Machinery] +- Fixes high CPU usage in kubectl drain ([#95260](https://github.com/kubernetes/kubernetes/pull/95260), [@amandahla](https://github.com/amandahla)) [SIG CLI] +- For vSphere Cloud Provider, If VM of worker node is deleted, the node will also be deleted by node controller ([#92608](https://github.com/kubernetes/kubernetes/pull/92608), [@lubronzhan](https://github.com/lubronzhan)) [SIG Cloud Provider] +- Gracefully delete nodes when their parent scale set went missing ([#95289](https://github.com/kubernetes/kubernetes/pull/95289), [@bpineau](https://github.com/bpineau)) [SIG Cloud Provider] +- HTTP/2 connection health check is enabled by default in all Kubernetes clients. The feature should work out-of-the-box. If needed, users can tune the feature via the HTTP2_READ_IDLE_TIMEOUT_SECONDS and HTTP2_PING_TIMEOUT_SECONDS environment variables. The feature is disabled if HTTP2_READ_IDLE_TIMEOUT_SECONDS is set to 0. ([#95981](https://github.com/kubernetes/kubernetes/pull/95981), [@caesarxuchao](https://github.com/caesarxuchao)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Node] +- If the user specifies an invalid timeout in the request URL, the request will be aborted with an HTTP 400. + - If the user specifies a timeout in the request URL that exceeds the maximum request deadline allowed by the apiserver, the request will be aborted with an HTTP 400. ([#96061](https://github.com/kubernetes/kubernetes/pull/96061), [@tkashem](https://github.com/tkashem)) [SIG API Machinery, Network and Testing] +- If we set SelectPolicy MinPolicySelect on scaleUp behavior or scaleDown behavior,Horizontal Pod Autoscaler doesn`t automatically scale the number of pods correctly ([#95647](https://github.com/kubernetes/kubernetes/pull/95647), [@JoshuaAndrew](https://github.com/JoshuaAndrew)) [SIG Apps and Autoscaling] +- Ignore apparmor for non-linux operating systems ([#93220](https://github.com/kubernetes/kubernetes/pull/93220), [@wawa0210](https://github.com/wawa0210)) [SIG Node and Windows] +- Ignore root user check when windows pod starts ([#92355](https://github.com/kubernetes/kubernetes/pull/92355), [@wawa0210](https://github.com/wawa0210)) [SIG Node and Windows] +- Improve error messages related to nodePort endpoint changes conntrack entries cleanup. ([#96251](https://github.com/kubernetes/kubernetes/pull/96251), [@ravens](https://github.com/ravens)) [SIG Network] +- In dual-stack clusters, kubelet will now set up both IPv4 and IPv6 iptables rules, which may + fix some problems, eg with HostPorts. ([#94474](https://github.com/kubernetes/kubernetes/pull/94474), [@danwinship](https://github.com/danwinship)) [SIG Network and Node] +- Increase maximum IOPS of AWS EBS io1 volume to current maximum (64,000). ([#90014](https://github.com/kubernetes/kubernetes/pull/90014), [@jacobmarble](https://github.com/jacobmarble)) +- Ipvs: ensure selected scheduler kernel modules are loaded ([#93040](https://github.com/kubernetes/kubernetes/pull/93040), [@cmluciano](https://github.com/cmluciano)) [SIG Network] +- K8s.io/apimachinery: runtime.DefaultUnstructuredConverter.FromUnstructured now handles converting integer fields to typed float values ([#93250](https://github.com/kubernetes/kubernetes/pull/93250), [@liggitt](https://github.com/liggitt)) [SIG API Machinery] +- Kube-proxy now trims extra spaces found in loadBalancerSourceRanges to match Service validation. ([#94107](https://github.com/kubernetes/kubernetes/pull/94107), [@robscott](https://github.com/robscott)) [SIG Network] +- Kubeadm ensures "kubeadm reset" does not unmount the root "/var/lib/kubelet" directory if it is mounted by the user. ([#93702](https://github.com/kubernetes/kubernetes/pull/93702), [@thtanaka](https://github.com/thtanaka)) +- Kubeadm now makes sure the etcd manifest is regenerated upon upgrade even when no etcd version change takes place ([#94395](https://github.com/kubernetes/kubernetes/pull/94395), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] +- Kubeadm now warns (instead of error out) on missing "ca.key" files for root CA, front-proxy CA and etcd CA, during "kubeadm join --control-plane" if the user has provided all certificates, keys and kubeconfig files which require signing with the given CA keys. ([#94988](https://github.com/kubernetes/kubernetes/pull/94988), [@neolit123](https://github.com/neolit123)) +- Kubeadm: add missing "--experimental-patches" flag to "kubeadm init phase control-plane" ([#95786](https://github.com/kubernetes/kubernetes/pull/95786), [@Sh4d1](https://github.com/Sh4d1)) [SIG Cluster Lifecycle] +- Kubeadm: avoid a panic when determining if the running version of CoreDNS is supported during upgrades ([#94299](https://github.com/kubernetes/kubernetes/pull/94299), [@zouyee](https://github.com/zouyee)) [SIG Cluster Lifecycle] +- Kubeadm: ensure the etcd data directory is created with 0700 permissions during control-plane init and join ([#94102](https://github.com/kubernetes/kubernetes/pull/94102), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubeadm: fix coredns migration should be triggered when there are newdefault configs during kubeadm upgrade ([#96907](https://github.com/kubernetes/kubernetes/pull/96907), [@pacoxu](https://github.com/pacoxu)) [SIG Cluster Lifecycle] +- Kubeadm: fix the bug that kubeadm tries to call 'docker info' even if the CRI socket was for another CR ([#94555](https://github.com/kubernetes/kubernetes/pull/94555), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] +- Kubeadm: for Docker as the container runtime, make the "kubeadm reset" command stop containers before removing them ([#94586](https://github.com/kubernetes/kubernetes/pull/94586), [@BedivereZero](https://github.com/BedivereZero)) [SIG Cluster Lifecycle] +- Kubeadm: make the kubeconfig files for the kube-controller-manager and kube-scheduler use the LocalAPIEndpoint instead of the ControlPlaneEndpoint. This makes kubeadm clusters more reseliant to version skew problems during immutable upgrades: https://kubernetes.io/docs/setup/release/version-skew-policy/#kube-controller-manager-kube-scheduler-and-cloud-controller-manager ([#94398](https://github.com/kubernetes/kubernetes/pull/94398), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubeadm: relax the validation of kubeconfig server URLs. Allow the user to define custom kubeconfig server URLs without erroring out during validation of existing kubeconfig files (e.g. when using external CA mode). ([#94816](https://github.com/kubernetes/kubernetes/pull/94816), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubectl: print error if users place flags before plugin name ([#92343](https://github.com/kubernetes/kubernetes/pull/92343), [@knight42](https://github.com/knight42)) [SIG CLI] +- Kubelet: assume that swap is disabled when `/proc/swaps` does not exist ([#93931](https://github.com/kubernetes/kubernetes/pull/93931), [@SataQiu](https://github.com/SataQiu)) [SIG Node] +- New Azure instance types do now have correct max data disk count information. ([#94340](https://github.com/kubernetes/kubernetes/pull/94340), [@ialidzhikov](https://github.com/ialidzhikov)) [SIG Cloud Provider and Storage] +- Port mapping now allows the same `containerPort` of different containers to different `hostPort` without naming the mapping explicitly. ([#94494](https://github.com/kubernetes/kubernetes/pull/94494), [@SergeyKanzhelev](https://github.com/SergeyKanzhelev)) +- Print go stack traces at -v=4 and not -v=2 ([#94663](https://github.com/kubernetes/kubernetes/pull/94663), [@soltysh](https://github.com/soltysh)) [SIG CLI] +- Recreate EndpointSlices on rapid Service creation. ([#94730](https://github.com/kubernetes/kubernetes/pull/94730), [@robscott](https://github.com/robscott)) +- Reduce volume name length for vsphere volumes ([#96533](https://github.com/kubernetes/kubernetes/pull/96533), [@gnufied](https://github.com/gnufied)) [SIG Storage] +- Remove ready file and its directory (which is created during volume SetUp) during emptyDir volume TearDown. ([#95770](https://github.com/kubernetes/kubernetes/pull/95770), [@jingxu97](https://github.com/jingxu97)) [SIG Storage] +- Reorganized iptables rules to fix a performance issue ([#95252](https://github.com/kubernetes/kubernetes/pull/95252), [@tssurya](https://github.com/tssurya)) [SIG Network] +- Require feature flag CustomCPUCFSQuotaPeriod if setting a non-default cpuCFSQuotaPeriod in kubelet config. ([#94687](https://github.com/kubernetes/kubernetes/pull/94687), [@karan](https://github.com/karan)) [SIG Node] +- Resolves a regression in 1.19+ with workloads targeting deprecated beta os/arch labels getting stuck in NodeAffinity status on node startup. ([#96810](https://github.com/kubernetes/kubernetes/pull/96810), [@liggitt](https://github.com/liggitt)) [SIG Node] +- Resolves non-deterministic behavior of the garbage collection controller when ownerReferences with incorrect data are encountered. Events with a reason of `OwnerRefInvalidNamespace` are recorded when namespace mismatches between child and owner objects are detected. The [kubectl-check-ownerreferences](https://github.com/kubernetes-sigs/kubectl-check-ownerreferences) tool can be run prior to upgrading to locate existing objects with invalid ownerReferences. + - A namespaced object with an ownerReference referencing a uid of a namespaced kind which does not exist in the same namespace is now consistently treated as though that owner does not exist, and the child object is deleted. + - A cluster-scoped object with an ownerReference referencing a uid of a namespaced kind is now consistently treated as though that owner is not resolvable, and the child object is ignored by the garbage collector. ([#92743](https://github.com/kubernetes/kubernetes/pull/92743), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Apps and Testing] +- Skip [k8s.io/kubernetes@v1.19.0/test/e2e/storage/testsuites/base.go:162]: Driver azure-disk doesn't support snapshot type DynamicSnapshot -- skipping + skip [k8s.io/kubernetes@v1.19.0/test/e2e/storage/testsuites/base.go:185]: Driver azure-disk doesn't support ntfs -- skipping ([#96144](https://github.com/kubernetes/kubernetes/pull/96144), [@qinpingli](https://github.com/qinpingli)) [SIG Storage and Testing] +- StatefulSet Controller now waits for PersistentVolumeClaim deletion before creating pods. ([#93457](https://github.com/kubernetes/kubernetes/pull/93457), [@ymmt2005](https://github.com/ymmt2005)) +- StreamWatcher now calls HandleCrash at appropriate sequence. ([#93108](https://github.com/kubernetes/kubernetes/pull/93108), [@lixiaobing1](https://github.com/lixiaobing1)) +- Support the node label `node.kubernetes.io/exclude-from-external-load-balancers` ([#95542](https://github.com/kubernetes/kubernetes/pull/95542), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- The AWS network load balancer attributes can now be specified during service creation ([#95247](https://github.com/kubernetes/kubernetes/pull/95247), [@kishorj](https://github.com/kishorj)) [SIG Cloud Provider] +- The `/debug/api_priority_and_fairness/dump_requests` path at an apiserver will no longer return a phantom line for each exempt priority level. ([#93406](https://github.com/kubernetes/kubernetes/pull/93406), [@MikeSpreitzer](https://github.com/MikeSpreitzer)) [SIG API Machinery] +- The kube-apiserver will no longer serve APIs that should have been deleted in GA non-alpha levels. Alpha levels will continue to serve the removed APIs so that CI doesn't immediately break. ([#96525](https://github.com/kubernetes/kubernetes/pull/96525), [@deads2k](https://github.com/deads2k)) [SIG API Machinery] +- The kubelet recognizes the --containerd-namespace flag to configure the namespace used by cadvisor. ([#87054](https://github.com/kubernetes/kubernetes/pull/87054), [@changyaowei](https://github.com/changyaowei)) [SIG Node] +- Unhealthy pods covered by PDBs can be successfully evicted if enough healthy pods are available. ([#94381](https://github.com/kubernetes/kubernetes/pull/94381), [@michaelgugino](https://github.com/michaelgugino)) [SIG Apps] +- Update Calico to v3.15.2 ([#94241](https://github.com/kubernetes/kubernetes/pull/94241), [@lmm](https://github.com/lmm)) [SIG Cloud Provider] +- Update default etcd server version to 3.4.13 ([#94287](https://github.com/kubernetes/kubernetes/pull/94287), [@jingyih](https://github.com/jingyih)) [SIG API Machinery, Cloud Provider, Cluster Lifecycle and Testing] +- Update max azure data disk count map ([#96308](https://github.com/kubernetes/kubernetes/pull/96308), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] +- Update the PIP when it is not in the Succeeded provisioning state during the LB update. ([#95748](https://github.com/kubernetes/kubernetes/pull/95748), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- Update the frontend IP config when the service's `pipName` annotation is changed ([#95813](https://github.com/kubernetes/kubernetes/pull/95813), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- Update the route table tag in the route reconcile loop ([#96545](https://github.com/kubernetes/kubernetes/pull/96545), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- Use NLB Subnet CIDRs instead of VPC CIDRs in Health Check SG Rules ([#93515](https://github.com/kubernetes/kubernetes/pull/93515), [@t0rr3sp3dr0](https://github.com/t0rr3sp3dr0)) [SIG Cloud Provider] +- Users will see increase in time for deletion of pods and also guarantee that removal of pod from api server would mean deletion of all the resources from container runtime. ([#92817](https://github.com/kubernetes/kubernetes/pull/92817), [@kmala](https://github.com/kmala)) [SIG Node] +- Very large patches may now be specified to `kubectl patch` with the `--patch-file` flag instead of including them directly on the command line. The `--patch` and `--patch-file` flags are mutually exclusive. ([#93548](https://github.com/kubernetes/kubernetes/pull/93548), [@smarterclayton](https://github.com/smarterclayton)) [SIG CLI] +- Volume binding: report UnschedulableAndUnresolvable status instead of an error when bound PVs not found ([#95541](https://github.com/kubernetes/kubernetes/pull/95541), [@cofyc](https://github.com/cofyc)) [SIG Apps, Scheduling and Storage] +- Warn instead of fail when creating Roles and ClusterRoles with custom verbs via kubectl ([#92492](https://github.com/kubernetes/kubernetes/pull/92492), [@eddiezane](https://github.com/eddiezane)) [SIG CLI] +- When creating a PVC with the volume.beta.kubernetes.io/storage-provisioner annotation already set, the PV controller might have incorrectly deleted the newly provisioned PV instead of binding it to the PVC, depending on timing and system load. ([#95909](https://github.com/kubernetes/kubernetes/pull/95909), [@pohly](https://github.com/pohly)) [SIG Apps and Storage] +- [kubectl] Fail when local source file doesn't exist ([#90333](https://github.com/kubernetes/kubernetes/pull/90333), [@bamarni](https://github.com/bamarni)) [SIG CLI] + +### 기타 (정리 또는 플레이크(flake)) + +- **Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.**: + + ([#96443](https://github.com/kubernetes/kubernetes/pull/96443), [@alaypatel07](https://github.com/alaypatel07)) [SIG Apps] +- --redirect-container-streaming is no longer functional. The flag will be removed in v1.22 ([#95935](https://github.com/kubernetes/kubernetes/pull/95935), [@tallclair](https://github.com/tallclair)) [SIG Node] +- A new metric `requestAbortsTotal` has been introduced that counts aborted requests for each `group`, `version`, `verb`, `resource`, `subresource` and `scope`. ([#95002](https://github.com/kubernetes/kubernetes/pull/95002), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery, Cloud Provider, Instrumentation and Scheduling] +- API priority and fairness metrics use snake_case in label names ([#96236](https://github.com/kubernetes/kubernetes/pull/96236), [@adtac](https://github.com/adtac)) [SIG API Machinery, Cluster Lifecycle, Instrumentation and Testing] +- Add fine grained debugging to intra-pod conformance test to troubleshoot networking issues for potentially unhealthy nodes when running conformance or sonobuoy tests. ([#93837](https://github.com/kubernetes/kubernetes/pull/93837), [@jayunit100](https://github.com/jayunit100)) +- Add the following metrics: + - network_plugin_operations_total + - network_plugin_operations_errors_total ([#93066](https://github.com/kubernetes/kubernetes/pull/93066), [@AnishShah](https://github.com/AnishShah)) +- Adds a bootstrapping ClusterRole, ClusterRoleBinding and group for /metrics, /livez/*, /readyz/*, & /healthz/- endpoints. ([#93311](https://github.com/kubernetes/kubernetes/pull/93311), [@logicalhan](https://github.com/logicalhan)) [SIG API Machinery, Auth, Cloud Provider and Instrumentation] +- AdmissionReview objects sent for the creation of Namespace API objects now populate the `namespace` attribute consistently (previously the `namespace` attribute was empty for Namespace creation via POST requests, and populated for Namespace creation via server-side-apply PATCH requests) ([#95012](https://github.com/kubernetes/kubernetes/pull/95012), [@nodo](https://github.com/nodo)) [SIG API Machinery and Testing] +- Applies translations on all command descriptions ([#95439](https://github.com/kubernetes/kubernetes/pull/95439), [@HerrNaN](https://github.com/HerrNaN)) [SIG CLI] +- Base-images: Update to debian-iptables:buster-v1.3.0 + - Uses iptables 1.8.5 + - base-images: Update to debian-base:buster-v1.2.0 + - cluster/images/etcd: Build etcd:3.4.13-1 image + - Uses debian-base:buster-v1.2.0 ([#94733](https://github.com/kubernetes/kubernetes/pull/94733), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery, Release and Testing] +- Changed: default "Accept-Encoding" header removed from HTTP probes. See https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#http-probes ([#96127](https://github.com/kubernetes/kubernetes/pull/96127), [@fonsecas72](https://github.com/fonsecas72)) [SIG Network and Node] +- Client-go header logging (at verbosity levels >= 9) now masks `Authorization` header contents ([#95316](https://github.com/kubernetes/kubernetes/pull/95316), [@sfowl](https://github.com/sfowl)) [SIG API Machinery] +- Decrease warning message frequency on setting volume ownership for configmap/secret. ([#92878](https://github.com/kubernetes/kubernetes/pull/92878), [@jvanz](https://github.com/jvanz)) +- Enhance log information of verifyRunAsNonRoot, add pod, container information ([#94911](https://github.com/kubernetes/kubernetes/pull/94911), [@wawa0210](https://github.com/wawa0210)) [SIG Node] +- Fix func name NewCreateCreateDeploymentOptions ([#91931](https://github.com/kubernetes/kubernetes/pull/91931), [@lixiaobing1](https://github.com/lixiaobing1)) [SIG CLI] +- Fix kubelet to properly log when a container is started. Previously, kubelet may log that container is dead and was restarted when it was actually started for the first time. This behavior only happened on pods with initContainers and regular containers. ([#91469](https://github.com/kubernetes/kubernetes/pull/91469), [@rata](https://github.com/rata)) +- Fixes the message about no auth for metrics in scheduler. ([#94035](https://github.com/kubernetes/kubernetes/pull/94035), [@zhouya0](https://github.com/zhouya0)) [SIG Scheduling] +- Generators for services are removed from kubectl ([#95256](https://github.com/kubernetes/kubernetes/pull/95256), [@Git-Jiro](https://github.com/Git-Jiro)) [SIG CLI] +- Introduce kubectl-convert plugin. ([#96190](https://github.com/kubernetes/kubernetes/pull/96190), [@soltysh](https://github.com/soltysh)) [SIG CLI and Testing] +- Kube-scheduler now logs processed component config at startup ([#96426](https://github.com/kubernetes/kubernetes/pull/96426), [@damemi](https://github.com/damemi)) [SIG Scheduling] +- Kubeadm: Separate argument key/value in log msg ([#94016](https://github.com/kubernetes/kubernetes/pull/94016), [@mrueg](https://github.com/mrueg)) [SIG Cluster Lifecycle] +- Kubeadm: remove the CoreDNS check for known image digests when applying the addon ([#94506](https://github.com/kubernetes/kubernetes/pull/94506), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubeadm: update the default pause image version to 1.4.0 on Windows. With this update the image supports Windows versions 1809 (2019LTS), 1903, 1909, 2004 ([#95419](https://github.com/kubernetes/kubernetes/pull/95419), [@jsturtevant](https://github.com/jsturtevant)) [SIG Cluster Lifecycle and Windows] +- Kubectl: the `generator` flag of `kubectl autoscale` has been deprecated and has no effect, it will be removed in a feature release ([#92998](https://github.com/kubernetes/kubernetes/pull/92998), [@SataQiu](https://github.com/SataQiu)) [SIG CLI] +- Lock ExternalPolicyForExternalIP to default, this feature gate will be removed in 1.22. ([#94581](https://github.com/kubernetes/kubernetes/pull/94581), [@knabben](https://github.com/knabben)) [SIG Network] +- Mask ceph RBD adminSecrets in logs when logLevel >= 4. ([#95245](https://github.com/kubernetes/kubernetes/pull/95245), [@sfowl](https://github.com/sfowl)) +- Remove offensive words from kubectl cluster-info command. ([#95202](https://github.com/kubernetes/kubernetes/pull/95202), [@rikatz](https://github.com/rikatz)) +- Remove support for "ci/k8s-master" version label in kubeadm, use "ci/latest" instead. See [kubernetes/test-infra#18517](https://github.com/kubernetes/test-infra/pull/18517). ([#93626](https://github.com/kubernetes/kubernetes/pull/93626), [@vikkyomkar](https://github.com/vikkyomkar)) +- Remove the dependency of csi-translation-lib module on apiserver/cloud-provider/controller-manager ([#95543](https://github.com/kubernetes/kubernetes/pull/95543), [@wawa0210](https://github.com/wawa0210)) [SIG Release] +- Scheduler framework interface moved from pkg/scheduler/framework/v1alpha to pkg/scheduler/framework ([#95069](https://github.com/kubernetes/kubernetes/pull/95069), [@farah](https://github.com/farah)) [SIG Scheduling, Storage and Testing] +- Service.beta.kubernetes.io/azure-load-balancer-disable-tcp-reset is removed. All Standard load balancers will always enable tcp resets. ([#94297](https://github.com/kubernetes/kubernetes/pull/94297), [@MarcPow](https://github.com/MarcPow)) [SIG Cloud Provider] +- Stop propagating SelfLink (deprecated in 1.16) in kube-apiserver ([#94397](https://github.com/kubernetes/kubernetes/pull/94397), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Testing] +- Strip unnecessary security contexts on Windows ([#93475](https://github.com/kubernetes/kubernetes/pull/93475), [@ravisantoshgudimetla](https://github.com/ravisantoshgudimetla)) [SIG Node, Testing and Windows] +- To ensure the code be strong, add unit test for GetAddressAndDialer ([#93180](https://github.com/kubernetes/kubernetes/pull/93180), [@FreeZhang61](https://github.com/FreeZhang61)) [SIG Node] +- UDP and SCTP protocols can left stale connections that need to be cleared to avoid services disruption, but they can cause problems that are hard to debug. + Kubernetes components using a loglevel greater or equal than 4 will log the conntrack operations and its output, to show the entries that were deleted. ([#95694](https://github.com/kubernetes/kubernetes/pull/95694), [@aojea](https://github.com/aojea)) [SIG Network] +- Update CNI plugins to v0.8.7 ([#94367](https://github.com/kubernetes/kubernetes/pull/94367), [@justaugustus](https://github.com/justaugustus)) [SIG Cloud Provider, Network, Node, Release and Testing] +- Update cri-tools to [v1.19.0](https://github.com/kubernetes-sigs/cri-tools/releases/tag/v1.19.0) ([#94307](https://github.com/kubernetes/kubernetes/pull/94307), [@xmudrii](https://github.com/xmudrii)) [SIG Cloud Provider] +- Update etcd client side to v3.4.13 ([#94259](https://github.com/kubernetes/kubernetes/pull/94259), [@jingyih](https://github.com/jingyih)) [SIG API Machinery and Cloud Provider] +- Users will now be able to configure all supported values for AWS NLB health check interval and thresholds for new resources. ([#96312](https://github.com/kubernetes/kubernetes/pull/96312), [@kishorj](https://github.com/kishorj)) [SIG Cloud Provider] +- V1helpers.MatchNodeSelectorTerms now accepts just a Node and a list of Terms ([#95871](https://github.com/kubernetes/kubernetes/pull/95871), [@damemi](https://github.com/damemi)) [SIG Apps, Scheduling and Storage] +- Vsphere: improve logging message on node cache refresh event ([#95236](https://github.com/kubernetes/kubernetes/pull/95236), [@andrewsykim](https://github.com/andrewsykim)) [SIG Cloud Provider] +- `MatchNodeSelectorTerms` function moved to `k8s.io/component-helpers` ([#95531](https://github.com/kubernetes/kubernetes/pull/95531), [@damemi](https://github.com/damemi)) [SIG Apps, Scheduling and Storage] +- `kubectl api-resources` now prints the API version (as 'API group/version', same as output of `kubectl api-versions`). The column APIGROUP is now APIVERSION ([#95253](https://github.com/kubernetes/kubernetes/pull/95253), [@sallyom](https://github.com/sallyom)) [SIG CLI] +- `kubectl get ingress` now prefers the `networking.k8s.io/v1` over `extensions/v1beta1` (deprecated since v1.14). To explicitly request the deprecated version, use `kubectl get ingress.v1beta1.extensions`. ([#94309](https://github.com/kubernetes/kubernetes/pull/94309), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and CLI] ## 의존성 ### 추가 -- cloud.google.com/go/bigquery: v1.0.1 -- cloud.google.com/go/datastore: v1.0.0 -- cloud.google.com/go/pubsub: v1.0.1 -- cloud.google.com/go/storage: v1.0.0 -- dmitri.shuralyov.com/gpu/mtl: 666a987 -- github.com/cespare/xxhash/v2: [v2.1.1](https://github.com/cespare/xxhash/v2/tree/v2.1.1) -- github.com/checkpoint-restore/go-criu/v4: [v4.0.2](https://github.com/checkpoint-restore/go-criu/v4/tree/v4.0.2) -- github.com/chzyer/logex: [v1.1.10](https://github.com/chzyer/logex/tree/v1.1.10) -- github.com/chzyer/readline: [2972be2](https://github.com/chzyer/readline/tree/2972be2) -- github.com/chzyer/test: [a1ea475](https://github.com/chzyer/test/tree/a1ea475) -- github.com/containerd/cgroups: [0dbf7f0](https://github.com/containerd/cgroups/tree/0dbf7f0) -- github.com/containerd/continuity: [aaeac12](https://github.com/containerd/continuity/tree/aaeac12) -- github.com/containerd/fifo: [a9fb20d](https://github.com/containerd/fifo/tree/a9fb20d) -- github.com/containerd/go-runc: [5a6d9f3](https://github.com/containerd/go-runc/tree/5a6d9f3) -- github.com/containerd/ttrpc: [v1.0.0](https://github.com/containerd/ttrpc/tree/v1.0.0) -- github.com/coreos/bbolt: [v1.3.2](https://github.com/coreos/bbolt/tree/v1.3.2) -- github.com/coreos/go-systemd/v22: [v22.1.0](https://github.com/coreos/go-systemd/v22/tree/v22.1.0) -- github.com/cpuguy83/go-md2man/v2: [v2.0.0](https://github.com/cpuguy83/go-md2man/v2/tree/v2.0.0) -- github.com/docopt/docopt-go: [ee0de3b](https://github.com/docopt/docopt-go/tree/ee0de3b) -- github.com/go-gl/glfw/v3.3/glfw: [12ad95a](https://github.com/go-gl/glfw/v3.3/glfw/tree/12ad95a) -- github.com/go-ini/ini: [v1.9.0](https://github.com/go-ini/ini/tree/v1.9.0) -- github.com/godbus/dbus/v5: [v5.0.3](https://github.com/godbus/dbus/v5/tree/v5.0.3) -- github.com/ianlancetaylor/demangle: [5e5cf60](https://github.com/ianlancetaylor/demangle/tree/5e5cf60) -- github.com/ishidawataru/sctp: [7c296d4](https://github.com/ishidawataru/sctp/tree/7c296d4) -- github.com/moby/ipvs: [v1.0.1](https://github.com/moby/ipvs/tree/v1.0.1) -- github.com/moby/sys/mountinfo: [v0.1.3](https://github.com/moby/sys/mountinfo/tree/v0.1.3) -- github.com/moby/term: [672ec06](https://github.com/moby/term/tree/672ec06) -- github.com/russross/blackfriday/v2: [v2.0.1](https://github.com/russross/blackfriday/v2/tree/v2.0.1) -- github.com/shurcooL/sanitized_anchor_name: [v1.0.0](https://github.com/shurcooL/sanitized_anchor_name/tree/v1.0.0) -- github.com/ugorji/go: [v1.1.4](https://github.com/ugorji/go/tree/v1.1.4) -- github.com/yuin/goldmark: [v1.1.27](https://github.com/yuin/goldmark/tree/v1.1.27) -- google.golang.org/protobuf: v1.24.0 -- gotest.tools/v3: v3.0.2 -- k8s.io/klog/v2: v2.2.0 +- cloud.google.com/go/firestore: v1.1.0 +- github.com/Azure/go-autorest: [v14.2.0+incompatible](https://github.com/Azure/go-autorest/tree/v14.2.0) +- github.com/armon/go-metrics: [f0300d1](https://github.com/armon/go-metrics/tree/f0300d1) +- github.com/armon/go-radix: [7fddfc3](https://github.com/armon/go-radix/tree/7fddfc3) +- github.com/bketelsen/crypt: [5cbc8cc](https://github.com/bketelsen/crypt/tree/5cbc8cc) +- github.com/form3tech-oss/jwt-go: [v3.2.2+incompatible](https://github.com/form3tech-oss/jwt-go/tree/v3.2.2) +- github.com/fvbommel/sortorder: [v1.0.1](https://github.com/fvbommel/sortorder/tree/v1.0.1) +- github.com/hashicorp/consul/api: [v1.1.0](https://github.com/hashicorp/consul/api/tree/v1.1.0) +- github.com/hashicorp/consul/sdk: [v0.1.1](https://github.com/hashicorp/consul/sdk/tree/v0.1.1) +- github.com/hashicorp/errwrap: [v1.0.0](https://github.com/hashicorp/errwrap/tree/v1.0.0) +- github.com/hashicorp/go-cleanhttp: [v0.5.1](https://github.com/hashicorp/go-cleanhttp/tree/v0.5.1) +- github.com/hashicorp/go-immutable-radix: [v1.0.0](https://github.com/hashicorp/go-immutable-radix/tree/v1.0.0) +- github.com/hashicorp/go-msgpack: [v0.5.3](https://github.com/hashicorp/go-msgpack/tree/v0.5.3) +- github.com/hashicorp/go-multierror: [v1.0.0](https://github.com/hashicorp/go-multierror/tree/v1.0.0) +- github.com/hashicorp/go-rootcerts: [v1.0.0](https://github.com/hashicorp/go-rootcerts/tree/v1.0.0) +- github.com/hashicorp/go-sockaddr: [v1.0.0](https://github.com/hashicorp/go-sockaddr/tree/v1.0.0) +- github.com/hashicorp/go-uuid: [v1.0.1](https://github.com/hashicorp/go-uuid/tree/v1.0.1) +- github.com/hashicorp/go.net: [v0.0.1](https://github.com/hashicorp/go.net/tree/v0.0.1) +- github.com/hashicorp/logutils: [v1.0.0](https://github.com/hashicorp/logutils/tree/v1.0.0) +- github.com/hashicorp/mdns: [v1.0.0](https://github.com/hashicorp/mdns/tree/v1.0.0) +- github.com/hashicorp/memberlist: [v0.1.3](https://github.com/hashicorp/memberlist/tree/v0.1.3) +- github.com/hashicorp/serf: [v0.8.2](https://github.com/hashicorp/serf/tree/v0.8.2) +- github.com/jmespath/go-jmespath/internal/testify: [v1.5.1](https://github.com/jmespath/go-jmespath/internal/testify/tree/v1.5.1) +- github.com/mitchellh/cli: [v1.0.0](https://github.com/mitchellh/cli/tree/v1.0.0) +- github.com/mitchellh/go-testing-interface: [v1.0.0](https://github.com/mitchellh/go-testing-interface/tree/v1.0.0) +- github.com/mitchellh/gox: [v0.4.0](https://github.com/mitchellh/gox/tree/v0.4.0) +- github.com/mitchellh/iochan: [v1.0.0](https://github.com/mitchellh/iochan/tree/v1.0.0) +- github.com/pascaldekloe/goe: [57f6aae](https://github.com/pascaldekloe/goe/tree/57f6aae) +- github.com/posener/complete: [v1.1.1](https://github.com/posener/complete/tree/v1.1.1) +- github.com/ryanuber/columnize: [9b3edd6](https://github.com/ryanuber/columnize/tree/9b3edd6) +- github.com/sean-/seed: [e2103e2](https://github.com/sean-/seed/tree/e2103e2) +- github.com/subosito/gotenv: [v1.2.0](https://github.com/subosito/gotenv/tree/v1.2.0) +- github.com/willf/bitset: [d5bec33](https://github.com/willf/bitset/tree/d5bec33) +- gopkg.in/ini.v1: v1.51.0 +- gopkg.in/yaml.v3: 9f266ea +- rsc.io/quote/v3: v3.1.0 +- rsc.io/sampler: v1.3.0 ### 변경 -- cloud.google.com/go: v0.38.0 → v0.51.0 -- github.com/Azure/azure-sdk-for-go: [v35.0.0+incompatible → v43.0.0+incompatible](https://github.com/Azure/azure-sdk-for-go/compare/v35.0.0...v43.0.0) -- github.com/Azure/go-autorest/autorest/adal: [v0.5.0 → v0.8.2](https://github.com/Azure/go-autorest/autorest/adal/compare/v0.5.0...v0.8.2) -- github.com/Azure/go-autorest/autorest/date: [v0.1.0 → v0.2.0](https://github.com/Azure/go-autorest/autorest/date/compare/v0.1.0...v0.2.0) -- github.com/Azure/go-autorest/autorest/mocks: [v0.2.0 → v0.3.0](https://github.com/Azure/go-autorest/autorest/mocks/compare/v0.2.0...v0.3.0) -- github.com/Azure/go-autorest/autorest: [v0.9.0 → v0.9.6](https://github.com/Azure/go-autorest/autorest/compare/v0.9.0...v0.9.6) -- github.com/GoogleCloudPlatform/k8s-cloud-provider: [27a4ced → 7901bc8](https://github.com/GoogleCloudPlatform/k8s-cloud-provider/compare/27a4ced...7901bc8) -- github.com/Microsoft/go-winio: [v0.4.14 → fc70bd9](https://github.com/Microsoft/go-winio/compare/v0.4.14...fc70bd9) -- github.com/Microsoft/hcsshim: [672e52e → 5eafd15](https://github.com/Microsoft/hcsshim/compare/672e52e...5eafd15) -- github.com/alecthomas/template: [a0175ee → fb15b89](https://github.com/alecthomas/template/compare/a0175ee...fb15b89) -- github.com/alecthomas/units: [2efee85 → c3de453](https://github.com/alecthomas/units/compare/2efee85...c3de453) -- github.com/beorn7/perks: [v1.0.0 → v1.0.1](https://github.com/beorn7/perks/compare/v1.0.0...v1.0.1) -- github.com/cilium/ebpf: [95b36a5 → 1c8d4c9](https://github.com/cilium/ebpf/compare/95b36a5...1c8d4c9) -- github.com/containerd/console: [84eeaae → v1.0.0](https://github.com/containerd/console/compare/84eeaae...v1.0.0) -- github.com/containerd/containerd: [v1.0.2 → v1.3.3](https://github.com/containerd/containerd/compare/v1.0.2...v1.3.3) -- github.com/containerd/typeurl: [2a93cfd → v1.0.0](https://github.com/containerd/typeurl/compare/2a93cfd...v1.0.0) -- github.com/containernetworking/cni: [v0.7.1 → v0.8.0](https://github.com/containernetworking/cni/compare/v0.7.1...v0.8.0) -- github.com/coredns/corefile-migration: [v1.0.6 → v1.0.10](https://github.com/coredns/corefile-migration/compare/v1.0.6...v1.0.10) -- github.com/coreos/pkg: [97fdf19 → 399ea9e](https://github.com/coreos/pkg/compare/97fdf19...399ea9e) -- github.com/docker/docker: [be7ac8b → aa6a989](https://github.com/docker/docker/compare/be7ac8b...aa6a989) -- github.com/docker/go-connections: [v0.3.0 → v0.4.0](https://github.com/docker/go-connections/compare/v0.3.0...v0.4.0) -- github.com/evanphx/json-patch: [v4.2.0+incompatible → e83c0a1](https://github.com/evanphx/json-patch/compare/v4.2.0...e83c0a1) -- github.com/fsnotify/fsnotify: [v1.4.7 → v1.4.9](https://github.com/fsnotify/fsnotify/compare/v1.4.7...v1.4.9) -- github.com/go-kit/kit: [v0.8.0 → v0.9.0](https://github.com/go-kit/kit/compare/v0.8.0...v0.9.0) -- github.com/go-logfmt/logfmt: [v0.3.0 → v0.4.0](https://github.com/go-logfmt/logfmt/compare/v0.3.0...v0.4.0) -- github.com/go-logr/logr: [v0.1.0 → v0.2.0](https://github.com/go-logr/logr/compare/v0.1.0...v0.2.0) -- github.com/golang/groupcache: [02826c3 → 215e871](https://github.com/golang/groupcache/compare/02826c3...215e871) -- github.com/golang/protobuf: [v1.3.2 → v1.4.2](https://github.com/golang/protobuf/compare/v1.3.2...v1.4.2) -- github.com/google/cadvisor: [v0.35.0 → v0.37.0](https://github.com/google/cadvisor/compare/v0.35.0...v0.37.0) -- github.com/google/go-cmp: [v0.3.0 → v0.4.0](https://github.com/google/go-cmp/compare/v0.3.0...v0.4.0) -- github.com/google/pprof: [3ea8567 → d4f498a](https://github.com/google/pprof/compare/3ea8567...d4f498a) -- github.com/googleapis/gax-go/v2: [v2.0.4 → v2.0.5](https://github.com/googleapis/gax-go/v2/compare/v2.0.4...v2.0.5) -- github.com/googleapis/gnostic: [v0.1.0 → v0.4.1](https://github.com/googleapis/gnostic/compare/v0.1.0...v0.4.1) -- github.com/gorilla/mux: [v1.7.0 → v1.7.3](https://github.com/gorilla/mux/compare/v1.7.0...v1.7.3) -- github.com/json-iterator/go: [v1.1.8 → v1.1.10](https://github.com/json-iterator/go/compare/v1.1.8...v1.1.10) -- github.com/jstemmer/go-junit-report: [af01ea7 → v0.9.1](https://github.com/jstemmer/go-junit-report/compare/af01ea7...v0.9.1) -- github.com/konsorten/go-windows-terminal-sequences: [v1.0.1 → v1.0.3](https://github.com/konsorten/go-windows-terminal-sequences/compare/v1.0.1...v1.0.3) -- github.com/kr/pretty: [v0.1.0 → v0.2.0](https://github.com/kr/pretty/compare/v0.1.0...v0.2.0) -- github.com/mattn/go-isatty: [v0.0.9 → v0.0.4](https://github.com/mattn/go-isatty/compare/v0.0.9...v0.0.4) -- github.com/matttproud/golang_protobuf_extensions: [v1.0.1 → c182aff](https://github.com/matttproud/golang_protobuf_extensions/compare/v1.0.1...c182aff) -- github.com/mistifyio/go-zfs: [v2.1.1+incompatible → f784269](https://github.com/mistifyio/go-zfs/compare/v2.1.1...f784269) -- github.com/mrunalp/fileutils: [7d4729f → abd8a0e](https://github.com/mrunalp/fileutils/compare/7d4729f...abd8a0e) -- github.com/opencontainers/runc: [v1.0.0-rc10 → 819fcc6](https://github.com/opencontainers/runc/compare/v1.0.0-rc10...819fcc6) -- github.com/opencontainers/runtime-spec: [v1.0.0 → 237cc4f](https://github.com/opencontainers/runtime-spec/compare/v1.0.0...237cc4f) -- github.com/opencontainers/selinux: [5215b18 → v1.5.2](https://github.com/opencontainers/selinux/compare/5215b18...v1.5.2) -- github.com/pkg/errors: [v0.8.1 → v0.9.1](https://github.com/pkg/errors/compare/v0.8.1...v0.9.1) -- github.com/prometheus/client_golang: [v1.0.0 → v1.7.1](https://github.com/prometheus/client_golang/compare/v1.0.0...v1.7.1) -- github.com/prometheus/common: [v0.4.1 → v0.10.0](https://github.com/prometheus/common/compare/v0.4.1...v0.10.0) -- github.com/prometheus/procfs: [v0.0.2 → v0.1.3](https://github.com/prometheus/procfs/compare/v0.0.2...v0.1.3) -- github.com/rubiojr/go-vhd: [0bfd3b3 → 02e2102](https://github.com/rubiojr/go-vhd/compare/0bfd3b3...02e2102) -- github.com/sirupsen/logrus: [v1.4.2 → v1.6.0](https://github.com/sirupsen/logrus/compare/v1.4.2...v1.6.0) -- github.com/spf13/cobra: [v0.0.5 → v1.0.0](https://github.com/spf13/cobra/compare/v0.0.5...v1.0.0) -- github.com/spf13/viper: [v1.3.2 → v1.4.0](https://github.com/spf13/viper/compare/v1.3.2...v1.4.0) -- github.com/tmc/grpc-websocket-proxy: [89b8d40 → 0ad062e](https://github.com/tmc/grpc-websocket-proxy/compare/89b8d40...0ad062e) -- github.com/urfave/cli: [v1.20.0 → v1.22.2](https://github.com/urfave/cli/compare/v1.20.0...v1.22.2) -- github.com/vishvananda/netlink: [v1.0.0 → v1.1.0](https://github.com/vishvananda/netlink/compare/v1.0.0...v1.1.0) -- github.com/vishvananda/netns: [be1fbed → 52d707b](https://github.com/vishvananda/netns/compare/be1fbed...52d707b) -- go.etcd.io/bbolt: v1.3.3 → v1.3.5 -- go.etcd.io/etcd: 3cf2f69 → 18dfb9c -- go.opencensus.io: v0.21.0 → v0.22.2 -- go.uber.org/atomic: v1.3.2 → v1.4.0 -- golang.org/x/crypto: bac4c82 → 75b2880 -- golang.org/x/exp: 4b39c73 → da58074 -- golang.org/x/image: 0694c2d → cff245a -- golang.org/x/lint: 959b441 → fdd1cda -- golang.org/x/mobile: d3739f8 → d2bd2a2 -- golang.org/x/mod: 4bf6d31 → v0.3.0 -- golang.org/x/net: 13f9640 → ab34263 -- golang.org/x/oauth2: 0f29369 → 858c2ad -- golang.org/x/sys: fde4db3 → ed371f2 -- golang.org/x/text: v0.3.2 → v0.3.3 -- golang.org/x/time: 9d24e82 → 555d28b -- golang.org/x/tools: 65e3620 → c1934b7 -- golang.org/x/xerrors: a985d34 → 9bdfabe -- google.golang.org/api: 5213b80 → v0.15.1 -- google.golang.org/appengine: v1.5.0 → v1.6.5 -- google.golang.org/genproto: 24fa4b2 → cb27e3a -- google.golang.org/grpc: v1.26.0 → v1.27.0 -- gopkg.in/check.v1: 788fd78 → 41f04d3 -- honnef.co/go/tools: v0.0.1-2019.2.2 → v0.0.1-2019.2.3 -- k8s.io/gengo: 36b2048 → 8167cfd -- k8s.io/kube-openapi: bf4fb3b → 656914f -- k8s.io/system-validators: v1.0.4 → v1.1.2 -- k8s.io/utils: 0a110f9 → d5654de -- sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.0.7 → v0.0.9 -- sigs.k8s.io/structured-merge-diff/v3: v3.0.0 → 43c19bb +- cloud.google.com/go/bigquery: v1.0.1 → v1.4.0 +- cloud.google.com/go/datastore: v1.0.0 → v1.1.0 +- cloud.google.com/go/pubsub: v1.0.1 → v1.2.0 +- cloud.google.com/go/storage: v1.0.0 → v1.6.0 +- cloud.google.com/go: v0.51.0 → v0.54.0 +- github.com/Azure/go-autorest/autorest/adal: [v0.8.2 → v0.9.5](https://github.com/Azure/go-autorest/autorest/adal/compare/v0.8.2...v0.9.5) +- github.com/Azure/go-autorest/autorest/date: [v0.2.0 → v0.3.0](https://github.com/Azure/go-autorest/autorest/date/compare/v0.2.0...v0.3.0) +- github.com/Azure/go-autorest/autorest/mocks: [v0.3.0 → v0.4.1](https://github.com/Azure/go-autorest/autorest/mocks/compare/v0.3.0...v0.4.1) +- github.com/Azure/go-autorest/autorest: [v0.9.6 → v0.11.1](https://github.com/Azure/go-autorest/autorest/compare/v0.9.6...v0.11.1) +- github.com/Azure/go-autorest/logger: [v0.1.0 → v0.2.0](https://github.com/Azure/go-autorest/logger/compare/v0.1.0...v0.2.0) +- github.com/Azure/go-autorest/tracing: [v0.5.0 → v0.6.0](https://github.com/Azure/go-autorest/tracing/compare/v0.5.0...v0.6.0) +- github.com/Microsoft/go-winio: [fc70bd9 → v0.4.15](https://github.com/Microsoft/go-winio/compare/fc70bd9...v0.4.15) +- github.com/aws/aws-sdk-go: [v1.28.2 → v1.35.24](https://github.com/aws/aws-sdk-go/compare/v1.28.2...v1.35.24) +- github.com/blang/semver: [v3.5.0+incompatible → v3.5.1+incompatible](https://github.com/blang/semver/compare/v3.5.0...v3.5.1) +- github.com/checkpoint-restore/go-criu/v4: [v4.0.2 → v4.1.0](https://github.com/checkpoint-restore/go-criu/v4/compare/v4.0.2...v4.1.0) +- github.com/containerd/containerd: [v1.3.3 → v1.4.1](https://github.com/containerd/containerd/compare/v1.3.3...v1.4.1) +- github.com/containerd/ttrpc: [v1.0.0 → v1.0.2](https://github.com/containerd/ttrpc/compare/v1.0.0...v1.0.2) +- github.com/containerd/typeurl: [v1.0.0 → v1.0.1](https://github.com/containerd/typeurl/compare/v1.0.0...v1.0.1) +- github.com/coreos/etcd: [v3.3.10+incompatible → v3.3.13+incompatible](https://github.com/coreos/etcd/compare/v3.3.10...v3.3.13) +- github.com/docker/docker: [aa6a989 → bd33bbf](https://github.com/docker/docker/compare/aa6a989...bd33bbf) +- github.com/go-gl/glfw/v3.3/glfw: [12ad95a → 6f7a984](https://github.com/go-gl/glfw/v3.3/glfw/compare/12ad95a...6f7a984) +- github.com/golang/groupcache: [215e871 → 8c9f03a](https://github.com/golang/groupcache/compare/215e871...8c9f03a) +- github.com/golang/mock: [v1.3.1 → v1.4.1](https://github.com/golang/mock/compare/v1.3.1...v1.4.1) +- github.com/golang/protobuf: [v1.4.2 → v1.4.3](https://github.com/golang/protobuf/compare/v1.4.2...v1.4.3) +- github.com/google/cadvisor: [v0.37.0 → v0.38.5](https://github.com/google/cadvisor/compare/v0.37.0...v0.38.5) +- github.com/google/go-cmp: [v0.4.0 → v0.5.2](https://github.com/google/go-cmp/compare/v0.4.0...v0.5.2) +- github.com/google/pprof: [d4f498a → 1ebb73c](https://github.com/google/pprof/compare/d4f498a...1ebb73c) +- github.com/google/uuid: [v1.1.1 → v1.1.2](https://github.com/google/uuid/compare/v1.1.1...v1.1.2) +- github.com/gorilla/mux: [v1.7.3 → v1.8.0](https://github.com/gorilla/mux/compare/v1.7.3...v1.8.0) +- github.com/gorilla/websocket: [v1.4.0 → v1.4.2](https://github.com/gorilla/websocket/compare/v1.4.0...v1.4.2) +- github.com/jmespath/go-jmespath: [c2b33e8 → v0.4.0](https://github.com/jmespath/go-jmespath/compare/c2b33e8...v0.4.0) +- github.com/karrick/godirwalk: [v1.7.5 → v1.16.1](https://github.com/karrick/godirwalk/compare/v1.7.5...v1.16.1) +- github.com/opencontainers/go-digest: [v1.0.0-rc1 → v1.0.0](https://github.com/opencontainers/go-digest/compare/v1.0.0-rc1...v1.0.0) +- github.com/opencontainers/runc: [819fcc6 → v1.0.0-rc92](https://github.com/opencontainers/runc/compare/819fcc6...v1.0.0-rc92) +- github.com/opencontainers/runtime-spec: [237cc4f → 4d89ac9](https://github.com/opencontainers/runtime-spec/compare/237cc4f...4d89ac9) +- github.com/opencontainers/selinux: [v1.5.2 → v1.6.0](https://github.com/opencontainers/selinux/compare/v1.5.2...v1.6.0) +- github.com/prometheus/procfs: [v0.1.3 → v0.2.0](https://github.com/prometheus/procfs/compare/v0.1.3...v0.2.0) +- github.com/quobyte/api: [v0.1.2 → v0.1.8](https://github.com/quobyte/api/compare/v0.1.2...v0.1.8) +- github.com/spf13/cobra: [v1.0.0 → v1.1.1](https://github.com/spf13/cobra/compare/v1.0.0...v1.1.1) +- github.com/spf13/viper: [v1.4.0 → v1.7.0](https://github.com/spf13/viper/compare/v1.4.0...v1.7.0) +- github.com/storageos/go-api: [343b3ef → v2.2.0+incompatible](https://github.com/storageos/go-api/compare/343b3ef...v2.2.0) +- github.com/stretchr/testify: [v1.4.0 → v1.6.1](https://github.com/stretchr/testify/compare/v1.4.0...v1.6.1) +- github.com/vishvananda/netns: [52d707b → db3c7e5](https://github.com/vishvananda/netns/compare/52d707b...db3c7e5) +- go.etcd.io/etcd: 17cef6e → dd1b699 +- go.opencensus.io: v0.22.2 → v0.22.3 +- golang.org/x/crypto: 75b2880 → 7f63de1 +- golang.org/x/exp: da58074 → 6cc2880 +- golang.org/x/lint: fdd1cda → 738671d +- golang.org/x/net: ab34263 → 69a7880 +- golang.org/x/oauth2: 858c2ad → bf48bf1 +- golang.org/x/sys: ed371f2 → 5cba982 +- golang.org/x/text: v0.3.3 → v0.3.4 +- golang.org/x/time: 555d28b → 3af7569 +- golang.org/x/xerrors: 9bdfabe → 5ec99f8 +- google.golang.org/api: v0.15.1 → v0.20.0 +- google.golang.org/genproto: cb27e3a → 8816d57 +- google.golang.org/grpc: v1.27.0 → v1.27.1 +- google.golang.org/protobuf: v1.24.0 → v1.25.0 +- honnef.co/go/tools: v0.0.1-2019.2.3 → v0.0.1-2020.1.3 +- k8s.io/gengo: 8167cfd → 83324d8 +- k8s.io/klog/v2: v2.2.0 → v2.4.0 +- k8s.io/kube-openapi: 6aeccd4 → d219536 +- k8s.io/system-validators: v1.1.2 → v1.2.0 +- k8s.io/utils: d5654de → 67b214c +- sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.0.9 → v0.0.14 +- sigs.k8s.io/structured-merge-diff/v4: v4.0.1 → v4.0.2 ### 제거 -- github.com/OpenPeeDeeP/depguard: [v1.0.1](https://github.com/OpenPeeDeeP/depguard/tree/v1.0.1) -- github.com/Rican7/retry: [v0.1.0](https://github.com/Rican7/retry/tree/v0.1.0) -- github.com/StackExchange/wmi: [5d04971](https://github.com/StackExchange/wmi/tree/5d04971) -- github.com/anmitsu/go-shlex: [648efa6](https://github.com/anmitsu/go-shlex/tree/648efa6) -- github.com/bazelbuild/bazel-gazelle: [70208cb](https://github.com/bazelbuild/bazel-gazelle/tree/70208cb) -- github.com/bazelbuild/buildtools: [69366ca](https://github.com/bazelbuild/buildtools/tree/69366ca) -- github.com/bazelbuild/rules_go: [6dae44d](https://github.com/bazelbuild/rules_go/tree/6dae44d) -- github.com/bradfitz/go-smtpd: [deb6d62](https://github.com/bradfitz/go-smtpd/tree/deb6d62) -- github.com/cespare/prettybench: [03b8cfe](https://github.com/cespare/prettybench/tree/03b8cfe) -- github.com/checkpoint-restore/go-criu: [17b0214](https://github.com/checkpoint-restore/go-criu/tree/17b0214) -- github.com/client9/misspell: [v0.3.4](https://github.com/client9/misspell/tree/v0.3.4) -- github.com/coreos/go-etcd: [v2.0.0+incompatible](https://github.com/coreos/go-etcd/tree/v2.0.0) -- github.com/cpuguy83/go-md2man: [v1.0.10](https://github.com/cpuguy83/go-md2man/tree/v1.0.10) -- github.com/docker/libnetwork: [c8a5fca](https://github.com/docker/libnetwork/tree/c8a5fca) -- github.com/gliderlabs/ssh: [v0.1.1](https://github.com/gliderlabs/ssh/tree/v0.1.1) -- github.com/go-critic/go-critic: [1df3008](https://github.com/go-critic/go-critic/tree/1df3008) -- github.com/go-lintpack/lintpack: [v0.5.2](https://github.com/go-lintpack/lintpack/tree/v0.5.2) -- github.com/go-ole/go-ole: [v1.2.1](https://github.com/go-ole/go-ole/tree/v1.2.1) -- github.com/go-toolsmith/astcast: [v1.0.0](https://github.com/go-toolsmith/astcast/tree/v1.0.0) -- github.com/go-toolsmith/astcopy: [v1.0.0](https://github.com/go-toolsmith/astcopy/tree/v1.0.0) -- github.com/go-toolsmith/astequal: [v1.0.0](https://github.com/go-toolsmith/astequal/tree/v1.0.0) -- github.com/go-toolsmith/astfmt: [v1.0.0](https://github.com/go-toolsmith/astfmt/tree/v1.0.0) -- github.com/go-toolsmith/astinfo: [9809ff7](https://github.com/go-toolsmith/astinfo/tree/9809ff7) -- github.com/go-toolsmith/astp: [v1.0.0](https://github.com/go-toolsmith/astp/tree/v1.0.0) -- github.com/go-toolsmith/pkgload: [v1.0.0](https://github.com/go-toolsmith/pkgload/tree/v1.0.0) -- github.com/go-toolsmith/strparse: [v1.0.0](https://github.com/go-toolsmith/strparse/tree/v1.0.0) -- github.com/go-toolsmith/typep: [v1.0.0](https://github.com/go-toolsmith/typep/tree/v1.0.0) -- github.com/gobwas/glob: [v0.2.3](https://github.com/gobwas/glob/tree/v0.2.3) -- github.com/godbus/dbus: [2ff6f7f](https://github.com/godbus/dbus/tree/2ff6f7f) -- github.com/golangci/check: [cfe4005](https://github.com/golangci/check/tree/cfe4005) -- github.com/golangci/dupl: [3e9179a](https://github.com/golangci/dupl/tree/3e9179a) -- github.com/golangci/errcheck: [ef45e06](https://github.com/golangci/errcheck/tree/ef45e06) -- github.com/golangci/go-misc: [927a3d8](https://github.com/golangci/go-misc/tree/927a3d8) -- github.com/golangci/go-tools: [e32c541](https://github.com/golangci/go-tools/tree/e32c541) -- github.com/golangci/goconst: [041c5f2](https://github.com/golangci/goconst/tree/041c5f2) -- github.com/golangci/gocyclo: [2becd97](https://github.com/golangci/gocyclo/tree/2becd97) -- github.com/golangci/gofmt: [0b8337e](https://github.com/golangci/gofmt/tree/0b8337e) -- github.com/golangci/golangci-lint: [v1.18.0](https://github.com/golangci/golangci-lint/tree/v1.18.0) -- github.com/golangci/gosec: [66fb7fc](https://github.com/golangci/gosec/tree/66fb7fc) -- github.com/golangci/ineffassign: [42439a7](https://github.com/golangci/ineffassign/tree/42439a7) -- github.com/golangci/lint-1: [ee948d0](https://github.com/golangci/lint-1/tree/ee948d0) -- github.com/golangci/maligned: [b1d8939](https://github.com/golangci/maligned/tree/b1d8939) -- github.com/golangci/misspell: [950f5d1](https://github.com/golangci/misspell/tree/950f5d1) -- github.com/golangci/prealloc: [215b22d](https://github.com/golangci/prealloc/tree/215b22d) -- github.com/golangci/revgrep: [d9c87f5](https://github.com/golangci/revgrep/tree/d9c87f5) -- github.com/golangci/unconvert: [28b1c44](https://github.com/golangci/unconvert/tree/28b1c44) -- github.com/google/go-github: [v17.0.0+incompatible](https://github.com/google/go-github/tree/v17.0.0) -- github.com/google/go-querystring: [v1.0.0](https://github.com/google/go-querystring/tree/v1.0.0) -- github.com/gostaticanalysis/analysisutil: [v0.0.3](https://github.com/gostaticanalysis/analysisutil/tree/v0.0.3) -- github.com/jellevandenhooff/dkim: [f50fe3d](https://github.com/jellevandenhooff/dkim/tree/f50fe3d) -- github.com/klauspost/compress: [v1.4.1](https://github.com/klauspost/compress/tree/v1.4.1) -- github.com/logrusorgru/aurora: [a7b3b31](https://github.com/logrusorgru/aurora/tree/a7b3b31) -- github.com/mattn/go-shellwords: [v1.0.5](https://github.com/mattn/go-shellwords/tree/v1.0.5) -- github.com/mattn/goveralls: [v0.0.2](https://github.com/mattn/goveralls/tree/v0.0.2) -- github.com/mesos/mesos-go: [v0.0.9](https://github.com/mesos/mesos-go/tree/v0.0.9) -- github.com/mitchellh/go-ps: [4fdf99a](https://github.com/mitchellh/go-ps/tree/4fdf99a) -- github.com/mozilla/tls-observatory: [8791a20](https://github.com/mozilla/tls-observatory/tree/8791a20) -- github.com/nbutton23/zxcvbn-go: [eafdab6](https://github.com/nbutton23/zxcvbn-go/tree/eafdab6) -- github.com/pquerna/ffjson: [af8b230](https://github.com/pquerna/ffjson/tree/af8b230) -- github.com/quasilyte/go-consistent: [c6f3937](https://github.com/quasilyte/go-consistent/tree/c6f3937) -- github.com/ryanuber/go-glob: [256dc44](https://github.com/ryanuber/go-glob/tree/256dc44) -- github.com/shirou/gopsutil: [c95755e](https://github.com/shirou/gopsutil/tree/c95755e) -- github.com/shirou/w32: [bb4de01](https://github.com/shirou/w32/tree/bb4de01) -- github.com/shurcooL/go-goon: [37c2f52](https://github.com/shurcooL/go-goon/tree/37c2f52) -- github.com/shurcooL/go: [9e1955d](https://github.com/shurcooL/go/tree/9e1955d) -- github.com/sourcegraph/go-diff: [v0.5.1](https://github.com/sourcegraph/go-diff/tree/v0.5.1) -- github.com/tarm/serial: [98f6abe](https://github.com/tarm/serial/tree/98f6abe) -- github.com/timakin/bodyclose: [87058b9](https://github.com/timakin/bodyclose/tree/87058b9) -- github.com/ugorji/go/codec: [d75b2dc](https://github.com/ugorji/go/codec/tree/d75b2dc) -- github.com/ultraware/funlen: [v0.0.2](https://github.com/ultraware/funlen/tree/v0.0.2) -- github.com/valyala/bytebufferpool: [v1.0.0](https://github.com/valyala/bytebufferpool/tree/v1.0.0) -- github.com/valyala/fasthttp: [v1.2.0](https://github.com/valyala/fasthttp/tree/v1.2.0) -- github.com/valyala/quicktemplate: [v1.1.1](https://github.com/valyala/quicktemplate/tree/v1.1.1) -- github.com/valyala/tcplisten: [ceec8f9](https://github.com/valyala/tcplisten/tree/ceec8f9) -- go4.org: 417644f -- golang.org/x/build: 2835ba2 -- golang.org/x/perf: 6e6d33e -- gopkg.in/airbrake/gobrake.v2: v2.0.9 -- gopkg.in/gemnasium/logrus-airbrake-hook.v2: v2.1.2 -- gotest.tools/gotestsum: v0.3.5 -- grpc.go4.org: 11d0a25 -- k8s.io/klog: v1.0.0 -- k8s.io/repo-infra: v0.0.1-alpha.1 -- mvdan.cc/interfacer: c200402 -- mvdan.cc/lint: adc824a -- mvdan.cc/unparam: fbb5962 -- sourcegraph.com/sqs/pbtypes: d3ebe8f +- github.com/armon/consul-api: [eb2c6b5](https://github.com/armon/consul-api/tree/eb2c6b5) +- github.com/go-ini/ini: [v1.9.0](https://github.com/go-ini/ini/tree/v1.9.0) +- github.com/ugorji/go: [v1.1.4](https://github.com/ugorji/go/tree/v1.1.4) +- github.com/xlab/handysort: [fb3537e](https://github.com/xlab/handysort/tree/fb3537e) +- github.com/xordataexchange/crypt: [b2862e3](https://github.com/xordataexchange/crypt/tree/b2862e3) +- vbom.ml/util: db5cfe1 ## 의존성 ### 추가 -- cloud.google.com/go/bigquery: v1.0.1 -- cloud.google.com/go/datastore: v1.0.0 -- cloud.google.com/go/pubsub: v1.0.1 -- cloud.google.com/go/storage: v1.0.0 -- dmitri.shuralyov.com/gpu/mtl: 666a987 -- github.com/cespare/xxhash/v2: [v2.1.1](https://github.com/cespare/xxhash/v2/tree/v2.1.1) -- github.com/checkpoint-restore/go-criu/v4: [v4.0.2](https://github.com/checkpoint-restore/go-criu/v4/tree/v4.0.2) -- github.com/chzyer/logex: [v1.1.10](https://github.com/chzyer/logex/tree/v1.1.10) -- github.com/chzyer/readline: [2972be2](https://github.com/chzyer/readline/tree/2972be2) -- github.com/chzyer/test: [a1ea475](https://github.com/chzyer/test/tree/a1ea475) -- github.com/containerd/cgroups: [0dbf7f0](https://github.com/containerd/cgroups/tree/0dbf7f0) -- github.com/containerd/continuity: [aaeac12](https://github.com/containerd/continuity/tree/aaeac12) -- github.com/containerd/fifo: [a9fb20d](https://github.com/containerd/fifo/tree/a9fb20d) -- github.com/containerd/go-runc: [5a6d9f3](https://github.com/containerd/go-runc/tree/5a6d9f3) -- github.com/containerd/ttrpc: [v1.0.0](https://github.com/containerd/ttrpc/tree/v1.0.0) -- github.com/coreos/bbolt: [v1.3.2](https://github.com/coreos/bbolt/tree/v1.3.2) -- github.com/coreos/go-systemd/v22: [v22.1.0](https://github.com/coreos/go-systemd/v22/tree/v22.1.0) -- github.com/cpuguy83/go-md2man/v2: [v2.0.0](https://github.com/cpuguy83/go-md2man/v2/tree/v2.0.0) -- github.com/docopt/docopt-go: [ee0de3b](https://github.com/docopt/docopt-go/tree/ee0de3b) -- github.com/go-gl/glfw/v3.3/glfw: [12ad95a](https://github.com/go-gl/glfw/v3.3/glfw/tree/12ad95a) -- github.com/go-ini/ini: [v1.9.0](https://github.com/go-ini/ini/tree/v1.9.0) -- github.com/godbus/dbus/v5: [v5.0.3](https://github.com/godbus/dbus/v5/tree/v5.0.3) -- github.com/ianlancetaylor/demangle: [5e5cf60](https://github.com/ianlancetaylor/demangle/tree/5e5cf60) -- github.com/ishidawataru/sctp: [7c296d4](https://github.com/ishidawataru/sctp/tree/7c296d4) -- github.com/moby/ipvs: [v1.0.1](https://github.com/moby/ipvs/tree/v1.0.1) -- github.com/moby/sys/mountinfo: [v0.1.3](https://github.com/moby/sys/mountinfo/tree/v0.1.3) -- github.com/moby/term: [672ec06](https://github.com/moby/term/tree/672ec06) -- github.com/russross/blackfriday/v2: [v2.0.1](https://github.com/russross/blackfriday/v2/tree/v2.0.1) -- github.com/shurcooL/sanitized_anchor_name: [v1.0.0](https://github.com/shurcooL/sanitized_anchor_name/tree/v1.0.0) -- github.com/ugorji/go: [v1.1.4](https://github.com/ugorji/go/tree/v1.1.4) -- github.com/yuin/goldmark: [v1.1.27](https://github.com/yuin/goldmark/tree/v1.1.27) -- google.golang.org/protobuf: v1.24.0 -- gotest.tools/v3: v3.0.2 -- k8s.io/klog/v2: v2.2.0 -- sigs.k8s.io/structured-merge-diff/v4: v4.0.1 +- cloud.google.com/go/firestore: v1.1.0 +- github.com/Azure/go-autorest: [v14.2.0+incompatible](https://github.com/Azure/go-autorest/tree/v14.2.0) +- github.com/armon/go-metrics: [f0300d1](https://github.com/armon/go-metrics/tree/f0300d1) +- github.com/armon/go-radix: [7fddfc3](https://github.com/armon/go-radix/tree/7fddfc3) +- github.com/bketelsen/crypt: [5cbc8cc](https://github.com/bketelsen/crypt/tree/5cbc8cc) +- github.com/form3tech-oss/jwt-go: [v3.2.2+incompatible](https://github.com/form3tech-oss/jwt-go/tree/v3.2.2) +- github.com/fvbommel/sortorder: [v1.0.1](https://github.com/fvbommel/sortorder/tree/v1.0.1) +- github.com/hashicorp/consul/api: [v1.1.0](https://github.com/hashicorp/consul/api/tree/v1.1.0) +- github.com/hashicorp/consul/sdk: [v0.1.1](https://github.com/hashicorp/consul/sdk/tree/v0.1.1) +- github.com/hashicorp/errwrap: [v1.0.0](https://github.com/hashicorp/errwrap/tree/v1.0.0) +- github.com/hashicorp/go-cleanhttp: [v0.5.1](https://github.com/hashicorp/go-cleanhttp/tree/v0.5.1) +- github.com/hashicorp/go-immutable-radix: [v1.0.0](https://github.com/hashicorp/go-immutable-radix/tree/v1.0.0) +- github.com/hashicorp/go-msgpack: [v0.5.3](https://github.com/hashicorp/go-msgpack/tree/v0.5.3) +- github.com/hashicorp/go-multierror: [v1.0.0](https://github.com/hashicorp/go-multierror/tree/v1.0.0) +- github.com/hashicorp/go-rootcerts: [v1.0.0](https://github.com/hashicorp/go-rootcerts/tree/v1.0.0) +- github.com/hashicorp/go-sockaddr: [v1.0.0](https://github.com/hashicorp/go-sockaddr/tree/v1.0.0) +- github.com/hashicorp/go-uuid: [v1.0.1](https://github.com/hashicorp/go-uuid/tree/v1.0.1) +- github.com/hashicorp/go.net: [v0.0.1](https://github.com/hashicorp/go.net/tree/v0.0.1) +- github.com/hashicorp/logutils: [v1.0.0](https://github.com/hashicorp/logutils/tree/v1.0.0) +- github.com/hashicorp/mdns: [v1.0.0](https://github.com/hashicorp/mdns/tree/v1.0.0) +- github.com/hashicorp/memberlist: [v0.1.3](https://github.com/hashicorp/memberlist/tree/v0.1.3) +- github.com/hashicorp/serf: [v0.8.2](https://github.com/hashicorp/serf/tree/v0.8.2) +- github.com/jmespath/go-jmespath/internal/testify: [v1.5.1](https://github.com/jmespath/go-jmespath/internal/testify/tree/v1.5.1) +- github.com/mitchellh/cli: [v1.0.0](https://github.com/mitchellh/cli/tree/v1.0.0) +- github.com/mitchellh/go-testing-interface: [v1.0.0](https://github.com/mitchellh/go-testing-interface/tree/v1.0.0) +- github.com/mitchellh/gox: [v0.4.0](https://github.com/mitchellh/gox/tree/v0.4.0) +- github.com/mitchellh/iochan: [v1.0.0](https://github.com/mitchellh/iochan/tree/v1.0.0) +- github.com/pascaldekloe/goe: [57f6aae](https://github.com/pascaldekloe/goe/tree/57f6aae) +- github.com/posener/complete: [v1.1.1](https://github.com/posener/complete/tree/v1.1.1) +- github.com/ryanuber/columnize: [9b3edd6](https://github.com/ryanuber/columnize/tree/9b3edd6) +- github.com/sean-/seed: [e2103e2](https://github.com/sean-/seed/tree/e2103e2) +- github.com/subosito/gotenv: [v1.2.0](https://github.com/subosito/gotenv/tree/v1.2.0) +- github.com/willf/bitset: [d5bec33](https://github.com/willf/bitset/tree/d5bec33) +- gopkg.in/ini.v1: v1.51.0 +- gopkg.in/yaml.v3: 9f266ea +- rsc.io/quote/v3: v3.1.0 +- rsc.io/sampler: v1.3.0 ### 변경 -- cloud.google.com/go: v0.38.0 → v0.51.0 -- github.com/Azure/azure-sdk-for-go: [v35.0.0+incompatible → v43.0.0+incompatible](https://github.com/Azure/azure-sdk-for-go/compare/v35.0.0...v43.0.0) -- github.com/Azure/go-autorest/autorest/adal: [v0.5.0 → v0.8.2](https://github.com/Azure/go-autorest/autorest/adal/compare/v0.5.0...v0.8.2) -- github.com/Azure/go-autorest/autorest/date: [v0.1.0 → v0.2.0](https://github.com/Azure/go-autorest/autorest/date/compare/v0.1.0...v0.2.0) -- github.com/Azure/go-autorest/autorest/mocks: [v0.2.0 → v0.3.0](https://github.com/Azure/go-autorest/autorest/mocks/compare/v0.2.0...v0.3.0) -- github.com/Azure/go-autorest/autorest: [v0.9.0 → v0.9.6](https://github.com/Azure/go-autorest/autorest/compare/v0.9.0...v0.9.6) -- github.com/GoogleCloudPlatform/k8s-cloud-provider: [27a4ced → 7901bc8](https://github.com/GoogleCloudPlatform/k8s-cloud-provider/compare/27a4ced...7901bc8) -- github.com/Microsoft/go-winio: [v0.4.14 → fc70bd9](https://github.com/Microsoft/go-winio/compare/v0.4.14...fc70bd9) -- github.com/Microsoft/hcsshim: [672e52e → 5eafd15](https://github.com/Microsoft/hcsshim/compare/672e52e...5eafd15) -- github.com/alecthomas/template: [a0175ee → fb15b89](https://github.com/alecthomas/template/compare/a0175ee...fb15b89) -- github.com/alecthomas/units: [2efee85 → c3de453](https://github.com/alecthomas/units/compare/2efee85...c3de453) -- github.com/beorn7/perks: [v1.0.0 → v1.0.1](https://github.com/beorn7/perks/compare/v1.0.0...v1.0.1) -- github.com/cilium/ebpf: [95b36a5 → 1c8d4c9](https://github.com/cilium/ebpf/compare/95b36a5...1c8d4c9) -- github.com/containerd/console: [84eeaae → v1.0.0](https://github.com/containerd/console/compare/84eeaae...v1.0.0) -- github.com/containerd/containerd: [v1.0.2 → v1.3.3](https://github.com/containerd/containerd/compare/v1.0.2...v1.3.3) -- github.com/containerd/typeurl: [2a93cfd → v1.0.0](https://github.com/containerd/typeurl/compare/2a93cfd...v1.0.0) -- github.com/containernetworking/cni: [v0.7.1 → v0.8.0](https://github.com/containernetworking/cni/compare/v0.7.1...v0.8.0) -- github.com/coredns/corefile-migration: [v1.0.6 → v1.0.10](https://github.com/coredns/corefile-migration/compare/v1.0.6...v1.0.10) -- github.com/coreos/pkg: [97fdf19 → 399ea9e](https://github.com/coreos/pkg/compare/97fdf19...399ea9e) -- github.com/docker/docker: [be7ac8b → aa6a989](https://github.com/docker/docker/compare/be7ac8b...aa6a989) -- github.com/docker/go-connections: [v0.3.0 → v0.4.0](https://github.com/docker/go-connections/compare/v0.3.0...v0.4.0) -- github.com/evanphx/json-patch: [v4.2.0+incompatible → v4.9.0+incompatible](https://github.com/evanphx/json-patch/compare/v4.2.0...v4.9.0) -- github.com/fsnotify/fsnotify: [v1.4.7 → v1.4.9](https://github.com/fsnotify/fsnotify/compare/v1.4.7...v1.4.9) -- github.com/go-kit/kit: [v0.8.0 → v0.9.0](https://github.com/go-kit/kit/compare/v0.8.0...v0.9.0) -- github.com/go-logfmt/logfmt: [v0.3.0 → v0.4.0](https://github.com/go-logfmt/logfmt/compare/v0.3.0...v0.4.0) -- github.com/go-logr/logr: [v0.1.0 → v0.2.0](https://github.com/go-logr/logr/compare/v0.1.0...v0.2.0) -- github.com/golang/groupcache: [02826c3 → 215e871](https://github.com/golang/groupcache/compare/02826c3...215e871) -- github.com/golang/protobuf: [v1.3.2 → v1.4.2](https://github.com/golang/protobuf/compare/v1.3.2...v1.4.2) -- github.com/google/cadvisor: [v0.35.0 → v0.37.0](https://github.com/google/cadvisor/compare/v0.35.0...v0.37.0) -- github.com/google/go-cmp: [v0.3.0 → v0.4.0](https://github.com/google/go-cmp/compare/v0.3.0...v0.4.0) -- github.com/google/pprof: [3ea8567 → d4f498a](https://github.com/google/pprof/compare/3ea8567...d4f498a) -- github.com/googleapis/gax-go/v2: [v2.0.4 → v2.0.5](https://github.com/googleapis/gax-go/v2/compare/v2.0.4...v2.0.5) -- github.com/googleapis/gnostic: [v0.1.0 → v0.4.1](https://github.com/googleapis/gnostic/compare/v0.1.0...v0.4.1) -- github.com/gorilla/mux: [v1.7.0 → v1.7.3](https://github.com/gorilla/mux/compare/v1.7.0...v1.7.3) -- github.com/json-iterator/go: [v1.1.8 → v1.1.10](https://github.com/json-iterator/go/compare/v1.1.8...v1.1.10) -- github.com/jstemmer/go-junit-report: [af01ea7 → v0.9.1](https://github.com/jstemmer/go-junit-report/compare/af01ea7...v0.9.1) -- github.com/konsorten/go-windows-terminal-sequences: [v1.0.1 → v1.0.3](https://github.com/konsorten/go-windows-terminal-sequences/compare/v1.0.1...v1.0.3) -- github.com/kr/pretty: [v0.1.0 → v0.2.0](https://github.com/kr/pretty/compare/v0.1.0...v0.2.0) -- github.com/mattn/go-isatty: [v0.0.9 → v0.0.4](https://github.com/mattn/go-isatty/compare/v0.0.9...v0.0.4) -- github.com/matttproud/golang_protobuf_extensions: [v1.0.1 → c182aff](https://github.com/matttproud/golang_protobuf_extensions/compare/v1.0.1...c182aff) -- github.com/mistifyio/go-zfs: [v2.1.1+incompatible → f784269](https://github.com/mistifyio/go-zfs/compare/v2.1.1...f784269) -- github.com/mrunalp/fileutils: [7d4729f → abd8a0e](https://github.com/mrunalp/fileutils/compare/7d4729f...abd8a0e) -- github.com/opencontainers/runc: [v1.0.0-rc10 → 819fcc6](https://github.com/opencontainers/runc/compare/v1.0.0-rc10...819fcc6) -- github.com/opencontainers/runtime-spec: [v1.0.0 → 237cc4f](https://github.com/opencontainers/runtime-spec/compare/v1.0.0...237cc4f) -- github.com/opencontainers/selinux: [5215b18 → v1.5.2](https://github.com/opencontainers/selinux/compare/5215b18...v1.5.2) -- github.com/pkg/errors: [v0.8.1 → v0.9.1](https://github.com/pkg/errors/compare/v0.8.1...v0.9.1) -- github.com/prometheus/client_golang: [v1.0.0 → v1.7.1](https://github.com/prometheus/client_golang/compare/v1.0.0...v1.7.1) -- github.com/prometheus/common: [v0.4.1 → v0.10.0](https://github.com/prometheus/common/compare/v0.4.1...v0.10.0) -- github.com/prometheus/procfs: [v0.0.2 → v0.1.3](https://github.com/prometheus/procfs/compare/v0.0.2...v0.1.3) -- github.com/rubiojr/go-vhd: [0bfd3b3 → 02e2102](https://github.com/rubiojr/go-vhd/compare/0bfd3b3...02e2102) -- github.com/sirupsen/logrus: [v1.4.2 → v1.6.0](https://github.com/sirupsen/logrus/compare/v1.4.2...v1.6.0) -- github.com/spf13/cobra: [v0.0.5 → v1.0.0](https://github.com/spf13/cobra/compare/v0.0.5...v1.0.0) -- github.com/spf13/viper: [v1.3.2 → v1.4.0](https://github.com/spf13/viper/compare/v1.3.2...v1.4.0) -- github.com/tmc/grpc-websocket-proxy: [89b8d40 → 0ad062e](https://github.com/tmc/grpc-websocket-proxy/compare/89b8d40...0ad062e) -- github.com/urfave/cli: [v1.20.0 → v1.22.2](https://github.com/urfave/cli/compare/v1.20.0...v1.22.2) -- github.com/vishvananda/netlink: [v1.0.0 → v1.1.0](https://github.com/vishvananda/netlink/compare/v1.0.0...v1.1.0) -- github.com/vishvananda/netns: [be1fbed → 52d707b](https://github.com/vishvananda/netns/compare/be1fbed...52d707b) -- go.etcd.io/bbolt: v1.3.3 → v1.3.5 -- go.etcd.io/etcd: 3cf2f69 → 17cef6e -- go.opencensus.io: v0.21.0 → v0.22.2 -- go.uber.org/atomic: v1.3.2 → v1.4.0 -- golang.org/x/crypto: bac4c82 → 75b2880 -- golang.org/x/exp: 4b39c73 → da58074 -- golang.org/x/image: 0694c2d → cff245a -- golang.org/x/lint: 959b441 → fdd1cda -- golang.org/x/mobile: d3739f8 → d2bd2a2 -- golang.org/x/mod: 4bf6d31 → v0.3.0 -- golang.org/x/net: 13f9640 → ab34263 -- golang.org/x/oauth2: 0f29369 → 858c2ad -- golang.org/x/sys: fde4db3 → ed371f2 -- golang.org/x/text: v0.3.2 → v0.3.3 -- golang.org/x/time: 9d24e82 → 555d28b -- golang.org/x/tools: 65e3620 → c1934b7 -- golang.org/x/xerrors: a985d34 → 9bdfabe -- google.golang.org/api: 5213b80 → v0.15.1 -- google.golang.org/appengine: v1.5.0 → v1.6.5 -- google.golang.org/genproto: 24fa4b2 → cb27e3a -- google.golang.org/grpc: v1.26.0 → v1.27.0 -- gopkg.in/check.v1: 788fd78 → 41f04d3 -- honnef.co/go/tools: v0.0.1-2019.2.2 → v0.0.1-2019.2.3 -- k8s.io/gengo: 36b2048 → 8167cfd -- k8s.io/kube-openapi: bf4fb3b → 6aeccd4 -- k8s.io/system-validators: v1.0.4 → v1.1.2 -- k8s.io/utils: a9aa75a → d5654de -- sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.0.7 → v0.0.9 +- cloud.google.com/go/bigquery: v1.0.1 → v1.4.0 +- cloud.google.com/go/datastore: v1.0.0 → v1.1.0 +- cloud.google.com/go/pubsub: v1.0.1 → v1.2.0 +- cloud.google.com/go/storage: v1.0.0 → v1.6.0 +- cloud.google.com/go: v0.51.0 → v0.54.0 +- github.com/Azure/go-autorest/autorest/adal: [v0.8.2 → v0.9.5](https://github.com/Azure/go-autorest/autorest/adal/compare/v0.8.2...v0.9.5) +- github.com/Azure/go-autorest/autorest/date: [v0.2.0 → v0.3.0](https://github.com/Azure/go-autorest/autorest/date/compare/v0.2.0...v0.3.0) +- github.com/Azure/go-autorest/autorest/mocks: [v0.3.0 → v0.4.1](https://github.com/Azure/go-autorest/autorest/mocks/compare/v0.3.0...v0.4.1) +- github.com/Azure/go-autorest/autorest: [v0.9.6 → v0.11.1](https://github.com/Azure/go-autorest/autorest/compare/v0.9.6...v0.11.1) +- github.com/Azure/go-autorest/logger: [v0.1.0 → v0.2.0](https://github.com/Azure/go-autorest/logger/compare/v0.1.0...v0.2.0) +- github.com/Azure/go-autorest/tracing: [v0.5.0 → v0.6.0](https://github.com/Azure/go-autorest/tracing/compare/v0.5.0...v0.6.0) +- github.com/Microsoft/go-winio: [fc70bd9 → v0.4.15](https://github.com/Microsoft/go-winio/compare/fc70bd9...v0.4.15) +- github.com/aws/aws-sdk-go: [v1.28.2 → v1.35.24](https://github.com/aws/aws-sdk-go/compare/v1.28.2...v1.35.24) +- github.com/blang/semver: [v3.5.0+incompatible → v3.5.1+incompatible](https://github.com/blang/semver/compare/v3.5.0...v3.5.1) +- github.com/checkpoint-restore/go-criu/v4: [v4.0.2 → v4.1.0](https://github.com/checkpoint-restore/go-criu/v4/compare/v4.0.2...v4.1.0) +- github.com/containerd/containerd: [v1.3.3 → v1.4.1](https://github.com/containerd/containerd/compare/v1.3.3...v1.4.1) +- github.com/containerd/ttrpc: [v1.0.0 → v1.0.2](https://github.com/containerd/ttrpc/compare/v1.0.0...v1.0.2) +- github.com/containerd/typeurl: [v1.0.0 → v1.0.1](https://github.com/containerd/typeurl/compare/v1.0.0...v1.0.1) +- github.com/coreos/etcd: [v3.3.10+incompatible → v3.3.13+incompatible](https://github.com/coreos/etcd/compare/v3.3.10...v3.3.13) +- github.com/docker/docker: [aa6a989 → bd33bbf](https://github.com/docker/docker/compare/aa6a989...bd33bbf) +- github.com/go-gl/glfw/v3.3/glfw: [12ad95a → 6f7a984](https://github.com/go-gl/glfw/v3.3/glfw/compare/12ad95a...6f7a984) +- github.com/golang/groupcache: [215e871 → 8c9f03a](https://github.com/golang/groupcache/compare/215e871...8c9f03a) +- github.com/golang/mock: [v1.3.1 → v1.4.1](https://github.com/golang/mock/compare/v1.3.1...v1.4.1) +- github.com/golang/protobuf: [v1.4.2 → v1.4.3](https://github.com/golang/protobuf/compare/v1.4.2...v1.4.3) +- github.com/google/cadvisor: [v0.37.0 → v0.38.5](https://github.com/google/cadvisor/compare/v0.37.0...v0.38.5) +- github.com/google/go-cmp: [v0.4.0 → v0.5.2](https://github.com/google/go-cmp/compare/v0.4.0...v0.5.2) +- github.com/google/pprof: [d4f498a → 1ebb73c](https://github.com/google/pprof/compare/d4f498a...1ebb73c) +- github.com/google/uuid: [v1.1.1 → v1.1.2](https://github.com/google/uuid/compare/v1.1.1...v1.1.2) +- github.com/gorilla/mux: [v1.7.3 → v1.8.0](https://github.com/gorilla/mux/compare/v1.7.3...v1.8.0) +- github.com/gorilla/websocket: [v1.4.0 → v1.4.2](https://github.com/gorilla/websocket/compare/v1.4.0...v1.4.2) +- github.com/jmespath/go-jmespath: [c2b33e8 → v0.4.0](https://github.com/jmespath/go-jmespath/compare/c2b33e8...v0.4.0) +- github.com/karrick/godirwalk: [v1.7.5 → v1.16.1](https://github.com/karrick/godirwalk/compare/v1.7.5...v1.16.1) +- github.com/opencontainers/go-digest: [v1.0.0-rc1 → v1.0.0](https://github.com/opencontainers/go-digest/compare/v1.0.0-rc1...v1.0.0) +- github.com/opencontainers/runc: [819fcc6 → v1.0.0-rc92](https://github.com/opencontainers/runc/compare/819fcc6...v1.0.0-rc92) +- github.com/opencontainers/runtime-spec: [237cc4f → 4d89ac9](https://github.com/opencontainers/runtime-spec/compare/237cc4f...4d89ac9) +- github.com/opencontainers/selinux: [v1.5.2 → v1.6.0](https://github.com/opencontainers/selinux/compare/v1.5.2...v1.6.0) +- github.com/prometheus/procfs: [v0.1.3 → v0.2.0](https://github.com/prometheus/procfs/compare/v0.1.3...v0.2.0) +- github.com/quobyte/api: [v0.1.2 → v0.1.8](https://github.com/quobyte/api/compare/v0.1.2...v0.1.8) +- github.com/spf13/cobra: [v1.0.0 → v1.1.1](https://github.com/spf13/cobra/compare/v1.0.0...v1.1.1) +- github.com/spf13/viper: [v1.4.0 → v1.7.0](https://github.com/spf13/viper/compare/v1.4.0...v1.7.0) +- github.com/storageos/go-api: [343b3ef → v2.2.0+incompatible](https://github.com/storageos/go-api/compare/343b3ef...v2.2.0) +- github.com/stretchr/testify: [v1.4.0 → v1.6.1](https://github.com/stretchr/testify/compare/v1.4.0...v1.6.1) +- github.com/vishvananda/netns: [52d707b → db3c7e5](https://github.com/vishvananda/netns/compare/52d707b...db3c7e5) +- go.etcd.io/etcd: 17cef6e → dd1b699 +- go.opencensus.io: v0.22.2 → v0.22.3 +- golang.org/x/crypto: 75b2880 → 7f63de1 +- golang.org/x/exp: da58074 → 6cc2880 +- golang.org/x/lint: fdd1cda → 738671d +- golang.org/x/net: ab34263 → 69a7880 +- golang.org/x/oauth2: 858c2ad → bf48bf1 +- golang.org/x/sys: ed371f2 → 5cba982 +- golang.org/x/text: v0.3.3 → v0.3.4 +- golang.org/x/time: 555d28b → 3af7569 +- golang.org/x/xerrors: 9bdfabe → 5ec99f8 +- google.golang.org/api: v0.15.1 → v0.20.0 +- google.golang.org/genproto: cb27e3a → 8816d57 +- google.golang.org/grpc: v1.27.0 → v1.27.1 +- google.golang.org/protobuf: v1.24.0 → v1.25.0 +- honnef.co/go/tools: v0.0.1-2019.2.3 → v0.0.1-2020.1.3 +- k8s.io/gengo: 8167cfd → 83324d8 +- k8s.io/klog/v2: v2.2.0 → v2.4.0 +- k8s.io/kube-openapi: 6aeccd4 → d219536 +- k8s.io/system-validators: v1.1.2 → v1.2.0 +- k8s.io/utils: d5654de → 67b214c +- sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.0.9 → v0.0.14 +- sigs.k8s.io/structured-merge-diff/v4: v4.0.1 → v4.0.2 ### 제거 -- github.com/OpenPeeDeeP/depguard: [v1.0.1](https://github.com/OpenPeeDeeP/depguard/tree/v1.0.1) -- github.com/Rican7/retry: [v0.1.0](https://github.com/Rican7/retry/tree/v0.1.0) -- github.com/StackExchange/wmi: [5d04971](https://github.com/StackExchange/wmi/tree/5d04971) -- github.com/anmitsu/go-shlex: [648efa6](https://github.com/anmitsu/go-shlex/tree/648efa6) -- github.com/bazelbuild/bazel-gazelle: [70208cb](https://github.com/bazelbuild/bazel-gazelle/tree/70208cb) -- github.com/bazelbuild/buildtools: [69366ca](https://github.com/bazelbuild/buildtools/tree/69366ca) -- github.com/bazelbuild/rules_go: [6dae44d](https://github.com/bazelbuild/rules_go/tree/6dae44d) -- github.com/bradfitz/go-smtpd: [deb6d62](https://github.com/bradfitz/go-smtpd/tree/deb6d62) -- github.com/cespare/prettybench: [03b8cfe](https://github.com/cespare/prettybench/tree/03b8cfe) -- github.com/checkpoint-restore/go-criu: [17b0214](https://github.com/checkpoint-restore/go-criu/tree/17b0214) -- github.com/client9/misspell: [v0.3.4](https://github.com/client9/misspell/tree/v0.3.4) -- github.com/coreos/go-etcd: [v2.0.0+incompatible](https://github.com/coreos/go-etcd/tree/v2.0.0) -- github.com/cpuguy83/go-md2man: [v1.0.10](https://github.com/cpuguy83/go-md2man/tree/v1.0.10) -- github.com/docker/libnetwork: [c8a5fca](https://github.com/docker/libnetwork/tree/c8a5fca) -- github.com/gliderlabs/ssh: [v0.1.1](https://github.com/gliderlabs/ssh/tree/v0.1.1) -- github.com/go-critic/go-critic: [1df3008](https://github.com/go-critic/go-critic/tree/1df3008) -- github.com/go-lintpack/lintpack: [v0.5.2](https://github.com/go-lintpack/lintpack/tree/v0.5.2) -- github.com/go-ole/go-ole: [v1.2.1](https://github.com/go-ole/go-ole/tree/v1.2.1) -- github.com/go-toolsmith/astcast: [v1.0.0](https://github.com/go-toolsmith/astcast/tree/v1.0.0) -- github.com/go-toolsmith/astcopy: [v1.0.0](https://github.com/go-toolsmith/astcopy/tree/v1.0.0) -- github.com/go-toolsmith/astequal: [v1.0.0](https://github.com/go-toolsmith/astequal/tree/v1.0.0) -- github.com/go-toolsmith/astfmt: [v1.0.0](https://github.com/go-toolsmith/astfmt/tree/v1.0.0) -- github.com/go-toolsmith/astinfo: [9809ff7](https://github.com/go-toolsmith/astinfo/tree/9809ff7) -- github.com/go-toolsmith/astp: [v1.0.0](https://github.com/go-toolsmith/astp/tree/v1.0.0) -- github.com/go-toolsmith/pkgload: [v1.0.0](https://github.com/go-toolsmith/pkgload/tree/v1.0.0) -- github.com/go-toolsmith/strparse: [v1.0.0](https://github.com/go-toolsmith/strparse/tree/v1.0.0) -- github.com/go-toolsmith/typep: [v1.0.0](https://github.com/go-toolsmith/typep/tree/v1.0.0) -- github.com/gobwas/glob: [v0.2.3](https://github.com/gobwas/glob/tree/v0.2.3) -- github.com/godbus/dbus: [2ff6f7f](https://github.com/godbus/dbus/tree/2ff6f7f) -- github.com/golangci/check: [cfe4005](https://github.com/golangci/check/tree/cfe4005) -- github.com/golangci/dupl: [3e9179a](https://github.com/golangci/dupl/tree/3e9179a) -- github.com/golangci/errcheck: [ef45e06](https://github.com/golangci/errcheck/tree/ef45e06) -- github.com/golangci/go-misc: [927a3d8](https://github.com/golangci/go-misc/tree/927a3d8) -- github.com/golangci/go-tools: [e32c541](https://github.com/golangci/go-tools/tree/e32c541) -- github.com/golangci/goconst: [041c5f2](https://github.com/golangci/goconst/tree/041c5f2) -- github.com/golangci/gocyclo: [2becd97](https://github.com/golangci/gocyclo/tree/2becd97) -- github.com/golangci/gofmt: [0b8337e](https://github.com/golangci/gofmt/tree/0b8337e) -- github.com/golangci/golangci-lint: [v1.18.0](https://github.com/golangci/golangci-lint/tree/v1.18.0) -- github.com/golangci/gosec: [66fb7fc](https://github.com/golangci/gosec/tree/66fb7fc) -- github.com/golangci/ineffassign: [42439a7](https://github.com/golangci/ineffassign/tree/42439a7) -- github.com/golangci/lint-1: [ee948d0](https://github.com/golangci/lint-1/tree/ee948d0) -- github.com/golangci/maligned: [b1d8939](https://github.com/golangci/maligned/tree/b1d8939) -- github.com/golangci/misspell: [950f5d1](https://github.com/golangci/misspell/tree/950f5d1) -- github.com/golangci/prealloc: [215b22d](https://github.com/golangci/prealloc/tree/215b22d) -- github.com/golangci/revgrep: [d9c87f5](https://github.com/golangci/revgrep/tree/d9c87f5) -- github.com/golangci/unconvert: [28b1c44](https://github.com/golangci/unconvert/tree/28b1c44) -- github.com/google/go-github: [v17.0.0+incompatible](https://github.com/google/go-github/tree/v17.0.0) -- github.com/google/go-querystring: [v1.0.0](https://github.com/google/go-querystring/tree/v1.0.0) -- github.com/gostaticanalysis/analysisutil: [v0.0.3](https://github.com/gostaticanalysis/analysisutil/tree/v0.0.3) -- github.com/jellevandenhooff/dkim: [f50fe3d](https://github.com/jellevandenhooff/dkim/tree/f50fe3d) -- github.com/klauspost/compress: [v1.4.1](https://github.com/klauspost/compress/tree/v1.4.1) -- github.com/logrusorgru/aurora: [a7b3b31](https://github.com/logrusorgru/aurora/tree/a7b3b31) -- github.com/mattn/go-shellwords: [v1.0.5](https://github.com/mattn/go-shellwords/tree/v1.0.5) -- github.com/mattn/goveralls: [v0.0.2](https://github.com/mattn/goveralls/tree/v0.0.2) -- github.com/mesos/mesos-go: [v0.0.9](https://github.com/mesos/mesos-go/tree/v0.0.9) -- github.com/mitchellh/go-ps: [4fdf99a](https://github.com/mitchellh/go-ps/tree/4fdf99a) -- github.com/mozilla/tls-observatory: [8791a20](https://github.com/mozilla/tls-observatory/tree/8791a20) -- github.com/nbutton23/zxcvbn-go: [eafdab6](https://github.com/nbutton23/zxcvbn-go/tree/eafdab6) -- github.com/pquerna/ffjson: [af8b230](https://github.com/pquerna/ffjson/tree/af8b230) -- github.com/quasilyte/go-consistent: [c6f3937](https://github.com/quasilyte/go-consistent/tree/c6f3937) -- github.com/ryanuber/go-glob: [256dc44](https://github.com/ryanuber/go-glob/tree/256dc44) -- github.com/shirou/gopsutil: [c95755e](https://github.com/shirou/gopsutil/tree/c95755e) -- github.com/shirou/w32: [bb4de01](https://github.com/shirou/w32/tree/bb4de01) -- github.com/shurcooL/go-goon: [37c2f52](https://github.com/shurcooL/go-goon/tree/37c2f52) -- github.com/shurcooL/go: [9e1955d](https://github.com/shurcooL/go/tree/9e1955d) -- github.com/sourcegraph/go-diff: [v0.5.1](https://github.com/sourcegraph/go-diff/tree/v0.5.1) -- github.com/tarm/serial: [98f6abe](https://github.com/tarm/serial/tree/98f6abe) -- github.com/timakin/bodyclose: [87058b9](https://github.com/timakin/bodyclose/tree/87058b9) -- github.com/ugorji/go/codec: [d75b2dc](https://github.com/ugorji/go/codec/tree/d75b2dc) -- github.com/ultraware/funlen: [v0.0.2](https://github.com/ultraware/funlen/tree/v0.0.2) -- github.com/valyala/bytebufferpool: [v1.0.0](https://github.com/valyala/bytebufferpool/tree/v1.0.0) -- github.com/valyala/fasthttp: [v1.2.0](https://github.com/valyala/fasthttp/tree/v1.2.0) -- github.com/valyala/quicktemplate: [v1.1.1](https://github.com/valyala/quicktemplate/tree/v1.1.1) -- github.com/valyala/tcplisten: [ceec8f9](https://github.com/valyala/tcplisten/tree/ceec8f9) -- go4.org: 417644f -- golang.org/x/build: 2835ba2 -- golang.org/x/perf: 6e6d33e -- gopkg.in/airbrake/gobrake.v2: v2.0.9 -- gopkg.in/gemnasium/logrus-airbrake-hook.v2: v2.1.2 -- gotest.tools/gotestsum: v0.3.5 -- grpc.go4.org: 11d0a25 -- k8s.io/klog: v1.0.0 -- k8s.io/repo-infra: v0.0.1-alpha.1 -- mvdan.cc/interfacer: c200402 -- mvdan.cc/lint: adc824a -- mvdan.cc/unparam: fbb5962 -- sigs.k8s.io/structured-merge-diff/v3: v3.0.0 -- sourcegraph.com/sqs/pbtypes: d3ebe8f +- github.com/armon/consul-api: [eb2c6b5](https://github.com/armon/consul-api/tree/eb2c6b5) +- github.com/go-ini/ini: [v1.9.0](https://github.com/go-ini/ini/tree/v1.9.0) +- github.com/ugorji/go: [v1.1.4](https://github.com/ugorji/go/tree/v1.1.4) +- github.com/xlab/handysort: [fb3537e](https://github.com/xlab/handysort/tree/fb3537e) +- github.com/xordataexchange/crypt: [b2862e3](https://github.com/xordataexchange/crypt/tree/b2862e3) +- vbom.ml/util: db5cfe1 -# v1.19.0-rc.4 +# v1.20.0-rc.0 -## Downloads for v1.19.0-rc.4 +## Downloads for v1.20.0-rc.0 ### Source Code filename | sha512 hash -------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes.tar.gz) | 98bb6e2ac98a3176a9592982fec04b037d189de73cb7175d51596075bfd008c7ec0a2301b9511375626581f864ea74b5731e2ef2b4c70363f1860d11eb827de1 -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-src.tar.gz) | d4686f8d07fe6f324f46880a4dc5af9afa314a6b7dca82d0edb50290b769d25d18babcc5257a96a51a046052c7747e324b025a90a36ca5e62f67642bb03c44f6 +[kubernetes.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes.tar.gz) | acfee8658831f9503fccda0904798405434f17be7064a361a9f34c6ed04f1c0f685e79ca40cef5fcf34e3193bacbf467665e8dc277e0562ebdc929170034b5ae +[kubernetes-src.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-src.tar.gz) | 9d962f8845e1fa221649cf0c0e178f0f03808486c49ea15ab5ec67861ec5aa948cf18bc0ee9b2067643c8332227973dd592e6a4457456a9d9d80e8ef28d5f7c3 ### Client binaries filename | sha512 hash -------- | ----------- -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-client-darwin-amd64.tar.gz) | e9184ceb37491764c1ea2ef0b1eca55f27109bb973c7ff7c78e83c5945840baf28fdead21ef861b0c5cb81f4dc39d0af86ed7b17ed6f087f211084d0033dad11 -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-client-linux-386.tar.gz) | c9f1ec4e8d9c6245f955b2132c0fae6d851a6a49a5b7a2333c01ba9fafa3c4e8a07c6462e525179c25e308520502544ab4dc570e1b9d0090d58b6d18bcfcba47 -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-client-linux-amd64.tar.gz) | d23858b03c3554ad12517ce5f7855ceccaa9425c2d19fbc9cf902c0e796a8182f8b0e8eeeeefff0f46e960dfee96b2a2033a04a3194ac34dfd2a32003775d060 -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-client-linux-arm.tar.gz) | a745b3a06fe992713e4d7f921e2f36c5b39222d7b1a3e13299d15925743dd99965c2bdf05b4deda30a6f6232a40588e154fdd83f40d9d260d7ac8f70b18cad48 -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-client-linux-arm64.tar.gz) | 719b1f30e4bbb05d638ee78cf0145003a1e783bbd0c2f0952fcb30702dd27dfd44c3bc85baaf9a776e490ed53c638327ed1c0e5a882dc93c24d7cac20e4f1dd0 -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-client-linux-ppc64le.tar.gz) | fba0794e9dc0f231da5a4e85e37c2d8260e5205574e0421f5122a7d60a05ca6546912519a28e8d6c241904617234e1b0b5c94f890853ad5ae4e329ef8085a092 -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-client-linux-s390x.tar.gz) | edce96e37e37fd2b60e34fe56240461094e5784985790453becdfe09011305fcbd8a50ee5bf6d82a70d208d660796d0ddf160bed0292271b6617049db800962f -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-client-windows-386.tar.gz) | 06c849b35d886bebedfd8d906ac37ccda10e05b06542fefe6440268c5e937f235915e53daafe35076b68e0af0d4ddeab4240da55b09ee52fa26928945f1a2ecd -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-client-windows-amd64.tar.gz) | a13e6ec70f76d6056d5668b678ba6f223e35756cded6c84dfb58e28b3741fecfa7cb5e6ae2239392d770028d1b55ca8eb520c0b24e13fc3bd38720134b472d53 +[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-client-darwin-amd64.tar.gz) | 062b57f1a450fe01d6184f104d81d376bdf5720010412821e315fd9b1b622a400ac91f996540daa66cee172006f3efade4eccc19265494f1a1d7cc9450f0b50a +[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-client-linux-386.tar.gz) | 86e96d2c2046c5e62e02bef30a6643f25e01f1b3eba256cab7dd61252908540c26cb058490e9cecc5a9bad97d2b577f5968884e9f1a90237e302419f39e068bc +[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-client-linux-amd64.tar.gz) | 619d3afb9ce902368390e71633396010e88e87c5fd848e3adc71571d1d4a25be002588415e5f83afee82460f8a7c9e0bd968335277cb8f8cb51e58d4bb43e64e +[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-client-linux-arm.tar.gz) | 60965150a60ab3d05a248339786e0c7da4b89a04539c3719737b13d71302bac1dd9bcaa427d8a1f84a7b42d0c67801dce2de0005e9e47d21122868b32ac3d40f +[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-client-linux-arm64.tar.gz) | 688e064f4ef6a17189dbb5af468c279b9de35e215c40500fb97b1d46692d222747023f9e07a7f7ba006400f9532a8912e69d7c5143f956b1dadca144c67ee711 +[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-client-linux-ppc64le.tar.gz) | 47b8abc02b42b3b1de67da184921b5801d7e3cb09befac840c85913193fc5ac4e5e3ecfcb57da6b686ff21af9a3bd42ae6949d4744dbe6ad976794340e328b83 +[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-client-linux-s390x.tar.gz) | 971b41d3169f30e6c412e0254c180636abb7ccc8dcee6641b0e9877b69752fc61aa30b76c19c108969df654fe385da3cb3a44dd59d3c28dc45561392d7e08874 +[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-client-windows-386.tar.gz) | 2d34e8387e31531d9aca5655f2f0d18e75b01825dc1c39b7beb73a7b7b610e2ba429e5ca97d5c41a71b67e75e7096c86ab63fda9baab4c0878c1ccb3a1aefac8 +[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-client-windows-amd64.tar.gz) | f909640f4140693bb871936f10a40e79b43502105d0adb318b35bb7a64a770ad9d05a3a732368ccd3d15d496d75454789165bd1f5c2571da9a00569b3e6c007c ### Server binaries filename | sha512 hash -------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-server-linux-amd64.tar.gz) | ff7fbf211c29b94c19466337e6c142e733c8c0bac815a97906168e57d21ad1b2965e4b0033b525de8fed9a91ab943e3eb6d330f8095660e32be2791f8161a6a2 -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-server-linux-arm.tar.gz) | 218a35466ebcc0bc0e8eff9bbb2e58f0ac3bec6a75f45a7c1487aa4fc3e2bddb90b74e91a2b81bbbbb1eb1de2df310adab4c07c2a2c38a9973580b4f85734a1f -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-server-linux-arm64.tar.gz) | 8a81d727e63875d18336fda8bb6f570084553fc346b7e7df2fc3e1c04a8ef766f61d96d445537e4660ce2f46b170a04218a4d8a270b3ad373caa3f815c0fec93 -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-server-linux-ppc64le.tar.gz) | 9b5afa44ac2e1232cd0c54b3602a2027bc8a08b30809b3ef973f75793b35a596491e6056d7995e493a1e4f48d83389240ac2e609b9f76d2715b8e115e6648716 -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-server-linux-s390x.tar.gz) | f3034b2e88b5c1d362d84f78dfd1761d0fc21ada1cd6b1a6132a709c663a1206651df96c948534b3661f6b70b651e33021aced3a7574a0e5fc88ace73fff2a6f +[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-server-linux-amd64.tar.gz) | 0ea4458ae34108c633b4d48f1f128c6274dbc82b613492e78b3e0a2f656ac0df0bb9a75124e15d67c8e81850adcecf19f4ab0234c17247ee7ddf84f2df3e5eaa +[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-server-linux-arm.tar.gz) | aef6a4d457faa29936603370f29a8523bb274211c3cb5101bd31aaf469c91ba6bd149ea99a4ccdd83352cf37e4d6508c5ee475ec10292bccd2f77ceea31e1c28 +[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-server-linux-arm64.tar.gz) | 4829f473e9d60f9929ad17c70fdc2b6b6509ed75418be0b23a75b28580949736cb5b0bd6382070f93aa0a2a8863f0b1596daf965186ca749996c29d03ef7d8b8 +[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-server-linux-ppc64le.tar.gz) | 9ab0790d382a3e28df1c013762c09da0085449cfd09d176d80be932806c24a715ea829be0075c3e221a2ad9cf06e726b4c39ab41987c1fb0fee2563e48206763 +[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-server-linux-s390x.tar.gz) | 98670b587e299856dd9821b7517a35f9a65835b915b153de08b66c54d82160438b66f774bf5306c07bc956d70ff709860bc23162225da5e89f995d3fdc1f0122 ### Node binaries filename | sha512 hash -------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-node-linux-amd64.tar.gz) | 2061a8f5bc2060b071564c92b693950eda7768a9ceb874982f0e91aa78284fb477becb55ecf099acae73c447271240caecefc19b3b29024e9b818e0639c2fc70 -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-node-linux-arm.tar.gz) | c06b817b191ff9a4b05bf70fc14edcf01d4ded204e489966b1761dd68d45d054028870301e45ebba648c0be097c7c42120867c8b28fdd625c8eb5a5bc3ace71d -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-node-linux-arm64.tar.gz) | 21efb3bf23628546de97210074f48e928fec211b81215eff8b10c3f5f7e79bb5911c1393a66a8363a0183fe299bf98b316c0c2d77a13c8c5b798255c056bd806 -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-node-linux-ppc64le.tar.gz) | ce31dd65b9cbfaabdc3c93e8afee0ea5606c64e6bf4452078bee73b1d328d23ebdbc871a00edd16fa4e676406a707cf9113fdaec76489681c379c35c3fd6aeb0 -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-node-linux-s390x.tar.gz) | 523a8e1d6e0eff70810e846c171b7f74a4aaecb25237addf541a9f8adb3797402b6e57abf9030f62d5bb333d5f5e8960199a44fe48696a4da98f7ed7d993cde1 -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.4/kubernetes-node-windows-amd64.tar.gz) | a7fbcd11ea8b6427e7846e39b2fdeae41d484320faa8f3e9b6a777d87ba62e7399ad0ec6a33d9a4675001898881e444f336eebd5c97b3903dee803834a646f3d +[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-node-linux-amd64.tar.gz) | 699e9c8d1837198312eade8eb6fec390f6a2fea9e08207d2f58e8bb6e3e799028aca69e4670aac0a4ba7cf0af683aee2c158bf78cc520c80edc876c8d94d521a +[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-node-linux-arm.tar.gz) | f3b5eab0669490e3cd7e802693daf3555d08323dfff6e73a881fce00fed4690e8bdaf1610278d9de74036ca37631016075e5695a02158b7d3e7582b20ef7fa35 +[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-node-linux-arm64.tar.gz) | e5012f77363561a609aaf791baaa17d09009819c4085a57132e5feb5366275a54640094e6ed1cba527f42b586c6d62999c2a5435edf5665ff0e114db4423c2ae +[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-node-linux-ppc64le.tar.gz) | 2a6d6501620b1a9838dff05c66a40260cc22154a28027813346eb16e18c386bc3865298a46a0f08da71cd55149c5e7d07c4c4c431b4fd231486dd9d716548adb +[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-node-linux-s390x.tar.gz) | 5eca02777519e31428a1e5842fe540b813fb8c929c341bbc71dcfd60d98deb89060f8f37352e8977020e21e053379eead6478eb2d54ced66fb9d38d5f3142bf0 +[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-rc.0/kubernetes-node-windows-amd64.tar.gz) | 8ace02e7623dff894e863a2e0fa7dfb916368431d1723170713fe82e334c0ae0481b370855b71e2561de0fb64fed124281be604761ec08607230b66fb9ed1c03 -## Changelog since v1.19.0-rc.3 +## Changelog since v1.20.0-beta.2 + +## Changes by Kind + +### Feature + +- Kubernetes is now built using go1.15.5 + - build: Update to k/repo-infra@v0.1.2 (supports go1.15.5) ([#95776](https://github.com/kubernetes/kubernetes/pull/95776), [@justaugustus](https://github.com/justaugustus)) [SIG Cloud Provider, Instrumentation, Release and Testing] + +### Failing Test + +- Resolves an issue running Ingress conformance tests on clusters which use finalizers on Ingress objects to manage releasing load balancer resources ([#96742](https://github.com/kubernetes/kubernetes/pull/96742), [@spencerhance](https://github.com/spencerhance)) [SIG Network and Testing] +- The Conformance test "validates that there is no conflict between pods with same hostPort but different hostIP and protocol" now validates the connectivity to each hostPort, in addition to the functionality. ([#96627](https://github.com/kubernetes/kubernetes/pull/96627), [@aojea](https://github.com/aojea)) [SIG Scheduling and Testing] + +### Bug or Regression + +- Bump node-problem-detector version to v0.8.5 to fix OOM detection in with Linux kernels 5.1+ ([#96716](https://github.com/kubernetes/kubernetes/pull/96716), [@tosi3k](https://github.com/tosi3k)) [SIG Cloud Provider, Scalability and Testing] +- Changes to timeout parameter handling in 1.20.0-beta.2 have been reverted to avoid breaking backwards compatibility with existing clients. ([#96727](https://github.com/kubernetes/kubernetes/pull/96727), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Testing] +- Duplicate owner reference entries in create/update/patch requests now get deduplicated by the API server. The client sending the request now receives a warning header in the API response. Clients should stop sending requests with duplicate owner references. The API server may reject such requests as early as 1.24. ([#96185](https://github.com/kubernetes/kubernetes/pull/96185), [@roycaihw](https://github.com/roycaihw)) [SIG API Machinery and Testing] +- Fix: resize Azure disk issue when it's in attached state ([#96705](https://github.com/kubernetes/kubernetes/pull/96705), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fixed a bug where aggregator_unavailable_apiservice metrics were reported for deleted apiservices. ([#96421](https://github.com/kubernetes/kubernetes/pull/96421), [@dgrisonnet](https://github.com/dgrisonnet)) [SIG API Machinery and Instrumentation] +- Fixes code generation for non-namespaced create subresources fake client test. ([#96586](https://github.com/kubernetes/kubernetes/pull/96586), [@Doude](https://github.com/Doude)) [SIG API Machinery] +- HTTP/2 connection health check is enabled by default in all Kubernetes clients. The feature should work out-of-the-box. If needed, users can tune the feature via the HTTP2_READ_IDLE_TIMEOUT_SECONDS and HTTP2_PING_TIMEOUT_SECONDS environment variables. The feature is disabled if HTTP2_READ_IDLE_TIMEOUT_SECONDS is set to 0. ([#95981](https://github.com/kubernetes/kubernetes/pull/95981), [@caesarxuchao](https://github.com/caesarxuchao)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Node] +- Kubeadm: fix coredns migration should be triggered when there are newdefault configs during kubeadm upgrade ([#96907](https://github.com/kubernetes/kubernetes/pull/96907), [@pacoxu](https://github.com/pacoxu)) [SIG Cluster Lifecycle] +- Reduce volume name length for vsphere volumes ([#96533](https://github.com/kubernetes/kubernetes/pull/96533), [@gnufied](https://github.com/gnufied)) [SIG Storage] +- Resolves a regression in 1.19+ with workloads targeting deprecated beta os/arch labels getting stuck in NodeAffinity status on node startup. ([#96810](https://github.com/kubernetes/kubernetes/pull/96810), [@liggitt](https://github.com/liggitt)) [SIG Node] + +## Dependencies + +### Added +_Nothing has changed._ + +### Changed +- github.com/google/cadvisor: [v0.38.4 → v0.38.5](https://github.com/google/cadvisor/compare/v0.38.4...v0.38.5) + +### Removed +_Nothing has changed._ + + + +# v1.20.0-beta.2 + + +## Downloads for v1.20.0-beta.2 + +### Source Code + +filename | sha512 hash +-------- | ----------- +[kubernetes.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes.tar.gz) | fe769280aa623802a949b6a35fbddadbba1d6f9933a54132a35625683719595ecf58096a9aa0f7456f8d4931774df21bfa98e148bc3d85913f1da915134f77bd +[kubernetes-src.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-src.tar.gz) | ce1c8d97c52e5189af335d673bd7e99c564816f6adebf249838f7e3f0e920f323b4e398a5d163ea767091497012ec38843c59ff14e6fdd07683b682135eed645 + +### Client binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-client-darwin-amd64.tar.gz) | d6c14bd0f6702f4bbdf14a6abdfa4e5936de5b4efee38aa86c2bd7272967ec6d7868b88fc00ad4a7c3a20717a35e6be2b84e56dec04154fd702315f641409f7c +[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-client-linux-386.tar.gz) | b923c44cb0acb91a8f6fd442c2168aa6166c848f5d037ce50a7cb11502be3698db65836b373c916f75b648d6ac8d9158807a050eecc4e1c77cffa25b386c8cdb +[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-client-linux-amd64.tar.gz) | 8cae14146a9034dcd4e9d69d5d700f195a77aac35f629a148960ae028ed8b4fe12213993fe3e6e464b4b3e111adebe6f3dd7ca0accc70c738ed5cfd8993edd7c +[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-client-linux-arm.tar.gz) | 1f54e5262a0432945ead57fcb924e6bfedd9ea76db1dd9ebd946787a2923c247cf16e10505307b47e365905a1b398678dac5af0f433c439c158a33e08362d97b +[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-client-linux-arm64.tar.gz) | 31cf79c01e4878a231b4881fe3ed5ef790bd5fb5419388438d3f8c6a2129e655aba9e00b8e1d77e0bc5d05ecc75cf4ae02cf8266788822d0306c49c85ee584ed +[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-client-linux-ppc64le.tar.gz) | 2527948c40be2e16724d939316ad5363f15aa22ebf42d59359d8b6f757d30cfef6447434cc93bc5caa5a23a6a00a2da8d8191b6441e06bba469d9d4375989a97 +[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-client-linux-s390x.tar.gz) | b777ad764b3a46651ecb0846e5b7f860bb2c1c4bd4d0fcc468c6ccffb7d3b8dcb6dcdd73b13c16ded7219f91bba9f1e92f9258527fd3bb162b54d7901ac303ff +[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-client-windows-386.tar.gz) | 8a2f58aaab01be9fe298e4d01456536047cbdd39a37d3e325c1f69ceab3a0504998be41a9f41a894735dfc4ed22bed02591eea5f3c75ce12d9e95ba134e72ec5 +[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-client-windows-amd64.tar.gz) | 2f69cda177a178df149f5de66b7dba7f5ce14c1ffeb7c8d7dc4130c701b47d89bb2fbe74e7a262f573e4d21dee2c92414d050d7829e7c6fc3637a9d6b0b9c5c1 + +### Server binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-server-linux-amd64.tar.gz) | 3ecaac0213d369eab691ac55376821a80df5013cb12e1263f18d1c236a9e49d42b3cea422175556d8f929cdf3109b22c0b6212ac0f2e80cc7a5f4afa3aba5f24 +[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-server-linux-arm.tar.gz) | 580030b57ff207e177208fec0801a43389cae10cc2c9306327d354e7be6a055390184531d54b6742e0983550b7a76693cc4a705c2d2f4ac30495cf63cef26b9b +[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-server-linux-arm64.tar.gz) | 3e3286bd54671549fbef0dfdaaf1da99bc5c3efb32cc8d1e1985d9926520cea0c43bcf7cbcbbc8b1c1a95eab961255693008af3bb1ba743362998b5f0017d6d7 +[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-server-linux-ppc64le.tar.gz) | 9fa051e7e97648e97e26b09ab6d26be247b41b1a5938d2189204c9e6688e455afe76612bbcdd994ed5692935d0d960bd96dc222bce4b83f61d62557752b9d75b +[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-server-linux-s390x.tar.gz) | fa85d432eff586f30975c95664ac130b9f5ae02dc52b97613ed7a41324496631ea11d1a267daba564cf2485a9e49707814d86bbd3175486c7efc8b58a9314af5 + +### Node binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-node-linux-amd64.tar.gz) | 86e631f95fe670b467ead2b88d34e0364eaa275935af433d27cc378d82dcaa22041ccce40f5fa9561b9656dadaa578dc018ad458a59b1690d35f86dca4776b5c +[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-node-linux-arm.tar.gz) | a8754ff58a0e902397056b8615ab49af07aca347ba7cc4a812c238e3812234862270f25106b6a94753b157bb153b8eae8b39a01ed67384774d798598c243583b +[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-node-linux-arm64.tar.gz) | 28d727d7d08e2c856c9b4a574ef2dbf9e37236a0555f7ec5258b4284fa0582fb94b06783aaf50bf661f7503d101fbd70808aba6de02a2f0af94db7d065d25947 +[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-node-linux-ppc64le.tar.gz) | a1283449f1a0b155c11449275e9371add544d0bdd4609d6dc737ed5f7dd228e84e24ff249613a2a153691627368dd894ad64f4e6c0010eecc6efd2c13d4fb133 +[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-node-linux-s390x.tar.gz) | 5806028ba15a6a9c54a34f90117bc3181428dbb0e7ced30874c9f4a953ea5a0e9b2c73e6b1e2545e1b4e5253e9c7691588538b44cdfa666ce6865964b92d2fa8 +[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.2/kubernetes-node-windows-amd64.tar.gz) | d5327e3b7916c78777b9b69ba0f3758c3a8645c67af80114a0ae52babd7af27bb504febbaf51b1bfe5bd2d74c8c5c573471e1cb449f2429453f4b1be9d5e682a + +## Changelog since v1.20.0-beta.1 + +## Urgent Upgrade Notes + +### (No, really, you MUST read this before you upgrade) + + - A bug was fixed in kubelet where exec probe timeouts were not respected. Ensure that pods relying on this behavior are updated to correctly handle probe timeouts. + + This change in behavior may be unexpected for some clusters and can be disabled by turning off the ExecProbeTimeout feature gate. This gate will be locked and removed in future releases so that exec probe timeouts are always respected. ([#94115](https://github.com/kubernetes/kubernetes/pull/94115), [@andrewsykim](https://github.com/andrewsykim)) [SIG Node and Testing] + - For CSI drivers, kubelet no longer creates the target_path for NodePublishVolume in accordance with the CSI spec. Kubelet also no longer checks if staging and target paths are mounts or corrupted. CSI drivers need to be idempotent and do any necessary mount verification. ([#88759](https://github.com/kubernetes/kubernetes/pull/88759), [@andyzhangx](https://github.com/andyzhangx)) [SIG Storage] + - Kubeadm: + - The label applied to control-plane nodes "node-role.kubernetes.io/master" is now deprecated and will be removed in a future release after a GA deprecation period. + - Introduce a new label "node-role.kubernetes.io/control-plane" that will be applied in parallel to "node-role.kubernetes.io/master" until the removal of the "node-role.kubernetes.io/master" label. + - Make "kubeadm upgrade apply" add the "node-role.kubernetes.io/control-plane" label on existing nodes that only have the "node-role.kubernetes.io/master" label during upgrade. + - Please adapt your tooling built on top of kubeadm to use the "node-role.kubernetes.io/control-plane" label. + + - The taint applied to control-plane nodes "node-role.kubernetes.io/master:NoSchedule" is now deprecated and will be removed in a future release after a GA deprecation period. + - Apply toleration for a new, future taint "node-role.kubernetes.io/control-plane:NoSchedule" to the kubeadm CoreDNS / kube-dns managed manifests. Note that this taint is not yet applied to kubeadm control-plane nodes. + - Please adapt your workloads to tolerate the same future taint preemptively. + + For more details see: http://git.k8s.io/enhancements/keps/sig-cluster-lifecycle/kubeadm/2067-rename-master-label-taint/README.md ([#95382](https://github.com/kubernetes/kubernetes/pull/95382), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] + +## Changes by Kind + +### Deprecation + +- Docker support in the kubelet is now deprecated and will be removed in a future release. The kubelet uses a module called "dockershim" which implements CRI support for Docker and it has seen maintenance issues in the Kubernetes community. We encourage you to evaluate moving to a container runtime that is a full-fledged implementation of CRI (v1alpha1 or v1 compliant) as they become available. ([#94624](https://github.com/kubernetes/kubernetes/pull/94624), [@dims](https://github.com/dims)) [SIG Node] +- Kubectl: deprecate --delete-local-data ([#95076](https://github.com/kubernetes/kubernetes/pull/95076), [@dougsland](https://github.com/dougsland)) [SIG CLI, Cloud Provider and Scalability] + +### API Change + +- API priority and fairness graduated to beta + 1.19 servers with APF turned on should not be run in a multi-server cluster with 1.20+ servers. ([#96527](https://github.com/kubernetes/kubernetes/pull/96527), [@adtac](https://github.com/adtac)) [SIG API Machinery and Testing] +- Add LoadBalancerIPMode feature gate ([#92312](https://github.com/kubernetes/kubernetes/pull/92312), [@Sh4d1](https://github.com/Sh4d1)) [SIG Apps, CLI, Cloud Provider and Network] +- Add WindowsContainerResources and Annotations to CRI-API UpdateContainerResourcesRequest ([#95741](https://github.com/kubernetes/kubernetes/pull/95741), [@katiewasnothere](https://github.com/katiewasnothere)) [SIG Node] +- Add a 'serving' and `terminating` condition to the EndpointSlice API. + + `serving` tracks the readiness of endpoints regardless of their terminating state. This is distinct from `ready` since `ready` is only true when pods are not terminating. + `terminating` is true when an endpoint is terminating. For pods this is any endpoint with a deletion timestamp. ([#92968](https://github.com/kubernetes/kubernetes/pull/92968), [@andrewsykim](https://github.com/andrewsykim)) [SIG Apps and Network] +- Add support for hugepages to downward API ([#86102](https://github.com/kubernetes/kubernetes/pull/86102), [@derekwaynecarr](https://github.com/derekwaynecarr)) [SIG API Machinery, Apps, CLI, Network, Node, Scheduling and Testing] +- Adds kubelet alpha feature, `GracefulNodeShutdown` which makes kubelet aware of node system shutdowns and result in graceful termination of pods during a system shutdown. ([#96129](https://github.com/kubernetes/kubernetes/pull/96129), [@bobbypage](https://github.com/bobbypage)) [SIG Node] +- AppProtocol is now GA for Endpoints and Services. The ServiceAppProtocol feature gate will be deprecated in 1.21. ([#96327](https://github.com/kubernetes/kubernetes/pull/96327), [@robscott](https://github.com/robscott)) [SIG Apps and Network] +- Automatic allocation of NodePorts for services with type LoadBalancer can now be disabled by setting the (new) parameter + Service.spec.allocateLoadBalancerNodePorts=false. The default is to allocate NodePorts for services with type LoadBalancer which is the existing behavior. ([#92744](https://github.com/kubernetes/kubernetes/pull/92744), [@uablrek](https://github.com/uablrek)) [SIG Apps and Network] +- Document that ServiceTopology feature is required to use `service.spec.topologyKeys`. ([#96528](https://github.com/kubernetes/kubernetes/pull/96528), [@andrewsykim](https://github.com/andrewsykim)) [SIG Apps] +- EndpointSlice has a new NodeName field guarded by the EndpointSliceNodeName feature gate. + - EndpointSlice topology field will be deprecated in an upcoming release. + - EndpointSlice "IP" address type is formally removed after being deprecated in Kubernetes 1.17. + - The discovery.k8s.io/v1alpha1 API is deprecated and will be removed in Kubernetes 1.21. ([#96440](https://github.com/kubernetes/kubernetes/pull/96440), [@robscott](https://github.com/robscott)) [SIG API Machinery, Apps and Network] +- Fewer candidates are enumerated for preemption to improve performance in large clusters ([#94814](https://github.com/kubernetes/kubernetes/pull/94814), [@adtac](https://github.com/adtac)) [SIG Scheduling] +- If BoundServiceAccountTokenVolume is enabled, cluster admins can use metric `serviceaccount_stale_tokens_total` to monitor workloads that are depending on the extended tokens. If there are no such workloads, turn off extended tokens by starting `kube-apiserver` with flag `--service-account-extend-token-expiration=false` ([#96273](https://github.com/kubernetes/kubernetes/pull/96273), [@zshihang](https://github.com/zshihang)) [SIG API Machinery and Auth] +- Introduce alpha support for exec-based container registry credential provider plugins in the kubelet. ([#94196](https://github.com/kubernetes/kubernetes/pull/94196), [@andrewsykim](https://github.com/andrewsykim)) [SIG Node and Release] +- Kube-apiserver now deletes expired kube-apiserver Lease objects: + - The feature is under feature gate `APIServerIdentity`. + - A flag is added to kube-apiserver: `identity-lease-garbage-collection-check-period-seconds` ([#95895](https://github.com/kubernetes/kubernetes/pull/95895), [@roycaihw](https://github.com/roycaihw)) [SIG API Machinery, Apps, Auth and Testing] +- Move configurable fsgroup change policy for pods to beta ([#96376](https://github.com/kubernetes/kubernetes/pull/96376), [@gnufied](https://github.com/gnufied)) [SIG Apps and Storage] +- New flag is introduced, i.e. --topology-manager-scope=container|pod. + The default value is the "container" scope. ([#92967](https://github.com/kubernetes/kubernetes/pull/92967), [@cezaryzukowski](https://github.com/cezaryzukowski)) [SIG Instrumentation, Node and Testing] +- NodeAffinity plugin can be configured with AddedAffinity. ([#96202](https://github.com/kubernetes/kubernetes/pull/96202), [@alculquicondor](https://github.com/alculquicondor)) [SIG Node, Scheduling and Testing] +- Promote RuntimeClass feature to GA. + Promote node.k8s.io API groups from v1beta1 to v1. ([#95718](https://github.com/kubernetes/kubernetes/pull/95718), [@SergeyKanzhelev](https://github.com/SergeyKanzhelev)) [SIG Apps, Auth, Node, Scheduling and Testing] +- Reminder: The labels "failure-domain.beta.kubernetes.io/zone" and "failure-domain.beta.kubernetes.io/region" are deprecated in favor of "topology.kubernetes.io/zone" and "topology.kubernetes.io/region" respectively. All users of the "failure-domain.beta..." labels should switch to the "topology..." equivalents. ([#96033](https://github.com/kubernetes/kubernetes/pull/96033), [@thockin](https://github.com/thockin)) [SIG API Machinery, Apps, CLI, Cloud Provider, Network, Node, Scheduling, Storage and Testing] +- The usage of mixed protocol values in the same LoadBalancer Service is possible if the new feature gate MixedProtocolLBSVC is enabled. + "action required" + The feature gate is disabled by default. The user has to enable it for the API Server. ([#94028](https://github.com/kubernetes/kubernetes/pull/94028), [@janosi](https://github.com/janosi)) [SIG API Machinery and Apps] +- This PR will introduce a feature gate CSIServiceAccountToken with two additional fields in `CSIDriverSpec`. ([#93130](https://github.com/kubernetes/kubernetes/pull/93130), [@zshihang](https://github.com/zshihang)) [SIG API Machinery, Apps, Auth, CLI, Network, Node, Storage and Testing] +- Users can try the cronjob controller v2 using the feature gate. This will be the default controller in future releases. ([#93370](https://github.com/kubernetes/kubernetes/pull/93370), [@alaypatel07](https://github.com/alaypatel07)) [SIG API Machinery, Apps, Auth and Testing] +- VolumeSnapshotDataSource moves to GA in 1.20 release ([#95282](https://github.com/kubernetes/kubernetes/pull/95282), [@xing-yang](https://github.com/xing-yang)) [SIG Apps] + +### Feature + +- **Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.**: ([#95896](https://github.com/kubernetes/kubernetes/pull/95896), [@zshihang](https://github.com/zshihang)) [SIG API Machinery and Cluster Lifecycle] +- A new set of alpha metrics are reported by the Kubernetes scheduler under the `/metrics/resources` endpoint that allow administrators to easily see the resource consumption (requests and limits for all resources on the pods) and compare it to actual pod usage or node capacity. ([#94866](https://github.com/kubernetes/kubernetes/pull/94866), [@smarterclayton](https://github.com/smarterclayton)) [SIG API Machinery, Instrumentation, Node and Scheduling] +- Add --experimental-logging-sanitization flag enabling runtime protection from leaking sensitive data in logs ([#96370](https://github.com/kubernetes/kubernetes/pull/96370), [@serathius](https://github.com/serathius)) [SIG API Machinery, Cluster Lifecycle and Instrumentation] +- Add a StorageVersionAPI feature gate that makes API server update storageversions before serving certain write requests. + This feature allows the storage migrator to manage storage migration for built-in resources. + Enabling internal.apiserver.k8s.io/v1alpha1 API and APIServerIdentity feature gate are required to use this feature. ([#93873](https://github.com/kubernetes/kubernetes/pull/93873), [@roycaihw](https://github.com/roycaihw)) [SIG API Machinery, Auth and Testing] +- Add a new `vSphere` metric: `cloudprovider_vsphere_vcenter_versions`. It's content show `vCenter` hostnames with the associated server version. ([#94526](https://github.com/kubernetes/kubernetes/pull/94526), [@Danil-Grigorev](https://github.com/Danil-Grigorev)) [SIG Cloud Provider and Instrumentation] +- Add feature to size memory backed volumes ([#94444](https://github.com/kubernetes/kubernetes/pull/94444), [@derekwaynecarr](https://github.com/derekwaynecarr)) [SIG Storage and Testing] +- Add node_authorizer_actions_duration_seconds metric that can be used to estimate load to node authorizer. ([#92466](https://github.com/kubernetes/kubernetes/pull/92466), [@mborsz](https://github.com/mborsz)) [SIG API Machinery, Auth and Instrumentation] +- Add pod_ based CPU and memory metrics to Kubelet's /metrics/resource endpoint ([#95839](https://github.com/kubernetes/kubernetes/pull/95839), [@egernst](https://github.com/egernst)) [SIG Instrumentation, Node and Testing] +- Adds a headless service on node-local-cache addon. ([#88412](https://github.com/kubernetes/kubernetes/pull/88412), [@stafot](https://github.com/stafot)) [SIG Cloud Provider and Network] +- CRDs: For structural schemas, non-nullable null map fields will now be dropped and defaulted if a default is available. null items in list will continue being preserved, and fail validation if not nullable. ([#95423](https://github.com/kubernetes/kubernetes/pull/95423), [@apelisse](https://github.com/apelisse)) [SIG API Machinery] +- E2e test for PodFsGroupChangePolicy ([#96247](https://github.com/kubernetes/kubernetes/pull/96247), [@saikat-royc](https://github.com/saikat-royc)) [SIG Storage and Testing] +- Gradudate the Pod Resources API to G.A + Introduces the pod_resources_endpoint_requests_total metric which tracks the total number of requests to the pod resources API ([#92165](https://github.com/kubernetes/kubernetes/pull/92165), [@RenaudWasTaken](https://github.com/RenaudWasTaken)) [SIG Instrumentation, Node and Testing] +- Introduce api-extensions category which will return: mutating admission configs, validating admission configs, CRDs and APIServices when used in kubectl get, for example. ([#95603](https://github.com/kubernetes/kubernetes/pull/95603), [@soltysh](https://github.com/soltysh)) [SIG API Machinery] +- Kube-apiserver now maintains a Lease object to identify itself: + - The feature is under feature gate `APIServerIdentity`. + - Two flags are added to kube-apiserver: `identity-lease-duration-seconds`, `identity-lease-renew-interval-seconds` ([#95533](https://github.com/kubernetes/kubernetes/pull/95533), [@roycaihw](https://github.com/roycaihw)) [SIG API Machinery] +- Kube-apiserver: The timeout used when making health check calls to etcd can now be configured with `--etcd-healthcheck-timeout`. The default timeout is 2 seconds, matching the previous behavior. ([#93244](https://github.com/kubernetes/kubernetes/pull/93244), [@Sh4d1](https://github.com/Sh4d1)) [SIG API Machinery] +- Kubectl: Previously users cannot provide arguments to a external diff tool via KUBECTL_EXTERNAL_DIFF env. This release now allow users to specify args to KUBECTL_EXTERNAL_DIFF env. ([#95292](https://github.com/kubernetes/kubernetes/pull/95292), [@dougsland](https://github.com/dougsland)) [SIG CLI] +- Scheduler now ignores Pod update events if the resourceVersion of old and new Pods are identical. ([#96071](https://github.com/kubernetes/kubernetes/pull/96071), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling] +- Support custom tags for cloud provider managed resources ([#96450](https://github.com/kubernetes/kubernetes/pull/96450), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- Support customize load balancer health probe protocol and request path ([#96338](https://github.com/kubernetes/kubernetes/pull/96338), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- Support multiple standard load balancers in one cluster ([#96111](https://github.com/kubernetes/kubernetes/pull/96111), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- The beta `RootCAConfigMap` feature gate is enabled by default and causes kube-controller-manager to publish a "kube-root-ca.crt" ConfigMap to every namespace. This ConfigMap contains a CA bundle used for verifying connections to the kube-apiserver. ([#96197](https://github.com/kubernetes/kubernetes/pull/96197), [@zshihang](https://github.com/zshihang)) [SIG API Machinery, Apps, Auth and Testing] +- The kubelet_runtime_operations_duration_seconds metric got additional buckets of 60, 300, 600, 900 and 1200 seconds ([#96054](https://github.com/kubernetes/kubernetes/pull/96054), [@alvaroaleman](https://github.com/alvaroaleman)) [SIG Instrumentation and Node] +- There is a new pv_collector_total_pv_count metric that counts persistent volumes by the volume plugin name and volume mode. ([#95719](https://github.com/kubernetes/kubernetes/pull/95719), [@tsmetana](https://github.com/tsmetana)) [SIG Apps, Instrumentation, Storage and Testing] +- Volume snapshot e2e test to validate PVC and VolumeSnapshotContent finalizer ([#95863](https://github.com/kubernetes/kubernetes/pull/95863), [@RaunakShah](https://github.com/RaunakShah)) [SIG Cloud Provider, Storage and Testing] +- Warns user when executing kubectl apply/diff to resource currently being deleted. ([#95544](https://github.com/kubernetes/kubernetes/pull/95544), [@SaiHarshaK](https://github.com/SaiHarshaK)) [SIG CLI] +- `kubectl alpha debug` has graduated to beta and is now `kubectl debug`. ([#96138](https://github.com/kubernetes/kubernetes/pull/96138), [@verb](https://github.com/verb)) [SIG CLI and Testing] +- `kubectl debug` gains support for changing container images when copying a pod for debugging, similar to how `kubectl set image` works. See `kubectl help debug` for more information. ([#96058](https://github.com/kubernetes/kubernetes/pull/96058), [@verb](https://github.com/verb)) [SIG CLI] + +### Documentation + +- Updates docs and guidance on cloud provider InstancesV2 and Zones interface for external cloud providers: + - removes experimental warning for InstancesV2 + - document that implementation of InstancesV2 will disable calls to Zones + - deprecate Zones in favor of InstancesV2 ([#96397](https://github.com/kubernetes/kubernetes/pull/96397), [@andrewsykim](https://github.com/andrewsykim)) [SIG Cloud Provider] + +### Bug or Regression + +- Change plugin name in fsgroupapplymetrics of csi and flexvolume to distinguish different driver ([#95892](https://github.com/kubernetes/kubernetes/pull/95892), [@JornShen](https://github.com/JornShen)) [SIG Instrumentation, Storage and Testing] +- Clear UDP conntrack entry on endpoint changes when using nodeport ([#71573](https://github.com/kubernetes/kubernetes/pull/71573), [@JacobTanenbaum](https://github.com/JacobTanenbaum)) [SIG Network] +- Exposes and sets a default timeout for the TokenReview client for DelegatingAuthenticationOptions ([#96217](https://github.com/kubernetes/kubernetes/pull/96217), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery and Cloud Provider] +- Fix CVE-2020-8555 for Quobyte client connections. ([#95206](https://github.com/kubernetes/kubernetes/pull/95206), [@misterikkit](https://github.com/misterikkit)) [SIG Storage] +- Fix IP fragmentation of UDP and TCP packets not supported issues on LoadBalancer rules ([#96464](https://github.com/kubernetes/kubernetes/pull/96464), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- Fix a bug that DefaultPreemption plugin is disabled when using (legacy) scheduler policy. ([#96439](https://github.com/kubernetes/kubernetes/pull/96439), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling and Testing] +- Fix bug in JSON path parser where an error occurs when a range is empty ([#95933](https://github.com/kubernetes/kubernetes/pull/95933), [@brianpursley](https://github.com/brianpursley)) [SIG API Machinery] +- Fix client-go prometheus metrics to correctly present the API path accessed in some environments. ([#74363](https://github.com/kubernetes/kubernetes/pull/74363), [@aanm](https://github.com/aanm)) [SIG API Machinery] +- Fix memory leak in kube-apiserver when underlying time goes forth and back. ([#96266](https://github.com/kubernetes/kubernetes/pull/96266), [@chenyw1990](https://github.com/chenyw1990)) [SIG API Machinery] +- Fix paging issues when Azure API returns empty values with non-empty nextLink ([#96211](https://github.com/kubernetes/kubernetes/pull/96211), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] +- Fix pull image error from multiple ACRs using azure managed identity ([#96355](https://github.com/kubernetes/kubernetes/pull/96355), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fix vSphere volumes that could be erroneously attached to wrong node ([#96224](https://github.com/kubernetes/kubernetes/pull/96224), [@gnufied](https://github.com/gnufied)) [SIG Cloud Provider and Storage] +- Fixed a bug that prevents kubectl to validate CRDs with schema using x-kubernetes-preserve-unknown-fields on object fields. ([#96369](https://github.com/kubernetes/kubernetes/pull/96369), [@gautierdelorme](https://github.com/gautierdelorme)) [SIG API Machinery and Testing] +- For vSphere Cloud Provider, If VM of worker node is deleted, the node will also be deleted by node controller ([#92608](https://github.com/kubernetes/kubernetes/pull/92608), [@lubronzhan](https://github.com/lubronzhan)) [SIG Cloud Provider] +- HTTP/2 connection health check is enabled by default in all Kubernetes clients. The feature should work out-of-the-box. If needed, users can tune the feature via the HTTP2_READ_IDLE_TIMEOUT_SECONDS and HTTP2_PING_TIMEOUT_SECONDS environment variables. The feature is disabled if HTTP2_READ_IDLE_TIMEOUT_SECONDS is set to 0. ([#95981](https://github.com/kubernetes/kubernetes/pull/95981), [@caesarxuchao](https://github.com/caesarxuchao)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Node] +- If the user specifies an invalid timeout in the request URL, the request will be aborted with an HTTP 400. + - If the user specifies a timeout in the request URL that exceeds the maximum request deadline allowed by the apiserver, the request will be aborted with an HTTP 400. ([#96061](https://github.com/kubernetes/kubernetes/pull/96061), [@tkashem](https://github.com/tkashem)) [SIG API Machinery, Network and Testing] +- Improve error messages related to nodePort endpoint changes conntrack entries cleanup. ([#96251](https://github.com/kubernetes/kubernetes/pull/96251), [@ravens](https://github.com/ravens)) [SIG Network] +- Print go stack traces at -v=4 and not -v=2 ([#94663](https://github.com/kubernetes/kubernetes/pull/94663), [@soltysh](https://github.com/soltysh)) [SIG CLI] +- Remove ready file and its directory (which is created during volume SetUp) during emptyDir volume TearDown. ([#95770](https://github.com/kubernetes/kubernetes/pull/95770), [@jingxu97](https://github.com/jingxu97)) [SIG Storage] +- Resolves non-deterministic behavior of the garbage collection controller when ownerReferences with incorrect data are encountered. Events with a reason of `OwnerRefInvalidNamespace` are recorded when namespace mismatches between child and owner objects are detected. + - A namespaced object with an ownerReference referencing a uid of a namespaced kind which does not exist in the same namespace is now consistently treated as though that owner does not exist, and the child object is deleted. + - A cluster-scoped object with an ownerReference referencing a uid of a namespaced kind is now consistently treated as though that owner is not resolvable, and the child object is ignored by the garbage collector. ([#92743](https://github.com/kubernetes/kubernetes/pull/92743), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Apps and Testing] +- Skip [k8s.io/kubernetes@v1.19.0/test/e2e/storage/testsuites/base.go:162]: Driver azure-disk doesn't support snapshot type DynamicSnapshot -- skipping + skip [k8s.io/kubernetes@v1.19.0/test/e2e/storage/testsuites/base.go:185]: Driver azure-disk doesn't support ntfs -- skipping ([#96144](https://github.com/kubernetes/kubernetes/pull/96144), [@qinpingli](https://github.com/qinpingli)) [SIG Storage and Testing] +- The AWS network load balancer attributes can now be specified during service creation ([#95247](https://github.com/kubernetes/kubernetes/pull/95247), [@kishorj](https://github.com/kishorj)) [SIG Cloud Provider] +- The kube-apiserver will no longer serve APIs that should have been deleted in GA non-alpha levels. Alpha levels will continue to serve the removed APIs so that CI doesn't immediately break. ([#96525](https://github.com/kubernetes/kubernetes/pull/96525), [@deads2k](https://github.com/deads2k)) [SIG API Machinery] +- Update max azure data disk count map ([#96308](https://github.com/kubernetes/kubernetes/pull/96308), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] +- Update the route table tag in the route reconcile loop ([#96545](https://github.com/kubernetes/kubernetes/pull/96545), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- Volume binding: report UnschedulableAndUnresolvable status instead of an error when bound PVs not found ([#95541](https://github.com/kubernetes/kubernetes/pull/95541), [@cofyc](https://github.com/cofyc)) [SIG Apps, Scheduling and Storage] +- [kubectl] Fail when local source file doesn't exist ([#90333](https://github.com/kubernetes/kubernetes/pull/90333), [@bamarni](https://github.com/bamarni)) [SIG CLI] + +### Other (Cleanup or Flake) + +- Handle slow cronjob lister in cronjob controller v2 and improve memory footprint. ([#96443](https://github.com/kubernetes/kubernetes/pull/96443), [@alaypatel07](https://github.com/alaypatel07)) [SIG Apps] +- --redirect-container-streaming is no longer functional. The flag will be removed in v1.22 ([#95935](https://github.com/kubernetes/kubernetes/pull/95935), [@tallclair](https://github.com/tallclair)) [SIG Node] +- A new metric `requestAbortsTotal` has been introduced that counts aborted requests for each `group`, `version`, `verb`, `resource`, `subresource` and `scope`. ([#95002](https://github.com/kubernetes/kubernetes/pull/95002), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery, Cloud Provider, Instrumentation and Scheduling] +- API priority and fairness metrics use snake_case in label names ([#96236](https://github.com/kubernetes/kubernetes/pull/96236), [@adtac](https://github.com/adtac)) [SIG API Machinery, Cluster Lifecycle, Instrumentation and Testing] +- Applies translations on all command descriptions ([#95439](https://github.com/kubernetes/kubernetes/pull/95439), [@HerrNaN](https://github.com/HerrNaN)) [SIG CLI] +- Changed: default "Accept-Encoding" header removed from HTTP probes. See https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#http-probes ([#96127](https://github.com/kubernetes/kubernetes/pull/96127), [@fonsecas72](https://github.com/fonsecas72)) [SIG Network and Node] +- Generators for services are removed from kubectl ([#95256](https://github.com/kubernetes/kubernetes/pull/95256), [@Git-Jiro](https://github.com/Git-Jiro)) [SIG CLI] +- Introduce kubectl-convert plugin. ([#96190](https://github.com/kubernetes/kubernetes/pull/96190), [@soltysh](https://github.com/soltysh)) [SIG CLI and Testing] +- Kube-scheduler now logs processed component config at startup ([#96426](https://github.com/kubernetes/kubernetes/pull/96426), [@damemi](https://github.com/damemi)) [SIG Scheduling] +- NONE ([#96179](https://github.com/kubernetes/kubernetes/pull/96179), [@bbyrne5](https://github.com/bbyrne5)) [SIG Network] +- Users will now be able to configure all supported values for AWS NLB health check interval and thresholds for new resources. ([#96312](https://github.com/kubernetes/kubernetes/pull/96312), [@kishorj](https://github.com/kishorj)) [SIG Cloud Provider] + +## Dependencies + +### Added +- cloud.google.com/go/firestore: v1.1.0 +- github.com/armon/go-metrics: [f0300d1](https://github.com/armon/go-metrics/tree/f0300d1) +- github.com/armon/go-radix: [7fddfc3](https://github.com/armon/go-radix/tree/7fddfc3) +- github.com/bketelsen/crypt: [5cbc8cc](https://github.com/bketelsen/crypt/tree/5cbc8cc) +- github.com/hashicorp/consul/api: [v1.1.0](https://github.com/hashicorp/consul/api/tree/v1.1.0) +- github.com/hashicorp/consul/sdk: [v0.1.1](https://github.com/hashicorp/consul/sdk/tree/v0.1.1) +- github.com/hashicorp/errwrap: [v1.0.0](https://github.com/hashicorp/errwrap/tree/v1.0.0) +- github.com/hashicorp/go-cleanhttp: [v0.5.1](https://github.com/hashicorp/go-cleanhttp/tree/v0.5.1) +- github.com/hashicorp/go-immutable-radix: [v1.0.0](https://github.com/hashicorp/go-immutable-radix/tree/v1.0.0) +- github.com/hashicorp/go-msgpack: [v0.5.3](https://github.com/hashicorp/go-msgpack/tree/v0.5.3) +- github.com/hashicorp/go-multierror: [v1.0.0](https://github.com/hashicorp/go-multierror/tree/v1.0.0) +- github.com/hashicorp/go-rootcerts: [v1.0.0](https://github.com/hashicorp/go-rootcerts/tree/v1.0.0) +- github.com/hashicorp/go-sockaddr: [v1.0.0](https://github.com/hashicorp/go-sockaddr/tree/v1.0.0) +- github.com/hashicorp/go-uuid: [v1.0.1](https://github.com/hashicorp/go-uuid/tree/v1.0.1) +- github.com/hashicorp/go.net: [v0.0.1](https://github.com/hashicorp/go.net/tree/v0.0.1) +- github.com/hashicorp/logutils: [v1.0.0](https://github.com/hashicorp/logutils/tree/v1.0.0) +- github.com/hashicorp/mdns: [v1.0.0](https://github.com/hashicorp/mdns/tree/v1.0.0) +- github.com/hashicorp/memberlist: [v0.1.3](https://github.com/hashicorp/memberlist/tree/v0.1.3) +- github.com/hashicorp/serf: [v0.8.2](https://github.com/hashicorp/serf/tree/v0.8.2) +- github.com/mitchellh/cli: [v1.0.0](https://github.com/mitchellh/cli/tree/v1.0.0) +- github.com/mitchellh/go-testing-interface: [v1.0.0](https://github.com/mitchellh/go-testing-interface/tree/v1.0.0) +- github.com/mitchellh/gox: [v0.4.0](https://github.com/mitchellh/gox/tree/v0.4.0) +- github.com/mitchellh/iochan: [v1.0.0](https://github.com/mitchellh/iochan/tree/v1.0.0) +- github.com/pascaldekloe/goe: [57f6aae](https://github.com/pascaldekloe/goe/tree/57f6aae) +- github.com/posener/complete: [v1.1.1](https://github.com/posener/complete/tree/v1.1.1) +- github.com/ryanuber/columnize: [9b3edd6](https://github.com/ryanuber/columnize/tree/9b3edd6) +- github.com/sean-/seed: [e2103e2](https://github.com/sean-/seed/tree/e2103e2) +- github.com/subosito/gotenv: [v1.2.0](https://github.com/subosito/gotenv/tree/v1.2.0) +- github.com/willf/bitset: [d5bec33](https://github.com/willf/bitset/tree/d5bec33) +- gopkg.in/ini.v1: v1.51.0 +- gopkg.in/yaml.v3: 9f266ea +- rsc.io/quote/v3: v3.1.0 +- rsc.io/sampler: v1.3.0 + +### Changed +- cloud.google.com/go/bigquery: v1.0.1 → v1.4.0 +- cloud.google.com/go/datastore: v1.0.0 → v1.1.0 +- cloud.google.com/go/pubsub: v1.0.1 → v1.2.0 +- cloud.google.com/go/storage: v1.0.0 → v1.6.0 +- cloud.google.com/go: v0.51.0 → v0.54.0 +- github.com/Microsoft/go-winio: [fc70bd9 → v0.4.15](https://github.com/Microsoft/go-winio/compare/fc70bd9...v0.4.15) +- github.com/aws/aws-sdk-go: [v1.35.5 → v1.35.24](https://github.com/aws/aws-sdk-go/compare/v1.35.5...v1.35.24) +- github.com/blang/semver: [v3.5.0+incompatible → v3.5.1+incompatible](https://github.com/blang/semver/compare/v3.5.0...v3.5.1) +- github.com/checkpoint-restore/go-criu/v4: [v4.0.2 → v4.1.0](https://github.com/checkpoint-restore/go-criu/v4/compare/v4.0.2...v4.1.0) +- github.com/containerd/containerd: [v1.3.3 → v1.4.1](https://github.com/containerd/containerd/compare/v1.3.3...v1.4.1) +- github.com/containerd/ttrpc: [v1.0.0 → v1.0.2](https://github.com/containerd/ttrpc/compare/v1.0.0...v1.0.2) +- github.com/containerd/typeurl: [v1.0.0 → v1.0.1](https://github.com/containerd/typeurl/compare/v1.0.0...v1.0.1) +- github.com/coreos/etcd: [v3.3.10+incompatible → v3.3.13+incompatible](https://github.com/coreos/etcd/compare/v3.3.10...v3.3.13) +- github.com/docker/docker: [aa6a989 → bd33bbf](https://github.com/docker/docker/compare/aa6a989...bd33bbf) +- github.com/go-gl/glfw/v3.3/glfw: [12ad95a → 6f7a984](https://github.com/go-gl/glfw/v3.3/glfw/compare/12ad95a...6f7a984) +- github.com/golang/groupcache: [215e871 → 8c9f03a](https://github.com/golang/groupcache/compare/215e871...8c9f03a) +- github.com/golang/mock: [v1.3.1 → v1.4.1](https://github.com/golang/mock/compare/v1.3.1...v1.4.1) +- github.com/golang/protobuf: [v1.4.2 → v1.4.3](https://github.com/golang/protobuf/compare/v1.4.2...v1.4.3) +- github.com/google/cadvisor: [v0.37.0 → v0.38.4](https://github.com/google/cadvisor/compare/v0.37.0...v0.38.4) +- github.com/google/go-cmp: [v0.4.0 → v0.5.2](https://github.com/google/go-cmp/compare/v0.4.0...v0.5.2) +- github.com/google/pprof: [d4f498a → 1ebb73c](https://github.com/google/pprof/compare/d4f498a...1ebb73c) +- github.com/google/uuid: [v1.1.1 → v1.1.2](https://github.com/google/uuid/compare/v1.1.1...v1.1.2) +- github.com/gorilla/mux: [v1.7.3 → v1.8.0](https://github.com/gorilla/mux/compare/v1.7.3...v1.8.0) +- github.com/gorilla/websocket: [v1.4.0 → v1.4.2](https://github.com/gorilla/websocket/compare/v1.4.0...v1.4.2) +- github.com/karrick/godirwalk: [v1.7.5 → v1.16.1](https://github.com/karrick/godirwalk/compare/v1.7.5...v1.16.1) +- github.com/opencontainers/runc: [819fcc6 → v1.0.0-rc92](https://github.com/opencontainers/runc/compare/819fcc6...v1.0.0-rc92) +- github.com/opencontainers/runtime-spec: [237cc4f → 4d89ac9](https://github.com/opencontainers/runtime-spec/compare/237cc4f...4d89ac9) +- github.com/opencontainers/selinux: [v1.5.2 → v1.6.0](https://github.com/opencontainers/selinux/compare/v1.5.2...v1.6.0) +- github.com/prometheus/procfs: [v0.1.3 → v0.2.0](https://github.com/prometheus/procfs/compare/v0.1.3...v0.2.0) +- github.com/quobyte/api: [v0.1.2 → v0.1.8](https://github.com/quobyte/api/compare/v0.1.2...v0.1.8) +- github.com/spf13/cobra: [v1.0.0 → v1.1.1](https://github.com/spf13/cobra/compare/v1.0.0...v1.1.1) +- github.com/spf13/viper: [v1.4.0 → v1.7.0](https://github.com/spf13/viper/compare/v1.4.0...v1.7.0) +- github.com/stretchr/testify: [v1.4.0 → v1.6.1](https://github.com/stretchr/testify/compare/v1.4.0...v1.6.1) +- github.com/vishvananda/netns: [52d707b → db3c7e5](https://github.com/vishvananda/netns/compare/52d707b...db3c7e5) +- go.opencensus.io: v0.22.2 → v0.22.3 +- golang.org/x/exp: da58074 → 6cc2880 +- golang.org/x/lint: fdd1cda → 738671d +- golang.org/x/net: ab34263 → 69a7880 +- golang.org/x/oauth2: 858c2ad → bf48bf1 +- golang.org/x/sys: ed371f2 → 5cba982 +- golang.org/x/text: v0.3.3 → v0.3.4 +- golang.org/x/time: 555d28b → 3af7569 +- golang.org/x/xerrors: 9bdfabe → 5ec99f8 +- google.golang.org/api: v0.15.1 → v0.20.0 +- google.golang.org/genproto: cb27e3a → 8816d57 +- google.golang.org/grpc: v1.27.0 → v1.27.1 +- google.golang.org/protobuf: v1.24.0 → v1.25.0 +- honnef.co/go/tools: v0.0.1-2019.2.3 → v0.0.1-2020.1.3 +- k8s.io/gengo: 8167cfd → 83324d8 +- k8s.io/klog/v2: v2.2.0 → v2.4.0 +- k8s.io/kube-openapi: 8b50664 → d219536 +- k8s.io/utils: d5654de → 67b214c +- sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.0.12 → v0.0.14 +- sigs.k8s.io/structured-merge-diff/v4: b3cf1e8 → v4.0.2 + +### Removed +- github.com/armon/consul-api: [eb2c6b5](https://github.com/armon/consul-api/tree/eb2c6b5) +- github.com/go-ini/ini: [v1.9.0](https://github.com/go-ini/ini/tree/v1.9.0) +- github.com/ugorji/go: [v1.1.4](https://github.com/ugorji/go/tree/v1.1.4) +- github.com/xordataexchange/crypt: [b2862e3](https://github.com/xordataexchange/crypt/tree/b2862e3) + + + +# v1.20.0-beta.1 + + +## Downloads for v1.20.0-beta.1 + +### Source Code + +filename | sha512 hash +-------- | ----------- +[kubernetes.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes.tar.gz) | 4eddf4850c2d57751696f352d0667309339090aeb30ff93e8db8a22c6cdebf74cb2d5dc78d4ae384c4e25491efc39413e2e420a804b76b421a9ad934e56b0667 +[kubernetes-src.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-src.tar.gz) | 59de5221162e9b6d88f5abbdb99765cb2b2e501498ea853fb65f2abe390211e28d9f21e0d87be3ade550a5ea6395d04552cf093d2ce2f99fd45ad46545dd13cb + +### Client binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-client-darwin-amd64.tar.gz) | d69ffed19b034a4221fc084e43ac293cf392e98febf5bf580f8d92307a8421d8b3aab18f9ca70608937e836b42c7a34e829f88eba6e040218a4486986e2fca21 +[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-client-linux-386.tar.gz) | 1b542e165860c4adcd4550adc19b86c3db8cd75d2a1b8db17becc752da78b730ee48f1b0aaf8068d7bfbb1d8e023741ec293543bc3dd0f4037172a6917db8169 +[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-client-linux-amd64.tar.gz) | 90ad52785eecb43a6f9035b92b6ba39fc84e67f8bc91cf098e70f8cfdd405c4b9d5c02dccb21022f21bb5b6ce92fdef304def1da0a7255c308e2c5fb3a9cdaab +[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-client-linux-arm.tar.gz) | d0cb3322b056e1821679afa70728ffc0d3375e8f3326dabbe8185be2e60f665ab8985b13a1a432e10281b84a929e0f036960253ac0dd6e0b44677d539e98e61b +[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-client-linux-arm64.tar.gz) | 3aecc8197e0aa368408624add28a2dd5e73f0d8a48e5e33c19edf91d5323071d16a27353a6f3e22df4f66ed7bfbae8e56e0a9050f7bbdf927ce6aeb29bba6374 +[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-client-linux-ppc64le.tar.gz) | 6ff145058f62d478b98f1e418e272555bfb5c7861834fbbf10a8fb334cc7ff09b32f2666a54b230932ba71d2fc7d3b1c1f5e99e6fe6d6ec83926a9b931cd2474 +[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-client-linux-s390x.tar.gz) | ff7b8bb894076e05a3524f6327a4a6353b990466f3292e84c92826cb64b5c82b3855f48b8e297ccadc8bcc15552bc056419ff6ff8725fc4e640828af9cc1331b +[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-client-windows-386.tar.gz) | 6c6dcac9c725605763a130b5a975f2b560aa976a5c809d4e0887900701b707baccb9ca1aebc10a03cfa7338a6f42922bbf838ccf6800fc2a3e231686a72568b6 +[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-client-windows-amd64.tar.gz) | d12e3a29c960f0ddd1b9aabf5426ac1259863ac6c8f2be1736ebeb57ddca6b1c747ee2c363be19e059e38cf71488c5ea3509ad4d0e67fd5087282a5ad0ae9a48 + +### Server binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-server-linux-amd64.tar.gz) | 904e8c049179e071c6caa65f525f465260bb4d4318a6dd9cc05be2172f39f7cfc69d1672736e01d926045764fe8872e806444e3af77ffef823ede769537b7d20 +[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-server-linux-arm.tar.gz) | 5934959374868aed8d4294de84411972660bca7b2e952201a9403f37e40c60a5c53eaea8001344d0bf4a00c8cd27de6324d88161388de27f263a5761357cb82b +[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-server-linux-arm64.tar.gz) | 4c884585970f80dc5462d9a734d7d5be9558b36c6e326a8a3139423efbd7284fa9f53fb077983647e17e19f03f5cb9bf26201450c78daecf10afa5a1ab5f9efc +[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-server-linux-ppc64le.tar.gz) | 235b78b08440350dcb9f13b63f7722bd090c672d8e724ca5d409256e5a5d4f46d431652a1aa908c3affc5b1e162318471de443d38b93286113e79e7f90501a9b +[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-server-linux-s390x.tar.gz) | 220fc9351702b3ecdcf79089892ceb26753a8a1deaf46922ffb3d3b62b999c93fef89440e779ca6043372b963081891b3a966d1a5df0cf261bdd44395fd28dce + +### Node binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-node-linux-amd64.tar.gz) | fe59d3a1f21c47bab126f689687657f77fbcb46a2caeef48eecd073b2b22879f997a466911b5c5c829e9cf27e68a36ecdf18686d42714839d4b97d6c7281578d +[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-node-linux-arm.tar.gz) | 93e545aa963cfd11e0b2c6d47669b5ef70c5a86ef80c3353c1a074396bff1e8e7371dda25c39d78c7a9e761f2607b8b5ab843fa0c10b8ff9663098fae8d25725 +[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-node-linux-arm64.tar.gz) | 5e0f177f9bec406a668d4b37e69b191208551fdf289c82b5ec898959da4f8a00a2b0695cbf1d2de5acb809321c6e5604f5483d33556543d92b96dcf80e814dd3 +[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-node-linux-ppc64le.tar.gz) | 574412059e4d257eb904cd4892a075b6a2cde27adfa4976ee64c46d6768facece338475f1b652ad94c8df7cfcbb70ebdf0113be109c7099ab76ffdb6f023eefd +[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-node-linux-s390x.tar.gz) | b1ffaa6d7f77d89885c642663cb14a86f3e2ec2afd223e3bb2000962758cf0f15320969ffc4be93b5826ff22d54fdbae0dbea09f9d8228eda6da50b6fdc88758 +[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.1/kubernetes-node-windows-amd64.tar.gz) | 388983765213cf3bdc1f8b27103ed79e39028767e5f1571e35ed1f91ed100e49f3027f7b7ff19b53fab7fbb6d723c0439f21fc6ed62be64532c25f5bfa7ee265 + +## Changelog since v1.20.0-beta.0 + +## Changes by Kind + +### Deprecation + +- ACTION REQUIRED: The kube-apiserver ability to serve on an insecure port, deprecated since v1.10, has been removed. The insecure address flags `--address` and `--insecure-bind-address` have no effect in kube-apiserver and will be removed in v1.24. The insecure port flags `--port` and `--insecure-port` may only be set to 0 and will be removed in v1.24. ([#95856](https://github.com/kubernetes/kubernetes/pull/95856), [@knight42](https://github.com/knight42)) [SIG API Machinery, Node and Testing] + +### API Change + +- + `TokenRequest` and `TokenRequestProjection` features have been promoted to GA. This feature allows generating service account tokens that are not visible in Secret objects and are tied to the lifetime of a Pod object. See https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection for details on configuring and using this feature. The `TokenRequest` and `TokenRequestProjection` feature gates will be removed in v1.21. + + kubeadm's kube-apiserver Pod manifest now includes the following flags by default "--service-account-key-file", "--service-account-signing-key-file", "--service-account-issuer". ([#93258](https://github.com/kubernetes/kubernetes/pull/93258), [@zshihang](https://github.com/zshihang)) [SIG API Machinery, Auth, Cluster Lifecycle, Storage and Testing] +- Certain fields on Service objects will be automatically cleared when changing the service's `type` to a mode that does not need those fields. For example, changing from type=LoadBalancer to type=ClusterIP will clear the NodePort assignments, rather than forcing the user to clear them. ([#95196](https://github.com/kubernetes/kubernetes/pull/95196), [@thockin](https://github.com/thockin)) [SIG API Machinery, Apps, Network and Testing] +- Services will now have a `clusterIPs` field to go with `clusterIP`. `clusterIPs[0]` is a synonym for `clusterIP` and will be syncronized on create and update operations. ([#95894](https://github.com/kubernetes/kubernetes/pull/95894), [@thockin](https://github.com/thockin)) [SIG Network] + +### Feature + +- A new metric `apiserver_request_filter_duration_seconds` has been introduced that + measures request filter latency in seconds. ([#95207](https://github.com/kubernetes/kubernetes/pull/95207), [@tkashem](https://github.com/tkashem)) [SIG API Machinery and Instrumentation] +- Add a new flag to set priority for the kubelet on Windows nodes so that workloads cannot overwhelm the node there by disrupting kubelet process. ([#96051](https://github.com/kubernetes/kubernetes/pull/96051), [@ravisantoshgudimetla](https://github.com/ravisantoshgudimetla)) [SIG Node and Windows] +- Changed: default "Accept: */*" header added to HTTP probes. See https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#http-probes (https://github.com/kubernetes/website/pull/24756) ([#95641](https://github.com/kubernetes/kubernetes/pull/95641), [@fonsecas72](https://github.com/fonsecas72)) [SIG Network and Node] +- Client-go credential plugins can now be passed in the current cluster information via the KUBERNETES_EXEC_INFO environment variable. ([#95489](https://github.com/kubernetes/kubernetes/pull/95489), [@ankeesler](https://github.com/ankeesler)) [SIG API Machinery and Auth] +- Kube-apiserver: added support for compressing rotated audit log files with `--audit-log-compress` ([#94066](https://github.com/kubernetes/kubernetes/pull/94066), [@lojies](https://github.com/lojies)) [SIG API Machinery and Auth] + +### Documentation + +- Fake dynamic client: document that List does not preserve TypeMeta in UnstructuredList ([#95117](https://github.com/kubernetes/kubernetes/pull/95117), [@andrewsykim](https://github.com/andrewsykim)) [SIG API Machinery] + +### Bug or Regression + +- Added support to kube-proxy for externalTrafficPolicy=Local setting via Direct Server Return (DSR) load balancers on Windows. ([#93166](https://github.com/kubernetes/kubernetes/pull/93166), [@elweb9858](https://github.com/elweb9858)) [SIG Network] +- Disable watchcache for events ([#96052](https://github.com/kubernetes/kubernetes/pull/96052), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery] +- Disabled `LocalStorageCapacityIsolation` feature gate is honored during scheduling. ([#96092](https://github.com/kubernetes/kubernetes/pull/96092), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling] +- Fix bug in JSON path parser where an error occurs when a range is empty ([#95933](https://github.com/kubernetes/kubernetes/pull/95933), [@brianpursley](https://github.com/brianpursley)) [SIG API Machinery] +- Fix k8s.io/apimachinery/pkg/api/meta.SetStatusCondition to update ObservedGeneration ([#95961](https://github.com/kubernetes/kubernetes/pull/95961), [@KnicKnic](https://github.com/KnicKnic)) [SIG API Machinery] +- Fixed a regression which prevented pods with `docker/default` seccomp annotations from being created in 1.19 if a PodSecurityPolicy was in place which did not allow `runtime/default` seccomp profiles. ([#95985](https://github.com/kubernetes/kubernetes/pull/95985), [@saschagrunert](https://github.com/saschagrunert)) [SIG Auth] +- Kubectl: print error if users place flags before plugin name ([#92343](https://github.com/kubernetes/kubernetes/pull/92343), [@knight42](https://github.com/knight42)) [SIG CLI] +- When creating a PVC with the volume.beta.kubernetes.io/storage-provisioner annotation already set, the PV controller might have incorrectly deleted the newly provisioned PV instead of binding it to the PVC, depending on timing and system load. ([#95909](https://github.com/kubernetes/kubernetes/pull/95909), [@pohly](https://github.com/pohly)) [SIG Apps and Storage] + +### Other (Cleanup or Flake) + +- Kubectl: the `generator` flag of `kubectl autoscale` has been deprecated and has no effect, it will be removed in a feature release ([#92998](https://github.com/kubernetes/kubernetes/pull/92998), [@SataQiu](https://github.com/SataQiu)) [SIG CLI] +- V1helpers.MatchNodeSelectorTerms now accepts just a Node and a list of Terms ([#95871](https://github.com/kubernetes/kubernetes/pull/95871), [@damemi](https://github.com/damemi)) [SIG Apps, Scheduling and Storage] +- `MatchNodeSelectorTerms` function moved to `k8s.io/component-helpers` ([#95531](https://github.com/kubernetes/kubernetes/pull/95531), [@damemi](https://github.com/damemi)) [SIG Apps, Scheduling and Storage] + +## Dependencies + +### Added +_Nothing has changed._ + +### Changed +_Nothing has changed._ + +### Removed +_Nothing has changed._ + + + +# v1.20.0-beta.0 + + +## Downloads for v1.20.0-beta.0 + +### Source Code + +filename | sha512 hash +-------- | ----------- +[kubernetes.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes.tar.gz) | 385e49e32bbd6996f07bcadbf42285755b8a8ef9826ee1ba42bd82c65827cf13f63e5634b834451b263a93b708299cbb4b4b0b8ddbc688433deaf6bec240aa67 +[kubernetes-src.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-src.tar.gz) | 842e80f6dcad461426fb699de8a55fde8621d76a94e54288fe9939cc1a3bbd0f4799abadac2c59bcf3f91d743726dbd17e1755312ae7fec482ef560f336dbcbb + +### Client binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-client-darwin-amd64.tar.gz) | bde5e7d9ee3e79d1e69465a3ddb4bb36819a4f281b5c01a7976816d7c784410812dde133cdf941c47e5434e9520701b9c5e8b94d61dca77c172f87488dfaeb26 +[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-client-linux-386.tar.gz) | 721bb8444c9e0d7a9f8461e3f5428882d76fcb3def6eb11b8e8e08fae7f7383630699248660d69d4f6a774124d6437888666e1fa81298d5b5518bc4a6a6b2c92 +[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-client-linux-amd64.tar.gz) | 71e4edc41afbd65f813e7ecbc22b27c95f248446f005e288d758138dc4cc708735be7218af51bcf15e8b9893a3598c45d6a685f605b46f50af3762b02c32ed76 +[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-client-linux-arm.tar.gz) | bbefc749156f63898973f2f7c7a6f1467481329fb430d641fe659b497e64d679886482d557ebdddb95932b93de8d1e3e365c91d4bf9f110b68bd94b0ba702ded +[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-client-linux-arm64.tar.gz) | 9803190685058b4b64d002c2fbfb313308bcea4734ed53a8c340cfdae4894d8cb13b3e819ae64051bafe0fbf8b6ecab53a6c1dcf661c57640c75b0eb60041113 +[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-client-linux-ppc64le.tar.gz) | bcdceea64cba1ae38ea2bab50d8fd77c53f6d673de12566050b0e3c204334610e6c19e4ace763e68b5e48ab9e811521208b852b1741627be30a2b17324fc1daf +[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-client-linux-s390x.tar.gz) | 41e36d00867e90012d5d5adfabfaae8d9f5a9fd32f290811e3c368e11822916b973afaaf43961081197f2cbab234090d97d89774e674aeadc1da61f7a64708a9 +[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-client-windows-386.tar.gz) | c50fec5aec2d0e742f851f25c236cb73e76f8fc73b0908049a10ae736c0205b8fff83eb3d29b1748412edd942da00dd738195d9003f25b577d6af8359d84fb2f +[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-client-windows-amd64.tar.gz) | 0fd6777c349908b6d627e849ea2d34c048b8de41f7df8a19898623f597e6debd35b7bcbf8e1d43a1be3a9abb45e4810bc498a0963cf780b109e93211659e9c7e + +### Server binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-server-linux-amd64.tar.gz) | 30d982424ca64bf0923503ae8195b2e2a59497096b2d9e58dfd491cd6639633027acfa9750bc7bccf34e1dc116d29d2f87cbd7ae713db4210ce9ac16182f0576 +[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-server-linux-arm.tar.gz) | f08b62be9bc6f0745f820b0083c7a31eedb2ce370a037c768459a59192107b944c8f4345d0bb88fc975f2e7a803ac692c9ac3e16d4a659249d4600e84ff75d9e +[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-server-linux-arm64.tar.gz) | e3472b5b3dfae0a56e5363d52062b1e4a9fc227a05e0cf5ece38233b2c442f427970aab94a52377fb87e583663c120760d154bc1c4ac22dca1f4d0d1ebb96088 +[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-server-linux-ppc64le.tar.gz) | 06c254e0a62f755d31bc40093d86c44974f0a60308716cc3214a6b3c249a4d74534d909b82f8a3dd3a3c9720e61465b45d2bb3a327ef85d3caba865750020dfb +[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-server-linux-s390x.tar.gz) | 2edeb4411c26a0de057a66787091ab1044f71774a464aed898ffee26634a40127181c2edddb38e786b6757cca878fd0c3a885880eec6c3448b93c645770abb12 + +### Node binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-node-linux-amd64.tar.gz) | cc1d5b94b86070b5e7746d7aaeaeac3b3a5e5ebbff1ec33885f7eeab270a6177d593cb1975b2e56f4430b7859ad42da76f266629f9313e0f688571691ac448ed +[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-node-linux-arm.tar.gz) | 75e82c7c9122add3b24695b94dcb0723c52420c3956abf47511e37785aa48a1fa8257db090c6601010c4475a325ccfff13eb3352b65e3aa1774f104b09b766b0 +[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-node-linux-arm64.tar.gz) | 16ef27c40bf4d678a55fcd3d3f7d09f1597eec2cc58f9950946f0901e52b82287be397ad7f65e8d162d8a9cdb4a34a610b6db8b5d0462be8e27c4b6eb5d6e5e7 +[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-node-linux-ppc64le.tar.gz) | 939865f2c4cb6a8934f22a06223e416dec5f768ffc1010314586149470420a1d62aef97527c34d8a636621c9669d6489908ce1caf96f109e8d073cee1c030b50 +[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-node-linux-s390x.tar.gz) | bbfdd844075fb816079af7b73d99bc1a78f41717cdbadb043f6f5872b4dc47bc619f7f95e2680d4b516146db492c630c17424e36879edb45e40c91bc2ae4493c +[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-beta.0/kubernetes-node-windows-amd64.tar.gz) | a2b3ea40086fd71aed71a4858fd3fc79fd1907bc9ea8048ff3c82ec56477b0a791b724e5a52d79b3b36338c7fbd93dfd3d03b00ccea9042bda0d270fc891e4ec + +## Changelog since v1.20.0-alpha.3 + +## Urgent Upgrade Notes + +### (No, really, you MUST read this before you upgrade) + + - Kubeadm: improve the validation of serviceSubnet and podSubnet. + ServiceSubnet has to be limited in size, due to implementation details, and the mask can not allocate more than 20 bits. + PodSubnet validates against the corresponding cluster "--node-cidr-mask-size" of the kube-controller-manager, it fail if the values are not compatible. + kubeadm no longer sets the node-mask automatically on IPv6 deployments, you must check that your IPv6 service subnet mask is compatible with the default node mask /64 or set it accordenly. + Previously, for IPv6, if the podSubnet had a mask lower than /112, kubeadm calculated a node-mask to be multiple of eight and splitting the available bits to maximise the number used for nodes. ([#95723](https://github.com/kubernetes/kubernetes/pull/95723), [@aojea](https://github.com/aojea)) [SIG Cluster Lifecycle] + - Windows hyper-v container featuregate is deprecated in 1.20 and will be removed in 1.21 ([#95505](https://github.com/kubernetes/kubernetes/pull/95505), [@wawa0210](https://github.com/wawa0210)) [SIG Node and Windows] + +## Changes by Kind + +### Deprecation + +- Support 'controlplane' as a valid EgressSelection type in the EgressSelectorConfiguration API. 'Master' is deprecated and will be removed in v1.22. ([#95235](https://github.com/kubernetes/kubernetes/pull/95235), [@andrewsykim](https://github.com/andrewsykim)) [SIG API Machinery] + +### API Change + +- Add dual-stack Services (alpha). This is a BREAKING CHANGE to an alpha API. + It changes the dual-stack API wrt Service from a single ipFamily field to 3 + fields: ipFamilyPolicy (SingleStack, PreferDualStack, RequireDualStack), + ipFamilies (a list of families assigned), and clusterIPs (inclusive of + clusterIP). Most users do not need to set anything at all, defaulting will + handle it for them. Services are single-stack unless the user asks for + dual-stack. This is all gated by the "IPv6DualStack" feature gate. ([#91824](https://github.com/kubernetes/kubernetes/pull/91824), [@khenidak](https://github.com/khenidak)) [SIG API Machinery, Apps, CLI, Network, Node, Scheduling and Testing] +- Introduces a metric source for HPAs which allows scaling based on container resource usage. ([#90691](https://github.com/kubernetes/kubernetes/pull/90691), [@arjunrn](https://github.com/arjunrn)) [SIG API Machinery, Apps, Autoscaling and CLI] + +### Feature + +- Add a metric for time taken to perform recursive permission change ([#95866](https://github.com/kubernetes/kubernetes/pull/95866), [@JornShen](https://github.com/JornShen)) [SIG Instrumentation and Storage] +- Allow cross compilation of kubernetes on different platforms. ([#94403](https://github.com/kubernetes/kubernetes/pull/94403), [@bnrjee](https://github.com/bnrjee)) [SIG Release] +- Command to start network proxy changes from 'KUBE_ENABLE_EGRESS_VIA_KONNECTIVITY_SERVICE ./cluster/kube-up.sh' to 'KUBE_ENABLE_KONNECTIVITY_SERVICE=true ./hack/kube-up.sh' ([#92669](https://github.com/kubernetes/kubernetes/pull/92669), [@Jefftree](https://github.com/Jefftree)) [SIG Cloud Provider] +- DefaultPodTopologySpread graduated to Beta. The feature gate is enabled by default. ([#95631](https://github.com/kubernetes/kubernetes/pull/95631), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling and Testing] +- Kubernetes E2E test image manifest lists now contain Windows images. ([#77398](https://github.com/kubernetes/kubernetes/pull/77398), [@claudiubelu](https://github.com/claudiubelu)) [SIG Testing and Windows] +- Support for Windows container images (OS Versions: 1809, 1903, 1909, 2004) was added the pause:3.4 image. ([#91452](https://github.com/kubernetes/kubernetes/pull/91452), [@claudiubelu](https://github.com/claudiubelu)) [SIG Node, Release and Windows] + +### Documentation + +- Fake dynamic client: document that List does not preserve TypeMeta in UnstructuredList ([#95117](https://github.com/kubernetes/kubernetes/pull/95117), [@andrewsykim](https://github.com/andrewsykim)) [SIG API Machinery] + +### Bug or Regression + +- Exposes and sets a default timeout for the SubjectAccessReview client for DelegatingAuthorizationOptions. ([#95725](https://github.com/kubernetes/kubernetes/pull/95725), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery and Cloud Provider] +- Alter wording to describe pods using a pvc ([#95635](https://github.com/kubernetes/kubernetes/pull/95635), [@RaunakShah](https://github.com/RaunakShah)) [SIG CLI] +- If we set SelectPolicy MinPolicySelect on scaleUp behavior or scaleDown behavior,Horizontal Pod Autoscaler doesn`t automatically scale the number of pods correctly ([#95647](https://github.com/kubernetes/kubernetes/pull/95647), [@JoshuaAndrew](https://github.com/JoshuaAndrew)) [SIG Apps and Autoscaling] +- Ignore apparmor for non-linux operating systems ([#93220](https://github.com/kubernetes/kubernetes/pull/93220), [@wawa0210](https://github.com/wawa0210)) [SIG Node and Windows] +- Ipvs: ensure selected scheduler kernel modules are loaded ([#93040](https://github.com/kubernetes/kubernetes/pull/93040), [@cmluciano](https://github.com/cmluciano)) [SIG Network] +- Kubeadm: add missing "--experimental-patches" flag to "kubeadm init phase control-plane" ([#95786](https://github.com/kubernetes/kubernetes/pull/95786), [@Sh4d1](https://github.com/Sh4d1)) [SIG Cluster Lifecycle] +- Reorganized iptables rules to fix a performance issue ([#95252](https://github.com/kubernetes/kubernetes/pull/95252), [@tssurya](https://github.com/tssurya)) [SIG Network] +- Unhealthy pods covered by PDBs can be successfully evicted if enough healthy pods are available. ([#94381](https://github.com/kubernetes/kubernetes/pull/94381), [@michaelgugino](https://github.com/michaelgugino)) [SIG Apps] +- Update the PIP when it is not in the Succeeded provisioning state during the LB update. ([#95748](https://github.com/kubernetes/kubernetes/pull/95748), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- Update the frontend IP config when the service's `pipName` annotation is changed ([#95813](https://github.com/kubernetes/kubernetes/pull/95813), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] + +### Other (Cleanup or Flake) + +- NO ([#95690](https://github.com/kubernetes/kubernetes/pull/95690), [@nikhita](https://github.com/nikhita)) [SIG Release] + +## Dependencies + +### Added +- github.com/form3tech-oss/jwt-go: [v3.2.2+incompatible](https://github.com/form3tech-oss/jwt-go/tree/v3.2.2) + +### Changed +- github.com/Azure/go-autorest/autorest/adal: [v0.9.0 → v0.9.5](https://github.com/Azure/go-autorest/autorest/adal/compare/v0.9.0...v0.9.5) +- github.com/Azure/go-autorest/autorest/mocks: [v0.4.0 → v0.4.1](https://github.com/Azure/go-autorest/autorest/mocks/compare/v0.4.0...v0.4.1) +- golang.org/x/crypto: 75b2880 → 7f63de1 + +### Removed +_Nothing has changed._ + + + +# v1.20.0-alpha.3 + + +## Downloads for v1.20.0-alpha.3 + +### Source Code + +filename | sha512 hash +-------- | ----------- +[kubernetes.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes.tar.gz) | 542cc9e0cd97732020491456402b6e2b4f54f2714007ee1374a7d363663a1b41e82b50886176a5313aaccfbfd4df2bc611d6b32d19961cdc98b5821b75d6b17c +[kubernetes-src.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-src.tar.gz) | 5e5d725294e552fd1d14fd6716d013222827ac2d4e2d11a7a1fdefb77b3459bbeb69931f38e1597de205dd32a1c9763ab524c2af1551faef4f502ef0890f7fbf + +### Client binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-client-darwin-amd64.tar.gz) | 60004939727c75d0f06adc4449e16b43303941937c0e9ea9aca7d947e93a5aed5d11e53d1fc94caeb988be66d39acab118d406dc2d6cead61181e1ced6d2be1a +[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-client-linux-386.tar.gz) | 7edba9c4f1bf38fdf1fa5bff2856c05c0e127333ce19b17edf3119dc9b80462c027404a1f58a5eabf1de73a8f2f20aced043dda1fafd893619db1a188cda550c +[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-client-linux-amd64.tar.gz) | db1818aa82d072cb3e32a2a988e66d76ecf7cebc6b8a29845fa2d6ec27f14a36e4b9839b1b7ed8c43d2da9cde00215eb672a7e8ee235d2e3107bc93c22e58d38 +[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-client-linux-arm.tar.gz) | d2922e70d22364b1f5a1e94a0c115f849fe2575b231b1ba268f73a9d86fc0a9fbb78dc713446839a2593acf1341cb5a115992f350870f13c1a472bb107b75af7 +[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-client-linux-arm64.tar.gz) | 2e3ae20e554c7d4fc3a8afdfcafe6bbc81d4c5e9aea036357baac7a3fdc2e8098aa8a8c3dded3951667d57f667ce3fbf37ec5ae5ceb2009a569dc9002d3a92f9 +[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-client-linux-ppc64le.tar.gz) | b54a34e572e6a86221577de376e6f7f9fcd82327f7fe94f2fc8d21f35d302db8a0f3d51e60dc89693999f5df37c96d0c3649a29f07f095efcdd59923ae285c95 +[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-client-linux-s390x.tar.gz) | 5be1b70dc437d3ba88cb0b89cd1bc555f79896c3f5b5f4fa0fb046a0d09d758b994d622ebe5cef8e65bba938c5ae945b81dc297f9dfa0d98f82ea75f344a3a0d +[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-client-windows-386.tar.gz) | 88cf3f66168ef3bf9a5d3d2275b7f33799406e8205f2c202997ebec23d449aa4bb48b010356ab1cf52ff7b527b8df7c8b9947a43a82ebe060df83c3d21b7223a +[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-client-windows-amd64.tar.gz) | 87d2d4ea1829da8cfa1a705a03ea26c759a03bd1c4d8b96f2c93264c4d172bb63a91d9ddda65cdc5478b627c30ae8993db5baf8be262c157d83bffcebe85474e + +### Server binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-server-linux-amd64.tar.gz) | 7af691fc0b13a937797912374e3b3eeb88d5262e4eb7d4ebe92a3b64b3c226cb049aedfd7e39f639f6990444f7bcf2fe58699cf0c29039daebe100d7eebf60de +[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-server-linux-arm.tar.gz) | 557c47870ecf5c2090b2694c8f0c8e3b4ca23df5455a37945bd037bc6fb5b8f417bf737bb66e6336b285112cb52de0345240fdb2f3ce1c4fb335ca7ef1197f99 +[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-server-linux-arm64.tar.gz) | 981de6cf7679d743cdeef1e894314357b68090133814801870504ef30564e32b5675e270db20961e9a731e35241ad9b037bdaf749da87b6c4ce8889eeb1c5855 +[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-server-linux-ppc64le.tar.gz) | 506578a21601ccff609ae757a55e68634c15cbfecbf13de972c96b32a155ded29bd71aee069c77f5f721416672c7a7ac0b8274de22bfd28e1ecae306313d96c5 +[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-server-linux-s390x.tar.gz) | af0cdcd4a77a7cc8060a076641615730a802f1f02dab084e41926023489efec6102d37681c70ab0dbe7440cd3e72ea0443719a365467985360152b9aae657375 + +### Node binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-node-linux-amd64.tar.gz) | 2d92c61596296279de1efae23b2b707415565d9d50cd61a7231b8d10325732b059bcb90f3afb36bef2575d203938c265572721e38df408e8792d3949523bd5d9 +[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-node-linux-arm.tar.gz) | c298de9b5ac1b8778729a2d8e2793ff86743033254fbc27014333880b03c519de81691caf03aa418c729297ee8942ce9ec89d11b0e34a80576b9936015dc1519 +[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-node-linux-arm64.tar.gz) | daa3c65afda6d7aff206c1494390bbcc205c2c6f8db04c10ca967a690578a01c49d49c6902b85e7158f79fd4d2a87c5d397d56524a75991c9d7db85ac53059a7 +[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-node-linux-ppc64le.tar.gz) | 05661908bb73bfcaf9c2eae96e9a6a793db5a7a100bce6df9e057985dd53a7a5248d72e81b6d13496bd38b9326c17cdb2edaf0e982b6437507245fb846e1efc6 +[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-node-linux-s390x.tar.gz) | 845e518e2c4ef0cef2c3b58f0b9ea5b5fe9b8a249717f789607752484c424c26ae854b263b7c0a004a8426feb9aa3683c177a9ed2567e6c3521f4835ea08c24a +[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.3/kubernetes-node-windows-amd64.tar.gz) | 530e536574ed2c3e5973d3c0f0fdd2b4d48ef681a7a7c02db13e605001669eeb4f4b8a856fc08fc21436658c27b377f5d04dbcb3aae438098abc953b6eaf5712 + +## Changelog since v1.20.0-alpha.2 + +## Changes by Kind + +### API Change + +- New parameter `defaultingType` for `PodTopologySpread` plugin allows to use k8s defined or user provided default constraints ([#95048](https://github.com/kubernetes/kubernetes/pull/95048), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] + +### Feature + +- Added new k8s.io/component-helpers repository providing shared helper code for (core) components. ([#92507](https://github.com/kubernetes/kubernetes/pull/92507), [@ingvagabund](https://github.com/ingvagabund)) [SIG Apps, Node, Release and Scheduling] +- Adds `create ingress` command to `kubectl` ([#78153](https://github.com/kubernetes/kubernetes/pull/78153), [@amimof](https://github.com/amimof)) [SIG CLI and Network] +- Kubectl create now supports creating ingress objects. ([#94327](https://github.com/kubernetes/kubernetes/pull/94327), [@rikatz](https://github.com/rikatz)) [SIG CLI and Network] +- New default scheduling plugins order reduces scheduling and preemption latency when taints and node affinity are used ([#95539](https://github.com/kubernetes/kubernetes/pull/95539), [@soulxu](https://github.com/soulxu)) [SIG Scheduling] +- SCTP support in API objects (Pod, Service, NetworkPolicy) is now GA. + Note that this has no effect on whether SCTP is enabled on nodes at the kernel level, + and note that some cloud platforms and network plugins do not support SCTP traffic. ([#95566](https://github.com/kubernetes/kubernetes/pull/95566), [@danwinship](https://github.com/danwinship)) [SIG Apps and Network] +- Scheduling Framework: expose Run[Pre]ScorePlugins functions to PreemptionHandle which can be used in PostFilter extention point. ([#93534](https://github.com/kubernetes/kubernetes/pull/93534), [@everpeace](https://github.com/everpeace)) [SIG Scheduling and Testing] +- SelectorSpreadPriority maps to PodTopologySpread plugin when DefaultPodTopologySpread feature is enabled ([#95448](https://github.com/kubernetes/kubernetes/pull/95448), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] +- SetHostnameAsFQDN has been graduated to Beta and therefore it is enabled by default. ([#95267](https://github.com/kubernetes/kubernetes/pull/95267), [@javidiaz](https://github.com/javidiaz)) [SIG Node] + +### Bug or Regression + +- An issues preventing volume expand controller to annotate the PVC with `volume.kubernetes.io/storage-resizer` when the PVC StorageClass is already updated to the out-of-tree provisioner is now fixed. ([#94489](https://github.com/kubernetes/kubernetes/pull/94489), [@ialidzhikov](https://github.com/ialidzhikov)) [SIG API Machinery, Apps and Storage] +- Change the mount way from systemd to normal mount except ceph and glusterfs intree-volume. ([#94916](https://github.com/kubernetes/kubernetes/pull/94916), [@smileusd](https://github.com/smileusd)) [SIG Apps, Cloud Provider, Network, Node, Storage and Testing] +- Fix azure disk attach failure for disk size bigger than 4TB ([#95463](https://github.com/kubernetes/kubernetes/pull/95463), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fix azure disk data loss issue on Windows when unmount disk ([#95456](https://github.com/kubernetes/kubernetes/pull/95456), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] +- Fix verb & scope reporting for kube-apiserver metrics (LIST reported instead of GET) ([#95562](https://github.com/kubernetes/kubernetes/pull/95562), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Testing] +- Fix vsphere detach failure for static PVs ([#95447](https://github.com/kubernetes/kubernetes/pull/95447), [@gnufied](https://github.com/gnufied)) [SIG Cloud Provider and Storage] +- Fix: smb valid path error ([#95583](https://github.com/kubernetes/kubernetes/pull/95583), [@andyzhangx](https://github.com/andyzhangx)) [SIG Storage] +- Fixed a bug causing incorrect formatting of `kubectl describe ingress`. ([#94985](https://github.com/kubernetes/kubernetes/pull/94985), [@howardjohn](https://github.com/howardjohn)) [SIG CLI and Network] +- Fixed a bug in client-go where new clients with customized `Dial`, `Proxy`, `GetCert` config may get stale HTTP transports. ([#95427](https://github.com/kubernetes/kubernetes/pull/95427), [@roycaihw](https://github.com/roycaihw)) [SIG API Machinery] +- Fixes high CPU usage in kubectl drain ([#95260](https://github.com/kubernetes/kubernetes/pull/95260), [@amandahla](https://github.com/amandahla)) [SIG CLI] +- Support the node label `node.kubernetes.io/exclude-from-external-load-balancers` ([#95542](https://github.com/kubernetes/kubernetes/pull/95542), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] + +### Other (Cleanup or Flake) + +- Fix func name NewCreateCreateDeploymentOptions ([#91931](https://github.com/kubernetes/kubernetes/pull/91931), [@lixiaobing1](https://github.com/lixiaobing1)) [SIG CLI] +- Kubeadm: update the default pause image version to 1.4.0 on Windows. With this update the image supports Windows versions 1809 (2019LTS), 1903, 1909, 2004 ([#95419](https://github.com/kubernetes/kubernetes/pull/95419), [@jsturtevant](https://github.com/jsturtevant)) [SIG Cluster Lifecycle and Windows] +- Upgrade snapshot controller to 3.0.0 ([#95412](https://github.com/kubernetes/kubernetes/pull/95412), [@saikat-royc](https://github.com/saikat-royc)) [SIG Cloud Provider] +- Remove the dependency of csi-translation-lib module on apiserver/cloud-provider/controller-manager ([#95543](https://github.com/kubernetes/kubernetes/pull/95543), [@wawa0210](https://github.com/wawa0210)) [SIG Release] +- Scheduler framework interface moved from pkg/scheduler/framework/v1alpha to pkg/scheduler/framework ([#95069](https://github.com/kubernetes/kubernetes/pull/95069), [@farah](https://github.com/farah)) [SIG Scheduling, Storage and Testing] +- UDP and SCTP protocols can left stale connections that need to be cleared to avoid services disruption, but they can cause problems that are hard to debug. + Kubernetes components using a loglevel greater or equal than 4 will log the conntrack operations and its output, to show the entries that were deleted. ([#95694](https://github.com/kubernetes/kubernetes/pull/95694), [@aojea](https://github.com/aojea)) [SIG Network] + +## Dependencies + +### Added +_Nothing has changed._ + +### Changed +_Nothing has changed._ + +### Removed +_Nothing has changed._ + + + +# v1.20.0-alpha.2 + + +## Downloads for v1.20.0-alpha.2 + +### Source Code + +filename | sha512 hash +-------- | ----------- +[kubernetes.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes.tar.gz) | 45089a4d26d56a5d613ecbea64e356869ac738eca3cc71d16b74ea8ae1b4527bcc32f1dc35ff7aa8927e138083c7936603faf063121d965a2f0f8ba28fa128d8 +[kubernetes-src.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-src.tar.gz) | 646edd890d6df5858b90aaf68cc6e1b4589b8db09396ae921b5c400f2188234999e6c9633906692add08c6e8b4b09f12b2099132b0a7533443fb2a01cfc2bf81 + +### Client binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-client-darwin-amd64.tar.gz) | c136273883e24a2a50b5093b9654f01cdfe57b97461d34885af4a68c2c4d108c07583c02b1cdf7f57f82e91306e542ce8f3bddb12fcce72b744458bc4796f8eb +[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-client-linux-386.tar.gz) | 6ec59f1ed30569fa64ddb2d0de32b1ae04cda4ffe13f339050a7c9d7c63d425ee6f6d963dcf82c17281c4474da3eaf32c08117669052872a8c81bdce2c8a5415 +[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-client-linux-amd64.tar.gz) | 7b40a4c087e2ea7f8d055f297fcd39a3f1cb6c866e7a3981a9408c3c3eb5363c648613491aad11bc7d44d5530b20832f8f96f6ceff43deede911fb74aafad35f +[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-client-linux-arm.tar.gz) | cda9955feebea5acb8f2b5b87895d24894bbbbde47041453b1f926ebdf47a258ce0496aa27d06bcbf365b5615ce68a20d659b64410c54227216726e2ee432fca +[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-client-linux-arm64.tar.gz) | f65bd9241c7eb88a4886a285330f732448570aea4ededaebeabcf70d17ea185f51bf8a7218f146ee09fb1adceca7ee71fb3c3683834f2c415163add820fba96e +[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-client-linux-ppc64le.tar.gz) | 1e377599af100a81d027d9199365fb8208d443a8e0a97affff1a79dc18796e14b78cb53d6e245c1c1e8defd0e050e37bf5f2a23c8a3ff45a6d18d03619709bf5 +[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-client-linux-s390x.tar.gz) | 1cdee81478246aa7e7b80ae4efc7f070a5b058083ae278f59fad088b75a8052761b0e15ab261a6e667ddafd6a69fb424fc307072ed47941cad89a85af7aee93d +[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-client-windows-386.tar.gz) | d8774167c87b6844c348aa15e92d5033c528d6ab9e95d08a7cb22da68bafd8e46d442cf57a5f6affad62f674c10ae6947d524b94108b5e450ca78f92656d63c0 +[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-client-windows-amd64.tar.gz) | f664b47d8daa6036f8154c1dc1f881bfe683bf57c39d9b491de3848c03d051c50c6644d681baf7f9685eae45f9ce62e4c6dfea2853763cfe8256a61bdd59d894 + +### Server binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-server-linux-amd64.tar.gz) | d6fcb4600be0beb9de222a8da64c35fe22798a0da82d41401d34d0f0fc7e2817512169524c281423d8f4a007cd77452d966317d5a1b67d2717a05ff346e8aa7d +[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-server-linux-arm.tar.gz) | 022a76cf10801f8afbabb509572479b68fdb4e683526fa0799cdbd9bab4d3f6ecb76d1d63d0eafee93e3edf6c12892d84b9c771ef2325663b95347728fa3d6c0 +[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-server-linux-arm64.tar.gz) | 0679aadd60bbf6f607e5befad74b5267eb2d4c1b55985cc25a97e0f4c5efb7acbb3ede91bfa6a5a5713dae4d7a302f6faaf678fd6b359284c33d9a6aca2a08bb +[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-server-linux-ppc64le.tar.gz) | 9f2cfeed543b515eafb60d9765a3afff4f3d323c0a5c8a0d75e3de25985b2627817bfcbe59a9a61d969e026e2b861adb974a09eae75b58372ed736ceaaed2a82 +[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-server-linux-s390x.tar.gz) | 937258704d7b9dcd91f35f2d34ee9dd38c18d9d4e867408c05281bfbbb919ad012c95880bee84d2674761aa44cc617fb2fae1124cf63b689289286d6eac1c407 + +### Node binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-node-linux-amd64.tar.gz) | 076165d745d47879de68f4404eaf432920884be48277eb409e84bf2c61759633bf3575f46b0995f1fc693023d76c0921ed22a01432e756d7f8d9e246a243b126 +[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-node-linux-arm.tar.gz) | 1ff2e2e3e43af41118cdfb70c778e15035bbb1aca833ffd2db83c4bcd44f55693e956deb9e65017ebf3c553f2820ad5cd05f5baa33f3d63f3e00ed980ea4dfed +[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-node-linux-arm64.tar.gz) | b232c7359b8c635126899beee76998078eec7a1ef6758d92bcdebe8013b0b1e4d7b33ecbf35e3f82824fe29493400845257e70ed63c1635bfa36c8b3b4969f6f +[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-node-linux-ppc64le.tar.gz) | 51d415a068f554840f4c78d11a4fedebd7cb03c686b0ec864509b24f7a8667ebf54bb0a25debcf2b70f38be1e345e743f520695b11806539a55a3620ce21946f +[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-node-linux-s390x.tar.gz) | b51c082d8af358233a088b632cf2f6c8cfe5421471c27f5dc9ba4839ae6ea75df25d84298f2042770097554c01742bb7686694b331ad9bafc93c86317b867728 +[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.2/kubernetes-node-windows-amd64.tar.gz) | 91b9d26620a2dde67a0edead0039814efccbdfd54594dda3597aaced6d89140dc92612ed0727bc21d63468efeef77c845e640153b09e39d8b736062e6eee0c76 + +## Changelog since v1.20.0-alpha.1 + +## Changes by Kind + +### Deprecation + +- Action-required: kubeadm: graduate the "kubeadm alpha certs" command to a parent command "kubeadm certs". The command "kubeadm alpha certs" is deprecated and will be removed in a future release. Please migrate. ([#94938](https://github.com/kubernetes/kubernetes/pull/94938), [@yagonobre](https://github.com/yagonobre)) [SIG Cluster Lifecycle] +- Action-required: kubeadm: remove the deprecated feature --experimental-kustomize from kubeadm commands. The feature was replaced with --experimental-patches in 1.19. To migrate see the --help description for the --experimental-patches flag. ([#94871](https://github.com/kubernetes/kubernetes/pull/94871), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubeadm: deprecate self-hosting support. The experimental command "kubeadm alpha self-hosting" is now deprecated and will be removed in a future release. ([#95125](https://github.com/kubernetes/kubernetes/pull/95125), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Removes deprecated scheduler metrics DeprecatedSchedulingDuration, DeprecatedSchedulingAlgorithmPredicateEvaluationSecondsDuration, DeprecatedSchedulingAlgorithmPriorityEvaluationSecondsDuration ([#94884](https://github.com/kubernetes/kubernetes/pull/94884), [@arghya88](https://github.com/arghya88)) [SIG Instrumentation and Scheduling] +- Scheduler alpha metrics binding_duration_seconds and scheduling_algorithm_preemption_evaluation_seconds are deprecated, Both of those metrics are now covered as part of framework_extension_point_duration_seconds, the former as a PostFilter the latter and a Bind plugin. The plan is to remove both in 1.21 ([#95001](https://github.com/kubernetes/kubernetes/pull/95001), [@arghya88](https://github.com/arghya88)) [SIG Instrumentation and Scheduling] + +### API Change + +- GPU metrics provided by kubelet are now disabled by default ([#95184](https://github.com/kubernetes/kubernetes/pull/95184), [@RenaudWasTaken](https://github.com/RenaudWasTaken)) [SIG Node] +- New parameter `defaultingType` for `PodTopologySpread` plugin allows to use k8s defined or user provided default constraints ([#95048](https://github.com/kubernetes/kubernetes/pull/95048), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] +- Server Side Apply now treats LabelSelector fields as atomic (meaning the entire selector is managed by a single writer and updated together), since they contain interrelated and inseparable fields that do not merge in intuitive ways. ([#93901](https://github.com/kubernetes/kubernetes/pull/93901), [@jpbetz](https://github.com/jpbetz)) [SIG API Machinery, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Storage and Testing] +- Status of v1beta1 CRDs without "preserveUnknownFields:false" will show violation "spec.preserveUnknownFields: Invalid value: true: must be false" ([#93078](https://github.com/kubernetes/kubernetes/pull/93078), [@vareti](https://github.com/vareti)) [SIG API Machinery] + +### Feature + +- Added `get-users` and `delete-user` to the `kubectl config` subcommand ([#89840](https://github.com/kubernetes/kubernetes/pull/89840), [@eddiezane](https://github.com/eddiezane)) [SIG CLI] +- Added counter metric "apiserver_request_self" to count API server self-requests with labels for verb, resource, and subresource. ([#94288](https://github.com/kubernetes/kubernetes/pull/94288), [@LogicalShark](https://github.com/LogicalShark)) [SIG API Machinery, Auth, Instrumentation and Scheduling] +- Added new k8s.io/component-helpers repository providing shared helper code for (core) components. ([#92507](https://github.com/kubernetes/kubernetes/pull/92507), [@ingvagabund](https://github.com/ingvagabund)) [SIG Apps, Node, Release and Scheduling] +- Adds `create ingress` command to `kubectl` ([#78153](https://github.com/kubernetes/kubernetes/pull/78153), [@amimof](https://github.com/amimof)) [SIG CLI and Network] +- Allow configuring AWS LoadBalancer health check protocol via service annotations ([#94546](https://github.com/kubernetes/kubernetes/pull/94546), [@kishorj](https://github.com/kishorj)) [SIG Cloud Provider] +- Azure: Support multiple services sharing one IP address ([#94991](https://github.com/kubernetes/kubernetes/pull/94991), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] +- Ephemeral containers now apply the same API defaults as initContainers and containers ([#94896](https://github.com/kubernetes/kubernetes/pull/94896), [@wawa0210](https://github.com/wawa0210)) [SIG Apps and CLI] +- In dual-stack bare-metal clusters, you can now pass dual-stack IPs to `kubelet --node-ip`. + eg: `kubelet --node-ip 10.1.0.5,fd01::0005`. This is not yet supported for non-bare-metal + clusters. + + In dual-stack clusters where nodes have dual-stack addresses, hostNetwork pods + will now get dual-stack PodIPs. ([#95239](https://github.com/kubernetes/kubernetes/pull/95239), [@danwinship](https://github.com/danwinship)) [SIG Network and Node] +- Introduces a new GCE specific cluster creation variable KUBE_PROXY_DISABLE. When set to true, this will skip over the creation of kube-proxy (whether the daemonset or static pod). This can be used to control the lifecycle of kube-proxy separately from the lifecycle of the nodes. ([#91977](https://github.com/kubernetes/kubernetes/pull/91977), [@varunmar](https://github.com/varunmar)) [SIG Cloud Provider] +- Kubeadm: do not throw errors if the current system time is outside of the NotBefore and NotAfter bounds of a loaded certificate. Print warnings instead. ([#94504](https://github.com/kubernetes/kubernetes/pull/94504), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubeadm: make the command "kubeadm alpha kubeconfig user" accept a "--config" flag and remove the following flags: + - apiserver-advertise-address / apiserver-bind-port: use either localAPIEndpoint from InitConfiguration or controlPlaneEndpoint from ClusterConfiguration. + - cluster-name: use clusterName from ClusterConfiguration + - cert-dir: use certificatesDir from ClusterConfiguration ([#94879](https://github.com/kubernetes/kubernetes/pull/94879), [@knight42](https://github.com/knight42)) [SIG Cluster Lifecycle] +- Kubectl rollout history sts/sts-name --revision=some-revision will start showing the detailed view of the sts on that specified revision ([#86506](https://github.com/kubernetes/kubernetes/pull/86506), [@dineshba](https://github.com/dineshba)) [SIG CLI] +- Scheduling Framework: expose Run[Pre]ScorePlugins functions to PreemptionHandle which can be used in PostFilter extention point. ([#93534](https://github.com/kubernetes/kubernetes/pull/93534), [@everpeace](https://github.com/everpeace)) [SIG Scheduling and Testing] +- Send gce node startup scripts logs to console and journal ([#95311](https://github.com/kubernetes/kubernetes/pull/95311), [@karan](https://github.com/karan)) [SIG Cloud Provider and Node] +- Support kubectl delete orphan/foreground/background options ([#93384](https://github.com/kubernetes/kubernetes/pull/93384), [@zhouya0](https://github.com/zhouya0)) [SIG CLI and Testing] + +### Bug or Regression + +- Change the mount way from systemd to normal mount except ceph and glusterfs intree-volume. ([#94916](https://github.com/kubernetes/kubernetes/pull/94916), [@smileusd](https://github.com/smileusd)) [SIG Apps, Cloud Provider, Network, Node, Storage and Testing] +- Cloud node controller: handle empty providerID from getProviderID ([#95342](https://github.com/kubernetes/kubernetes/pull/95342), [@nicolehanjing](https://github.com/nicolehanjing)) [SIG Cloud Provider] +- Fix a bug where the endpoint slice controller was not mirroring the parent service labels to its corresponding endpoint slices ([#94443](https://github.com/kubernetes/kubernetes/pull/94443), [@aojea](https://github.com/aojea)) [SIG Apps and Network] +- Fix azure disk attach failure for disk size bigger than 4TB ([#95463](https://github.com/kubernetes/kubernetes/pull/95463), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fix azure disk data loss issue on Windows when unmount disk ([#95456](https://github.com/kubernetes/kubernetes/pull/95456), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] +- Fix detach azure disk issue when vm not exist ([#95177](https://github.com/kubernetes/kubernetes/pull/95177), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fix network_programming_latency metric reporting for Endpoints/EndpointSlice deletions, where we don't have correct timestamp ([#95363](https://github.com/kubernetes/kubernetes/pull/95363), [@wojtek-t](https://github.com/wojtek-t)) [SIG Network and Scalability] +- Fix scheduler cache snapshot when a Node is deleted before its Pods ([#95130](https://github.com/kubernetes/kubernetes/pull/95130), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] +- Fix vsphere detach failure for static PVs ([#95447](https://github.com/kubernetes/kubernetes/pull/95447), [@gnufied](https://github.com/gnufied)) [SIG Cloud Provider and Storage] +- Fixed a bug that prevents the use of ephemeral containers in the presence of a validating admission webhook. ([#94685](https://github.com/kubernetes/kubernetes/pull/94685), [@verb](https://github.com/verb)) [SIG Node and Testing] +- Gracefully delete nodes when their parent scale set went missing ([#95289](https://github.com/kubernetes/kubernetes/pull/95289), [@bpineau](https://github.com/bpineau)) [SIG Cloud Provider] +- In dual-stack clusters, kubelet will now set up both IPv4 and IPv6 iptables rules, which may + fix some problems, eg with HostPorts. ([#94474](https://github.com/kubernetes/kubernetes/pull/94474), [@danwinship](https://github.com/danwinship)) [SIG Network and Node] +- Kubeadm: for Docker as the container runtime, make the "kubeadm reset" command stop containers before removing them ([#94586](https://github.com/kubernetes/kubernetes/pull/94586), [@BedivereZero](https://github.com/BedivereZero)) [SIG Cluster Lifecycle] +- Kubeadm: warn but do not error out on missing "ca.key" files for root CA, front-proxy CA and etcd CA, during "kubeadm join --control-plane" if the user has provided all certificates, keys and kubeconfig files which require signing with the given CA keys. ([#94988](https://github.com/kubernetes/kubernetes/pull/94988), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Port mapping allows to map the same `containerPort` to multiple `hostPort` without naming the mapping explicitly. ([#94494](https://github.com/kubernetes/kubernetes/pull/94494), [@SergeyKanzhelev](https://github.com/SergeyKanzhelev)) [SIG Network and Node] +- Warn instead of fail when creating Roles and ClusterRoles with custom verbs via kubectl ([#92492](https://github.com/kubernetes/kubernetes/pull/92492), [@eddiezane](https://github.com/eddiezane)) [SIG CLI] + +### Other (Cleanup or Flake) + +- Added fine grained debugging to the intra-pod conformance test for helping easily resolve networking issues for nodes that might be unhealthy when running conformance or sonobuoy tests. ([#93837](https://github.com/kubernetes/kubernetes/pull/93837), [@jayunit100](https://github.com/jayunit100)) [SIG Network and Testing] +- AdmissionReview objects sent for the creation of Namespace API objects now populate the `namespace` attribute consistently (previously the `namespace` attribute was empty for Namespace creation via POST requests, and populated for Namespace creation via server-side-apply PATCH requests) ([#95012](https://github.com/kubernetes/kubernetes/pull/95012), [@nodo](https://github.com/nodo)) [SIG API Machinery and Testing] +- Client-go header logging (at verbosity levels >= 9) now masks `Authorization` header contents ([#95316](https://github.com/kubernetes/kubernetes/pull/95316), [@sfowl](https://github.com/sfowl)) [SIG API Machinery] +- Enhance log information of verifyRunAsNonRoot, add pod, container information ([#94911](https://github.com/kubernetes/kubernetes/pull/94911), [@wawa0210](https://github.com/wawa0210)) [SIG Node] +- Errors from staticcheck: + vendor/k8s.io/client-go/discovery/cached/memory/memcache_test.go:94:2: this value of g is never used (SA4006) ([#95098](https://github.com/kubernetes/kubernetes/pull/95098), [@phunziker](https://github.com/phunziker)) [SIG API Machinery] +- Kubeadm: update the default pause image version to 1.4.0 on Windows. With this update the image supports Windows versions 1809 (2019LTS), 1903, 1909, 2004 ([#95419](https://github.com/kubernetes/kubernetes/pull/95419), [@jsturtevant](https://github.com/jsturtevant)) [SIG Cluster Lifecycle and Windows] +- Masks ceph RBD adminSecrets in logs when logLevel >= 4 ([#95245](https://github.com/kubernetes/kubernetes/pull/95245), [@sfowl](https://github.com/sfowl)) [SIG Storage] +- Upgrade snapshot controller to 3.0.0 ([#95412](https://github.com/kubernetes/kubernetes/pull/95412), [@saikat-royc](https://github.com/saikat-royc)) [SIG Cloud Provider] +- Remove offensive words from kubectl cluster-info command ([#95202](https://github.com/kubernetes/kubernetes/pull/95202), [@rikatz](https://github.com/rikatz)) [SIG Architecture, CLI and Testing] +- The following new metrics are available. + - network_plugin_operations_total + - network_plugin_operations_errors_total ([#93066](https://github.com/kubernetes/kubernetes/pull/93066), [@AnishShah](https://github.com/AnishShah)) [SIG Instrumentation, Network and Node] +- Vsphere: improve logging message on node cache refresh event ([#95236](https://github.com/kubernetes/kubernetes/pull/95236), [@andrewsykim](https://github.com/andrewsykim)) [SIG Cloud Provider] +- `kubectl api-resources` now prints the API version (as 'API group/version', same as output of `kubectl api-versions`). The column APIGROUP is now APIVERSION ([#95253](https://github.com/kubernetes/kubernetes/pull/95253), [@sallyom](https://github.com/sallyom)) [SIG CLI] + +## Dependencies + +### Added +- github.com/jmespath/go-jmespath/internal/testify: [v1.5.1](https://github.com/jmespath/go-jmespath/internal/testify/tree/v1.5.1) + +### Changed +- github.com/aws/aws-sdk-go: [v1.28.2 → v1.35.5](https://github.com/aws/aws-sdk-go/compare/v1.28.2...v1.35.5) +- github.com/jmespath/go-jmespath: [c2b33e8 → v0.4.0](https://github.com/jmespath/go-jmespath/compare/c2b33e8...v0.4.0) +- k8s.io/kube-openapi: 6aeccd4 → 8b50664 +- sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.0.9 → v0.0.12 +- sigs.k8s.io/structured-merge-diff/v4: v4.0.1 → b3cf1e8 + +### Removed +_Nothing has changed._ + + + +# v1.20.0-alpha.1 + + +## Downloads for v1.20.0-alpha.1 + +### Source Code + +filename | sha512 hash +-------- | ----------- +[kubernetes.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes.tar.gz) | e7daed6502ea07816274f2371f96fe1a446d0d7917df4454b722d9eb3b5ff6163bfbbd5b92dfe7a0c1d07328b8c09c4ae966e482310d6b36de8813aaf87380b5 +[kubernetes-src.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-src.tar.gz) | e91213a0919647a1215d4691a63b12d89a3e74055463a8ebd71dc1a4cabf4006b3660881067af0189960c8dab74f4a7faf86f594df69021901213ee5b56550ea + +### Client binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-client-darwin-amd64.tar.gz) | 1f3add5f826fa989820d715ca38e8864b66f30b59c1abeacbb4bfb96b4e9c694eac6b3f4c1c81e0ee3451082d44828cb7515315d91ad68116959a5efbdaef1e1 +[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-client-linux-386.tar.gz) | c62acdc8993b0a950d4b0ce0b45473bf96373d501ce61c88adf4007afb15c1d53da8d53b778a7eccac6c1624f7fdda322be9f3a8bc2d80aaad7b4237c39f5eaf +[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-client-linux-amd64.tar.gz) | 1203ababfe00f9bc5be5c059324c17160a96530c1379a152db33564bbe644ccdb94b30eea15a0655bd652efb17895a46c31bbba19d4f5f473c2a0ff62f6e551f +[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-client-linux-arm.tar.gz) | 31860088596e12d739c7aed94556c2d1e217971699b950c8417a3cea1bed4e78c9ff1717b9f3943354b75b4641d4b906cd910890dbf4278287c0d224837d9a7d +[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-client-linux-arm64.tar.gz) | 8d469f37fe20d6e15b5debc13cce4c22e8b7a4f6a4ac787006b96507a85ce761f63b28140d692c54b5f7deb08697f8d5ddb9bbfa8f5ac0d9241fc7de3a3fe3cd +[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-client-linux-ppc64le.tar.gz) | 0d62ee1729cd5884946b6c73701ad3a570fa4d642190ca0fe5c1db0fb0cba9da3ac86a948788d915b9432d28ab8cc499e28aadc64530b7d549ee752a6ed93ec1 +[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-client-linux-s390x.tar.gz) | 0fc0420e134ec0b8e0ab2654e1e102cebec47b48179703f1e1b79d51ee0d6da55a4e7304d8773d3cf830341ac2fe3cede1e6b0460fd88f7595534e0730422d5a +[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-client-windows-386.tar.gz) | 3fb53b5260f4888c77c0e4ff602bbcf6bf38c364d2769850afe2b8d8e8b95f7024807c15e2b0d5603e787c46af8ac53492be9e88c530f578b8a389e3bd50c099 +[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-client-windows-amd64.tar.gz) | 2f44c93463d6b5244ce0c82f147e7f32ec2233d0e29c64c3c5759e23533aebd12671bf63e986c0861e9736f9b5259bb8d138574a7c8c8efc822e35cd637416c0 + +### Server binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-server-linux-amd64.tar.gz) | ae82d14b1214e4100f0cc2c988308b3e1edd040a65267d0eddb9082409f79644e55387889e3c0904a12c710f91206e9383edf510990bee8c9ea2e297b6472551 +[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-server-linux-arm.tar.gz) | 9a2a5828b7d1ddb16cc19d573e99a4af642f84129408e6203eeeb0558e7b8db77f3269593b5770b6a976fe9df4a64240ed27ad05a4bd43719e55fce1db0abf58 +[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-server-linux-arm64.tar.gz) | ed700dd226c999354ce05b73927388d36d08474c15333ae689427de15de27c84feb6b23c463afd9dd81993315f31eb8265938cfc7ecf6f750247aa42b9b33fa9 +[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-server-linux-ppc64le.tar.gz) | abb7a9d726538be3ccf5057a0c63ff9732b616e213c6ebb81363f0c49f1e168ce8068b870061ad7cba7ba1d49252f94cf00a5f68cec0f38dc8fce4e24edc5ca6 +[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-server-linux-s390x.tar.gz) | 3a51888af1bfdd2d5b0101d173ee589c1f39240e4428165f5f85c610344db219625faa42f00a49a83ce943fb079be873b1a114a62003fae2f328f9bf9d1227a4 + +### Node binaries + +filename | sha512 hash +-------- | ----------- +[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-node-linux-amd64.tar.gz) | d0f28e3c38ca59a7ff1bfecb48a1ce97116520355d9286afdca1200d346c10018f5bbdf890f130a388654635a2e83e908b263ed45f8a88defca52a7c1d0a7984 +[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-node-linux-arm.tar.gz) | ed9d3f13028beb3be39bce980c966f82c4b39dc73beaae38cc075fea5be30b0309e555cb2af8196014f2cc9f0df823354213c314b4d6545ff6e30dd2d00ec90e +[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-node-linux-arm64.tar.gz) | ad5b3268db365dcdded9a9a4bffc90c7df0f844000349accdf2b8fb5f1081e553de9b9e9fb25d5e8a4ef7252d51fa94ef94d36d2ab31d157854e164136f662c2 +[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-node-linux-ppc64le.tar.gz) | c4de2524e513996def5eeba7b83f7b406f17eaf89d4d557833a93bd035348c81fa9375dcd5c27cfcc55d73995449fc8ee504be1b3bd7b9f108b0b2f153cb05ae +[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-node-linux-s390x.tar.gz) | 9157b44e3e7bd5478af9f72014e54d1afa5cd19b984b4cd8b348b312c385016bb77f29db47f44aea08b58abf47d8a396b92a2d0e03f2fe8acdd30f4f9466cbdb +[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.20.0-alpha.1/kubernetes-node-windows-amd64.tar.gz) | 8b40a43c5e6447379ad2ee8aac06e8028555e1b370a995f6001018a62411abe5fbbca6060b3d1682c5cadc07a27d49edd3204e797af46368800d55f4ca8aa1de + +## Changelog since v1.20.0-alpha.0 + +## Urgent Upgrade Notes + +### (No, really, you MUST read this before you upgrade) + + - Azure blob disk feature(`kind`: `Shared`, `Dedicated`) has been deprecated, you should use `kind`: `Managed` in `kubernetes.io/azure-disk` storage class. ([#92905](https://github.com/kubernetes/kubernetes/pull/92905), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] + - CVE-2020-8559 (Medium): Privilege escalation from compromised node to cluster. See https://github.com/kubernetes/kubernetes/issues/92914 for more details. + The API Server will no longer proxy non-101 responses for upgrade requests. This could break proxied backends (such as an extension API server) that respond to upgrade requests with a non-101 response code. ([#92941](https://github.com/kubernetes/kubernetes/pull/92941), [@tallclair](https://github.com/tallclair)) [SIG API Machinery] ## Changes by Kind ### Deprecation - Kube-apiserver: the componentstatus API is deprecated. This API provided status of etcd, kube-scheduler, and kube-controller-manager components, but only worked when those components were local to the API server, and when kube-scheduler and kube-controller-manager exposed unsecured health endpoints. Instead of this API, etcd health is included in the kube-apiserver health check and kube-scheduler/kube-controller-manager health checks can be made directly against those components' health endpoints. ([#93570](https://github.com/kubernetes/kubernetes/pull/93570), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Apps and Cluster Lifecycle] +- Kubeadm: deprecate the "kubeadm alpha kubelet config enable-dynamic" command. To continue using the feature please defer to the guide for "Dynamic Kubelet Configuration" at k8s.io. ([#92881](https://github.com/kubernetes/kubernetes/pull/92881), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubeadm: remove the deprecated "kubeadm alpha kubelet config enable-dynamic" command. To continue using the feature please defer to the guide for "Dynamic Kubelet Configuration" at k8s.io. This change also removes the parent command "kubeadm alpha kubelet" as there are no more sub-commands under it for the time being. ([#94668](https://github.com/kubernetes/kubernetes/pull/94668), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubeadm: remove the deprecated --kubelet-config flag for the command "kubeadm upgrade node" ([#94869](https://github.com/kubernetes/kubernetes/pull/94869), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubelet's deprecated endpoint `metrics/resource/v1alpha1` has been removed, please adopt to `metrics/resource`. ([#94272](https://github.com/kubernetes/kubernetes/pull/94272), [@RainbowMango](https://github.com/RainbowMango)) [SIG Instrumentation and Node] +- The v1alpha1 PodPreset API and admission plugin has been removed with no built-in replacement. Admission webhooks can be used to modify pods on creation. ([#94090](https://github.com/kubernetes/kubernetes/pull/94090), [@deads2k](https://github.com/deads2k)) [SIG API Machinery, Apps, CLI, Cloud Provider, Scalability and Testing] + +### API Change + +- A new `nofuzz` go build tag now disables gofuzz support. Release binaries enable this. ([#92491](https://github.com/kubernetes/kubernetes/pull/92491), [@BenTheElder](https://github.com/BenTheElder)) [SIG API Machinery] +- A new alpha-level field, `SupportsFsGroup`, has been introduced for CSIDrivers to allow them to specify whether they support volume ownership and permission modifications. The `CSIVolumeSupportFSGroup` feature gate must be enabled to allow this field to be used. ([#92001](https://github.com/kubernetes/kubernetes/pull/92001), [@huffmanca](https://github.com/huffmanca)) [SIG API Machinery, CLI and Storage] +- Added pod version skew strategy for seccomp profile to synchronize the deprecated annotations with the new API Server fields. Please see the corresponding section [in the KEP](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/20190717-seccomp-ga.md#version-skew-strategy) for more detailed explanations. ([#91408](https://github.com/kubernetes/kubernetes/pull/91408), [@saschagrunert](https://github.com/saschagrunert)) [SIG Apps, Auth, CLI and Node] +- Adds the ability to disable Accelerator/GPU metrics collected by Kubelet ([#91930](https://github.com/kubernetes/kubernetes/pull/91930), [@RenaudWasTaken](https://github.com/RenaudWasTaken)) [SIG Node] +- Custom Endpoints are now mirrored to EndpointSlices by a new EndpointSliceMirroring controller. ([#91637](https://github.com/kubernetes/kubernetes/pull/91637), [@robscott](https://github.com/robscott)) [SIG API Machinery, Apps, Auth, Cloud Provider, Instrumentation, Network and Testing] +- External facing API podresources is now available under k8s.io/kubelet/pkg/apis/ ([#92632](https://github.com/kubernetes/kubernetes/pull/92632), [@RenaudWasTaken](https://github.com/RenaudWasTaken)) [SIG Node and Testing] +- Fix conversions for custom metrics. ([#94481](https://github.com/kubernetes/kubernetes/pull/94481), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Instrumentation] +- Generic ephemeral volumes, a new alpha feature under the `GenericEphemeralVolume` feature gate, provide a more flexible alternative to `EmptyDir` volumes: as with `EmptyDir`, volumes are created and deleted for each pod automatically by Kubernetes. But because the normal provisioning process is used (`PersistentVolumeClaim`), storage can be provided by third-party storage vendors and all of the usual volume features work. Volumes don't need to be empt; for example, restoring from snapshot is supported. ([#92784](https://github.com/kubernetes/kubernetes/pull/92784), [@pohly](https://github.com/pohly)) [SIG API Machinery, Apps, Auth, CLI, Instrumentation, Node, Scheduling, Storage and Testing] +- Kube-controller-manager: volume plugins can be restricted from contacting local and loopback addresses by setting `--volume-host-allow-local-loopback=false`, or from contacting specific CIDR ranges by setting `--volume-host-cidr-denylist` (for example, `--volume-host-cidr-denylist=127.0.0.1/28,feed::/16`) ([#91785](https://github.com/kubernetes/kubernetes/pull/91785), [@mattcary](https://github.com/mattcary)) [SIG API Machinery, Apps, Auth, CLI, Network, Node, Storage and Testing] +- Kubernetes is now built with golang 1.15.0-rc.1. + - The deprecated, legacy behavior of treating the CommonName field on X.509 serving certificates as a host name when no Subject Alternative Names are present is now disabled by default. It can be temporarily re-enabled by adding the value x509ignoreCN=0 to the GODEBUG environment variable. ([#93264](https://github.com/kubernetes/kubernetes/pull/93264), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Release, Scalability, Storage and Testing] +- Migrate scheduler, controller-manager and cloud-controller-manager to use LeaseLock ([#94603](https://github.com/kubernetes/kubernetes/pull/94603), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery, Apps, Cloud Provider and Scheduling] +- Modify DNS-1123 error messages to indicate that RFC 1123 is not followed exactly ([#94182](https://github.com/kubernetes/kubernetes/pull/94182), [@mattfenwick](https://github.com/mattfenwick)) [SIG API Machinery, Apps, Auth, Network and Node] +- The ServiceAccountIssuerDiscovery feature gate is now Beta and enabled by default. ([#91921](https://github.com/kubernetes/kubernetes/pull/91921), [@mtaufen](https://github.com/mtaufen)) [SIG Auth] +- The kube-controller-manager managed signers can now have distinct signing certificates and keys. See the help about `--cluster-signing-[signer-name]-{cert,key}-file`. `--cluster-signing-{cert,key}-file` is still the default. ([#90822](https://github.com/kubernetes/kubernetes/pull/90822), [@deads2k](https://github.com/deads2k)) [SIG API Machinery, Apps and Auth] +- When creating a networking.k8s.io/v1 Ingress API object, `spec.tls[*].secretName` values are required to pass validation rules for Secret API object names. ([#93929](https://github.com/kubernetes/kubernetes/pull/93929), [@liggitt](https://github.com/liggitt)) [SIG Network] +- WinOverlay feature graduated to beta ([#94807](https://github.com/kubernetes/kubernetes/pull/94807), [@ksubrmnn](https://github.com/ksubrmnn)) [SIG Windows] + +### Feature + +- ACTION REQUIRED : In CoreDNS v1.7.0, [metrics names have been changed](https://github.com/coredns/coredns/blob/master/notes/coredns-1.7.0.md#metric-changes) which will be backward incompatible with existing reporting formulas that use the old metrics' names. Adjust your formulas to the new names before upgrading. + + Kubeadm now includes CoreDNS version v1.7.0. Some of the major changes include: + - Fixed a bug that could cause CoreDNS to stop updating service records. + - Fixed a bug in the forward plugin where only the first upstream server is always selected no matter which policy is set. + - Remove already deprecated options `resyncperiod` and `upstream` in the Kubernetes plugin. + - Includes Prometheus metrics name changes (to bring them in line with standard Prometheus metrics naming convention). They will be backward incompatible with existing reporting formulas that use the old metrics' names. + - The federation plugin (allows for v1 Kubernetes federation) has been removed. + More details are available in https://coredns.io/2020/06/15/coredns-1.7.0-release/ ([#92651](https://github.com/kubernetes/kubernetes/pull/92651), [@rajansandeep](https://github.com/rajansandeep)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle and Instrumentation] +- Add metrics for azure service operations (route and loadbalancer). ([#94124](https://github.com/kubernetes/kubernetes/pull/94124), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider and Instrumentation] +- Add network rule support in Azure account creation ([#94239](https://github.com/kubernetes/kubernetes/pull/94239), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Add tags support for Azure File Driver ([#92825](https://github.com/kubernetes/kubernetes/pull/92825), [@ZeroMagic](https://github.com/ZeroMagic)) [SIG Cloud Provider and Storage] +- Added kube-apiserver metrics: apiserver_current_inflight_request_measures and, when API Priority and Fairness is enable, windowed_request_stats. ([#91177](https://github.com/kubernetes/kubernetes/pull/91177), [@MikeSpreitzer](https://github.com/MikeSpreitzer)) [SIG API Machinery, Instrumentation and Testing] +- Audit events for API requests to deprecated API versions now include a `"k8s.io/deprecated": "true"` audit annotation. If a target removal release is identified, the audit event includes a `"k8s.io/removal-release": "."` audit annotation as well. ([#92842](https://github.com/kubernetes/kubernetes/pull/92842), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Instrumentation] +- Cloud node-controller use InstancesV2 ([#91319](https://github.com/kubernetes/kubernetes/pull/91319), [@gongguan](https://github.com/gongguan)) [SIG Apps, Cloud Provider, Scalability and Storage] +- Kubeadm: Add a preflight check that the control-plane node has at least 1700MB of RAM ([#93275](https://github.com/kubernetes/kubernetes/pull/93275), [@xlgao-zju](https://github.com/xlgao-zju)) [SIG Cluster Lifecycle] +- Kubeadm: add the "--cluster-name" flag to the "kubeadm alpha kubeconfig user" to allow configuring the cluster name in the generated kubeconfig file ([#93992](https://github.com/kubernetes/kubernetes/pull/93992), [@prabhu43](https://github.com/prabhu43)) [SIG Cluster Lifecycle] +- Kubeadm: add the "--kubeconfig" flag to the "kubeadm init phase upload-certs" command to allow users to pass a custom location for a kubeconfig file. ([#94765](https://github.com/kubernetes/kubernetes/pull/94765), [@zhanw15](https://github.com/zhanw15)) [SIG Cluster Lifecycle] +- Kubeadm: deprecate the "--csr-only" and "--csr-dir" flags of the "kubeadm init phase certs" subcommands. Please use "kubeadm alpha certs generate-csr" instead. This new command allows you to generate new private keys and certificate signing requests for all the control-plane components, so that the certificates can be signed by an external CA. ([#92183](https://github.com/kubernetes/kubernetes/pull/92183), [@wallrj](https://github.com/wallrj)) [SIG Cluster Lifecycle] +- Kubeadm: make etcd pod request 100m CPU, 100Mi memory and 100Mi ephemeral_storage by default ([#94479](https://github.com/kubernetes/kubernetes/pull/94479), [@knight42](https://github.com/knight42)) [SIG Cluster Lifecycle] +- Kubemark now supports both real and hollow nodes in a single cluster. ([#93201](https://github.com/kubernetes/kubernetes/pull/93201), [@ellistarn](https://github.com/ellistarn)) [SIG Scalability] +- Kubernetes is now built using go1.15.2 + - build: Update to k/repo-infra@v0.1.1 (supports go1.15.2) + - build: Use go-runner:buster-v2.0.1 (built using go1.15.1) + - bazel: Replace --features with Starlark build settings flag + - hack/lib/util.sh: some bash cleanups + + - switched one spot to use kube::logging + - make kube::util::find-binary return an error when it doesn't find + anything so that hack scripts fail fast instead of with '' binary not + found errors. + - this required deleting some genfeddoc stuff. the binary no longer + exists in k/k repo since we removed federation/, and I don't see it + in https://github.com/kubernetes-sigs/kubefed/ either. I'm assuming + that it's gone for good now. + + - bazel: output go_binary rule directly from go_binary_conditional_pure + + From: @mikedanese: + Instead of aliasing. Aliases are annoying in a number of ways. This is + specifically bugging me now because they make the action graph harder to + analyze programmatically. By using aliases here, we would need to handle + potentially aliased go_binary targets and dereference to the effective + target. + + The comment references an issue with `pure = select(...)` which appears + to be resolved considering this now builds. + + - make kube::util::find-binary not dependent on bazel-out/ structure + + Implement an aspect that outputs go_build_mode metadata for go binaries, + and use that during binary selection. ([#94449](https://github.com/kubernetes/kubernetes/pull/94449), [@justaugustus](https://github.com/justaugustus)) [SIG Architecture, CLI, Cluster Lifecycle, Node, Release and Testing] +- Only update Azure data disks when attach/detach ([#94265](https://github.com/kubernetes/kubernetes/pull/94265), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Promote SupportNodePidsLimit to GA to provide node to pod pid isolation + Promote SupportPodPidsLimit to GA to provide ability to limit pids per pod ([#94140](https://github.com/kubernetes/kubernetes/pull/94140), [@derekwaynecarr](https://github.com/derekwaynecarr)) [SIG Node and Testing] +- Rename pod_preemption_metrics to preemption_metrics. ([#93256](https://github.com/kubernetes/kubernetes/pull/93256), [@ahg-g](https://github.com/ahg-g)) [SIG Instrumentation and Scheduling] +- Server-side apply behavior has been regularized in the case where a field is removed from the applied configuration. Removed fields which have no other owners are deleted from the live object, or reset to their default value if they have one. Safe ownership transfers, such as the transfer of a `replicas` field from a user to an HPA without resetting to the default value are documented in [Transferring Ownership](https://kubernetes.io/docs/reference/using-api/api-concepts/#transferring-ownership) ([#92661](https://github.com/kubernetes/kubernetes/pull/92661), [@jpbetz](https://github.com/jpbetz)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Testing] +- Set CSIMigrationvSphere feature gates to beta. + Users should enable CSIMigration + CSIMigrationvSphere features and install the vSphere CSI Driver (https://github.com/kubernetes-sigs/vsphere-csi-driver) to move workload from the in-tree vSphere plugin "kubernetes.io/vsphere-volume" to vSphere CSI Driver. + + Requires: vSphere vCenter/ESXi Version: 7.0u1, HW Version: VM version 15 ([#92816](https://github.com/kubernetes/kubernetes/pull/92816), [@divyenpatel](https://github.com/divyenpatel)) [SIG Cloud Provider and Storage] +- Support [service.beta.kubernetes.io/azure-pip-ip-tags] annotations to allow customers to specify ip-tags to influence public-ip creation in Azure [Tag1=Value1, Tag2=Value2, etc.] ([#94114](https://github.com/kubernetes/kubernetes/pull/94114), [@MarcPow](https://github.com/MarcPow)) [SIG Cloud Provider] +- Support a smooth upgrade from client-side apply to server-side apply without conflicts, as well as support the corresponding downgrade. ([#90187](https://github.com/kubernetes/kubernetes/pull/90187), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG API Machinery and Testing] +- Trace output in apiserver logs is more organized and comprehensive. Traces are nested, and for all non-long running request endpoints, the entire filter chain is instrumented (e.g. authentication check is included). ([#88936](https://github.com/kubernetes/kubernetes/pull/88936), [@jpbetz](https://github.com/jpbetz)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Scheduling] +- `kubectl alpha debug` now supports debugging nodes by creating a debugging container running in the node's host namespaces. ([#92310](https://github.com/kubernetes/kubernetes/pull/92310), [@verb](https://github.com/verb)) [SIG CLI] + +### Documentation + +- Kubelet: remove alpha warnings for CNI flags. ([#94508](https://github.com/kubernetes/kubernetes/pull/94508), [@andrewsykim](https://github.com/andrewsykim)) [SIG Network and Node] + +### Failing Test + +- Kube-proxy iptables min-sync-period defaults to 1 sec. Previously, it was 0. ([#92836](https://github.com/kubernetes/kubernetes/pull/92836), [@aojea](https://github.com/aojea)) [SIG Network] ### Bug or Regression - A panic in the apiserver caused by the `informer-sync` health checker is now fixed. ([#93600](https://github.com/kubernetes/kubernetes/pull/93600), [@ialidzhikov](https://github.com/ialidzhikov)) [SIG API Machinery] -- EndpointSliceMirroring controller now copies labels from Endpoints to EndpointSlices. ([#93442](https://github.com/kubernetes/kubernetes/pull/93442), [@robscott](https://github.com/robscott)) [SIG Apps and Network] -- Kube-apiserver: jsonpath expressions with consecutive recursive descent operators are no longer evaluated for custom resource printer columns ([#93408](https://github.com/kubernetes/kubernetes/pull/93408), [@joelsmith](https://github.com/joelsmith)) [SIG API Machinery] - -### Other (Cleanup or Flake) - -- Build: Update to debian-base@v2.1.0 and debian-iptables@v12.1.1 ([#93667](https://github.com/kubernetes/kubernetes/pull/93667), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery, Release and Testing] - -## Dependencies - -### Added -_Nothing has changed._ - -### Changed -- k8s.io/utils: 0bdb4ca → d5654de - -### Removed -_Nothing has changed._ - - - -# v1.19.0-rc.3 - - -## Downloads for v1.19.0-rc.3 - -### Source Code - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes.tar.gz) | 31f98fb8d51c6dfa60e2cf710a35af14bc17a6b3833b3802cebc92586b01996c091943087dc818541fc13ad75f051d20c176d9506fc0c86ab582a9295fb7ed59 -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-src.tar.gz) | 4886180edf6287adf9db1cdab1e8439c41296c6b5b40af9c4642bb6cfd1fb894313c6d1210c2b882f1bc40dbfd17ed20c5159ea3a8c79ad2ef7a7630016e99de - -### Client binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-client-darwin-amd64.tar.gz) | 19b0f9fe95e135329ce2cb9dd3e95551f3552be035ce7235e055c9d775dfa747c773b0806b5c2eef1e69863368be13adcb4c5ef78ae05af65483434686e9a773 -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-client-linux-386.tar.gz) | 219a15b54ba616938960ac38869c87be573e3cd7897e4790c31cdeb819415fcefb4f293fc49d63901b42f70e66555c72a8a774cced7ec15a93592dffef3b1336 -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-client-linux-amd64.tar.gz) | 7c5a2163e0e163d3b1819acc7c4475d35b853318dd5a6084ea0785744a92063edf65254b0f0eae0f69f4598561c182033a9722c1b8a61894959333f1357cb1f9 -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-client-linux-arm.tar.gz) | 5d48f78da6a54b63d8ea68e983d780c672b546b4a5d1fb2c15033377dd3098f0011516b55cc47db316dacabdbbd3660108014d12899ef1f4a6a03158ef503101 -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-client-linux-arm64.tar.gz) | c2db09db465f8ea2bd7b82971a59a2be394b2f9a8c15ff78ab06c3a41d9f1292175de19fdc7450cc28746027d59dc3162cb47b64555e91d324d33d699d89f408 -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-client-linux-ppc64le.tar.gz) | f28c9c672bc2c5e780f6fdcf019a5dad7172537e38e2ab7d52a1ea55babb41d296cef97b482133c7fce0634b1aed1b5322d1e0061d30c3848e4c912a7e1ca248 -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-client-linux-s390x.tar.gz) | 22844af3c97eb9f36a038c552e9818b8670cd02acc98defe5c131c7f88621014cd51c343c1e0921b88ebbfd9850a5c277f50df78350f7565db4e356521d415d4 -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-client-windows-386.tar.gz) | edabe78a1337f73caa81c885d722544fec443f875297291e57608d4f486c897af6c602656048a4325fcc957ce1d7acb1c1cf06cab0bd2e36acee1d6be206d3c6 -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-client-windows-amd64.tar.gz) | f1a370b9ec298838e302909dd826760b50b593ee2d2247416d345ff00331973e7b6b29cef69f07d6c1477ab534d6ec9d1bbf5d3c2d1bb9b5b2933e088c8de3f1 - -### Server binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-server-linux-amd64.tar.gz) | 193c023306d7478c2e43c4039642649c77598c05b07dbc466611e166f0233a7ea2a7f2ff61763b2630988c151a591f44428942d8ee06ce6766641e1dcfaac588 -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-server-linux-arm.tar.gz) | c1aa489779fb74855385f24120691771a05b57069064c99471b238e5d541d94d4356e7d2cd5b66c284c46bde1fc3eff2a1cebfcd9e72a78377b76e32a1dbf57a -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-server-linux-arm64.tar.gz) | 73400003571f9f0308051ca448b1f96d83e9d211876a57b572ffb787ad0c3bb5f1e20547d959f0fac51a916cf7f26f8839ddddd55d4a38e59c8270d5eb48a970 -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-server-linux-ppc64le.tar.gz) | bebf75d884d024ffebfda40abaa0bfec99a6d4cd3cc0fac904a1c4c190e6eb8fc9412c7790b2f8a2b3cc8ccdf8556d9a93eec37e5c298f8abd62ee41de641a42 -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-server-linux-s390x.tar.gz) | 8374dfb689abae31480814d6849aaa51e30666b7203cdcf204d49c9a0344391232f40d135671ec8316e26d1685e1cbbea4b829ff3b9f83c08c2d1ba50cd5aeb2 - -### Node binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-node-linux-amd64.tar.gz) | 194ee29b012463e6d90c346f76d53f94778f75cc916b0e10a5ee174983fac6e848438e0d9e36a475c5d7ba7b0f3ad5debc039ec8f95fdfb6229843f04dfacb53 -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-node-linux-arm.tar.gz) | f0d075eaa84dae7ce2101dfa421021b0bfea235fe606d693e881775cd37ff0b82ca6a419dfe48becd2eddc5f882e97ba838164e6ac5991445225c31f147b4f97 -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-node-linux-arm64.tar.gz) | 3dc69981f31b01a2d8c439f7047f73e5699a121501c516ed17b3e91ed358ee97e43fa955eb9e1434cbf7864e51097e76c216075d34f4b455930a44af6c64be5c -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-node-linux-ppc64le.tar.gz) | 4a77720373960a0cc20bbcfcdfe17f8d5ddaaf2e38bad607cfe05831029e8e14559e78cd0b5b80ab9c9268a04a8b6bd54ad7232c29301a1f6a6392fcd38ecedf -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-node-linux-s390x.tar.gz) | 319e684340aab739e3da46c6407851ff1c42463ba176bf190e58faa48d143975f02df3443ac287cdfcf652b5d6b6e6721d9e4f35995c4e705297a97dd777fe7e -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.3/kubernetes-node-windows-amd64.tar.gz) | 1ff22497a3f0844ffa8593a2a444a8fcb45d0123da49fd58e17cfc1477d22be7f6809d923898b6aa7a9ce519b0a6e0825f575f6cf71da5c8a0fa5f6b4d0905b6 - -## Changelog since v1.19.0-rc.2 - -## Changes by Kind - -### API Change - -- Adds the ability to disable Accelerator/GPU metrics collected by Kubelet ([#91930](https://github.com/kubernetes/kubernetes/pull/91930), [@RenaudWasTaken](https://github.com/RenaudWasTaken)) [SIG Node] -- Kubernetes is now built with golang 1.15.0-rc.1. - - The deprecated, legacy behavior of treating the CommonName field on X.509 serving certificates as a host name when no Subject Alternative Names are present is now disabled by default. It can be temporarily re-enabled by adding the value x509ignoreCN=0 to the GODEBUG environment variable. ([#93264](https://github.com/kubernetes/kubernetes/pull/93264), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Release, Scalability, Storage and Testing] - -### Bug or Regression - +- Add kubectl wait --ignore-not-found flag ([#90969](https://github.com/kubernetes/kubernetes/pull/90969), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] +- Adding fix to the statefulset controller to wait for pvc deletion before creating pods. ([#93457](https://github.com/kubernetes/kubernetes/pull/93457), [@ymmt2005](https://github.com/ymmt2005)) [SIG Apps] +- Azure ARM client: don't segfault on empty response and http error ([#94078](https://github.com/kubernetes/kubernetes/pull/94078), [@bpineau](https://github.com/bpineau)) [SIG Cloud Provider] +- Azure: fix a bug that kube-controller-manager would panic if wrong Azure VMSS name is configured ([#94306](https://github.com/kubernetes/kubernetes/pull/94306), [@knight42](https://github.com/knight42)) [SIG Cloud Provider] - Azure: per VMSS VMSS VMs cache to prevent throttling on clusters having many attached VMSS ([#93107](https://github.com/kubernetes/kubernetes/pull/93107), [@bpineau](https://github.com/bpineau)) [SIG Cloud Provider] -- Extended DSR loadbalancer feature in winkernel kube-proxy to HNS versions 9.3-9.max, 10.2+ ([#93080](https://github.com/kubernetes/kubernetes/pull/93080), [@elweb9858](https://github.com/elweb9858)) [SIG Network] -- Fix instance not found issues when an Azure Node is recreated in a short time ([#93316](https://github.com/kubernetes/kubernetes/pull/93316), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] +- Both apiserver_request_duration_seconds metrics and RequestReceivedTimestamp field of an audit event take + into account the time a request spends in the apiserver request filters. ([#94903](https://github.com/kubernetes/kubernetes/pull/94903), [@tkashem](https://github.com/tkashem)) [SIG API Machinery, Auth and Instrumentation] +- Build/lib/release: Explicitly use '--platform' in building server images -## Dependencies + When we switched to go-runner for building the apiserver, + controller-manager, and scheduler server components, we no longer + reference the individual architectures in the image names, specifically + in the 'FROM' directive of the server image Dockerfiles. -### Added -- github.com/yuin/goldmark: [v1.1.27](https://github.com/yuin/goldmark/tree/v1.1.27) + As a result, server images for non-amd64 images copy in the go-runner + amd64 binary instead of the go-runner that matches that architecture. -### Changed -- github.com/Microsoft/hcsshim: [v0.8.9 → 5eafd15](https://github.com/Microsoft/hcsshim/compare/v0.8.9...5eafd15) -- github.com/containerd/cgroups: [bf292b2 → 0dbf7f0](https://github.com/containerd/cgroups/compare/bf292b2...0dbf7f0) -- github.com/urfave/cli: [v1.22.1 → v1.22.2](https://github.com/urfave/cli/compare/v1.22.1...v1.22.2) -- golang.org/x/crypto: bac4c82 → 75b2880 -- golang.org/x/mod: v0.1.0 → v0.3.0 -- golang.org/x/net: d3edc99 → ab34263 -- golang.org/x/tools: c00d67e → c1934b7 + This commit explicitly sets the '--platform=linux/${arch}' to ensure + we're pulling the correct go-runner arch from the manifest list. -### Removed -- github.com/godbus/dbus: [ade71ed](https://github.com/godbus/dbus/tree/ade71ed) - - - -# v1.19.0-rc.2 - - -## Downloads for v1.19.0-rc.2 - -### Source Code - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes.tar.gz) | 7a9fa6af3772be18f8c427d8b96836bd77e271a08fffeba92d01b3fac4bd69d2be1bbc404cdd4fc259dda42b16790a7943eddb7c889b918d7631857e127a724c -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-src.tar.gz) | 60184627a181ac99cd914acb0ba61c22f31b315ef13be5504f3cb43dea1fa84abb2142c8a1ba9e98e037e0d9d2765e8d85bd12903b03a86538d7638ceb6ac5c9 - -### Client binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-client-darwin-386.tar.gz) | 03332cd70ce6a9c8e533d93d694da32b549bef486cf73c649bcb1c85fc314b0ac0f95e035de7b54c81112c1ac39029abeb8f246d359384bde2119ea5ea3ebe66 -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-client-darwin-amd64.tar.gz) | e82c2908366cc27cbc1d72f89fdc13414b484dfdf26c39c6180bf2e5734169cc97d77a2d1ac051cdb153582a38f4805e5c5b5b8eb88022c914ffb4ef2a8202d3 -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-client-linux-386.tar.gz) | 948be72e8162ee109c670a88c443ba0907acfd0ffb64df62afe41762717bc2fb9308cbc4eb2012a14e0203197e8576e3700ad9f105379841d46acafad2a4c6dc -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-client-linux-amd64.tar.gz) | 54e1980b6967dab1e70be2b4df0cd0171f04c92f12dcdf80908b087facb9d5cc1399a7d9455a4a799daa8e9d48b6ad86cb3666a131e5adfcd36b008d25138fa3 -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-client-linux-arm.tar.gz) | 4edcd2e1a866a16b8b0f6228f93b4a61cdd43dca36dcb53a5dbd865cc5a143ef6fd3b8575925acc8af17cff21dee993df9b88db5724320e7b420ca9d0427677f -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-client-linux-arm64.tar.gz) | 138b215e35cfb5d05bda766763e92352171e018a090d516dbf0c280588c5e6f36228163a75a8147c7bac46e773ad0353daaf550d8fa0e91b1e05c5bc0242531c -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-client-linux-ppc64le.tar.gz) | 3b8e7f5f1f2e34df5dbb06c12f07f660a2a732846c56d0f4b0a939b8121361d381325565bdda3182ef8951f4c2513a2c255940f97011034063ffb506d5aedeab -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-client-linux-s390x.tar.gz) | b695cc0695bd324c51084e64bea113aaad3c0b5ba44b5d122db9da6e359a4108008a80944cbe96c405bd2cf57f5f31b3eaf50f33c23d980bdb9f272937c88d1c -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-client-windows-386.tar.gz) | 8e370a66545cdebe0ae0816afe361c7579c7c6e8ee5652e4e01c6fcc3d6d2a6557101be39be24ceb14302fb30855730894a17f6ae11586759257f12406c653e2 -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-client-windows-amd64.tar.gz) | 89e0fe5aac33c991891b08e5a3891ecbda3e038f0ee6a5cdd771ea294ec84292bd5f65f1a895f23e6892ec28f001f66d0166d204bf135cb1aa467ae56ccc1260 - -### Server binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-server-linux-amd64.tar.gz) | 2b0a1b107bf31913d9deec57eab9d3db2ea512c995ce3b4fe247f91c36fdebcc4484a2f8ff53d40a5bc6a04c7144827b85b40ac90c46a9b0cec8a680700f1b1c -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-server-linux-arm.tar.gz) | 2f1ab3bcacd82a9b6d92e09b7cdd63f57fc44623cdfb517512b634264fed87999d78b8571c7930839381b1ed4793b68343e85956d7a8c5bae77ba8f8ade06afa -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-server-linux-arm64.tar.gz) | ea67613c8356f650891a096881546afb27f00e86a9c777617817583628d38b4725f0f65da3b0732414cbc8f97316b3029a355177342a4b1d94cf02d79542e4cd -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-server-linux-ppc64le.tar.gz) | d1b151f3f47c28ead2304d2477fa25f24d12e3fd80e9d1b3b593db99b9a1c5821db4d089f4f1dd041796ea3fd814000c225a7e75aac1e5891a4e16517bcaceee -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-server-linux-s390x.tar.gz) | 69bf215fdc3ad53834eaa9a918452feb0803dffe381b6e03b73141364a697a576e5ed0242d448616707cb386190c21564fe89f8cf3409a7c621a86d86b2c7680 - -### Node binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-node-linux-amd64.tar.gz) | 88ae137316bab3bb1dcb6c78a4d725face618d41714400505b97ce9d3fa37a6caa036b9e8508ade6dd679e3a8c483a32aef9e400ab08d86b6bf39bc13f34e435 -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-node-linux-arm.tar.gz) | 7eaaf2a2a4ee5181cb4c1567e99b8bf82a3da342799f5d2b34dd7f133313c3e3d2ac5a778110e178161788cb226bd64836fba35fbec21c8384e7725cae9b756c -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-node-linux-arm64.tar.gz) | 4f0ef95abc52da0e5d0c40434f8c324ddfb218a577114c4ead00f2ac1c01439922aee6fe347f702927a73b0166cd8b9f4c491d3a18a1a951d24c9ea7259d2655 -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-node-linux-ppc64le.tar.gz) | 0424896e2fedae3a566a5aa2e4af26977a578066d49e3ad66307839c2d2dd1c53d1afcf16b2f6cebf0c74d2d60dbc118e6446d9c02aaab27e95b3a6d26889f51 -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-node-linux-s390x.tar.gz) | 294788687a6e6d1ca2e4d56435b1174e4330abe64cc58b1372c3b9caaab4455586da4e3bfc62616b52ea7d678561fb77ce1f8d0023fd7d1e75e1db348c69939c -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.2/kubernetes-node-windows-amd64.tar.gz) | 61389f8c05c682102e3432a2f05f41b11d531124f61443429627f94ef6e970d44240d44d32aa467b814de0b54a17208b2d2696602ba5dd6d30f64db964900230 - -## Changelog since v1.19.0-rc.1 - -## Changes by Kind - -### API Change - -- A new alpha-level field, `SupportsFsGroup`, has been introduced for CSIDrivers to allow them to specify whether they support volume ownership and permission modifications. The `CSIVolumeSupportFSGroup` feature gate must be enabled to allow this field to be used. ([#92001](https://github.com/kubernetes/kubernetes/pull/92001), [@huffmanca](https://github.com/huffmanca)) [SIG API Machinery, CLI and Storage] -- The kube-controller-manager managed signers can now have distinct signing certificates and keys. See the help about `--cluster-signing-[signer-name]-{cert,key}-file`. `--cluster-signing-{cert,key}-file` is still the default. ([#90822](https://github.com/kubernetes/kubernetes/pull/90822), [@deads2k](https://github.com/deads2k)) [SIG API Machinery, Apps and Auth] - -### Feature - -- Added kube-apiserver metrics: apiserver_current_inflight_request_measures and, when API Priority and Fairness is enable, windowed_request_stats. ([#91177](https://github.com/kubernetes/kubernetes/pull/91177), [@MikeSpreitzer](https://github.com/MikeSpreitzer)) [SIG API Machinery, Instrumentation and Testing] -- Rename pod_preemption_metrics to preemption_metrics. ([#93256](https://github.com/kubernetes/kubernetes/pull/93256), [@ahg-g](https://github.com/ahg-g)) [SIG Instrumentation and Scheduling] - -### Bug or Regression + Before: + `FROM ${base_image}` + After: + `FROM --platform=linux/${arch} ${base_image}` ([#94552](https://github.com/kubernetes/kubernetes/pull/94552), [@justaugustus](https://github.com/justaugustus)) [SIG Release] +- CSIDriver object can be deployed during volume attachment. ([#93710](https://github.com/kubernetes/kubernetes/pull/93710), [@Jiawei0227](https://github.com/Jiawei0227)) [SIG Apps, Node, Storage and Testing] +- CVE-2020-8557 (Medium): Node-local denial of service via container /etc/hosts file. See https://github.com/kubernetes/kubernetes/issues/93032 for more details. ([#92916](https://github.com/kubernetes/kubernetes/pull/92916), [@joelsmith](https://github.com/joelsmith)) [SIG Node] - Do not add nodes labeled with kubernetes.azure.com/managed=false to backend pool of load balancer. ([#93034](https://github.com/kubernetes/kubernetes/pull/93034), [@matthias50](https://github.com/matthias50)) [SIG Cloud Provider] +- Do not fail sorting empty elements. ([#94666](https://github.com/kubernetes/kubernetes/pull/94666), [@soltysh](https://github.com/soltysh)) [SIG CLI] - Do not retry volume expansion if CSI driver returns FailedPrecondition error ([#92986](https://github.com/kubernetes/kubernetes/pull/92986), [@gnufied](https://github.com/gnufied)) [SIG Node and Storage] +- Dockershim security: pod sandbox now always run with `no-new-privileges` and `runtime/default` seccomp profile + dockershim seccomp: custom profiles can now have smaller seccomp profiles when set at pod level ([#90948](https://github.com/kubernetes/kubernetes/pull/90948), [@pjbgf](https://github.com/pjbgf)) [SIG Node] +- Dual-stack: make nodeipam compatible with existing single-stack clusters when dual-stack feature gate become enabled by default ([#90439](https://github.com/kubernetes/kubernetes/pull/90439), [@SataQiu](https://github.com/SataQiu)) [SIG API Machinery] +- Endpoint controller requeues service after an endpoint deletion event occurs to confirm that deleted endpoints are undesired to mitigate the effects of an out of sync endpoint cache. ([#93030](https://github.com/kubernetes/kubernetes/pull/93030), [@swetharepakula](https://github.com/swetharepakula)) [SIG Apps and Network] +- EndpointSlice controllers now return immediately if they encounter an error creating, updating, or deleting resources. ([#93908](https://github.com/kubernetes/kubernetes/pull/93908), [@robscott](https://github.com/robscott)) [SIG Apps and Network] +- EndpointSliceMirroring controller now copies labels from Endpoints to EndpointSlices. ([#93442](https://github.com/kubernetes/kubernetes/pull/93442), [@robscott](https://github.com/robscott)) [SIG Apps and Network] +- EndpointSliceMirroring controller now mirrors Endpoints that do not have a Service associated with them. ([#94171](https://github.com/kubernetes/kubernetes/pull/94171), [@robscott](https://github.com/robscott)) [SIG Apps, Network and Testing] +- Ensure backoff step is set to 1 for Azure armclient. ([#94180](https://github.com/kubernetes/kubernetes/pull/94180), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] +- Ensure getPrimaryInterfaceID not panic when network interfaces for Azure VMSS are null ([#94355](https://github.com/kubernetes/kubernetes/pull/94355), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] +- Eviction requests for pods that have a non-zero DeletionTimestamp will always succeed ([#91342](https://github.com/kubernetes/kubernetes/pull/91342), [@michaelgugino](https://github.com/michaelgugino)) [SIG Apps] +- Extended DSR loadbalancer feature in winkernel kube-proxy to HNS versions 9.3-9.max, 10.2+ ([#93080](https://github.com/kubernetes/kubernetes/pull/93080), [@elweb9858](https://github.com/elweb9858)) [SIG Network] +- Fix HandleCrash order ([#93108](https://github.com/kubernetes/kubernetes/pull/93108), [@lixiaobing1](https://github.com/lixiaobing1)) [SIG API Machinery] +- Fix a concurrent map writes error in kubelet ([#93773](https://github.com/kubernetes/kubernetes/pull/93773), [@knight42](https://github.com/knight42)) [SIG Node] +- Fix a regression where kubeadm bails out with a fatal error when an optional version command line argument is supplied to the "kubeadm upgrade plan" command ([#94421](https://github.com/kubernetes/kubernetes/pull/94421), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] +- Fix azure file migration panic ([#94853](https://github.com/kubernetes/kubernetes/pull/94853), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fix bug where loadbalancer deletion gets stuck because of missing resource group #75198 ([#93962](https://github.com/kubernetes/kubernetes/pull/93962), [@phiphi282](https://github.com/phiphi282)) [SIG Cloud Provider] +- Fix calling AttachDisk on a previously attached EBS volume ([#93567](https://github.com/kubernetes/kubernetes/pull/93567), [@gnufied](https://github.com/gnufied)) [SIG Cloud Provider, Storage and Testing] +- Fix detection of image filesystem, disk metrics for devicemapper, detection of OOM Kills on 5.0+ linux kernels. ([#92919](https://github.com/kubernetes/kubernetes/pull/92919), [@dashpole](https://github.com/dashpole)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Node] +- Fix etcd_object_counts metric reported by kube-apiserver ([#94773](https://github.com/kubernetes/kubernetes/pull/94773), [@tkashem](https://github.com/tkashem)) [SIG API Machinery] +- Fix incorrectly reported verbs for kube-apiserver metrics for CRD objects ([#93523](https://github.com/kubernetes/kubernetes/pull/93523), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Instrumentation] +- Fix instance not found issues when an Azure Node is recreated in a short time ([#93316](https://github.com/kubernetes/kubernetes/pull/93316), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] +- Fix kube-apiserver /readyz to contain "informer-sync" check ensuring that internal informers are synced. ([#93670](https://github.com/kubernetes/kubernetes/pull/93670), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Testing] +- Fix kubectl SchemaError on CRDs with schema using x-kubernetes-preserve-unknown-fields on array types. ([#94888](https://github.com/kubernetes/kubernetes/pull/94888), [@sttts](https://github.com/sttts)) [SIG API Machinery] +- Fix memory leak in EndpointSliceTracker for EndpointSliceMirroring controller. ([#93441](https://github.com/kubernetes/kubernetes/pull/93441), [@robscott](https://github.com/robscott)) [SIG Apps and Network] +- Fix missing csi annotations on node during parallel csinode update. ([#94389](https://github.com/kubernetes/kubernetes/pull/94389), [@pacoxu](https://github.com/pacoxu)) [SIG Storage] +- Fix the `cloudprovider_azure_api_request_duration_seconds` metric buckets to correctly capture the latency metrics. Previously, the majority of the calls would fall in the "+Inf" bucket. ([#94873](https://github.com/kubernetes/kubernetes/pull/94873), [@marwanad](https://github.com/marwanad)) [SIG Cloud Provider and Instrumentation] +- Fix: azure disk resize error if source does not exist ([#93011](https://github.com/kubernetes/kubernetes/pull/93011), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fix: detach azure disk broken on Azure Stack ([#94885](https://github.com/kubernetes/kubernetes/pull/94885), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] - Fix: determine the correct ip config based on ip family ([#93043](https://github.com/kubernetes/kubernetes/pull/93043), [@aramase](https://github.com/aramase)) [SIG Cloud Provider] - Fix: initial delay in mounting azure disk & file ([#93052](https://github.com/kubernetes/kubernetes/pull/93052), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] +- Fix: use sensitiveOptions on Windows mount ([#94126](https://github.com/kubernetes/kubernetes/pull/94126), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] +- Fixed Ceph RBD volume expansion when no ceph.conf exists ([#92027](https://github.com/kubernetes/kubernetes/pull/92027), [@juliantaylor](https://github.com/juliantaylor)) [SIG Storage] +- Fixed a bug where improper storage and comparison of endpoints led to excessive API traffic from the endpoints controller ([#94112](https://github.com/kubernetes/kubernetes/pull/94112), [@damemi](https://github.com/damemi)) [SIG Apps, Network and Testing] +- Fixed a bug whereby the allocation of reusable CPUs and devices was not being honored when the TopologyManager was enabled ([#93189](https://github.com/kubernetes/kubernetes/pull/93189), [@klueska](https://github.com/klueska)) [SIG Node] +- Fixed a panic in kubectl debug when pod has multiple init containers or ephemeral containers ([#94580](https://github.com/kubernetes/kubernetes/pull/94580), [@kiyoshim55](https://github.com/kiyoshim55)) [SIG CLI] +- Fixed a regression that sometimes prevented `kubectl portforward` to work when TCP and UDP services were configured on the same port ([#94728](https://github.com/kubernetes/kubernetes/pull/94728), [@amorenoz](https://github.com/amorenoz)) [SIG CLI] +- Fixed bug in reflector that couldn't recover from "Too large resource version" errors with API servers 1.17.0-1.18.5 ([#94316](https://github.com/kubernetes/kubernetes/pull/94316), [@janeczku](https://github.com/janeczku)) [SIG API Machinery] +- Fixed bug where kubectl top pod output is not sorted when --sort-by and --containers flags are used together ([#93692](https://github.com/kubernetes/kubernetes/pull/93692), [@brianpursley](https://github.com/brianpursley)) [SIG CLI] +- Fixed kubelet creating extra sandbox for pods with RestartPolicyOnFailure after all containers succeeded ([#92614](https://github.com/kubernetes/kubernetes/pull/92614), [@tnqn](https://github.com/tnqn)) [SIG Node and Testing] +- Fixed memory leak in endpointSliceTracker ([#92838](https://github.com/kubernetes/kubernetes/pull/92838), [@tnqn](https://github.com/tnqn)) [SIG Apps and Network] +- Fixed node data lost in kube-scheduler for clusters with imbalance on number of nodes across zones ([#93355](https://github.com/kubernetes/kubernetes/pull/93355), [@maelk](https://github.com/maelk)) [SIG Scheduling] - Fixed the EndpointSliceController to correctly create endpoints for IPv6-only pods. - + Fixed the EndpointController to allow IPv6 headless services, if the IPv6DualStack feature gate is enabled, by specifying `ipFamily: IPv6` on the service. (This already worked with the EndpointSliceController.) ([#91399](https://github.com/kubernetes/kubernetes/pull/91399), [@danwinship](https://github.com/danwinship)) [SIG Apps and Network] +- Fixes a bug evicting pods after a taint with a limited tolerationSeconds toleration is removed from a node ([#93722](https://github.com/kubernetes/kubernetes/pull/93722), [@liggitt](https://github.com/liggitt)) [SIG Apps and Node] +- Fixes a bug where EndpointSlices would not be recreated after rapid Service recreation. ([#94730](https://github.com/kubernetes/kubernetes/pull/94730), [@robscott](https://github.com/robscott)) [SIG Apps, Network and Testing] +- Fixes a race condition in kubelet pod handling ([#94751](https://github.com/kubernetes/kubernetes/pull/94751), [@auxten](https://github.com/auxten)) [SIG Node] +- Fixes an issue proxying to ipv6 pods without specifying a port ([#94834](https://github.com/kubernetes/kubernetes/pull/94834), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Network] +- Fixes an issue that can result in namespaced custom resources being orphaned when their namespace is deleted, if the CRD defining the custom resource is removed concurrently with namespaces being deleted, then recreated. ([#93790](https://github.com/kubernetes/kubernetes/pull/93790), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Apps] +- Ignore root user check when windows pod starts ([#92355](https://github.com/kubernetes/kubernetes/pull/92355), [@wawa0210](https://github.com/wawa0210)) [SIG Node and Windows] +- Increased maximum IOPS of AWS EBS io1 volumes to 64,000 (current AWS maximum). ([#90014](https://github.com/kubernetes/kubernetes/pull/90014), [@jacobmarble](https://github.com/jacobmarble)) [SIG Cloud Provider and Storage] +- K8s.io/apimachinery: runtime.DefaultUnstructuredConverter.FromUnstructured now handles converting integer fields to typed float values ([#93250](https://github.com/kubernetes/kubernetes/pull/93250), [@liggitt](https://github.com/liggitt)) [SIG API Machinery] +- Kube-aggregator certificates are dynamically loaded on change from disk ([#92791](https://github.com/kubernetes/kubernetes/pull/92791), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery] +- Kube-apiserver: fixed a bug returning inconsistent results from list requests which set a field or label selector and set a paging limit ([#94002](https://github.com/kubernetes/kubernetes/pull/94002), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery] +- Kube-apiserver: jsonpath expressions with consecutive recursive descent operators are no longer evaluated for custom resource printer columns ([#93408](https://github.com/kubernetes/kubernetes/pull/93408), [@joelsmith](https://github.com/joelsmith)) [SIG API Machinery] +- Kube-proxy now trims extra spaces found in loadBalancerSourceRanges to match Service validation. ([#94107](https://github.com/kubernetes/kubernetes/pull/94107), [@robscott](https://github.com/robscott)) [SIG Network] +- Kube-up now includes CoreDNS version v1.7.0. Some of the major changes include: + - Fixed a bug that could cause CoreDNS to stop updating service records. + - Fixed a bug in the forward plugin where only the first upstream server is always selected no matter which policy is set. + - Remove already deprecated options `resyncperiod` and `upstream` in the Kubernetes plugin. + - Includes Prometheus metrics name changes (to bring them in line with standard Prometheus metrics naming convention). They will be backward incompatible with existing reporting formulas that use the old metrics' names. + - The federation plugin (allows for v1 Kubernetes federation) has been removed. + More details are available in https://coredns.io/2020/06/15/coredns-1.7.0-release/ ([#92718](https://github.com/kubernetes/kubernetes/pull/92718), [@rajansandeep](https://github.com/rajansandeep)) [SIG Cloud Provider] +- Kubeadm now makes sure the etcd manifest is regenerated upon upgrade even when no etcd version change takes place ([#94395](https://github.com/kubernetes/kubernetes/pull/94395), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] +- Kubeadm: avoid a panic when determining if the running version of CoreDNS is supported during upgrades ([#94299](https://github.com/kubernetes/kubernetes/pull/94299), [@zouyee](https://github.com/zouyee)) [SIG Cluster Lifecycle] +- Kubeadm: ensure "kubeadm reset" does not unmount the root "/var/lib/kubelet" directory if it is mounted by the user ([#93702](https://github.com/kubernetes/kubernetes/pull/93702), [@thtanaka](https://github.com/thtanaka)) [SIG Cluster Lifecycle] +- Kubeadm: ensure the etcd data directory is created with 0700 permissions during control-plane init and join ([#94102](https://github.com/kubernetes/kubernetes/pull/94102), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubeadm: fix the bug that kubeadm tries to call 'docker info' even if the CRI socket was for another CR ([#94555](https://github.com/kubernetes/kubernetes/pull/94555), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] +- Kubeadm: make the kubeconfig files for the kube-controller-manager and kube-scheduler use the LocalAPIEndpoint instead of the ControlPlaneEndpoint. This makes kubeadm clusters more reseliant to version skew problems during immutable upgrades: https://kubernetes.io/docs/setup/release/version-skew-policy/#kube-controller-manager-kube-scheduler-and-cloud-controller-manager ([#94398](https://github.com/kubernetes/kubernetes/pull/94398), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubeadm: relax the validation of kubeconfig server URLs. Allow the user to define custom kubeconfig server URLs without erroring out during validation of existing kubeconfig files (e.g. when using external CA mode). ([#94816](https://github.com/kubernetes/kubernetes/pull/94816), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubeadm: remove duplicate DNS names and IP addresses from generated certificates ([#92753](https://github.com/kubernetes/kubernetes/pull/92753), [@QianChenglong](https://github.com/QianChenglong)) [SIG Cluster Lifecycle] +- Kubelet: assume that swap is disabled when `/proc/swaps` does not exist ([#93931](https://github.com/kubernetes/kubernetes/pull/93931), [@SataQiu](https://github.com/SataQiu)) [SIG Node] +- Kubelet: fix race condition in pluginWatcher ([#93622](https://github.com/kubernetes/kubernetes/pull/93622), [@knight42](https://github.com/knight42)) [SIG Node] +- Kuberuntime security: pod sandbox now always runs with `runtime/default` seccomp profile + kuberuntime seccomp: custom profiles can now have smaller seccomp profiles when set at pod level ([#90949](https://github.com/kubernetes/kubernetes/pull/90949), [@pjbgf](https://github.com/pjbgf)) [SIG Node] +- NONE ([#71269](https://github.com/kubernetes/kubernetes/pull/71269), [@DeliangFan](https://github.com/DeliangFan)) [SIG Node] +- New Azure instance types do now have correct max data disk count information. ([#94340](https://github.com/kubernetes/kubernetes/pull/94340), [@ialidzhikov](https://github.com/ialidzhikov)) [SIG Cloud Provider and Storage] +- Pods with invalid Affinity/AntiAffinity LabelSelectors will now fail scheduling when these plugins are enabled ([#93660](https://github.com/kubernetes/kubernetes/pull/93660), [@damemi](https://github.com/damemi)) [SIG Scheduling] +- Require feature flag CustomCPUCFSQuotaPeriod if setting a non-default cpuCFSQuotaPeriod in kubelet config. ([#94687](https://github.com/kubernetes/kubernetes/pull/94687), [@karan](https://github.com/karan)) [SIG Node] +- Reverted devicemanager for Windows node added in 1.19rc1. ([#93263](https://github.com/kubernetes/kubernetes/pull/93263), [@liggitt](https://github.com/liggitt)) [SIG Node and Windows] +- Scheduler bugfix: Scheduler doesn't lose pod information when nodes are quickly recreated. This could happen when nodes are restarted or quickly recreated reusing a nodename. ([#93938](https://github.com/kubernetes/kubernetes/pull/93938), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scalability, Scheduling and Testing] +- The EndpointSlice controller now waits for EndpointSlice and Node caches to be synced before starting. ([#94086](https://github.com/kubernetes/kubernetes/pull/94086), [@robscott](https://github.com/robscott)) [SIG Apps and Network] +- The `/debug/api_priority_and_fairness/dump_requests` path at an apiserver will no longer return a phantom line for each exempt priority level. ([#93406](https://github.com/kubernetes/kubernetes/pull/93406), [@MikeSpreitzer](https://github.com/MikeSpreitzer)) [SIG API Machinery] +- The kubelet recognizes the --containerd-namespace flag to configure the namespace used by cadvisor. ([#87054](https://github.com/kubernetes/kubernetes/pull/87054), [@changyaowei](https://github.com/changyaowei)) [SIG Node] +- The terminationGracePeriodSeconds from pod spec is respected for the mirror pod. ([#92442](https://github.com/kubernetes/kubernetes/pull/92442), [@tedyu](https://github.com/tedyu)) [SIG Node and Testing] +- Update Calico to v3.15.2 ([#94241](https://github.com/kubernetes/kubernetes/pull/94241), [@lmm](https://github.com/lmm)) [SIG Cloud Provider] +- Update default etcd server version to 3.4.13 ([#94287](https://github.com/kubernetes/kubernetes/pull/94287), [@jingyih](https://github.com/jingyih)) [SIG API Machinery, Cloud Provider, Cluster Lifecycle and Testing] +- Updated Cluster Autoscaler to 1.19.0; ([#93577](https://github.com/kubernetes/kubernetes/pull/93577), [@vivekbagade](https://github.com/vivekbagade)) [SIG Autoscaling and Cloud Provider] +- Use NLB Subnet CIDRs instead of VPC CIDRs in Health Check SG Rules ([#93515](https://github.com/kubernetes/kubernetes/pull/93515), [@t0rr3sp3dr0](https://github.com/t0rr3sp3dr0)) [SIG Cloud Provider] +- Users will see increase in time for deletion of pods and also guarantee that removal of pod from api server would mean deletion of all the resources from container runtime. ([#92817](https://github.com/kubernetes/kubernetes/pull/92817), [@kmala](https://github.com/kmala)) [SIG Node] +- Very large patches may now be specified to `kubectl patch` with the `--patch-file` flag instead of including them directly on the command line. The `--patch` and `--patch-file` flags are mutually exclusive. ([#93548](https://github.com/kubernetes/kubernetes/pull/93548), [@smarterclayton](https://github.com/smarterclayton)) [SIG CLI] +- When creating a networking.k8s.io/v1 Ingress API object, `spec.rules[*].http` values are now validated consistently when the `host` field contains a wildcard. ([#93954](https://github.com/kubernetes/kubernetes/pull/93954), [@Miciah](https://github.com/Miciah)) [SIG CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Storage and Testing] ### Other (Cleanup or Flake) +- --cache-dir sets cache directory for both http and discovery, defaults to $HOME/.kube/cache ([#92910](https://github.com/kubernetes/kubernetes/pull/92910), [@soltysh](https://github.com/soltysh)) [SIG API Machinery and CLI] +- Adds a bootstrapping ClusterRole, ClusterRoleBinding and group for /metrics, /livez/*, /readyz/*, & /healthz/- endpoints. ([#93311](https://github.com/kubernetes/kubernetes/pull/93311), [@logicalhan](https://github.com/logicalhan)) [SIG API Machinery, Auth, Cloud Provider and Instrumentation] +- Base-images: Update to debian-iptables:buster-v1.3.0 + - Uses iptables 1.8.5 + - base-images: Update to debian-base:buster-v1.2.0 + - cluster/images/etcd: Build etcd:3.4.13-1 image + - Uses debian-base:buster-v1.2.0 ([#94733](https://github.com/kubernetes/kubernetes/pull/94733), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery, Release and Testing] +- Build: Update to debian-base@v2.1.2 and debian-iptables@v12.1.1 ([#93667](https://github.com/kubernetes/kubernetes/pull/93667), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery, Release and Testing] +- Build: Update to debian-base@v2.1.3 and debian-iptables@v12.1.2 ([#93916](https://github.com/kubernetes/kubernetes/pull/93916), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery, Release and Testing] +- Build: Update to go-runner:buster-v2.0.0 ([#94167](https://github.com/kubernetes/kubernetes/pull/94167), [@justaugustus](https://github.com/justaugustus)) [SIG Release] +- Fix kubelet to properly log when a container is started. Before, sometimes the log said that a container is dead and was restarted when it was started for the first time. This only happened when using pods with initContainers and regular containers. ([#91469](https://github.com/kubernetes/kubernetes/pull/91469), [@rata](https://github.com/rata)) [SIG Node] +- Fix: license issue in blob disk feature ([#92824](https://github.com/kubernetes/kubernetes/pull/92824), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] +- Fixes the flooding warning messages about setting volume ownership for configmap/secret volumes ([#92878](https://github.com/kubernetes/kubernetes/pull/92878), [@jvanz](https://github.com/jvanz)) [SIG Instrumentation, Node and Storage] +- Fixes the message about no auth for metrics in scheduler. ([#94035](https://github.com/kubernetes/kubernetes/pull/94035), [@zhouya0](https://github.com/zhouya0)) [SIG Scheduling] - Kube-up: defaults to limiting critical pods to the kube-system namespace to match behavior prior to 1.17 ([#93121](https://github.com/kubernetes/kubernetes/pull/93121), [@liggitt](https://github.com/liggitt)) [SIG Cloud Provider and Scheduling] +- Kubeadm: Separate argument key/value in log msg ([#94016](https://github.com/kubernetes/kubernetes/pull/94016), [@mrueg](https://github.com/mrueg)) [SIG Cluster Lifecycle] +- Kubeadm: remove support for the "ci/k8s-master" version label. This label has been removed in the Kubernetes CI release process and would no longer work in kubeadm. You can use the "ci/latest" version label instead. See kubernetes/test-infra#18517 ([#93626](https://github.com/kubernetes/kubernetes/pull/93626), [@vikkyomkar](https://github.com/vikkyomkar)) [SIG Cluster Lifecycle] +- Kubeadm: remove the CoreDNS check for known image digests when applying the addon ([#94506](https://github.com/kubernetes/kubernetes/pull/94506), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] +- Kubernetes is now built with go1.15.0 ([#93939](https://github.com/kubernetes/kubernetes/pull/93939), [@justaugustus](https://github.com/justaugustus)) [SIG Release and Testing] +- Kubernetes is now built with go1.15.0-rc.2 ([#93827](https://github.com/kubernetes/kubernetes/pull/93827), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Node, Release and Testing] +- Lock ExternalPolicyForExternalIP to default, this feature gate will be removed in 1.22. ([#94581](https://github.com/kubernetes/kubernetes/pull/94581), [@knabben](https://github.com/knabben)) [SIG Network] +- Service.beta.kubernetes.io/azure-load-balancer-disable-tcp-reset is removed. All Standard load balancers will always enable tcp resets. ([#94297](https://github.com/kubernetes/kubernetes/pull/94297), [@MarcPow](https://github.com/MarcPow)) [SIG Cloud Provider] +- Stop propagating SelfLink (deprecated in 1.16) in kube-apiserver ([#94397](https://github.com/kubernetes/kubernetes/pull/94397), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Testing] +- Strip unnecessary security contexts on Windows ([#93475](https://github.com/kubernetes/kubernetes/pull/93475), [@ravisantoshgudimetla](https://github.com/ravisantoshgudimetla)) [SIG Node, Testing and Windows] +- To ensure the code be strong, add unit test for GetAddressAndDialer ([#93180](https://github.com/kubernetes/kubernetes/pull/93180), [@FreeZhang61](https://github.com/FreeZhang61)) [SIG Node] +- Update CNI plugins to v0.8.7 ([#94367](https://github.com/kubernetes/kubernetes/pull/94367), [@justaugustus](https://github.com/justaugustus)) [SIG Cloud Provider, Network, Node, Release and Testing] - Update Golang to v1.14.5 - Update repo-infra to 0.0.7 (to support go1.14.5 and go1.13.13) - Includes: @@ -1418,1186 +2090,52 @@ filename | sha512 hash - Includes: - bazelbuild/bazel-toolchains@3.4.0 - bazelbuild/rules_go@v0.22.8 ([#93198](https://github.com/kubernetes/kubernetes/pull/93198), [@justaugustus](https://github.com/justaugustus)) [SIG Release and Testing] +- Update cri-tools to [v1.19.0](https://github.com/kubernetes-sigs/cri-tools/releases/tag/v1.19.0) ([#94307](https://github.com/kubernetes/kubernetes/pull/94307), [@xmudrii](https://github.com/xmudrii)) [SIG Cloud Provider] - Update default etcd server version to 3.4.9 ([#92349](https://github.com/kubernetes/kubernetes/pull/92349), [@jingyih](https://github.com/jingyih)) [SIG API Machinery, Cloud Provider, Cluster Lifecycle and Testing] +- Update etcd client side to v3.4.13 ([#94259](https://github.com/kubernetes/kubernetes/pull/94259), [@jingyih](https://github.com/jingyih)) [SIG API Machinery and Cloud Provider] +- `kubectl get ingress` now prefers the `networking.k8s.io/v1` over `extensions/v1beta1` (deprecated since v1.14). To explicitly request the deprecated version, use `kubectl get ingress.v1beta1.extensions`. ([#94309](https://github.com/kubernetes/kubernetes/pull/94309), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and CLI] ## Dependencies ### Added -_Nothing has changed._ - -### Changed -- go.etcd.io/etcd: 54ba958 → 18dfb9c -- k8s.io/utils: 6e3d28b → 0bdb4ca - -### Removed -_Nothing has changed._ - - - -# v1.19.0-rc.1 - - -## Downloads for v1.19.0-rc.1 - -### Source Code - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes.tar.gz) | d4bc1d86ff77a1a8695091207b8181a246c8964ae1dd8967392aae95197c0339c7915a016c017ecab0b9d203b3205221ca766ce568d7ee52947e7f50f057af4f -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-src.tar.gz) | 79af4e01b0d5432f92b026730a0c60523069d312858c30fdcaeaf6ee159c71f3413a5075d82c0acd9b135b7a06d5ecb0c0d38b8a8d0f301a9d9bffb35d22f029 - -### Client binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-client-darwin-386.tar.gz) | 7d21bf9733810659576e67986d129208894adea3c571de662dbf80fb822e18abfc1644ea60a4e5fbe244a23b56aa973b76dafe789ead1bf7539f41bdd9bca886 -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-client-darwin-amd64.tar.gz) | b4622e06c09bb08a0dc0115bfcd991c50459c7b772889820648ed1c05a425605d10b71b92c58c119b77baa3bca209f9c75827d2cde69d128a5cfcada5f37be39 -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-client-linux-386.tar.gz) | f51032ad605543f68a2a4da3bede1f3e7be0dd63b03b751fef5f133e8d64bec02bfe7433b75e3d0c4ae122d4e0cf009095800c638d2cc81f6fb81b488f5a6dab -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-client-linux-amd64.tar.gz) | 48489d22969f69a5015988e596d597c64ea18675649afe55ad119dbbe98ba9a4104d5e323704cf1f3cbdfca3feac629d3813e260a330a72da12f1a794d054f76 -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-client-linux-arm.tar.gz) | d9f8a6f6f3d09be9c08588c2b5153a4d8cc9db496bde3da2f3af472c260566d1391cd8811f2c05d4f302db849a38432f25228d9bbb59aaaf0dfba64b33f8ee8e -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-client-linux-arm64.tar.gz) | 1c3590750a3f02e0e5845e1135cc3ab990309bdecfe64c089842a134eae57b573488531696796185ed12dde2d6f95d2e3656dd9893d04cd0adbe025513ffff30 -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-client-linux-ppc64le.tar.gz) | 158a562d5dbbe90cd56b5d757823adda1919e9b5db8005fb6e2523358e5a20628d55ec1903c0e317a0d8ac9b9a649eea23d9ea746db22b73d6d580ae8c067077 -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-client-linux-s390x.tar.gz) | 47c140567dc593caf065f295ed6006efcde010a526a96c8d3ef5f3d9a9dc6b413bc197dc822648067fe16299908ada7046c2a8a3213d4296b04b51a264ad40e9 -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-client-windows-386.tar.gz) | e25d7d4ad3e6f6e6cfba181c5871e56de2751f88b640502745f6693ddd86ccd7eef8aebaa30955afdbbd0320a5b51d4e9e17f71baab37a470aac284178a0e21c -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-client-windows-amd64.tar.gz) | fd8463b04b5d7f115104245fa1dd53de6656b349dad4cfd55f239012d4f2c1a8e35aa3f3554138df9ddfea9d7702b51a249f6db698c0cea7c36e5bc98a017fe7 - -### Server binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-server-linux-amd64.tar.gz) | 96acce78bba3779bef616de28da5d75bc4dc0b52fe0bf03b169c469ade9a8cd38b19c4620d222d67bff9ceeb0c5ebf893f55c1de02356bcebe5689890d0478f7 -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-server-linux-arm.tar.gz) | 1e561f3edbc66d2ab7f6f1ffe8dc1c01cec13ee3ba700458bd5d87202723cc832f3305a864a3b569463c96d60c9f60c03b77f210663cc40589e40515b3a32e75 -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-server-linux-arm64.tar.gz) | ba8fc011ac0e54cb1a0e0e3ee5f1cff4d877f4fdd75e15bf25b1cf817b3cf2bc85f9809d3cc76e9145f07a837960843ca68bdf02fe970c0043fc9ff7b53da021 -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-server-linux-ppc64le.tar.gz) | 1f506676284ab2f6bd3fc8a29a062f4fddf5346ef30be9363f640467c64011144381180c5bf74ec885d2f54524e82e21c745c5d2f1b191948bc40db2a09a2900 -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-server-linux-s390x.tar.gz) | 5a7101288d51297c3346d028176b4b997afd8652d6481cec82f8863a91209fec6e8a9286a9bd7543b428e6ef82c1c68a7ce0782191c4682634015a032f749554 - -### Node binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-node-linux-amd64.tar.gz) | 6852edc9818cb51a7e738e44a8bca2290777320e62518c024962fddd05f7ef390fb5696537068fd75e340bae909602f0bbc2aa5ebf6c487c7b1e990250f16810 -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-node-linux-arm.tar.gz) | f13edad4684d0de61e4cd7e524f891c75e0efe1050911d9bf0ee3a77cac28f57dca68fb990df6b5d9646e9b389527cbb861de10e12a84e57788f339db05936cb -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-node-linux-arm64.tar.gz) | 69480150325525459aed212b8c96cb1865598cb5ecbeb57741134142d65e8a96258ec298b86d533ce88d2c499c4ad17e66dd3f0f7b5e9c34882889e9cb384805 -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-node-linux-ppc64le.tar.gz) | 774cfa9a4319ede166674d3e8c46900c9319d98ffba5b46684244e4bb15d94d31df8a6681e4711bc744d7e92fd23f207505eda98f43c8e2383107badbd43f289 -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-node-linux-s390x.tar.gz) | 7e696988febb1e913129353134191b23c6aa5b0bea7c9c9168116596b827c091a88049ca8b8847dda25ecd4467cca4cc48cae8699635b5e78b83aab482c109f5 -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-rc.1/kubernetes-node-windows-amd64.tar.gz) | 067182292d9e17f0d4974051681bedcf5ed6017dc80485541f89ea1f211085714165941a5262a4997b7bfc2bd190f2255df4c1b39f86a3278487248111d83cd4 - -## Changelog since v1.19.0-rc.0 - -## Urgent Upgrade Notes - -### (No, really, you MUST read this before you upgrade) - - - Azure blob disk feature(`kind`: `Shared`, `Dedicated`) has been deprecated, you should use `kind`: `Managed` in `kubernetes.io/azure-disk` storage class. ([#92905](https://github.com/kubernetes/kubernetes/pull/92905), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] - -## Changes by Kind - -### Deprecation - -- Kubeadm: deprecate the "kubeadm alpha kubelet config enable-dynamic" command. To continue using the feature please defer to the guide for "Dynamic Kubelet Configuration" at k8s.io. ([#92881](https://github.com/kubernetes/kubernetes/pull/92881), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] - -### API Change - -- Added pod version skew strategy for seccomp profile to synchronize the deprecated annotations with the new API Server fields. Please see the corresponding section [in the KEP](https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/20190717-seccomp-ga.mdversion-skew-strategy) for more detailed explanations. ([#91408](https://github.com/kubernetes/kubernetes/pull/91408), [@saschagrunert](https://github.com/saschagrunert)) [SIG Apps, Auth, CLI and Node] -- Custom Endpoints are now mirrored to EndpointSlices by a new EndpointSliceMirroring controller. ([#91637](https://github.com/kubernetes/kubernetes/pull/91637), [@robscott](https://github.com/robscott)) [SIG API Machinery, Apps, Auth, Cloud Provider, Instrumentation, Network and Testing] -- Generic ephemeral volumes, a new alpha feature under the `GenericEphemeralVolume` feature gate, provide a more flexible alternative to `EmptyDir` volumes: as with `EmptyDir`, volumes are created and deleted for each pod automatically by Kubernetes. But because the normal provisioning process is used (`PersistentVolumeClaim`), storage can be provided by third-party storage vendors and all of the usual volume features work. Volumes don't need to be empt; for example, restoring from snapshot is supported. ([#92784](https://github.com/kubernetes/kubernetes/pull/92784), [@pohly](https://github.com/pohly)) [SIG API Machinery, Apps, Auth, CLI, Instrumentation, Node, Scheduling, Storage and Testing] - -### Feature - -- ACTION REQUIRED : In CoreDNS v1.7.0, [metrics names have been changed](https://github.com/coredns/coredns/blob/master/notes/coredns-1.7.0.md#metric-changes) which will be backward incompatible with existing reporting formulas that use the old metrics' names. Adjust your formulas to the new names before upgrading. - - Kubeadm now includes CoreDNS version v1.7.0. Some of the major changes include: - - Fixed a bug that could cause CoreDNS to stop updating service records. - - Fixed a bug in the forward plugin where only the first upstream server is always selected no matter which policy is set. - - Remove already deprecated options `resyncperiod` and `upstream` in the Kubernetes plugin. - - Includes Prometheus metrics name changes (to bring them in line with standard Prometheus metrics naming convention). They will be backward incompatible with existing reporting formulas that use the old metrics' names. - - The federation plugin (allows for v1 Kubernetes federation) has been removed. - More details are available in https://coredns.io/2020/06/15/coredns-1.7.0-release/ ([#92651](https://github.com/kubernetes/kubernetes/pull/92651), [@rajansandeep](https://github.com/rajansandeep)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle and Instrumentation] -- Add tags support for Azure File Driver ([#92825](https://github.com/kubernetes/kubernetes/pull/92825), [@ZeroMagic](https://github.com/ZeroMagic)) [SIG Cloud Provider and Storage] -- Audit events for API requests to deprecated API versions now include a `"k8s.io/deprecated": "true"` audit annotation. If a target removal release is identified, the audit event includes a `"k8s.io/removal-release": "."` audit annotation as well. ([#92842](https://github.com/kubernetes/kubernetes/pull/92842), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Instrumentation] -- Cloud node-controller use InstancesV2 ([#91319](https://github.com/kubernetes/kubernetes/pull/91319), [@gongguan](https://github.com/gongguan)) [SIG Apps, Cloud Provider, Scalability and Storage] -- Kubeadm: deprecate the "--csr-only" and "--csr-dir" flags of the "kubeadm init phase certs" subcommands. Please use "kubeadm alpha certs generate-csr" instead. This new command allows you to generate new private keys and certificate signing requests for all the control-plane components, so that the certificates can be signed by an external CA. ([#92183](https://github.com/kubernetes/kubernetes/pull/92183), [@wallrj](https://github.com/wallrj)) [SIG Cluster Lifecycle] -- Server-side apply behavior has been regularized in the case where a field is removed from the applied configuration. Removed fields which have no other owners are deleted from the live object, or reset to their default value if they have one. Safe ownership transfers, such as the transfer of a `replicas` field from a user to an HPA without resetting to the default value are documented in [Transferring Ownership](https://kubernetes.io/docs/reference/using-api/api-concepts/#transferring-ownership) ([#92661](https://github.com/kubernetes/kubernetes/pull/92661), [@jpbetz](https://github.com/jpbetz)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Testing] -- Set CSIMigrationvSphere feature gates to beta. - Users should enable CSIMigration + CSIMigrationvSphere features and install the vSphere CSI Driver (https://github.com/kubernetes-sigs/vsphere-csi-driver) to move workload from the in-tree vSphere plugin "kubernetes.io/vsphere-volume" to vSphere CSI Driver. - - Requires: vSphere vCenter/ESXi Version: 7.0u1, HW Version: VM version 15 ([#92816](https://github.com/kubernetes/kubernetes/pull/92816), [@divyenpatel](https://github.com/divyenpatel)) [SIG Cloud Provider and Storage] -- Support a smooth upgrade from client-side apply to server-side apply without conflicts, as well as support the corresponding downgrade. ([#90187](https://github.com/kubernetes/kubernetes/pull/90187), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG API Machinery and Testing] -- Trace output in apiserver logs is more organized and comprehensive. Traces are nested, and for all non-long running request endpoints, the entire filter chain is instrumented (e.g. authentication check is included). ([#88936](https://github.com/kubernetes/kubernetes/pull/88936), [@jpbetz](https://github.com/jpbetz)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Scheduling] -- `kubectl alpha debug` now supports debugging nodes by creating a debugging container running in the node's host namespaces. ([#92310](https://github.com/kubernetes/kubernetes/pull/92310), [@verb](https://github.com/verb)) [SIG CLI] - -### Failing Test - -- Kube-proxy iptables min-sync-period defaults to 1 sec. Previously, it was 0. ([#92836](https://github.com/kubernetes/kubernetes/pull/92836), [@aojea](https://github.com/aojea)) [SIG Network] - -### Bug or Regression - -- Dockershim security: pod sandbox now always run with `no-new-privileges` and `runtime/default` seccomp profile - dockershim seccomp: custom profiles can now have smaller seccomp profiles when set at pod level ([#90948](https://github.com/kubernetes/kubernetes/pull/90948), [@pjbgf](https://github.com/pjbgf)) [SIG Node] -- Eviction requests for pods that have a non-zero DeletionTimestamp will always succeed ([#91342](https://github.com/kubernetes/kubernetes/pull/91342), [@michaelgugino](https://github.com/michaelgugino)) [SIG Apps] -- Fix detection of image filesystem, disk metrics for devicemapper, detection of OOM Kills on 5.0+ linux kernels. ([#92919](https://github.com/kubernetes/kubernetes/pull/92919), [@dashpole](https://github.com/dashpole)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Node] -- Fixed memory leak in endpointSliceTracker ([#92838](https://github.com/kubernetes/kubernetes/pull/92838), [@tnqn](https://github.com/tnqn)) [SIG Apps and Network] -- Kube-aggregator certificates are dynamically loaded on change from disk ([#92791](https://github.com/kubernetes/kubernetes/pull/92791), [@p0lyn0mial](https://github.com/p0lyn0mial)) [SIG API Machinery] -- Kube-up now includes CoreDNS version v1.7.0. Some of the major changes include: - - Fixed a bug that could cause CoreDNS to stop updating service records. - - Fixed a bug in the forward plugin where only the first upstream server is always selected no matter which policy is set. - - Remove already deprecated options `resyncperiod` and `upstream` in the Kubernetes plugin. - - Includes Prometheus metrics name changes (to bring them in line with standard Prometheus metrics naming convention). They will be backward incompatible with existing reporting formulas that use the old metrics' names. - - The federation plugin (allows for v1 Kubernetes federation) has been removed. - More details are available in https://coredns.io/2020/06/15/coredns-1.7.0-release/ ([#92718](https://github.com/kubernetes/kubernetes/pull/92718), [@rajansandeep](https://github.com/rajansandeep)) [SIG Cloud Provider] -- The apiserver will no longer proxy non-101 responses for upgrade requests. This could break proxied backends (such as an extension API server) that respond to upgrade requests with a non-101 response code. ([#92941](https://github.com/kubernetes/kubernetes/pull/92941), [@tallclair](https://github.com/tallclair)) [SIG API Machinery] -- The terminationGracePeriodSeconds from pod spec is respected for the mirror pod. ([#92442](https://github.com/kubernetes/kubernetes/pull/92442), [@tedyu](https://github.com/tedyu)) [SIG Node and Testing] - -### Other (Cleanup or Flake) - -- --cache-dir sets cache directory for both http and discovery, defaults to $HOME/.kube/cache ([#92910](https://github.com/kubernetes/kubernetes/pull/92910), [@soltysh](https://github.com/soltysh)) [SIG API Machinery and CLI] -- Fix: license issue in blob disk feature ([#92824](https://github.com/kubernetes/kubernetes/pull/92824), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] - -## Dependencies - -### Added -_Nothing has changed._ +- github.com/Azure/go-autorest: [v14.2.0+incompatible](https://github.com/Azure/go-autorest/tree/v14.2.0) +- github.com/fvbommel/sortorder: [v1.0.1](https://github.com/fvbommel/sortorder/tree/v1.0.1) +- github.com/yuin/goldmark: [v1.1.27](https://github.com/yuin/goldmark/tree/v1.1.27) +- sigs.k8s.io/structured-merge-diff/v4: v4.0.1 ### Changed +- github.com/Azure/go-autorest/autorest/adal: [v0.8.2 → v0.9.0](https://github.com/Azure/go-autorest/autorest/adal/compare/v0.8.2...v0.9.0) +- github.com/Azure/go-autorest/autorest/date: [v0.2.0 → v0.3.0](https://github.com/Azure/go-autorest/autorest/date/compare/v0.2.0...v0.3.0) +- github.com/Azure/go-autorest/autorest/mocks: [v0.3.0 → v0.4.0](https://github.com/Azure/go-autorest/autorest/mocks/compare/v0.3.0...v0.4.0) +- github.com/Azure/go-autorest/autorest: [v0.9.6 → v0.11.1](https://github.com/Azure/go-autorest/autorest/compare/v0.9.6...v0.11.1) +- github.com/Azure/go-autorest/logger: [v0.1.0 → v0.2.0](https://github.com/Azure/go-autorest/logger/compare/v0.1.0...v0.2.0) +- github.com/Azure/go-autorest/tracing: [v0.5.0 → v0.6.0](https://github.com/Azure/go-autorest/tracing/compare/v0.5.0...v0.6.0) +- github.com/Microsoft/hcsshim: [v0.8.9 → 5eafd15](https://github.com/Microsoft/hcsshim/compare/v0.8.9...5eafd15) - github.com/cilium/ebpf: [9f1617e → 1c8d4c9](https://github.com/cilium/ebpf/compare/9f1617e...1c8d4c9) +- github.com/containerd/cgroups: [bf292b2 → 0dbf7f0](https://github.com/containerd/cgroups/compare/bf292b2...0dbf7f0) - github.com/coredns/corefile-migration: [v1.0.8 → v1.0.10](https://github.com/coredns/corefile-migration/compare/v1.0.8...v1.0.10) +- github.com/evanphx/json-patch: [e83c0a1 → v4.9.0+incompatible](https://github.com/evanphx/json-patch/compare/e83c0a1...v4.9.0) - github.com/google/cadvisor: [8450c56 → v0.37.0](https://github.com/google/cadvisor/compare/8450c56...v0.37.0) - github.com/json-iterator/go: [v1.1.9 → v1.1.10](https://github.com/json-iterator/go/compare/v1.1.9...v1.1.10) +- github.com/opencontainers/go-digest: [v1.0.0-rc1 → v1.0.0](https://github.com/opencontainers/go-digest/compare/v1.0.0-rc1...v1.0.0) - github.com/opencontainers/runc: [1b94395 → 819fcc6](https://github.com/opencontainers/runc/compare/1b94395...819fcc6) - github.com/prometheus/client_golang: [v1.6.0 → v1.7.1](https://github.com/prometheus/client_golang/compare/v1.6.0...v1.7.1) - github.com/prometheus/common: [v0.9.1 → v0.10.0](https://github.com/prometheus/common/compare/v0.9.1...v0.10.0) - github.com/prometheus/procfs: [v0.0.11 → v0.1.3](https://github.com/prometheus/procfs/compare/v0.0.11...v0.1.3) - github.com/rubiojr/go-vhd: [0bfd3b3 → 02e2102](https://github.com/rubiojr/go-vhd/compare/0bfd3b3...02e2102) -- sigs.k8s.io/structured-merge-diff/v3: v3.0.0 → 43c19bb +- github.com/storageos/go-api: [343b3ef → v2.2.0+incompatible](https://github.com/storageos/go-api/compare/343b3ef...v2.2.0) +- github.com/urfave/cli: [v1.22.1 → v1.22.2](https://github.com/urfave/cli/compare/v1.22.1...v1.22.2) +- go.etcd.io/etcd: 54ba958 → dd1b699 +- golang.org/x/crypto: bac4c82 → 75b2880 +- golang.org/x/mod: v0.1.0 → v0.3.0 +- golang.org/x/net: d3edc99 → ab34263 +- golang.org/x/tools: c00d67e → c1934b7 +- k8s.io/kube-openapi: 656914f → 6aeccd4 +- k8s.io/system-validators: v1.1.2 → v1.2.0 +- k8s.io/utils: 6e3d28b → d5654de ### Removed -_Nothing has changed._ - - - -# v1.19.0-beta.2 - - -## Downloads for v1.19.0-beta.2 - -### Source Code - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes.tar.gz) | 806c1734a57dfc1800730fcb25aeb60d50d19d248c0e2a92ede4b6c4565745b4f370d4fd925bef302a96fba89102b7560b8f067240e0f35f6ec6caa29971dea4 -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-src.tar.gz) | 507372c6d7ea380ec68ea237141a2b62953a2e1d1d16288f37820b605e33778c5f43ac5a3dedf39f7907d501749916221a8fa4d50be1e5a90b3ce23d36eaa075 - -### Client binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-client-darwin-386.tar.gz) | 6d20ca8d37b01213dcb98a1e49d44d414043ce485ae7df9565dfb7914acb1ec42b7aeb0c503b8febc122a8b444c6ed13eec0ff3c88033c6db767e7af5dbbc65d -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-client-darwin-amd64.tar.gz) | e9caa5463a662869cfc8b9254302641aee9b53fa2119244bd65ef2c66e8c617f7db9b194a672ff80d7bc42256e6560db9fe8a00b2214c0ef023e2d6feed58a3a -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-client-linux-386.tar.gz) | 48296417fcd2c2f6d01c30dcf66956401ea46455c52a2bbd76feb9b117502ceaa2fb10dae944e087e7038b9fdae5b835497213894760ca01698eb892087490d2 -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-client-linux-amd64.tar.gz) | e2cc7819974316419a8973f0d77050b3262c4e8d078946ff9f6f013d052ec1dd82893313feff6e4493ae0fd3fb62310e6ce4de49ba6e80f8b9979650debf53f2 -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-client-linux-arm.tar.gz) | 484aac48a7a736970ea0766547453b7d37b25ed29fdee771734973e3e080b33f6731eecc458647db962290b512d32546e675e4658287ced3214e87292b98a643 -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-client-linux-arm64.tar.gz) | f793078dc2333825a6679126b279cb0a3415ded8c650478e73c37735c6aa9576b68b2a4165bb77ef475884d50563ea236d8db4c72b2e5552b5418ea06268daae -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-client-linux-ppc64le.tar.gz) | 4c204b8d3b2717470ee460230b6bdc63725402ad3d24789397934bfe077b94d68041a376864b618e01f541b5bd00d0e63d75aa531a327ab0082c01eb4b9aa5ee -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-client-linux-s390x.tar.gz) | d0f6e4ddbf122ebcb4c5a980d5f8e33a23213cb438983341870f288afd17e73ec42f0ded55a3a9622c57700e68999228508d449ca206aca85f3254f7622375db -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-client-windows-386.tar.gz) | a615a7821bba1f8e4115b7981347ed94a79947c78d32c692cd600e21e0de29fedfc4a39dc08ca516f2f35261cf4a6d6ce557008f034e0e1d311fa9e75478ec0c -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-client-windows-amd64.tar.gz) | 34046130c5ebb3afe17e6e3cf88229b8d3281a9ac9c28dece1fd2d49a11b7be011700b74d9b8111dee7d0943e5ebfa208185bae095c2571aa54e0f9201e2cddd - -### Server binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-server-linux-amd64.tar.gz) | c922058ce9c665e329d3d4647aac5d2dd22d9a8af63a21e6af98943dfd14f2b90268c53876f42a64093b96499ee1109803868c9aead4c15fd8db4b1bbec58fd9 -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-server-linux-arm.tar.gz) | 4f17489b946dc04570bfab87015f2c2401b139b9ee745ed659bc94ccd116f3f23e249f83e19aaa418aa980874fffb478b1ec7340aa25292af758c9eabd4c2022 -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-server-linux-arm64.tar.gz) | 69e44a63d15962de95a484e311130d415ebfec16a9da54989afc53a835c5b67de20911d71485950d07259a0f8286a299f4d74f90c73530e905da8dc60e391597 -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-server-linux-ppc64le.tar.gz) | 66b30ebad7a8226304150aa42a1bd660a0b3975fecbfd8dbbea3092936454d9f81c8083841cc67c6645ab771383b66c7f980dd65319803078c91436c55d5217a -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-server-linux-s390x.tar.gz) | 0e197280f99654ec9e18ea01a9fc848449213ce28521943bc5d593dd2cac65310b6a918f611ea283b3a0377347eb718e99dd59224b8fad8adb223d483fa9fecb - -### Node binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-node-linux-amd64.tar.gz) | f40afee38155c5163ba92e3fa3973263ca975f3b72ac18535799fb29180413542ef86f09c87681161affeef94eb0bd38e7cf571a73ab0f51a88420f1aedeaeec -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-node-linux-arm.tar.gz) | 6088b11767b77f0ec932a9f1aee9f0c7795c3627529f259edf4d8b1be2e1a324a75c89caed65c6aa277c2fd6ee23b3ebeb05901f351cd2dde0a833bbbd6d6d07 -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-node-linux-arm64.tar.gz) | e790c491d057721b94d0d2ad22dd5c75400e8602e95276471f20cd2181f52c5be38e66b445d8360e1fb671627217eb0b7735b485715844d0e9908cf3de249464 -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-node-linux-ppc64le.tar.gz) | 04f696cfab66f92b4b22c23807a49c344d6a157a9ac3284a267613369b7f9f5887f67902cb8a2949caa204f89fdc65fe442a03c2c454013523f81b56476d39a0 -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-node-linux-s390x.tar.gz) | c671e20f69f70ec567fb16bbed2fecac3099998a3365def1e0755e41509531fd65768f7a04015b27b17e6a5884e65cddb82ff30a8374ed011c5e2008817259db -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.2/kubernetes-node-windows-amd64.tar.gz) | 23d712fb2d455b5095d31b9c280d92442f7871786808528a1b39b9babf169dc7ae467f1ee2b2820089d69aa2342441d0290edf4f710808c78277e612f870321d - -## Changelog since v1.19.0-beta.1 - -## Changes by Kind - -### Deprecation - -- Kubeadm: remove the deprecated "--use-api" flag for "kubeadm alpha certs renew" ([#90143](https://github.com/kubernetes/kubernetes/pull/90143), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Scheduler's alpha feature 'ResourceLimitsPriorityFunction' is completely removed due to lack of usage ([#91883](https://github.com/kubernetes/kubernetes/pull/91883), [@SataQiu](https://github.com/SataQiu)) [SIG Scheduling and Testing] - -### API Change - -- Remove `BindTimeoutSeconds` from schedule configuration `KubeSchedulerConfiguration` ([#91580](https://github.com/kubernetes/kubernetes/pull/91580), [@cofyc](https://github.com/cofyc)) [SIG Scheduling and Testing] -- Resolve regression in metadata.managedFields handling in update/patch requests submitted by older API clients ([#91748](https://github.com/kubernetes/kubernetes/pull/91748), [@apelisse](https://github.com/apelisse)) [SIG API Machinery and Testing] -- The CertificateSigningRequest API is promoted to certificates.k8s.io/v1 with the following changes: - - `spec.signerName` is now required, and requests for `kubernetes.io/legacy-unknown` are not allowed to be created via the `certificates.k8s.io/v1` API - - `spec.usages` is now required, may not contain duplicate values, and must only contain known usages - - `status.conditions` may not contain duplicate types - - `status.conditions[*].status` is now required - - `status.certificate` must be PEM-encoded, and contain only CERTIFICATE blocks ([#91685](https://github.com/kubernetes/kubernetes/pull/91685), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Architecture, Auth, CLI and Testing] -- The Kubelet's `--cloud-provider` and `--cloud-config` options are now marked as deprecated. ([#90408](https://github.com/kubernetes/kubernetes/pull/90408), [@knabben](https://github.com/knabben)) [SIG Cloud Provider and Node] - -### Feature - -- A new extension point `PostFilter` is introduced to scheduler framework which runs after Filter phase to resolve scheduling filter failures. A typical implementation is running preemption logic. ([#91314](https://github.com/kubernetes/kubernetes/pull/91314), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling and Testing] -- Added --privileged flag to kubectl run ([#90569](https://github.com/kubernetes/kubernetes/pull/90569), [@brianpursley](https://github.com/brianpursley)) [SIG CLI] -- Enable feature Gate DefaultPodTopologySpread to use PodTopologySpread plugin to do defaultspreading. In doing so, legacy DefaultPodTopologySpread plugin is disabled. ([#91793](https://github.com/kubernetes/kubernetes/pull/91793), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- Extend AWS azToRegion method to support Local Zones ([#90874](https://github.com/kubernetes/kubernetes/pull/90874), [@Jeffwan](https://github.com/Jeffwan)) [SIG Cloud Provider] -- Kube-Proxy now supports IPv6DualStack on Windows with the IPv6DualStack feature gate. ([#90853](https://github.com/kubernetes/kubernetes/pull/90853), [@kumarvin123](https://github.com/kumarvin123)) [SIG Network, Node and Windows] -- Kube-controller-manager: the `--experimental-cluster-signing-duration` flag is marked as deprecated for removal in v1.22, and is replaced with `--cluster-signing-duration`. ([#91154](https://github.com/kubernetes/kubernetes/pull/91154), [@liggitt](https://github.com/liggitt)) [SIG Auth and Cloud Provider] -- Support kubectl create deployment with replicas ([#91562](https://github.com/kubernetes/kubernetes/pull/91562), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] -- The RotateKubeletClientCertificate feature gate has been promoted to GA, and the kubelet --feature-gate RotateKubeletClientCertificate parameter will be removed in 1.20. ([#91780](https://github.com/kubernetes/kubernetes/pull/91780), [@liggitt](https://github.com/liggitt)) [SIG Auth and Node] -- The metric label name of `kubernetes_build_info` has been updated from `camel case` to `snake case`: - - gitVersion --> git_version - - gitCommit --> git_commit - - gitTreeState --> git_tree_state - - buildDate --> build_date - - goVersion --> go_version - - This change happens in `kube-apiserver`、`kube-scheduler`、`kube-proxy` and `kube-controller-manager`. ([#91805](https://github.com/kubernetes/kubernetes/pull/91805), [@RainbowMango](https://github.com/RainbowMango)) [SIG API Machinery, Cluster Lifecycle and Instrumentation] -- `EventRecorder()` is exposed to `FrameworkHandle` interface so that scheduler plugin developers can choose to log cluster-level events. ([#92010](https://github.com/kubernetes/kubernetes/pull/92010), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling] - -### Bug or Regression - -- Azure: set dest prefix and port for IPv6 inbound security rule ([#91831](https://github.com/kubernetes/kubernetes/pull/91831), [@aramase](https://github.com/aramase)) [SIG Cloud Provider] -- Fix etcd version migration script in etcd image. ([#91925](https://github.com/kubernetes/kubernetes/pull/91925), [@wenjiaswe](https://github.com/wenjiaswe)) [SIG API Machinery] -- Fix issues when supported huge page sizes changes ([#80831](https://github.com/kubernetes/kubernetes/pull/80831), [@odinuge](https://github.com/odinuge)) [SIG Node and Testing] -- Fix kubectl describe output format for empty annotations. ([#91405](https://github.com/kubernetes/kubernetes/pull/91405), [@iyashu](https://github.com/iyashu)) [SIG CLI] -- Fixed an issue that a Pod's nominatedNodeName cannot be cleared upon node deletion. ([#91750](https://github.com/kubernetes/kubernetes/pull/91750), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling and Testing] -- Fixed several bugs involving the IPFamily field when creating or updating services - in clusters with the IPv6DualStack feature gate enabled. - - Beware that the behavior of the IPFamily field is strange and inconsistent and will - likely be changed before the dual-stack feature goes GA. Users should treat the - field as "write-only" for now and should not make any assumptions about a service - based on its current IPFamily value. ([#91400](https://github.com/kubernetes/kubernetes/pull/91400), [@danwinship](https://github.com/danwinship)) [SIG Apps and Network] -- Kube-apiserver: fixes scale subresource patch handling to avoid returning unnecessary 409 Conflict error to clients ([#90342](https://github.com/kubernetes/kubernetes/pull/90342), [@liggitt](https://github.com/liggitt)) [SIG Apps, Autoscaling and Testing] -- Kube-up: fixes setup of validating admission webhook credential configuration ([#91995](https://github.com/kubernetes/kubernetes/pull/91995), [@liggitt](https://github.com/liggitt)) [SIG Cloud Provider and Cluster Lifecycle] -- Kubeadm: Add retries for kubeadm join / UpdateStatus to make update status more resilient by adding a retry loop to this operation ([#91952](https://github.com/kubernetes/kubernetes/pull/91952), [@xlgao-zju](https://github.com/xlgao-zju)) [SIG Cluster Lifecycle] -- On AWS nodes with multiple network interfaces, kubelet should now more reliably report addresses from secondary interfaces. ([#91889](https://github.com/kubernetes/kubernetes/pull/91889), [@anguslees](https://github.com/anguslees)) [SIG Cloud Provider] -- Resolve regression in metadata.managedFields handling in create/update/patch requests not using server-side apply ([#91690](https://github.com/kubernetes/kubernetes/pull/91690), [@apelisse](https://github.com/apelisse)) [SIG API Machinery and Testing] - -### Other (Cleanup or Flake) - -- Deprecate the `--target-ram-md` flags that is no longer used for anything. ([#91818](https://github.com/kubernetes/kubernetes/pull/91818), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery] -- Replace framework.Failf with ExpectNoError ([#91811](https://github.com/kubernetes/kubernetes/pull/91811), [@lixiaobing1](https://github.com/lixiaobing1)) [SIG Instrumentation, Storage and Testing] -- The Kubelet's `--experimental-allocatable-ignore-eviction` option is now marked as deprecated. ([#91578](https://github.com/kubernetes/kubernetes/pull/91578), [@knabben](https://github.com/knabben)) [SIG Node] -- Update corefile-migration library to 1.0.8 ([#91856](https://github.com/kubernetes/kubernetes/pull/91856), [@wawa0210](https://github.com/wawa0210)) [SIG Node] - -## Dependencies - -### Added -_Nothing has changed._ - -### Changed -- github.com/Azure/azure-sdk-for-go: [v40.2.0+incompatible → v43.0.0+incompatible](https://github.com/Azure/azure-sdk-for-go/compare/v40.2.0...v43.0.0) -- github.com/coredns/corefile-migration: [v1.0.6 → v1.0.8](https://github.com/coredns/corefile-migration/compare/v1.0.6...v1.0.8) -- k8s.io/klog/v2: v2.0.0 → v2.1.0 - -### Removed -_Nothing has changed._ - - - -# v1.19.0-beta.1 - - -## Downloads for v1.19.0-beta.1 - -### Source Code - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes.tar.gz) | c4ab79e987790fbda842310525abecee60861e44374c414159e60d74e85b4dd36d9d49253b8e7f08aec36a031726f9517d0a401fb748e41835ae2dc86aee069d -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-src.tar.gz) | 08d1aadb8a31b35f3bc39f44d8f97b7e98951f833bb87f485f318c6acfdb53539851fbb2d4565036e00b6f620c5b1882c6f9620759c3b36833da1d6b2b0610f2 - -### Client binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-client-darwin-386.tar.gz) | 55eb230fdb4e60ded6c456ec6e03363c6d55e145a956aa5eff0c2b38d8ecfe848b4a404169def45d392e747e4d04ee71fe3182ab1e6426110901ccfb2e1bc17f -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-client-darwin-amd64.tar.gz) | ddc03644081928bd352c40077f2a075961c90a7159964be072b3e05ec170a17d6d78182d90210c18d24d61e75b45eae3d1b1486626db9e28f692dfb33196615c -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-client-linux-386.tar.gz) | 6e1e00a53289bd9a4d74a61fce4665786051aafe8fef8d1d42de88ba987911bfb7fd5f4a2c3771ae830819546cf9f4badd94fd90c50ca74367c1ace748e8eafd -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-client-linux-amd64.tar.gz) | 2c4db87c61bc4a528eb2af9246648fc7a015741fe52f551951fda786c252eca1dc48a4325be70e6f80f1560f773b763242334ad4fe06657af290e610f10bc231 -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-client-linux-arm.tar.gz) | 8a2bebf67cbd8f91ba38edc36a239aa50d3e58187827763eb5778a5ca0d9d35be97e193b794bff415e8f5de071e47659033dc0420e038d78cc32e841a417a62a -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-client-linux-arm64.tar.gz) | f2d0029efc03bf17554c01c11e77b161b8956d9da4b17962ca878378169cbdee04722bbda87279f4b7431c91db0e92bfede45dcc6d971f34d3fe891339b7c47b -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-client-linux-ppc64le.tar.gz) | 45eb3fe40951ba152f05aa0fe41b7c17ffb91ee3cecb12ec19d2d9cdb467267c1eb5696660687852da314eb8a14a9ebf5f5da21eca252e1c2e3b18dca151ad0d -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-client-linux-s390x.tar.gz) | 2097ac5d593dd0951a34df9bdf7883b5c228da262042904ee3a2ccfd1f9c955ff6a3a59961850053e41646bce8fc70a023efe9e9fe49f14f9a6276c8da22f907 -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-client-windows-386.tar.gz) | c38b034e8ac3a5972a01f36b184fe1a195f6a422a3c6564f1f3faff858b1220173b6ab934e7b7ec200931fd7d9456e947572620d82d02e7b05fc61a7fb67ec70 -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-client-windows-amd64.tar.gz) | 0501694734381914882836e067dc177e8bccd48a4826e286017dc5f858f27cdef348edbb664dda59162f6cd3ac14a9e491e314a3ea032dec43bc77610ce8c8bc - -### Server binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-server-linux-amd64.tar.gz) | 0dd2058889eabbf0b05b6fafd593997ff9911467f0fc567c142583adf0474f4d0e2f4024b4906ff9ee4264d1cbbfde66596ccb8c73b3d5bb79f67e5eb4b3258a -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-server-linux-arm.tar.gz) | 9c3a33d7c198116386178a4f8ee7d4df82e810d6f26833f19f93eff112c29f9f89e5ee790013ad1d497856ecb2662ee95a49fc6a41f0d33cc67e431d06135b88 -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-server-linux-arm64.tar.gz) | 11f83132f729bec4a4d84fc1983dbd5ddd1643d000dc74c6e05f35637de21533834a572692fc1281c7b0bd29ee93e721fb00e276983e36c327a1950266b17f6d -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-server-linux-ppc64le.tar.gz) | 949334065d968f10207089db6175dcc4bf9432b3b48b120f689cd39c56562a0f4f60d774c95a20a5391d0467140a4c3cb6b2a2dfedccfda6c20f333a63ebcf81 -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-server-linux-s390x.tar.gz) | 29e8f6a22969d8ab99bf6d272215f53d8f7a125d0c5c20981dcfe960ed440369f831c71a94bb61974b486421e4e9ed936a9421a1be6f02a40e456daab4995663 - -### Node binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-node-linux-amd64.tar.gz) | 3d9767e97a40b501f29bbfc652c8fd841eae1dee22a97fdc20115e670081de7fa8e84f6e1be7bbf2376b59c5eef15fb5291415ae2e24ce4c9c5e141faa38c47c -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-node-linux-arm.tar.gz) | 8ccf401e0bd0c59403af49046b49cf556ff164fca12c5233169a80e18cc4367f404fd7edd236bb862bff9fd25b687d48a8d57d5567809b89fd2727549d0dc48f -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-node-linux-arm64.tar.gz) | 3e1fa2bde05a4baec6ddd43cd1994d155a143b9c825ab5dafe766efc305cb1aad92d6026c41c05e9da114a04226361fb6b0510b98e3b05c3ed510da23db403b3 -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-node-linux-ppc64le.tar.gz) | 01df4be687f5634afa0ab5ef06f8cee17079264aa452f00a45eccb8ace654c9acc6582f4c74e8242e6ca7715bc48bf2a7d2c4d3d1eef69106f99c8208bc245c4 -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-node-linux-s390x.tar.gz) | 5523b0b53c30b478b1a9e1df991607886acdcde8605e1b44ef91c94993ca2256c74f6e38fbdd24918d7dbf7afd5cd73d24a3f7ff911e9762819776cc19935363 -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.1/kubernetes-node-windows-amd64.tar.gz) | 8e7ebf000bc8dec1079a775576807c0a11764d20a59e16f89d93c948532ba5e6864efd3e08c3e8cc5bd7e7f97bb65baefbf2f01cb226897abd5e01997a4c4f75 - -## Changelog since v1.19.0-alpha.3 - -## Urgent Upgrade Notes - -### (No, really, you MUST read this before you upgrade) - - - ACTION REQUIRED : Switch core master base images (kube-controller-manager) from debian to distroless. If you need Flex Volumes support using scripts, please build your own image with required packages (like bash) ([#91329](https://github.com/kubernetes/kubernetes/pull/91329), [@dims](https://github.com/dims)) [SIG Cloud Provider, Release, Storage and Testing] - - Kubeadm: Move the "kubeadm init" phase "kubelet-start" later in the init workflow, after the "kubeconfig" phase. This makes kubeadm start the kubelet only after the KubeletConfiguration component config file (/var/lib/kubelet/config.yaml) is generated and solves a problem where init systems like OpenRC cannot crashloop the kubelet service. ([#90892](https://github.com/kubernetes/kubernetes/pull/90892), [@xphoniex](https://github.com/xphoniex)) [SIG Cluster Lifecycle] - -## Changes by Kind - -### API Change - -- CertificateSigningRequest API conditions were updated: - - a `status` field was added; this field defaults to `True`, and may only be set to `True` for `Approved`, `Denied`, and `Failed` conditions - - a `lastTransitionTime` field was added - - a `Failed` condition type was added to allow signers to indicate permanent failure; this condition can be added via the `certificatesigningrequests/status` subresource. - - `Approved` and `Denied` conditions are mutually exclusive - - `Approved`, `Denied`, and `Failed` conditions can no longer be removed from a CSR ([#90191](https://github.com/kubernetes/kubernetes/pull/90191), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Apps, Auth, CLI and Node] -- EnvVarSource api doc bug fixes ([#91194](https://github.com/kubernetes/kubernetes/pull/91194), [@wawa0210](https://github.com/wawa0210)) [SIG Apps] -- Fixed: log timestamps now include trailing zeros to maintain a fixed width ([#91207](https://github.com/kubernetes/kubernetes/pull/91207), [@iamchuckss](https://github.com/iamchuckss)) [SIG Apps and Node] -- The Kubelet's --node-status-max-images option is now available via the Kubelet config file field nodeStatusMaxImage ([#91275](https://github.com/kubernetes/kubernetes/pull/91275), [@knabben](https://github.com/knabben)) [SIG Node] -- The Kubelet's --seccomp-profile-root option is now available via the Kubelet config file field seccompProfileRoot. ([#91182](https://github.com/kubernetes/kubernetes/pull/91182), [@knabben](https://github.com/knabben)) [SIG Node] -- The Kubelet's `--enable-server` and `--provider-id` option is now available via the Kubelet config file field `enableServer` and `providerID` respectively. ([#90494](https://github.com/kubernetes/kubernetes/pull/90494), [@knabben](https://github.com/knabben)) [SIG Node] -- The Kubelet's `--really-crash-for-testing` and `--chaos-chance` options are now marked as deprecated. ([#90499](https://github.com/kubernetes/kubernetes/pull/90499), [@knabben](https://github.com/knabben)) [SIG Node] -- The alpha `DynamicAuditing` feature gate and `auditregistration.k8s.io/v1alpha1` API have been removed and are no longer supported. ([#91502](https://github.com/kubernetes/kubernetes/pull/91502), [@deads2k](https://github.com/deads2k)) [SIG API Machinery, Auth and Testing] -- `NodeResourcesLeastAllocated` and `NodeResourcesMostAllocated` plugins now support customized weight on the CPU and memory. ([#90544](https://github.com/kubernetes/kubernetes/pull/90544), [@chendave](https://github.com/chendave)) [SIG Scheduling] -- `PostFilter` type is added to scheduler component config API on version v1beta1. ([#91547](https://github.com/kubernetes/kubernetes/pull/91547), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling] -- `kubescheduler.config.k8s.io` is now beta ([#91420](https://github.com/kubernetes/kubernetes/pull/91420), [@pancernik](https://github.com/pancernik)) [SIG Scheduling] - -### Feature - -- Add --logging-format flag for component-base. Defaults to "text" using unchanged klog. ([#89683](https://github.com/kubernetes/kubernetes/pull/89683), [@yuzhiquan](https://github.com/yuzhiquan)) [SIG Instrumentation] -- Add --port flag to kubectl create deployment ([#91113](https://github.com/kubernetes/kubernetes/pull/91113), [@soltysh](https://github.com/soltysh)) [SIG CLI and Testing] -- Add .import-restrictions file to cmd/cloud-controller-manager. ([#90630](https://github.com/kubernetes/kubernetes/pull/90630), [@nilo19](https://github.com/nilo19)) [SIG API Machinery and Cloud Provider] -- Add Annotations to CRI-API ImageSpec objects. ([#90061](https://github.com/kubernetes/kubernetes/pull/90061), [@marosset](https://github.com/marosset)) [SIG Node and Windows] -- Added feature support to Windows for configuring session affinity of Kubernetes services. - required: [Windows Server vNext Insider Preview Build 19551](https://blogs.windows.com/windowsexperience/2020/01/28/announcing-windows-server-vnext-insider-preview-build-19551/) (or higher) ([#91701](https://github.com/kubernetes/kubernetes/pull/91701), [@elweb9858](https://github.com/elweb9858)) [SIG Network and Windows] -- Added service.beta.kubernetes.io/aws-load-balancer-target-node-labels annotation to target nodes in AWS LoadBalancer Services ([#90943](https://github.com/kubernetes/kubernetes/pull/90943), [@foobarfran](https://github.com/foobarfran)) [SIG Cloud Provider] -- Feat: azure disk migration go beta in 1.19 ([#90896](https://github.com/kubernetes/kubernetes/pull/90896), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] -- Kube-addon-manager has been updated to v9.1.1 to allow overriding the default list of whitelisted resources (https://github.com/kubernetes/kubernetes/pull/91018) ([#91240](https://github.com/kubernetes/kubernetes/pull/91240), [@tosi3k](https://github.com/tosi3k)) [SIG Cloud Provider, Scalability and Testing] -- Kubeadm now distinguishes between generated and user supplied component configs, regenerating the former ones if a config upgrade is required ([#86070](https://github.com/kubernetes/kubernetes/pull/86070), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] -- Kubeadm: add startup probes for static Pods to protect slow starting containers ([#91179](https://github.com/kubernetes/kubernetes/pull/91179), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] -- Kubelets configured to rotate client certificates now publish a `certificate_manager_server_ttl_seconds` gauge metric indicating the remaining seconds until certificate expiration. ([#91148](https://github.com/kubernetes/kubernetes/pull/91148), [@liggitt](https://github.com/liggitt)) [SIG Auth and Node] -- Local-up-cluster.sh installs CSI snapshotter by default now, can be disabled with ENABLE_CSI_SNAPSHOTTER=false. ([#91504](https://github.com/kubernetes/kubernetes/pull/91504), [@pohly](https://github.com/pohly)) [SIG Storage] -- Rest.Config now supports a flag to override proxy configuration that was previously only configurable through environment variables. ([#81443](https://github.com/kubernetes/kubernetes/pull/81443), [@mikedanese](https://github.com/mikedanese)) [SIG API Machinery and Node] -- Scores from PodTopologySpreading have reduced differentiation as maxSkew increases. ([#90820](https://github.com/kubernetes/kubernetes/pull/90820), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- Service controller: only sync LB node pools when relevant fields in Node changes ([#90769](https://github.com/kubernetes/kubernetes/pull/90769), [@andrewsykim](https://github.com/andrewsykim)) [SIG Apps and Network] -- Switch core master base images (kube-apiserver, kube-scheduler) from debian to distroless ([#90674](https://github.com/kubernetes/kubernetes/pull/90674), [@dims](https://github.com/dims)) [SIG Cloud Provider, Release and Scalability] -- Switch etcd image (with migration scripts) from debian to distroless ([#91171](https://github.com/kubernetes/kubernetes/pull/91171), [@dims](https://github.com/dims)) [SIG API Machinery and Cloud Provider] -- The `certificatesigningrequests/approval` subresource now supports patch API requests ([#91558](https://github.com/kubernetes/kubernetes/pull/91558), [@liggitt](https://github.com/liggitt)) [SIG Auth and Testing] -- Update cri-tools to v1.18.0 ([#89720](https://github.com/kubernetes/kubernetes/pull/89720), [@saschagrunert](https://github.com/saschagrunert)) [SIG Cloud Provider, Cluster Lifecycle, Release and Scalability] -- Weight of PodTopologySpread scheduling Score is doubled. ([#91258](https://github.com/kubernetes/kubernetes/pull/91258), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- `maxThreshold` of `ImageLocality` plugin is now scaled by the number of images in the pod, which helps to distinguish the node priorities for pod with several images. ([#91138](https://github.com/kubernetes/kubernetes/pull/91138), [@chendave](https://github.com/chendave)) [SIG Scheduling] - -### Bug or Regression - -- Add support for TLS 1.3 ciphers: TLS_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256 and TLS_AES_256_GCM_SHA384. ([#90843](https://github.com/kubernetes/kubernetes/pull/90843), [@pjbgf](https://github.com/pjbgf)) [SIG API Machinery, Auth and Cluster Lifecycle] -- Base-images: Update to kube-cross:v1.13.9-5 ([#90963](https://github.com/kubernetes/kubernetes/pull/90963), [@justaugustus](https://github.com/justaugustus)) [SIG Release and Testing] -- CloudNodeLifecycleController will check node existence status before shutdown status when monitoring nodes. ([#90737](https://github.com/kubernetes/kubernetes/pull/90737), [@jiahuif](https://github.com/jiahuif)) [SIG Apps and Cloud Provider] -- First pod with required affinity terms can schedule only on nodes with matching topology keys. ([#91168](https://github.com/kubernetes/kubernetes/pull/91168), [@ahg-g](https://github.com/ahg-g)) [SIG Scheduling] -- Fix VirtualMachineScaleSets.virtualMachines.GET not allowed issues when customers have set VMSS orchestrationMode. ([#91097](https://github.com/kubernetes/kubernetes/pull/91097), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- Fix a racing issue that scheduler may perform unnecessary scheduling attempt. ([#90660](https://github.com/kubernetes/kubernetes/pull/90660), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling and Testing] -- Fix kubectl create --dryrun client ignore namespace ([#90502](https://github.com/kubernetes/kubernetes/pull/90502), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] -- Fix kubectl create secret docker-registry --from-file not usable ([#90960](https://github.com/kubernetes/kubernetes/pull/90960), [@zhouya0](https://github.com/zhouya0)) [SIG CLI and Testing] -- Fix kubectl describe node for users not having access to lease information. ([#90469](https://github.com/kubernetes/kubernetes/pull/90469), [@uthark](https://github.com/uthark)) [SIG CLI] -- Fix kubectl run --dry-run client ignore namespace ([#90785](https://github.com/kubernetes/kubernetes/pull/90785), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] -- Fix public IP not shown issues after assigning public IP to Azure VMs ([#90886](https://github.com/kubernetes/kubernetes/pull/90886), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- Fix: add azure file migration support on annotation support ([#91093](https://github.com/kubernetes/kubernetes/pull/91093), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Node] -- Fix: azure disk dangling attach issue which would cause API throttling ([#90749](https://github.com/kubernetes/kubernetes/pull/90749), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] -- Fix: fix topology issue in azure disk storage class migration ([#91196](https://github.com/kubernetes/kubernetes/pull/91196), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] -- Fix: support removal of nodes backed by deleted non VMSS instances on Azure ([#91184](https://github.com/kubernetes/kubernetes/pull/91184), [@bpineau](https://github.com/bpineau)) [SIG Cloud Provider] -- Fixed a regression preventing garbage collection of RBAC role and binding objects ([#90534](https://github.com/kubernetes/kubernetes/pull/90534), [@apelisse](https://github.com/apelisse)) [SIG Auth] -- For external storage e2e test suite, update external driver, to pick snapshot provisioner from VolumeSnapshotClass, when a VolumeSnapshotClass is explicitly provided as an input. ([#90878](https://github.com/kubernetes/kubernetes/pull/90878), [@saikat-royc](https://github.com/saikat-royc)) [SIG Storage and Testing] -- Get-kube.sh: fix order to get the binaries from the right bucket ([#91635](https://github.com/kubernetes/kubernetes/pull/91635), [@cpanato](https://github.com/cpanato)) [SIG Release] -- In a HA env, during the period a standby scheduler lost connection to API server, if a Pod is deleted and recreated, and the standby scheduler becomes master afterwards, there could be a scheduler cache corruption. This PR fixes this issue. ([#91126](https://github.com/kubernetes/kubernetes/pull/91126), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling] -- Kubeadm: during "reset" do not remove the only remaining stacked etcd member from the cluster and just proceed with the cleanup of the local etcd storage. ([#91145](https://github.com/kubernetes/kubernetes/pull/91145), [@tnqn](https://github.com/tnqn)) [SIG Cluster Lifecycle] -- Kubeadm: increase robustness for "kubeadm join" when adding etcd members on slower setups ([#90645](https://github.com/kubernetes/kubernetes/pull/90645), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Pod Conditions updates are skipped for re-scheduling attempts ([#91252](https://github.com/kubernetes/kubernetes/pull/91252), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- Prevent PVC requested size overflow when expanding or creating a volume ([#90907](https://github.com/kubernetes/kubernetes/pull/90907), [@gnufied](https://github.com/gnufied)) [SIG Cloud Provider and Storage] -- Resolves an issue using `kubectl certificate approve/deny` against a server serving the v1 CSR API ([#91691](https://github.com/kubernetes/kubernetes/pull/91691), [@liggitt](https://github.com/liggitt)) [SIG Auth and CLI] -- Scheduling failures due to no nodes available are now reported as unschedulable under ```schedule_attempts_total``` metric. ([#90989](https://github.com/kubernetes/kubernetes/pull/90989), [@ahg-g](https://github.com/ahg-g)) [SIG Scheduling] -- The following components that do not expect non-empty, non-flag arguments will now print an error message and exit if an argument is specified: cloud-controller-manager, kube-apiserver, kube-controller-manager, kube-proxy, kubeadm {alpha|config|token|version}, kubemark. Flags should be prefixed with a single dash "-" (0x45) for short form or double dash "--" for long form. Before this change, malformed flags (for example, starting with a non-ascii dash character such as 0x8211: "–") would have been silently treated as positional arguments and ignored. ([#91349](https://github.com/kubernetes/kubernetes/pull/91349), [@neolit123](https://github.com/neolit123)) [SIG API Machinery, Cloud Provider, Cluster Lifecycle, Network and Scheduling] -- When evicting, Pods in Pending state are removed without checking PDBs. ([#83906](https://github.com/kubernetes/kubernetes/pull/83906), [@michaelgugino](https://github.com/michaelgugino)) [SIG API Machinery, Apps, Node and Scheduling] - -### Other (Cleanup or Flake) - -- Adds additional testing to ensure that udp pods conntrack are cleaned up ([#90180](https://github.com/kubernetes/kubernetes/pull/90180), [@JacobTanenbaum](https://github.com/JacobTanenbaum)) [SIG Architecture, Network and Testing] -- Adjusts the fsType for cinder values to be `ext4` if no fsType is specified. ([#90608](https://github.com/kubernetes/kubernetes/pull/90608), [@huffmanca](https://github.com/huffmanca)) [SIG Storage] -- Change beta.kubernetes.io/os to kubernetes.io/os ([#89461](https://github.com/kubernetes/kubernetes/pull/89461), [@wawa0210](https://github.com/wawa0210)) [SIG Cloud Provider and Cluster Lifecycle] -- Content-type and verb for request metrics are now bounded to a known set. ([#89451](https://github.com/kubernetes/kubernetes/pull/89451), [@logicalhan](https://github.com/logicalhan)) [SIG API Machinery and Instrumentation] -- Emit `WaitingForPodScheduled` event if the unbound PVC is in delay binding mode but used by a pod ([#91455](https://github.com/kubernetes/kubernetes/pull/91455), [@cofyc](https://github.com/cofyc)) [SIG Storage] -- Improve server-side apply conflict errors by setting dedicated kubectl subcommand field managers ([#88885](https://github.com/kubernetes/kubernetes/pull/88885), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG CLI and Testing] -- It is now possible to use the service annotation `cloud.google.com/network-tier: Standard` to configure the Network Tier of the GCE Loadbalancer ([#88532](https://github.com/kubernetes/kubernetes/pull/88532), [@zioproto](https://github.com/zioproto)) [SIG Cloud Provider, Network and Testing] -- Kube-scheduler: The metric name `scheduler_total_preemption_attempts` has been renamed to `scheduler_preemption_attempts_total`. ([#91448](https://github.com/kubernetes/kubernetes/pull/91448), [@RainbowMango](https://github.com/RainbowMango)) [SIG API Machinery, Cluster Lifecycle, Instrumentation and Scheduling] -- Kubeadm now forwards the IPv6DualStack feature gate using the kubelet component config, instead of the kubelet command line ([#90840](https://github.com/kubernetes/kubernetes/pull/90840), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] -- Kubeadm: do not use a DaemonSet for the pre-pull of control-plane images during "kubeadm upgrade apply". Individual node upgrades now pull the required images using a preflight check. The flag "--image-pull-timeout" for "kubeadm upgrade apply" is now deprecated and will be removed in a future release following a GA deprecation policy. ([#90788](https://github.com/kubernetes/kubernetes/pull/90788), [@xlgao-zju](https://github.com/xlgao-zju)) [SIG Cluster Lifecycle] -- Kubeadm: use two separate checks on /livez and /readyz for the kube-apiserver static Pod instead of using /healthz ([#90970](https://github.com/kubernetes/kubernetes/pull/90970), [@johscheuer](https://github.com/johscheuer)) [SIG Cluster Lifecycle] -- NONE ([#91597](https://github.com/kubernetes/kubernetes/pull/91597), [@elmiko](https://github.com/elmiko)) [SIG Autoscaling and Testing] -- Remove deprecated --server-dry-run flag from kubectl apply ([#91308](https://github.com/kubernetes/kubernetes/pull/91308), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG CLI and Testing] -- The "HostPath should give a volume the correct mode" is no longer a conformance test ([#90861](https://github.com/kubernetes/kubernetes/pull/90861), [@dims](https://github.com/dims)) [SIG Architecture and Testing] -- The Kubelet's --experimental-mounter-path and --experimental-check-node-capabilities-before-mount options are now marked as deprecated. ([#91373](https://github.com/kubernetes/kubernetes/pull/91373), [@knabben](https://github.com/knabben)) [SIG Node] -- The kube-apiserver `--kubelet-https` flag is deprecated. kube-apiserver connections to kubelets now unconditionally use `https` (kubelets have unconditionally used `https` to serve the endpoints the apiserver communicates with since before v1.0). ([#91630](https://github.com/kubernetes/kubernetes/pull/91630), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Node] -- Update CNI to v0.8.6 ([#91370](https://github.com/kubernetes/kubernetes/pull/91370), [@justaugustus](https://github.com/justaugustus)) [SIG Cloud Provider, Network, Release and Testing] -- `beta.kubernetes.io/os` and `beta.kubernetes.io/arch` node labels are deprecated. Update node selectors to use `kubernetes.io/os` and `kubernetes.io/arch`. ([#91046](https://github.com/kubernetes/kubernetes/pull/91046), [@wawa0210](https://github.com/wawa0210)) [SIG Apps and Node] -- base-images: Use debian-base:v2.1.0 ([#90697](https://github.com/kubernetes/kubernetes/pull/90697), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery and Release] -- base-images: Use debian-iptables:v12.1.0 ([#90782](https://github.com/kubernetes/kubernetes/pull/90782), [@justaugustus](https://github.com/justaugustus)) [SIG Release] - -## Dependencies - -### Added -- cloud.google.com/go/bigquery: v1.0.1 -- cloud.google.com/go/datastore: v1.0.0 -- cloud.google.com/go/pubsub: v1.0.1 -- cloud.google.com/go/storage: v1.0.0 -- dmitri.shuralyov.com/gpu/mtl: 666a987 -- github.com/cespare/xxhash/v2: [v2.1.1](https://github.com/cespare/xxhash/v2/tree/v2.1.1) -- github.com/chzyer/logex: [v1.1.10](https://github.com/chzyer/logex/tree/v1.1.10) -- github.com/chzyer/readline: [2972be2](https://github.com/chzyer/readline/tree/2972be2) -- github.com/chzyer/test: [a1ea475](https://github.com/chzyer/test/tree/a1ea475) -- github.com/containerd/cgroups: [bf292b2](https://github.com/containerd/cgroups/tree/bf292b2) -- github.com/containerd/continuity: [aaeac12](https://github.com/containerd/continuity/tree/aaeac12) -- github.com/containerd/fifo: [a9fb20d](https://github.com/containerd/fifo/tree/a9fb20d) -- github.com/containerd/go-runc: [5a6d9f3](https://github.com/containerd/go-runc/tree/5a6d9f3) -- github.com/coreos/bbolt: [v1.3.2](https://github.com/coreos/bbolt/tree/v1.3.2) -- github.com/cpuguy83/go-md2man/v2: [v2.0.0](https://github.com/cpuguy83/go-md2man/v2/tree/v2.0.0) -- github.com/go-gl/glfw/v3.3/glfw: [12ad95a](https://github.com/go-gl/glfw/v3.3/glfw/tree/12ad95a) -- github.com/google/renameio: [v0.1.0](https://github.com/google/renameio/tree/v0.1.0) -- github.com/ianlancetaylor/demangle: [5e5cf60](https://github.com/ianlancetaylor/demangle/tree/5e5cf60) -- github.com/rogpeppe/go-internal: [v1.3.0](https://github.com/rogpeppe/go-internal/tree/v1.3.0) -- github.com/russross/blackfriday/v2: [v2.0.1](https://github.com/russross/blackfriday/v2/tree/v2.0.1) -- github.com/shurcooL/sanitized_anchor_name: [v1.0.0](https://github.com/shurcooL/sanitized_anchor_name/tree/v1.0.0) -- github.com/ugorji/go: [v1.1.4](https://github.com/ugorji/go/tree/v1.1.4) -- golang.org/x/mod: v0.1.0 -- google.golang.org/protobuf: v1.23.0 -- gopkg.in/errgo.v2: v2.1.0 -- k8s.io/klog/v2: v2.0.0 - -### Changed -- cloud.google.com/go: v0.38.0 → v0.51.0 -- github.com/GoogleCloudPlatform/k8s-cloud-provider: [27a4ced → 7901bc8](https://github.com/GoogleCloudPlatform/k8s-cloud-provider/compare/27a4ced...7901bc8) -- github.com/Microsoft/hcsshim: [672e52e → v0.8.9](https://github.com/Microsoft/hcsshim/compare/672e52e...v0.8.9) -- github.com/alecthomas/template: [a0175ee → fb15b89](https://github.com/alecthomas/template/compare/a0175ee...fb15b89) -- github.com/alecthomas/units: [2efee85 → c3de453](https://github.com/alecthomas/units/compare/2efee85...c3de453) -- github.com/beorn7/perks: [v1.0.0 → v1.0.1](https://github.com/beorn7/perks/compare/v1.0.0...v1.0.1) -- github.com/coreos/pkg: [97fdf19 → 399ea9e](https://github.com/coreos/pkg/compare/97fdf19...399ea9e) -- github.com/go-kit/kit: [v0.8.0 → v0.9.0](https://github.com/go-kit/kit/compare/v0.8.0...v0.9.0) -- github.com/go-logfmt/logfmt: [v0.3.0 → v0.4.0](https://github.com/go-logfmt/logfmt/compare/v0.3.0...v0.4.0) -- github.com/golang/groupcache: [02826c3 → 215e871](https://github.com/golang/groupcache/compare/02826c3...215e871) -- github.com/golang/protobuf: [v1.3.3 → v1.4.2](https://github.com/golang/protobuf/compare/v1.3.3...v1.4.2) -- github.com/google/cadvisor: [8af10c6 → 6a8d614](https://github.com/google/cadvisor/compare/8af10c6...6a8d614) -- github.com/google/pprof: [3ea8567 → d4f498a](https://github.com/google/pprof/compare/3ea8567...d4f498a) -- github.com/googleapis/gax-go/v2: [v2.0.4 → v2.0.5](https://github.com/googleapis/gax-go/v2/compare/v2.0.4...v2.0.5) -- github.com/json-iterator/go: [v1.1.8 → v1.1.9](https://github.com/json-iterator/go/compare/v1.1.8...v1.1.9) -- github.com/jstemmer/go-junit-report: [af01ea7 → v0.9.1](https://github.com/jstemmer/go-junit-report/compare/af01ea7...v0.9.1) -- github.com/prometheus/client_golang: [v1.0.0 → v1.6.0](https://github.com/prometheus/client_golang/compare/v1.0.0...v1.6.0) -- github.com/prometheus/common: [v0.4.1 → v0.9.1](https://github.com/prometheus/common/compare/v0.4.1...v0.9.1) -- github.com/prometheus/procfs: [v0.0.5 → v0.0.11](https://github.com/prometheus/procfs/compare/v0.0.5...v0.0.11) -- github.com/spf13/cobra: [v0.0.5 → v1.0.0](https://github.com/spf13/cobra/compare/v0.0.5...v1.0.0) -- github.com/spf13/viper: [v1.3.2 → v1.4.0](https://github.com/spf13/viper/compare/v1.3.2...v1.4.0) -- github.com/tmc/grpc-websocket-proxy: [89b8d40 → 0ad062e](https://github.com/tmc/grpc-websocket-proxy/compare/89b8d40...0ad062e) -- go.opencensus.io: v0.21.0 → v0.22.2 -- go.uber.org/atomic: v1.3.2 → v1.4.0 -- golang.org/x/exp: 4b39c73 → da58074 -- golang.org/x/image: 0694c2d → cff245a -- golang.org/x/lint: 959b441 → fdd1cda -- golang.org/x/mobile: d3739f8 → d2bd2a2 -- golang.org/x/oauth2: 0f29369 → 858c2ad -- google.golang.org/api: 5213b80 → v0.15.1 -- google.golang.org/appengine: v1.5.0 → v1.6.5 -- google.golang.org/genproto: f3c370f → ca5a221 -- honnef.co/go/tools: e561f67 → v0.0.1-2019.2.3 -- k8s.io/gengo: e0e292d → 8167cfd -- k8s.io/kube-openapi: e1beb1b → 656914f -- k8s.io/utils: a9aa75a → 2df71eb -- sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.0.7 → 33b9978 - -### Removed -- github.com/coreos/go-etcd: [v2.0.0+incompatible](https://github.com/coreos/go-etcd/tree/v2.0.0) -- github.com/ugorji/go/codec: [d75b2dc](https://github.com/ugorji/go/codec/tree/d75b2dc) -- k8s.io/klog: v1.0.0 - - - -# v1.19.0-beta.0 - - -## Downloads for v1.19.0-beta.0 - -### Source Code - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes.tar.gz) | 8c7e820b8bd7a8f742b7560cafe6ae1acc4c9836ae23d1b10d987b4de6a690826be75c68b8f76ec027097e8dfd861afb1d229b3687f0b82afcfe7b4d6481242e -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-src.tar.gz) | 543e9d36fd8b2de3e19631d3295d3a7706e6e88bbd3adb2d558b27b3179a3961455f4f04f0d4a5adcff1466779e1b08023fe64dc2ab39813b37adfbbc779dec7 - -### Client binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-client-darwin-386.tar.gz) | 3ef37ef367a8d9803f023f6994d73ff217865654a69778c1ea3f58c88afbf25ff5d8d6bec9c608ac647c2654978228c4e63f30eec2a89d16d60f4a1c5f333b22 -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-client-darwin-amd64.tar.gz) | edb02b0b8d6a1c2167fbce4a85d84fb413566d3a76839fd366801414ca8ad2d55a5417b39b4cac6b65fddf13c1b3259791a607703773241ca22a67945ecb0014 -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-client-linux-386.tar.gz) | dafe93489df7328ae23f4bdf0a9d2e234e18effe7e042b217fe2dd1355e527a54bab3fb664696ed606a8ebedce57da4ee12647ec1befa2755bd4c43d9d016063 -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-client-linux-amd64.tar.gz) | d8e2bf8c9dd665410c2e7ceaa98bc4fc4f966753b7ade91dcef3b5eff45e0dda63bd634610c8761392a7804deb96c6b030c292280bf236b8b29f63b7f1af3737 -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-client-linux-arm.tar.gz) | d590d3d07d0ebbb562bce480c7cbe4e60b99feba24376c216fe73d8b99a246e2cd2acb72abe1427bde3e541d94d55b7688daf9e6961e4cbc6b875ac4eeea6e62 -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-client-linux-arm64.tar.gz) | f9647a99a566c9febd348c1c4a8e5c05326058eab076292a8bb5d3a2b882ee49287903f8e0e036b40af294aa3571edd23e65f3de91330ac9af0c10350b02583d -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-client-linux-ppc64le.tar.gz) | 662f009bc393734a89203d7956942d849bad29e28448e7baa017d1ac2ec2d26d7290da4a44bccb99ed960b2e336d9d98908c98f8a3d9fe1c54df2d134c799cad -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-client-linux-s390x.tar.gz) | 61fdf4aff78dcdb721b82a3602bf5bc94d44d51ab6607b255a9c2218bb3e4b57f6e656c2ee0dd68586fb53acbeff800d6fd03e4642dded49735a93356e7c5703 -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-client-windows-386.tar.gz) | 20d1e803b10b3bee09a7a206473ba320cc5f1120278d8f6e0136c388b2720da7264b917cd4738488b1d0a9aa922eb581c1f540715a6c2042c4dd7b217b6a9a0a -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-client-windows-amd64.tar.gz) | b85d729ec269f6aad0b6d2f95f3648fbea84330d2fbfde2267a519bc08c42d70d7b658b0e41c3b0d5f665702a8f1bbb37652753de34708ae3a03e45175c8b92c - -### Server binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-server-linux-amd64.tar.gz) | c3641bdb0a8d8eff5086d24b71c6547131092b21f976b080dc48129f91de3da560fed6edf880eab1d205017ad74be716a5b970e4bbc00d753c005e5932b3d319 -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-server-linux-arm.tar.gz) | 7c29b8e33ade23a787330d28da22bf056610dae4d3e15574c56c46340afe5e0fdb00126ae3fd64fd70a26d1a87019f47e401682b88fa1167368c7edbecc72ccf -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-server-linux-arm64.tar.gz) | 27cd6042425eb94bb468431599782467ed818bcc51d75e8cb251c287a806b60a5cce50d4ae7525348c5446eaa45f849bc3fe3e6ac7248b54f3ebae8bf6553c3f -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-server-linux-ppc64le.tar.gz) | ede896424eb12ec07dd3756cbe808ca3915f51227e7b927795402943d81a99bb61654fd8f485a838c2faf199d4a55071af5bd8e69e85669a7f4a0b0e84a093cc -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-server-linux-s390x.tar.gz) | 4e48d4f5afd22f0ae6ade7da4877238fd2a5c10ae3dea2ae721c39ac454b0b295e1d7501e26bddee4bc0289e79e33dadca255a52a645bee98cf81acf937db0ef - -### Node binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-node-linux-amd64.tar.gz) | 8025bd8deb9586487fcf268bdaf99e8fd9f9433d9e7221c29363d1d66c4cbd55a2c44e6c89bc8133828c6a1aa0c42c2359b74846dfb71765c9ae8f21b8170625 -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-node-linux-arm.tar.gz) | 25787d47c8cc1e9445218d3a947b443d261266033187f8b7bc6141ae353a6806503fe72e3626f058236d4cd7f284348d2cc8ccb7a0219b9ddd7c6a336dae360b -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-node-linux-arm64.tar.gz) | ff737a7310057bdfd603f2853b15f79dc2b54a3cbbbd7a8ffd4d9756720fa5a02637ffc10a381eeee58bef61024ff348a49f3044a6dfa0ba99645fda8d08e2da -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-node-linux-ppc64le.tar.gz) | 2b1144c9ae116306a2c3214b02361083a60a349afc804909f95ea85db3660de5025de69a1860e8fc9e7e92ded335c93b74ecbbb20e1f6266078842d4adaf4161 -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-node-linux-s390x.tar.gz) | 822ec64aef3d65faa668a91177aa7f5d0c78a83cc1284c5e30629eda448ee4b2874cf4cfa6f3d68ad8eb8029dd035bf9fe15f68cc5aa4b644513f054ed7910ae -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-beta.0/kubernetes-node-windows-amd64.tar.gz) | 3957cae43211df050c5a9991a48e23ac27d20aec117c580c53fc7edf47caf79ed1e2effa969b5b972968a83e9bdba0b20c46705caca0c35571713041481c1966 - -## Changelog since v1.19.0-alpha.3 - -## Changes by Kind - -### API Change - - EnvVarSource api doc bug fixes ([#91194](https://github.com/kubernetes/kubernetes/pull/91194), [@wawa0210](https://github.com/wawa0210)) [SIG Apps] - - The Kubelet's `--really-crash-for-testing` and `--chaos-chance` options are now marked as deprecated. ([#90499](https://github.com/kubernetes/kubernetes/pull/90499), [@knabben](https://github.com/knabben)) [SIG Node] - - `NodeResourcesLeastAllocated` and `NodeResourcesMostAllocated` plugins now support customized weight on the CPU and memory. ([#90544](https://github.com/kubernetes/kubernetes/pull/90544), [@chendave](https://github.com/chendave)) [SIG Scheduling] - -### Feature - - Add .import-restrictions file to cmd/cloud-controller-manager. ([#90630](https://github.com/kubernetes/kubernetes/pull/90630), [@nilo19](https://github.com/nilo19)) [SIG API Machinery and Cloud Provider] - - Add Annotations to CRI-API ImageSpec objects. ([#90061](https://github.com/kubernetes/kubernetes/pull/90061), [@marosset](https://github.com/marosset)) [SIG Node and Windows] - - Kubelets configured to rotate client certificates now publish a `certificate_manager_server_ttl_seconds` gauge metric indicating the remaining seconds until certificate expiration. ([#91148](https://github.com/kubernetes/kubernetes/pull/91148), [@liggitt](https://github.com/liggitt)) [SIG Auth and Node] - - Rest.Config now supports a flag to override proxy configuration that was previously only configurable through environment variables. ([#81443](https://github.com/kubernetes/kubernetes/pull/81443), [@mikedanese](https://github.com/mikedanese)) [SIG API Machinery and Node] - - Scores from PodTopologySpreading have reduced differentiation as maxSkew increases. ([#90820](https://github.com/kubernetes/kubernetes/pull/90820), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] - - Service controller: only sync LB node pools when relevant fields in Node changes ([#90769](https://github.com/kubernetes/kubernetes/pull/90769), [@andrewsykim](https://github.com/andrewsykim)) [SIG Apps and Network] - - Switch core master base images (kube-apiserver, kube-scheduler) from debian to distroless ([#90674](https://github.com/kubernetes/kubernetes/pull/90674), [@dims](https://github.com/dims)) [SIG Cloud Provider, Release and Scalability] - - Update cri-tools to v1.18.0 ([#89720](https://github.com/kubernetes/kubernetes/pull/89720), [@saschagrunert](https://github.com/saschagrunert)) [SIG Cloud Provider, Cluster Lifecycle, Release and Scalability] - -### Bug or Regression - - Add support for TLS 1.3 ciphers: TLS_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256 and TLS_AES_256_GCM_SHA384. ([#90843](https://github.com/kubernetes/kubernetes/pull/90843), [@pjbgf](https://github.com/pjbgf)) [SIG API Machinery, Auth and Cluster Lifecycle] - - Base-images: Update to kube-cross:v1.13.9-5 ([#90963](https://github.com/kubernetes/kubernetes/pull/90963), [@justaugustus](https://github.com/justaugustus)) [SIG Release and Testing] - - CloudNodeLifecycleController will check node existence status before shutdown status when monitoring nodes. ([#90737](https://github.com/kubernetes/kubernetes/pull/90737), [@jiahuif](https://github.com/jiahuif)) [SIG Apps and Cloud Provider] - - First pod with required affinity terms can schedule only on nodes with matching topology keys. ([#91168](https://github.com/kubernetes/kubernetes/pull/91168), [@ahg-g](https://github.com/ahg-g)) [SIG Scheduling] - - Fix VirtualMachineScaleSets.virtualMachines.GET not allowed issues when customers have set VMSS orchestrationMode. ([#91097](https://github.com/kubernetes/kubernetes/pull/91097), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] - - Fix a racing issue that scheduler may perform unnecessary scheduling attempt. ([#90660](https://github.com/kubernetes/kubernetes/pull/90660), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling and Testing] - - Fix kubectl run --dry-run client ignore namespace ([#90785](https://github.com/kubernetes/kubernetes/pull/90785), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] - - Fix public IP not shown issues after assigning public IP to Azure VMs ([#90886](https://github.com/kubernetes/kubernetes/pull/90886), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] - - Fix: azure disk dangling attach issue which would cause API throttling ([#90749](https://github.com/kubernetes/kubernetes/pull/90749), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] - - Fix: support removal of nodes backed by deleted non VMSS instances on Azure ([#91184](https://github.com/kubernetes/kubernetes/pull/91184), [@bpineau](https://github.com/bpineau)) [SIG Cloud Provider] - - Fixed a regression preventing garbage collection of RBAC role and binding objects ([#90534](https://github.com/kubernetes/kubernetes/pull/90534), [@apelisse](https://github.com/apelisse)) [SIG Auth] - - For external storage e2e test suite, update external driver, to pick snapshot provisioner from VolumeSnapshotClass, when a VolumeSnapshotClass is explicitly provided as an input. ([#90878](https://github.com/kubernetes/kubernetes/pull/90878), [@saikat-royc](https://github.com/saikat-royc)) [SIG Storage and Testing] - - In a HA env, during the period a standby scheduler lost connection to API server, if a Pod is deleted and recreated, and the standby scheduler becomes master afterwards, there could be a scheduler cache corruption. This PR fixes this issue. ([#91126](https://github.com/kubernetes/kubernetes/pull/91126), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling] - - Kubeadm: increase robustness for "kubeadm join" when adding etcd members on slower setups ([#90645](https://github.com/kubernetes/kubernetes/pull/90645), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] - - Prevent PVC requested size overflow when expanding or creating a volume ([#90907](https://github.com/kubernetes/kubernetes/pull/90907), [@gnufied](https://github.com/gnufied)) [SIG Cloud Provider and Storage] - - Scheduling failures due to no nodes available are now reported as unschedulable under ```schedule_attempts_total``` metric. ([#90989](https://github.com/kubernetes/kubernetes/pull/90989), [@ahg-g](https://github.com/ahg-g)) [SIG Scheduling] - -### Other (Cleanup or Flake) - - Adds additional testing to ensure that udp pods conntrack are cleaned up ([#90180](https://github.com/kubernetes/kubernetes/pull/90180), [@JacobTanenbaum](https://github.com/JacobTanenbaum)) [SIG Architecture, Network and Testing] - - Adjusts the fsType for cinder values to be `ext4` if no fsType is specified. ([#90608](https://github.com/kubernetes/kubernetes/pull/90608), [@huffmanca](https://github.com/huffmanca)) [SIG Storage] - - Change beta.kubernetes.io/os to kubernetes.io/os ([#89461](https://github.com/kubernetes/kubernetes/pull/89461), [@wawa0210](https://github.com/wawa0210)) [SIG Cloud Provider and Cluster Lifecycle] - - Improve server-side apply conflict errors by setting dedicated kubectl subcommand field managers ([#88885](https://github.com/kubernetes/kubernetes/pull/88885), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG CLI and Testing] - - It is now possible to use the service annotation `cloud.google.com/network-tier: Standard` to configure the Network Tier of the GCE Loadbalancer ([#88532](https://github.com/kubernetes/kubernetes/pull/88532), [@zioproto](https://github.com/zioproto)) [SIG Cloud Provider, Network and Testing] - - Kubeadm now forwards the IPv6DualStack feature gate using the kubelet component config, instead of the kubelet command line ([#90840](https://github.com/kubernetes/kubernetes/pull/90840), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] - - Kubeadm: do not use a DaemonSet for the pre-pull of control-plane images during "kubeadm upgrade apply". Individual node upgrades now pull the required images using a preflight check. The flag "--image-pull-timeout" for "kubeadm upgrade apply" is now deprecated and will be removed in a future release following a GA deprecation policy. ([#90788](https://github.com/kubernetes/kubernetes/pull/90788), [@xlgao-zju](https://github.com/xlgao-zju)) [SIG Cluster Lifecycle] - - Kubeadm: use two separate checks on /livez and /readyz for the kube-apiserver static Pod instead of using /healthz ([#90970](https://github.com/kubernetes/kubernetes/pull/90970), [@johscheuer](https://github.com/johscheuer)) [SIG Cluster Lifecycle] - - The "HostPath should give a volume the correct mode" is no longer a conformance test ([#90861](https://github.com/kubernetes/kubernetes/pull/90861), [@dims](https://github.com/dims)) [SIG Architecture and Testing] - - `beta.kubernetes.io/os` and `beta.kubernetes.io/arch` node labels are deprecated. Update node selectors to use `kubernetes.io/os` and `kubernetes.io/arch`. ([#91046](https://github.com/kubernetes/kubernetes/pull/91046), [@wawa0210](https://github.com/wawa0210)) [SIG Apps and Node] - - base-images: Use debian-base:v2.1.0 ([#90697](https://github.com/kubernetes/kubernetes/pull/90697), [@justaugustus](https://github.com/justaugustus)) [SIG API Machinery and Release] - - base-images: Use debian-iptables:v12.1.0 ([#90782](https://github.com/kubernetes/kubernetes/pull/90782), [@justaugustus](https://github.com/justaugustus)) [SIG Release] - -## Dependencies - -### Added -- cloud.google.com/go/bigquery: v1.0.1 -- cloud.google.com/go/datastore: v1.0.0 -- cloud.google.com/go/pubsub: v1.0.1 -- cloud.google.com/go/storage: v1.0.0 -- dmitri.shuralyov.com/gpu/mtl: 666a987 -- github.com/cespare/xxhash/v2: [v2.1.1](https://github.com/cespare/xxhash/v2/tree/v2.1.1) -- github.com/chzyer/logex: [v1.1.10](https://github.com/chzyer/logex/tree/v1.1.10) -- github.com/chzyer/readline: [2972be2](https://github.com/chzyer/readline/tree/2972be2) -- github.com/chzyer/test: [a1ea475](https://github.com/chzyer/test/tree/a1ea475) -- github.com/coreos/bbolt: [v1.3.2](https://github.com/coreos/bbolt/tree/v1.3.2) -- github.com/cpuguy83/go-md2man/v2: [v2.0.0](https://github.com/cpuguy83/go-md2man/v2/tree/v2.0.0) -- github.com/go-gl/glfw/v3.3/glfw: [12ad95a](https://github.com/go-gl/glfw/v3.3/glfw/tree/12ad95a) -- github.com/google/renameio: [v0.1.0](https://github.com/google/renameio/tree/v0.1.0) -- github.com/ianlancetaylor/demangle: [5e5cf60](https://github.com/ianlancetaylor/demangle/tree/5e5cf60) -- github.com/rogpeppe/go-internal: [v1.3.0](https://github.com/rogpeppe/go-internal/tree/v1.3.0) -- github.com/russross/blackfriday/v2: [v2.0.1](https://github.com/russross/blackfriday/v2/tree/v2.0.1) -- github.com/shurcooL/sanitized_anchor_name: [v1.0.0](https://github.com/shurcooL/sanitized_anchor_name/tree/v1.0.0) -- github.com/ugorji/go: [v1.1.4](https://github.com/ugorji/go/tree/v1.1.4) -- golang.org/x/mod: v0.1.0 -- google.golang.org/protobuf: v1.23.0 -- gopkg.in/errgo.v2: v2.1.0 -- k8s.io/klog/v2: v2.0.0 - -### Changed -- cloud.google.com/go: v0.38.0 → v0.51.0 -- github.com/GoogleCloudPlatform/k8s-cloud-provider: [27a4ced → 7901bc8](https://github.com/GoogleCloudPlatform/k8s-cloud-provider/compare/27a4ced...7901bc8) -- github.com/alecthomas/template: [a0175ee → fb15b89](https://github.com/alecthomas/template/compare/a0175ee...fb15b89) -- github.com/alecthomas/units: [2efee85 → c3de453](https://github.com/alecthomas/units/compare/2efee85...c3de453) -- github.com/beorn7/perks: [v1.0.0 → v1.0.1](https://github.com/beorn7/perks/compare/v1.0.0...v1.0.1) -- github.com/coreos/pkg: [97fdf19 → 399ea9e](https://github.com/coreos/pkg/compare/97fdf19...399ea9e) -- github.com/go-kit/kit: [v0.8.0 → v0.9.0](https://github.com/go-kit/kit/compare/v0.8.0...v0.9.0) -- github.com/go-logfmt/logfmt: [v0.3.0 → v0.4.0](https://github.com/go-logfmt/logfmt/compare/v0.3.0...v0.4.0) -- github.com/golang/groupcache: [02826c3 → 215e871](https://github.com/golang/groupcache/compare/02826c3...215e871) -- github.com/golang/protobuf: [v1.3.3 → v1.4.2](https://github.com/golang/protobuf/compare/v1.3.3...v1.4.2) -- github.com/google/cadvisor: [8af10c6 → 6a8d614](https://github.com/google/cadvisor/compare/8af10c6...6a8d614) -- github.com/google/pprof: [3ea8567 → d4f498a](https://github.com/google/pprof/compare/3ea8567...d4f498a) -- github.com/googleapis/gax-go/v2: [v2.0.4 → v2.0.5](https://github.com/googleapis/gax-go/v2/compare/v2.0.4...v2.0.5) -- github.com/json-iterator/go: [v1.1.8 → v1.1.9](https://github.com/json-iterator/go/compare/v1.1.8...v1.1.9) -- github.com/jstemmer/go-junit-report: [af01ea7 → v0.9.1](https://github.com/jstemmer/go-junit-report/compare/af01ea7...v0.9.1) -- github.com/prometheus/client_golang: [v1.0.0 → v1.6.0](https://github.com/prometheus/client_golang/compare/v1.0.0...v1.6.0) -- github.com/prometheus/common: [v0.4.1 → v0.9.1](https://github.com/prometheus/common/compare/v0.4.1...v0.9.1) -- github.com/prometheus/procfs: [v0.0.5 → v0.0.11](https://github.com/prometheus/procfs/compare/v0.0.5...v0.0.11) -- github.com/spf13/cobra: [v0.0.5 → v1.0.0](https://github.com/spf13/cobra/compare/v0.0.5...v1.0.0) -- github.com/spf13/viper: [v1.3.2 → v1.4.0](https://github.com/spf13/viper/compare/v1.3.2...v1.4.0) -- github.com/tmc/grpc-websocket-proxy: [89b8d40 → 0ad062e](https://github.com/tmc/grpc-websocket-proxy/compare/89b8d40...0ad062e) -- go.opencensus.io: v0.21.0 → v0.22.2 -- go.uber.org/atomic: v1.3.2 → v1.4.0 -- golang.org/x/exp: 4b39c73 → da58074 -- golang.org/x/image: 0694c2d → cff245a -- golang.org/x/lint: 959b441 → fdd1cda -- golang.org/x/mobile: d3739f8 → d2bd2a2 -- golang.org/x/oauth2: 0f29369 → 858c2ad -- google.golang.org/api: 5213b80 → v0.15.1 -- google.golang.org/appengine: v1.5.0 → v1.6.5 -- google.golang.org/genproto: f3c370f → ca5a221 -- honnef.co/go/tools: e561f67 → v0.0.1-2019.2.3 -- k8s.io/gengo: e0e292d → 8167cfd -- k8s.io/kube-openapi: e1beb1b → 656914f -- k8s.io/utils: a9aa75a → 2df71eb -- sigs.k8s.io/apiserver-network-proxy/konnectivity-client: v0.0.7 → 33b9978 - -### Removed -- github.com/coreos/go-etcd: [v2.0.0+incompatible](https://github.com/coreos/go-etcd/tree/v2.0.0) -- github.com/ugorji/go/codec: [d75b2dc](https://github.com/ugorji/go/codec/tree/d75b2dc) -- k8s.io/klog: v1.0.0 - - - -# v1.19.0-alpha.3 - -[Documentation](https://docs.k8s.io) - -## Downloads for v1.19.0-alpha.3 - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes.tar.gz) | `49df3a77453b759d3262be6883dd9018426666b4261313725017eed42da1bc8dd1af037ec6c11357a6360c0c32c2486490036e9e132c9026f491325ce353c84b` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-src.tar.gz) | `ddbb0baaf77516dc885c41017f4a8d91d0ff33eeab14009168a1e4d975939ccc6a053a682c2af14346c67fe7b142aa2c1ba32e86a30f2433cefa423764c5332d` - -### Client Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-client-darwin-386.tar.gz) | `c0fb1afb5b22f6e29cf3e5121299d3a5244a33b7663e041209bcc674a0009842b35b9ebdafa5bd6b91a1e1b67fa891e768627b97ea5258390d95250f07c2defc` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-client-darwin-amd64.tar.gz) | `f32596863fed32bc8e3f032ef1e4f9f232898ed506624cb1b4877ce2ced2a0821d70b15599258422aa13181ab0e54f38837399ca611ab86cbf3feec03ede8b95` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-client-linux-386.tar.gz) | `37290244cee54ff05662c2b14b69445eee674d385e6b05ca0b8c8b410ba047cf054033229c78af91670ca1370807753103c25dbb711507edc1c6beca87bd0988` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-client-linux-amd64.tar.gz) | `3753eb28b9d68a47ef91fff3e91215015c28bce12828f81c0bbddbde118fd2cf4d580e474e54b1e8176fa547829e2ed08a4df36bbf83b912c831a459821bd581` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-client-linux-arm.tar.gz) | `86b1cdb59a6b4e9de4496e5aa817b1ae7687ac6a93f8b8259cdeb356020773711d360a2ea35f7a8dc1bdd6d31c95e6491abf976afaff3392eb7d2df1008e192c` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-client-linux-arm64.tar.gz) | `fbf324e92b93cd8048073b2a627ddc8866020bc4f086604d82bf4733d463411a534d8c8f72565976eb1b32be64aecae8858cd140ef8b7a3c96fcbbf92ca54689` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-client-linux-ppc64le.tar.gz) | `7a6551eca17d29efb5d818e360b53ab2f0284e1091cc537e0a7ce39843d0b77579f26eb14bdeca9aa9e0aa0ef92ce1ccde34bdce84b4a5c1e090206979afb0ea` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-client-linux-s390x.tar.gz) | `46352be54882cf3edb949b355e71daea839c9b1955ccfe1085590b81326665d81cabde192327d82e56d6a157e224caefdcfbec3364b9f8b18b5da0cfcb97fc0c` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-client-windows-386.tar.gz) | `d049bf5f27e5e646ea4aa657aa0a694de57394b0dc60eadf1f7516d1ca6a6db39fc89d34bb6bba0a82f0c140113c2a91c41ad409e0ab41118a104f47eddcb9d2` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-client-windows-amd64.tar.gz) | `2e585f6f97b86443a6e3a847c8dfaa29c6323f8d5bbfdb86dc7bf5465ba54f64b35ee55a6d38e9be105a67fff39057ad16db3f3b1c3b9c909578517f4da7e51e` - -### Server Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-server-linux-amd64.tar.gz) | `8c41c6abf32ba7040c2cc654765d443e615d96891eacf6bcec24146a8aaf79b9206d13358518958e5ec04eb911ade108d4522ebd8603b88b3e3d95e7d5b24e60` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-server-linux-arm.tar.gz) | `7e54c60bf724e2e3e2cff1197512ead0f73030788877f2f92a7e0deeeabd86e75ce8120eb815bf63909f8a110e647a5fcfddd510efffbd9c339bd0f90caa6706` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-server-linux-arm64.tar.gz) | `7c57fd80b18be6dd6b6e17558d12ec0c07c06ce248e99837737fdd39b7f5d752597679748dc6294563f30def986ed712a8f469f3ea1c3a4cbe5d63c44f1d41dc` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-server-linux-ppc64le.tar.gz) | `d22b1d4d8ccf9e9df8f90d35b8d2a1e7916f8d809806743cddc00b15d8ace095c54c61d7c9affd6609a316ee14ba43bf760bfec4276aee8273203aab3e7ac3c1` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-server-linux-s390x.tar.gz) | `3177c9a2d6bd116d614fa69ff9cb16b822bee4e36e38f93ece6aeb5d118ae67dbe61546c7f628258ad719e763c127ca32437ded70279ea869cfe4869e06cbdde` - -### Node Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-node-linux-amd64.tar.gz) | `543248e35c57454bfc4b6f3cf313402d7cf81606b9821a5dd95c6758d55d5b9a42e283a7fb0d45322ad1014e3382aafaee69879111c0799dac31d5c4ad1b8041` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-node-linux-arm.tar.gz) | `c94bed3861376d3fd41cb7bc93b5a849612bc7346ed918f6b5b634449cd3acef69ff63ca0b6da29f45df68402f64f3d290d7688bc50f46dac07e889219dac30c` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-node-linux-arm64.tar.gz) | `3649dbca59d08c3922830b7acd8176e8d2f622fbf6379288f3a70045763d5d72c944d241f8a2c57306f23e6e44f7cc3b912554442f77e0f90e9f876f240114a8` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-node-linux-ppc64le.tar.gz) | `5655d1d48a1ae97352af2d703954c7a28c2d1c644319c4eb24fe19ccc5fb546c30b34cc86d8910f26c88feee88d7583bc085ebfe58916054f73dcf372a824fd9` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-node-linux-s390x.tar.gz) | `55190804357a687c37d1abb489d5aef7cea209d1c03778548f0aa4dab57a0b98b710fda09ff5c46d0963f2bb674726301d544b359f673df8f57226cafa831ce3` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.3/kubernetes-node-windows-amd64.tar.gz) | `d8ffbe8dc9a0b0b55db357afa6ef94e6145f9142b1bc505897cac9ee7c950ef527a189397a8e61296e66ce76b020eccb276668256927d2273d6079b9ffebef24` - -## Changelog since v1.19.0-alpha.2 - -## Urgent Upgrade Notes - -### (No, really, you MUST read this before you upgrade) - -- Kubeadm does not set the deprecated '--cgroup-driver' flag in /var/lib/kubelet/kubeadm-flags.env, it will be set in the kubelet config.yaml. If you have this flag in /var/lib/kubelet/kubeadm-flags.env or /etc/default/kubelet (/etc/sysconfig/kubelet for RPMs) please remove it and set the value using KubeletConfiguration ([#90513](https://github.com/kubernetes/kubernetes/pull/90513), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] - -- Kubeadm respects resolvConf value set by user even if systemd-resolved service is active. kubeadm no longer sets the flag in '--resolv-conf' in /var/lib/kubelet/kubeadm-flags.env. If you have this flag in /var/lib/kubelet/kubeadm-flags.env or /etc/default/kubelet (/etc/sysconfig/kubelet for RPMs) please remove it and set the value using KubeletConfiguration ([#90394](https://github.com/kubernetes/kubernetes/pull/90394), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] - -## Changes by Kind - -### Deprecation - -- Apiextensions.k8s.io/v1beta1 is deprecated in favor of apiextensions.k8s.io/v1 ([#90673](https://github.com/kubernetes/kubernetes/pull/90673), [@deads2k](https://github.com/deads2k)) [SIG API Machinery] -- Apiregistration.k8s.io/v1beta1 is deprecated in favor of apiregistration.k8s.io/v1 ([#90672](https://github.com/kubernetes/kubernetes/pull/90672), [@deads2k](https://github.com/deads2k)) [SIG API Machinery] -- Authentication.k8s.io/v1beta1 and authorization.k8s.io/v1beta1 are deprecated in 1.19 in favor of v1 levels and will be removed in 1.22 ([#90458](https://github.com/kubernetes/kubernetes/pull/90458), [@deads2k](https://github.com/deads2k)) [SIG API Machinery and Auth] -- Autoscaling/v2beta1 is deprecated in favor of autoscaling/v2beta2 ([#90463](https://github.com/kubernetes/kubernetes/pull/90463), [@deads2k](https://github.com/deads2k)) [SIG Autoscaling] -- Coordination.k8s.io/v1beta1 is deprecated in 1.19, targeted for removal in 1.22, use v1 instead. ([#90559](https://github.com/kubernetes/kubernetes/pull/90559), [@deads2k](https://github.com/deads2k)) [SIG Scalability] -- Storage.k8s.io/v1beta1 is deprecated in favor of storage.k8s.io/v1 ([#90671](https://github.com/kubernetes/kubernetes/pull/90671), [@deads2k](https://github.com/deads2k)) [SIG Storage] - -### API Change - -- K8s.io/apimachinery - scheme.Convert() now uses only explicitly registered conversions - default reflection based conversion is no longer available. `+k8s:conversion-gen` tags can be used with the `k8s.io/code-generator` component to generate conversions. ([#90018](https://github.com/kubernetes/kubernetes/pull/90018), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery, Apps and Testing] -- Kubelet's --runonce option is now also available in Kubelet's config file as `runOnce`. ([#89128](https://github.com/kubernetes/kubernetes/pull/89128), [@vincent178](https://github.com/vincent178)) [SIG Node] -- Promote Immutable Secrets/ConfigMaps feature to Beta and enable the feature by default. - This allows to set `Immutable` field in Secrets or ConfigMap object to mark their contents as immutable. ([#89594](https://github.com/kubernetes/kubernetes/pull/89594), [@wojtek-t](https://github.com/wojtek-t)) [SIG Apps and Testing] -- The unused `series.state` field, deprecated since v1.14, is removed from the `events.k8s.io/v1beta1` and `v1` Event types. ([#90449](https://github.com/kubernetes/kubernetes/pull/90449), [@wojtek-t](https://github.com/wojtek-t)) [SIG Apps] - -### Feature - -- Kube-apiserver: The NodeRestriction admission plugin now restricts Node labels kubelets are permitted to set when creating a new Node to the `--node-labels` parameters accepted by kubelets in 1.16+. ([#90307](https://github.com/kubernetes/kubernetes/pull/90307), [@liggitt](https://github.com/liggitt)) [SIG Auth and Node] -- Kubectl supports taint no without specifying(without having to type the full resource name) ([#88723](https://github.com/kubernetes/kubernetes/pull/88723), [@wawa0210](https://github.com/wawa0210)) [SIG CLI] -- New scoring for PodTopologySpreading that yields better spreading ([#90475](https://github.com/kubernetes/kubernetes/pull/90475), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- No ([#89549](https://github.com/kubernetes/kubernetes/pull/89549), [@happinesstaker](https://github.com/happinesstaker)) [SIG API Machinery, Auth, Instrumentation and Testing] -- Try to send watch bookmarks (if requested) periodically in addition to sending them right before timeout ([#90560](https://github.com/kubernetes/kubernetes/pull/90560), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery] - -### Bug or Regression - -- Avoid GCE API calls when initializing GCE CloudProvider for Kubelets. ([#90218](https://github.com/kubernetes/kubernetes/pull/90218), [@wojtek-t](https://github.com/wojtek-t)) [SIG Cloud Provider and Scalability] -- Avoid unnecessary scheduling churn when annotations are updated while Pods are being scheduled. ([#90373](https://github.com/kubernetes/kubernetes/pull/90373), [@fabiokung](https://github.com/fabiokung)) [SIG Scheduling] -- Fix a bug where ExternalTrafficPolicy is not applied to service ExternalIPs. ([#90537](https://github.com/kubernetes/kubernetes/pull/90537), [@freehan](https://github.com/freehan)) [SIG Network] -- Fixed a regression in wait.Forever that skips the backoff period on the first repeat ([#90476](https://github.com/kubernetes/kubernetes/pull/90476), [@zhan849](https://github.com/zhan849)) [SIG API Machinery] -- Fixes a bug that non directory hostpath type can be recognized as HostPathFile and adds e2e tests for HostPathType ([#64829](https://github.com/kubernetes/kubernetes/pull/64829), [@dixudx](https://github.com/dixudx)) [SIG Apps, Storage and Testing] -- Fixes a regression in 1.17 that dropped cache-control headers on API requests ([#90468](https://github.com/kubernetes/kubernetes/pull/90468), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Testing] -- Fixes regression in CPUManager that caused freeing of exclusive CPUs at incorrect times ([#90377](https://github.com/kubernetes/kubernetes/pull/90377), [@cbf123](https://github.com/cbf123)) [SIG Cloud Provider and Node] -- Fixes regression in CPUManager that had the (rare) possibility to release exclusive CPUs in app containers inherited from init containers. ([#90419](https://github.com/kubernetes/kubernetes/pull/90419), [@klueska](https://github.com/klueska)) [SIG Node] -- Jsonpath support in kubectl / client-go serializes complex types (maps / slices / structs) as json instead of Go-syntax. ([#89660](https://github.com/kubernetes/kubernetes/pull/89660), [@pjferrell](https://github.com/pjferrell)) [SIG API Machinery, CLI and Cluster Lifecycle] -- Kubeadm: ensure `image-pull-timeout` flag is respected during upgrade phase ([#90328](https://github.com/kubernetes/kubernetes/pull/90328), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] -- Kubeadm: fix misleading warning for the kube-apiserver authz modes during "kubeadm init" ([#90064](https://github.com/kubernetes/kubernetes/pull/90064), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Provides a fix to allow a cluster in a private Azure cloud to authenticate to ACR in the same cloud. ([#90425](https://github.com/kubernetes/kubernetes/pull/90425), [@DavidParks8](https://github.com/DavidParks8)) [SIG Cloud Provider] -- Update github.com/moby/ipvs to v1.0.1 to fix IPVS compatiblity issue with older kernels ([#90555](https://github.com/kubernetes/kubernetes/pull/90555), [@andrewsykim](https://github.com/andrewsykim)) [SIG Network] -- Updates to pod status via the status subresource now validate that `status.podIP` and `status.podIPs` fields are well-formed. ([#90628](https://github.com/kubernetes/kubernetes/pull/90628), [@liggitt](https://github.com/liggitt)) [SIG Apps and Node] - -### Other (Cleanup or Flake) - -- Drop some conformance tests that rely on Kubelet API directly ([#90615](https://github.com/kubernetes/kubernetes/pull/90615), [@dims](https://github.com/dims)) [SIG Architecture, Network, Release and Testing] -- Kube-proxy exposes a new metric, `kubeproxy_sync_proxy_rules_last_queued_timestamp_seconds`, that indicates the last time a change for kube-proxy was queued to be applied. ([#90175](https://github.com/kubernetes/kubernetes/pull/90175), [@squeed](https://github.com/squeed)) [SIG Instrumentation and Network] -- Kubeadm: fix badly formatted error message for small service CIDRs ([#90411](https://github.com/kubernetes/kubernetes/pull/90411), [@johscheuer](https://github.com/johscheuer)) [SIG Cluster Lifecycle] -- None. ([#90484](https://github.com/kubernetes/kubernetes/pull/90484), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] -- Remove the repeated calculation of nodeName and hostname during kubelet startup, these parameters are all calculated in the `RunKubelet` method ([#90284](https://github.com/kubernetes/kubernetes/pull/90284), [@wawa0210](https://github.com/wawa0210)) [SIG Node] -- UI change ([#87743](https://github.com/kubernetes/kubernetes/pull/87743), [@u2takey](https://github.com/u2takey)) [SIG Apps and Node] -- Update opencontainers/runtime-spec dependency to v1.0.2 ([#89644](https://github.com/kubernetes/kubernetes/pull/89644), [@saschagrunert](https://github.com/saschagrunert)) [SIG Node] - - -# v1.19.0-alpha.2 - -[Documentation](https://docs.k8s.io) - -## Downloads for v1.19.0-alpha.2 - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes.tar.gz) | `a1106309d18a5d73882650f8a5cbd1f287436a0dc527136808e5e882f5e98d6b0d80029ff53abc0c06ac240f6b879167437f15906e5309248d536ec1675ed909` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-src.tar.gz) | `c24c0b2a99ad0d834e0f017d7436fa84c6de8f30e8768ee59b1a418eb66a9b34ed4bcc25e03c04b19ea17366564f4ee6fe55a520fa4d0837e86c0a72fc7328c1` - -### Client Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-client-darwin-386.tar.gz) | `51ede026b0f8338f7fd293fb096772a67f88f23411c3280dff2f9efdd3ad7be7917d5c32ba764162c1a82b14218a90f624271c3cd8f386c8e41e4a9eac28751f` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-client-darwin-amd64.tar.gz) | `4ed4358cabbecf724d974207746303638c7f23d422ece9c322104128c245c8485e37d6ffdd9d17e13bb1d8110e870c0fe17dcc1c9e556b69a4df7d34b6ff66d5` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-client-linux-386.tar.gz) | `a57b10f146083828f18d809dbe07938b72216fa21083e7dbb9acce7dbcc3e8c51b8287d3bf89e81c8e1af4dd139075c675cc0f6ae7866ef69a3813db09309b97` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-client-linux-amd64.tar.gz) | `099247419dd34dc78131f24f1890cc5c6a739e887c88fae96419d980c529456bfd45c4e451ba5b6425320ddc764245a2eab1bd5e2b5121d9a2774bdb5df9438b` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-client-linux-arm.tar.gz) | `d12704bc6c821d3afcd206234fbd32e57cefcb5a5d15a40434b6b0ef4781d7fa77080e490678005225f24b116540ff51e436274debf66a6eb2247cd1dc833e6c` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-client-linux-arm64.tar.gz) | `da0d110751fa9adac69ed2166eb82b8634989a32b65981eff014c84449047abfb94fe015e2d2e22665d57ff19f673e2c9f6549c578ad1b1e2f18b39871b50b81` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-client-linux-ppc64le.tar.gz) | `7ac2b85bba9485dd38aed21895d627d34beb9e3b238e0684a9864f4ce2cfa67d7b3b7c04babc2ede7144d05beacdbe11c28c7d53a5b0041004700b2854b68042` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-client-linux-s390x.tar.gz) | `ac447eabc5002a059e614b481d25e668735a7858134f8ad49feb388bb9f9191ff03b65da57bb49811119983e8744c8fdc7d19c184d9232bd6d038fae9eeec7c6` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-client-windows-386.tar.gz) | `7c7dac7af329e4515302e7c35d3a19035352b4211942f254a4bb94c582a89d740b214d236ba6e35b9e78945a06b7e6fe8d70da669ecc19a40b7a9e8eaa2c0a28` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-client-windows-amd64.tar.gz) | `0c89b70a25551123ffdd7c5d3cc499832454745508c5f539f13b4ea0bf6eea1afd16e316560da9cf68e5178ae69d91ccfe6c02d7054588db3fac15c30ed96f4b` - -### Server Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-server-linux-amd64.tar.gz) | `3396e6e0516a09999ec26631e305cf0fb1eb0109ca1490837550b7635eb051dd92443de8f4321971fc2b4030ea2d8da4bfe8b85887505dec96e2a136b6a46617` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-server-linux-arm.tar.gz) | `cdea122a2d8d602ec0c89c1135ecfc27c47662982afc5b94edf4a6db7d759f27d6fe8d8b727bddf798bfec214a50e8d8a6d8eb0bca2ad5b1f72eb3768afd37f1` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-server-linux-arm64.tar.gz) | `6543186a3f4437fb475fbc6a5f537640ab00afb2a22678c468c3699b3f7493f8b35fb6ca14694406ffc90ff8faad17a1d9d9d45732baa976cb69f4b27281295a` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-server-linux-ppc64le.tar.gz) | `fde8dfeb9a0b243c8bef5127a9c63bf685429e2ff7e486ac8bae373882b87a4bd1b28a12955e3cce1c04eb0e6a67aabba43567952f9deef943a75fcb157a949c` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-server-linux-s390x.tar.gz) | `399d004ee4db5d367f37a1fa9ace63b5db4522bd25eeb32225019f3df9b70c715d2159f6556015ddffe8f49aa0f72a1f095f742244637105ddbed3fb09570d0d` - -### Node Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-node-linux-amd64.tar.gz) | `fd865c2fcc71796d73c90982f90c789a44a921cf1d56aee692bd00efaa122dcc903b0448f285a06b0a903e809f8310546764b742823fb8d10690d36ec9e27cbd` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-node-linux-arm.tar.gz) | `63aeb35222241e2a9285aeee4190b4b49c49995666db5cdb142016ca87872e7fdafc9723bc5de1797a45cc7e950230ed27be93ac165b8cda23ca2a9f9233c27a` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-node-linux-arm64.tar.gz) | `3532574d9babfc064ce90099b514eadfc2a4ce69091f92d9c1a554ead91444373416d1506a35ef557438606a96cf0e5168a83ddd56c92593ea4adaa15b0b56a8` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-node-linux-ppc64le.tar.gz) | `de59d91e5b0e4549e9a97f3a0243236e97babaed08c70f1a17273abf1966e6127db7546e1f91c3d66e933ce6eeb70bc65632ab473aa2c1be2a853da026c9d725` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-node-linux-s390x.tar.gz) | `0cb8cf6f8dffd63122376a2f3e8986a2db155494a45430beea7cb5d1180417072428dabebd1af566ea13a4f079d46368c8b549be4b8a6c0f62a974290fd2fdb0` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.2/kubernetes-node-windows-amd64.tar.gz) | `f1faf695f9f6fded681653f958b48779a2fecf50803af49787acba192441790c38b2b611ec8e238971508c56e67bb078fb423e8f6d9bddb392c199b5ee47937c` - -## Changelog since v1.19.0-alpha.1 - -## Urgent Upgrade Notes - -### (No, really, you MUST read this before you upgrade) - -- Kubeadm now respects user specified etcd versions in the ClusterConfiguration and properly uses them. If users do not want to stick to the version specified in the ClusterConfiguration, they should edit the kubeadm-config config map and delete it. ([#89588](https://github.com/kubernetes/kubernetes/pull/89588), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] - -## Changes by Kind - -### API Change - -- Kube-proxy: add `--bind-address-hard-fail` flag to treat failure to bind to a port as fatal ([#89350](https://github.com/kubernetes/kubernetes/pull/89350), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle and Network] -- Remove kubescheduler.config.k8s.io/v1alpha1 ([#89298](https://github.com/kubernetes/kubernetes/pull/89298), [@gavinfish](https://github.com/gavinfish)) [SIG Scheduling] -- ServiceAppProtocol feature gate is now beta and enabled by default, adding new AppProtocol field to Services and Endpoints. ([#90023](https://github.com/kubernetes/kubernetes/pull/90023), [@robscott](https://github.com/robscott)) [SIG Apps and Network] -- The Kubelet's `--volume-plugin-dir` option is now available via the Kubelet config file field `VolumePluginDir`. ([#88480](https://github.com/kubernetes/kubernetes/pull/88480), [@savitharaghunathan](https://github.com/savitharaghunathan)) [SIG Node] - -### Feature - -- Add client-side and server-side dry-run support to kubectl scale ([#89666](https://github.com/kubernetes/kubernetes/pull/89666), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG CLI and Testing] -- Add support for cgroups v2 node validation ([#89901](https://github.com/kubernetes/kubernetes/pull/89901), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle and Node] -- Detailed scheduler scoring result can be printed at verbose level 10. ([#89384](https://github.com/kubernetes/kubernetes/pull/89384), [@Huang-Wei](https://github.com/Huang-Wei)) [SIG Scheduling] -- E2e.test can print the list of conformance tests that need to pass for the cluster to be conformant. ([#88924](https://github.com/kubernetes/kubernetes/pull/88924), [@dims](https://github.com/dims)) [SIG Architecture and Testing] -- Feat: add azure shared disk support ([#89511](https://github.com/kubernetes/kubernetes/pull/89511), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] -- Kube-apiserver backed by etcd3 exports metric showing the database file size. ([#89151](https://github.com/kubernetes/kubernetes/pull/89151), [@jingyih](https://github.com/jingyih)) [SIG API Machinery] -- Kube-apiserver: The NodeRestriction admission plugin now restricts Node labels kubelets are permitted to set when creating a new Node to the `--node-labels` parameters accepted by kubelets in 1.16+. ([#90307](https://github.com/kubernetes/kubernetes/pull/90307), [@liggitt](https://github.com/liggitt)) [SIG Auth and Node] -- Kubeadm: during 'upgrade apply', if the kube-proxy ConfigMap is missing, assume that kube-proxy should not be upgraded. Same applies to a missing kube-dns/coredns ConfigMap for the DNS server addon. Note that this is a temporary workaround until 'upgrade apply' supports phases. Once phases are supported the kube-proxy/dns upgrade should be skipped manually. ([#89593](https://github.com/kubernetes/kubernetes/pull/89593), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Kubeadm: switch control-plane static Pods to the "system-node-critical" priority class ([#90063](https://github.com/kubernetes/kubernetes/pull/90063), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Support for running on a host that uses cgroups v2 unified mode ([#85218](https://github.com/kubernetes/kubernetes/pull/85218), [@giuseppe](https://github.com/giuseppe)) [SIG Node] -- Update etcd client side to v3.4.7 ([#89822](https://github.com/kubernetes/kubernetes/pull/89822), [@jingyih](https://github.com/jingyih)) [SIG API Machinery and Cloud Provider] - -### Bug or Regression - -- An issue preventing GCP cloud-controller-manager running out-of-cluster to initialize new Nodes is now fixed. ([#90057](https://github.com/kubernetes/kubernetes/pull/90057), [@ialidzhikov](https://github.com/ialidzhikov)) [SIG Apps and Cloud Provider] -- Avoid unnecessary GCE API calls when adding IP alises or reflecting them in Node object in GCE cloud provider. ([#90242](https://github.com/kubernetes/kubernetes/pull/90242), [@wojtek-t](https://github.com/wojtek-t)) [SIG Apps, Cloud Provider and Network] -- Azure: fix concurreny issue in lb creation ([#89604](https://github.com/kubernetes/kubernetes/pull/89604), [@aramase](https://github.com/aramase)) [SIG Cloud Provider] -- Bug fix for AWS NLB service when nodePort for existing servicePort changed manually. ([#89562](https://github.com/kubernetes/kubernetes/pull/89562), [@M00nF1sh](https://github.com/M00nF1sh)) [SIG Cloud Provider] -- CSINode initialization does not crash kubelet on startup when APIServer is not reachable or kubelet has not the right credentials yet. ([#89589](https://github.com/kubernetes/kubernetes/pull/89589), [@jsafrane](https://github.com/jsafrane)) [SIG Storage] -- Client-go: resolves an issue with informers falling back to full list requests when timeouts are encountered, rather than re-establishing a watch. ([#89652](https://github.com/kubernetes/kubernetes/pull/89652), [@liggitt](https://github.com/liggitt)) [SIG API Machinery and Testing] -- Dual-stack: fix the bug that Service clusterIP does not respect specified ipFamily ([#89612](https://github.com/kubernetes/kubernetes/pull/89612), [@SataQiu](https://github.com/SataQiu)) [SIG Network] -- Ensure Azure availability zone is always in lower cases. ([#89722](https://github.com/kubernetes/kubernetes/pull/89722), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- Explain CRDs whose resource name are the same as builtin objects ([#89505](https://github.com/kubernetes/kubernetes/pull/89505), [@knight42](https://github.com/knight42)) [SIG API Machinery, CLI and Testing] -- Fix flaws in Azure File CSI translation ([#90162](https://github.com/kubernetes/kubernetes/pull/90162), [@rfranzke](https://github.com/rfranzke)) [SIG Release and Storage] -- Fix kubectl describe CSINode nil pointer error ([#89646](https://github.com/kubernetes/kubernetes/pull/89646), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] -- Fix kubectl diff so it doesn't actually persist patches ([#89795](https://github.com/kubernetes/kubernetes/pull/89795), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG CLI and Testing] -- Fix kubectl version should print version info without config file ([#89913](https://github.com/kubernetes/kubernetes/pull/89913), [@zhouya0](https://github.com/zhouya0)) [SIG API Machinery and CLI] -- Fix missing `-c` shorthand for `--container` flag of `kubectl alpha debug` ([#89674](https://github.com/kubernetes/kubernetes/pull/89674), [@superbrothers](https://github.com/superbrothers)) [SIG CLI] -- Fix printers ignoring object average value ([#89142](https://github.com/kubernetes/kubernetes/pull/89142), [@zhouya0](https://github.com/zhouya0)) [SIG API Machinery] -- Fix scheduler crash when removing node before its pods ([#89908](https://github.com/kubernetes/kubernetes/pull/89908), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- Fix: get attach disk error due to missing item in max count table ([#89768](https://github.com/kubernetes/kubernetes/pull/89768), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] -- Fixed a bug where executing a kubectl command with a jsonpath output expression that has a nested range would ignore expressions following the nested range. ([#88464](https://github.com/kubernetes/kubernetes/pull/88464), [@brianpursley](https://github.com/brianpursley)) [SIG API Machinery] -- Fixed a regression running kubectl commands with --local or --dry-run flags when no kubeconfig file is present ([#90243](https://github.com/kubernetes/kubernetes/pull/90243), [@soltysh](https://github.com/soltysh)) [SIG API Machinery, CLI and Testing] -- Fixed an issue mounting credentials for service accounts whose name contains `.` characters ([#89696](https://github.com/kubernetes/kubernetes/pull/89696), [@nabokihms](https://github.com/nabokihms)) [SIG Auth] -- Fixed mountOptions in iSCSI and FibreChannel volume plugins. ([#89172](https://github.com/kubernetes/kubernetes/pull/89172), [@jsafrane](https://github.com/jsafrane)) [SIG Storage] -- Fixed the EndpointSlice controller to run without error on a cluster with the OwnerReferencesPermissionEnforcement validating admission plugin enabled. ([#89741](https://github.com/kubernetes/kubernetes/pull/89741), [@marun](https://github.com/marun)) [SIG Auth and Network] -- Fixes a bug defining a default value for a replicas field in a custom resource definition that has the scale subresource enabled ([#89833](https://github.com/kubernetes/kubernetes/pull/89833), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle and Instrumentation] -- Fixes conversion error for HorizontalPodAutoscaler objects with invalid annotations ([#89963](https://github.com/kubernetes/kubernetes/pull/89963), [@liggitt](https://github.com/liggitt)) [SIG Autoscaling] -- Fixes kubectl to apply all validly built objects, instead of stopping on error. ([#89848](https://github.com/kubernetes/kubernetes/pull/89848), [@seans3](https://github.com/seans3)) [SIG CLI and Testing] -- For GCE cluster provider, fix bug of not being able to create internal type load balancer for clusters with more than 1000 nodes in a single zone. ([#89902](https://github.com/kubernetes/kubernetes/pull/89902), [@wojtek-t](https://github.com/wojtek-t)) [SIG Cloud Provider, Network and Scalability] -- If firstTimestamp is not set use eventTime when printing event ([#89999](https://github.com/kubernetes/kubernetes/pull/89999), [@soltysh](https://github.com/soltysh)) [SIG CLI] -- If we set parameter cgroupPerQos=false and cgroupRoot=/docker，this function will retrun nodeAllocatableRoot=/docker/kubepods, it is not right, the correct return should be /docker. - cm.NodeAllocatableRoot(s.CgroupRoot, s.CgroupDriver) - - kubeDeps.CAdvisorInterface, err = cadvisor.New(imageFsInfoProvider, s.RootDirectory, cgroupRoots, cadvisor.UsingLegacyCadvisorStats(s.ContainerRuntime, s.RemoteRuntimeEndpoint)) - the above funtion，as we use cgroupRoots to create cadvisor interface，the wrong parameter cgroupRoots will lead eviction manager not to collect metric from /docker, then kubelet frequently print those error： - E0303 17:25:03.436781 63839 summary_sys_containers.go:47] Failed to get system container stats for "/docker": failed to get cgroup stats for "/docker": failed to get container info for "/docker": unknown container "/docker" - E0303 17:25:03.436809 63839 helpers.go:680] eviction manager: failed to construct signal: "allocatableMemory.available" error: system container "pods" not found in metrics ([#88970](https://github.com/kubernetes/kubernetes/pull/88970), [@mysunshine92](https://github.com/mysunshine92)) [SIG Node] -- In the kubelet resource metrics endpoint at /metrics/resource, change the names of the following metrics: - - node_cpu_usage_seconds --> node_cpu_usage_seconds_total - - container_cpu_usage_seconds --> container_cpu_usage_seconds_total - This is a partial revert of #86282, which was added in 1.18.0, and initially removed the _total suffix ([#89540](https://github.com/kubernetes/kubernetes/pull/89540), [@dashpole](https://github.com/dashpole)) [SIG Instrumentation and Node] -- Kube-apiserver: multiple comma-separated protocols in a single X-Stream-Protocol-Version header are now recognized, in addition to multiple headers, complying with RFC2616 ([#89857](https://github.com/kubernetes/kubernetes/pull/89857), [@tedyu](https://github.com/tedyu)) [SIG API Machinery] -- Kubeadm increased to 5 minutes its timeout for the TLS bootstrapping process to complete upon join ([#89735](https://github.com/kubernetes/kubernetes/pull/89735), [@rosti](https://github.com/rosti)) [SIG Cluster Lifecycle] -- Kubeadm: during join when a check is performed that a Node with the same name already exists in the cluster, make sure the NodeReady condition is properly validated ([#89602](https://github.com/kubernetes/kubernetes/pull/89602), [@kvaps](https://github.com/kvaps)) [SIG Cluster Lifecycle] -- Kubeadm: fix a bug where post upgrade to 1.18.x, nodes cannot join the cluster due to missing RBAC ([#89537](https://github.com/kubernetes/kubernetes/pull/89537), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Kubeadm: fix misleading warning about passing control-plane related flags on 'kubeadm join' ([#89596](https://github.com/kubernetes/kubernetes/pull/89596), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Kubectl azure authentication: fixed a regression in 1.18.0 where "spn:" prefix was unexpectedly added to the `apiserver-id` configuration in the kubeconfig file ([#89706](https://github.com/kubernetes/kubernetes/pull/89706), [@weinong](https://github.com/weinong)) [SIG API Machinery and Auth] -- Restore the ability to `kubectl apply --prune` without --namespace flag. Since 1.17, `kubectl apply --prune` only prunes resources in the default namespace (or from kubeconfig) or explicitly specified in command line flag. But this is s breaking change from kubectl 1.16, which can prune resources in all namespace in config file. This patch restores the kubectl 1.16 behaviour. ([#89551](https://github.com/kubernetes/kubernetes/pull/89551), [@tatsuhiro-t](https://github.com/tatsuhiro-t)) [SIG CLI and Testing] -- Restores priority of static control plane pods in the cluster/gce/manifests control-plane manifests ([#89970](https://github.com/kubernetes/kubernetes/pull/89970), [@liggitt](https://github.com/liggitt)) [SIG Cluster Lifecycle and Node] -- Service account tokens bound to pods can now be used during the pod deletion grace period. ([#89583](https://github.com/kubernetes/kubernetes/pull/89583), [@liggitt](https://github.com/liggitt)) [SIG Auth] -- Sync LB backend nodes for Service Type=LoadBalancer on Add/Delete node events. ([#81185](https://github.com/kubernetes/kubernetes/pull/81185), [@andrewsykim](https://github.com/andrewsykim)) [SIG Apps and Network] - -### Other (Cleanup or Flake) - -- Change beta.kubernetes.io/os to kubernetes.io/os ([#89460](https://github.com/kubernetes/kubernetes/pull/89460), [@wawa0210](https://github.com/wawa0210)) [SIG Testing and Windows] -- Changes not found message when using `kubectl get` to retrieve not namespaced resources ([#89861](https://github.com/kubernetes/kubernetes/pull/89861), [@rccrdpccl](https://github.com/rccrdpccl)) [SIG CLI] -- Node ([#76443](https://github.com/kubernetes/kubernetes/pull/76443), [@mgdevstack](https://github.com/mgdevstack)) [SIG Architecture, Network, Node, Testing and Windows] -- None. ([#90273](https://github.com/kubernetes/kubernetes/pull/90273), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] -- Reduce event spam during a volume operation error. ([#89794](https://github.com/kubernetes/kubernetes/pull/89794), [@msau42](https://github.com/msau42)) [SIG Storage] -- The PR adds functionality to generate events when a PV or PVC processing encounters certain failures. The events help users to know the reason for the failure so they can take necessary recovery actions. ([#89845](https://github.com/kubernetes/kubernetes/pull/89845), [@yuga711](https://github.com/yuga711)) [SIG Apps] -- The PodShareProcessNamespace feature gate has been removed, and the PodShareProcessNamespace is unconditionally enabled. ([#90099](https://github.com/kubernetes/kubernetes/pull/90099), [@tanjunchen](https://github.com/tanjunchen)) [SIG Node] -- Update default etcd server version to 3.4.4 ([#89214](https://github.com/kubernetes/kubernetes/pull/89214), [@jingyih](https://github.com/jingyih)) [SIG API Machinery, Cluster Lifecycle and Testing] -- Update default etcd server version to 3.4.7 ([#89895](https://github.com/kubernetes/kubernetes/pull/89895), [@jingyih](https://github.com/jingyih)) [SIG API Machinery, Cluster Lifecycle and Testing] - - -# v1.19.0-alpha.1 - -[Documentation](https://docs.k8s.io) - -## Downloads for v1.19.0-alpha.1 - -filename | sha512 hash --------- | ----------- -[kubernetes.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes.tar.gz) | `d5930e62f98948e3ae2bc0a91b2cb93c2009202657b9e798e43fcbf92149f50d991af34a49049b2640db729efc635d643d008f4b3dd6c093cac4426ee3d5d147` -[kubernetes-src.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-src.tar.gz) | `5d92125ec3ca26b6b0af95c6bb3289bb7cf60a4bad4e120ccdad06ffa523c239ca8e608015b7b5a1eb789bfdfcedbe0281518793da82a7959081fb04cf53c174` - -### Client Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-client-darwin-386.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-client-darwin-386.tar.gz) | `08d307dafdd8e1aa27721f97f038210b33261d1777ea173cc9ed4b373c451801988a7109566425fce32d38df70bdf0be6b8cfff69da768fbd3c303abd6dc13a5` -[kubernetes-client-darwin-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-client-darwin-amd64.tar.gz) | `08c3b722a62577d051e300ebc3c413ead1bd3e79555598a207c704064116087323215fb402bae7584b9ffd08590f36fa8a35f13f8fea1ce92e8f144e3eae3384` -[kubernetes-client-linux-386.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-client-linux-386.tar.gz) | `0735978b4d4cb0601171eae3cc5603393c00f032998f51d79d3b11e4020f4decc9559905e9b02ddcb0b6c3f4caf78f779940ebc97996e3b96b98ba378fbe189d` -[kubernetes-client-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-client-linux-amd64.tar.gz) | `ca55fc431d59c1a0bf1f1c248da7eab65215e438fcac223d4fc3a57fae0205869e1727b2475dfe9b165921417d68ac380a6e42bf7ea6732a34937ba2590931ce` -[kubernetes-client-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-client-linux-arm.tar.gz) | `4e1aa9e640d7cf0ccaad19377e4c3ca9a60203daa2ce0437d1d40fdea0e43759ef38797e948cdc3c676836b01e83f1bfde51effc0579bf832f6f062518f03f06` -[kubernetes-client-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-client-linux-arm64.tar.gz) | `fca5df8c2919a9b3d99248120af627d9a1b5ddf177d9a10f04eb4e486c14d4e3ddb72e3abc4733b5078e0d27204a51e2f714424923fb92a5351137f82d87d6ea` -[kubernetes-client-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-client-linux-ppc64le.tar.gz) | `6a98a4f99aa8b72ec815397c5062b90d5c023092da28fa7bca1cdadf406e2d86e2fd3a0eeab28574064959c6926007423c413d9781461e433705452087430d57` -[kubernetes-client-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-client-linux-s390x.tar.gz) | `94724c17985ae2dbd3888e6896f300f95fec8dc2bf08e768849e98b05affc4381b322d802f41792b8e6da4708ce1ead2edcb8f4d5299be6267f6559b0d49e484` -[kubernetes-client-windows-386.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-client-windows-386.tar.gz) | `5a076bf3a5926939c170a501f8292a38003552848c45c1f148a97605b7ac9843fb660ef81a46abe6d139f4c5eaa342d4b834a799ee7055d5a548d189b31d7124` -[kubernetes-client-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-client-windows-amd64.tar.gz) | `4b395894bfd9cfa0976512d1d58c0056a80bacefc798de294db6d3f363bd5581fd3ce2e4bdc1b902d46c8ce2ac87a98ced56b6b29544c86e8444fb8e9465faea` - -### Server Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-server-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-server-linux-amd64.tar.gz) | `6720d1b826dc20e56b0314e580403cd967430ff25bdbe08e8bf453fed339557d2a4ace114c2f524e6b6814ec9341ccdea870f784ebb53a52056ca3ab22e5cc36` -[kubernetes-server-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-server-linux-arm.tar.gz) | `f09b295f5a95cc72494eb1c0e9706b237a8523eacda182778e9afdb469704c7eacd29614aff6d3d7aff3bc1783fb277d52ad56a1417f1bd973eeb9bdc8086695` -[kubernetes-server-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-server-linux-arm64.tar.gz) | `24787767abd1d67a4d0234433e1693ea3e1e906364265ee03e58ba203b66583b75d4ce0c4185756fc529997eb9a842d65841962cd228df9c182a469dbd72493d` -[kubernetes-server-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-server-linux-ppc64le.tar.gz) | `a117e609729263d7bd58aac156efa33941f0f9aa651892d1abf32cfa0a984aa495fccd3be8385cae083415bfa8f81942648d5978f72e950103e42184fd0d7527` -[kubernetes-server-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-server-linux-s390x.tar.gz) | `19280a6dc20f019d23344934f8f1ec6aa17c3374b9c569d4c173535a8cd9e298b8afcabe06d232a146c9c7cb4bfe7d1d0e10aa2ab9184ace0b7987e36973aaef` - -### Node Binaries - -filename | sha512 hash --------- | ----------- -[kubernetes-node-linux-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-node-linux-amd64.tar.gz) | `c4b23f113ed13edb91b59a498d15de8b62ff1005243f2d6654a11468511c9d0ebaebb6dc02d2fa505f18df446c9221e77d7fc3147fa6704cde9bec5d6d80b5a3` -[kubernetes-node-linux-arm.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-node-linux-arm.tar.gz) | `8dcf5531a5809576049c455d3c5194f09ddf3b87995df1e8ca4543deff3ffd90a572539daff9aa887e22efafedfcada2e28035da8573e3733c21778e4440677a` -[kubernetes-node-linux-arm64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-node-linux-arm64.tar.gz) | `4b3f4dfee2034ce7d01fef57b8766851fe141fc72da0f9edeb39aca4c7a937e2dccd2c198a83fbb92db7911d81e50a98bd0a17b909645adbeb26e420197db2cd` -[kubernetes-node-linux-ppc64le.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-node-linux-ppc64le.tar.gz) | `df0e87f5e42056db2bbc7ef5f08ecda95d66afc3f4d0bc57f6efcc05834118c39ab53d68595d8f2bb278829e33b9204c5cce718d8bf841ce6cccbb86d0d20730` -[kubernetes-node-linux-s390x.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-node-linux-s390x.tar.gz) | `3a6499b008a68da52f8ae12eb694885d9e10a8f805d98f28fc5f7beafea72a8e180df48b5ca31097b2d4779c61ff67216e516c14c2c812163e678518d95f22d6` -[kubernetes-node-windows-amd64.tar.gz](https://dl.k8s.io/v1.19.0-alpha.1/kubernetes-node-windows-amd64.tar.gz) | `c311373506cbfa0244ac92a709fbb9bddb46cbeb130733bdb689641ecee6b21a7a7f020eae4856a3f04a3845839dc5e0914cddc3478d55cd3d5af3d7804aa5ba` - -## Changelog since v1.19.0-alpha.0 - -## Urgent Upgrade Notes - -### (No, really, you MUST read this before you upgrade) - -- The StreamingProxyRedirects feature and `--redirect-container-streaming` flag are deprecated, and will be removed in a future release. The default behavior (proxy streaming requests through the kubelet) will be the only supported option. - If you are setting `--redirect-container-streaming=true`, then you must migrate off this configuration. The flag will no longer be able to be enabled starting in v1.20. If you are not setting the flag, no action is necessary. ([#88290](https://github.com/kubernetes/kubernetes/pull/88290), [@tallclair](https://github.com/tallclair)) [SIG API Machinery and Node] - -- `kubectl` no longer defaults to `http://localhost:8080`. If you own one of these legacy clusters, you are *strongly- encouraged to secure your server. If you cannot secure your server, you can set `KUBERNETES_MASTER` if you were relying on that behavior and you're client-go user. Set `--server`, `--kubeconfig` or `KUBECONFIG` to make it work in `kubectl`. ([#86173](https://github.com/kubernetes/kubernetes/pull/86173), [@soltysh](https://github.com/soltysh)) [SIG API Machinery, CLI and Testing] - -## Changes by Kind - -### Deprecation - -- AlgorithmSource is removed from v1alpha2 Scheduler ComponentConfig ([#87999](https://github.com/kubernetes/kubernetes/pull/87999), [@damemi](https://github.com/damemi)) [SIG Scheduling] -- Azure service annotation service.beta.kubernetes.io/azure-load-balancer-disable-tcp-reset has been deprecated. Its support would be removed in a future release. ([#88462](https://github.com/kubernetes/kubernetes/pull/88462), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- Kube-proxy: deprecate `--healthz-port` and `--metrics-port` flag, please use `--healthz-bind-address` and `--metrics-bind-address` instead ([#88512](https://github.com/kubernetes/kubernetes/pull/88512), [@SataQiu](https://github.com/SataQiu)) [SIG Network] -- Kubeadm: deprecate the usage of the experimental flag '--use-api' under the 'kubeadm alpha certs renew' command. ([#88827](https://github.com/kubernetes/kubernetes/pull/88827), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Kubernetes no longer supports building hyperkube images ([#88676](https://github.com/kubernetes/kubernetes/pull/88676), [@dims](https://github.com/dims)) [SIG Cluster Lifecycle and Release] - -### API Change - -- A new IngressClass resource has been added to enable better Ingress configuration. ([#88509](https://github.com/kubernetes/kubernetes/pull/88509), [@robscott](https://github.com/robscott)) [SIG API Machinery, Apps, CLI, Network, Node and Testing] -- API additions to apiserver types ([#87179](https://github.com/kubernetes/kubernetes/pull/87179), [@Jefftree](https://github.com/Jefftree)) [SIG API Machinery, Cloud Provider and Cluster Lifecycle] -- Add Scheduling Profiles to kubescheduler.config.k8s.io/v1alpha2 ([#88087](https://github.com/kubernetes/kubernetes/pull/88087), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling and Testing] -- Added GenericPVCDataSource feature gate to enable using arbitrary custom resources as the data source for a PVC. ([#88636](https://github.com/kubernetes/kubernetes/pull/88636), [@bswartz](https://github.com/bswartz)) [SIG Apps and Storage] -- Added support for multiple sizes huge pages on a container level ([#84051](https://github.com/kubernetes/kubernetes/pull/84051), [@bart0sh](https://github.com/bart0sh)) [SIG Apps, Node and Storage] -- Allow user to specify fsgroup permission change policy for pods ([#88488](https://github.com/kubernetes/kubernetes/pull/88488), [@gnufied](https://github.com/gnufied)) [SIG Apps and Storage] -- AppProtocol is a new field on Service and Endpoints resources, enabled with the ServiceAppProtocol feature gate. ([#88503](https://github.com/kubernetes/kubernetes/pull/88503), [@robscott](https://github.com/robscott)) [SIG Apps and Network] -- BlockVolume and CSIBlockVolume features are now GA. ([#88673](https://github.com/kubernetes/kubernetes/pull/88673), [@jsafrane](https://github.com/jsafrane)) [SIG Apps, Node and Storage] -- Consumers of the 'certificatesigningrequests/approval' API must now grant permission to 'approve' CSRs for the 'signerName' specified on the CSR. More information on the new signerName field can be found at https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/20190607-certificates-api.md#signers ([#88246](https://github.com/kubernetes/kubernetes/pull/88246), [@munnerz](https://github.com/munnerz)) [SIG API Machinery, Apps, Auth, CLI, Node and Testing] -- CustomResourceDefinition schemas that use `x-kubernetes-list-map-keys` to specify properties that uniquely identify list items must make those properties required or have a default value, to ensure those properties are present for all list items. See https://kubernetes.io/docs/reference/using-api/api-concepts/#merge-strategy for details. ([#88076](https://github.com/kubernetes/kubernetes/pull/88076), [@eloyekunle](https://github.com/eloyekunle)) [SIG API Machinery and Testing] -- Fixed missing validation of uniqueness of list items in lists with `x-kubernetes-list-type: map` or x-kubernetes-list-type: set` in CustomResources. ([#84920](https://github.com/kubernetes/kubernetes/pull/84920), [@sttts](https://github.com/sttts)) [SIG API Machinery] -- Fixes a regression with clients prior to 1.15 not being able to update podIP in pod status, or podCIDR in node spec, against >= 1.16 API servers ([#88505](https://github.com/kubernetes/kubernetes/pull/88505), [@liggitt](https://github.com/liggitt)) [SIG Apps and Network] -- Ingress: Add Exact and Prefix maching to Ingress PathTypes ([#88587](https://github.com/kubernetes/kubernetes/pull/88587), [@cmluciano](https://github.com/cmluciano)) [SIG Apps, Cluster Lifecycle and Network] -- Ingress: Add alternate backends via TypedLocalObjectReference ([#88775](https://github.com/kubernetes/kubernetes/pull/88775), [@cmluciano](https://github.com/cmluciano)) [SIG Apps and Network] -- Ingress: allow wildcard hosts in IngressRule ([#88858](https://github.com/kubernetes/kubernetes/pull/88858), [@cmluciano](https://github.com/cmluciano)) [SIG Network] -- Introduces optional --detect-local flag to kube-proxy. - Currently the only supported value is "cluster-cidr", - which is the default if not specified. ([#87748](https://github.com/kubernetes/kubernetes/pull/87748), [@satyasm](https://github.com/satyasm)) [SIG Cluster Lifecycle, Network and Scheduling] -- Kube-controller-manager and kube-scheduler expose profiling by default to match the kube-apiserver. Use `--enable-profiling=false` to disable. ([#88663](https://github.com/kubernetes/kubernetes/pull/88663), [@deads2k](https://github.com/deads2k)) [SIG API Machinery, Cloud Provider and Scheduling] -- Kube-scheduler can run more than one scheduling profile. Given a pod, the profile is selected by using its `.spec.SchedulerName`. ([#88285](https://github.com/kubernetes/kubernetes/pull/88285), [@alculquicondor](https://github.com/alculquicondor)) [SIG Apps, Scheduling and Testing] -- Move TaintBasedEvictions feature gates to GA ([#87487](https://github.com/kubernetes/kubernetes/pull/87487), [@skilxn-go](https://github.com/skilxn-go)) [SIG API Machinery, Apps, Node, Scheduling and Testing] -- Moving Windows RunAsUserName feature to GA ([#87790](https://github.com/kubernetes/kubernetes/pull/87790), [@marosset](https://github.com/marosset)) [SIG Apps and Windows] -- New flag --endpointslice-updates-batch-period in kube-controller-manager can be used to reduce number of endpointslice updates generated by pod changes. ([#88745](https://github.com/kubernetes/kubernetes/pull/88745), [@mborsz](https://github.com/mborsz)) [SIG API Machinery, Apps and Network] -- New flag `--show-hidden-metrics-for-version` in kubelet can be used to show all hidden metrics that deprecated in the previous minor release. ([#85282](https://github.com/kubernetes/kubernetes/pull/85282), [@serathius](https://github.com/serathius)) [SIG Node] -- Removes ConfigMap as suggestion for IngressClass parameters ([#89093](https://github.com/kubernetes/kubernetes/pull/89093), [@robscott](https://github.com/robscott)) [SIG Network] -- Scheduler Extenders can now be configured in the v1alpha2 component config ([#88768](https://github.com/kubernetes/kubernetes/pull/88768), [@damemi](https://github.com/damemi)) [SIG Release, Scheduling and Testing] -- The apiserver/v1alph1#EgressSelectorConfiguration API is now beta. ([#88502](https://github.com/kubernetes/kubernetes/pull/88502), [@caesarxuchao](https://github.com/caesarxuchao)) [SIG API Machinery] -- The storage.k8s.io/CSIDriver has moved to GA, and is now available for use. ([#84814](https://github.com/kubernetes/kubernetes/pull/84814), [@huffmanca](https://github.com/huffmanca)) [SIG API Machinery, Apps, Auth, Node, Scheduling, Storage and Testing] -- VolumePVCDataSource moves to GA in 1.18 release ([#88686](https://github.com/kubernetes/kubernetes/pull/88686), [@j-griffith](https://github.com/j-griffith)) [SIG Apps, CLI and Cluster Lifecycle] - -### Feature - -- deps: Update to Golang 1.13.9 - - build: Remove kube-cross image building ([#89275](https://github.com/kubernetes/kubernetes/pull/89275), [@justaugustus](https://github.com/justaugustus)) [SIG Release and Testing] -- Add --dry-run to kubectl delete, taint, replace ([#88292](https://github.com/kubernetes/kubernetes/pull/88292), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG CLI and Testing] -- Add `rest_client_rate_limiter_duration_seconds` metric to component-base to track client side rate limiter latency in seconds. Broken down by verb and URL. ([#88134](https://github.com/kubernetes/kubernetes/pull/88134), [@jennybuckley](https://github.com/jennybuckley)) [SIG API Machinery, Cluster Lifecycle and Instrumentation] -- Add huge page stats to Allocated resources in "kubectl describe node" ([#80605](https://github.com/kubernetes/kubernetes/pull/80605), [@odinuge](https://github.com/odinuge)) [SIG CLI] -- Add support for pre allocated huge pages with different sizes, on node level ([#89252](https://github.com/kubernetes/kubernetes/pull/89252), [@odinuge](https://github.com/odinuge)) [SIG Apps and Node] -- Adds support for NodeCIDR as an argument to --detect-local-mode ([#88935](https://github.com/kubernetes/kubernetes/pull/88935), [@satyasm](https://github.com/satyasm)) [SIG Network] -- Allow user to specify resource using --filename flag when invoking kubectl exec ([#88460](https://github.com/kubernetes/kubernetes/pull/88460), [@soltysh](https://github.com/soltysh)) [SIG CLI and Testing] -- Apiserver add a new flag --goaway-chance which is the fraction of requests that will be closed gracefully(GOAWAY) to prevent HTTP/2 clients from getting stuck on a single apiserver. - After the connection closed(received GOAWAY), the client's other in-flight requests won't be affected, and the client will reconnect. - The flag min value is 0 (off), max is .02 (1/50 requests); .001 (1/1000) is a recommended starting point. - Clusters with single apiservers, or which don't use a load balancer, should NOT enable this. ([#88567](https://github.com/kubernetes/kubernetes/pull/88567), [@answer1991](https://github.com/answer1991)) [SIG API Machinery] -- Azure Cloud Provider now supports using Azure network resources (Virtual Network, Load Balancer, Public IP, Route Table, Network Security Group, etc.) in different AAD Tenant and Subscription than those for the Kubernetes cluster. To use the feature, please reference https://github.com/kubernetes-sigs/cloud-provider-azure/blob/master/docs/cloud-provider-config.md#host-network-resources-in-different-aad-tenant-and-subscription. ([#88384](https://github.com/kubernetes/kubernetes/pull/88384), [@bowen5](https://github.com/bowen5)) [SIG Cloud Provider] -- Azure: add support for single stack IPv6 ([#88448](https://github.com/kubernetes/kubernetes/pull/88448), [@aramase](https://github.com/aramase)) [SIG Cloud Provider] -- DefaultConstraints can be specified for the PodTopologySpread plugin in the component config ([#88671](https://github.com/kubernetes/kubernetes/pull/88671), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- EndpointSlice controller waits longer to retry failed sync. ([#89438](https://github.com/kubernetes/kubernetes/pull/89438), [@robscott](https://github.com/robscott)) [SIG Apps and Network] -- Feat: change azure disk api-version ([#89250](https://github.com/kubernetes/kubernetes/pull/89250), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] -- Feat: support [Azure shared disk](https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disks-shared-enable), added a new field(`maxShares`) in azure disk storage class: - - kind: StorageClass - apiVersion: storage.k8s.io/v1 - metadata: - name: shared-disk - provisioner: kubernetes.io/azure-disk - parameters: - skuname: Premium_LRS # Currently only available with premium SSDs. - cachingMode: None # ReadOnly host caching is not available for premium SSDs with maxShares>1 - maxShares: 2 ([#89328](https://github.com/kubernetes/kubernetes/pull/89328), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] -- Kube-apiserver, kube-scheduler and kube-controller manager now use SO_REUSEPORT socket option when listening on address defined by --bind-address and --secure-port flags, when running on Unix systems (Windows is NOT supported). This allows to run multiple instances of those processes on a single host with the same configuration, which allows to update/restart them in a graceful way, without causing downtime. ([#88893](https://github.com/kubernetes/kubernetes/pull/88893), [@invidian](https://github.com/invidian)) [SIG API Machinery, Scheduling and Testing] -- Kubeadm: The ClusterStatus struct present in the kubeadm-config ConfigMap is deprecated and will be removed on a future version. It is going to be maintained by kubeadm until it gets removed. The same information can be found on `etcd` and `kube-apiserver` pod annotations, `kubeadm.kubernetes.io/etcd.advertise-client-urls` and `kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint` respectively. ([#87656](https://github.com/kubernetes/kubernetes/pull/87656), [@ereslibre](https://github.com/ereslibre)) [SIG Cluster Lifecycle] -- Kubeadm: add the experimental feature gate PublicKeysECDSA that can be used to create a - cluster with ECDSA certificates from "kubeadm init". Renewal of existing ECDSA certificates is - also supported using "kubeadm alpha certs renew", but not switching between the RSA and - ECDSA algorithms on the fly or during upgrades. ([#86953](https://github.com/kubernetes/kubernetes/pull/86953), [@rojkov](https://github.com/rojkov)) [SIG API Machinery, Auth and Cluster Lifecycle] -- Kubeadm: on kubeconfig certificate renewal, keep the embedded CA in sync with the one on disk ([#88052](https://github.com/kubernetes/kubernetes/pull/88052), [@neolit123](https://github.com/neolit123)) [SIG Cluster Lifecycle] -- Kubeadm: support Windows specific kubelet flags in kubeadm-flags.env ([#88287](https://github.com/kubernetes/kubernetes/pull/88287), [@gab-satchi](https://github.com/gab-satchi)) [SIG Cluster Lifecycle and Windows] -- Kubeadm: upgrade supports fallback to the nearest known etcd version if an unknown k8s version is passed ([#88373](https://github.com/kubernetes/kubernetes/pull/88373), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] -- Kubectl cluster-info dump changed to only display a message telling you the location where the output was written when the output is not standard output. ([#88765](https://github.com/kubernetes/kubernetes/pull/88765), [@brianpursley](https://github.com/brianpursley)) [SIG CLI] -- New flag `--show-hidden-metrics-for-version` in kube-scheduler can be used to show all hidden metrics that deprecated in the previous minor release. ([#84913](https://github.com/kubernetes/kubernetes/pull/84913), [@serathius](https://github.com/serathius)) [SIG Instrumentation and Scheduling] -- Print NotReady when pod is not ready based on its conditions. ([#88240](https://github.com/kubernetes/kubernetes/pull/88240), [@soltysh](https://github.com/soltysh)) [SIG CLI] -- Scheduler Extender API is now located under k8s.io/kube-scheduler/extender ([#88540](https://github.com/kubernetes/kubernetes/pull/88540), [@damemi](https://github.com/damemi)) [SIG Release, Scheduling and Testing] -- Scheduler framework permit plugins now run at the end of the scheduling cycle, after reserve plugins. Waiting on permit will remain in the beginning of the binding cycle. ([#88199](https://github.com/kubernetes/kubernetes/pull/88199), [@mateuszlitwin](https://github.com/mateuszlitwin)) [SIG Scheduling] -- Signatures on scale client methods have been modified to accept `context.Context` as a first argument. Signatures of Get, Update, and Patch methods have been updated to accept GetOptions, UpdateOptions and PatchOptions respectively. ([#88599](https://github.com/kubernetes/kubernetes/pull/88599), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG API Machinery, Apps, Autoscaling and CLI] -- Signatures on the dynamic client methods have been modified to accept `context.Context` as a first argument. Signatures of Delete and DeleteCollection methods now accept DeleteOptions by value instead of by reference. ([#88906](https://github.com/kubernetes/kubernetes/pull/88906), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Apps, CLI, Cluster Lifecycle, Storage and Testing] -- Signatures on the metadata client methods have been modified to accept `context.Context` as a first argument. Signatures of Delete and DeleteCollection methods now accept DeleteOptions by value instead of by reference. ([#88910](https://github.com/kubernetes/kubernetes/pull/88910), [@liggitt](https://github.com/liggitt)) [SIG API Machinery, Apps and Testing] -- Support create or update VMSS asynchronously. ([#89248](https://github.com/kubernetes/kubernetes/pull/89248), [@nilo19](https://github.com/nilo19)) [SIG Cloud Provider] -- The kubelet and the default docker runtime now support running ephemeral containers in the Linux process namespace of a target container. Other container runtimes must implement this feature before it will be available in that runtime. ([#84731](https://github.com/kubernetes/kubernetes/pull/84731), [@verb](https://github.com/verb)) [SIG Node] -- Update etcd client side to v3.4.4 ([#89169](https://github.com/kubernetes/kubernetes/pull/89169), [@jingyih](https://github.com/jingyih)) [SIG API Machinery and Cloud Provider] -- Upgrade to azure-sdk v40.2.0 ([#89105](https://github.com/kubernetes/kubernetes/pull/89105), [@andyzhangx](https://github.com/andyzhangx)) [SIG CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Storage and Testing] -- Webhooks will have alpha support for network proxy ([#85870](https://github.com/kubernetes/kubernetes/pull/85870), [@Jefftree](https://github.com/Jefftree)) [SIG API Machinery, Auth and Testing] -- When client certificate files are provided, reload files for new connections, and close connections when a certificate changes. ([#79083](https://github.com/kubernetes/kubernetes/pull/79083), [@jackkleeman](https://github.com/jackkleeman)) [SIG API Machinery, Auth, Node and Testing] -- When deleting objects using kubectl with the --force flag, you are no longer required to also specify --grace-period=0. ([#87776](https://github.com/kubernetes/kubernetes/pull/87776), [@brianpursley](https://github.com/brianpursley)) [SIG CLI] -- `kubectl` now contains a `kubectl alpha debug` command. This command allows attaching an ephemeral container to a running pod for the purposes of debugging. ([#88004](https://github.com/kubernetes/kubernetes/pull/88004), [@verb](https://github.com/verb)) [SIG CLI] - -### Documentation - -- Improved error message for incorrect auth field. ([#82829](https://github.com/kubernetes/kubernetes/pull/82829), [@martin-schibsted](https://github.com/martin-schibsted)) [SIG Auth] -- Update Japanese translation for kubectl help ([#86837](https://github.com/kubernetes/kubernetes/pull/86837), [@inductor](https://github.com/inductor)) [SIG CLI and Docs] -- Updated the instructions for deploying the sample app. ([#82785](https://github.com/kubernetes/kubernetes/pull/82785), [@ashish-billore](https://github.com/ashish-billore)) [SIG API Machinery] -- `kubectl plugin` now prints a note how to install krew ([#88577](https://github.com/kubernetes/kubernetes/pull/88577), [@corneliusweig](https://github.com/corneliusweig)) [SIG CLI] - -### Other (Bug, Cleanup or Flake) - -- A PV set from in-tree source will have ordered requirement values in NodeAffinity when converted to CSIPersistentVolumeSource ([#88987](https://github.com/kubernetes/kubernetes/pull/88987), [@jiahuif](https://github.com/jiahuif)) [SIG Storage] -- Add delays between goroutines for vm instance update ([#88094](https://github.com/kubernetes/kubernetes/pull/88094), [@aramase](https://github.com/aramase)) [SIG Cloud Provider] -- Add init containers log to cluster dump info. ([#88324](https://github.com/kubernetes/kubernetes/pull/88324), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] -- Azure VMSS LoadBalancerBackendAddressPools updating has been improved with squential-sync + concurrent-async requests. ([#88699](https://github.com/kubernetes/kubernetes/pull/88699), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- Azure auth module for kubectl now requests login after refresh token expires. ([#86481](https://github.com/kubernetes/kubernetes/pull/86481), [@tdihp](https://github.com/tdihp)) [SIG API Machinery and Auth] -- AzureFile and CephFS use new Mount library that prevents logging of sensitive mount options. ([#88684](https://github.com/kubernetes/kubernetes/pull/88684), [@saad-ali](https://github.com/saad-ali)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Storage] -- Beta.kubernetes.io/arch is already deprecated since v1.14, are targeted for removal in v1.18 ([#89462](https://github.com/kubernetes/kubernetes/pull/89462), [@wawa0210](https://github.com/wawa0210)) [SIG Testing] -- Build: Enable kube-cross image-building on K8s Infra ([#88562](https://github.com/kubernetes/kubernetes/pull/88562), [@justaugustus](https://github.com/justaugustus)) [SIG Release and Testing] -- CPU limits are now respected for Windows containers. If a node is over-provisioned, no weighting is used - only limits are respected. ([#86101](https://github.com/kubernetes/kubernetes/pull/86101), [@PatrickLang](https://github.com/PatrickLang)) [SIG Node, Testing and Windows] -- Client-go certificate manager rotation gained the ability to preserve optional intermediate chains accompanying issued certificates ([#88744](https://github.com/kubernetes/kubernetes/pull/88744), [@jackkleeman](https://github.com/jackkleeman)) [SIG API Machinery and Auth] -- Cloud provider config CloudProviderBackoffMode has been removed since it won't be used anymore. ([#88463](https://github.com/kubernetes/kubernetes/pull/88463), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- Conformance image now depends on stretch-slim instead of debian-hyperkube-base as that image is being deprecated and removed. ([#88702](https://github.com/kubernetes/kubernetes/pull/88702), [@dims](https://github.com/dims)) [SIG Cluster Lifecycle, Release and Testing] -- Deprecate --generator flag from kubectl create commands ([#88655](https://github.com/kubernetes/kubernetes/pull/88655), [@soltysh](https://github.com/soltysh)) [SIG CLI] -- Deprecate kubectl top flags related to heapster - Drop support of heapster in kubectl top ([#87498](https://github.com/kubernetes/kubernetes/pull/87498), [@serathius](https://github.com/serathius)) [SIG CLI] -- EndpointSlice should not contain endpoints for terminating pods ([#89056](https://github.com/kubernetes/kubernetes/pull/89056), [@andrewsykim](https://github.com/andrewsykim)) [SIG Apps and Network] -- Evictions due to pods breaching their ephemeral storage limits are now recorded by the `kubelet_evictions` metric and can be alerted on. ([#87906](https://github.com/kubernetes/kubernetes/pull/87906), [@smarterclayton](https://github.com/smarterclayton)) [SIG Node] -- FIX: prevent apiserver from panicking when failing to load audit webhook config file ([#88879](https://github.com/kubernetes/kubernetes/pull/88879), [@JoshVanL](https://github.com/JoshVanL)) [SIG API Machinery and Auth] -- Fix /readyz to return error immediately after a shutdown is initiated, before the --shutdown-delay-duration has elapsed. ([#88911](https://github.com/kubernetes/kubernetes/pull/88911), [@tkashem](https://github.com/tkashem)) [SIG API Machinery] -- Fix a bug that didn't allow to use IPv6 addresses with leading zeros ([#89341](https://github.com/kubernetes/kubernetes/pull/89341), [@aojea](https://github.com/aojea)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle and Instrumentation] -- Fix a bug where ExternalTrafficPolicy is not applied to service ExternalIPs. ([#88786](https://github.com/kubernetes/kubernetes/pull/88786), [@freehan](https://github.com/freehan)) [SIG Network] -- Fix a bug where kubenet fails to parse the tc output. ([#83572](https://github.com/kubernetes/kubernetes/pull/83572), [@chendotjs](https://github.com/chendotjs)) [SIG Network] -- Fix bug with xfs_repair from stopping xfs mount ([#89444](https://github.com/kubernetes/kubernetes/pull/89444), [@gnufied](https://github.com/gnufied)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Storage] -- Fix describe ingress annotations not sorted. ([#88394](https://github.com/kubernetes/kubernetes/pull/88394), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] -- Fix detection of SystemOOMs in which the victim is a container. ([#88871](https://github.com/kubernetes/kubernetes/pull/88871), [@dashpole](https://github.com/dashpole)) [SIG Node] -- Fix handling of aws-load-balancer-security-groups annotation. Security-Groups assigned with this annotation are no longer modified by kubernetes which is the expected behaviour of most users. Also no unnecessary Security-Groups are created anymore if this annotation is used. ([#83446](https://github.com/kubernetes/kubernetes/pull/83446), [@Elias481](https://github.com/Elias481)) [SIG Cloud Provider] -- Fix invalid VMSS updates due to incorrect cache ([#89002](https://github.com/kubernetes/kubernetes/pull/89002), [@ArchangelSDY](https://github.com/ArchangelSDY)) [SIG Cloud Provider] -- Fix isCurrentInstance for Windows by removing the dependency of hostname. ([#89138](https://github.com/kubernetes/kubernetes/pull/89138), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- Fix kube-apiserver startup to wait for APIServices to be installed into the HTTP handler before reporting readiness. ([#89147](https://github.com/kubernetes/kubernetes/pull/89147), [@sttts](https://github.com/sttts)) [SIG API Machinery] -- Fix kubectl create deployment image name ([#86636](https://github.com/kubernetes/kubernetes/pull/86636), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] -- Fix missing "apiVersion" for "involvedObject" in Events for Nodes. ([#87537](https://github.com/kubernetes/kubernetes/pull/87537), [@uthark](https://github.com/uthark)) [SIG Apps and Node] -- Fix that prevents repeated fetching of PVC/PV objects by kubelet when processing of pod volumes fails. While this prevents hammering API server in these error scenarios, it means that some errors in processing volume(s) for a pod could now take up to 2-3 minutes before retry. ([#88141](https://github.com/kubernetes/kubernetes/pull/88141), [@tedyu](https://github.com/tedyu)) [SIG Node and Storage] -- Fix the VMSS name and resource group name when updating Azure VMSS for LoadBalancer backendPools ([#89337](https://github.com/kubernetes/kubernetes/pull/89337), [@feiskyer](https://github.com/feiskyer)) [SIG Cloud Provider] -- Fix: add remediation in azure disk attach/detach ([#88444](https://github.com/kubernetes/kubernetes/pull/88444), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] -- Fix: azure file mount timeout issue ([#88610](https://github.com/kubernetes/kubernetes/pull/88610), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider and Storage] -- Fix: check disk status before delete azure disk ([#88360](https://github.com/kubernetes/kubernetes/pull/88360), [@andyzhangx](https://github.com/andyzhangx)) [SIG Cloud Provider] -- Fix: corrupted mount point in csi driver ([#88569](https://github.com/kubernetes/kubernetes/pull/88569), [@andyzhangx](https://github.com/andyzhangx)) [SIG Storage] -- Fixed a bug in the TopologyManager. Previously, the TopologyManager would only guarantee alignment if container creation was serialized in some way. Alignment is now guaranteed under all scenarios of container creation. ([#87759](https://github.com/kubernetes/kubernetes/pull/87759), [@klueska](https://github.com/klueska)) [SIG Node] -- Fixed a data race in kubelet image manager that can cause static pod workers to silently stop working. ([#88915](https://github.com/kubernetes/kubernetes/pull/88915), [@roycaihw](https://github.com/roycaihw)) [SIG Node] -- Fixed an issue that could cause the kubelet to incorrectly run concurrent pod reconciliation loops and crash. ([#89055](https://github.com/kubernetes/kubernetes/pull/89055), [@tedyu](https://github.com/tedyu)) [SIG Node] -- Fixed block CSI volume cleanup after timeouts. ([#88660](https://github.com/kubernetes/kubernetes/pull/88660), [@jsafrane](https://github.com/jsafrane)) [SIG Node and Storage] -- Fixed bug where a nonzero exit code was returned when initializing zsh completion even though zsh completion was successfully initialized ([#88165](https://github.com/kubernetes/kubernetes/pull/88165), [@brianpursley](https://github.com/brianpursley)) [SIG CLI] -- Fixed cleaning of CSI raw block volumes. ([#87978](https://github.com/kubernetes/kubernetes/pull/87978), [@jsafrane](https://github.com/jsafrane)) [SIG Storage] -- Fixes conversion error in multi-version custom resources that could cause metadata.generation to increment on no-op patches or updates of a custom resource. ([#88995](https://github.com/kubernetes/kubernetes/pull/88995), [@liggitt](https://github.com/liggitt)) [SIG API Machinery] -- Fixes issue where you can't attach more than 15 GCE Persistent Disks to c2, n2, m1, m2 machine types. ([#88602](https://github.com/kubernetes/kubernetes/pull/88602), [@yuga711](https://github.com/yuga711)) [SIG Storage] -- Fixes v1.18.0-rc.1 regression in `kubectl port-forward` when specifying a local and remote port ([#89401](https://github.com/kubernetes/kubernetes/pull/89401), [@liggitt](https://github.com/liggitt)) [SIG CLI] -- For volumes that allow attaches across multiple nodes, attach and detach operations across different nodes are now executed in parallel. ([#88678](https://github.com/kubernetes/kubernetes/pull/88678), [@verult](https://github.com/verult)) [SIG Apps, Node and Storage] -- Get-kube.sh uses the gcloud's current local GCP service account for auth when the provider is GCE or GKE instead of the metadata server default ([#88383](https://github.com/kubernetes/kubernetes/pull/88383), [@BenTheElder](https://github.com/BenTheElder)) [SIG Cluster Lifecycle] -- Golang/x/net has been updated to bring in fixes for CVE-2020-9283 ([#88381](https://github.com/kubernetes/kubernetes/pull/88381), [@BenTheElder](https://github.com/BenTheElder)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle and Instrumentation] -- Hide kubectl.kubernetes.io/last-applied-configuration in describe command ([#88758](https://github.com/kubernetes/kubernetes/pull/88758), [@soltysh](https://github.com/soltysh)) [SIG Auth and CLI] -- In GKE alpha clusters it will be possible to use the service annotation `cloud.google.com/network-tier: Standard` ([#88487](https://github.com/kubernetes/kubernetes/pull/88487), [@zioproto](https://github.com/zioproto)) [SIG Cloud Provider] -- Ipvs: only attempt setting of sysctlconnreuse on supported kernels ([#88541](https://github.com/kubernetes/kubernetes/pull/88541), [@cmluciano](https://github.com/cmluciano)) [SIG Network] -- Kube-proxy: on dual-stack mode, if it is not able to get the IP Family of an endpoint, logs it with level InfoV(4) instead of Warning, avoiding flooding the logs for endpoints without addresses ([#88934](https://github.com/kubernetes/kubernetes/pull/88934), [@aojea](https://github.com/aojea)) [SIG Network] -- Kubeadm now includes CoreDNS version 1.6.7 ([#86260](https://github.com/kubernetes/kubernetes/pull/86260), [@rajansandeep](https://github.com/rajansandeep)) [SIG Cluster Lifecycle] -- Kubeadm: fix the bug that 'kubeadm upgrade' hangs in single node cluster ([#88434](https://github.com/kubernetes/kubernetes/pull/88434), [@SataQiu](https://github.com/SataQiu)) [SIG Cluster Lifecycle] -- Kubelet: fix the bug that kubelet help information can not show the right type of flags ([#88515](https://github.com/kubernetes/kubernetes/pull/88515), [@SataQiu](https://github.com/SataQiu)) [SIG Docs and Node] -- Kubelets perform fewer unnecessary pod status update operations on the API server. ([#88591](https://github.com/kubernetes/kubernetes/pull/88591), [@smarterclayton](https://github.com/smarterclayton)) [SIG Node and Scalability] -- Optimize kubectl version help info ([#88313](https://github.com/kubernetes/kubernetes/pull/88313), [@zhouya0](https://github.com/zhouya0)) [SIG CLI] -- Plugin/PluginConfig and Policy APIs are mutually exclusive when running the scheduler ([#88864](https://github.com/kubernetes/kubernetes/pull/88864), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- Removes the deprecated command `kubectl rolling-update` ([#88057](https://github.com/kubernetes/kubernetes/pull/88057), [@julianvmodesto](https://github.com/julianvmodesto)) [SIG Architecture, CLI and Testing] -- Resolved a regression in v1.18.0-rc.1 mounting windows volumes ([#89319](https://github.com/kubernetes/kubernetes/pull/89319), [@mboersma](https://github.com/mboersma)) [SIG API Machinery, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation and Storage] -- Scheduler PreScore plugins are not executed if there is one filtered node or less. ([#89370](https://github.com/kubernetes/kubernetes/pull/89370), [@ahg-g](https://github.com/ahg-g)) [SIG Scheduling] -- Specifying PluginConfig for the same plugin more than once fails scheduler startup. - - Specifying extenders and configuring .ignoredResources for the NodeResourcesFit plugin fails ([#88870](https://github.com/kubernetes/kubernetes/pull/88870), [@alculquicondor](https://github.com/alculquicondor)) [SIG Scheduling] -- Support TLS Server Name overrides in kubeconfig file and via --tls-server-name in kubectl ([#88769](https://github.com/kubernetes/kubernetes/pull/88769), [@deads2k](https://github.com/deads2k)) [SIG API Machinery, Auth and CLI] -- Terminating a restartPolicy=Never pod no longer has a chance to report the pod succeeded when it actually failed. ([#88440](https://github.com/kubernetes/kubernetes/pull/88440), [@smarterclayton](https://github.com/smarterclayton)) [SIG Node and Testing] -- The EventRecorder from k8s.io/client-go/tools/events will now create events in the default namespace (instead of kube-system) when the related object does not have it set. ([#88815](https://github.com/kubernetes/kubernetes/pull/88815), [@enj](https://github.com/enj)) [SIG API Machinery] -- The audit event sourceIPs list will now always end with the IP that sent the request directly to the API server. ([#87167](https://github.com/kubernetes/kubernetes/pull/87167), [@tallclair](https://github.com/tallclair)) [SIG API Machinery and Auth] -- Update Cluster Autoscaler to 1.18.0; changelog: https://github.com/kubernetes/autoscaler/releases/tag/cluster-autoscaler-1.18.0 ([#89095](https://github.com/kubernetes/kubernetes/pull/89095), [@losipiuk](https://github.com/losipiuk)) [SIG Autoscaling and Cluster Lifecycle] -- Update to use golang 1.13.8 ([#87648](https://github.com/kubernetes/kubernetes/pull/87648), [@ialidzhikov](https://github.com/ialidzhikov)) [SIG Release and Testing] -- Validate kube-proxy flags --ipvs-tcp-timeout, --ipvs-tcpfin-timeout, --ipvs-udp-timeout ([#88657](https://github.com/kubernetes/kubernetes/pull/88657), [@chendotjs](https://github.com/chendotjs)) [SIG Network] -- Wait for all CRDs to show up in discovery endpoint before reporting readiness. ([#89145](https://github.com/kubernetes/kubernetes/pull/89145), [@sttts](https://github.com/sttts)) [SIG API Machinery] -- `kubectl config view` now redacts bearer tokens by default, similar to client certificates. The `--raw` flag can still be used to output full content. ([#88985](https://github.com/kubernetes/kubernetes/pull/88985), [@brianpursley](https://github.com/brianpursley)) [SIG API Machinery and CLI] +- github.com/godbus/dbus: [ade71ed](https://github.com/godbus/dbus/tree/ade71ed) +- github.com/xlab/handysort: [fb3537e](https://github.com/xlab/handysort/tree/fb3537e) +- sigs.k8s.io/structured-merge-diff/v3: v3.0.0 +- vbom.ml/util: db5cfe1 From f54fdecb65fe67430e2d592f721d32b731b40b19 Mon Sep 17 00:00:00 2001 From: weihan Date: Tue, 29 Dec 2020 17:24:22 +0800 Subject: [PATCH 229/258] typo fix --- content/zh/docs/setup/production-environment/tools/kubespray.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/setup/production-environment/tools/kubespray.md b/content/zh/docs/setup/production-environment/tools/kubespray.md index 126d1a1305..a5dee4fe23 100644 --- a/content/zh/docs/setup/production-environment/tools/kubespray.md +++ b/content/zh/docs/setup/production-environment/tools/kubespray.md @@ -250,7 +250,7 @@ When running the reset playbook, be sure not to accidentally target your product Check out planned work on Kubespray's [roadmap](https://github.com/kubernetes-sigs/kubespray/blob/master/docs/roadmap.md). --> -## {{％heading“ whatsnext”％}} +## {{% heading "whatsnext" %}} 查看有关 Kubespray 的[路线图](https://github.com/kubernetes-sigs/kubespray/blob/master/docs/roadmap.md)的计划工作。 From 24ff7283344614844830f1f7545ffc17ef648c34 Mon Sep 17 00:00:00 2001 From: Felipe Martinez Date: Tue, 29 Dec 2020 13:51:25 +0000 Subject: [PATCH 230/258] Adding kubernetes-basics/_index.html --- .../tutorials/kubernetes-basics/_index.html | 117 ++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 content/pt/docs/tutorials/kubernetes-basics/_index.html diff --git a/content/pt/docs/tutorials/kubernetes-basics/_index.html b/content/pt/docs/tutorials/kubernetes-basics/_index.html new file mode 100644 index 0000000000..c87f0f2a9f --- /dev/null +++ b/content/pt/docs/tutorials/kubernetes-basics/_index.html @@ -0,0 +1,117 @@ +--- +title: Aprenda as noções básicas do Kubernetes +linkTitle: Aprenda as noções básicas do Kubernetes +no_list: true +weight: 10 +card: + name: tutoriais + weight: 20 + title: Aprenda o básico +--- + + + + + + + + + +
+ +
+ +
+
+

Basico do Kubernetes

+

Este tutorial fornece instruções básicas sobre o sistema de orquestração de cluster do Kubernetes. Cada módulo contém algumas informações básicas sobre os principais recursos e conceitos do Kubernetes e inclui um tutorial online interativo. Esses tutoriais interativos permitem que você mesmo gerencie um cluster simples e seus aplicativos em contêineres.

+

Usando os tutoriais interativos, você pode aprender a:

+
    +
  • Implante um aplicativo em contêiner em um cluster.
    • +
  • Dimensione a implantação.
    • +
  • Atualize o aplicativo em contêiner com uma nova versão do software.
    • +
  • Depure o aplicativo em contêiner.
    • +
+

Os tutoriais usam Katacoda para executar um terminal virtual em seu navegador da Web, executado em Minikube, uma implantação local em pequena escala do Kubernetes que pode ser executada em qualquer lugar. Não há necessidade de instalar nenhum software ou configurar nada; cada tutorial interativo é executado diretamente no navegador da web.

+
+
+ +
+ +
+
+

O que o Kubernetes pode fazer por você?

+

Com os serviços da Web modernos, os usuários esperam que os aplicativos estejam disponíveis 24 horas por dia, 7 dias por semana, e os desenvolvedores esperam implantar novas versões desses aplicativos várias vezes ao dia. A conteinerização ajuda a empacotar o software para atender a esses objetivos, permitindo que os aplicativos sejam lançados e atualizados de maneira fácil e rápida, sem tempo de inatividade. O Kubernetes ajuda a garantir que esses aplicativos em contêiner sejam executados onde e quando você quiser e os ajuda a encontrar os recursos e ferramentas de que precisam para funcionar. Kubernetes é uma plataforma de código aberto pronta para produção, projetada com a experiência acumulada do Google em orquestração de contêineres, combinada com as melhores ideias da comunidade.

+
+
+ +
+ +
+

Módulos básicos do Kubernetes

+
+
+
+
+
+ +
+
1. Crie um cluster Kubernetes
 +
+
+
+
+
+ +
+
2. Implantar um aplicativo
 +
+
+
+
+
+ +
+
3. Explore seu aplicativo
 +
+
+
+
+
+
+
+
+
+ +
+
4. Exponha seu aplicativo publicamente
 +
+
+
+
+
+ +
+
5. Amplie seu aplicativo
 +
+
+
+
+
+ +
+
6. Atualize seu aplicativo
 +
+
+
+
+
+
+
+ +
+ +
+ + + From b2e99114f02cff77435848fda48c51c2f47df5a2 Mon Sep 17 00:00:00 2001 From: Felipe Martinez Date: Tue, 29 Dec 2020 14:43:34 +0000 Subject: [PATCH 231/258] Adding create cluster --- .../create-cluster/_index.md | 4 + .../create-cluster/cluster-interactive.html | 37 ++++++ .../create-cluster/cluster-intro.html | 112 ++++++++++++++++++ 3 files changed, 153 insertions(+) create mode 100644 content/pt/docs/tutorials/kubernetes-basics/create-cluster/_index.md create mode 100644 content/pt/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html create mode 100644 content/pt/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html diff --git a/content/pt/docs/tutorials/kubernetes-basics/create-cluster/_index.md b/content/pt/docs/tutorials/kubernetes-basics/create-cluster/_index.md new file mode 100644 index 0000000000..3fb0a78778 --- /dev/null +++ b/content/pt/docs/tutorials/kubernetes-basics/create-cluster/_index.md @@ -0,0 +1,4 @@ +--- +title: Crie um Cluster +weight: 10 +--- diff --git a/content/pt/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html b/content/pt/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html new file mode 100644 index 0000000000..c817407ff3 --- /dev/null +++ b/content/pt/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html @@ -0,0 +1,37 @@ +--- +title: Tutorial interativo - Criando um cluster +weight: 20 +--- + + + + + + + + + + + +
+ +
+ +
+
+ Esta tela é muito estreita para interagir com o Terminal, use um desktop / tablet. +
+
+
+
+
+ Continue to Module 2› +
+
+ +
+ +
+ + + diff --git a/content/pt/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html b/content/pt/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html new file mode 100644 index 0000000000..fd5025ab45 --- /dev/null +++ b/content/pt/docs/tutorials/kubernetes-basics/create-cluster/cluster-intro.html @@ -0,0 +1,112 @@ +--- +title: Usando Minikube para criar um cluster +weight: 10 +--- + + + + + + + + + +
+ +
+ +
+ +
+

Objetivos

+
    +
  • Aprenda o que é um cluster Kubernetes.
    • +
  • Aprenda o que é o Minikube.
    • +
  • Inicie um cluster Kubernetes usando um terminal online.
    • +
+
+ +
+

Clusters do Kubernetes

+

+ O Kubernetes coordena um cluster altamente disponível de computadores conectados para funcionar como uma única unidade. + As abstrações no Kubernetes permitem implantar aplicativos em contêineres em um cluster sem amarrá-los especificamente a máquinas individuais. + Para fazer uso desse novo modelo de implantação, os aplicativos precisam ser empacotados de uma forma que os desacople dos hosts individuais: eles precisam ser colocados em contêineres. Os aplicativos em contêineres são mais flexíveis e disponíveis do que nos modelos de implantação anteriores, nos quais os aplicativos eram instalados diretamente em máquinas específicas como pacotes profundamente integrados ao host. + O Kubernetes automatiza a distribuição e o agendamento de contêineres de aplicativos em um cluster de maneira mais eficiente. + O Kubernetes é uma plataforma de código aberto e está pronto para produção. +

+

Um cluster Kubernetes consiste em dois tipos de recursos: +

    +
  • O Master coordena o cluster
    • +
  • Os Nodes são os trabalhadores que executam aplicativos
    • +
+

+
+ +
+
+

Resumo:

+
    +
  • Cluster do Kubernetes
    • +
  • Minikube
    • +
+
+
+

+ O Kubernetes é uma plataforma de código aberto de nível de produção que orquestra o agendamento e a execução de contêineres de aplicativos dentro e entre clusters de computador. +

+
+
+
+
+ +
+
+

Diagrama de Cluster

+
+
+ +
+
+

+
+
+
+ +
+
+

O mestre é responsável por gerenciar o cluster. O mestre coordena todas as atividades em seu cluster, como programação de aplicativos, manutenção do estado desejado dos aplicativos, escalonamento de aplicativos e lançamento de novas atualizações.

+

Um nó é uma VM ou um computador físico que atua como uma máquina de trabalho em um cluster Kubernetes. Cada nó tem um Kubelet, que é um agente para gerenciar o nó e se comunicar com o mestre do Kubernetes. O nó também deve ter ferramentas para lidar com operações de contêiner, como containerd ou Docker. Um cluster Kubernetes que lida com o tráfego de produção deve ter no mínimo três nós.

+ +
+
+
+

Os mestres gerenciam o cluster e os nós que são usados ​​para hospedar os aplicativos em execução.

+
+
+
+ +
+
+

Ao implantar aplicativos no Kubernetes, você diz ao mestre para iniciar os contêineres de aplicativos. O mestre agenda os contêineres para serem executados nos nós do cluster. Os nós se comunicam com o mestre usando a API Kubernetes , que o mestre expõe. Os usuários finais também podem usar a API Kubernetes diretamente para interagir com o cluster.

+ +

Um cluster Kubernetes pode ser implantado em máquinas físicas ou virtuais. Para começar o desenvolvimento do Kubernetes, você pode usar o Minikube. O Minikube é uma implementação leve do Kubernetes que cria uma VM em sua máquina local e implanta um cluster simples contendo apenas um nó. O Minikube está disponível para sistemas Linux, macOS e Windows. O Minikube CLI fornece operações básicas de inicialização para trabalhar com seu cluster, incluindo iniciar, parar, status e excluir. Para este tutorial, no entanto, você usará um terminal online fornecido com o Minikube pré-instalado.

+ +

Agora que você sabe o que é Kubernetes, vamos para o tutorial online e iniciar nosso primeiro cluster!

+ +
+
+
+ +
+
+ Iniciar tutorial interativo › +
+
+ +
+ +
+ + + From 399af08bba44a8f8e6416037a53e3950c5dbc2ec Mon Sep 17 00:00:00 2001 From: Felipe Date: Tue, 29 Dec 2020 20:21:31 +0000 Subject: [PATCH 232/258] Update content/pt/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html Co-authored-by: Jhon Mike --- .../kubernetes-basics/create-cluster/cluster-interactive.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/pt/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html b/content/pt/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html index c817407ff3..9be46e849d 100644 --- a/content/pt/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html +++ b/content/pt/docs/tutorials/kubernetes-basics/create-cluster/cluster-interactive.html @@ -25,7 +25,7 @@ weight: 20
- Continue to Module 2› + Continue para o Módulo 2›
From aced579ef1ab3ebbaed359a4a22a31db68f4763d Mon Sep 17 00:00:00 2001 From: Arhell Date: Wed, 30 Dec 2020 02:11:00 +0200 Subject: [PATCH 233/258] [zh] use https for link to contributor covenant --- content/zh/community/static/cncf-code-of-conduct.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/community/static/cncf-code-of-conduct.md b/content/zh/community/static/cncf-code-of-conduct.md index 189675848a..0c63979e3e 100644 --- a/content/zh/community/static/cncf-code-of-conduct.md +++ b/content/zh/community/static/cncf-code-of-conduct.md @@ -23,7 +23,7 @@ 如需举报侮辱、骚扰或其他不可接受的行为，您可发送邮件至 联系 [Kubernetes行为守则委员会](https://github.com/kubernetes/community/tree/master/committee-code-of-conduct)。其他事务请联系CNCF项目维护专员，或发送邮件至 联系我们的调解员Mishi Choudhary。 -本行为准则改编自《贡献者契约》（ http://contributor-covenant.org ）1.2.0 版本，可在 http://contributor-covenant.org/version/1/2/0/ 查看。 +本行为准则改编自《贡献者契约》（ https://contributor-covenant.org ）1.2.0 版本，可在 https://contributor-covenant.org/version/1/2/0/ 查看。 ### CNCF 活动行为准则 From 8e109008343ebf08edfa7f6689846cadc00194c6 Mon Sep 17 00:00:00 2001 From: Zhang Yong Date: Wed, 30 Dec 2020 11:16:15 +0800 Subject: [PATCH 234/258] fix init-Container status describe fault --- content/en/docs/concepts/workloads/pods/init-containers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/workloads/pods/init-containers.md b/content/en/docs/concepts/workloads/pods/init-containers.md index 08d6e0fa0f..869ba66f66 100644 --- a/content/en/docs/concepts/workloads/pods/init-containers.md +++ b/content/en/docs/concepts/workloads/pods/init-containers.md @@ -257,7 +257,7 @@ if the Pod `restartPolicy` is set to Always, the init containers use A Pod cannot be `Ready` until all init containers have succeeded. The ports on an init container are not aggregated under a Service. A Pod that is initializing -is in the `Pending` state but should have a condition `Initialized` set to true. +is in the `Pending` state but should have a condition `Initialized` set to false. If the Pod [restarts](#pod-restart-reasons), or is restarted, all init containers must execute again. From 6b03522212435e96ac634bfb2bdcbb3d628326f4 Mon Sep 17 00:00:00 2001 From: Zhang Yong Date: Wed, 30 Dec 2020 14:30:44 +0800 Subject: [PATCH 235/258] Use https for link to contributor covenant --- content/pt/community/static/cncf-code-of-conduct.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/pt/community/static/cncf-code-of-conduct.md b/content/pt/community/static/cncf-code-of-conduct.md index a3db1daad2..3366db8ed4 100644 --- a/content/pt/community/static/cncf-code-of-conduct.md +++ b/content/pt/community/static/cncf-code-of-conduct.md @@ -36,8 +36,8 @@ quando um indivíduo está representando o projeto ou sua comunidade. Casos de comportamento abusivo, de assédio ou inaceitável no Kubernetes podem ser relatados entrando em contato com o [Comitê de Código de Conduta da Kubernetes] (https://git.k8s.io/community/committee-code-of-conduct) via . Para outros projetos, entre em contato com um mantenedor do projeto CNCF ou com nosso mediador, Mishi Choudhary . Este Código de Conduta é adaptado do Pacto do Colaborador -(http://contributor-covenant.org), versão 1.2.0, disponível em -http://contributor-covenant.org/version/1/2/0/ +(https://contributor-covenant.org), versão 1.2.0, disponível em +https://contributor-covenant.org/version/1/2/0/ ### Código de Conduta para a Comunidade CNCF From eb47b6fe37cbd418a706d8d8969d1356a1d8f294 Mon Sep 17 00:00:00 2001 From: Zhang Yong Date: Wed, 30 Dec 2020 14:43:26 +0800 Subject: [PATCH 236/258] Use https for link to contributor covenant --- content/de/community/static/cncf-code-of-conduct.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/de/community/static/cncf-code-of-conduct.md b/content/de/community/static/cncf-code-of-conduct.md index e94bc7b7fa..7a7bee34e7 100644 --- a/content/de/community/static/cncf-code-of-conduct.md +++ b/content/de/community/static/cncf-code-of-conduct.md @@ -23,7 +23,7 @@ Dieser Verhaltenskodex gilt sowohl innerhalb von Projekträumen als auch in öff Fälle von missbräuchlichem, belästigendem oder anderweitig unzumutbarem Verhalten in Kubernetes können gemeldet werden, indem Sie sich an das [Kubernetes Komitee für Verhaltenskodex](https://git.k8s.io/community/committee-code-of-conduct) wenden unter . Für andere Projekte wenden Sie sich bitte an einen CNCF-Projektbetreuer oder an unseren Mediator, Mishi Choudhary . -Dieser Verhaltenskodex wurde aus dem Contributor Covenant übernommen (http://contributor-covenant.org), Version 1.2.0, verfügbar unter http://contributor-covenant.org/version/1/2/0/ +Dieser Verhaltenskodex wurde aus dem Contributor Covenant übernommen (https://contributor-covenant.org), Version 1.2.0, verfügbar unter https://contributor-covenant.org/version/1/2/0/ ### CNCF Verhaltenskodex für Veranstaltungen From c4b818c1f11280c5946d45475e91c890ad7289f4 Mon Sep 17 00:00:00 2001 From: AUT0R3V <63261637+Aut0R3V@users.noreply.github.com> Date: Wed, 30 Dec 2020 14:35:16 +0530 Subject: [PATCH 237/258] Update common-labels.md --- .../concepts/overview/working-with-objects/common-labels.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/en/docs/concepts/overview/working-with-objects/common-labels.md b/content/en/docs/concepts/overview/working-with-objects/common-labels.md index a0a68c6dff..29af899b4e 100644 --- a/content/en/docs/concepts/overview/working-with-objects/common-labels.md +++ b/content/en/docs/concepts/overview/working-with-objects/common-labels.md @@ -59,8 +59,8 @@ metadata: ## Applications And Instances Of Applications An application can be installed one or more times into a Kubernetes cluster and, -in some cases, the same namespace. For example, wordpress can be installed more -than once where different websites are different installations of wordpress. +in some cases, the same namespace. For example, WordPress can be installed more +than once where different websites are different installations of WordPress. The name of an application and the instance name are recorded separately. For example, WordPress has a `app.kubernetes.io/name` of `wordpress` while it has @@ -168,6 +168,6 @@ metadata: ... ``` -With the MySQL `StatefulSet` and `Service` you'll notice information about both MySQL and Wordpress, the broader application, are included. +With the MySQL `StatefulSet` and `Service` you'll notice information about both MySQL and WordPress, the broader application, are included. From 258f189e73a1ab1343859414c91375f5654e1159 Mon Sep 17 00:00:00 2001 From: yuandongx Date: Wed, 30 Dec 2020 09:49:17 +0000 Subject: [PATCH 238/258] outdate --- content/zh/docs/concepts/scheduling-eviction/pod-overhead.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/concepts/scheduling-eviction/pod-overhead.md b/content/zh/docs/concepts/scheduling-eviction/pod-overhead.md index 98febf6328..825e59d9dd 100644 --- a/content/zh/docs/concepts/scheduling-eviction/pod-overhead.md +++ b/content/zh/docs/concepts/scheduling-eviction/pod-overhead.md @@ -73,7 +73,7 @@ RuntimeClass 如下，其中每个 Pod 大约使用 120MiB: ```yaml --- kind: RuntimeClass -apiVersion: node.k8s.io/v1beta1 +apiVersion: node.k8s.io/v1 metadata: name: kata-fc handler: kata-fc From e57ff3eb5261322a94a690760c98f0b3fb7ee341 Mon Sep 17 00:00:00 2001 From: morihaya Date: Wed, 30 Dec 2020 21:36:08 +0900 Subject: [PATCH 239/258] Add a default description to path of HTTP probes --- .../configure-liveness-readiness-startup-probes.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md b/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md index 42e2e3d468..45d56531f2 100644 --- a/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md +++ b/content/en/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes.md @@ -366,7 +366,7 @@ have additional fields that can be set on `httpGet`: * `host`: Host name to connect to, defaults to the pod IP. You probably want to set "Host" in httpHeaders instead. * `scheme`: Scheme to use for connecting to the host (HTTP or HTTPS). Defaults to HTTP. -* `path`: Path to access on the HTTP server. +* `path`: Path to access on the HTTP server. Defaults to /. * `httpHeaders`: Custom headers to set in the request. HTTP allows repeated headers. * `port`: Name or number of the port to access on the container. Number must be in the range 1 to 65535. From 053103dc4a0ddbebba9f8651c4b72bae30f197c1 Mon Sep 17 00:00:00 2001 From: Ader Date: Wed, 30 Dec 2020 20:57:11 +0800 Subject: [PATCH 240/258] Add Code blocks in pod-topology-spread-constraints.md Add Code blocks in the Markdown spec to make it easy to read.. --- .../concepts/workloads/pods/pod-topology-spread-constraints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md b/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md index 4b33db8703..2e8a915c62 100644 --- a/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md +++ b/content/en/docs/concepts/workloads/pods/pod-topology-spread-constraints.md @@ -66,7 +66,7 @@ Instead of manually applying labels, you can also reuse the [well-known labels]( The API field `pod.spec.topologySpreadConstraints` is defined as below: -``` +```yaml apiVersion: v1 kind: Pod metadata: From 67e54d68aab0566dac10c733ba71b67d4c35e941 Mon Sep 17 00:00:00 2001 From: yuandongx Date: Thu, 31 Dec 2020 02:39:10 +0000 Subject: [PATCH 241/258] typo --- content/zh/docs/reference/glossary/configmap.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/zh/docs/reference/glossary/configmap.md b/content/zh/docs/reference/glossary/configmap.md index eb936aca66..be80c84f61 100644 --- a/content/zh/docs/reference/glossary/configmap.md +++ b/content/zh/docs/reference/glossary/configmap.md @@ -4,7 +4,7 @@ id: configmap date: 2018-04-12 full_link: /zh/docs/tasks/configure-pod-container/configure-pod-configmap/ short_description: > - ConfigMap 是一种 API 对象，用来将非机密性的数据保存到健值对中。使用时可以用作环境变量、命令行参数或者存储卷中的配置文件。 + ConfigMap 是一种 API 对象，用来将非机密性的数据保存到键值对中。使用时可以用作环境变量、命令行参数或者存储卷中的配置文件。 aka: tags: @@ -33,7 +33,7 @@ environment variables, command-line arguments, or as configuration files in a {{< glossary_tooltip text="volume" term_id="volume" >}}. --> - ConfigMap 是一种 API 对象，用来将非机密性的数据保存到健值对中。使用时， {{< glossary_tooltip text="Pods" term_id="pod" >}} 可以将其用作环境变量、命令行参数或者存储卷中的配置文件。 + ConfigMap 是一种 API 对象，用来将非机密性的数据保存到键值对中。使用时， {{< glossary_tooltip text="Pods" term_id="pod" >}} 可以将其用作环境变量、命令行参数或者存储卷中的配置文件。 From 21d86f2aa8abd86a9f4b369e164bd94e748079bf Mon Sep 17 00:00:00 2001 From: yuandongx <786018072@qq.com> Date: Thu, 31 Dec 2020 11:21:00 +0800 Subject: [PATCH 242/258] Incorrect apiVersion --- .../windows/user-guide-windows-containers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/zh/docs/setup/production-environment/windows/user-guide-windows-containers.md b/content/zh/docs/setup/production-environment/windows/user-guide-windows-containers.md index 1fd7105edb..93eae4e7d6 100644 --- a/content/zh/docs/setup/production-environment/windows/user-guide-windows-containers.md +++ b/content/zh/docs/setup/production-environment/windows/user-guide-windows-containers.md @@ -303,7 +303,7 @@ This label reflects the Windows major, minor, and build number that need to matc 1. 将此文件保存到 `runtimeClasses.yml` 文件。它包括适用于 Windows 操作系统、体系结构和版本的 `nodeSelector`。 ```yaml - apiVersion: node.k8s.io/v1beta1 + apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: name: windows-2019 From 89ecb8cfb63b156ec5df6150b443383e6af71535 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Thu, 31 Dec 2020 11:46:33 +0800 Subject: [PATCH 243/258] Fix feature gate for hugepage The text says "disable" because the gate is in Beta, but the example says "enable". That is awkward. --- content/en/docs/tasks/manage-hugepages/scheduling-hugepages.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/manage-hugepages/scheduling-hugepages.md b/content/en/docs/tasks/manage-hugepages/scheduling-hugepages.md index 36b92ac18a..c3e43127a9 100644 --- a/content/en/docs/tasks/manage-hugepages/scheduling-hugepages.md +++ b/content/en/docs/tasks/manage-hugepages/scheduling-hugepages.md @@ -117,4 +117,4 @@ token. gate](/docs/reference/command-line-tools-reference/feature-gates/) on the {{< glossary_tooltip text="kubelet" term_id="kubelet" >}} and {{< glossary_tooltip text="kube-apiserver" -term_id="kube-apiserver" >}} (`--feature-gates=HugePageStorageMediumSize=true`). +term_id="kube-apiserver" >}} (`--feature-gates=HugePageStorageMediumSize=false`). From ad59de018dd1212c0bddfa3b8690747898dda2a9 Mon Sep 17 00:00:00 2001 From: Qiming Teng Date: Thu, 31 Dec 2020 11:47:58 +0800 Subject: [PATCH 244/258] Wrap lines properly --- .../manage-hugepages/scheduling-hugepages.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/content/en/docs/tasks/manage-hugepages/scheduling-hugepages.md b/content/en/docs/tasks/manage-hugepages/scheduling-hugepages.md index c3e43127a9..8d4cd4afe6 100644 --- a/content/en/docs/tasks/manage-hugepages/scheduling-hugepages.md +++ b/content/en/docs/tasks/manage-hugepages/scheduling-hugepages.md @@ -104,17 +104,19 @@ spec: - Huge page requests must equal the limits. This is the default if limits are specified, but requests are not. -- Huge pages are isolated at a container scope, so each container has own limit on their cgroup sandbox as requested in a container spec. +- Huge pages are isolated at a container scope, so each container has own + limit on their cgroup sandbox as requested in a container spec. - EmptyDir volumes backed by huge pages may not consume more huge page memory than the pod request. - Applications that consume huge pages via `shmget()` with `SHM_HUGETLB` must run with a supplemental group that matches `proc/sys/vm/hugetlb_shm_group`. - Huge page usage in a namespace is controllable via ResourceQuota similar -to other compute resources like `cpu` or `memory` using the `hugepages-` -token. + to other compute resources like `cpu` or `memory` using the `hugepages-` + token. - Support of multiple sizes huge pages is feature gated. It can be - disabled with the `HugePageStorageMediumSize` [feature -gate](/docs/reference/command-line-tools-reference/feature-gates/) on the {{< -glossary_tooltip text="kubelet" term_id="kubelet" >}} and {{< -glossary_tooltip text="kube-apiserver" -term_id="kube-apiserver" >}} (`--feature-gates=HugePageStorageMediumSize=false`). + disabled with the `HugePageStorageMediumSize` + [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) + on the {{< glossary_tooltip text="kubelet" term_id="kubelet" >}} and + {{< glossary_tooltip text="kube-apiserver" term_id="kube-apiserver" >}} + (`--feature-gates=HugePageStorageMediumSize=false`). + From d22e255dd634947162c894f1b342b278cb7cc319 Mon Sep 17 00:00:00 2001 From: yuandongx Date: Wed, 30 Dec 2020 10:28:24 +0000 Subject: [PATCH 245/258] miss url && something is outdate --- .../tools/kubeadm/kubelet-integration.md | 76 ++++++++++--------- 1 file changed, 41 insertions(+), 35 deletions(-) diff --git a/content/zh/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md b/content/zh/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md index 476c27f075..8eeb160775 100644 --- a/content/zh/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md +++ b/content/zh/docs/setup/production-environment/tools/kubeadm/kubelet-integration.md @@ -25,15 +25,15 @@ The lifecycle of the kubeadm CLI tool is decoupled from the on each node within the Kubernetes cluster. The kubeadm CLI tool is executed by the user when Kubernetes is initialized or upgraded, where as the kubelet is always running in the background. -Since the kubelet is a daemon, it needs to be maintained by some kind of a init +Since the kubelet is a daemon, it needs to be maintained by some kind of an init system or service manager. When the kubelet is installed using DEBs or RPMs, systemd is configured to manage the kubelet. You can use a different service manager instead, but you need to configure it manually. Some kubelet configuration details need to be the same across all kubelets involved in the cluster, while -other configuration aspects need to be set on a per-kubelet basis, to accommodate the different -characteristics of a given machine, such as OS, storage, and networking. You can manage the configuration -of your kubelets manually, but [kubeadm now provides a `KubeletConfiguration` API type for managing your +other configuration aspects need to be set on a per-kubelet basis to accommodate the different +characteristics of a given machine (such as OS, storage, and networking). You can manage the configuration +of your kubelets manually, but kubeadm now provides a `KubeletConfiguration` API type for [managing your kubelet configurations centrally](#configure-kubelets-using-kubeadm). --> kubeadm CLI 工具的生命周期与 [kubelet](/zh/docs/reference/command-line-tools-reference/kubelet)解耦，它是一个守护程序，在 Kubernetes 集群中的每个节点上运行。 @@ -41,10 +41,12 @@ kubeadm CLI 工具的生命周期与 [kubelet](/zh/docs/reference/command-line-t 由于kubelet是守护程序，因此需要通过某种初始化系统或服务管理器进行维护。 当使用 DEB 或 RPM 安装 kubelet 时，配置系统去管理 kubelet。 -您可以改用其他服务管理器，但需要手动地配置。 +你可以改用其他服务管理器，但需要手动地配置。 -集群中涉及的所有 kubelet 的一些配置细节都必须相同，而其他配置方面则需要基于每个 kubelet 进行设置，以适应给定机器的不同特性，例如操作系统、存储和网络。 -您可以手动地管理 kubelet 的配置，但是 [kubeadm 现在提供一种 `KubeletConfiguration` API 类型，用于集中管理 kubelet 的配置](#configure-kubelets-using-kubeadm)。 +集群中涉及的所有 kubelet 的一些配置细节都必须相同， +而其他配置方面则需要基于每个 kubelet 进行设置，以适应给定机器的不同特性（例如操作系统、存储和网络）。 +你可以手动地管理 kubelet 的配置，但是 kubeadm 现在提供一种 `KubeletConfiguration` API 类型 +用于[集中管理 kubelet 的配置](#configure-kubelets-using-kubeadm)。 @@ -91,17 +93,17 @@ clusterDNS: --> ### 将集群级配置传播到每个 kubelet 中 -您可以通过使用 `kubeadm init` 和 `kubeadm join` 命令为 kubelet 提供默认值。 +你可以通过使用 `kubeadm init` 和 `kubeadm join` 命令为 kubelet 提供默认值。 有趣的示例包括使用其他 CRI 运行时或通过服务器设置不同的默认子网。 -如果您想使用子网 `10.96.0.0/12` 作为默认的服务，您可以给 kubeadm 传递 `--service-cidr` 参数： +如果你想使用子网 `10.96.0.0/12` 作为默认的服务，你可以给 kubeadm 传递 `--service-cidr` 参数： ```bash kubeadm init --service-cidr 10.96.0.0/12 ``` 现在，可以从该子网分配服务的虚拟 IP。 -您还需要通过 kubelet 使用 `--cluster-dns` 标志设置 DNS 地址。 +你还需要通过 kubelet 使用 `--cluster-dns` 标志设置 DNS 地址。 在集群中的每个管理器和节点上的 kubelet 的设置需要相同。 kubelet 提供了一个版本化的结构化 API 对象，该对象可以配置 kubelet 中的大多数参数，并将此配置推送到集群中正在运行的每个 kubelet 上。 此对象被称为 **kubelet 的配置组件**。 @@ -119,7 +121,7 @@ clusterDNS: ## kubelet 的 systemd 文件 {#the-kubelet-drop-in-file-for-systemd} -kubeadm 中附带了有关系统如何运行 kubelet 的 systemd 配置文件。 +`kubeadm` 中附带了有关系统如何运行 kubelet 的 systemd 配置文件。 请注意 kubeadm CLI 命令不会修改此文件。 -通过 `kubeadm` [DEB](https://github.com/kubernetes/kubernetes/blob/master/build/debs/10-kubeadm.conf) 或者 [RPM 包](https://github.com/kubernetes/kubernetes/blob/master/build/rpms/10-kubeadm.conf) 安装的配置文件已被写入 `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` 并由系统使用。 -它加强了基础设施 [`kubelet.service` for RPM](https://github.com/kubernetes/kubernetes/blob/master/build/rpms/kubelet.service) (resp. [`kubelet.service` for DEB](https://github.com/kubernetes/kubernetes/blob/master/build/debs/kubelet.service)))： +通过 `kubeadm` [DEB](https://github.com/kubernetes/release/blob/master/cmd/kubepkg/templates/latest/deb/kubeadm/10-kubeadm.conf) +或者 [RPM 包](https://github.com/kubernetes/release/blob/master/cmd/kubepkg/templates/latest/rpm/kubeadm/10-kubeadm.conf) +安装的配置文件被写入 `/etc/systemd/system/kubelet.service.d/10-kubeadm.conf` 并由系统使用。 +它对原来的 [RPM 版本 `kubelet.service`](https://github.com/kubernetes/release/blob/master/cmd/kubepkg/templates/latest/rpm/kubelet/kubelet.service) +或者 [DEB 版本 `kubelet.service`](https://github.com/kubernetes/release/blob/master/cmd/kubepkg/templates/latest/deb/kubelet/lib/systemd/system/kubelet.service) +作了增强： ```none [Service] @@ -361,10 +368,9 @@ The DEB and RPM packages shipped with the Kubernetes releases are: | Package name | Description | |--------------|-------------| | `kubeadm` | Installs the `/usr/bin/kubeadm` CLI tool and the [kubelet drop-in file](#the-kubelet-drop-in-file-for-systemd) for the kubelet. | -| `kubelet` | Installs the `/usr/bin/kubelet` binary. | +| `kubelet` | Installs the kubelet binary in `/usr/bin` and CNI binaries in `/opt/cni/bin`. | | `kubectl` | Installs the `/usr/bin/kubectl` binary. | -| `kubernetes-cni` | Installs the official CNI binaries into the `/opt/cni/bin` directory. | -| `cri-tools` | Installs the `/usr/bin/crictl` binary from the [cri-tools git repository](https://github.com/kubernetes-incubator/cri-tools). | +| `cri-tools` | Installs the `/usr/bin/crictl` binary from the [cri-tools git repository](https://github.com/kubernetes-sigs/cri-tools). | --> ## Kubernetes 二进制文件和软件包内容 @@ -373,8 +379,8 @@ Kubernetes 版本对应的 DEB 和 RPM 软件包是： | Package name | Description | |--------------|-------------| | `kubeadm` | 给 kubelet 安装 `/usr/bin/kubeadm` CLI 工具和 [kubelet 的 systemd 文件](#the-kubelet-drop-in-file-for-systemd)。 | -| `kubelet` | 安装 `/usr/bin/kubelet` 二进制文件和 `/opt/cni/bin` CNI 二进制文件。 | -| `kubectl` | 安装 `/usr/bin/kubectl` 二进制文件。 | -| `cri-tools` | 从 [cri-tools git 仓库](https://github.com/kubernetes-incubator/cri-tools)中安装 `/usr/bin/crictl` 二进制文件。 | +| `kubelet` | 安装 kublet 可执行文件到 `/usr/bin` 路径，安装 CNI 可执行文件到 `/opt/cni/bin` 路径。 | +| `kubectl` | 安装 `/usr/bin/kubectl` 可执行文件。 | +| `cri-tools` | 从 [cri-tools git 仓库](https://github.com/kubernetes-sigs/cri-tools)中安装 `/usr/bin/crictl` 可执行文件。 | From 9558f9b78b055ab3d1b22a71a766747a10849093 Mon Sep 17 00:00:00 2001 From: Ader Date: Thu, 31 Dec 2020 17:21:41 +0800 Subject: [PATCH 246/258] Fix some typo in pod-overhead.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Uniform case in pod-overhead.md(Kubelet → kubelet). --- content/en/docs/concepts/scheduling-eviction/pod-overhead.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/concepts/scheduling-eviction/pod-overhead.md b/content/en/docs/concepts/scheduling-eviction/pod-overhead.md index 989db38a7f..cb3ad94241 100644 --- a/content/en/docs/concepts/scheduling-eviction/pod-overhead.md +++ b/content/en/docs/concepts/scheduling-eviction/pod-overhead.md @@ -30,7 +30,7 @@ time according to the overhead associated with the Pod's [RuntimeClass](/docs/concepts/containers/runtime-class/). When Pod Overhead is enabled, the overhead is considered in addition to the sum of container -resource requests when scheduling a Pod. Similarly, Kubelet will include the Pod overhead when sizing +resource requests when scheduling a Pod. Similarly, the kubelet will include the Pod overhead when sizing the Pod cgroup, and when carrying out Pod eviction ranking. ## Enabling Pod Overhead {#set-up} From 103311a5adacd813e06b2c3bc81465ba81057950 Mon Sep 17 00:00:00 2001 From: kylejep <62087369+kylejep@users.noreply.github.com> Date: Thu, 31 Dec 2020 07:42:58 -0800 Subject: [PATCH 247/258] Update container-runtimes.md I propose that by adding the modules to /etc/modules-load.d/ can help prevent issues with overlay and br_netfilter modules not loading after reboot. --- .../setup/production-environment/container-runtimes.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/en/docs/setup/production-environment/container-runtimes.md b/content/en/docs/setup/production-environment/container-runtimes.md index 66173bd080..fdc7214d00 100644 --- a/content/en/docs/setup/production-environment/container-runtimes.md +++ b/content/en/docs/setup/production-environment/container-runtimes.md @@ -236,6 +236,13 @@ For more information, see the [CRI-O compatibility matrix](https://github.com/cr Install and configure prerequisites: ```shell + +# Create the .conf file to load the modules at bootup +cat < Date: Thu, 31 Dec 2020 07:54:16 -0800 Subject: [PATCH 248/258] Update install-kubeadm.md Propose adding config reference to load br_netfilter at boot up to prevent issues with the module not being loaded after reboot. --- .../production-environment/tools/kubeadm/install-kubeadm.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md index 8ff56de29f..9d0853b824 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/install-kubeadm.md @@ -59,6 +59,10 @@ Make sure that the `br_netfilter` module is loaded. This can be done by running As a requirement for your Linux Node's iptables to correctly see bridged traffic, you should ensure `net.bridge.bridge-nf-call-iptables` is set to 1 in your `sysctl` config, e.g. ```bash +cat < Date: Thu, 31 Dec 2020 08:33:50 -0800 Subject: [PATCH 249/258] zh:sync docs from en and delete the removed file --- .../docs/concepts/workloads/pods/podpreset.md | 162 ------------------ .../docs/setup/learning-environment/kind.md | 23 --- 2 files changed, 185 deletions(-) delete mode 100644 content/zh/docs/concepts/workloads/pods/podpreset.md delete mode 100644 content/zh/docs/setup/learning-environment/kind.md diff --git a/content/zh/docs/concepts/workloads/pods/podpreset.md b/content/zh/docs/concepts/workloads/pods/podpreset.md deleted file mode 100644 index bb17654ddb..0000000000 --- a/content/zh/docs/concepts/workloads/pods/podpreset.md +++ /dev/null @@ -1,162 +0,0 @@ ---- -title: Pod Preset -content_type: concept -weight: 50 ---- - - - - - - -{{< feature-state for_k8s_version="v1.6" state="alpha" >}} - -本文提供了 PodPreset 的概述。 在 Pod 创建时，用户可以使用 PodPreset 对象将特定信息注入 Pod 中，这些信息可以包括 Secret、卷、卷挂载和环境变量。 - - - - -## 理解 Pod Preset - - -`Pod Preset` 是一种 API 资源，在 Pod 创建时，用户可以用它将额外的运行时需求信息注入 Pod。 -使用[标签选择算符](/zh/docs/concepts/overview/working-with-objects/labels/#label-selectors) -来指定 Pod Preset 所适用的 Pod。 - - - -使用 Pod Preset 使得 Pod 模板编写者不必显式地为每个 Pod 设置信息。 -这样，使用特定服务的 Pod 模板编写者不需要了解该服务的所有细节。 - - -## 在你的集群中启用 Pod Preset {#enable-pod-preset} - -为了在集群中使用 Pod Preset，必须确保以下几点： - - -1. 已启用 API 类型 `settings.k8s.io/v1alpha1/podpreset`。 例如，这可以通过在 API 服务器的 `--runtime-config` - 配置项中包含 `settings.k8s.io/v1alpha1=true` 来实现。 - 在 minikube 部署的集群中，启动集群时添加此参数 `--extra-config=apiserver.runtime-config=settings.k8s.io/v1alpha1=true`。 -1. 已启用准入控制器 `PodPreset`。 启用的一种方式是在 API 服务器的 `--enable-admission-plugins` - 配置项中包含 `PodPreset` 。在 minikube 部署的集群中，启动集群时添加以下参数： - - ```shell - --extra-config=apiserver.enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,PodPreset - ``` - - -## PodPreset 如何工作 - -Kubernetes 提供了准入控制器 (`PodPreset`)，该控制器被启用时，会将 Pod Preset -应用于接收到的 Pod 创建请求中。 -当出现 Pod 创建请求时，系统会执行以下操作： - - - -1. 检索所有可用 `PodPresets` 。 -1. 检查 `PodPreset` 的标签选择器与要创建的 Pod 的标签是否匹配。 -1. 尝试合并 `PodPreset` 中定义的各种资源，并注入要创建的 Pod。 -1. 发生错误时抛出事件，该事件记录了 pod 信息合并错误，同时在 _不注入_ `PodPreset` 信息的情况下创建 Pod。 -1. 为改动的 Pod spec 添加注解，来表明它被 `PodPreset` 所修改。 注解形如： - `podpreset.admission.kubernetes.io/podpreset-": "<资源版本>"`。 - - - -一个 Pod 可能不与任何 Pod Preset 匹配，也可能匹配多个 Pod Preset。 同时，一个 `PodPreset` -可能不应用于任何 Pod，也可能应用于多个 Pod。 当 `PodPreset` 应用于一个或多个 Pod 时，Kubernetes -修改 pod spec。 对于 `Env`、 `EnvFrom` 和 `VolumeMounts` 的改动， Kubernetes 修改 pod -中所有容器 spec，对于卷的改动，Kubernetes 会修改 Pod spec。 - - -{{< note >}} -适当时候，Pod Preset 可以修改 Pod 规范中的以下字段： -- `.spec.containers` 字段 -- `initContainers` 字段 -{{< /note >}} - - -### 为特定 Pod 禁用 Pod Preset - -在一些情况下，用户不希望 Pod 被 Pod Preset 所改动，这时，用户可以在 Pod -的 `.spec` 中添加形如 `podpreset.admission.kubernetes.io/exclude: "true"` 的注解。 - -## {{% heading "whatsnext" %}} - - -* 参考[使用 PodPreset 将信息注入 Pod](/zh/docs/tasks/inject-data-application/podpreset/)。 -* 若要更多地了解背景知识，请参阅 [PodPreset 的设计提案](https://git.k8s.io/community/contributors/design-proposals/service-catalog/pod-preset.md)。 - diff --git a/content/zh/docs/setup/learning-environment/kind.md b/content/zh/docs/setup/learning-environment/kind.md deleted file mode 100644 index d45686fc23..0000000000 --- a/content/zh/docs/setup/learning-environment/kind.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: 使用 Kind 安装 Kubernetes -weight: 40 -content_type: concept ---- - - - - -Kind 是一个使用 Docker 容器“节点”运行本地 Kubernetes 集群的工具。 - - - - -## 安装 {#installation} - -参见[安装 Kind ](https://kind.sigs.k8s.io/docs/user/quick-start/)。 From 0ed380d4aac54475e63bfb7fb8128237268464f6 Mon Sep 17 00:00:00 2001 From: Jerry Park Date: Mon, 14 Dec 2020 00:16:04 +0000 Subject: [PATCH 250/258] Ko: 1st Korean l10n work for release-1.20 - Translate reference/glossary/persistent-volume.md in Korean (#25474) - Update outdated files in the dev-1.20-ko.1 branch (1) (#25576) - Translate blog/dont-panic-kubernetes-and-docker into Korean (#25596) - Update outdated files in the dev-1.20-ko.1 branch(3) (#25728) - Ko: enhance tutorials//cluster-intro translation (#25754) - Fix Outdated files in the dev-1.20-ko.1 branch (2) (#25765) Co-authored-by: seokho-son Co-authored-by: jmyung Co-authored-by: Jerry Park Co-authored-by: santachopa Co-authored-by: SEUNGHYUN KO Co-authored-by: June Yi --- content/ko/blog/_index.md | 16 + ...-12-02-dont-panic-kubernetes-and-docker.md | 104 +++++++ .../ko/docs/concepts/architecture/nodes.md | 21 ++ .../kubelet-garbage-collection.md | 18 +- .../cluster-administration/networking.md | 5 +- .../cluster-administration/system-metrics.md | 19 ++ .../manage-resources-containers.md | 4 + .../ko/docs/concepts/configuration/secret.md | 18 +- .../docs/concepts/containers/runtime-class.md | 4 +- .../compute-storage-net/device-plugins.md | 4 +- .../docs/concepts/overview/kubernetes-api.md | 66 ++-- .../overview/working-with-objects/labels.md | 9 +- .../concepts/policy/pod-security-policy.md | 2 +- .../docs/concepts/policy/resource-quotas.md | 2 +- .../scheduling-eviction/assign-pod-node.md | 45 +++ .../scheduling-eviction/pod-overhead.md | 2 +- .../services-networking/dns-pod-service.md | 6 +- .../services-networking/dual-stack.md | 171 +++++++++-- .../services-networking/endpoint-slices.md | 53 +++- .../ingress-controllers.md | 55 ++-- .../concepts/services-networking/service.md | 116 ++++--- .../concepts/storage/persistent-volumes.md | 57 ++-- .../storage/volume-snapshot-classes.md | 4 +- .../docs/concepts/storage/volume-snapshots.md | 10 +- content/ko/docs/concepts/storage/volumes.md | 6 + .../workloads/controllers/cron-jobs.md | 10 +- .../workloads/controllers/daemonset.md | 6 - .../workloads/controllers/deployment.md | 8 +- .../controllers/garbage-collection.md | 21 +- .../ko/docs/concepts/workloads/pods/_index.md | 1 - .../workloads/pods/ephemeral-containers.md | 2 +- .../concepts/workloads/pods/pod-lifecycle.md | 2 +- .../pods/pod-topology-spread-constraints.md | 21 +- .../docs/concepts/workloads/pods/podpreset.md | 89 ------ .../service-accounts-admin.md | 14 + .../feature-gates.md | 138 ++++++--- .../ko/docs/reference/glossary/kube-proxy.md | 3 +- .../reference/glossary/persistent-volume.md | 21 ++ .../ko/docs/reference/kubectl/cheatsheet.md | 3 +- .../ko/docs/reference/kubectl/conventions.md | 4 +- content/ko/docs/reference/kubectl/kubectl.md | 12 +- .../container-runtimes.md | 10 +- .../windows/intro-windows-in-kubernetes.md | 95 ++---- .../windows/user-guide-windows-containers.md | 2 +- .../highly-available-master.md | 35 ++- .../kubeadm/adding-windows-nodes.md | 77 ++++- .../kubeadm/kubeadm-certs.md | 16 +- .../kubeadm/kubeadm-upgrade.md | 288 +++++------------- .../docs/tasks/network/validate-dual-stack.md | 117 +++++-- .../horizontal-pod-autoscale.md | 69 +++++ .../create-cluster/cluster-intro.html | 45 +-- .../ko/examples/application/job/cronjob.yaml | 1 + .../application/mysql/mysql-configmap.yaml | 8 +- .../application/mysql/mysql-services.yaml | 6 +- .../application/mysql/mysql-statefulset.yaml | 36 +-- .../networking/dual-stack-default-svc.yaml | 3 +- .../dual-stack-ipfamilies-ipv6.yaml | 12 + ...aml => dual-stack-prefer-ipv6-lb-svc.yaml} | 0 .../dual-stack-preferred-ipfamilies-svc.yaml | 16 + .../networking/dual-stack-preferred-svc.yaml | 13 + 60 files changed, 1290 insertions(+), 731 deletions(-) create mode 100644 content/ko/blog/_index.md create mode 100644 content/ko/blog/_posts/2020-12-02-dont-panic-kubernetes-and-docker.md delete mode 100644 content/ko/docs/concepts/workloads/pods/podpreset.md create mode 100644 content/ko/docs/reference/glossary/persistent-volume.md create mode 100644 content/ko/examples/service/networking/dual-stack-ipfamilies-ipv6.yaml rename content/ko/examples/service/networking/{dual-stack-ipv6-lb-svc.yaml => dual-stack-prefer-ipv6-lb-svc.yaml} (100%) create mode 100644 content/ko/examples/service/networking/dual-stack-preferred-ipfamilies-svc.yaml create mode 100644 content/ko/examples/service/networking/dual-stack-preferred-svc.yaml diff --git a/content/ko/blog/_index.md b/content/ko/blog/_index.md new file mode 100644 index 0000000000..2b5dd379da --- /dev/null +++ b/content/ko/blog/_index.md @@ -0,0 +1,16 @@ +--- +title: 쿠버네티스 블로그 +linkTitle: 블로그 +menu: + main: + title: "블로그" + weight: 40 + post: > +

쿠버네티스와 컨테이너 전반적 영역에 대한 최신 뉴스도 읽고, 방금 나온 따끈따끈한 기술적 노하우도 알아보세요.

+--- +{{< comment >}} + +블로그에 기여하는 방법에 대한 자세한 내용은 +https://kubernetes.io/docs/contribute/new-content/blogs-case-studies/#write-a-blog-post 를 참고하세요. + +{{< /comment >}} diff --git a/content/ko/blog/_posts/2020-12-02-dont-panic-kubernetes-and-docker.md b/content/ko/blog/_posts/2020-12-02-dont-panic-kubernetes-and-docker.md new file mode 100644 index 0000000000..de7d44ecad --- /dev/null +++ b/content/ko/blog/_posts/2020-12-02-dont-panic-kubernetes-and-docker.md @@ -0,0 +1,104 @@ +--- +layout: blog +title: "당황하지 마세요. 쿠버네티스와 도커" +date: 2020-12-02 +slug: dont-panic-kubernetes-and-docker +--- + +**작성자:** Jorge Castro, Duffie Cooley, Kat Cosgrove, Justin Garrison, Noah Kantrowitz, Bob Killen, Rey Lejano, Dan “POP” Papandrea, Jeffrey Sica, Davanum “Dims” Srinivas + +쿠버네티스는 v1.20 이후 컨테이너 런타임으로서 +[도커를 +사용 중단(deprecating)](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.20.md#deprecation)합니다. + +**당황할 필요는 없습니다. 말처럼 극적이진 않습니다.** + +요약하자면, 기본(underlying) 런타임 중 하나인 도커는 쿠버네티스의 [컨테이너 런타임 인터페이스(CRI)](https://kubernetes.io/blog/2016/12/container-runtime-interface-cri-in-kubernetes/)를 +사용하는 런타임으로써는 더 이상 사용되지 않습니다(deprecated). +도커가 생성한 이미지는 늘 그래왔듯이 모든 런타임을 통해 클러스터에서 +계속 작동될 것입니다. + +쿠버네티스의 엔드유저에게는 많은 변화가 없을 것입니다. +이 내용은 도커의 끝을 의미하지 않으며, 도커를 더 이상 개발 도구로 사용할 수 없다거나, +사용하면 안 된다는 의미도 아닙니다. 도커는 여전히 컨테이너를 +빌드하는 데 유용한 도구이며, `docker +build` 실행 결과로 만들어진 이미지도 여전히 쿠버네티스 클러스터에서 동작합니다. + +GKE, EKS 또는 AKS([containerd가 기본](https://github.com/Azure/AKS/releases/tag/2020-11-16)인)와 같은 관리형 쿠버네티스 서비스를 +사용하는 경우 쿠버네티스의 향후 버전에서 도커에 대한 지원이 +없어지기 전에, 워커 노드가 지원되는 컨테이너 런타임을 사용하고 있는지 확인해야 합니다. 노드에 +사용자 정의가 적용된 경우 사용자 환경 및 런타임 요구 사항에 따라 업데이트가 필요할 수도 +있습니다. 서비스 공급자와 협업하여 적절한 업그레이드 +테스트 및 계획을 확인하세요. + +자체 클러스터를 운영하는 경우에도, 클러스터의 고장을 피하기 위해서 +변경을 수행해야 합니다. v1.20에서는 도커에 대한 지원 중단 경고(deprecation warning)가 표시됩니다. +도커 런타임 지원이 쿠버네티스의 향후 릴리스(현재는 2021년 하반기의 +1.22 릴리스로 계획됨)에서 제거되면 더 이상 지원되지 +않으며, containerd 또는 CRI-O와 같은 다른 호환 컨테이너 런타임 중 +하나로 전환해야 합니다. 선택한 런타임이 현재 사용 중인 +도커 데몬 구성(예: 로깅)을 지원하는지 확인하세요. + +## 많은 사람들이 걱정하는 이유는 무엇이며, 왜 이런 혼란이 야기되었나요? + +우리는 여기서 두 가지 다른 환경에 대해 이야기하고 있는데, 이것이 혼란을 야기하고 +있습니다. 쿠버네티스 클러스터 내부에는 컨테이너 이미지를 가져오고 +실행하는 역할을 하는 컨테이너 런타임이라는 것이 있습니다. 도커를 +컨테이너 런타임(다른 일반적인 옵션에는 containerd 및 CRI-O가 있음)으로 많이 +선택하지만, 도커는 쿠버네티스 내부에 포함(embedded)되도록 설계되지 않았기에 문제를 +유발합니다. + +우리가 "도커"라고 부르는 것은 실제로는 하나가 아닙니다. 도커는 +전체 기술 스택이고, 그 중 한 부분은 그 자체로서 고수준(high-level)의 +컨테이너 런타임인 "containerd" 입니다. 도커는 개발을 하는 동안 +사람이 정말 쉽게 상호 작용할 수 있도록 많은 UX 개선을 포함하므로 +도커는 멋지고 유용합니다. 하지만, 쿠버네티스는 사람이 아니기 때문에 +이런 UX 개선 사항들이 필요하지 않습니다. + +이 인간 친화적인 추상화 계층의 결과로, 쿠버네티스 클러스터는 +containerd가 정말 필요로 하는 것들을 확보하기 위해서 도커심(Dockershim)이라는 +다른 도구를 사용해야 합니다. 이것은 좋지 않습니다. 왜냐하면, 이는 추가적인 유지 관리를 +필요로 하고 오류의 가능성도 높이기 때문입니다. 여기서 실제로 일어나는 일은 +도커심이 빠르면 v1.23 릴리스에 Kubelet에서 제거되어, 결과적으로 +도커에 대한 컨테이너 런타임으로서의 지원이 제거된다는 것입니다. 여러분 +스스로도 생각할 수 있을 것입니다. containerd가 도커 스택에 포함되어 있는 것이라면, 도커심이 +쿠버네티스에 왜 필요할까요? + +도커는 [컨테이너 런타임 인터페이스](https://kubernetes.io/blog/2016/12/container-runtime-interface-cri-in-kubernetes/)인 CRI를 준수하지 않습니다. +만약 이를 준수했다면, 심(shim)이 필요하지 않았을 것입니다. 그러나 +이건 세상의 종말이 아니며, 당황할 필요도 없습니다. 여러분은 단지 +컨테이너 런타임을 도커에서 지원되는 다른 컨테이너 런타임으로 변경하기만 하면 됩니다. + +참고할 사항 한 가지: 현재 클러스터 내 워크플로의 일부가 기본 도커 소켓 +(/var/run/docker.sock)에 의존하고 있는 경우, 다른 +런타임으로 전환하는 것은 해당 워크플로의 사용에 문제를 일으킵니다. 이 패턴은 종종 +도커 내의 도커라고 합니다. 이런 특정 유스케이스에 대해서 +[kaniko](https://github.com/GoogleContainerTools/kaniko), +[img](https://github.com/genuinetools/img)와 +[buildah](https://github.com/containers/buildah) +같은 것들을 포함해 많은 옵션들이 있습니다. + +## 그렇지만, 이 변경이 개발자에게는 어떤 의미인가요? 여전히 Dockerfile을 작성나요? 여전히 도커로 빌드하나요? + +이 변경 사항은 사람들(folks)이 보통 도커와 상호 작용하는 데 사용하는 것과는 다른 환경을 +제시합니다. 개발에 사용하는 도커의 설치는 쿠버네티스 클러스터 내의 +도커 런타임과 관련이 없습니다. 혼란스럽죠, 우리도 알고 있습니다. 개발자에게 +도커는 이 변경 사항이 발표되기 전과 마찬가지로 여전히 +유용합니다. 도커가 생성하는 이미지는 실제로는 +도커에만 특정된 이미지가 아니라 OCI([Open Container Initiative](https://opencontainers.org/)) 이미지입니다. +모든 OCI 호환 이미지는 해당 이미지를 빌드하는 데 사용하는 도구에 관계없이 +쿠버네티스에서 동일하게 보입니다. [containerd](https://containerd.io/)와 +[CRI-O](https://cri-o.io/)는 모두 해당 이미지를 가져와 실행하는 방법을 알고 있습니다. 이것이 +컨테이너가 어떤 모습이어야 하는지에 대한 표준이 있는 이유입니다. + +변경은 다가오고 있습니다. 이 변경이 일부 문제를 일으킬 수도 있지만, 치명적이지는 +않으며, 일반적으로는 괜찮은 일입니다. 사용자가 쿠버네티스와 상호 작용하는 +방식에 따라 이 변경은 아무런 의미가 없거나 약간의 작업만을 의미할 수 있습니다. +장기적으로는 일이 더 쉬워질 것입니다. 이것이 여전히 +혼란스럽더라도 괜찮습니다. 이에 대해서 많은 일이 진행되고 있습니다. 쿠버네티스에는 변화되는 +부분이 많이 있고, 이에 대해 100% 전문가는 없습니다. 경험 수준이나 +복잡성에 관계없이 어떤 질문이든 하시기 바랍니다! 우리의 목표는 +모든 사람이 다가오는 변경 사항에 대해 최대한 많은 교육을 받을 수 있도록 하는 것입니다. `<3` 이 글이 +여러분이 가지는 대부분의 질문에 대한 답이 되었고, 불안을 약간은 진정시켰기를 바랍니다! + +더 많은 답변을 찾고 계신가요? 함께 제공되는 [도커심 사용 중단 FAQ](/blog/2020/12/02/dockershim-faq/)를 확인하세요. diff --git a/content/ko/docs/concepts/architecture/nodes.md b/content/ko/docs/concepts/architecture/nodes.md index b9e6b92435..18133b6577 100644 --- a/content/ko/docs/concepts/architecture/nodes.md +++ b/content/ko/docs/concepts/architecture/nodes.md @@ -327,6 +327,26 @@ kubelet은 `NodeStatus` 와 리스 오브젝트를 생성하고 업데이트 할 자세한 내용은 [노드의 컨트롤 토폴로지 관리 정책](/docs/tasks/administer-cluster/topology-manager/)을 본다. +## 그레이스풀(Graceful) 노드 셧다운 + +{{< feature-state state="alpha" for_k8s_version="v1.20" >}} + +`GracefulNodeShutdown` [기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/)를 활성화한 경우 kubelet은 노드 시스템 종료를 감지하고 노드에서 실행 중인 파드를 종료한다. +Kubelet은 노드가 종료되는 동안 파드가 일반 [파드 종료 프로세스](/ko/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination)를 따르도록 한다. + +`GracefulNodeShutdown` 기능 게이트가 활성화되면 kubelet은 [systemd inhibitor locks](https://www.freedesktop.org/wiki/Software/systemd/inhibit/)를 사용하여 주어진 기간 동안 노드 종료를 지연시킨다. 종료 중에 kubelet은 두 단계로 파드를 종료시킨다. + +1. 노드에서 실행 중인 일반 파드를 종료시킨다. +2. 노드에서 실행 중인 [중요(critical) 파드](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical)를 종료시킨다. + +그레이스풀 노드 셧다운 기능은 두 개의 [`KubeletConfiguration`](/docs/tasks/administer-cluster/kubelet-config-file/) 옵션으로 구성된다. +* `ShutdownGracePeriod`: + * 노드가 종료를 지연해야 하는 총 기간을 지정한다. 이것은 모든 일반 및 [중요 파드](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical)의 파드 종료에 필요한 총 유예 기간에 해당한다. +* `ShutdownGracePeriodCriticalPods`: + * 노드 종료 중에 [중요 파드](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical)를 종료하는 데 사용되는 기간을 지정한다. 이는 `ShutdownGracePeriod`보다 작아야 한다. + +예를 들어 `ShutdownGracePeriod=30s`, `ShutdownGracePeriodCriticalPods=10s` 인 경우 kubelet은 노드 종료를 30 초까지 지연시킨다. 종료하는 동안 처음 20(30-10) 초는 일반 파드의 유예 종료에 할당되고, 마지막 10 초는 [중요 파드](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/#marking-pod-as-critical)의 종료에 할당된다. + ## {{% heading "whatsnext" %}} @@ -335,3 +355,4 @@ kubelet은 `NodeStatus` 와 리스 오브젝트를 생성하고 업데이트 할 * 아키텍처 디자인 문서의 [노드](https://git.k8s.io/community/contributors/design-proposals/architecture/architecture.md#the-kubernetes-node) 섹션을 읽어본다. * [테인트와 톨러레이션](/ko/docs/concepts/scheduling-eviction/taint-and-toleration/)을 읽어본다. + diff --git a/content/ko/docs/concepts/cluster-administration/kubelet-garbage-collection.md b/content/ko/docs/concepts/cluster-administration/kubelet-garbage-collection.md index d749710484..228e0af585 100644 --- a/content/ko/docs/concepts/cluster-administration/kubelet-garbage-collection.md +++ b/content/ko/docs/concepts/cluster-administration/kubelet-garbage-collection.md @@ -17,7 +17,7 @@ weight: 70 ## 이미지 수집 -쿠버네티스는 cadvisor와 imageManager를 통하여 모든 이미지들의 +쿠버네티스는 cadvisor와 imageManager를 통하여 모든 이미지들의 라이프사이클을 관리한다. 이미지들에 대한 가비지 수집 정책에는 다음 2가지 요소가 고려된다: @@ -36,26 +36,26 @@ kubelet이 관리하지 않는 컨테이너는 컨테이너 가비지 수집 대 ## 사용자 설정 -사용자는 후술될 kubelet 플래그들을 통하여 이미지 가비지 수집을 조정하기 위하여 다음의 임계값을 조정할 수 있다. +여러분은 후술될 kubelet 플래그들을 통하여 이미지 가비지 수집을 조정하기 위하여 다음의 임계값을 조정할 수 있다. 1. `image-gc-high-threshold`, 이미지 가비지 수집을 발생시키는 디스크 사용량의 비율로 기본값은 85% 이다. 2. `image-gc-low-threshold`, 이미지 가비지 수집을 더 이상 시도하지 않는 디스크 사용량의 비율로 기본값은 80% 이다. -또한 사용자는 다음의 kubelet 플래그를 통해 가비지 수집 정책을 사용자 정의 할 수 있다. +다음의 kubelet 플래그를 통해 가비지 수집 정책을 사용자 정의할 수 있다. -1. `minimum-container-ttl-duration`, 종료된 컨테이너가 가비지 수집 -되기 전의 최소 시간. 기본 값은 0 분이며, 이 경우 모든 종료된 컨테이너는 바로 가비지 수집의 대상이 된다. +1. `minimum-container-ttl-duration`, 종료된 컨테이너가 가비지 수집 +되기 전의 최소 시간. 기본 값은 0 분이며, 이 경우 모든 종료된 컨테이너는 바로 가비지 수집의 대상이 된다. 2. `maximum-dead-containers-per-container`, 컨테이너가 보유할 수 있는 오래된 인스턴스의 최대 수. 기본 값은 1 이다. 3. `maximum-dead-containers`, 글로벌하게 보유 할 컨테이너의 최대 오래된 인스턴스의 최대 수. 기본 값은 -1이며, 이 경우 인스턴스 수의 제한은 없다. 컨테이너들은 유용성이 만료되기 이전에도 가비지 수집이 될 수 있다. 이러한 컨테이너들은 -문제 해결에 도움이 될 수 있는 로그나 다른 데이터를 포함하고 있을 수 있다. 컨테이너 당 적어도 -1개의 죽은 컨테이너가 허용될 수 있도록 `maximum-dead-containers-per-container` -값을 충분히 큰 값으로 지정하는 것을 권장한다. 동일한 이유로 `maximum-dead-containers` +문제 해결에 도움이 될 수 있는 로그나 다른 데이터를 포함하고 있을 수 있다. 컨테이너 당 적어도 +1개의 죽은 컨테이너가 허용될 수 있도록 `maximum-dead-containers-per-container` +값을 충분히 큰 값으로 지정하는 것을 권장한다. 동일한 이유로 `maximum-dead-containers` 의 값도 상대적으로 더 큰 값을 권장한다. 자세한 내용은 [해당 이슈](https://github.com/kubernetes/kubernetes/issues/13287)를 참고한다. @@ -82,5 +82,3 @@ kubelet이 관리하지 않는 컨테이너는 컨테이너 가비지 수집 대 자세한 내용은 [리소스 부족 처리 구성](/docs/tasks/administer-cluster/out-of-resource/)를 본다. - - diff --git a/content/ko/docs/concepts/cluster-administration/networking.md b/content/ko/docs/concepts/cluster-administration/networking.md index a24b3bb93f..b72d38a360 100644 --- a/content/ko/docs/concepts/cluster-administration/networking.md +++ b/content/ko/docs/concepts/cluster-administration/networking.md @@ -55,11 +55,12 @@ weight: 50 주로 호환된다. 잡이 이전에 VM에서 실행된 경우, VM에 IP가 있고 프로젝트의 다른 VM과 통신할 수 있다. 이것은 동일한 기본 모델이다. -쿠버네티스의 IP 주소는 그것의 IP 주소를 포함하여 `Pod` 범위에 존재한다(`Pod` 내 +쿠버네티스의 IP 주소는 그것의 IP 주소와 MAC 주소를 포함하여 `Pod` 범위에 존재한다(`Pod` 내 컨테이너는 네트워크 네임스페이스를 공유함). 이것은 `Pod` 내 컨테이너가 모두 `localhost` 에서 서로의 포트에 도달할 수 있다는 것을 의미한다. 또한 `Pod` 내부의 컨테이너 포트의 사용을 조정해야하는 것을 의미하지만, 이것도 -VM 내의 프로세스와 동일하다. 이것을 "IP-per-pod(파드별 IP)" 모델이라고 한다. +VM 내의 프로세스와 동일하다. 이것을 "IP-per-pod(파드별 IP)" 모델이라고 +한다. 이것이 어떻게 구현되는 지는 사용 중인 특정 컨테이너 런타임의 세부 사항이다. diff --git a/content/ko/docs/concepts/cluster-administration/system-metrics.md b/content/ko/docs/concepts/cluster-administration/system-metrics.md index e4dedb068a..b897a0e79a 100644 --- a/content/ko/docs/concepts/cluster-administration/system-metrics.md +++ b/content/ko/docs/concepts/cluster-administration/system-metrics.md @@ -128,6 +128,25 @@ cloudprovider_gce_api_request_duration_seconds { request = "detach_disk"} cloudprovider_gce_api_request_duration_seconds { request = "list_disk"} ``` +### kube-scheduler 메트릭 + +{{< feature-state for_k8s_version="v1.20" state="alpha" >}} + +스케줄러는 실행 중인 모든 파드의 요청(request)된 리소스와 요구되는 제한(limit)을 보고하는 선택적 메트릭을 노출한다. 이러한 메트릭은 용량 계획(capacity planning) 대시보드를 구축하고, 현재 또는 과거 스케줄링 제한을 평가하고, 리소스 부족으로 스케줄할 수 없는 워크로드를 빠르게 식별하고, 실제 사용량을 파드의 요청과 비교하는 데 사용할 수 있다. + +kube-scheduler는 각 파드에 대해 구성된 리소스 [요청과 제한](/ko/docs/concepts/configuration/manage-resources-containers/)을 식별한다. 요청 또는 제한이 0이 아닌 경우 kube-scheduler는 메트릭 시계열을 보고한다. 시계열에는 다음과 같은 레이블이 지정된다. +- 네임스페이스 +- 파드 이름 +- 파드가 스케줄된 노드 또는 아직 스케줄되지 않은 경우 빈 문자열 +- 우선순위 +- 해당 파드에 할당된 스케줄러 +- 리소스 이름 (예: `cpu`) +- 알려진 경우 리소스 단위 (예: `cores`) + +파드가 완료되면 (`Never` 또는 `OnFailure`의 `restartPolicy`가 있고 `Succeeded` 또는 `Failed` 파드 단계에 있거나, 삭제되고 모든 컨테이너가 종료된 상태에 있음) 스케줄러가 이제 다른 파드를 실행하도록 스케줄할 수 있으므로 시리즈가 더 이상 보고되지 않는다. 두 메트릭을 `kube_pod_resource_request` 및 `kube_pod_resource_limit` 라고 한다. + +메트릭은 HTTP 엔드포인트 `/metrics/resources`에 노출되며 스케줄러의 `/metrics` 엔드포인트 +와 동일한 인증이 필요하다. 이러한 알파 수준의 메트릭을 노출시키려면 `--show-hidden-metrics-for-version=1.20` 플래그를 사용해야 한다. ## {{% heading "whatsnext" %}} diff --git a/content/ko/docs/concepts/configuration/manage-resources-containers.md b/content/ko/docs/concepts/configuration/manage-resources-containers.md index 1f01481270..8f499fbc6a 100644 --- a/content/ko/docs/concepts/configuration/manage-resources-containers.md +++ b/content/ko/docs/concepts/configuration/manage-resources-containers.md @@ -600,6 +600,10 @@ spec: example.com/foo: 1 ``` +## PID 제한 + +프로세스 ID(PID) 제한은 kubelet의 구성에 대해 주어진 파드가 사용할 수 있는 PID 수를 제한할 수 있도록 허용한다. 자세한 내용은 [Pid 제한](/docs/concepts/policy/pid-limiting/)을 참고한다. + ## 문제 해결 ### 내 파드가 failedScheduling 이벤트 메시지로 보류 중이다 diff --git a/content/ko/docs/concepts/configuration/secret.md b/content/ko/docs/concepts/configuration/secret.md index e75beb8666..557fb50397 100644 --- a/content/ko/docs/concepts/configuration/secret.md +++ b/content/ko/docs/concepts/configuration/secret.md @@ -134,7 +134,7 @@ data: [서비스 어카운트](/docs/tasks/configure-pod-container/configure-service-account/) 문서를 보면 서비스 어카운트가 동작하는 방법에 대한 더 자세한 정보를 얻을 수 있다. 또한 파드에서 서비스 어카운트를 참조하는 방법을 -[`Pod`](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#secret-v1-core)의 +[`Pod`](/docs/reference/generated/kubernetes-api/{{< param "version" >}}/#pod-v1-core)의 `automountServiceAccountToken` 필드와 `serviceAccountName` 필드를 통해 확인할 수 있다. @@ -152,7 +152,7 @@ data: 인코딩된 `~/.dockercfg` 파일의 콘텐츠를 값으로 가지는 `.dockercfg` 키를 포함하고 있는지 확실히 확인해야 한다. -`kubernetes/dockerconfigjson` 타입은 `~/.dockercfg` 의 +`kubernetes.io/dockerconfigjson` 타입은 `~/.dockercfg` 의 새로운 포맷인 `~/.docker/config.json` 파일과 동일한 포맷 법칙을 따르는 직렬화 된 JSON의 저장을 위해 디자인되었다. 이 시크릿 타입을 사용할 때는, 시크릿 오브젝트의 `data` 필드가 `.dockerconfigjson` 키를 @@ -347,22 +347,21 @@ data: usage-bootstrap-signing: dHJ1ZQ== ``` -부트스트랩 타입은 `data` 아래 명시된 다음의 키들을 가진다. +부트스트랩 타입 시크릿은 `data` 아래 명시된 다음의 키들을 가진다. - `token_id`: 토큰 식별자로 임의의 6개 문자의 문자열. 필수 사항. - `token-secret`: 실제 토큰 시크릿으로 임의의 16개 문자의 문자열. 필수 사항. -- `description1`: 토큰의 사용처를 설명하는 사람이 읽을 수 있는 +- `description`: 토큰의 사용처를 설명하는 사람이 읽을 수 있는 문자열. 선택 사항. - `expiration`: 토큰이 만료되어야 하는 시기를 명시한 RFC3339를 사용하는 절대 UTC 시간. 선택 사항. - `usage-bootstrap-`: 부트스트랩 토큰의 추가적인 사용처를 나타내는 불리언(boolean) 플래그. -- `auth-extra-groups`: system:bootstrappers 그룹에 추가로 인증될 +- `auth-extra-groups`: `system:bootstrappers` 그룹에 추가로 인증될 쉼표로 구분된 그룹 이름 목록. 위의 YAML은 모두 base64로 인코딩된 문자열 값이므로 혼란스러워 보일 -수 있다. 사실은 다음 YAML을 사용하여 동일한 시크릿 오브젝트 결과를 만드는 -동일한 시크릿을 생성할 수 있다. +수 있다. 사실은 다음 YAML을 사용하여 동일한 시크릿을 생성할 수 있다. ```yaml apiVersion: v1 @@ -724,6 +723,11 @@ echo $SECRET_PASSWORD 1f2d1e2e67df ``` +#### 시크릿 업데이트 후 환경 변수가 업데이트되지 않음 + +컨테이너가 환경 변수에서 이미 시크릿을 사용하는 경우, 다시 시작하지 않는 한 컨테이너에서 시크릿 업데이트를 볼 수 없다. +시크릿이 변경될 때 재시작을 트리거하는 써드파티 솔루션이 있다. + ## 변경할 수 없는(immutable) 시크릿 {#secret-immutable} {{< feature-state for_k8s_version="v1.19" state="beta" >}} diff --git a/content/ko/docs/concepts/containers/runtime-class.md b/content/ko/docs/concepts/containers/runtime-class.md index 315b83ce99..674f47b32a 100644 --- a/content/ko/docs/concepts/containers/runtime-class.md +++ b/content/ko/docs/concepts/containers/runtime-class.md @@ -6,7 +6,7 @@ weight: 20 -{{< feature-state for_k8s_version="v1.12" state="alpha" >}} +{{< feature-state for_k8s_version="v1.20" state="stable" >}} 이 페이지는 런타임클래스 리소스와 런타임 선택 메커니즘에 대해서 설명한다. @@ -63,7 +63,7 @@ weight: 20 (`handler`)로 단 2개의 중요 필드만 가지고 있다. 오브젝트 정의는 다음과 같은 형태이다. ```yaml -apiVersion: node.k8s.io/v1beta1 # 런타임클래스는 node.k8s.io API 그룹에 정의되어 있음 +apiVersion: node.k8s.io/v1 # 런타임클래스는 node.k8s.io API 그룹에 정의되어 있음 kind: RuntimeClass metadata: name: myclass # 런타임클래스는 해당 이름을 통해서 참조됨 diff --git a/content/ko/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md b/content/ko/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md index 70a7d1ea27..56230e5911 100644 --- a/content/ko/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md +++ b/content/ko/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins.md @@ -203,7 +203,7 @@ gRPC 서비스는 `/var/lib/kubelet/pod-resources/kubelet.sock` 의 유닉스 `/var/lib/kubelet/pod-resources` 를 {{< glossary_tooltip text="볼륨" term_id="volume" >}}으로 마운트해야 한다. -"PodResources 서비스"를 지원하려면 `KubeletPodResources` [기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/)를 활성화해야 한다. 쿠버네티스 1.15부터 기본적으로 활성화되어 있다. +"PodResources 서비스"를 지원하려면 `KubeletPodResources` [기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/)를 활성화해야 한다. ## 토폴로지 관리자와 장치 플러그인 통합 @@ -254,5 +254,3 @@ pluginapi.Device{ID: "25102017", Health: pluginapi.Healthy, Topology:&pluginapi. * 노드에서의 [확장 리소스 알리기](/ko/docs/tasks/administer-cluster/extended-resource-node/)에 대해 배우기 * 쿠버네티스에서 [TLS 수신에 하드웨어 가속](https://kubernetes.io/blog/2019/04/24/hardware-accelerated-ssl/tls-termination-in-ingress-controllers-using-kubernetes-device-plugins-and-runtimeclass/) 사용에 대해 읽기 * [토폴로지 관리자](/docs/tasks/administer-cluster/topology-manager/)에 대해 알아보기 - - diff --git a/content/ko/docs/concepts/overview/kubernetes-api.md b/content/ko/docs/concepts/overview/kubernetes-api.md index 89871bd83a..854147597b 100644 --- a/content/ko/docs/concepts/overview/kubernetes-api.md +++ b/content/ko/docs/concepts/overview/kubernetes-api.md @@ -75,19 +75,10 @@ Protobuf에 기반한 직렬화 형식을 구현한다. 이 형식에 대한 API 오브젝트를 정의하는 Go 패키지에 들어있는 각각의 스키마에 대한 IDL(인터페이스 정의 언어) 파일을 참고한다. -## API 변경 사항 +## 지속성 -성공적인 시스템은 새로운 유스케이스가 등장하거나 기존 사례가 변경됨에 따라 성장하고 변화해야 한다. -따라서, 쿠버네티스는 쿠버네티스 API가 지속적으로 변경되고 성장할 수 있도록 기능을 설계했다. -쿠버네티스 프로젝트는 기존 클라이언트와의 호환성을 깨지 _않고_ 다른 프로젝트가 -적응할 기회를 가질 수 있도록 장기간 해당 호환성을 유지하는 것을 목표로 한다. - -일반적으로, 새 API 리소스와 새 리소스 필드는 자주 추가될 수 있다. -리소스 또는 필드를 제거하려면 -[API 지원 중단 정책](/docs/reference/using-api/deprecation-policy/)을 따라야 한다. - -호환 가능한 변경 사항과 API 변경 방법은 -[API 변경 사항](https://git.k8s.io/community/contributors/devel/sig-architecture/api_changes.md#readme)에 자세히 설명되어 있다. +쿠버네티스는 오브젝트의 직렬화된 상태를 +{{< glossary_tooltip term_id="etcd" >}}에 기록하여 저장한다. ## API 그룹과 버전 규칙 @@ -105,29 +96,44 @@ API가 시스템 리소스 및 동작에 대한 명확하고 일관된 보기를 가능한 [API 그룹](/ko/docs/reference/using-api/#api-그룹)을 구현한다. API 리소스는 API 그룹, 리소스 유형, 네임스페이스 -(네임스페이스 리소스용) 및 이름으로 구분된다. API 서버는 -여러 API 버전을 통해 동일한 기본 데이터를 제공하고 API 버전 간의 -변환을 투명하게 처리할 수 있다. 이 모든 다른 버전은 실제로 -같은 리소스의 표현이다. 예를 들어 동일한 리소스에 대해 -두 가지 버전 `v1`과 `v1beta1`이 있다고 가정해 보자. -`v1beta1` 버전에서 생성된 오브젝트를 `v1beta1` 또는 `v1` 버전에서 -읽기, 업데이트 및 삭제할 수 있다. +(네임스페이스 리소스용) 및 이름으로 구분된다. API 서버는 API 버전 간의 +변환을 투명하게 처리한다. 서로 다른 모든 버전은 실제로 +동일한 지속 데이터의 표현이다. API 서버는 여러 API 버전을 통해 +동일한 기본 데이터를 제공할 수 있다. -API 버전 수준 정의에 대한 자세한 내용은 -[API 버전 레퍼런스](/ko/docs/reference/using-api/#api-버전-규칙)를 참조한다. +예를 들어, 동일한 리소스에 대해 `v1` 과 `v1beta1` 이라는 두 가지 API 버전이 +있다고 가정한다. 원래 API의 `v1beta1` 버전을 사용하여 오브젝트를 +만든 경우, 나중에 `v1beta1` 또는 `v1` API 버전을 사용하여 해당 오브젝트를 +읽거나, 업데이트하거나, 삭제할 수 있다. -API 리소스는 해당 API 그룹, 리소스 유형, 네임스페이스 -(네임스페이스 리소스용) 및 이름으로 구분된다. API 서버는 여러 API 버전을 통해 동일한 -기본 데이터를 제공하고 API 버전 간의 변환을 투명하게 -처리할 수 있다. 이 모든 다른 버전은 실제로 -동일한 리소스의 표현이다. 예를 들어, 동일한 리소스에 대해 두 가지 -버전 `v1` 과 `v1beta1` 이 있다고 가정한다. 그런 다음 `v1beta1` 버전에서 -생성된 오브젝트를 `v1beta1` 또는 `v1` 버전에서 읽고 업데이트하고 -삭제할 수 있다. +## API 변경 사항 + +성공적인 시스템은 새로운 유스케이스가 등장하거나 기존 사례가 변경됨에 따라 성장하고 변화해야 한다. +따라서, 쿠버네티스는 쿠버네티스 API가 지속적으로 변경되고 성장할 수 있도록 설계했다. +쿠버네티스 프로젝트는 기존 클라이언트와의 호환성을 깨지 _않고_ 다른 프로젝트가 +적응할 기회를 가질 수 있도록 장기간 해당 호환성을 유지하는 것을 목표로 한다. + +일반적으로, 새 API 리소스와 새 리소스 필드는 자주 추가될 수 있다. +리소스 또는 필드를 제거하려면 +[API 지원 중단 정책](/docs/reference/using-api/deprecation-policy/)을 따라야 한다. + +쿠버네티스는 일반적으로 API 버전 `v1` 에서 안정 버전(GA)에 도달하면, 공식 쿠버네티스 API에 +대한 호환성 유지를 강력하게 이행한다. 또한, +쿠버네티스는 가능한 경우 _베타_ API 버전에서도 호환성을 유지한다. +베타 API를 채택하면 기능이 안정된 후에도 해당 API를 사용하여 클러스터와 +계속 상호 작용할 수 있다. + +{{< note >}} +쿠버네티스는 또한 _알파_ API 버전에 대한 호환성을 유지하는 것을 목표로 하지만, 일부 +상황에서는 호환성이 깨진다. 알파 API 버전을 사용하는 경우, API가 변경된 경우 클러스터를 +업그레이드할 때 쿠버네티스에 대한 릴리스 정보를 확인한다. +{{< /note >}} API 버전 수준 정의에 대한 자세한 내용은 [API 버전 레퍼런스](/ko/docs/reference/using-api/api-overview/#api-버전-규칙)를 참조한다. + + ## API 확장 쿠버네티스 API는 다음 두 가지 방법 중 하나로 확장할 수 있다. @@ -145,3 +151,5 @@ API 버전 수준 정의에 대한 자세한 내용은 클러스터가 API 접근을 위한 인증 및 권한을 관리하는 방법을 설명한다. - [API 레퍼런스](/docs/reference/kubernetes-api/)를 읽고 API 엔드포인트, 리소스 유형 및 샘플에 대해 배우기. +- [API 변경 사항](https://git.k8s.io/community/contributors/devel/sig-architecture/api_changes.md#readme)에서 + 호환 가능한 변경 사항을 구성하고, API를 변경하는 방법에 대해 알아본다. diff --git a/content/ko/docs/concepts/overview/working-with-objects/labels.md b/content/ko/docs/concepts/overview/working-with-objects/labels.md index 597bf0e48d..1e0d86a97b 100644 --- a/content/ko/docs/concepts/overview/working-with-objects/labels.md +++ b/content/ko/docs/concepts/overview/working-with-objects/labels.md @@ -138,10 +138,11 @@ partition !partition ``` -첫 번째 예시에서 키가 `environment`이고 값이 `production` 또는 `qa`인 모든 리소스를 선택한다. -두 번째 예시에서 키가 `tier`이고 값이 `frontend`와 `backend`를 가지는 리소스를 제외한 모든 리소스와 키로 `tier`를 가지고 값을 공백으로 가지는 모든 리소스를 선택한다. -세 번째 예시에서 레이블의 값에 상관없이 키가 `partition`을 포함하는 모든 리소스를 선택한다. -네 번째 예시에서 레이블의 값에 상관없이 키가 `partition`을 포함하지 않는 모든 리소스를 선택한다. +* 첫 번째 예시에서 키가 `environment`이고 값이 `production` 또는 `qa`인 모든 리소스를 선택한다. +* 두 번째 예시에서 키가 `tier`이고 값이 `frontend`와 `backend`를 가지는 리소스를 제외한 모든 리소스와 키로 `tier`를 가지고 값을 공백으로 가지는 모든 리소스를 선택한다. +* 세 번째 예시에서 레이블의 값에 상관없이 키가 `partition`을 포함하는 모든 리소스를 선택한다. +* 네 번째 예시에서 레이블의 값에 상관없이 키가 `partition`을 포함하지 않는 모든 리소스를 선택한다. + 마찬가지로 쉼표는 _AND_ 연산자로 작동한다. 따라서 `partition,environment notin (qa)`와 같이 사용하면 값과 상관없이 키가 `partition`인 것과 키가 `environment`이고 값이 `qa`와 다른 리소스를 필터링할 수 있다. _집합성 기준_ 레이블 셀렉터는 일반적으로 `environment=production`과 `environment in (production)`을 같은 것으로 본다. 유사하게는 `!=`과 `notin`을 같은 것으로 본다. diff --git a/content/ko/docs/concepts/policy/pod-security-policy.md b/content/ko/docs/concepts/policy/pod-security-policy.md index 93f2093952..0ea3f087e3 100644 --- a/content/ko/docs/concepts/policy/pod-security-policy.md +++ b/content/ko/docs/concepts/policy/pod-security-policy.md @@ -1,7 +1,7 @@ --- title: 파드 시큐리티 폴리시 content_type: concept -weight: 20 +weight: 30 --- diff --git a/content/ko/docs/concepts/policy/resource-quotas.md b/content/ko/docs/concepts/policy/resource-quotas.md index 2f351b2ba5..d659350eff 100644 --- a/content/ko/docs/concepts/policy/resource-quotas.md +++ b/content/ko/docs/concepts/policy/resource-quotas.md @@ -1,7 +1,7 @@ --- title: 리소스 쿼터 content_type: concept -weight: 10 +weight: 20 --- diff --git a/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md b/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md index caca717323..edbe7daf39 100644 --- a/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md +++ b/content/ko/docs/concepts/scheduling-eviction/assign-pod-node.md @@ -154,6 +154,49 @@ spec: `preferredDuringSchedulingIgnoredDuringExecution` 의 `weight` 필드의 범위는 1-100이다. 모든 스케줄링 요구 사항 (리소스 요청, RequiredDuringScheduling 어피니티 표현식 등)을 만족하는 각 노드들에 대해 스케줄러는 이 필드의 요소들을 반복해서 합계를 계산하고 노드가 MatchExpressions 에 일치하는 경우 합계에 "가중치(weight)"를 추가한다. 이후에 이 점수는 노드에 대한 다른 우선순위 함수의 점수와 합쳐진다. 전체 점수가 가장 높은 노드를 가장 선호한다. +#### 스케줄링 프로파일당 노드 어피니티 + +{{< feature-state for_k8s_version="v1.20" state="beta" >}} + +여러 [스케줄링 프로파일](/ko/docs/reference/scheduling/config/#여러-프로파일)을 구성할 때 +노드 어피니티가 있는 프로파일을 연결할 수 있는데, 이는 프로파일이 특정 노드 집합에만 적용되는 경우 유용하다. +이렇게 하려면 [스케줄러 구성](/ko/docs/reference/scheduling/config/)에 있는 +[`NodeAffinity` 플러그인](/ko/docs/reference/scheduling/config/#스케줄링-플러그인-1)의 인수에 `addedAffinity`를 추가한다. 예를 들면 + +```yaml +apiVersion: kubescheduler.config.k8s.io/v1beta1 +kind: KubeSchedulerConfiguration + +profiles: + - schedulerName: default-scheduler + - schedulerName: foo-scheduler + pluginConfig: + - name: NodeAffinity + args: + addedAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: scheduler-profile + operator: In + values: + - foo +``` + +`addedAffinity`는 `.spec.schedulerName`을 `foo-scheduler`로 설정하는 모든 파드에 적용되며 +PodSpec에 지정된 NodeAffinity도 적용된다. +즉, 파드를 매칭시키려면, 노드가 `addedAffinity`와 파드의 `.spec.NodeAffinity`를 충족해야 한다. + +`addedAffinity`는 엔드 유저에게 표시되지 않으므로, 예상치 못한 동작이 일어날 수 있다. 프로파일의 +스케줄러 이름과 명확한 상관 관계가 있는 노드 레이블을 사용하는 것이 좋다. + +{{< note >}} +[데몬셋용 파드를 생성](/ko/docs/concepts/workloads/controllers/daemonset/#기본-스케줄러로-스케줄)하는 데몬셋 컨트롤러는 +스케줄링 프로파일을 인식하지 못한다. +따라서 `addedAffinity`없이 `default-scheduler`와 같은 스케줄러 프로파일을 유지하는 것이 좋다. 그런 다음 데몬셋의 파드 템플릿이 스케줄러 이름을 사용해야 한다. +그렇지 않으면, 데몬셋 컨트롤러에 의해 생성된 일부 파드가 스케줄되지 않은 상태로 유지될 수 있다. +{{< /note >}} + ### 파드간 어피니티와 안티-어피니티 파드간 어피니티와 안티-어피니티를 사용하면 노드의 레이블을 기반으로 하지 않고, *노드에서 이미 실행 중인 파드 레이블을 기반으로* @@ -386,3 +429,5 @@ spec: 파드가 노드에 할당되면 kubelet은 파드를 실행하고 노드의 로컬 리소스를 할당한다. [토폴로지 매니저](/docs/tasks/administer-cluster/topology-manager/)는 노드 수준의 리소스 할당 결정에 참여할 수 있다. + + diff --git a/content/ko/docs/concepts/scheduling-eviction/pod-overhead.md b/content/ko/docs/concepts/scheduling-eviction/pod-overhead.md index 2a08de53fb..29ab845af2 100644 --- a/content/ko/docs/concepts/scheduling-eviction/pod-overhead.md +++ b/content/ko/docs/concepts/scheduling-eviction/pod-overhead.md @@ -44,7 +44,7 @@ _파드 오버헤드_ 는 컨테이너 리소스 요청과 상한 위에서 파 ```yaml --- kind: RuntimeClass -apiVersion: node.k8s.io/v1beta1 +apiVersion: node.k8s.io/v1 metadata: name: kata-fc handler: kata-fc diff --git a/content/ko/docs/concepts/services-networking/dns-pod-service.md b/content/ko/docs/concepts/services-networking/dns-pod-service.md index 6546aa9735..fc1074a86c 100644 --- a/content/ko/docs/concepts/services-networking/dns-pod-service.md +++ b/content/ko/docs/concepts/services-networking/dns-pod-service.md @@ -165,11 +165,7 @@ A 또는 AAAA 레코드만 생성할 수 있다. (`default-subdomain.my-namespac ### 파드의 setHostnameAsFQDN 필드 {# pod-sethostnameasfqdn-field} -{{< feature-state for_k8s_version="v1.19" state="alpha" >}} - -**전제 조건**: `SetHostnameAsFQDN` [기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/)를 -{{< glossary_tooltip text="API 서버" term_id="kube-apiserver" >}}에 -대해 활성화해야 한다. +{{< feature-state for_k8s_version="v1.20" state="beta" >}} 파드가 전체 주소 도메인 이름(FQDN)을 갖도록 구성된 경우, 해당 호스트네임은 짧은 호스트네임이다. 예를 들어, 전체 주소 도메인 이름이 `busybox-1.default-subdomain.my-namespace.svc.cluster-domain.example` 인 파드가 있는 경우, 기본적으로 해당 파드 내부의 `hostname` 명령어는 `busybox-1` 을 반환하고 `hostname --fqdn` 명령은 FQDN을 반환한다. diff --git a/content/ko/docs/concepts/services-networking/dual-stack.md b/content/ko/docs/concepts/services-networking/dual-stack.md index 4206a2d9d4..cae986bb5d 100644 --- a/content/ko/docs/concepts/services-networking/dual-stack.md +++ b/content/ko/docs/concepts/services-networking/dual-stack.md @@ -26,14 +26,17 @@ weight: 70 쿠버네티스 클러스터에서 IPv4/IPv6 이중 스택을 활성화하면 다음의 기능을 제공한다. * 이중 스택 파드 네트워킹(파드 당 단일 IPv4와 IPv6 주소 할당) - * IPv4와 IPv6 지원 서비스(각 서비스는 단일 주소 패밀리이어야 한다.) + * IPv4와 IPv6 지원 서비스 * IPv4와 IPv6 인터페이스를 통한 파드 오프(off) 클러스터 이그레스 라우팅(예: 인터넷) ## 필수 구성 요소 IPv4/IPv6 이중 스택 쿠버네티스 클러스터를 활용하려면 다음의 필수 구성 요소가 필요하다. - * 쿠버네티스 1.16 또는 이후 버전 + * 쿠버네티스 1.20 이상 + 이전 버전과 함께 이중 스택 서비스를 사용하는 방법에 대한 정보 + 쿠버네티스 버전, 쿠버네티스 해당 버전에 대한 + 문서 참조 * 이중 스택 네트워킹을 위한 공급자의 지원(클라우드 공급자 또는 다른 방식으로 쿠버네티스 노드에 라우팅 가능한 IPv4/IPv6 네트워크 인터페이스를 제공할 수 있어야 한다.) * 이중 스택(예: Kubenet 또는 Calico)을 지원하는 네트워크 플러그인 @@ -64,45 +67,173 @@ IPv6 CIDR의 예: `fdXY:IJKL:MNOP:15::/64` (이 형식으로 표시되지만, ## 서비스 -만약 클러스터 IPv4/IPv6 이중 스택 네트워킹을 활성화한 경우, IPv4 또는 IPv6 주소로 {{< glossary_tooltip text="서비스" term_id="service" >}} 를 만들 수 있다. 해당 서비스에서 `.spec.ipFamily` 필드를 설정하면, 서비스 클러스터 IP의 주소 패밀리를 선택할 수 있다. -새 서비스를 생성할 때만 이 필드를 설정할 수 있다. `.spec.ipFamily` 필드는 선택 사항이며 클러스터에서 {{< glossary_tooltip text="서비스" term_id="service" >}} 와 {{< glossary_tooltip text="인그레스" term_id="ingress" >}} 를 IPv4와 IPv6로 사용하도록 설정할 경우에만 사용해야 한다. 이 필드의 구성은 [이그레스](#이그레스-트래픽)에 대한 요구사항이 아니다. +클러스터에 이중 스택이 활성화된 경우 IPv4, IPv6 또는 둘 다를 사용할 수 있는 {{< glossary_tooltip text="서비스" term_id="service" >}}를 만들 수 있다. + +서비스의 주소 계열은 기본적으로 첫 번째 서비스 클러스터 IP 범위의 주소 계열로 설정된다. (`--service-cluster-ip-range` 플래그를 통해 kube-controller-manager에 구성) + +서비스를 정의할 때 선택적으로 이중 스택으로 구성할 수 있다. 원하는 동작을 지정하려면 `.spec.ipFamilyPolicy` 필드를 +다음 값 중 하나로 설정한다. + +* `SingleStack`: 단일 스택 서비스. 컨트롤 플레인은 첫 번째로 구성된 서비스 클러스터 IP 범위를 사용하여 서비스에 대한 클러스터 IP를 할당한다. +* `PreferDualStack`: + * 클러스터에 이중 스택이 활성화된 경우에만 사용된다. 서비스에 대해 IPv4 및 IPv6 클러스터 IP를 할당한다. + * 클러스터에 이중 스택이 활성화되지 않은 경우, 이 설정은 `SingleStack`과 동일한 동작을 따른다. +* `RequireDualStack`: IPv4 및 IPv6 주소 범위 모두에서 서비스 `.spec.ClusterIPs`를 할당한다. + * `.spec.ipFamilies` 배열의 첫 번째 요소의 주소 계열을 기반으로 `.spec.ClusterIPs` 목록에서 `.spec.ClusterIP`를 선택한다. + * 클러스터에는 이중 스택 네트워킹이 구성되어 있어야 한다. + +단일 스택에 사용할 IP 계열을 정의하거나 이중 스택에 대한 IP 군의 순서를 정의하려는 경우, 서비스에서 옵션 필드 `.spec.ipFamilies`를 설정하여 주소 군을 선택할 수 있다. {{< note >}} -클러스터의 기본 주소 패밀리는 `--service-cluster-ip-range` 플래그로 kube-controller-manager에 구성된 첫 번째 서비스 클러스터 IP 범위의 주소 패밀리이다. +`.spec.ipFamilies` 필드는 이미 존재하는 서비스에 `.spec.ClusterIP`를 재할당할 수 없기 때문에 변경할 수 없다. `.spec.ipFamilies`를 변경하려면 서비스를 삭제하고 다시 생성한다. {{< /note >}} -`.spec.ipFamily` 를 다음 중 하나로 설정할 수 있다. +`.spec.ipFamilies`를 다음 배열 값 중 하나로 설정할 수 있다. - * `IPv4`: API 서버는 `ipv4` 인 `service-cluster-ip-range` 의 IP를 할당 한다. - * `IPv6`: API 서버는 `ipv6` 인 `service-cluster-ip-range` 의 IP를 할당 한다. +- `["IPv4"]` +- `["IPv6"]` +- `["IPv4","IPv6"]` (이중 스택) +- `["IPv6","IPv4"]` (이중 스택) -다음 서비스 사양에는 `ipFamily` 필드가 포함되어 있지 않다. 쿠버네티스는 처음 구성된 `service-cluster-ip-range` 의 IP 주소("클러스터 IP" 라고도 함)를 이 서비스에 할당 한다. +나열한 첫 번째 군은 레거시`.spec.ClusterIP` 필드에 사용된다. + +### 이중 스택 서비스 구성 시나리오 + +이 예제는 다양한 이중 스택 서비스 구성 시나리오의 동작을 보여준다. + +#### 새로운 서비스에 대한 이중 스택 옵션 + +1. 이 서비스 사양은 `.spec.ipFamilyPolicy`를 명시적으로 정의하지 않는다. 이 서비스를 만들 때 쿠버네티스는 처음 구성된 `service-cluster-ip-range`에서 서비스에 대한 클러스터 IP를 할당하고 `.spec.ipFamilyPolicy`를 `SingleStack`으로 설정한다. ([셀렉터가 없는 서비스](/ko/docs/concepts/services-networking/service/#셀렉터가-없는-서비스) 및 [헤드리스 서비스](/ko/docs/concepts/services-networking/service/#헤드리스-headless-서비스)와 같은 방식으로 동작한다.) {{< codenew file="service/networking/dual-stack-default-svc.yaml" >}} -다음 서비스 명세에는 `ipFamily` 필드가 포함되어 있다. 쿠버네티스는 구성된 `service-cluster-ip-range` 의 IPv6 주소("클러스터 IP" 라고도 함)를 이 서비스에 할당 한다. +1. 이 서비스 사양은 `.spec.ipFamilyPolicy`에 `PreferDualStack`을 명시적으로 정의한다. 이중 스택 클러스터에서 이 서비스를 생성하면 쿠버네티스는 서비스에 대해 IPv4 및 IPv6 주소를 모두 할당한다. 컨트롤 플레인은 서비스의 `.spec`을 업데이트하여 IP 주소 할당을 기록한다. 필드 `.spec.ClusterIPs`는 기본 필드이며 할당된 IP 주소를 모두 포함한다. `.spec.ClusterIP`는 값이 `.spec.ClusterIPs`에서 계산된 보조 필드이다. -{{< codenew file="service/networking/dual-stack-ipv6-svc.yaml" >}} + * `.spec.ClusterIP` 필드의 경우 컨트롤 플레인은 첫 번째 서비스 클러스터 IP 범위와 동일한 주소 계열의 IP 주소를 기록한다. + * 단일 스택 클러스터에서 `.spec.ClusterIPs` 및 `.spec.ClusterIP` 필드는 모두 하나의 주소만 나열한다. + * 이중 스택이 활성화된 클러스터에서 `.spec.ipFamilyPolicy`에 `RequireDualStack`을 지정하면 `PreferDualStack`과 동일하게 작동한다. -비교를 위해, 다음 서비스 명세에는 구성된 `service-cluster-ip-range` 의 IPv4 주소("클러스터 IP" 라고도 함)를 이 서비스에 할당한다. +{{< codenew file="service/networking/dual-stack-preferred-svc.yaml" >}} -{{< codenew file="service/networking/dual-stack-ipv4-svc.yaml" >}} +1. 이 서비스 사양은 `.spec.ipFamilies`에` IPv6`과 `IPv4`를 명시적으로 정의하고 `.spec.ipFamilyPolicy`에 `PreferDualStack`을 정의한다. 쿠버네티스가 `.spec.ClusterIPs`에 IPv6 및 IPv4 주소를 할당할 때 `.spec.ClusterIP`는 `.spec.ClusterIPs` 배열의 첫 번째 요소이므로 IPv6 주소로 설정되어 기본값을 재정의한다. -### 로드밸런서 유형 +{{< codenew file="service/networking/dual-stack-preferred-ipfamilies-svc.yaml" >}} -IPv6가 활성화된 외부 로드 밸런서를 지원하는 클라우드 공급자들은 `type` 필드를 `LoadBalancer` 로 설정하고, 추가적으로 `ipFamily` 필드를 `IPv6` 로 설정하면 서비스에 대한 클라우드 로드 밸런서가 구축된다. +#### 기존 서비스의 이중 스택 기본값 -## 이그레스 트래픽 +이 예제는 서비스가 이미있는 클러스터에서 이중 스택이 새로 활성화된 경우의 기본 동작을 보여준다. -근본적으로 {{< glossary_tooltip text="CNI" term_id="cni" >}} 공급자가 전송을 구현할 수 있는 경우 공개적으로 라우팅 하거나 비공개 라우팅만 가능한 IPv6 주소 블록의 사용은 허용된다. 만약 비공개 라우팅만 가능한 IPv6를 사용하는 파드가 있고, 해당 파드가 오프 클러스터 목적지(예: 공용 인터넷)에 도달하기를 원하는 경우에는 이그레스 트래픽과 모든 응답을 위한 마스커레이딩 IP를 설정해야 한다. [ip-masq-agent](https://github.com/kubernetes-sigs/ip-masq-agent)는 이중 스택을 인식하기에, 이중 스택 클러스터에서 마스커레이딩 IP에 ip-masq-agent를 사용할 수 있다. +1. 클러스터에서 이중 스택이 활성화된 경우 기존 서비스 (`IPv4` 또는 `IPv6`)는 컨트롤 플레인이 `.spec.ipFamilyPolicy`를 `SingleStack`으로 지정하고 `.spec.ipFamilies`를 기존 서비스의 주소 계열로 설정한다. 기존 서비스 클러스터 IP는 `.spec.ClusterIPs`에 저장한다. -## 알려진 이슈들 +{{< codenew file="service/networking/dual-stack-default-svc.yaml" >}} - * Kubenet은 IP의 IPv4,IPv6의 위치 보고를 강제로 수행한다. (--cluster-cidr) + kubectl을 사용하여 기존 서비스를 검사하여 이 동작을 검증할 수 있다. +```shell +kubectl get svc my-service -o yaml +``` +```yaml +apiVersion: v1 +kind: Service +metadata: + labels: + app: MyApp + name: my-service +spec: + clusterIP: 10.0.197.123 + clusterIPs: + - 10.0.197.123 + ipFamilies: + - IPv4 + ipFamilyPolicy: SingleStack + ports: + - port: 80 + protocol: TCP + targetPort: 80 + selector: + app: MyApp + type: ClusterIP +status: + loadBalancer: {} +``` + +1. 클러스터에서 이중 스택이 활성화된 경우, 셀렉터가 있는 기존 [헤드리스 서비스](/ko/docs/concepts/services-networking/service/#헤드리스-headless-서비스)는 `.spec.ClusterIP`가 `None`이라도 컨트롤 플레인이 `.spec.ipFamilyPolicy`을 `SingleStack`으로 지정하고 `.spec.ipFamilies`는 첫 번째 서비스 클러스터 IP 범위(kube-controller-manager에 대한 `--service-cluster-ip-range` 플래그를 통해 구성)의 주소 계열으로 지정한다. + +{{< codenew file="service/networking/dual-stack-default-svc.yaml" >}} + + kubectl을 사용하여 셀렉터로 기존 헤드리스 서비스를 검사하여 이 동작의 유효성을 검사 할 수 있다. + +```shell +kubectl get svc my-service -o yaml +``` + +```yaml +apiVersion: v1 +kind: Service +metadata: + labels: + app: MyApp + name: my-service +spec: + clusterIP: None + clusterIPs: + - None + ipFamilies: + - IPv4 + ipFamilyPolicy: SingleStack + ports: + - port: 80 + protocol: TCP + targetPort: 80 + selector: + app: MyApp +``` + +#### 단일 스택과 이중 스택 간 서비스 전환 + +서비스는 단일 스택에서 이중 스택으로, 이중 스택에서 단일 스택으로 변경할 수 있다. + +1. 서비스를 단일 스택에서 이중 스택으로 변경하려면 원하는 대로 `.spec.ipFamilyPolicy`를 `SingleStack`에서 `PreferDualStack` 또는 `RequireDualStack`으로 변경한다. 이 서비스를 단일 스택에서 이중 스택으로 변경하면 쿠버네티스는 누락된 주소 계열의 것을 배정하므로 해당 서비스는 이제 IPv4와 IPv6 주소를 갖게된다. + + `.spec.ipFamilyPolicy`를 `SingleStack`에서 `PreferDualStack`으로 업데이트하는 서비스 사양을 편집한다. + +이전: +```yaml +spec: + ipFamilyPolicy: SingleStack +``` +이후: +```yaml +spec: + ipFamilyPolicy: PreferDualStack +``` + +1. 서비스를 이중 스택에서 단일 스택으로 변경하려면 `.spec.ipFamilyPolicy`를 `PreferDualStack`에서 또는 `RequireDualStack`을 `SingleStack`으로 변경한다. 이 서비스를 이중 스택에서 단일 스택으로 변경하면 쿠버네티스는 `.spec.ClusterIPs` 배열의 첫 번째 요소 만 유지하고 `.spec.ClusterIP`를 해당 IP 주소로 설정하고 `.spec.ipFamilies`를 `.spec.ClusterIPs`의 주소 계열로 설정한다. + +### 셀렉터가 없는 헤드리스 서비스 + +[셀렉터가 없는 서비스](/ko/docs/concepts/services-networking/service/#셀렉터가-없는-서비스) 및 `.spec.ipFamilyPolicy`가 명시적으로 설정되지 않은 경우 `.spec.ipFamilyPolicy` 필드의 기본값은 `RequireDualStack` 이다. + +### 로드밸런서 서비스 유형 + +서비스에 이중 스택 로드밸런서를 프로비저닝하려면 + * `.spec.type` 필드를 `LoadBalancer`로 설정 + * `.spec.ipFamilyPolicy` 필드를 `PreferDualStack` 또는 `RequireDualStack`으로 설정 + +{{< note >}} +이중 스택 `LoadBalancer` 유형 서비스를 사용하려면 클라우드 공급자가 IPv4 및 IPv6로드 밸런서를 지원해야 한다. +{{< /note >}} + +## 이그레스(Egress) 트래픽 + +비공개로 라우팅할 수 있는 IPv6 주소를 사용하는 파드에서 클러스터 외부 대상 (예: 공용 인터넷)에 도달하기 위해 이그레스 트래픽을 활성화하려면 투명 프록시 또는 IP 위장과 같은 메커니즘을 통해 공개적으로 라우팅한 IPv6 주소를 사용하도록 파드를 활성화해야 한다. [ip-masq-agent](https://github.com/kubernetes-sigs/ip-masq-agent) 프로젝트는 이중 스택 클러스터에서 IP 위장을 지원한다. + +{{< note >}} +{{< glossary_tooltip text="CNI" term_id="cni" >}} 공급자가 IPv6를 지원하는지 확인한다. +{{< /note >}} ## {{% heading "whatsnext" %}} -* [IPv4/IPv6 이중 스택 확인](/ko/docs/tasks/network/validate-dual-stack) 네트워킹 +* [IPv4/IPv6 이중 스택 검증](/ko/docs/tasks/network/validate-dual-stack) 네트워킹 diff --git a/content/ko/docs/concepts/services-networking/endpoint-slices.md b/content/ko/docs/concepts/services-networking/endpoint-slices.md index 22af37603a..f75dc819c3 100644 --- a/content/ko/docs/concepts/services-networking/endpoint-slices.md +++ b/content/ko/docs/concepts/services-networking/endpoint-slices.md @@ -73,7 +73,8 @@ endpoints: ``` 기본적으로, 컨트롤 플레인은 각각 100개 이하의 엔드포인트를 -갖도록 엔드포인트슬라이스를 생성하고 관리한다. `--max-endpoints-per-slice` +갖도록 엔드포인트슬라이스를 +생성하고 관리한다. `--max-endpoints-per-slice` {{< glossary_tooltip text="kube-controller-manager" term_id="kube-controller-manager" >}} 플래그를 사용하여, 최대 1000개까지 구성할 수 있다. @@ -90,8 +91,58 @@ endpoints: * IPv6 * FQDN (전체 주소 도메인 이름) +### 조건 + +엔드포인트슬라이스 API는 컨슈머에게 유용한 엔드포인트에 대한 조건을 저장한다. +조건은 `준비`, `제공` 및 `종료` 세 가지가 있다. + +#### 준비 + +`ready`는 파드의 `Ready` 조건에 매핑되는 조건이다. `Ready` 조건이 `True`로 설정된 실행 중인 파드는 +이 엔드포인트슬라이스 조건도 `true`로 설정되어야 한다. 호환성의 +이유로, 파드가 종료될 때 `ready`는 절대 `true`가 되면 안 된다. 컨슈머는 `serving` 조건을 참조하여 +파드 종료 준비 상태(readiness)를 검사해야 한다. +이 규칙의 유일한 예외는 `spec.publishNotReadyAddresses`가 `true`로 설정된 서비스이다. +이러한 서비스의 엔드 포인트는 항상 `ready`조건이 `true`로 설정된다. + +#### 제공(Serving) + +{{< feature-state for_k8s_version="v1.20" state="alpha" >}} + +`serving`은 종료 상태를 고려하지 않는다는 점을 제외하면 `ready` 조건과 동일하다. +엔드포인트슬라이스 API 컨슈머는 파드가 종료되는 동안 파드 준비 상태에 관심이 있다면 +이 조건을 확인해야 한다. + +{{< note >}} + +`serving`은 `ready`와 거의 동일하지만 `ready`의 기존 의미가 깨지는 것을 방지하기 위해 추가되었다. +엔드포인트를 종료하기 위해 `ready`가 `true` 일 수 있다면 기존 클라이언트에게는 예상치 못한 일이 될 수 있다. +역사적으로 종료된 엔드포인트는 처음부터 엔드포인트 또는 엔드포인트슬라이스 API에 포함되지 않았기 때문이다. +이러한 이유로 `ready`는 엔드포인트 종료를 위해 _always_ `false`이며, +클라이언트가 `ready`에 대한 기존 의미와 관계없이 파드 종료 준비 상태를 +추적 할 수 있도록 v1.20에 새로운 조건 `serving`이 추가되었다. + +{{< /note >}} + +#### 종료(Terminating) + +{{< feature-state for_k8s_version="v1.20" state="alpha" >}} + +`종료(Terminating)`는 엔드포인트가 종료되는지 여부를 나타내는 조건이다. +파드의 경우 삭제 타임 스탬프가 설정된 모든 파드이다. + ### 토폴로지 정보 {#토폴로지} +{{< feature-state for_k8s_version="v1.20" state="deprecated" >}} + +{{< note >}} +엔드포인트슬라이스의 토폴로지 필드는 사용 중단되었으며 향후 릴리스에서 제거된다. +토폴로지에서 `kubernetes.io/hostname`을 설정하는 대신 새로운 `nodeName` 필드가 +사용된다. 영역 및 리전을 커버하는 다른 토폴로지 필드는 +엔드포인트슬라이스 내의 모든 엔드포인트에 적용되는 +엔드포인트슬라이스 레이블을 이용해 더 잘 표현될 수 있다. +{{< /note >}} + 엔드포인트슬라이스 내 각 엔드포인트는 연관된 토폴로지 정보를 포함할 수 있다. 이는 해당 노드, 영역 그리고 지역에 대한 정보가 포함된 엔드포인트가 있는 위치를 나타나는데 사용 한다. 값을 사용할 수 있으면, diff --git a/content/ko/docs/concepts/services-networking/ingress-controllers.md b/content/ko/docs/concepts/services-networking/ingress-controllers.md index 653993a485..7690669757 100644 --- a/content/ko/docs/concepts/services-networking/ingress-controllers.md +++ b/content/ko/docs/concepts/services-networking/ingress-controllers.md @@ -13,8 +13,8 @@ kube-controller-manager 바이너리의 일부로 실행되는 컨트롤러의 클러스터와 함께 자동으로 실행되지 않는다. 클러스터에 가장 적합한 인그레스 컨트롤러 구현을 선택하는데 이 페이지를 사용한다. -프로젝트로써 쿠버네티스는 현재 [GCE](https://git.k8s.io/ingress-gce/README.md) 와 - [nginx](https://git.k8s.io/ingress-nginx/README.md) 컨트롤러를 지원하고 유지한다. +프로젝트로써 쿠버네티스는 [AWS](https://github.com/kubernetes-sigs/aws-load-balancer-controller#readme), [GCE](https://git.k8s.io/ingress-gce/README.md#readme)와 + [nginx](https://git.k8s.io/ingress-nginx/README.md#readme) 인그레스 컨트롤러를 지원하고 유지한다. @@ -24,31 +24,31 @@ kube-controller-manager 바이너리의 일부로 실행되는 컨트롤러의 {{% thirdparty-content %}} -* [AKS Application Gateway Ingress Controller](https://github.com/Azure/application-gateway-kubernetes-ingress) is an ingress controller that enables ingress to [AKS clusters](https://docs.microsoft.com/azure/aks/kubernetes-walkthrough-portal) using the [Azure Application Gateway](https://docs.microsoft.com/azure/application-gateway/overview). -* [Ambassador](https://www.getambassador.io/) API 게이트웨이는 [Datawire](https://www.datawire.io/)의 - [커뮤니티](https://www.getambassador.io/docs) 혹은 [상업적](https://www.getambassador.io/pro/) 지원을 제공하는 - [Envoy](https://www.envoyproxy.io) 기반 인그레스 컨트롤러다. -* [AppsCode Inc.](https://appscode.com) 는 가장 널리 사용되는 [HAProxy](https://www.haproxy.org/) 기반 인그레스 컨트롤러인 [Voyager](https://appscode.com/products/voyager)에 대한 지원 및 유지 보수를 제공한다. -* [AWS 로드 밸런서 컨트롤러](https://github.com/kubernetes-sigs/aws-load-balancer-controller)(이전의 AWS ALB 인그레스 컨트롤러)는 [AWS Elastic Load Balancing](https://aws.amazon.com/elasticloadbalancing/)을 사용하여 인그레스를 활성화한다. -* [Contour](https://projectcontour.io/)는 [Envoy](https://www.envoyproxy.io/) 기반 인그레스 컨트롤러로 - VMware에서 제공하고 지원한다. -* Citrix는 [베어메탈](https://github.com/citrix/citrix-k8s-ingress-controller/tree/master/deployment/baremetal)과 [클라우드](https://github.com/citrix/citrix-k8s-ingress-controller/tree/master/deployment) 배포를 위해 하드웨어 (MPX), 가상화 (VPX) 및 [무료 컨테이너화 (CPX) ADC](https://www.citrix.com/products/citrix-adc/cpx-express.html)를 위한 [인그레스 컨트롤러](https://github.com/citrix/citrix-k8s-ingress-controller)를 제공한다. -* F5 Networks는 [쿠버네티스를 위한 F5 BIG-IP 컨테이너 인그레스 서비스](http://clouddocs.f5.com/products/connectors/k8s-bigip-ctlr/latest)에 대한 - [지원과 유지 보수](https://support.f5.com/csp/article/K86859508)를 제공한다. -* [Gloo](https://gloo.solo.io)는 [solo.io](https://www.solo.io)의 엔터프라이즈 지원과 함께 API 게이트웨이 기능을 제공하는 [Envoy](https://www.envoyproxy.io) 기반의 오픈 소스 인그레스 컨트롤러다. -* [HAProxy 인그레스](https://haproxy-ingress.github.io)는 HAProxy를 위한 고도로 커스터마이징 가능한 커뮤니티 주도형 인그레스 컨트롤러다. -* [HAProxy Technologies](https://www.haproxy.com/)는 [쿠버네티스를 위한 HAProxy 인그레스 컨트롤러](https://github.com/haproxytech/kubernetes-ingress)를 지원하고 유지 보수한다. [공식 문서](https://www.haproxy.com/documentation/hapee/1-9r1/traffic-management/kubernetes-ingress-controller/)를 통해 확인할 수 있다. -* [Istio](https://istio.io/)는 인그레스 컨트롤러 기반으로 - [인그레스 트래픽을 제어](https://istio.io/docs/tasks/traffic-management/ingress/). -* [Kong](https://konghq.com/)은 [쿠버네티스를 위한 Kong 인그레스 컨트롤러](https://github.com/Kong/kubernetes-ingress-controller)에 대한 - [커뮤니티](https://discuss.konghq.com/c/kubernetes) 또는 - [상업적](https://konghq.com/kong-enterprise/) 지원과 유지 보수를 제공한다. -* [NGINX, Inc.](https://www.nginx.com/)는 - [쿠버네티스를 위한 NGINX 인그레스 컨트롤러](https://www.nginx.com/products/nginx/kubernetes-ingress-controller)에 대한 지원과 유지 보수를 제공한다. -* [Skipper](https://opensource.zalando.com/skipper/kubernetes/ingress-controller/)는 쿠버네티스 인그레스와 같은 유스케이스를 포함하는 서비스 구성을 위한 HTTP 라우터와 리버스 프록시는 사용자 정의 프록시를 빌드하기 위한 라이브러리로 설계되었다. -* [Traefik](https://github.com/traefik/traefik)은 - 모든 기능([Let's Encrypt](https://letsencrypt.org), secrets, http2, 웹 소켓)을 갖춘 인그레스 컨트롤러로, - [Traefik Labs](https://traefik.io)에서 상업적인 지원을 제공한다. +* [AKS 애플리케이션 게이트웨이 인그레스 컨트롤러] (https://azure.github.io/application-gateway-kubernetes-ingress/)는 [Azure 애플리케이션 게이트웨이](https://docs.microsoft.com)를 구성하는 인그레스 컨트롤러다. +* [Ambassador](https://www.getambassador.io/) API 게이트웨이는 [Envoy](https://www.envoyproxy.io) 기반 인그레스 + 컨트롤러다. +* [Citrix 인그레스 컨트롤러](https://github.com/citrix/citrix-k8s-ingress-controller#readme)는 + Citrix 애플리케이션 딜리버리 컨트롤러에서 작동한다. +* [Contour](https://projectcontour.io/)는 [Envoy](https://www.envoyproxy.io/) 기반 인그레스 컨트롤러다. +* F5 BIG-IP [쿠버네티스 용 컨테이너 인그레스 서비스](https://clouddocs.f5.com/containers/latest/userguide/kubernetes/)를 + 이용하면 인그레스를 사용하여 F5 BIG-IP 가상 서버를 구성할 수 있다. +* [Gloo](https://gloo.solo.io)는 API 게이트웨이 기능을 제공하는 [Envoy](https://www.envoyproxy.io) 기반의 + 오픈소스 인그레스 컨트롤러다. +* [HAProxy 인그레스](https://haproxy-ingress.github.io/)는 [HAProxy](http://www.haproxy.org/#desc)의 + 인그레스 컨트롤러다. +* [쿠버네티스 용 HAProxy 인그레스 컨트롤러](https://github.com/haproxytech/kubernetes-ingress#readme)는 [HAProxy](http://www.haproxy.org/#desc) 용 + 인그레스 컨트롤러이기도 하다. +* [Istio 인그레스](https://istio.io/latest/docs/tasks/traffic-management/ingress/kubernetes-ingress/)는 [Istio](https://istio.io/) + 기반 인그레스 컨트롤러다. +* [쿠버네티스 용 Kong 인그레스 컨트롤러](https://github.com/Kong/kubernetes-ingress-controller#readme)는 [Kong 게이트웨이](https://konghq.com/kong/)를 + 구동하는 인그레스 컨트롤러다. +* [쿠버네티스 용 NGINX 인그레스 컨트롤러](https://www.nginx.com/products/nginx/kubernetes-ingress-controller)는 [NGINX](https://www.nginx.com/resources/glossary) + 웹서버(프록시로 사용)와 함께 작동한다. +* [Skipper](https://opensource.zalando.com/skipper/kubernetes/ingress-controller/)는 사용자의 커스텀 프록시를 구축하기 위한 라이브러리로 설계된 쿠버네티스 인그레스와 같은 유스케이스를 포함한 서비스 구성을 위한 HTTP 라우터 및 역방향 프록시다. +* [Traefik 쿠버네티스 인그레스 제공자](https://doc.traefik.io/traefik/providers/kubernetes-ingress/)는 + [Traefik](https://traefik.io/traefik/) 프록시 용 인그레스 컨트롤러다. +* [Voyager](https://appscode.com/products/voyager)는 + [HAProxy](http://www.haproxy.org/#desc)의 인그레스 컨트롤러다. ## 여러 인그레스 컨트롤러 사용 @@ -73,3 +73,4 @@ kube-controller-manager 바이너리의 일부로 실행되는 컨트롤러의 * [인그레스](/ko/docs/concepts/services-networking/ingress/)에 대해 자세히 알아보기. * [NGINX 컨트롤러로 Minikube에서 인그레스를 설정하기](/docs/tasks/access-application-cluster/ingress-minikube). + diff --git a/content/ko/docs/concepts/services-networking/service.md b/content/ko/docs/concepts/services-networking/service.md index e79762e9e7..3270c498aa 100644 --- a/content/ko/docs/concepts/services-networking/service.md +++ b/content/ko/docs/concepts/services-networking/service.md @@ -201,10 +201,15 @@ API 리소스이다. 개념적으로 엔드포인트와 매우 유사하지만, ### 애플리케이션 프로토콜 -{{< feature-state for_k8s_version="v1.19" state="beta" >}} +{{< feature-state for_k8s_version="v1.20" state="stable" >}} -`AppProtocol` 필드는 각 서비스 포트에 대한 애플리케이션 프로토콜을 지정하는 방법을 제공한다. -이 필드의 값은 해당 엔드포인트와 엔드포인트슬라이스 리소스에 의해 미러링된다. +`appProtocol` 필드는 각 서비스 포트에 대한 애플리케이션 프로토콜을 지정하는 방법을 제공한다. +이 필드의 값은 해당 엔드포인트와 엔드포인트슬라이스 +오브젝트에 의해 미러링된다. + +이 필드는 표준 쿠버네티스 레이블 구문을 따른다. 값은 +[IANA 표준 서비스 이름](http://www.iana.org/assignments/service-names) 또는 +`mycompany.com/my-custom-protocol`과 같은 도메인 접두사 이름 중 하나여야 한다. ## 가상 IP와 서비스 프록시 @@ -576,21 +581,12 @@ status: 외부 로드 밸런서의 트래픽은 백엔드 파드로 전달된다. 클라우드 공급자는 로드 밸런싱 방식을 결정한다. -로드 밸런서 서비스 유형의 경우 두 개 이상의 포트가 정의된 경우, -모든 포트의 프로토콜이 동일해야 하고, 프로토콜은 `TCP`, `UDP` 그리고 -`SCTP` 중 하나여야 한다. - 일부 클라우드 공급자는 `loadBalancerIP`를 지정할 수 있도록 허용한다. 이 경우, 로드 밸런서는 사용자 지정 `loadBalancerIP`로 생성된다. `loadBalancerIP` 필드가 지정되지 않으면, 임시 IP 주소로 loadBalancer가 설정된다. `loadBalancerIP`를 지정했지만 클라우드 공급자가 이 기능을 지원하지 않는 경우, 설정한 `loadbalancerIP` 필드는 무시된다. -{{< note >}} -SCTP를 사용하는 경우, `LoadBalancer` 서비스 유형에 대한 아래의 [경고](#caveat-sctp-loadbalancer-service-type)를 -참고한다. -{{< /note >}} - {{< note >}} **Azure** 에서 사용자 지정 공개(public) 유형 `loadBalancerIP`를 사용하려면, 먼저 @@ -602,7 +598,35 @@ SCTP를 사용하는 경우, `LoadBalancer` 서비스 유형에 대한 아래의 {{< /note >}} -#### 내부 로드 밸런서 {#internal-load-balancer} +#### 프로토콜 유형이 혼합된 로드밸런서 + +{{< feature-state for_k8s_version="v1.20" state="alpha" >}} + +기본적으로 로드밸런서 서비스 유형의 경우 둘 이상의 포트가 정의되어 있을 때 모든 +포트는 동일한 프로토콜을 가져야 하며 프로토콜은 클라우드 공급자가 +지원하는 프로토콜이어야 한다. + +kube-apiserver에 대해 기능 게이트 `MixedProtocolLBService`가 활성화된 경우 둘 이상의 포트가 정의되어 있을 때 다른 프로토콜을 사용할 수 있다. + +{{< note >}} + +로드밸런서 서비스 유형에 사용할 수 있는 프로토콜 세트는 여전히 클라우드 제공 업체에서 정의한다. + +{{< /note >}} + +#### 로드밸런서 NodePort 할당 비활성화 + +{{< feature-state for_k8s_version="v1.20" state="alpha" >}} + +v1.20부터는 `spec.allocateLoadBalancerNodePorts`필드를 `false`로 설정하여 서비스 Type=LoadBalancer에 +대한 노드 포트 할당을 선택적으로 비활성화 할 수 있다. +노드 포트를 사용하는 대신 트래픽을 파드로 직접 라우팅하는 로드 밸런서 구현에만 사용해야 한다. +기본적으로 `spec.allocateLoadBalancerNodePorts`는 `true`이며 로드밸런서 서비스 유형은 계속해서 노드 포트를 할당한다. +노드 포트가 할당된 기존 서비스에서 `spec.allocateLoadBalancerNodePorts`가 `false`로 설정된 경우 해당 노드 포트는 자동으로 할당 해제되지 않는다. +이러한 노드 포트를 할당 해제하려면 모든 서비스 포트에서 `nodePorts` 항목을 명시적으로 제거해야 한다. +이 필드를 사용하려면 `ServiceLBNodePortControl` 기능 게이트를 활성화해야 한다. + +#### 내부 로드 밸런서 혼재된 환경에서는 서비스의 트래픽을 동일한 (가상) 네트워크 주소 블록 내로 라우팅해야 하는 경우가 있다. @@ -1182,6 +1206,36 @@ IPVS는 로드 밸런싱을 위해 설계되었고 커널-내부 해시 테이 대부분의 서비스에 UDP를 사용할 수 있다. type=LoadBalancer 서비스의 경우, UDP 지원은 이 기능을 제공하는 클라우드 공급자에 따라 다르다. +### SCTP + +{{< feature-state for_k8s_version="v1.20" state="stable" >}} + +SCTP 트래픽을 지원하는 네트워크 플러그인을 사용하는 경우 대부분의 서비스에 SCTP를 사용할 수 있다. +type=LoadBalancer 서비스의 경우 SCTP 지원은 이 기능을 제공하는 +클라우드 공급자에 따라 다르다. (대부분 그렇지 않음) + +#### 경고 {#caveat-sctp-overview} + +##### 멀티홈드(multihomed) SCTP 연결을 위한 지원 {#caveat-sctp-multihomed} + +{{< warning >}} +멀티홈 SCTP 연결을 위해서는 먼저 CNI 플러그인이 파드에 대해 멀티 인터페이스 및 IP 주소 할당이 지원되어야 한다. + +멀티홈 SCTP 연결을 위한 NAT는 해당 커널 모듈 내에 특수한 로직을 필요로 한다. +{{< /warning >}} + +##### 윈도우 {#caveat-sctp-windows-os} + +{{< warning >}} +SCTP는 윈도우 기반 노드를 지원하지 않는다. +{{< /warning >}} + +##### 유저스페이스 kube-proxy {#caveat-sctp-kube-proxy-userspace} + +{{< warning >}} +kube-proxy는 유저스페이스 모드에 있을 때 SCTP 연결 관리를 지원하지 않는다. +{{< /warning >}} + ### HTTP 클라우드 공급자가 이를 지원하는 경우, LoadBalancer 모드의 @@ -1209,42 +1263,6 @@ PROXY TCP4 192.0.2.202 10.0.42.7 12345 7\r\n 클라이언트 데이터가 뒤따라온다. -### SCTP - -{{< feature-state for_k8s_version="v1.19" state="beta" >}} - -쿠버네티스는 서비스, 엔드포인트, 엔드포인트슬라이스, 네트워크폴리시 및 파드 정의에서 SCTP를 `protocol` 값으로 지원한다. 이 기능은 베타 기능으로, 기본 활성화되어 있다. 클러스터 수준에서 SCTP를 비활성화하려면, 사용자(또는 클러스터 관리자)가 API 서버에서 `--feature-gates=SCTPSupport=false,…` 를 사용해서 `SCTPSupport` [기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/)를 비활성화해야 한다. - -기능 게이트가 활성화되면, 서비스, 엔드포인트, 엔드포인트슬라이스, 네트워크폴리시 또는 파드의 `protocol` 필드를 `SCTP` 로 설정할 수 있다. 쿠버네티스는 TCP 연결과 마찬가지로, SCTP 연결에 맞게 네트워크를 설정한다. - -#### 경고 {#caveat-sctp-overview} - -##### 멀티홈드(multihomed) SCTP 연결을 위한 지원 {#caveat-sctp-multihomed} - -{{< warning >}} -멀티홈 SCTP 연결을 위해서는 먼저 CNI 플러그인이 파드에 대해 멀티 인터페이스 및 IP 주소 할당이 지원되어야 한다. - -멀티홈 SCTP 연결을 위한 NAT는 해당 커널 모듈 내에 특수한 로직을 필요로 한다. -{{< /warning >}} - -##### type=LoadBalancer 서비스 {#caveat-sctp-loadbalancer-service-type} - -{{< warning >}} -클라우드 공급자의 로드 밸런서 구현이 프로토콜로서 SCTP를 지원하는 경우에만 LoadBalancer `유형`과 SCTP `프로토콜`을 사용하여 서비스를 생성할 수 있다. 그렇지 않으면, 서비스 생성 요청이 거부된다. 현재 클라우드 로드 밸런서 공급자 세트 (Azure, AWS, CloudStack, GCE, OpenStack)는 모두 SCTP에 대한 지원이 없다. -{{< /warning >}} - -##### 윈도우 {#caveat-sctp-windows-os} - -{{< warning >}} -SCTP는 윈도우 기반 노드를 지원하지 않는다. -{{< /warning >}} - -##### 유저스페이스 kube-proxy {#caveat-sctp-kube-proxy-userspace} - -{{< warning >}} -kube-proxy는 유저스페이스 모드에 있을 때 SCTP 연결 관리를 지원하지 않는다. -{{< /warning >}} - ## {{% heading "whatsnext" %}} * [서비스와 애플리케이션 연결](/ko/docs/concepts/services-networking/connect-applications-service/) 알아보기 diff --git a/content/ko/docs/concepts/storage/persistent-volumes.md b/content/ko/docs/concepts/storage/persistent-volumes.md index a74dd45de6..2b421c7fb2 100644 --- a/content/ko/docs/concepts/storage/persistent-volumes.md +++ b/content/ko/docs/concepts/storage/persistent-volumes.md @@ -304,26 +304,35 @@ EBS 볼륨 확장은 시간이 많이 걸리는 작업이다. 또한 6시간마 퍼시스턴트볼륨 유형은 플러그인으로 구현된다. 쿠버네티스는 현재 다음의 플러그인을 지원한다. -* GCEPersistentDisk -* AWSElasticBlockStore -* AzureFile -* AzureDisk -* CSI -* FC (파이버 채널) -* FlexVolume -* Flocker -* NFS -* iSCSI -* RBD (Ceph Block Device) -* CephFS -* Cinder (OpenStack 블록 스토리지) -* Glusterfs -* VsphereVolume -* Quobyte Volumes -* HostPath (단일 노드 테스트 전용 – 로컬 스토리지는 어떤 방식으로도 지원되지 않으며 다중-노드 클러스터에서 작동하지 않음) -* Portworx Volumes -* ScaleIO Volumes -* StorageOS +* [`awsElasticBlockStore`](/ko/docs/concepts/storage/volumes/#awselasticblockstore) - AWS Elastic Block Store (EBS) +* [`azureDisk`](/ko/docs/concepts/storage/volumes/#azuredisk) - Azure Disk +* [`azureFile`](/ko/docs/concepts/storage/volumes/#azurefile) - Azure File +* [`cephfs`](/ko/docs/concepts/storage/volumes/#cephfs) - CephFS 볼륨 +* [`cinder`](/ko/docs/concepts/storage/volumes/#cinder) - Cinder (오픈스택 블록 스토리지) + (**사용 중단**) +* [`csi`](/ko/docs/concepts/storage/volumes/#csi) - 컨테이너 스토리지 인터페이스 (CSI) +* [`fc`](/ko/docs/concepts/storage/volumes/#fc) - Fibre Channel (FC) 스토리지 +* [`flexVolume`](/ko/docs/concepts/storage/volumes/#flexVolume) - FlexVolume +* [`flocker`](/ko/docs/concepts/storage/volumes/#flocker) - Flocker 스토리지 +* [`gcePersistentDisk`](/ko/docs/concepts/storage/volumes/#gcepersistentdisk) - GCE Persistent Disk +* [`glusterfs`](/ko/docs/concepts/storage/volumes/#glusterfs) - Glusterfs 볼륨 +* [`hostPath`](/ko/docs/concepts/storage/volumes/#hostpath) - HostPath 볼륨 + (단일 노드 테스트 전용. 다중-노드 클러스터에서 작동하지 않음. + 대신 `로컬` 볼륨 사용 고려) +* [`iscsi`](/ko/docs/concepts/storage/volumes/#iscsi) - iSCSI (SCSI over IP) 스토리지 +* [`local`](/ko/docs/concepts/storage/volumes/#local) - 노드에 마운트된 + 로컬 스토리지 디바이스 +* [`nfs`](/ko/docs/concepts/storage/volumes/#nfs) - 네트워크 파일 시스템 (NFS) 스토리지 +* `photonPersistentDisk` - Photon 컨트롤러 퍼시스턴트 디스크. + (이 볼륨 유형은 해당 클라우드 공급자가 없어진 이후 더 이상 + 작동하지 않는다.) +* [`portworxVolume`](/ko/docs/concepts/storage/volumes/#portworxvolume) - Portworx 볼륨 +* [`quobyte`](/ko/docs/concepts/storage/volumes/#quobyte) - Quobyte 볼륨 +* [`rbd`](/ko/docs/concepts/storage/volumes/#rbd) - Rados Block Device (RBD) 볼륨 +* [`scaleIO`](/ko/docs/concepts/storage/volumes/#scaleio) - ScaleIO 볼륨 + (**사용 중단**) +* [`storageos`](/ko/docs/concepts/storage/volumes/#storageos) - StorageOS 볼륨 +* [`vsphereVolume`](/ko/docs/concepts/storage/volumes/#vspherevolume) - vSphere VMDK 볼륨 ## 퍼시스턴트 볼륨 @@ -717,12 +726,10 @@ spec: ## 볼륨 스냅샷 및 스냅샷 지원에서 볼륨 복원 -{{< feature-state for_k8s_version="v1.17" state="beta" >}} +{{< feature-state for_k8s_version="v1.20" state="stable" >}} -CSI 볼륨 플러그인만 지원하도록 볼륨 스냅샷 기능이 추가되었다. 자세한 내용은 [볼륨 스냅샷](/ko/docs/concepts/storage/volume-snapshots/)을 참고한다. - -볼륨 스냅샷 데이터 소스에서 볼륨 복원을 지원하려면 apiserver와 controller-manager에서 -`VolumeSnapshotDataSource` 기능 게이트를 활성화한다. +볼륨 스냅 샷은 아웃-오브-트리 CSI 볼륨 플러그인만 지원한다. 자세한 내용은 [볼륨 스냅샷](/ko/docs/concepts/storage/volume-snapshots/)을 참조한다. +인-트리 볼륨 플러그인은 사용 중단 되었다. [볼륨 플러그인 FAQ](https://github.com/kubernetes/community/blob/master/sig-storage/volume-plugin-faq.md)에서 사용 중단된 볼륨 플러그인에 대해 확인할 수 있다. ### 볼륨 스냅샷에서 퍼시스턴트볼륨클레임 생성 {#create-persistent-volume-claim-from-volume-snapshot} diff --git a/content/ko/docs/concepts/storage/volume-snapshot-classes.md b/content/ko/docs/concepts/storage/volume-snapshot-classes.md index bdf1920567..11708eeec5 100644 --- a/content/ko/docs/concepts/storage/volume-snapshot-classes.md +++ b/content/ko/docs/concepts/storage/volume-snapshot-classes.md @@ -33,7 +33,7 @@ weight: 30 생성된 이후에는 업데이트할 수 없다. ```yaml -apiVersion: snapshot.storage.k8s.io/v1beta1 +apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotClass metadata: name: csi-hostpath-snapclass @@ -47,7 +47,7 @@ parameters: 기본 볼륨스냅샷클래스를 지정할 수 있다. ```yaml -apiVersion: snapshot.storage.k8s.io/v1beta1 +apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotClass metadata: name: csi-hostpath-snapclass diff --git a/content/ko/docs/concepts/storage/volume-snapshots.md b/content/ko/docs/concepts/storage/volume-snapshots.md index 58e8821194..b01a8affa4 100644 --- a/content/ko/docs/concepts/storage/volume-snapshots.md +++ b/content/ko/docs/concepts/storage/volume-snapshots.md @@ -6,7 +6,6 @@ weight: 20 -{{< feature-state for_k8s_version="v1.17" state="beta" >}} 쿠버네티스에서 스토리지 시스템 볼륨 스냅샷은 _VolumeSnapshot_ 을 나타낸다. 이 문서는 이미 쿠버네티스 [퍼시스턴트 볼륨](/ko/docs/concepts/storage/persistent-volumes/)에 대해 잘 알고 있다고 가정한다. @@ -30,7 +29,8 @@ API 리소스 `PersistentVolume` 및 `PersistentVolumeClaim` 가 사용자 및 * API 오브젝트인 `VolumeSnapshot`, `VolumeSnapshotContent`, `VolumeSnapshotClass` 는 핵심 API가 아닌, {{< glossary_tooltip term_id="CustomResourceDefinition" text="CRDs" >}}이다. * `VolumeSnapshot` 은 CSI 드라이버에서만 사용할 수 있다. -* 쿠버네티스 팀은 `VolumeSnapshot` 베타 버젼의 배포 프로세스 일부로써, 컨트롤 플레인에 배포할 스냅샷 컨트롤러와 CSI 드라이버와 함께 배포할 csi-snapshotter라는 사이드카 헬퍼(helper) 컨테이너를 제공한다. 스냅샷 컨트롤러는 `VolumeSnapshot` 및 `VolumeSnapshotContent` 오브젝트를 관찰하고 동적 프로비저닝에서 `VolumeSnapshotContent` 오브젝트의 생성 및 삭제를 할 수 있다.사이드카 csi-snapshotter는 `VolumeSnapshotContent` 오브젝트를 관찰하고 CSI 엔드포인트에 대해 `CreateSnapshot` 및 `DeleteSnapshot` 을 트리거(trigger)한다. +* 쿠버네티스 팀은 `VolumeSnapshot` 의 배포 프로세스 일부로써, 컨트롤 플레인에 배포할 스냅샷 컨트롤러와 CSI 드라이버와 함께 배포할 csi-snapshotter라는 사이드카 헬퍼(helper) 컨테이너를 제공한다. 스냅샷 컨트롤러는 `VolumeSnapshot` 및 `VolumeSnapshotContent` 오브젝트를 관찰하고 동적 프로비저닝에서 `VolumeSnapshotContent` 오브젝트의 생성 및 삭제를 할 수 있다.사이드카 csi-snapshotter는 `VolumeSnapshotContent` 오브젝트를 관찰하고 CSI 엔드포인트에 대해 `CreateSnapshot` 및 `DeleteSnapshot` 을 트리거(trigger)한다. +* 스냅샷 오브젝트에 대한 강화된 검증을 제공하는 검증 웹훅 서버도 있다. 이는 CSI 드라이버가 아닌 스냅샷 컨트롤러 및 CRD와 함께 쿠버네티스 배포판에 의해 설치되어야 한다. 스냅샷 기능이 활성화된 모든 쿠버네티스 클러스터에 설치해야 한다. * CSI 드라이버에서의 볼륨 스냅샷 기능 유무는 확실하지 않다. 볼륨 스냅샷 서포트를 제공하는 CSI 드라이버는 csi-snapshotter를 사용할 가능성이 높다. 자세한 사항은 [CSI 드라이버 문서](https://kubernetes-csi.github.io/docs/)를 확인하면 된다. * CRDs 및 스냅샷 컨트롤러는 쿠버네티스 배포 시 설치된다. @@ -71,7 +71,7 @@ API 오브젝트가 시스템에서 지워지지 않게 하는 것이다(데이 각각의 볼륨 스냅샷은 스펙과 상태를 포함한다. ```yaml -apiVersion: snapshot.storage.k8s.io/v1beta1 +apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshot metadata: name: new-snapshot-test @@ -90,7 +90,7 @@ spec: 사전 프로비저닝된 스냅샷의 경우, 다음 예와 같이 `volumeSnapshotContentName`을 스냅샷 소스로 지정해야 한다. 사전 프로비저닝된 스냅샷에는 `volumeSnapshotContentName` 소스 필드가 필요하다. ```yaml -apiVersion: snapshot.storage.k8s.io/v1beta1 +apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshot metadata: name: test-snapshot @@ -125,7 +125,7 @@ spec: 사전 프로비저닝된 스냅샷의 경우, (클러스터 관리자로서) 다음과 같이 `VolumeSnapshotContent` 오브젝트를 작성해야 한다. ```yaml -apiVersion: snapshot.storage.k8s.io/v1beta1 +apiVersion: snapshot.storage.k8s.io/v1 kind: VolumeSnapshotContent metadata: name: new-snapshot-content-test diff --git a/content/ko/docs/concepts/storage/volumes.md b/content/ko/docs/concepts/storage/volumes.md index d89c0b7241..2e37dc0a67 100644 --- a/content/ko/docs/concepts/storage/volumes.md +++ b/content/ko/docs/concepts/storage/volumes.md @@ -296,6 +296,12 @@ tmpfs는 매우 빠르지만, 디스크와 다르게 노드 재부팅시 tmpfs 작성하는 모든 파일이 컨테이너 메모리 제한에 포함된다. +{{< note >}} +`SizeMemoryBackedVolumes` [기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/)가 활성화된 경우, +메모리 기반 볼륨의 크기를 지정할 수 있다. 크기를 지정하지 않으면, 메모리 +기반 볼륨의 크기는 리눅스 호스트 메모리의 50%로 조정된다. +{{< /note >}} + #### emptyDir 구성 예시 ```yaml diff --git a/content/ko/docs/concepts/workloads/controllers/cron-jobs.md b/content/ko/docs/concepts/workloads/controllers/cron-jobs.md index fe46abd604..19995d83ce 100644 --- a/content/ko/docs/concepts/workloads/controllers/cron-jobs.md +++ b/content/ko/docs/concepts/workloads/controllers/cron-jobs.md @@ -28,8 +28,6 @@ kube-controller-manager 컨테이너에 설정된 시간대는 11자를 자동으로 추가하고, 작업 이름의 최대 길이는 63자라는 제약 조건이 있기 때문이다. - - ## 크론잡 @@ -78,6 +76,14 @@ Cannot determine if job needs to be started. Too many missed start time (> 100). 크론잡은 오직 그 일정에 맞는 잡 생성에 책임이 있고, 잡은 그 잡이 대표하는 파드 관리에 책임이 있다. +## 새 컨트롤러 + +쿠버네티스 1.20부터 알파 기능으로 사용할 수 있는 크론잡 컨트롤러의 대체 구현이 있다. 크론잡 컨트롤러의 버전 2를 선택하려면, 다음의 [기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/) 플래그를 {{< glossary_tooltip term_id="kube-controller-manager" text="kube-controller-manager" >}}에 전달한다. + +``` +--feature-gates="CronJobControllerV2=true" +``` + ## {{% heading "whatsnext" %}} diff --git a/content/ko/docs/concepts/workloads/controllers/daemonset.md b/content/ko/docs/concepts/workloads/controllers/daemonset.md index 3fd5f2830a..589fe7c1dd 100644 --- a/content/ko/docs/concepts/workloads/controllers/daemonset.md +++ b/content/ko/docs/concepts/workloads/controllers/daemonset.md @@ -81,12 +81,6 @@ kubectl apply -f https://k8s.io/examples/controllers/daemonset.yaml 만약 `.spec.selector` 를 명시하면, 이것은 `.spec.template.metadata.labels` 와 일치해야 한다. 일치하지 않는 구성은 API에 의해 거부된다. -또한 일반적으로 다른 데몬셋이나 레플리카셋과 같은 다른 컨트롤러를 통해 직접적으로 -레이블이 셀렉터와 일치하는 다른 파드를 생성하지 않아야 한다. 그렇지 않으면 데몬셋 -{{< glossary_tooltip term_id="controller" text="컨트롤러" >}}는 해당 파드가 생성된 것으로 생각한다. 쿠버네티스는 이런 일을 하는 것을 -막지 못한다. 사용자가 이와 같은 일을 하게 되는 한 가지 경우는 테스트를 목적으로 한 노드에서 다른 값을 가지는 파드들을 -수동으로 생성하는 것이다. - ### 오직 일부 노드에서만 파드 실행 만약 `.spec.template.spec.nodeSelector` 를 명시하면 데몬셋 컨트롤러는 diff --git a/content/ko/docs/concepts/workloads/controllers/deployment.md b/content/ko/docs/concepts/workloads/controllers/deployment.md index 0c6a278031..779fcfbe34 100644 --- a/content/ko/docs/concepts/workloads/controllers/deployment.md +++ b/content/ko/docs/concepts/workloads/controllers/deployment.md @@ -95,7 +95,7 @@ kubectl apply -f https://k8s.io/examples/controllers/nginx-deployment.yaml `.spec.replicas` 필드에 따라 의도한 레플리카의 수가 3개인지 알 수 있다. -3. 디플로이먼트의 롤아웃 상태를 보려면, `kubectl rollout status deployment.v1.apps/nginx-deployment` 를 실행한다. +3. 디플로이먼트의 롤아웃 상태를 보려면, `kubectl rollout status deployment/nginx-deployment` 를 실행한다. 다음과 유사하게 출력된다. ``` @@ -194,7 +194,7 @@ kubectl apply -f https://k8s.io/examples/controllers/nginx-deployment.yaml 2. 롤아웃 상태를 보려면 다음을 실행한다. ```shell - kubectl rollout status deployment.v1.apps/nginx-deployment + kubectl rollout status deployment/nginx-deployment ``` 이와 유사하게 출력된다. @@ -373,7 +373,7 @@ API 버전 `apps/v1` 에서 디플로이먼트의 레이블 셀렉터는 생성 ```shell - kubectl rollout status deployment.v1.apps/nginx-deployment + kubectl rollout status deployment/nginx-deployment ``` 이와 유사하게 출력된다. @@ -850,7 +850,7 @@ nginx-deployment-618515232 11 11 11 7m 만약 롤아웃이 성공적으로 완료되면 `kubectl rollout status` 는 종료 코드로 0이 반환된다. ```shell -kubectl rollout status deployment.v1.apps/nginx-deployment +kubectl rollout status deployment/nginx-deployment ``` 이와 유사하게 출력된다. ``` diff --git a/content/ko/docs/concepts/workloads/controllers/garbage-collection.md b/content/ko/docs/concepts/workloads/controllers/garbage-collection.md index cf6641958e..a93b455948 100644 --- a/content/ko/docs/concepts/workloads/controllers/garbage-collection.md +++ b/content/ko/docs/concepts/workloads/controllers/garbage-collection.md @@ -59,11 +59,22 @@ metadata: ``` {{< note >}} -교차 네임스페이스(cross-namespace)의 소유자 참조는 디자인상 허용되지 않는다. 이는 다음을 의미한다. -1) 네임스페이스 범위의 종속 항목은 동일한 네임스페이스의 소유자와 -클러스터 범위의 소유자만 지정할 수 있다. -2) 클러스터 범위의 종속 항목은 클러스터 범위의 소유자만 지정할 수 있으며, -네임스페이스 범위의 소유자는 불가하다. +교차 네임스페이스(cross-namespace)의 소유자 참조는 디자인상 허용되지 않는다. + +네임스페이스 종속 항목은 클러스터 범위 또는 네임스페이스 소유자를 지정할 수 있다. +네임스페이스 소유자는 **반드시** 종속 항목과 동일한 네임스페이스에 있어야 한다. +그렇지 않은 경우, 소유자 참조는 없는 것으로 처리되며, 소유자가 없는 것으로 확인되면 +종속 항목이 삭제될 수 있다. + +클러스터 범위의 종속 항목은 클러스터 범위의 소유자만 지정할 수 있다. +v1.20 이상에서 클러스터 범위의 종속 항목이 네임스페이스 종류를 소유자로 지정하면, +확인할 수 없는 소유자 참조가 있는 것으로 처리되고 가비지 수집이 될 수 없다. + +v1.20 이상에서 가비지 수집기가 잘못된 교차 네임스페이스 `ownerReference` +또는 네임스페이스 종류를 참조하는 `ownerReference` 가 있는 클러스터 범위의 종속 항목을 감지하면, +`OwnerRefInvalidNamespace` 의 원인이 있는 경고 이벤트와 유효하지 않은 종속 항목의 `involvedObject` 가 보고된다. +`kubectl get events -A --field-selector=reason=OwnerRefInvalidNamespace` 를 실행하여 +이러한 종류의 이벤트를 확인할 수 있다. {{< /note >}} ## 가비지 수집기의 종속 항목 삭제 방식 제어 diff --git a/content/ko/docs/concepts/workloads/pods/_index.md b/content/ko/docs/concepts/workloads/pods/_index.md index 5bbcb0e1c2..6dce0bfcee 100644 --- a/content/ko/docs/concepts/workloads/pods/_index.md +++ b/content/ko/docs/concepts/workloads/pods/_index.md @@ -255,7 +255,6 @@ kubelet은 자동으로 각 정적 파드에 대한 쿠버네티스 API 서버 ## {{% heading "whatsnext" %}} * [파드의 라이프사이클](/ko/docs/concepts/workloads/pods/pod-lifecycle/)에 대해 알아본다. -* [PodPresets](/ko/docs/concepts/workloads/pods/podpreset/)에 대해 알아본다. * [런타임클래스(RuntimeClass)](/ko/docs/concepts/containers/runtime-class/)와 이를 사용하여 다양한 컨테이너 런타임 구성으로 다양한 파드를 설정하는 방법에 대해 알아본다. * [파드 토폴로지 분배 제약 조건](/ko/docs/concepts/workloads/pods/pod-topology-spread-constraints/)에 대해 읽어본다. diff --git a/content/ko/docs/concepts/workloads/pods/ephemeral-containers.md b/content/ko/docs/concepts/workloads/pods/ephemeral-containers.md index 20977e4e94..27e48b192f 100644 --- a/content/ko/docs/concepts/workloads/pods/ephemeral-containers.md +++ b/content/ko/docs/concepts/workloads/pods/ephemeral-containers.md @@ -87,7 +87,7 @@ API에서 특별한 `ephemeralcontainers` 핸들러를 사용해서 만들어지 {{< /note >}} 이 섹션의 예시는 임시 컨테이너가 어떻게 API에 나타나는지 -보여준다. 일반적으로 `kubectl alpha debug` 또는 +보여준다. 일반적으로 `kubectl debug` 또는 다른 `kubectl` [플러그인](/ko/docs/tasks/extend-kubectl/kubectl-plugins/)을 사용해서 API를 직접 호출하지 않고 이런 단계들을 자동화 한다. diff --git a/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md b/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md index e80c36aee4..0c4ea5960c 100644 --- a/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md +++ b/content/ko/docs/concepts/workloads/pods/pod-lifecycle.md @@ -316,7 +316,7 @@ kubelet은 실행 중인 컨테이너들에 대해서 선택적으로 세 가지 ### 언제 스타트업 프로브를 사용해야 하는가? -{{< feature-state for_k8s_version="v1.18" state="beta" >}} +{{< feature-state for_k8s_version="v1.20" state="stable" >}} 스타트업 프로브는 서비스를 시작하는 데 오랜 시간이 걸리는 컨테이너가 있는 파드에 유용하다. 긴 활성 간격을 설정하는 대신, 컨테이너가 시작될 때 diff --git a/content/ko/docs/concepts/workloads/pods/pod-topology-spread-constraints.md b/content/ko/docs/concepts/workloads/pods/pod-topology-spread-constraints.md index a0a3a0ae77..2cd28660d0 100644 --- a/content/ko/docs/concepts/workloads/pods/pod-topology-spread-constraints.md +++ b/content/ko/docs/concepts/workloads/pods/pod-topology-spread-constraints.md @@ -310,6 +310,7 @@ profiles: - maxSkew: 1 topologyKey: topology.kubernetes.io/zone whenUnsatisfiable: ScheduleAnyway + defaultingType: List ``` {{< note >}} @@ -322,9 +323,9 @@ profiles: #### 내부 기본 제약 -{{< feature-state for_k8s_version="v1.19" state="alpha" >}} +{{< feature-state for_k8s_version="v1.20" state="beta" >}} -`DefaultPodTopologySpread` 기능 게이트를 활성화하면, 기존 +기본적으로 활성화된 `DefaultPodTopologySpread` 기능 게이트를 사용하면, 기존 `SelectorSpread` 플러그인이 비활성화된다. kube-scheduler는 `PodTopologySpread` 플러그인 구성에 다음과 같은 기본 토폴로지 제약 조건을 사용한다. @@ -351,6 +352,22 @@ defaultConstraints: 없는 노드에 점수를 매기지 않는다. {{< /note >}} +클러스터에 기본 파드 분배 제약 조건을 사용하지 않으려면, +`PodTopologySpread` 플러그인 구성에서 `defaultingType` 을 `List` 로 설정하고 +`defaultConstraints` 를 비워두어 기본값을 비활성화할 수 있다. + +```yaml +apiVersion: kubescheduler.config.k8s.io/v1beta1 +kind: KubeSchedulerConfiguration + +profiles: + - pluginConfig: + - name: PodTopologySpread + args: + defaultConstraints: [] + defaultingType: List +``` + ## 파드어피니티(PodAffinity)/파드안티어피니티(PodAntiAffinity)와의 비교 쿠버네티스에서 "어피니티(Affinity)"와 관련된 지침은 파드가 diff --git a/content/ko/docs/concepts/workloads/pods/podpreset.md b/content/ko/docs/concepts/workloads/pods/podpreset.md deleted file mode 100644 index 6fad15ece7..0000000000 --- a/content/ko/docs/concepts/workloads/pods/podpreset.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: 파드 프리셋 -content_type: concept -weight: 50 ---- - - -{{< feature-state for_k8s_version="v1.6" state="alpha" >}} - -이 페이지는 파드프리셋(PodPreset)에 대한 개요를 제공한다. 파드프리셋은 파드 생성 시간에 파드에 -특정 정보를 주입하기 위한 오브젝트이다. 해당 정보에는 -시크릿, 볼륨, 볼륨 마운트, 환경 변수가 포함될 수 있다. - - - - -## 파드 프리셋 이해하기 - -파드프리셋은 파드 생성 시간에 파드에 추가적인 런타임 요구사항을 -주입하기 위한 API 리소스이다. -주어진 파드프리셋이 적용되도록 파드에 명시하기 위해서는 -[레이블 셀렉터](/ko/docs/concepts/overview/working-with-objects/labels/#레이블-셀렉터)를 사용한다. - -파드프리셋을 사용하는 것은 파드 템플릿 작성자에게 모든 파드를 위한 모든 정보를 명시적으로 -제공하지는 않아도 되도록 한다. 이렇게 하면, 어떤 특정 서비스를 사용할 파드의 파드 -템플릿 작성자는 해당 서비스에 대한 모든 세부 사항을 알 필요가 없다. - - -## 클러스터에서 파드프리셋 활성화하기 {#enable-pod-preset} - -클러스터에서 파드 프리셋을 사용하기 위해서는 다음 사항이 반드시 이행되어야 한다. - -1. API 타입 `settings.k8s.io/v1alpha1/podpreset`을 활성화하였다. - 예를 들면, 이것은 API 서버의 `--runtime-config` 옵션에 `settings.k8s.io/v1alpha1=true`을 포함하여 완료할 수 있다. - minikube에서는 클러스터가 시작할 때 - `--extra-config=apiserver.runtime-config=settings.k8s.io/v1alpha1=true` - 플래그를 추가한다. -1. 어드미션 컨트롤러 `PodPreset`을 활성화하였다. 이것을 이루는 방법 중 하나는 - API 서버를 위해서 명시된 `--enable-admission-plugins` 옵션에 `PodPreset`을 포함하는 것이다. - minikube에서는 클러스터가 시작할 때 - - ```shell - --extra-config=apiserver.enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,PodPreset - ``` - - 플래그를 추가한다. - -## 어떻게 동작하는가 - -쿠버네티스는 어드미션 컨트롤러(`PodPreset`)를 제공한다. 어드미션 컨트롤러가 활성화되면, -파드 프리셋을 파드 생성 요청에 적용한다. -파드 생성 요청이 발생하면, 시스템은 다음의 내용을 수행한다. - -1. 사용 가능한 모든 `PodPresets`을 검색한다. -1. `PodPreset`의 레이블 셀렉터들 중 하나라도 생성되는 파드의 레이블과 일치하는 - 것이 있는지 확인한다. -1. `PodPreset`에 의해서 정의된 다양한 리소스가 생성되는 파드에 - 병합되도록 시도한다. -1. 오류 시, 파드의 병합 오류를 문서화하는 이벤트를 발생시키고, `PodPreset`으로 - 부터 주입된 어떤 리소스도 _없이_ 파드를 생성한다. -1. 수정된 파드 스펙의 결과에 어노테이션을 달아 `PodPreset`에 의해서 - 수정되었음을 표시한다. 해당 어노테이션은 다음의 양식을 따른다. - `podpreset.admission.kubernetes.io/podpreset-<파드-프리셋 이름>: "<리소스 버전>"`. - -각 파드는 0개 이상의 파드프리셋에 일치될 수 있고, 각 파드프리셋은 0개 이상의 -파드에 적용될 수 있다. 하나의 파드프리셋이 한 개 이상의 파드에 적용되었을 -때, 쿠버네티스는 해당 파드의 스펙을 수정한다. `env`, `envFrom`, `volumeMounts`의 -변경에 대해서는, 쿠버네티스가 파드 내의 모든 컨테이너의 컨테이너 스펙을 -수정한다. `volume` 변경에 대해서는, 쿠버네티스는 해당 파드의 스펙을 수정한다. - -{{< note >}} -파드 프리셋은 적절한 경우 파드 스펙의 다음 필드를 수정할 수도 있다. -- `.spec.containers` 필드 -- `.spec.initContainers` 필드 -{{< /note >}} - -### 특정 파드의 파드 프리셋 비활성화하기 - -어떠한 파드 프리셋 변이에 의해서도 파드에 변경이 일어나지 않게 하고 싶은 경우가 -있을 것이다. 이 경우에는, 다음과 같은 양식으로 어노테이션을 파드의 `.spec` 에 -추가한다. `podpreset.admission.kubernetes.io/exclude: "true"`. - - - -## {{% heading "whatsnext" %}} - -[파드프리셋을 사용하여 파드에 데이터 주입하기](/docs/tasks/inject-data-application/podpreset/)를 본다. - -배경에 대한 자세한 정보를 위해서는, [파드프리셋을 위한 디자인 제안](https://git.k8s.io/community/contributors/design-proposals/service-catalog/pod-preset.md)을 본다. diff --git a/content/ko/docs/reference/access-authn-authz/service-accounts-admin.md b/content/ko/docs/reference/access-authn-authz/service-accounts-admin.md index 4e4c1c2fb8..f9bc6a1112 100644 --- a/content/ko/docs/reference/access-authn-authz/service-accounts-admin.md +++ b/content/ko/docs/reference/access-authn-authz/service-accounts-admin.md @@ -48,6 +48,20 @@ weight: 50 파드가 생성되거나 수정될 때 파드를 수정하기 위해 동기적으로 동작한다. 이 플러그인이 활성 상태(대부분의 배포에서 기본값)인 경우 파드 생성 또는 수정 시 다음 작업을 수행한다. + 1. 파드에 `ServiceAccount` 가 없다면, `ServiceAccount` 를 `default` 로 설정한다. + 1. 파드에 참조되는 `ServiceAccount` 가 있도록 하고, 그렇지 않으면 이를 거부한다. + 1. 파드에 `ImagePullSecrets` 이 없는 경우, `ServiceAccount` 의 `ImagePullSecrets` 이 파드에 추가된다. + 1. 파드에 API 접근을 위한 토큰이 포함된 `volume` 을 추가한다. + 1. `/var/run/secrets/kubernetes.io/serviceaccount` 에 마운트된 파드의 각 컨테이너에 `volumeSource` 를 추가한다. + +#### 바인딩된 서비스 어카운트 토큰 볼륨 +{{< feature-state for_k8s_version="v1.13" state="alpha" >}} + +`BoundServiceAccountTokenVolume` 기능 게이트가 활성화되면, 서비스 어카운트 어드미션 컨트롤러가 +시크릿 볼륨 대신 프로젝티드 서비스 어카운트 토큰 볼륨을 추가한다. 서비스 어카운트 토큰은 기본적으로 1시간 후에 만료되거나 파드가 삭제된다. [프로젝티드 볼륨](/docs/tasks/configure-pod-container/configure-projected-volume-storage/)에 대한 자세한 내용을 참고한다. + +이 기능은 모든 네임스페이스에 "kube-root-ca.crt" 컨피그맵을 게시하는 활성화된 `RootCAConfigMap` 기능 게이트에 따라 다르다. 이 컨피그맵에는 kube-apiserver에 대한 연결을 확인하는 데 사용되는 CA 번들이 포함되어 있다. + 1. 파드에 `serviceAccountName`가 없다면, `serviceAccountName`를 `default`로 설정한다. 1. 파드에 참조되는 `serviceAccountName`가 있도록 하고, 그렇지 않으면 diff --git a/content/ko/docs/reference/command-line-tools-reference/feature-gates.md b/content/ko/docs/reference/command-line-tools-reference/feature-gates.md index bb6f839d86..78d54badce 100644 --- a/content/ko/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/ko/docs/reference/command-line-tools-reference/feature-gates.md @@ -51,8 +51,10 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `AnyVolumeDataSource` | `false` | 알파 | 1.18 | | | `APIListChunking` | `false` | 알파 | 1.8 | 1.8 | | `APIListChunking` | `true` | 베타 | 1.9 | | -| `APIPriorityAndFairness` | `false` | 알파 | 1.17 | | +| `APIPriorityAndFairness` | `false` | 알파 | 1.17 | 1.19 | +| `APIPriorityAndFairness` | `true` | 베타 | 1.20 | | | `APIResponseCompression` | `false` | 알파 | 1.7 | | +| `APIServerIdentity` | `false` | 알파 | 1.20 | | | `AppArmor` | `true` | 베타 | 1.4 | | | `BalanceAttachedNodeVolumes` | `false` | 알파 | 1.11 | | | `BoundServiceAccountTokenVolume` | `false` | 알파 | 1.13 | | @@ -79,14 +81,23 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `CSIMigrationOpenStackComplete` | `false` | 알파 | 1.17 | | | `CSIMigrationvSphere` | `false` | 베타 | 1.19 | | | `CSIMigrationvSphereComplete` | `false` | 베타 | 1.19 | | +| `CSIServiceAccountToken` | `false` | 알파 | 1.20 | | | `CSIStorageCapacity` | `false` | 알파 | 1.19 | | -| `CSIVolumeFSGroupPolicy` | `false` | 알파 | 1.19 | | -| `ConfigurableFSGroupPolicy` | `false` | 알파 | 1.18 | | +| `CSIVolumeFSGroupPolicy` | `false` | 알파 | 1.19 | 1.19 | +| `CSIVolumeFSGroupPolicy` | `true` | 베타 | 1.20 | | +| `ConfigurableFSGroupPolicy` | `false` | 알파 | 1.18 | 1.19 | +| `ConfigurableFSGroupPolicy` | `true` | 베타 | 1.20 | | +| `CronJobControllerV2` | `false` | 알파 | 1.20 | | | `CustomCPUCFSQuotaPeriod` | `false` | 알파 | 1.12 | | -| `DefaultPodTopologySpread` | `false` | 알파 | 1.19 | | +| `CustomResourceDefaulting` | `false` | 알파| 1.15 | 1.15 | +| `CustomResourceDefaulting` | `true` | 베타 | 1.16 | | +| `DefaultPodTopologySpread` | `false` | 알파 | 1.19 | 1.19 | +| `DefaultPodTopologySpread` | `true` | 베타 | 1.20 | | | `DevicePlugins` | `false` | 알파 | 1.8 | 1.9 | | `DevicePlugins` | `true` | 베타 | 1.10 | | -| `DisableAcceleratorUsageMetrics` | `false` | 알파 | 1.19 | 1.20 | +| `DisableAcceleratorUsageMetrics` | `false` | 알파 | 1.19 | 1.19 | +| `DisableAcceleratorUsageMetrics` | `true` | 베타 | 1.20 | 1.22 | +| `DownwardAPIHugePages` | `false` | 알파 | 1.20 | | | `DryRun` | `false` | 알파 | 1.12 | 1.12 | | `DryRun` | `true` | 베타 | 1.13 | | | `DynamicKubeletConfig` | `false` | 알파 | 1.4 | 1.10 | @@ -94,7 +105,10 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `EndpointSlice` | `false` | 알파 | 1.16 | 1.16 | | `EndpointSlice` | `false` | 베타 | 1.17 | | | `EndpointSlice` | `true` | 베타 | 1.18 | | -| `EndpointSliceProxying` | `false` | 알파 | 1.18 | | +| `EndpointSliceNodeName` | `false` | 알파 | 1.20 | | +| `EndpointSliceProxying` | `false` | 알파 | 1.18 | 1.18 | +| `EndpointSliceProxying` | `true` | 베타 | 1.19 | | +| `EndpointSliceTerminating` | `false` | 알파 | 1.20 | | | `EphemeralContainers` | `false` | 알파 | 1.16 | | | `ExpandCSIVolumes` | `false` | 알파 | 1.14 | 1.15 | | `ExpandCSIVolumes` | `true` | 베타 | 1.16 | | @@ -104,6 +118,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `ExpandPersistentVolumes` | `true` | 베타 | 1.11 | | | `ExperimentalHostUserNamespaceDefaulting` | `false` | 베타 | 1.5 | | | `GenericEphemeralVolume` | `false` | 알파 | 1.19 | | +| `GracefulNodeShutdown` | `false` | 알파 | 1.20 | | | `HPAScaleToZero` | `false` | 알파 | 1.16 | | | `HugePageStorageMediumSize` | `false` | 알파 | 1.18 | 1.18 | | `HugePageStorageMediumSize` | `true` | 베타 | 1.19 | | @@ -111,12 +126,11 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `ImmutableEphemeralVolumes` | `false` | 알파 | 1.18 | 1.18 | | `ImmutableEphemeralVolumes` | `true` | 베타 | 1.19 | | | `IPv6DualStack` | `false` | 알파 | 1.16 | | -| `KubeletPodResources` | `false` | 알파 | 1.13 | 1.14 | -| `KubeletPodResources` | `true` | 베타 | 1.15 | | | `LegacyNodeRoleBehavior` | `true` | 알파 | 1.16 | | | `LocalStorageCapacityIsolation` | `false` | 알파 | 1.7 | 1.9 | | `LocalStorageCapacityIsolation` | `true` | 베타 | 1.10 | | | `LocalStorageCapacityIsolationFSQuotaMonitoring` | `false` | 알파 | 1.15 | | +| `MixedProtocolLBService` | `false` | 알파 | 1.20 | | | `MountContainers` | `false` | 알파 | 1.9 | | | `NodeDisruptionExclusion` | `false` | 알파 | 1.16 | 1.18 | | `NodeDisruptionExclusion` | `true` | 베타 | 1.19 | | @@ -124,10 +138,13 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `NonPreemptingPriority` | `true` | 베타 | 1.19 | | | `PodDisruptionBudget` | `false` | 알파 | 1.3 | 1.4 | | `PodDisruptionBudget` | `true` | 베타 | 1.5 | | -| `PodOverhead` | `false` | 알파 | 1.16 | - | +| `PodOverhead` | `false` | 알파 | 1.16 | 1.17 | +| `PodOverhead` | `true` | 베타 | 1.18 | | | `ProcMountType` | `false` | 알파 | 1.12 | | | `QOSReserved` | `false` | 알파 | 1.11 | | | `RemainingItemCount` | `false` | 알파 | 1.15 | | +| `RootCAConfigMap` | `false` | 알파 | 1.13 | 1.19 | +| `RootCAConfigMap` | `true` | 베타 | 1.20 | | | `RotateKubeletServerCertificate` | `false` | 알파 | 1.7 | 1.11 | | `RotateKubeletServerCertificate` | `true` | 베타 | 1.12 | | | `RunAsGroup` | `true` | 베타 | 1.14 | | @@ -137,32 +154,21 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `SCTPSupport` | `true` | 베타 | 1.19 | | | `ServerSideApply` | `false` | 알파 | 1.14 | 1.15 | | `ServerSideApply` | `true` | 베타 | 1.16 | | -| `ServiceAccountIssuerDiscovery` | `false` | Alpha | 1.18 | | -| `ServiceAppProtocol` | `false` | 알파 | 1.18 | 1.18 | -| `ServiceAppProtocol` | `true` | 베타 | 1.19 | | +| `ServiceAccountIssuerDiscovery` | `false` | 알파 | 1.18 | | +| `ServiceLBNodePortControl` | `false` | 알파 | 1.20 | 1.20 | | `ServiceNodeExclusion` | `false` | 알파 | 1.8 | 1.18 | | `ServiceNodeExclusion` | `true` | 베타 | 1.19 | | | `ServiceTopology` | `false` | 알파 | 1.17 | | -| `SetHostnameAsFQDN` | `false` | 알파 | 1.19 | | -| `StartupProbe` | `false` | 알파 | 1.16 | 1.17 | -| `StartupProbe` | `true` | 베타 | 1.18 | | +| `SizeMemoryBackedVolumes` | `false` | 알파 | 1.20 | | +| `SetHostnameAsFQDN` | `false` | 알파 | 1.19 | 1.19 | +| `SetHostnameAsFQDN` | `true` | 베타 | 1.20 | | | `StorageVersionHash` | `false` | 알파 | 1.14 | 1.14 | | `StorageVersionHash` | `true` | 베타 | 1.15 | | -| `SupportNodePidsLimit` | `false` | 알파 | 1.14 | 1.14 | -| `SupportNodePidsLimit` | `true` | 베타 | 1.15 | | -| `SupportPodPidsLimit` | `false` | 알파 | 1.10 | 1.13 | -| `SupportPodPidsLimit` | `true` | 베타 | 1.14 | | | `Sysctls` | `true` | 베타 | 1.11 | | -| `TokenRequest` | `false` | 알파 | 1.10 | 1.11 | -| `TokenRequest` | `true` | 베타 | 1.12 | | -| `TokenRequestProjection` | `false` | 알파 | 1.11 | 1.11 | -| `TokenRequestProjection` | `true` | 베타 | 1.12 | | | `TTLAfterFinished` | `false` | 알파 | 1.12 | | | `TopologyManager` | `false` | 알파 | 1.16 | | | `ValidateProxyRedirects` | `false` | 알파 | 1.12 | 1.13 | | `ValidateProxyRedirects` | `true` | 베타 | 1.14 | | -| `VolumeSnapshotDataSource` | `false` | 알파 | 1.12 | 1.16 | -| `VolumeSnapshotDataSource` | `true` | 베타 | 1.17 | - | | `WindowsEndpointSliceProxying` | `false` | 알파 | 1.19 | | | `WindowsGMSA` | `false` | 알파 | 1.14 | | | `WindowsGMSA` | `true` | 베타 | 1.16 | | @@ -177,12 +183,12 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | 기능 | 디폴트 | 단계 | 도입 | 종료 | |---------|---------|-------|-------|-------| | `Accelerators` | `false` | 알파 | 1.6 | 1.10 | -| `Accelerators` | - | 사용 중단 | 1.11 | - | +| `Accelerators` | - | 사용중단 | 1.11 | - | | `AdvancedAuditing` | `false` | 알파 | 1.7 | 1.7 | | `AdvancedAuditing` | `true` | 베타 | 1.8 | 1.11 | | `AdvancedAuditing` | `true` | GA | 1.12 | - | | `AffinityInAnnotations` | `false` | 알파 | 1.6 | 1.7 | -| `AffinityInAnnotations` | - | 사용 중단 | 1.8 | - | +| `AffinityInAnnotations` | - | 사용중단 | 1.8 | - | | `AllowExtTrafficLocalEndpoints` | `false` | 베타 | 1.4 | 1.6 | | `AllowExtTrafficLocalEndpoints` | `true` | GA | 1.7 | - | | `BlockVolume` | `false` | 알파 | 1.9 | 1.12 | @@ -206,7 +212,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `CustomPodDNS` | `false` | 알파 | 1.9 | 1.9 | | `CustomPodDNS` | `true` | 베타| 1.10 | 1.13 | | `CustomPodDNS` | `true` | GA | 1.14 | - | -| `CustomResourceDefaulting` | `false` | 알파 | 1.15 | 1.15 | +| `CustomResourceDefaulting` | `false` | 알파| 1.15 | 1.15 | | `CustomResourceDefaulting` | `true` | 베타 | 1.16 | 1.16 | | `CustomResourceDefaulting` | `true` | GA | 1.17 | - | | `CustomResourcePublishOpenAPI` | `false` | 알파| 1.14 | 1.14 | @@ -222,30 +228,35 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `CustomResourceWebhookConversion` | `true` | 베타 | 1.15 | 1.15 | | `CustomResourceWebhookConversion` | `true` | GA | 1.16 | - | | `DynamicAuditing` | `false` | 알파 | 1.13 | 1.18 | -| `DynamicAuditing` | - | 사용 중단 | 1.19 | - | +| `DynamicAuditing` | - | 사용중단 | 1.19 | - | | `DynamicProvisioningScheduling` | `false` | 알파 | 1.11 | 1.11 | -| `DynamicProvisioningScheduling` | - | 사용 중단| 1.12 | - | +| `DynamicProvisioningScheduling` | - | 사용중단| 1.12 | - | | `DynamicVolumeProvisioning` | `true` | 알파 | 1.3 | 1.7 | | `DynamicVolumeProvisioning` | `true` | GA | 1.8 | - | | `EnableEquivalenceClassCache` | `false` | 알파 | 1.8 | 1.14 | -| `EnableEquivalenceClassCache` | - | 사용 중단 | 1.15 | - | +| `EnableEquivalenceClassCache` | - | 사용중단 | 1.15 | - | | `ExperimentalCriticalPodAnnotation` | `false` | 알파 | 1.5 | 1.12 | -| `ExperimentalCriticalPodAnnotation` | `false` | 사용 중단 | 1.13 | - | +| `ExperimentalCriticalPodAnnotation` | `false` | 사용중단 | 1.13 | - | | `EvenPodsSpread` | `false` | 알파 | 1.16 | 1.17 | | `EvenPodsSpread` | `true` | 베타 | 1.18 | 1.18 | | `EvenPodsSpread` | `true` | GA | 1.19 | - | +| `ExecProbeTimeout` | `true` | GA | 1.20 | - | | `GCERegionalPersistentDisk` | `true` | 베타 | 1.10 | 1.12 | | `GCERegionalPersistentDisk` | `true` | GA | 1.13 | - | | `HugePages` | `false` | 알파 | 1.8 | 1.9 | | `HugePages` | `true` | 베타| 1.10 | 1.13 | | `HugePages` | `true` | GA | 1.14 | - | | `Initializers` | `false` | 알파 | 1.7 | 1.13 | -| `Initializers` | - | 사용 중단 | 1.14 | - | +| `Initializers` | - | 사용중단 | 1.14 | - | | `KubeletConfigFile` | `false` | 알파 | 1.8 | 1.9 | -| `KubeletConfigFile` | - | 사용 중단 | 1.10 | - | +| `KubeletConfigFile` | - | 사용중단 | 1.10 | - | +| `KubeletCredentialProviders` | `false` | 알파 | 1.20 | 1.20 | | `KubeletPluginsWatcher` | `false` | 알파 | 1.11 | 1.11 | | `KubeletPluginsWatcher` | `true` | 베타 | 1.12 | 1.12 | | `KubeletPluginsWatcher` | `true` | GA | 1.13 | - | +| `KubeletPodResources` | `false` | 알파 | 1.13 | 1.14 | +| `KubeletPodResources` | `true` | 베타 | 1.15 | | +| `KubeletPodResources` | `true` | GA | 1.20 | | | `MountPropagation` | `false` | 알파 | 1.8 | 1.9 | | `MountPropagation` | `true` | 베타 | 1.10 | 1.11 | | `MountPropagation` | `true` | GA | 1.12 | - | @@ -265,36 +276,63 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 | `PodShareProcessNamespace` | `true` | 베타 | 1.12 | 1.16 | | `PodShareProcessNamespace` | `true` | GA | 1.17 | - | | `PVCProtection` | `false` | 알파 | 1.9 | 1.9 | -| `PVCProtection` | - | 사용 중단 | 1.10 | - | +| `PVCProtection` | - | 사용중단 | 1.10 | - | | `RequestManagement` | `false` | 알파 | 1.15 | 1.16 | | `ResourceLimitsPriorityFunction` | `false` | 알파 | 1.9 | 1.18 | -| `ResourceLimitsPriorityFunction` | - | 사용 중단 | 1.19 | - | +| `ResourceLimitsPriorityFunction` | - | 사용중단 | 1.19 | - | | `ResourceQuotaScopeSelectors` | `false` | 알파 | 1.11 | 1.11 | | `ResourceQuotaScopeSelectors` | `true` | 베타 | 1.12 | 1.16 | | `ResourceQuotaScopeSelectors` | `true` | GA | 1.17 | - | | `RotateKubeletClientCertificate` | `true` | 베타 | 1.8 | 1.18 | | `RotateKubeletClientCertificate` | `true` | GA | 1.19 | - | +| `RuntimeClass` | `false` | 알파 | 1.12 | 1.13 | +| `RuntimeClass` | `true` | 베타 | 1.14 | 1.19 | +| `RuntimeClass` | `true` | GA | 1.20 | - | | `ScheduleDaemonSetPods` | `false` | 알파 | 1.11 | 1.11 | | `ScheduleDaemonSetPods` | `true` | 베타 | 1.12 | 1.16 | | `ScheduleDaemonSetPods` | `true` | GA | 1.17 | - | +| `SCTPSupport` | `false` | 알파 | 1.12 | 1.18 | +| `SCTPSupport` | `true` | 베타 | 1.19 | 1.19 | +| `SCTPSupport` | `true` | GA | 1.20 | - | +| `ServiceAppProtocol` | `false` | 알파 | 1.18 | 1.18 | +| `ServiceAppProtocol` | `true` | 베타 | 1.19 | | +| `ServiceAppProtocol` | `true` | GA | 1.20 | - | | `ServiceLoadBalancerFinalizer` | `false` | 알파 | 1.15 | 1.15 | | `ServiceLoadBalancerFinalizer` | `true` | 베타 | 1.16 | 1.16 | | `ServiceLoadBalancerFinalizer` | `true` | GA | 1.17 | - | +| `StartupProbe` | `false` | 알파 | 1.16 | 1.17 | +| `StartupProbe` | `true` | 베타 | 1.18 | 1.19 | +| `StartupProbe` | `true` | GA | 1.20 | - | | `StorageObjectInUseProtection` | `true` | 베타 | 1.10 | 1.10 | | `StorageObjectInUseProtection` | `true` | GA | 1.11 | - | | `StreamingProxyRedirects` | `false` | 베타 | 1.5 | 1.5 | | `StreamingProxyRedirects` | `true` | 베타 | 1.6 | 1.18 | -| `StreamingProxyRedirects` | - | 사용 중단| 1.19 | - | +| `StreamingProxyRedirects` | - | 사용중단| 1.19 | - | | `SupportIPVSProxyMode` | `false` | 알파 | 1.8 | 1.8 | | `SupportIPVSProxyMode` | `false` | 베타 | 1.9 | 1.9 | | `SupportIPVSProxyMode` | `true` | 베타 | 1.10 | 1.10 | | `SupportIPVSProxyMode` | `true` | GA | 1.11 | - | +| `SupportNodePidsLimit` | `false` | 알파 | 1.14 | 1.14 | +| `SupportNodePidsLimit` | `true` | 베타 | 1.15 | 1.19 | +| `SupportNodePidsLimit` | `true` | GA | 1.20 | - | +| `SupportPodPidsLimit` | `false` | 알파 | 1.10 | 1.13 | +| `SupportPodPidsLimit` | `true` | 베타 | 1.14 | 1.19 | +| `SupportPodPidsLimit` | `true` | GA | 1.20 | - | | `TaintBasedEvictions` | `false` | 알파 | 1.6 | 1.12 | | `TaintBasedEvictions` | `true` | 베타 | 1.13 | 1.17 | | `TaintBasedEvictions` | `true` | GA | 1.18 | - | | `TaintNodesByCondition` | `false` | 알파 | 1.8 | 1.11 | | `TaintNodesByCondition` | `true` | 베타 | 1.12 | 1.16 | | `TaintNodesByCondition` | `true` | GA | 1.17 | - | +| `TokenRequest` | `false` | 알파 | 1.10 | 1.11 | +| `TokenRequest` | `true` | 베타 | 1.12 | 1.19 | +| `TokenRequest` | `true` | GA | 1.20 | - | +| `TokenRequestProjection` | `false` | 알파 | 1.11 | 1.11 | +| `TokenRequestProjection` | `true` | 베타 | 1.12 | 1.19 | +| `TokenRequestProjection` | `true` | GA | 1.20 | - | +| `VolumeSnapshotDataSource` | `false` | 알파 | 1.12 | 1.16 | +| `VolumeSnapshotDataSource` | `true` | 베타 | 1.17 | 1.19 | +| `VolumeSnapshotDataSource` | `true` | GA | 1.20 | - | | `VolumePVCDataSource` | `false` | 알파 | 1.15 | 1.15 | | `VolumePVCDataSource` | `true` | 베타 | 1.16 | 1.17 | | `VolumePVCDataSource` | `true` | GA | 1.18 | - | @@ -368,6 +406,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `APIListChunking`: API 클라이언트가 API 서버에서 (`LIST` 또는 `GET`) 리소스를 청크(chunks)로 검색할 수 있도록 한다. - `APIPriorityAndFairness`: 각 서버의 우선 순위와 공정성을 통해 동시 요청을 관리할 수 있다. (`RequestManagement` 에서 이름이 변경됨) - `APIResponseCompression`: `LIST` 또는 `GET` 요청에 대한 API 응답을 압축한다. +- `APIServerIdentity`: 클러스터의 각 kube-apiserver에 ID를 할당한다. - `AppArmor`: 도커를 사용할 때 리눅스 노드에서 AppArmor 기반의 필수 접근 제어를 활성화한다. 자세한 내용은 [AppArmor 튜토리얼](/ko/docs/tutorials/clusters/apparmor/)을 참고한다. - `AttachVolumeLimit`: 볼륨 플러그인이 노드에 연결될 수 있는 볼륨 수에 @@ -380,10 +419,13 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 자세한 내용은 [원시 블록 볼륨 지원](/ko/docs/concepts/storage/persistent-volumes/#원시-블록-볼륨-지원)을 참고한다. - `BoundServiceAccountTokenVolume`: ServiceAccountTokenVolumeProjection으로 구성된 프로젝션 볼륨을 사용하도록 서비스어카운트 볼륨을 - 마이그레이션한다. - 자세한 내용은 [서비스 어카운트 토큰 볼륨](https://git.k8s.io/community/contributors/design-proposals/storage/svcacct-token-volume-source.md)을 + 마이그레이션한다. 클러스터 관리자는 `serviceaccount_stale_tokens_total` 메트릭을 사용하여 + 확장 토큰에 의존하는 워크로드를 모니터링 할 수 있다. 이러한 워크로드가 없는 경우 `--service-account-extend-token-expiration=false` 플래그로 + `kube-apiserver`를 시작하여 확장 토큰 기능을 끈다. + 자세한 내용은 [바운드 서비스 계정 토큰](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/1205-bound-service-account-tokens/README.md)을 확인한다. - `ConfigurableFSGroupPolicy`: 파드에 볼륨을 마운트할 때 fsGroups에 대한 볼륨 권한 변경 정책을 구성할 수 있다. 자세한 내용은 [파드에 대한 볼륨 권한 및 소유권 변경 정책 구성](/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods)을 참고한다. +-`CronJobControllerV2` : {{< glossary_tooltip text="크론잡" term_id="cronjob" >}} 컨트롤러의 대체 구현을 사용한다. 그렇지 않으면 동일한 컨트롤러의 버전 1이 선택된다. 버전 2 컨트롤러는 실험적인 성능 향상을 제공한다. - `CPUManager`: 컨테이너 수준의 CPU 어피니티 지원을 활성화한다. [CPU 관리 정책](/docs/tasks/administer-cluster/cpu-management-policies/)을 참고한다. - `CRIContainerLogRotation`: cri 컨테이너 런타임에 컨테이너 로그 로테이션을 활성화한다. - `CSIBlockVolume`: 외부 CSI 볼륨 드라이버가 블록 스토리지를 지원할 수 있게 한다. 자세한 내용은 [`csi` 원시 블록 볼륨 지원](/ko/docs/concepts/storage/volumes/#csi-원시-raw-블록-볼륨-지원) 문서를 참고한다. @@ -406,7 +448,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `CSIPersistentVolume`: [CSI (Container Storage Interface)](https://github.com/kubernetes/community/blob/master/contributors/design-proposals/storage/container-storage-interface.md) 호환 볼륨 플러그인을 통해 프로비저닝된 볼륨을 감지하고 마운트할 수 있다. - 자세한 내용은 [`csi` 볼륨 유형](/ko/docs/concepts/storage/volumes/#csi) 문서를 확인한다. +- `CSIServiceAccountToken` : 볼륨을 마운트하는 파드의 서비스 계정 토큰을 받을 수 있도록 CSI 드라이버를 활성화한다. [토큰 요청](https://kubernetes-csi.github.io/docs/token-requests.html)을 참조한다. - `CSIStorageCapacity`: CSI 드라이버가 스토리지 용량 정보를 게시하고 쿠버네티스 스케줄러가 파드를 스케줄할 때 해당 정보를 사용하도록 한다. [스토리지 용량](/docs/concepts/storage/storage-capacity/)을 참고한다. 자세한 내용은 [`csi` 볼륨 유형](/ko/docs/concepts/storage/volumes/#csi) 문서를 확인한다. - `CSIVolumeFSGroupPolicy`: CSI드라이버가 `fsGroupPolicy` 필드를 사용하도록 허용한다. 이 필드는 CSI드라이버에서 생성된 볼륨이 마운트될 때 볼륨 소유권과 권한 수정을 지원하는지 여부를 제어한다. @@ -423,14 +465,14 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `CustomResourceWebhookConversion`: [커스텀리소스데피니션](/ko/docs/concepts/extend-kubernetes/api-extension/custom-resources/)에서 생성된 리소스에 대해 웹 훅 기반의 변환을 활성화한다. 실행 중인 파드 문제를 해결한다. -- `DisableAcceleratorUsageMetrics`: [kubelet이 수집한 액셀러레이터 지표 비활성화](/ko/docs/concepts/cluster-administration/system-metrics/). +- `DisableAcceleratorUsageMetrics`: [kubelet이 수집한 액셀러레이터 지표 비활성화](/ko/docs/concepts/cluster-administration/system-metrics/#액셀러레이터-메트릭-비활성화). - `DevicePlugins`: 노드에서 [장치 플러그인](/ko/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/) 기반 리소스 프로비저닝을 활성화한다. - `DefaultPodTopologySpread`: `PodTopologySpread` 스케줄링 플러그인을 사용하여 [기본 분배](/ko/docs/concepts/workloads/pods/pod-topology-spread-constraints/#내부-기본-제약)를 수행한다. +- `DownwardAPIHugePages`: 다운워드 API에서 hugepages 사용을 활성화한다. - `DryRun`: 서버 측의 [dry run](/docs/reference/using-api/api-concepts/#dry-run) 요청을 요청을 활성화하여 커밋하지 않고 유효성 검사, 병합 및 변화를 테스트할 수 있다. -- `DynamicAuditing`: [동적 감사](/docs/tasks/debug-application-cluster/audit/#dynamic-backend) 기능을 활성화한다. - `DynamicAuditing`(*사용 중단됨*): v1.19 이전의 버전에서 동적 감사를 활성화하는 데 사용된다. - `DynamicKubeletConfig`: kubelet의 동적 구성을 활성화한다. [kubelet 재구성](/docs/tasks/administer-cluster/reconfigure-kubelet/)을 참고한다. - `DynamicProvisioningScheduling`: 볼륨 스케줄을 인식하고 PV 프로비저닝을 처리하도록 기본 스케줄러를 확장한다. @@ -441,6 +483,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `EphemeralContainers`: 파드를 실행하기 위한 {{< glossary_tooltip text="임시 컨테이너" term_id="ephemeral-container" >}}를 추가할 수 있다. - `EvenPodsSpread`: 토폴로지 도메인 간에 파드를 균등하게 스케줄링할 수 있다. [파드 토폴로지 분배 제약 조건](/ko/docs/concepts/workloads/pods/pod-topology-spread-constraints/)을 참고한다. +-`ExecProbeTimeout` : kubelet이 exec 프로브 시간 초과를 준수하는지 확인한다. 이 기능 게이트는 기존 워크로드가 쿠버네티스가 exec 프로브 제한 시간을 무시한 현재 수정된 결함에 의존하는 경우 존재한다. [준비성 프로브](/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes)를 참조한다. - `ExpandInUsePersistentVolumes`: 사용 중인 PVC를 확장할 수 있다. [사용 중인 퍼시스턴트볼륨클레임 크기 조정](/ko/docs/concepts/storage/persistent-volumes/#사용-중인-퍼시스턴트볼륨클레임-크기-조정)을 참고한다. - `ExpandPersistentVolumes`: 퍼시스턴트 볼륨 확장을 활성화한다. [퍼시스턴트 볼륨 클레임 확장](/ko/docs/concepts/storage/persistent-volumes/#퍼시스턴트-볼륨-클레임-확장)을 참고한다. - `ExperimentalCriticalPodAnnotation`: 특정 파드에 *critical* 로 어노테이션을 달아서 [스케줄링이 보장되도록](/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/) 한다. @@ -452,6 +495,9 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 재 매핑이 활성화된 경우에만 활성화해야 한다. - `EndpointSlice`: 보다 스케일링 가능하고 확장 가능한 네트워크 엔드포인트에 대한 엔드포인트 슬라이스를 활성화한다. [엔드포인트 슬라이스 활성화](/docs/tasks/administer-cluster/enabling-endpointslices/)를 참고한다. +-`EndpointSliceNodeName` : 엔드포인트슬라이스 `nodeName` 필드를 활성화한다. +-`EndpointSliceTerminating` : 엔드포인트슬라이스 `terminating` 및 `serving` 조건 필드를 + 활성화한다. - `EndpointSliceProxying`: 이 기능 게이트가 활성화되면, 리눅스에서 실행되는 kube-proxy는 엔드포인트 대신 엔드포인트슬라이스를 기본 데이터 소스로 사용하여 확장성과 성능을 향상시킨다. @@ -462,6 +508,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 [엔드포인트 슬라이스 활성화](/docs/tasks/administer-cluster/enabling-endpointslices/)를 참고한다. - `GCERegionalPersistentDisk`: GCE에서 지역 PD 기능을 활성화한다. - `GenericEphemeralVolume`: 일반 볼륨의 모든 기능을 지원하는 임시, 인라인 볼륨을 활성화한다(타사 스토리지 공급 업체, 스토리지 용량 추적, 스냅샷으로부터 복원 등에서 제공할 수 있음). [임시 볼륨](/docs/concepts/storage/ephemeral-volumes/)을 참고한다. +-`GracefulNodeShutdown` : kubelet에서 정상 종료를 지원한다. 시스템 종료 중에 kubelet은 종료 이벤트를 감지하고 노드에서 실행중인 파드를 정상적으로 종료하려고 시도한다. 자세한 내용은 [Graceful Node Shutdown](/docs/concepts/architecture/nodes/#graceful-node-shutdown)을 참조한다. - `HugePages`: 사전 할당된 [huge page](/ko/docs/tasks/manage-hugepages/scheduling-hugepages/)의 할당 및 사용을 활성화한다. - `HugePageStorageMediumSize`: 사전 할당된 [huge page](/ko/docs/tasks/manage-hugepages/scheduling-hugepages/)의 여러 크기를 지원한다. - `HyperVContainer`: 윈도우 컨테이너를 위한 [Hyper-V 격리](https://docs.microsoft.com/ko-kr/virtualization/windowscontainers/manage-containers/hyperv-container) 기능을 활성화한다. @@ -469,6 +516,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `ImmutableEphemeralVolumes`: 안정성과 성능 향상을 위해 개별 시크릿(Secret)과 컨피그맵(ConfigMap)을 변경할 수 없는(immutable) 것으로 표시할 수 있다. - `KubeletConfigFile`: 구성 파일을 사용하여 지정된 파일에서 kubelet 구성을 로드할 수 있다. 자세한 내용은 [구성 파일을 통해 kubelet 파라미터 설정](/docs/tasks/administer-cluster/kubelet-config-file/)을 참고한다. +- `KubeletCredentialProviders`: 이미지 풀 자격 증명에 대해 kubelet exec 자격 증명 공급자를 활성화한다. - `KubeletPluginsWatcher`: kubelet이 [CSI 볼륨 드라이버](/ko/docs/concepts/storage/volumes/#csi)와 같은 플러그인을 검색할 수 있도록 프로브 기반 플러그인 감시자(watcher) 유틸리티를 사용한다. - `KubeletPodResources`: kubelet의 파드 리소스 grpc 엔드포인트를 활성화한다. @@ -476,6 +524,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `LegacyNodeRoleBehavior`: 비활성화되면, 서비스 로드 밸런서 및 노드 중단의 레거시 동작은 `NodeDisruptionExclusion` 과 `ServiceNodeExclusion` 에 의해 제공된 기능별 레이블을 대신하여 `node-role.kubernetes.io/master` 레이블을 무시한다. - `LocalStorageCapacityIsolation`: [로컬 임시 스토리지](/ko/docs/concepts/configuration/manage-resources-containers/)와 [emptyDir 볼륨](/ko/docs/concepts/storage/volumes/#emptydir)의 `sizeLimit` 속성을 사용할 수 있게 한다. - `LocalStorageCapacityIsolationFSQuotaMonitoring`: [로컬 임시 스토리지](/ko/docs/concepts/configuration/manage-resources-containers/)에 `LocalStorageCapacityIsolation` 이 활성화되고 [emptyDir 볼륨](/ko/docs/concepts/storage/volumes/#emptydir)의 백업 파일시스템이 프로젝트 쿼터를 지원하고 활성화된 경우, 파일시스템 사용보다는 프로젝트 쿼터를 사용하여 [emptyDir 볼륨](/ko/docs/concepts/storage/volumes/#emptydir) 스토리지 사용을 모니터링하여 성능과 정확성을 향상시킨다. +- `MixedProtocolLBService`: 동일한 로드밸런서 유형 서비스 인스턴스에서 다른 프로토콜 사용을 활성화한다. - `MountContainers`: 호스트의 유틸리티 컨테이너를 볼륨 마운터로 사용할 수 있다. - `MountPropagation`: 한 컨테이너에서 다른 컨테이너 또는 파드로 마운트된 볼륨을 공유할 수 있다. 자세한 내용은 [마운트 전파(propagation)](/ko/docs/concepts/storage/volumes/#마운트-전파-propagation)을 참고한다. @@ -503,6 +552,8 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 스케줄러 우선 순위 기능을 활성화한다. 의도는 동일한 점수를 가진 노드 사이의 관계를 끊는 것이다. - `ResourceQuotaScopeSelectors`: 리소스 쿼터 범위 셀렉터를 활성화한다. +- `RootCAConfigMap`: 모든 네임 스페이스에 `kube-root-ca.crt`라는 {{< glossary_tooltip text="컨피그맵" term_id="configmap" >}}을 게시하도록 kube-controller-manager를 구성한다. 이 컨피그맵에는 kube-apiserver에 대한 연결을 확인하는 데 사용되는 CA 번들이 포함되어 있다. + 자세한 내용은 [바운드 서비스 계정 토큰](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/1205-bound-service-account-tokens/README.md)을 참조한다. - `RotateKubeletClientCertificate`: kubelet에서 클라이언트 TLS 인증서의 로테이션을 활성화한다. 자세한 내용은 [kubelet 구성](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#kubelet-configuration)을 참고한다. - `RotateKubeletServerCertificate`: kubelet에서 서버 TLS 인증서의 로테이션을 활성화한다. @@ -514,10 +565,12 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `ServerSideApply`: API 서버에서 [SSA(Sever Side Apply)](/docs/reference/using-api/server-side-apply/) 경로를 활성화한다. - `ServiceAccountIssuerDiscovery`: API 서버에서 서비스 어카운트 발행자에 대해 OIDC 디스커버리 엔드포인트(발급자 및 JWKS URL)를 활성화한다. 자세한 내용은 [파드의 서비스 어카운트 구성](/docs/tasks/configure-pod-container/configure-service-account/#service-account-issuer-discovery)을 참고한다. - `ServiceAppProtocol`: 서비스와 엔드포인트에서 `AppProtocol` 필드를 활성화한다. +- `ServiceLBNodePortControl`: 서비스에서`spec.allocateLoadBalancerNodePorts` 필드를 활성화한다. - `ServiceLoadBalancerFinalizer`: 서비스 로드 밸런서에 대한 Finalizer 보호를 활성화한다. - `ServiceNodeExclusion`: 클라우드 제공자가 생성한 로드 밸런서에서 노드를 제외할 수 있다. "`alpha.service-controller.kubernetes.io/exclude-balancer`" 키 또는 `node.kubernetes.io/exclude-from-external-load-balancers` 로 레이블이 지정된 경우 노드를 제외할 수 있다. - `ServiceTopology`: 서비스가 클러스터의 노드 토폴로지를 기반으로 트래픽을 라우팅할 수 있도록 한다. 자세한 내용은 [서비스토폴로지(ServiceTopology)](/ko/docs/concepts/services-networking/service-topology/)를 참고한다. +- `SizeMemoryBackedVolumes`: kubelet 지원을 사용하여 메모리 백업 볼륨의 크기를 조정한다. 자세한 내용은 [volumes](/ko/docs/concepts/storage/volumes)를 참조한다. - `SetHostnameAsFQDN`: 전체 주소 도메인 이름(FQDN)을 파드의 호스트 이름으로 설정하는 기능을 활성화한다. [파드의 `setHostnameAsFQDN` 필드](/ko/docs/concepts/services-networking/dns-pod-service/#파드의-sethostnameasfqdn-필드)를 참고한다. - `StartupProbe`: kubelet에서 [스타트업](/ko/docs/concepts/workloads/pods/pod-lifecycle/#언제-스타트업-프로브를-사용해야-하는가) 프로브를 활성화한다. - `StorageObjectInUseProtection`: 퍼시스턴트볼륨 또는 퍼시스턴트볼륨클레임 오브젝트가 여전히 @@ -529,6 +582,7 @@ kubelet과 같은 컴포넌트의 기능 게이트를 설정하려면, 기능 - `SupportIPVSProxyMode`: IPVS를 사용하여 클러스터 내 서비스 로드 밸런싱을 제공한다. 자세한 내용은 [서비스 프록시](/ko/docs/concepts/services-networking/service/#가상-ip와-서비스-프록시)를 참고한다. - `SupportPodPidsLimit`: 파드의 PID 제한을 지원한다. +- `SupportNodePidsLimit`: 노드에서 PID 제한 지원을 활성화한다. `--system-reserved` 및 `--kube-reserved` 옵션의 `pid=` 매개 변수를 지정하여 지정된 수의 프로세스 ID가 시스템 전체와 각각 쿠버네티스 시스템 데몬에 대해 예약되도록 할 수 있다. - `Sysctls`: 각 파드에 설정할 수 있는 네임스페이스 커널 파라미터(sysctl)를 지원한다. 자세한 내용은 [sysctl](/docs/tasks/administer-cluster/sysctl-cluster/)을 참고한다. - `TaintBasedEvictions`: 노드의 테인트(taint) 및 파드의 톨러레이션(toleration)을 기반으로 노드에서 파드를 축출할 수 있다. diff --git a/content/ko/docs/reference/glossary/kube-proxy.md b/content/ko/docs/reference/glossary/kube-proxy.md index a4d5381602..7281e6f4c5 100755 --- a/content/ko/docs/reference/glossary/kube-proxy.md +++ b/content/ko/docs/reference/glossary/kube-proxy.md @@ -23,4 +23,5 @@ tags: 세션이나 클러스터 바깥에서 파드로 네트워크 통신을 할 수 있도록 해준다. -kube-proxy는 운영 체제에 가용한 패킷 필터링 계층이 있는 경우, 이를 사용한다. 그렇지 않으면, kube-proxy는 트래픽 자체를 포워드(forward)한다. +kube-proxy는 운영 체제에 가용한 패킷 +필터링 계층이 있는 경우, 이를 사용한다. 그렇지 않으면, kube-proxy는 트래픽 자체를 포워드(forward)한다. diff --git a/content/ko/docs/reference/glossary/persistent-volume.md b/content/ko/docs/reference/glossary/persistent-volume.md new file mode 100644 index 0000000000..e0436c8a8b --- /dev/null +++ b/content/ko/docs/reference/glossary/persistent-volume.md @@ -0,0 +1,21 @@ +--- +title: 퍼시스턴트 볼륨(Persistent Volume) +id: persistent-volume +date: 2018-04-12 +full_link: /ko/docs/concepts/storage/persistent-volumes/ +short_description: > + 클러스터의 스토리지를 구성하는 API 오브젝트이다. 보통은 개별 파드보다 수명이 긴 플러그 가능한 형태의 리소스로 제공한다. + +aka: +tags: +- core-object +- storage +--- + 클러스터의 스토리지를 나타내는 API 오브젝트이다. 보통은 개별 {{< glossary_tooltip text="파드" term_id="pod" >}}보다 수명이 긴 플러그 가능한 형태의 리소스로 제공한다. + + + +퍼시스턴트볼륨(PV)은 스토리지를 어떻게 제공하고 사용하는지를 추상화하는 API를 제공한다. +PV는 스토리지를 미리 생성할 수 있는 경우에 사용한다(정적 프로비저닝). +온-디맨드 스토리지(동적 프로비저닝)가 필요한 경우에는 퍼시스턴트볼륨클레임(PVC)을 대신 사용한다. + diff --git a/content/ko/docs/reference/kubectl/cheatsheet.md b/content/ko/docs/reference/kubectl/cheatsheet.md index 5e03ead888..1613791ddf 100644 --- a/content/ko/docs/reference/kubectl/cheatsheet.md +++ b/content/ko/docs/reference/kubectl/cheatsheet.md @@ -305,9 +305,10 @@ mynamespace # 특정 네임스페이스 kubectl run nginx --image=nginx # nginx 파드를 실행하고 해당 스펙을 pod.yaml 파일에 기록 --dry-run=client -o yaml > pod.yaml -kubectl attach my-pod -i # 실행중인 컨테이너에 연결 +kubectl attach my-pod -i # 실행 중인 컨테이너에 연결 kubectl port-forward my-pod 5000:6000 # 로컬 머신의 5000번 포트를 리스닝하고, my-pod의 6000번 포트로 전달 kubectl exec my-pod -- ls / # 기존 파드에서 명령 실행(한 개 컨테이너 경우) +kubectl exec --stdin --tty my-pod -- /bin/sh # 실행 중인 파드로 대화형 셸 액세스(1 컨테이너 경우) kubectl exec my-pod -c my-container -- ls / # 기존 파드에서 명령 실행(멀티-컨테이너 경우) kubectl top pod POD_NAME --containers # 특정 파드와 해당 컨테이너에 대한 메트릭 표시 ``` diff --git a/content/ko/docs/reference/kubectl/conventions.md b/content/ko/docs/reference/kubectl/conventions.md index de771c2d65..b18f64b5ef 100644 --- a/content/ko/docs/reference/kubectl/conventions.md +++ b/content/ko/docs/reference/kubectl/conventions.md @@ -32,7 +32,7 @@ content_type: concept `--dry-run` 플래그를 사용하여 실제로 제출하지 않고 클러스터로 보낼 오브젝트를 미리 볼 수 있다. {{< note >}} -모든 `kubectl`의 생성기(generator)는 더 이상 사용 할 수 없다. 생성기 [목록](https://v1-17.docs.kubernetes.io/docs/reference/kubectl/conventions/#generators) 및 사용 방법은 쿠버네티스 v1.17 문서를 참고한다. +모든 `kubectl run`의 생성기(generator)는 더 이상 사용 할 수 없다. 생성기 [목록](https://v1-17.docs.kubernetes.io/docs/reference/kubectl/conventions/#generators) 및 사용 방법은 쿠버네티스 v1.17 문서를 참고한다. {{< /note >}} #### 생성기 @@ -58,5 +58,3 @@ content_type: concept ### `kubectl apply` * `kubectl apply`를 사용해서 리소스를 생성하거나 업데이트 할 수 있다. kubectl apply를 사용하여 리소스를 업데이트하는 방법에 대한 자세한 정보는 [Kubectl 책](https://kubectl.docs.kubernetes.io)을 참고한다. - - diff --git a/content/ko/docs/reference/kubectl/kubectl.md b/content/ko/docs/reference/kubectl/kubectl.md index fe60f87d8f..ede8c85457 100644 --- a/content/ko/docs/reference/kubectl/kubectl.md +++ b/content/ko/docs/reference/kubectl/kubectl.md @@ -206,6 +206,13 @@ kubectl [flags] + + + + + + + @@ -325,7 +332,6 @@ kubectl [flags] ## {{% heading "seealso" %}} -* [kubectl alpha](/docs/reference/generated/kubectl/kubectl-commands#alpha) - 알파 기능에 대한 커맨드 * [kubectl annotate](/docs/reference/generated/kubectl/kubectl-commands#annotate) - 리소스에 대한 어노테이션 업데이트 * [kubectl api-resources](/docs/reference/generated/kubectl/kubectl-commands#api-resources) - 서버에서 지원되는 API 리소스 출력 * [kubectl api-versions](/docs/reference/generated/kubectl/kubectl-commands#api-versions) - "그룹/버전" 형식으로 서버에서 지원되는 API 버전을 출력 @@ -337,10 +343,10 @@ kubectl [flags] * [kubectl cluster-info](/docs/reference/generated/kubectl/kubectl-commands#cluster-info) - 클러스터 정보 표시 * [kubectl completion](/docs/reference/generated/kubectl/kubectl-commands#completion) - 지정된 셸(bash 또는 zsh)에 대한 셸 완성 코드 출력 * [kubectl config](/docs/reference/generated/kubectl/kubectl-commands#config) - kubeconfig 파일 수정 -* [kubectl convert](/docs/reference/generated/kubectl/kubectl-commands#convert) - 다른 API 버전 간에 구성 파일 변환 * [kubectl cordon](/docs/reference/generated/kubectl/kubectl-commands#cordon) - 노드를 unschedulable로 표시 * [kubectl cp](/docs/reference/generated/kubectl/kubectl-commands#cp) - 컨테이너 간에 파일과 디렉터리 복사 * [kubectl create](/docs/reference/generated/kubectl/kubectl-commands#create) - 파일 또는 표준 입력에서 리소스를 생성 +* [kubectl debug](/docs/reference/generated/kubectl/kubectl-commands#debug) - 워크로드와 노드의 문제 해결을 위한 디버깅 세션 생성 * [kubectl delete](/docs/reference/generated/kubectl/kubectl-commands#delete) - 파일명, 표준 입력, 리소스 및 이름, 또는 리소스 및 레이블 셀렉터로 리소스 삭제 * [kubectl describe](/docs/reference/generated/kubectl/kubectl-commands#describe) - 특정 리소스 또는 리소스 그룹의 세부 정보를 표시 * [kubectl diff](/docs/reference/generated/kubectl/kubectl-commands#diff) - 적용 예정 버전과 라이브 버전 비교 @@ -354,7 +360,7 @@ kubectl [flags] * [kubectl label](/docs/reference/generated/kubectl/kubectl-commands#label) - 리소스의 레이블 업데이트 * [kubectl logs](/docs/reference/generated/kubectl/kubectl-commands#logs) - 파드의 컨테이너에 대한 로그 출력 * [kubectl options](/docs/reference/generated/kubectl/kubectl-commands#options) - 모든 커맨드에서 상속된 플래그 목록을 출력 -* [kubectl patch](/docs/reference/generated/kubectl/kubectl-commands#patch) - 전략적 병합 패치를 사용하여 리소스 필드를 업데이트 +* [kubectl patch](/docs/reference/generated/kubectl/kubectl-commands#patch) - 리소스 필드를 업데이트 * [kubectl plugin](/docs/reference/generated/kubectl/kubectl-commands#plugin) - 플러그인과 상호 작용하기 위한 유틸리티를 제공 * [kubectl port-forward](/docs/reference/generated/kubectl/kubectl-commands#port-forward) - 하나 이상의 로컬 포트를 파드로 전달 * [kubectl proxy](/docs/reference/generated/kubectl/kubectl-commands#proxy) - 쿠버네티스 API 서버에 대한 프록시 실행 diff --git a/content/ko/docs/setup/production-environment/container-runtimes.md b/content/ko/docs/setup/production-environment/container-runtimes.md index bbf5de5d82..891e0bf61a 100644 --- a/content/ko/docs/setup/production-environment/container-runtimes.md +++ b/content/ko/docs/setup/production-environment/container-runtimes.md @@ -119,7 +119,7 @@ sudo apt-get update && sudo apt-get install -y containerd.io ```shell # containerd 구성 sudo mkdir -p /etc/containerd -sudo containerd config default > /etc/containerd/config.toml +sudo containerd config default | sudo tee /etc/containerd/config.toml ``` ```shell @@ -161,10 +161,10 @@ sudo systemctl restart containerd {{% /tab %}} {{% tab name="Windows (PowerShell)" %}} ```powershell -# (Install containerd) -# download containerd -cmd /c curl -OL https://github.com/containerd/containerd/releases/download/v1.4.0-beta.2/containerd-1.4.0-beta.2-windows-amd64.tar.gz -cmd /c tar xvf .\containerd-1.4.0-beta.2-windows-amd64.tar.gz +# (containerd 설치) +# containerd 다운로드 +cmd /c curl -OL https://github.com/containerd/containerd/releases/download/v1.4.1/containerd-1.4.1-windows-amd64.tar.gz +cmd /c tar xvf .\containerd-1.4.1-windows-amd64.tar.gz ``` ```shell diff --git a/content/ko/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md b/content/ko/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md index 7eb0f8f706..cfa880235a 100644 --- a/content/ko/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md +++ b/content/ko/docs/setup/production-environment/windows/intro-windows-in-kubernetes.md @@ -8,8 +8,6 @@ weight: 65 윈도우 애플리케이션은 많은 조직에서 실행되는 서비스 및 애플리케이션의 상당 부분을 구성한다. [윈도우 컨테이너](https://aka.ms/windowscontainers)는 프로세스와 패키지 종속성을 캡슐화하는 현대적인 방법을 제공하여, 데브옵스(DevOps) 사례를 더욱 쉽게 ​​사용하고 윈도우 애플리케이션의 클라우드 네이티브 패턴을 따르도록 한다. 쿠버네티스는 사실상의 표준 컨테이너 오케스트레이터가 되었으며, 쿠버네티스 1.14 릴리스에는 쿠버네티스 클러스터의 윈도우 노드에서 윈도우 컨테이너 스케줄링을 위한 프로덕션 지원이 포함되어 있어, 광범위한 윈도우 애플리케이션 생태계가 쿠버네티스의 강력한 기능을 활용할 수 있다. 윈도우 기반 애플리케이션과 리눅스 기반 애플리케이션에 투자한 조직은 워크로드를 관리하기 위해 별도의 오케스트레이터를 찾을 필요가 없으므로, 운영 체제와 관계없이 배포 전반에 걸쳐 운영 효율성이 향상된다. - - ## 쿠버네티스의 윈도우 컨테이너 @@ -36,12 +34,10 @@ weight: 65 | 쿠버네티스 버전 | 윈도우 서버 LTSC 릴리스 | 윈도우 서버 SAC 릴리스 | | --- | --- | --- | --- | -| *Kubernetes v1.14* | Windows Server 2019 | Windows Server ver 1809 | -| *Kubernetes v1.15* | Windows Server 2019 | Windows Server ver 1809 | -| *Kubernetes v1.16* | Windows Server 2019 | Windows Server ver 1809 | | *Kubernetes v1.17* | Windows Server 2019 | Windows Server ver 1809 | | *Kubernetes v1.18* | Windows Server 2019 | Windows Server ver 1809, Windows Server ver 1903, Windows Server ver 1909 | | *Kubernetes v1.19* | Windows Server 2019 | Windows Server ver 1909, Windows Server ver 2004 | +| *Kubernetes v1.20* | Windows Server 2019 | Windows Server ver 1909, Windows Server ver 2004 | {{< note >}} 지원 모델을 포함한 다양한 윈도우 서버 서비스 채널에 대한 정보는 [윈도우 서버 서비스 채널](https://docs.microsoft.com/ko-kr/windows-server/get-started-19/servicing-channels-19)에서 확인할 수 있다. @@ -56,6 +52,10 @@ weight: 65 프로세스 격리가 포함된 윈도우 컨테이너에는 엄격한 호환성 규칙이 있으며, [여기서 호스트 OS 버전은 컨테이너 베이스 이미지 OS 버전과 일치해야 한다](https://docs.microsoft.com/ko-kr/virtualization/windowscontainers/deploy-containers/version-compatibility). 일단 쿠버네티스에서 Hyper-V 격리가 포함된 윈도우 컨테이너를 지원하면, 제한 및 호환성 규칙이 변경될 것이다. {{< /note >}} +#### 퍼즈(Pause) 이미지 + +Microsoft는 `mcr.microsoft.com/oss/kubernetes/pause:1.4.1`에서 윈도우 퍼즈 인프라 컨테이너를 유지한다. + #### 컴퓨트 API 및 kubectl의 관점에서, 윈도우 컨테이너는 리눅스 기반 컨테이너와 거의 같은 방식으로 작동한다. 그러나 [제한 섹션](#제한)에 요약된 주요 기능에는 몇 가지 눈에 띄는 차이점이 있다. @@ -114,23 +114,22 @@ Docker EE-basic 19.03 이상은 모든 윈도우 서버 버전에 대해 권장 ##### CRI-ContainerD -{{< feature-state for_k8s_version="v1.19" state="beta" >}} +{{< feature-state for_k8s_version="v1.20" state="stable" >}} -{{< caution >}} -커널 패치가 필요한 윈도우 네트워크 공유에 접근하기 위해 ContainerD와 함께 GMSA를 사용할 때 [알려진 제한](/docs/tasks/configure-pod-container/configure-gmsa/#gmsa-limitations)이 있다. [Microsoft 윈도우 컨테이너 이슈 트래커](https://github.com/microsoft/Windows-Containers/issues/44)에서 업데이트를 확인한다. -{{< /caution >}} - -{{< glossary_tooltip term_id="containerd" text="ContainerD" >}} 1.4.0-beta.2+는 윈도우 쿠버네티스 노드의 컨테이너 런타임으로도 사용할 수 있다. - -쿠버네티스 v1.18은 윈도우에서 ContainerD에 대한 초기 지원을 추가한다. 윈도우에서 ContainerD의 진행 상황은 [enhancements#1001](https://github.com/kubernetes/enhancements/issues/1001)에서 확인할 수 있다. +{{< glossary_tooltip term_id="containerd" text="ContainerD" >}} 1.4.0+는 윈도우 쿠버네티스 노드의 컨테이너 런타임으로도 사용할 수 있다. [윈도우에 ContainerD 설치](/ko/docs/setup/production-environment/container-runtimes/#containerd-설치) 방법을 확인한다. +{{< caution >}} +ContainerD와 함께 GMSA를 사용하여 커널 패치가 필요한 윈도우 네트워크 공유에 액세스 할 때 [알려진 제한](/docs/tasks/configure-pod-container/configure-gmsa/#gmsa-limitations)이 있다. 이 제한을 해결하기위한 업데이트는 현재 Windows Server, 버전 2004에서 사용할 수 있으며 2021년 초에 Windows Server 2019에서 사용할 수 있다. [Microsoft 윈도우 컨테이너 이슈 트래커](https://github.com/microsoft/Windows-Containers/issues/44)에서 업데이트를 확인한다. +{{< /caution >}} + #### 퍼시스턴트 스토리지(Persistent Storage) 쿠버네티스 [볼륨](/ko/docs/concepts/storage/volumes/)을 사용하면 데이터 지속성(persistence) 및 파드 볼륨 공유 요구 사항이 있는 복잡한 애플리케이션을 쿠버네티스에 배포할 수 있다. 특정 스토리지 백엔드 또는 프로토콜과 관련된 퍼시스턴트 볼륨 관리에는 볼륨 프로비저닝/디-프로비저닝/크기 조정, 쿠버네티스 노드에 볼륨 연결/분리, 데이터를 유지해야 하는 파드의 개별 컨테이너에 볼륨 마운트/분리와 같은 작업이 포함된다. 특정 스토리지 백엔드 또는 프로토콜에 대해 이러한 볼륨 관리 작업을 구현하는 코드는 쿠버네티스 볼륨 [플러그인](/ko/docs/concepts/storage/volumes/#볼륨-유형들)의 형태로 제공된다. 다음과 같은 광범위한 쿠버네티스 볼륨 플러그인 클래스가 윈도우에서 지원된다. ##### 인-트리(In-tree) 볼륨 플러그인 + 인-트리 볼륨 플러그인과 관련된 코드는 핵심 쿠버네티스 코드 베이스의 일부로 제공된다. 인-트리 볼륨 플러그인 배포는 추가 스크립트를 설치하거나 별도의 컨테이너화된 플러그인 컴포넌트를 배포할 필요가 없다. 이러한 플러그인들은 볼륨 프로비저닝/디-프로비저닝, 스토리지 백엔드 볼륨 크기 조정, 쿠버네티스 노드에 볼륨 연결/분리, 파드의 개별 컨테이너에 볼륨 마운트/분리를 처리할 수 있다. 다음의 인-트리 플러그인은 윈도우 노드를 지원한다. * [awsElasticBlockStore](/ko/docs/concepts/storage/volumes/#awselasticblockstore) @@ -140,6 +139,7 @@ Docker EE-basic 19.03 이상은 모든 윈도우 서버 버전에 대해 권장 * [vsphereVolume](/ko/docs/concepts/storage/volumes/#vspherevolume) ##### FlexVolume 플러그인 + [FlexVolume](/ko/docs/concepts/storage/volumes/#flexVolume) 플러그인과 관련된 코드는 아웃-오브-트리(out-of-tree) 스크립트 또는 호스트에 직접 배포해야 하는 바이너리로 제공된다. FlexVolume 플러그인은 쿠버네티스 노드에 볼륨 연결/분리 및 파드의 개별 컨테이너에 볼륨 마운트/분리를 처리한다. FlexVolume 플러그인과 관련된 퍼시스턴트 볼륨의 프로비저닝/디-프로비저닝은 일반적으로 FlexVolume 플러그인과는 별도의 외부 프로비저너를 통해 처리될 수 있다. 호스트에서 powershell 스크립트로 배포된 다음의 FlexVolume [플러그인](https://github.com/Microsoft/K8s-Storage-Plugins/tree/master/flexvolume/windows)은 윈도우 노드를 지원한다. * [SMB](https://github.com/microsoft/K8s-Storage-Plugins/tree/master/flexvolume/windows/plugins/microsoft.com~smb.cmd) @@ -147,7 +147,7 @@ Docker EE-basic 19.03 이상은 모든 윈도우 서버 버전에 대해 권장 ##### CSI 플러그인 -{{< feature-state for_k8s_version="v1.16" state="alpha" >}} +{{< feature-state for_k8s_version="v1.19" state="beta" >}} {{< glossary_tooltip text="CSI" term_id="csi" >}} 플러그인과 관련된 코드는 일반적으로 컨테이너 이미지로 배포되고 데몬셋(DaemonSets) 및 스테이트풀셋(StatefulSets)과 같은 표준 쿠버네티스 구성을 사용하여 배포되는 아웃-오브-트리 스크립트 및 바이너리로 제공된다. CSI 플러그인은 쿠버네티스에서 볼륨 프로비저닝/디-프로비저닝, 볼륨 크기 조정, 쿠버네티스 노드에 볼륨 연결/분리, 파드의 개별 컨테이너에 볼륨 마운트/분리, 스냅샷 및 복제를 사용하여 퍼시스턴트 데이터 백업/복원과 같은 다양한 볼륨 관리 작업을 처리한다. CSI 플러그인은 일반적으로 (각 노드에서 데몬셋으로 실행되는) 노드 플러그인과 컨트롤러 플러그인으로 구성된다. @@ -170,6 +170,7 @@ CSI 노드 플러그인(특히 블록 디바이스 또는 공유 파일시스템 * ExternalName ##### 네트워크 모드 + 윈도우는 L2bridge, L2tunnel, Overlay, Transparent 및 NAT의 다섯 가지 네트워킹 드라이버/모드를 지원한다. 윈도우와 리눅스 워커 노드가 있는 이기종 클러스터에서는 윈도우와 리눅스 모두에서 호환되는 네트워킹 솔루션을 선택해야 한다. 윈도우에서 다음과 같은 out-of-tree 플러그인이 지원되며 각 CNI 사용 시 권장 사항이 있다. | 네트워크 드라이버 | 설명 | 컨테이너 패킷 수정 | 네트워크 플러그인 | 네트워크 플러그인 특성 | @@ -180,7 +181,7 @@ CSI 노드 플러그인(특히 블록 디바이스 또는 공유 파일시스템 | Transparent([ovn-kubernetes](https://github.com/openvswitch/ovn-kubernetes)의 특수한 유스케이스) | 외부 vSwitch가 필요하다. 컨테이너는 논리적 네트워크(논리적 스위치 및 라우터)를 통해 파드 내 통신을 가능하게 하는 외부 vSwitch에 연결된다. | 패킷은 [GENEVE](https://datatracker.ietf.org/doc/draft-gross-geneve/) 또는 [STT](https://datatracker.ietf.org/doc/draft-davie-stt)를 통해 캡슐화되는데, 동일한 호스트에 있지 않은 파드에 도달하기 위한 터널링을 한다.
패킷은 ovn 네트워크 컨트롤러에서 제공하는 터널 메타데이터 정보를 통해 전달되거나 삭제된다.
NAT는 north-south 통신(데이터 센터와 클라이언트, 네트워크 상의 데이터 센터 외부와의 통신)을 위해 수행된다. | [ovn-kubernetes](https://github.com/openvswitch/ovn-kubernetes) | [ansible을 통해 배포](https://github.com/openvswitch/ovn-kubernetes/tree/master/contrib)한다. 분산 ACL은 쿠버네티스 정책을 통해 적용할 수 있다. IPAM을 지원한다. kube-proxy 없이 로드 밸런싱을 수행할 수 있다. NAT를 수행할 때 iptables/netsh를 사용하지 않고 수행된다. | | NAT(*쿠버네티스에서 사용되지 않음*) | 컨테이너에는 내부 vSwitch에 연결된 vNIC이 제공된다. DNS/DHCP는 [WinNAT](https://blogs.technet.microsoft.com/virtualization/2016/05/25/windows-nat-winnat-capabilities-and-limitations/)라는 내부 컴포넌트를 사용하여 제공된다. | MAC 및 IP는 호스트 MAC/IP에 다시 작성된다. | [nat](https://github.com/Microsoft/windows-container-networking/tree/master/plugins/nat) | 완전성을 위해 여기에 포함되었다. | -위에서 설명한대로 [플라넬(Flannel)](https://github.com/coreos/flannel) CNI [메타 플러그인](https://github.com/containernetworking/plugins/tree/master/plugins/meta/flannel)은 [VXLAN 네트워크 백엔드](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan)(**alpha 지원**, win-overlay에 위임) 및 [host-gateway network backend](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) (안정적인 지원, win-bridge에 위임)를 통해 [윈도우](https://github.com/containernetworking/plugins/tree/master/plugins/meta/flannel#windows-support-experimental)에서도 지원된다. 이 플러그인은 자동 노드 서브넷 임대 할당과 HNS 네트워크 생성을 위해 윈도우 (Flanneld)에서 Flannel 데몬과 함께 작동하도록 참조 CNI 플러그인 (win-overlay, win-bridge) 중 하나에 대한 위임을 지원한다. 이 플러그인은 자체 구성 파일 (cni.conf)을 읽고, 이를 FlannelD 생성하는 subnet.env 파일의 환경 변수와 함께 집계한다. 이후 네트워크 연결을 위한 참조 CNI 플러그인 중 하나에 위임하고 노드 할당 서브넷을 포함하는 올바른 구성을 IPAM 플러그인 (예: 호스트-로컬)으로 보낸다. +위에서 설명한대로 [플란넬(Flannel)](https://github.com/coreos/flannel) CNI [메타 플러그인](https://github.com/containernetworking/plugins/tree/master/plugins/meta/flannel)은 [VXLAN 네트워크 백엔드](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#vxlan)(**alpha 지원**, win-overlay에 위임) 및 [host-gateway network backend](https://github.com/coreos/flannel/blob/master/Documentation/backends.md#host-gw) (안정적인 지원, win-bridge에 위임)를 통해 [윈도우](https://github.com/containernetworking/plugins/tree/master/plugins/meta/flannel#windows-support-experimental)에서도 지원된다. 이 플러그인은 자동 노드 서브넷 임대 할당과 HNS 네트워크 생성을 위해 윈도우 (Flanneld)에서 Flannel 데몬과 함께 작동하도록 참조 CNI 플러그인 (win-overlay, win-bridge) 중 하나에 대한 위임을 지원한다. 이 플러그인은 자체 구성 파일 (cni.conf)을 읽고, 이를 FlannelD 생성하는 subnet.env 파일의 환경 변수와 함께 집계한다. 이후 네트워크 연결을 위한 참조 CNI 플러그인 중 하나에 위임하고 노드 할당 서브넷을 포함하는 올바른 구성을 IPAM 플러그인 (예: 호스트-로컬)으로 보낸다. 노드, 파드, 서비스 오브젝트의 경우 TCP/UDP 트래픽에 대해 다음 네트워크 흐름이 지원된다. @@ -194,7 +195,8 @@ CSI 노드 플러그인(특히 블록 디바이스 또는 공유 파일시스템 * 노드 -> 파드 * 파드 -> 노드 -##### IP 주소 관리(IPAM) {#ipam} +##### IP 주소 관리(IPAM) + 윈도우에서는 다음 IPAM 옵션이 지원된다. * [호스트-로컬](https://github.com/containernetworking/plugins/tree/master/plugins/ipam/host-local) @@ -215,10 +217,11 @@ CSI 노드 플러그인(특히 블록 디바이스 또는 공유 파일시스템 {{< /table >}} #### IPv4/IPv6 이중 스택 + `IPv6DualStack` [기능 게이트](https://kubernetes.io/ko/docs/reference/command-line-tools-reference/feature-gates/)를 사용하여 `l2bridge` 네트워크에 IPv4/IPv6 이중 스택 네트워킹을 활성화할 수 있다. 자세한 내용은 [IPv4/IPv6 이중 스택 활성화](/ko/docs/concepts/services-networking/dual-stack/#ipv4-ipv6-이중-스택-활성화)을 참조한다. {{< note >}} -윈도우에서 쿠버네티스와 함께 IPv6를 사용하려면 윈도우 서버 vNext Insider Preview Build 19603 이상이 필요하다. +윈도우에서 쿠버네티스와 함께 IPv6를 사용하려면 윈도우 서버 버전 2004 (커널 버전 10.0.19041.610) 이상이 필요하다. {{< /note >}} {{< note >}} @@ -243,7 +246,7 @@ CSI 노드 플러그인(특히 블록 디바이스 또는 공유 파일시스템 ##### 기능 제한 -* TerminationGracePeriod: 구현되지 않음 +* TerminationGracePeriod: CRI-containerD 필요 * 단일 파일 매핑: CRI-ContainerD로 구현 예정 * 종료 메시지: CRI-ContainerD로 구현 예정 * 특권을 가진(Privileged) 컨테이너: 현재 윈도우 컨테이너에서 지원되지 않음 @@ -267,12 +270,13 @@ CSI 노드 플러그인(특히 블록 디바이스 또는 공유 파일시스템 * MemoryPressure 조건은 구현되지 않았다. * kubelet이 취한 OOM 축출 조치가 없다. * 윈도우 노드에서 실행되는 Kubelet에는 메모리 제한이 없다. `--kubelet-reserve`와 `--system-reserve`는 호스트에서 실행되는 kubelet 또는 프로세스에 제한을 설정하지 않는다. 이는 호스트의 kubelet 또는 프로세스가 node-allocatable 및 스케줄러 외부에서 메모리 리소스 부족을 유발할 수 있음을 의미한다. +* kubelet 프로세스의 우선 순위를 설정하는 추가 플래그는 `--windows-priorityclass`라는 윈도우 노드에서 사용할 수 있다. 이 플래그를 사용하면 kubelet 프로세스가 윈도우 호스트에서 실행중인 다른 프로세스와 비교할 때 더 많은 CPU 시간 슬라이스을 얻을 수 있다. 허용되는 값과 그 의미에 대한 자세한 내용은 [윈도우 우선순위 클래스](https://docs.microsoft.com/en-us/windows/win32/procthread/scheduling-priorities#priority-class)에서 확인할 수 있다. kubelet이 항상 충분한 CPU주기를 갖도록 하려면 이 플래그를 `ABOVE_NORMAL_PRIORITY_CLASS` 이상으로 설정하는 것이 좋다. #### 스토리지 윈도우에는 컨테이너 계층을 마운트하고 NTFS를 기반으로 하는 복제 파일시스템을 만드는 레이어드(layered) 파일시스템 드라이버가 있다. 컨테이너의 모든 파일 경로는 해당 컨테이너의 컨텍스트 내에서만 확인된다. -* 볼륨 마운트는 개별 파일이 아닌 컨테이너의 디렉터리만 대상으로 할 수 있다. +* 도커 볼륨 마운트는 개별 파일이 아닌 컨테이너의 디렉토리 만 대상으로 할 수 있다. 이 제한은 CRI-containerD에는 존재하지 않는다. * 볼륨 마운트는 파일이나 디렉터리를 호스트 파일시스템으로 다시 투영할 수 없다. * 읽기 전용 파일시스템은 윈도우 레지스트리 및 SAM 데이터베이스에 항상 쓰기 접근이 필요하기 때문에 지원되지 않는다. 그러나 읽기 전용 볼륨은 지원된다. * 볼륨 사용자 마스크(user-masks) 및 권한은 사용할 수 없다. SAM은 호스트와 컨테이너 간에 공유되지 않기 때문에 이들 간에 매핑이 없다. 모든 권한은 컨테이너 컨텍스트 내에서 해결된다. @@ -329,10 +333,11 @@ CSI 노드 플러그인(특히 블록 디바이스 또는 공유 파일시스템 * 윈도우에서는 사용할 수 있는 여러 가지의 DNS 리졸버(resolver)가 있다. 이들은 약간 다른 동작을 제공하므로, 이름 쿼리 확인을 위해 `Resolve-DNSName` 유틸리티를 사용하는 것이 좋다. ##### IPv6 + 윈도우의 쿠버네티스는 단일 스택 "IPv6 전용" 네트워킹을 지원하지 않는다. 그러나 단일 제품군 서비스를 사용하는 파드와 노드에 대한 이중 스택 IPv4/IPv6 네트워킹이 지원된다. 자세한 내용은 [IPv4/IPv6 이중 스택 네트워킹](#ipv4ipv6-이중-스택)을 참고한다. - ##### 세션 어피니티(affinity) + `service.spec.sessionAffinityConfig.clientIP.timeoutSeconds`를 사용하는 윈도우 서비스의 최대 세션 고정(sticky) 시간 설정은 지원되지 않는다. ##### 보안 @@ -342,7 +347,7 @@ CSI 노드 플러그인(특히 블록 디바이스 또는 공유 파일시스템 1. 파일 ACL을 사용하여 시크릿 파일 위치를 보호한다. 2. [BitLocker](https://docs.microsoft.com/ko-kr/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server)를 사용한 볼륨-레벨 암호화를 사용한다. -[RunAsUser](/ko/docs/concepts/policy/pod-security-policy/#사용자-및-그룹)는 현재 윈도우에서 지원되지 않는다. 해결 방법(workaround)은 컨테이너를 패키징하기 전에 로컬 계정을 만드는 것이다. RunAsUsername 기능은 향후 릴리스에 추가될 수 있다. +[RunAsUsername](/ko/docs/tasks/configure-pod-container/configure-runasusername)은 컨테이너 프로세스를 노드 기본 사용자로 실행하기 위해 윈도우 파드 또는 컨테이너에 지정할 수 있다. 이것은 [RunAsUser](/ko/docs/concepts/policy/pod-security-policy/#사용자-및-그룹)와 거의 동일하다. SELinux, AppArmor, Seccomp, 기능(POSIX 기능)과 같은 리눅스 특유의 파드 시큐리티 컨텍스트 권한은 지원하지 않는다. @@ -464,9 +469,9 @@ PodSecurityContext 필드는 윈도우에서 작동하지 않는다. 참조를 nssm start flanneld # kubelet.exe 등록 - # Microsoft는 mcr.microsoft.com/k8s/core/pause:1.2.0에서 pause 인프라 컨테이너를 릴리스했다. + # Microsoft는 mcr.microsoft.com/oss/kubernetes/pause:1.4.1에서 pause 인프라 컨테이너를 릴리스했다. nssm install kubelet C:\k\kubelet.exe - nssm set kubelet AppParameters --hostname-override= --v=6 --pod-infra-container-image=mcr.microsoft.com/k8s/core/pause:1.2.0 --resolv-conf="" --allow-privileged=true --enable-debugging-handlers --cluster-dns= --cluster-domain=cluster.local --kubeconfig=c:\k\config --hairpin-mode=promiscuous-bridge --image-pull-progress-deadline=20m --cgroups-per-qos=false --log-dir= --logtostderr=false --enforce-node-allocatable="" --network-plugin=cni --cni-bin-dir=c:\k\cni --cni-conf-dir=c:\k\cni\config + nssm set kubelet AppParameters --hostname-override= --v=6 --pod-infra-container-image=mcr.microsoft.com/oss/kubernetes/pause:1.4.1 --resolv-conf="" --allow-privileged=true --enable-debugging-handlers --cluster-dns= --cluster-domain=cluster.local --kubeconfig=c:\k\config --hairpin-mode=promiscuous-bridge --image-pull-progress-deadline=20m --cgroups-per-qos=false --log-dir= --logtostderr=false --enforce-node-allocatable="" --network-plugin=cni --cni-bin-dir=c:\k\cni --cni-conf-dir=c:\k\cni\config nssm set kubelet AppDirectory C:\k nssm start kubelet @@ -528,7 +533,7 @@ PodSecurityContext 필드는 윈도우에서 작동하지 않는다. 참조를 C:\k\kube-proxy.exe --hostname-override=$(hostname) ``` -1. 플라넬(flannel)을 사용하면 클러스터에 다시 조인(join)한 후 노드에 이슈가 발생한다. +1. 플란넬(flannel)을 사용하면 클러스터에 다시 조인(join)한 후 노드에 이슈가 발생한다. 이전에 삭제된 노드가 클러스터에 다시 조인될 때마다, flannelD는 새 파드 서브넷을 노드에 할당하려고 한다. 사용자는 다음 경로에서 이전 파드 서브넷 구성 파일을 제거해야 한다. @@ -548,7 +553,7 @@ PodSecurityContext 필드는 윈도우에서 작동하지 않는다. 참조를 1. `/run/flannel/subnet.env` 누락으로 인해 윈도우 파드를 시작할 수 없다. - 이것은 플라넬이 제대로 실행되지 않았음을 나타낸다. flanneld.exe를 다시 시작하거나 쿠버네티스 마스터의 `/run/flannel/subnet.env`에서 윈도우 워커 노드의 `C:\run\flannel\subnet.env`로 파일을 수동으로 복사할 수 있고, `FLANNEL_SUBNET` 행을 다른 숫자로 수정한다. 예를 들어, 다음은 노드 서브넷 10.244.4.1/24가 필요한 경우이다. + 이것은 플란넬이 제대로 실행되지 않았음을 나타낸다. flanneld.exe를 다시 시작하거나 쿠버네티스 마스터의 `/run/flannel/subnet.env`에서 윈도우 워커 노드의 `C:\run\flannel\subnet.env`로 파일을 수동으로 복사할 수 있고, `FLANNEL_SUBNET` 행을 다른 숫자로 수정한다. 예를 들어, 다음은 노드 서브넷 10.244.4.1/24가 필요한 경우이다. ```env FLANNEL_NETWORK=10.244.0.0/16 @@ -576,15 +581,13 @@ PodSecurityContext 필드는 윈도우에서 작동하지 않는다. 참조를 pause 이미지가 OS 버전과 호환되는지 확인한다. [지침](https://docs.microsoft.com/en-us/virtualization/windowscontainers/kubernetes/deploying-resources)에서는 OS와 컨테이너가 모두 버전 1803이라고 가정한다. 이후 버전의 윈도우가 있는 경우, Insider 빌드와 같이 그에 따라 이미지를 조정해야 한다. 이미지는 Microsoft의 [도커 리포지터리](https://hub.docker.com/u/microsoft/)를 참조한다. 그럼에도 불구하고, pause 이미지 Dockerfile과 샘플 서비스는 이미지가 :latest로 태그될 것으로 예상한다. - 쿠버네티스 v1.14부터 Microsoft는 `mcr.microsoft.com/k8s/core/pause:1.2.0`에서 pause 인프라 컨테이너를 릴리스한다. - 1. DNS 확인(resolution)이 제대로 작동하지 않는다. 이 [섹션](#dns-limitations)에서 윈도우에 대한 DNS 제한을 확인한다. 1. `kubectl port-forward`가 "unable to do port forwarding: wincat not found"로 실패한다. - 이는 쿠버네티스 1.15 및 pause 인프라 컨테이너 `mcr.microsoft.com/k8s/core/pause:1.2.0`에서 구현되었다. 해당 버전 또는 최신 버전을 사용해야 한다. + 이는 쿠버네티스 1.15 및 pause 인프라 컨테이너 `mcr.microsoft.com/oss/kubernetes/pause:1.4.1`에서 구현되었다. 해당 버전 또는 최신 버전을 사용해야 한다. 자체 pause 인프라 컨테이너를 빌드하려면 [wincat](https://github.com/kubernetes-sigs/sig-windows-tools/tree/master/cmd/wincat)을 포함해야 한다. 1. 내 윈도우 서버 노드가 프록시 뒤에 있기 때문에 내 쿠버네티스 설치가 실패한다. @@ -600,7 +603,7 @@ PodSecurityContext 필드는 윈도우에서 작동하지 않는다. 참조를 쿠버네티스 파드에서는 컨테이너 엔드포인트를 호스팅하기 위해 먼저 인프라 또는 "pause" 컨테이너가 생성된다. 인프라 및 워커 컨테이너를 포함하여 동일한 파드에 속하는 컨테이너는 공통 네트워크 네임스페이스 및 엔드포인트(동일한 IP 및 포트 공간)를 공유한다. 네트워크 구성을 잃지 않고 워커 컨테이너가 충돌하거나 다시 시작되도록 하려면 pause 컨테이너가 필요하다. - "pause" (인프라) 이미지는 Microsoft Container Registry(MCR)에서 호스팅된다. `docker pull mcr.microsoft.com/k8s/core/pause:1.2.0`을 사용하여 접근할 수 있다. 자세한 내용은 [DOCKERFILE](https://github.com/kubernetes-sigs/windows-testing/blob/master/images/pause/Dockerfile)을 참고한다. + "pause" (인프라) 이미지는 Microsoft Container Registry(MCR)에서 호스팅된다. `mcr.microsoft.com/oss/kubernetes/pause:1.4.1`을 사용하여 접근할 수 있다. 자세한 내용은 [DOCKERFILE](https://github.com/kubernetes-sigs/windows-testing/blob/master/images/pause/Dockerfile)을 참고한다. ### 추가 조사 @@ -622,11 +625,8 @@ PodSecurityContext 필드는 윈도우에서 작동하지 않는다. 참조를 * [관련 로그](https://github.com/kubernetes/community/blob/master/sig-windows/CONTRIBUTING.md#gathering-logs) * SIG-Windows 회원의 주의를 끌 수 있도록 `/sig windows`로 이슈에 대해 어노테이션을 달아 이슈에 sig/windows 태그를 지정한다. - - ## {{% heading "whatsnext" %}} - 로드맵에는 많은 기능이 있다. 요약된 높은 수준의 목록이 아래에 포함되어 있지만, [로드맵 프로젝트](https://github.com/orgs/kubernetes/projects/8)를 보고 [기여](https://github.com/kubernetes/community/blob/master/sig-windows/)하여 윈도우 지원을 개선하는데 도움이 주는 것이 좋다. ### Hyper-V 격리(isolation) @@ -638,31 +638,7 @@ PodSecurityContext 필드는 윈도우에서 작동하지 않는다. 참조를 * 파드에 대한 특정 CPU/NUMA 설정 * 메모리 격리 및 예약 -v1.10의 실험적(experimental) 기능인 기존 Hyper-V 격리 지원은 위에서 언급한 CRI-ContainerD와 런타임클래스(RuntimeClass) 기능을 위해 향후 사용 중단(deprecated)된다. 현재 기능을 사용하고 Hyper-V 격리된 컨테이너를 만들려면, kubelet을 기능 게이트(feature gates) `HyperVContainer=true`로 시작해야 하고 파드에 `experimental.windows.kubernetes.io/isolation-type=hyperv` 어노테이션을 포함해야 한다. 실험 릴리스에서 이 기능은 파드 당 컨테이너 1개로 제한된다. - -```yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: iis -spec: - selector: - matchLabels: - app: iis - replicas: 3 - template: - metadata: - labels: - app: iis - annotations: - experimental.windows.kubernetes.io/isolation-type: hyperv - spec: - containers: - - name: iis - image: microsoft/iis - ports: - - containerPort: 80 -``` +Hyper-V 격리 지원은 이후 릴리스에 추가되며 CRI-Containerd가 필요하다. ### kubeadm 및 클러스터 API를 사용한 배포 @@ -671,8 +647,3 @@ Kubeadm은 사용자가 쿠버네티스 클러스터를 배포하기 위한 사 [여기](/ko/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes/)에서 가이드를 사용할 수 있다. 또한 윈도우 노드가 적절하게 프로비저닝되도록 클러스터 API에 투자하고 있다. - -### 몇 가지 기타 주요 기능 -* 그룹 관리 서비스 어카운트(Service Accounts)에 대한 베타 지원 -* 더 많은 CNI -* 더 많은 스토리지 플러그인 diff --git a/content/ko/docs/setup/production-environment/windows/user-guide-windows-containers.md b/content/ko/docs/setup/production-environment/windows/user-guide-windows-containers.md index bae83b73a9..aabc838ea5 100644 --- a/content/ko/docs/setup/production-environment/windows/user-guide-windows-containers.md +++ b/content/ko/docs/setup/production-environment/windows/user-guide-windows-containers.md @@ -177,7 +177,7 @@ tolerations: 1. 이 파일을 `runtimeClasses.yml` 로 저장한다. 여기에는 윈도우 OS, 아키텍처 및 버전에 적합한 `nodeSelector` 가 포함되었다. ```yaml -apiVersion: node.k8s.io/v1beta1 +apiVersion: node.k8s.io/v1 kind: RuntimeClass metadata: name: windows-2019 diff --git a/content/ko/docs/tasks/administer-cluster/highly-available-master.md b/content/ko/docs/tasks/administer-cluster/highly-available-master.md index 1ecf5b15d3..76a734bd65 100644 --- a/content/ko/docs/tasks/administer-cluster/highly-available-master.md +++ b/content/ko/docs/tasks/administer-cluster/highly-available-master.md @@ -169,8 +169,39 @@ Etcd 데이터 디렉터리를 마이그레이션하여 속도를 높일 수 있 etcd를 클러스터로 구축하려면, etcd 인스턴스간 통신에 필요한 포트를 열어야 한다(클러스터 내부 통신용). 이러한 배포를 안전하게 하기 위해, etcd 인스턴스간의 통신은 SSL을 이용하여 승인한다. +### API 서버 신원 + +{{< feature-state state="alpha" for_k8s_version="v1.20" >}} + +API 서버 식별 기능은 +[기능 게이트](/ko/docs/reference/command-line-tools-reference/feature-gates/)에 +의해 제어되며 기본적으로 활성화되지 않는다. +{{< glossary_tooltip text="API 서버" term_id="kube-apiserver" >}} +시작 시 `APIServerIdentity` 라는 기능 게이트를 활성화하여 API 서버 신원을 활성화할 수 있다. + +```shell +kube-apiserver \ +--feature-gates=APIServerIdentity=true \ + # …다른 플래그는 평소와 같다. +``` + +부트스트랩 중에 각 kube-apiserver는 고유한 ID를 자신에게 할당한다. ID는 +`kube-apiserver-{UUID}` 형식이다. 각 kube-apiserver는 +_kube-system_ {{< glossary_tooltip text="네임스페이스" term_id="namespace">}}에 +[임대](/docs/reference/generated/kubernetes-api/{{< param "version" >}}//#lease-v1-coordination-k8s-io)를 생성한다. +임대 이름은 kube-apiserver의 고유 ID이다. 임대에는 +`k8s.io/component=kube-apiserver` 라는 레이블이 있다. 각 kube-apiserver는 +`IdentityLeaseRenewIntervalSeconds` (기본값은 10초)마다 임대를 새로 갱신한다. 각 +kube-apiserver는 `IdentityLeaseDurationSeconds` (기본값은 3600초)마다 +모든 kube-apiserver 식별 ID 임대를 확인하고, +`IdentityLeaseDurationSeconds` 이상 갱신되지 않은 임대를 삭제한다. +`IdentityLeaseRenewIntervalSeconds` 및 `IdentityLeaseDurationSeconds`는 +kube-apiserver 플래그 `identity-lease-renew-interval-seconds` +및 `identity-lease-duration-seconds`로 구성된다. + +이 기능을 활성화하는 것은 HA API 서버 조정과 관련된 기능을 +사용하기 위한 전제조건이다(예: `StorageVersionAPI` 기능 게이트). + ## 추가 자료 [자동화된 HA 마스터 배포 - 제안 문서](https://git.k8s.io/community/contributors/design-proposals/cluster-lifecycle/ha_master.md) - - diff --git a/content/ko/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md b/content/ko/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md index 0294db62ec..ce453789cb 100644 --- a/content/ko/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md +++ b/content/ko/docs/tasks/administer-cluster/kubeadm/adding-windows-nodes.md @@ -135,31 +135,91 @@ curl -L https://github.com/kubernetes-sigs/sig-windows-tools/releases/latest/dow ### 윈도우 워커 노드 조인(joining) -{{< note >}} -`Containers` 기능을 설치하고 도커를 설치해야 한다. -[윈도우 서버에 Docker Engine - Enterprise 설치](https://hub.docker.com/editions/enterprise/docker-ee-server-windows)에서 설치에 대한 내용을 참고할 수 있다. -{{< /note >}} {{< note >}} 윈도우 섹션의 모든 코드 스니펫(snippet)은 윈도우 워커 노드의 높은 권한(관리자)이 있는 PowerShell 환경에서 실행해야 한다. {{< /note >}} -1. wins, kubelet 및 kubeadm 설치 +{{< tabs name="tab-windows-kubeadm-runtime-installation" >}} +{{% tab name="Docker EE" %}} + +#### Docker EE 설치 + +`컨테이너` 기능 설치 + +```powershell +Install-WindowsFeature -Name containers +``` + +도커 설치 +자세한 내용은 [도커 엔진 설치 - 윈도우 서버 엔터프라이즈](https://hub.docker.com/editions/enterprise/docker-ee-server-windows)에서 확인할 수 있다. + +#### wins, kubelet 및 kubeadm 설치 ```PowerShell curl.exe -LO https://github.com/kubernetes-sigs/sig-windows-tools/releases/latest/download/PrepareNode.ps1 .\PrepareNode.ps1 -KubernetesVersion {{< param "fullversion" >}} ``` -1. 노드에 조인하기 위해 `kubeadm` 실행 +#### `kubeadm` 실행하여 노드에 조인 + +컨트롤 플레인 호스트에서 `kubeadm init` 실행할 때 제공된 명령을 사용한다. +이 명령이 더 이상 없거나, 토큰이 만료된 경우, `kubeadm token create --print-join-command` +(컨트롤 플레인 호스트에서)를 실행하여 새 토큰 및 조인 명령을 생성할 수 있다. + +{{% /tab %}} +{{% tab name="CRI-containerD" %}} + +#### containerD 설치 + +```powershell +curl.exe -LO https://github.com/kubernetes-sigs/sig-windows-tools/releases/latest/download/Install-Containerd.ps1 +.\Install-Containerd.ps1 +``` + +{{< note >}} +특정 버전의 containerD를 설치하려면 -ContainerDVersion를 사용하여 버전을 지정한다. + +```powershell +# 예 +.\Install-Containerd.ps1 -ContainerDVersion v1.4.1 +``` + +{{< /note >}} + +{{< note >}} +윈도우 노드에서 이더넷(예: "Ethernet0 2")이 아닌 다른 인터페이스를 사용하는 경우, `-netAdapterName` 으로 이름을 지정한다. + +```powershell +# 예 +.\Install-Containerd.ps1 -netAdapterName "Ethernet0 2" +``` + +{{< /note >}} + +#### wins, kubelet 및 kubeadm 설치 + +```PowerShell +curl.exe -LO https://github.com/kubernetes-sigs/sig-windows-tools/releases/latest/download/PrepareNode.ps1 +.\PrepareNode.ps1 -KubernetesVersion {{< param "fullversion" >}} -ContainerRuntime containerD +``` + +#### `kubeadm` 실행하여 노드에 조인 컨트롤 플레인 호스트에서 `kubeadm init` 실행할 때 제공된 명령을 사용한다. 이 명령이 더 이상 없거나, 토큰이 만료된 경우, `kubeadm token create --print-join-command` (컨트롤 플레인 호스트에서)를 실행하여 새 토큰 및 조인 명령을 생성할 수 있다. +{{< note >}} +**CRI-containerD** 를 사용하는 경우 kubeadm 호출에 `--cri-socket "npipe:////./pipe/containerd-containerd"` 를 추가한다 +{{< /note >}} + +{{% /tab %}} +{{< /tabs >}} + +### 설치 확인 -#### 설치 확인 이제 다음을 실행하여 클러스터에서 윈도우 노드를 볼 수 있다. ```bash @@ -175,9 +235,6 @@ kubectl -n kube-system get pods -l app=flannel flannel 파드가 실행되면, 노드는 `Ready` 상태가 되고 워크로드를 처리할 수 있어야 한다. - - ## {{% heading "whatsnext" %}} - - [윈도우 kubeadm 노드 업그레이드](/ko/docs/tasks/administer-cluster/kubeadm/upgrading-windows-nodes) diff --git a/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index aea9411eda..272da1e329 100644 --- a/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -50,7 +50,7 @@ CA 키없이 진행한다. `check-expiration` 하위 명령을 사용하여 인증서가 만료되는 시기를 확인할 수 있다. ``` -kubeadm alpha certs check-expiration +kubeadm certs check-expiration ``` 출력 결과는 다음과 비슷하다. @@ -118,7 +118,7 @@ kubeadm 1.17 이전 버전에는 `kubeadm upgrade node` 명령에서 ## 수동 인증서 갱신 -`kubeadm alpha certs renew` 명령을 사용하여 언제든지 인증서를 수동으로 갱신할 수 있다. +`kubeadm certs renew` 명령을 사용하여 언제든지 인증서를 수동으로 갱신할 수 있다. 이 명령은 `/etc/kubernetes/pki` 에 저장된 CA(또는 프론트 프록시 CA) 인증서와 키를 사용하여 갱신을 수행한다. @@ -127,10 +127,10 @@ HA 클러스터를 실행 중인 경우, 모든 컨트롤 플레인 노드에서 {{< /warning >}} {{< note >}} -`alpha certs renew` 는 기존 인증서를 kubeadm-config 컨피그맵(ConfigMap) 대신 속성(공통 이름, 조직, SAN 등)의 신뢰할 수 있는 소스로 사용한다. 둘 다 동기화 상태를 유지하는 것을 강력히 권장한다. +`certs renew` 는 기존 인증서를 kubeadm-config 컨피그맵(ConfigMap) 대신 속성(공통 이름, 조직, SAN 등)의 신뢰할 수 있는 소스로 사용한다. 둘 다 동기화 상태를 유지하는 것을 강력히 권장한다. {{< /note >}} -`kubeadm alpha certs renew` 는 다음의 옵션을 제공한다. +`kubeadm certs renew` 는 다음의 옵션을 제공한다. 쿠버네티스 인증서는 일반적으로 1년 후 만료일에 도달한다. @@ -168,14 +168,14 @@ controllerManager: ### 인증서 서명 요청(CSR) 생성 -`kubeadm alpha certs renew --use-api` 로 쿠버네티스 인증서 API에 대한 인증서 서명 요청을 만들 수 있다. +`kubeadm certs renew --use-api` 로 쿠버네티스 인증서 API에 대한 인증서 서명 요청을 만들 수 있다. [cert-manager](https://github.com/jetstack/cert-manager)와 같은 외부 서명자를 설정하면, 인증서 서명 요청(CSR)이 자동으로 승인된다. 그렇지 않으면, [`kubectl certificate`](/ko/docs/setup/best-practices/certificates/) 명령을 사용하여 인증서를 수동으로 승인해야 한다. 다음의 kubeadm 명령은 승인할 인증서 이름을 출력한 다음, 승인이 발생하기를 차단하고 기다린다. ```shell -sudo kubeadm alpha certs renew apiserver --use-api & +sudo kubeadm certs renew apiserver --use-api & ``` 출력 결과는 다음과 비슷하다. ``` @@ -209,13 +209,13 @@ kubeadm 관점에서, 일반적으로 온-디스크(on-disk) CA에 의해 서명 ### 인증서 서명 요청(CSR) 생성 -`kubeadm alpha certs renew --csr-only` 로 인증서 서명 요청을 만들 수 있다. +`kubeadm certs renew --csr-only` 로 인증서 서명 요청을 만들 수 있다. CSR과 함께 제공되는 개인 키가 모두 출력된다. `--csr-dir` 로 사용할 디텍터리를 전달하여 지정된 위치로 CSR을 출력할 수 있다. `--csr-dir` 을 지정하지 않으면, 기본 인증서 디렉터리(`/etc/kubernetes/pki`)가 사용된다. -`kubeadm alpha certs renew --csr-only` 로 인증서를 갱신할 수 있다. +`kubeadm certs renew --csr-only` 로 인증서를 갱신할 수 있다. `kubeadm init` 과 마찬가지로 출력 디렉터리를 `--csr-dir` 플래그로 지정할 수 있다. CSR에는 인증서 이름, 도메인 및 IP가 포함되지만, 용도를 지정하지는 않는다. diff --git a/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md b/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md index e18c3e0808..05d9b6bd27 100644 --- a/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md +++ b/content/ko/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade.md @@ -2,22 +2,22 @@ title: kubeadm 클러스터 업그레이드 content_type: task weight: 20 -min-kubernetes-server-version: 1.19 --- 이 페이지는 kubeadm으로 생성된 쿠버네티스 클러스터를 -1.18.x 버전에서 1.19.x 버전으로, 1.19.x 버전에서 1.19.y(여기서 `y > x`) 버전으로 업그레이드하는 방법을 설명한다. +{{< skew latestVersionAddMinor -1 >}}.x 버전에서 {{< skew latestVersion >}}.x 버전으로, +{{< skew latestVersion >}}.x 버전에서 {{< skew latestVersion >}}.y(여기서 `y > x`) 버전으로 업그레이드하는 방법을 설명한다. 업그레이드가 지원되지 않는 경우 +마이너 버전을 건너뛴다. 이전 버전의 kubeadm을 사용하여 생성된 클러스터 업그레이드에 대한 정보를 보려면, 이 페이지 대신 다음의 페이지들을 참고한다. -- [kubeadm 클러스터를 1.17에서 1.18로 업그레이드](https://v1-18.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) -- [kubeadm 클러스터를 1.16에서 1.17로 업그레이드](https://v1-17.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) -- [kubeadm 클러스터를 1.15에서 1.16으로 업그레이드](https://v1-16.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) -- [kubeadm 클러스터를 1.14에서 1.15로 업그레이드](https://v1-15.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade-1-15/) -- [kubeadm 클러스터를 1.13에서 1.14로 업그레이드](https://v1-15.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade-1-14/) +- [kubeadm 클러스터를 {{< skew latestVersionAddMinor -2 >}}에서 {{< skew latestVersionAddMinor -1 >}}로 업그레이드](https://v{{< skew latestVersionAddMinor -1 "-" >}}.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) +- [kubeadm 클러스터를 {{< skew latestVersionAddMinor -3 >}}에서 {{< skew latestVersionAddMinor -2 >}}로 업그레이드](https://v{{< skew latestVersionAddMinor -2 "-" >}}.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) +- [kubeadm 클러스터를 {{< skew latestVersionAddMinor -4 >}}에서 {{< skew latestVersionAddMinor -3 >}}로 업그레이드](https://v{{< skew latestVersionAddMinor -3 "-" >}}.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) +- [kubeadm 클러스터를 {{< skew latestVersionAddMinor -5 >}}에서 {{< skew latestVersionAddMinor -4 >}}으로 업그레이드](https://v{{< skew latestVersionAddMinor -4 "-" >}}.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/) 추상적인 업그레이드 작업 절차는 다음과 같다. @@ -27,60 +27,63 @@ min-kubernetes-server-version: 1.19 ## {{% heading "prerequisites" %}} -- 1.18.0 버전 이상을 실행하는 kubeadm 쿠버네티스 클러스터가 있어야 한다. -- [스왑을 비활성화해야 한다](https://serverfault.com/questions/684771/best-way-to-disable-swap-in-linux). -- 클러스터는 정적 컨트롤 플레인 및 etcd 파드 또는 외부 etcd를 사용해야 한다. - [릴리스 노트]({{< latest-release-notes >}})를 주의 깊게 읽어야 한다. +- 클러스터는 정적 컨트롤 플레인 및 etcd 파드 또는 외부 etcd를 사용해야 한다. - 데이터베이스에 저장된 앱-레벨 상태와 같은 중요한 컴포넌트를 반드시 백업한다. `kubeadm upgrade` 는 워크로드에 영향을 미치지 않고, 쿠버네티스 내부의 컴포넌트만 다루지만, 백업은 항상 모범 사례일 정도로 중요하다. +- [스왑을 비활성화해야 한다](https://serverfault.com/questions/684771/best-way-to-disable-swap-in-linux). ### 추가 정보 +- kubelet 마이너 버전을 업그레이드하기 전에 [노드 드레이닝(draining)](https://kubernetes.io/docs/tasks/administer-cluster/safely-drain-node/)이 + 필요하다. 컨트롤 플레인 노드의 경우 CoreNDS 파드 또는 기타 중요한 워크로드를 실행할 수 있다. - 컨테이너 사양 해시 값이 변경되므로, 업그레이드 후 모든 컨테이너가 다시 시작된다. -- 하나의 MINOR 버전에서 다음 MINOR 버전으로, - 또는 동일한 MINOR의 PATCH 버전 사이에서만 업그레이드할 수 있다. 즉, 업그레이드할 때 MINOR 버전을 건너 뛸 수 없다. - 예를 들어, 1.y에서 1.y+1로 업그레이드할 수 있지만, 1.y에서 1.y+2로 업그레이드할 수는 없다. ## 업그레이드할 버전 결정 -최신의 안정 버전인 1.19를 찾는다. +OS 패키지 관리자를 사용하여 최신의 안정 버전({{< skew latestVersion >}})을 찾는다. {{< tabs name="k8s_install_versions" >}} {{% tab name="Ubuntu, Debian 또는 HypriotOS" %}} apt update apt-cache madison kubeadm - # 목록에서 최신 버전 1.19를 찾는다 - # 1.19.x-00과 같아야 한다. 여기서 x는 최신 패치이다. + # 목록에서 최신 버전({{< skew latestVersion >}})을 찾는다 + # {{< skew latestVersion >}}.x-00과 같아야 한다. 여기서 x는 최신 패치이다. {{% /tab %}} {{% tab name="CentOS, RHEL 또는 Fedora" %}} yum list --showduplicates kubeadm --disableexcludes=kubernetes - # 목록에서 최신 버전 1.19를 찾는다 - # 1.19.x-0과 같아야 한다. 여기서 x는 최신 패치이다. + # 목록에서 최신 버전({{< skew latestVersion >}})을 찾는다 + # {{< skew latestVersion >}}.x-0과 같아야 한다. 여기서 x는 최신 패치이다. {{% /tab %}} {{< /tabs >}} ## 컨트롤 플레인 노드 업그레이드 -### 첫 번째 컨트롤 플레인 노드 업그레이드 +컨트롤 플레인 노드의 업그레이드 절차는 한 번에 한 노드씩 실행해야 한다. +먼저 업그레이드할 컨트롤 플레인 노드를 선택한다. `/etc/kubernetes/admin.conf` 파일이 있어야 한다. -- 첫 번째 컨트롤 플레인 노드에서 kubeadm을 업그레이드한다. +### "kubeadm upgrade" 호출 + +**첫 번째 컨트롤 플레인 노드의 경우** + +- kubeadm 업그레이드 {{< tabs name="k8s_install_kubeadm_first_cp" >}} {{% tab name="Ubuntu, Debian 또는 HypriotOS" %}} - # 1.19.x-00에서 x를 최신 패치 버전으로 바꾼다. + # {{< skew latestVersion >}}.x-00에서 x를 최신 패치 버전으로 바꾼다. apt-mark unhold kubeadm && \ - apt-get update && apt-get install -y kubeadm=1.19.x-00 && \ + apt-get update && apt-get install -y kubeadm={{< skew latestVersion >}}.x-00 && \ apt-mark hold kubeadm - # apt-get 버전 1.1부터 다음 방법을 사용할 수도 있다 apt-get update && \ - apt-get install -y --allow-change-held-packages kubeadm=1.19.x-00 + apt-get install -y --allow-change-held-packages kubeadm={{< skew latestVersion >}}.x-00 {{% /tab %}} {{% tab name="CentOS, RHEL 또는 Fedora" %}} - # 1.19.x-0에서 x를 최신 패치 버전으로 바꾼다. - yum install -y kubeadm-1.19.x-0 --disableexcludes=kubernetes + # {{< skew latestVersion >}}.x-0에서 x를 최신 패치 버전으로 바꾼다. + yum install -y kubeadm-{{< skew latestVersion >}}.x-0 --disableexcludes=kubernetes {{% /tab %}} {{< /tabs >}} @@ -90,63 +93,10 @@ min-kubernetes-server-version: 1.19 kubeadm version ``` -- 컨트롤 플레인 노드를 드레인(drain)한다. +- 업그레이드 계획을 확인한다. ```shell - # 을 컨트롤 플레인 노드 이름으로 바꾼다. - kubectl drain --ignore-daemonsets - ``` - -- 컨트롤 플레인 노드에서 다음을 실행한다. - - ```shell - sudo kubeadm upgrade plan - ``` - - 다음과 비슷한 출력이 표시되어야 한다. - - ``` - [upgrade/config] Making sure the configuration is correct: - [upgrade/config] Reading configuration from the cluster... - [upgrade/config] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml' - [preflight] Running pre-flight checks. - [upgrade] Running cluster health checks - [upgrade] Fetching available versions to upgrade to - [upgrade/versions] Cluster version: v1.18.4 - [upgrade/versions] kubeadm version: v1.19.0 - [upgrade/versions] Latest stable version: v1.19.0 - [upgrade/versions] Latest version in the v1.18 series: v1.19.0 - - Components that must be upgraded manually after you have upgraded the control plane with 'kubeadm upgrade apply': - COMPONENT CURRENT AVAILABLE - Kubelet 1 x v1.18.4 v1.19.0 - - Upgrade to the latest version in the v1.18 series: - - COMPONENT CURRENT AVAILABLE - API Server v1.18.4 v1.19.0 - Controller Manager v1.18.4 v1.19.0 - Scheduler v1.18.4 v1.19.0 - Kube Proxy v1.18.4 v1.19.0 - CoreDNS 1.6.7 1.7.0 - Etcd 3.4.3-0 3.4.7-0 - - You can now apply the upgrade by executing the following command: - - kubeadm upgrade apply v1.19.0 - - _____________________________________________________________________ - - 아래 표는 이 버전의 kubeadm에서 이해하는 컴포넌트 구성의 현재 상태를 보여준다. - "MANUAL UPGRADE REQUIRED" 열에 "yes" 표시가 있는 구성은 성공적인 업그레이드를 - 수행하기 전에 수동 구성 업그레이드 또는 kubeadm 기본값으로 재설정이 필요하다. 수동으로 - 업그레이드할 버전은 "PREFERRED VERSION" 열에 표시된다. - - API GROUP CURRENT VERSION PREFERRED VERSION MANUAL UPGRADE REQUIRED - kubeproxy.config.k8s.io v1alpha1 v1alpha1 no - kubelet.config.k8s.io v1beta1 v1beta1 no - _____________________________________________________________________ - + kubeadm upgrade plan ``` 이 명령은 클러스터를 업그레이드할 수 있는지를 확인하고, 업그레이드할 수 있는 버전을 가져온다. @@ -168,90 +118,13 @@ min-kubernetes-server-version: 1.19 ```shell # 이 업그레이드를 위해 선택한 패치 버전으로 x를 바꾼다. - sudo kubeadm upgrade apply v1.19.x + sudo kubeadm upgrade apply v{{< skew latestVersion >}}.x ``` - - 다음과 비슷한 출력이 표시되어야 한다. + 명령이 완료되면 다음을 확인해야 한다. ``` - [upgrade/config] Making sure the configuration is correct: - [upgrade/config] Reading configuration from the cluster... - [upgrade/config] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml' - [preflight] Running pre-flight checks. - [upgrade] Running cluster health checks - [upgrade/version] You have chosen to change the cluster version to "v1.19.0" - [upgrade/versions] Cluster version: v1.18.4 - [upgrade/versions] kubeadm version: v1.19.0 - [upgrade/confirm] Are you sure you want to proceed with the upgrade? [y/N]: y - [upgrade/prepull] Pulling images required for setting up a Kubernetes cluster - [upgrade/prepull] This might take a minute or two, depending on the speed of your internet connection - [upgrade/prepull] You can also perform this action in beforehand using 'kubeadm config images pull' - [upgrade/apply] Upgrading your Static Pod-hosted control plane to version "v1.19.0"... - Static pod: kube-apiserver-kind-control-plane hash: b4c8effe84b4a70031f9a49a20c8b003 - Static pod: kube-controller-manager-kind-control-plane hash: 9ac092f0ca813f648c61c4d5fcbf39f2 - Static pod: kube-scheduler-kind-control-plane hash: 7da02f2c78da17af7c2bf1533ecf8c9a - [upgrade/etcd] Upgrading to TLS for etcd - Static pod: etcd-kind-control-plane hash: 171c56cd0e81c0db85e65d70361ceddf - [upgrade/staticpods] Preparing for "etcd" upgrade - [upgrade/staticpods] Renewing etcd-server certificate - [upgrade/staticpods] Renewing etcd-peer certificate - [upgrade/staticpods] Renewing etcd-healthcheck-client certificate - [upgrade/staticpods] Moved new manifest to "/etc/kubernetes/manifests/etcd.yaml" and backed up old manifest to "/etc/kubernetes/tmp/kubeadm-backup-manifests-2020-07-13-16-24-16/etcd.yaml" - [upgrade/staticpods] Waiting for the kubelet to restart the component - [upgrade/staticpods] This might take a minute or longer depending on the component/version gap (timeout 5m0s) - Static pod: etcd-kind-control-plane hash: 171c56cd0e81c0db85e65d70361ceddf - Static pod: etcd-kind-control-plane hash: 171c56cd0e81c0db85e65d70361ceddf - Static pod: etcd-kind-control-plane hash: 59e40b2aab1cd7055e64450b5ee438f0 - [apiclient] Found 1 Pods for label selector component=etcd - [upgrade/staticpods] Component "etcd" upgraded successfully! - [upgrade/etcd] Waiting for etcd to become available - [upgrade/staticpods] Writing new Static Pod manifests to "/etc/kubernetes/tmp/kubeadm-upgraded-manifests999800980" - [upgrade/staticpods] Preparing for "kube-apiserver" upgrade - [upgrade/staticpods] Renewing apiserver certificate - [upgrade/staticpods] Renewing apiserver-kubelet-client certificate - [upgrade/staticpods] Renewing front-proxy-client certificate - [upgrade/staticpods] Renewing apiserver-etcd-client certificate - [upgrade/staticpods] Moved new manifest to "/etc/kubernetes/manifests/kube-apiserver.yaml" and backed up old manifest to "/etc/kubernetes/tmp/kubeadm-backup-manifests-2020-07-13-16-24-16/kube-apiserver.yaml" - [upgrade/staticpods] Waiting for the kubelet to restart the component - [upgrade/staticpods] This might take a minute or longer depending on the component/version gap (timeout 5m0s) - Static pod: kube-apiserver-kind-control-plane hash: b4c8effe84b4a70031f9a49a20c8b003 - Static pod: kube-apiserver-kind-control-plane hash: b4c8effe84b4a70031f9a49a20c8b003 - Static pod: kube-apiserver-kind-control-plane hash: b4c8effe84b4a70031f9a49a20c8b003 - Static pod: kube-apiserver-kind-control-plane hash: b4c8effe84b4a70031f9a49a20c8b003 - Static pod: kube-apiserver-kind-control-plane hash: f717874150ba572f020dcd89db8480fc - [apiclient] Found 1 Pods for label selector component=kube-apiserver - [upgrade/staticpods] Component "kube-apiserver" upgraded successfully! - [upgrade/staticpods] Preparing for "kube-controller-manager" upgrade - [upgrade/staticpods] Renewing controller-manager.conf certificate - [upgrade/staticpods] Moved new manifest to "/etc/kubernetes/manifests/kube-controller-manager.yaml" and backed up old manifest to "/etc/kubernetes/tmp/kubeadm-backup-manifests-2020-07-13-16-24-16/kube-controller-manager.yaml" - [upgrade/staticpods] Waiting for the kubelet to restart the component - [upgrade/staticpods] This might take a minute or longer depending on the component/version gap (timeout 5m0s) - Static pod: kube-controller-manager-kind-control-plane hash: 9ac092f0ca813f648c61c4d5fcbf39f2 - Static pod: kube-controller-manager-kind-control-plane hash: b155b63c70e798b806e64a866e297dd0 - [apiclient] Found 1 Pods for label selector component=kube-controller-manager - [upgrade/staticpods] Component "kube-controller-manager" upgraded successfully! - [upgrade/staticpods] Preparing for "kube-scheduler" upgrade - [upgrade/staticpods] Renewing scheduler.conf certificate - [upgrade/staticpods] Moved new manifest to "/etc/kubernetes/manifests/kube-scheduler.yaml" and backed up old manifest to "/etc/kubernetes/tmp/kubeadm-backup-manifests-2020-07-13-16-24-16/kube-scheduler.yaml" - [upgrade/staticpods] Waiting for the kubelet to restart the component - [upgrade/staticpods] This might take a minute or longer depending on the component/version gap (timeout 5m0s) - Static pod: kube-scheduler-kind-control-plane hash: 7da02f2c78da17af7c2bf1533ecf8c9a - Static pod: kube-scheduler-kind-control-plane hash: 260018ac854dbf1c9fe82493e88aec31 - [apiclient] Found 1 Pods for label selector component=kube-scheduler - [upgrade/staticpods] Component "kube-scheduler" upgraded successfully! - [upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace - [kubelet] Creating a ConfigMap "kubelet-config-1.19" in namespace kube-system with the configuration for the kubelets in the cluster - [kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml" - [bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to get nodes - [bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials - [bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token - [bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster - W0713 16:26:14.074656 2986 dns.go:282] the CoreDNS Configuration will not be migrated due to unsupported version of CoreDNS. The existing CoreDNS Corefile configuration and deployment has been retained. - [addons] Applied essential addon: CoreDNS - [addons] Applied essential addon: kube-proxy - - [upgrade/successful] SUCCESS! Your cluster was upgraded to "v1.19.0". Enjoy! + [upgrade/successful] SUCCESS! Your cluster was upgraded to "v{{< skew latestVersion >}}.x". Enjoy! [upgrade/kubelet] Now that your control plane is upgraded, please proceed with upgrading your kubelets if you haven't already done so. ``` @@ -264,14 +137,7 @@ min-kubernetes-server-version: 1.19 CNI 제공자가 데몬셋(DaemonSet)으로 실행되는 경우 추가 컨트롤 플레인 노드에는 이 단계가 필요하지 않다. -- 컨트롤 플레인 노드에 적용된 cordon을 해제한다. - - ```shell - # 을 컨트롤 플레인 노드 이름으로 바꾼다. - kubectl uncordon - ``` - -### 추가 컨트롤 플레인 노드 업그레이드 +**다른 컨트롤 플레인 노드의 경우** 첫 번째 컨트롤 플레인 노드와 동일하지만 다음을 사용한다. @@ -285,36 +151,58 @@ sudo kubeadm upgrade node sudo kubeadm upgrade apply ``` -또한 `sudo kubeadm upgrade plan` 은 필요하지 않다. +`kubeadm upgrade plan` 을 호출하고 CNI 공급자 플러그인을 업그레이드할 필요가 없다. + +### 노드 드레인 + +- Prepare the node for maintenance by marking it unschedulable and evicting the workloads: + + ```shell + # 을 드레인하는 노드의 이름으로 바꾼다. + kubectl drain --ignore-daemonsets + ``` ### kubelet과 kubectl 업그레이드 -모든 컨트롤 플레인 노드에서 kubelet 및 kubectl을 업그레이드한다. +- 모든 컨트롤 플레인 노드에서 kubelet 및 kubectl을 업그레이드한다. {{< tabs name="k8s_install_kubelet" >}} -{{% tab name="Ubuntu, Debian 또는 HypriotOS" %}} - # 1.19.x-00의 x를 최신 패치 버전으로 바꾼다 +{{< tab name="Ubuntu, Debian 또는 HypriotOS" >}} + 
>
+    # {{< skew latestVersion >}}.x-00의 x를 최신 패치 버전으로 바꾼다
     apt-mark unhold kubelet kubectl && \
-    apt-get update && apt-get install -y kubelet=1.19.x-00 kubectl=1.19.x-00 && \
+    apt-get update && apt-get install -y kubelet={{< skew latestVersion >}}.x-00 kubectl={{< skew latestVersion >}}.x-00 && \
     apt-mark hold kubelet kubectl
     -
     # apt-get 버전 1.1부터 다음 방법을 사용할 수도 있다
     apt-get update && \
-    apt-get install -y --allow-change-held-packages kubelet=1.19.x-00 kubectl=1.19.x-00
-{{% /tab %}}
-{{% tab name="CentOS, RHEL 또는 Fedora" %}}
-    # 1.19.x-0에서 x를 최신 패치 버전으로 바꾼다
-    yum install -y kubelet-1.19.x-0 kubectl-1.19.x-0 --disableexcludes=kubernetes
-{{% /tab %}}
+    apt-get install -y --allow-change-held-packages kubelet={{< skew latestVersion >}}.x-00 kubectl={{< skew latestVersion >}}.x-00
+
+{{< /tab >}} +{{< tab name="CentOS, RHEL 또는 Fedora" >}} + 
+    # {{< skew latestVersion >}}.x-0에서 x를 최신 패치 버전으로 바꾼다
+    yum install -y kubelet-{{< skew latestVersion >}}.x-0 kubectl-{{< skew latestVersion >}}.x-0 --disableexcludes=kubernetes
+
+{{< /tab >}} {{< /tabs >}} -kubelet을 다시 시작한다. +- kubelet을 다시 시작한다. ```shell sudo systemctl daemon-reload sudo systemctl restart kubelet ``` +### 노드 uncordon + +- 노드를 스케줄 가능으로 표시하여 노드를 다시 온라인 상태로 전환한다. + + ```shell + # 을 드레인하는 노드의 이름으로 바꾼다. + kubectl uncordon + ``` + ## 워커 노드 업그레이드 워커 노드의 업그레이드 절차는 워크로드를 실행하는 데 필요한 최소 용량을 보장하면서, @@ -326,18 +214,18 @@ sudo systemctl restart kubelet {{< tabs name="k8s_install_kubeadm_worker_nodes" >}} {{% tab name="Ubuntu, Debian 또는 HypriotOS" %}} - # 1.19.x-00의 x를 최신 패치 버전으로 바꾼다 + # {{< skew latestVersion >}}.x-00의 x를 최신 패치 버전으로 바꾼다 apt-mark unhold kubeadm && \ - apt-get update && apt-get install -y kubeadm=1.19.x-00 && \ + apt-get update && apt-get install -y kubeadm={{< skew latestVersion >}}.x-00 && \ apt-mark hold kubeadm - # apt-get 버전 1.1부터 다음 방법을 사용할 수도 있다 apt-get update && \ - apt-get install -y --allow-change-held-packages kubeadm=1.19.x-00 + apt-get install -y --allow-change-held-packages kubeadm={{< skew latestVersion >}}.x-00 {{% /tab %}} {{% tab name="CentOS, RHEL 또는 Fedora" %}} - # 1.19.x-0에서 x를 최신 패치 버전으로 바꾼다 - yum install -y kubeadm-1.19.x-0 --disableexcludes=kubernetes + # {{< skew latestVersion >}}.x-0에서 x를 최신 패치 버전으로 바꾼다 + yum install -y kubeadm-{{< skew latestVersion >}}.x-0 --disableexcludes=kubernetes {{% /tab %}} {{< /tabs >}} @@ -350,17 +238,9 @@ sudo systemctl restart kubelet kubectl drain --ignore-daemonsets ``` - 다음과 비슷한 출력이 표시되어야 한다. +### kubeadm 업그레이드 호출 - ``` - node/ip-172-31-85-18 cordoned - WARNING: ignoring DaemonSet-managed Pods: kube-system/kube-proxy-dj7d7, kube-system/weave-net-z65qx - node/ip-172-31-85-18 drained - ``` - -### kubelet 구성 업그레이드 - -1. 다음의 명령을 호출한다. +- 워커 노드의 경우 로컬 kubelet 구성을 업그레이드한다. ```shell sudo kubeadm upgrade node @@ -368,22 +248,22 @@ sudo systemctl restart kubelet ### kubelet과 kubectl 업그레이드 -- 모든 워커 노드에서 kubelet 및 kubectl을 업그레이드한다. +- kubelet 및 kubectl을 업그레이드한다. {{< tabs name="k8s_kubelet_and_kubectl" >}} {{% tab name="Ubuntu, Debian 또는 HypriotOS" %}} - # 1.19.x-00의 x를 최신 패치 버전으로 바꾼다 + # {{< skew latestVersion >}}.x-00의 x를 최신 패치 버전으로 바꾼다 apt-mark unhold kubelet kubectl && \ - apt-get update && apt-get install -y kubelet=1.19.x-00 kubectl=1.19.x-00 && \ + apt-get update && apt-get install -y kubelet={{< skew latestVersion >}}.x-00 kubectl={{< skew latestVersion >}}.x-00 && \ apt-mark hold kubelet kubectl - # apt-get 버전 1.1부터 다음 방법을 사용할 수도 있다 apt-get update && \ - apt-get install -y --allow-change-held-packages kubelet=1.19.x-00 kubectl=1.19.x-00 + apt-get install -y --allow-change-held-packages kubelet={{< skew latestVersion >}}.x-00 kubectl={{< skew latestVersion >}}.x-00 {{% /tab %}} {{% tab name="CentOS, RHEL 또는 Fedora" %}} - # 1.19.x-0에서 x를 최신 패치 버전으로 바꾼다 - yum install -y kubelet-1.19.x-0 kubectl-1.19.x-0 --disableexcludes=kubernetes + # {{< skew latestVersion >}}.x-0에서 x를 최신 패치 버전으로 바꾼다 + yum install -y kubelet-{{< skew latestVersion >}}.x-0 kubectl-{{< skew latestVersion >}}.x-0 --disableexcludes=kubernetes {{% /tab %}} {{< /tabs >}} @@ -405,7 +285,8 @@ sudo systemctl restart kubelet ## 클러스터 상태 확인 -모든 노드에서 kubelet을 업그레이드 한 후 kubectl이 클러스터에 접근할 수 있는 곳에서 다음의 명령을 실행하여 모든 노드를 다시 사용할 수 있는지 확인한다. +모든 노드에서 kubelet을 업그레이드한 후 kubectl이 클러스터에 접근할 수 있는 곳에서 다음의 명령을 실행하여 +모든 노드를 다시 사용할 수 있는지 확인한다. ```shell kubectl get nodes @@ -413,8 +294,6 @@ kubectl get nodes 모든 노드에 대해 `STATUS` 열에 `Ready` 가 표시되어야 하고, 버전 번호가 업데이트되어 있어야 한다. - - ## 장애 상태에서의 복구 예를 들어 `kubeadm upgrade` 를 실행하는 중에 예기치 못한 종료로 인해 업그레이드가 실패하고 롤백하지 않는다면, `kubeadm upgrade` 를 다시 실행할 수 있다. @@ -423,7 +302,6 @@ kubectl get nodes 잘못된 상태에서 복구하기 위해, 클러스터가 실행 중인 버전을 변경하지 않고 `kubeadm upgrade apply --force` 를 실행할 수도 있다. 업그레이드하는 동안 kubeadm은 `/etc/kubernetes/tmp` 아래에 다음과 같은 백업 폴더를 작성한다. - - `kubeadm-backup-etcd--
--kube-reserved mapStringString     Default: <None>
A set of `=` (e.g. `cpu=200m,memory=500Mi,ephemeral-storage=1Gi`) pairs that describe resources reserved for kubernetes system components. Currently `cpu`, `memory` and local `ephemeral-storage` for root file system are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)A set of `=` (e.g. `cpu=200m,memory=500Mi,ephemeral-storage=1Gi,pid='100'`) pairs that describe resources reserved for kubernetes system components. Currently `cpu`, `memory` and local `ephemeral-storage` for root file system are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
--system-reserved mapStringString     Default: \
A set of `=` (e.g. `cpu=200m,memory=500Mi,ephemeral-storage=1Gi`) pairs that describe resources reserved for non-kubernetes components. Currently only `cpu` and `memory` are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)A set of `=` (e.g. `cpu=200m,memory=500Mi,ephemeral-storage=1Gi,pid='100'`) pairs that describe resources reserved for non-kubernetes components. Currently only `cpu` and `memory` are supported. See http://kubernetes.io/docs/user-guide/compute-resources for more detail. (DEPRECATED: This parameter should be set via the config file specified by the Kubelet's `--config` flag. See https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/ for more information.)
- 设置为 true 表示添加文件目录到 header 中 + 设置为 true 表示添加文件目录到日志信息头中
--cache-dir string     默认值: "~/.kube/http-cache"--cache-dir string     默认值: "$HOME/.kube/cache"
- 默认 HTTP 缓存目录 + 默认缓存目录
--cloud-provider-gce-l7lb-src-cidrs cidrs     默认值: 130.211.0.0/22,35.191.0.0/16
+ + 在 GCE 防火墙中开放的 CIDR，用来进行 L7 LB 流量代理和健康检查。 +
--cloud-provider-gce-lb-src-cidrs cidrs     默认值: 130.211.0.0/22,209.85.152.0/22,209.85.204.0/22,35.191.0.0/16
- 在 GCE 防火墙中打开 CIDR，以进行 LB 流量代理和运行状况检查。 + 在 GCE 防火墙中开放的 CIDR，用来进行 L4 LB 流量代理和健康检查。
--one-output
+ + 如果为 true，则只将日志写入初始严重级别（而不是同时写入所有较低的严重级别）。 +
--password string지정된 경우, 해당 네임스페이스가 CLI 요청의 범위가 됨
--one-output
true이면, 로그를 기본 심각도 수준으로만 기록한다(그렇지 않으면 각각의 더 낮은 심각도 수준에도 기록함).
--password string